universal-dev-standards 6.14.0-beta.3 → 6.14.0-beta.5

package/bin/uds.js

@@ -106,9 +106,13 @@ program
     // Fallback to OS environment variable detection
     setLanguage(detectLanguage(null));
   })
-  .hook('postAction', async (thisCommand) => {
+  .hook('postAction', async (thisCommand, actionCommand) => {
     const cmd = thisCommand.name();
     if (!shouldCheckUpdateForCommand(cmd)) return;
+    // XSPEC-454 R3: --offline promises no network. This hook runs after every command and
+    // asks the npm registry for the latest version; it ignored the flag, so `check --offline`
+    // and `audit --offline` still made that request (whenever the terminal was interactive).
+    if (actionCommand?.opts?.().offline) return;
     await printUpdateNoticeIfAvailable();
   });
 
@@ -253,6 +257,8 @@ program
   .option('--gh', 'Force gh CLI for submission')
   .option('--format <format>', 'Output format (json)')
   .option('--quiet', 'Summary only')
+  // XSPEC-454 R3: `check` and `update` already take --offline; `audit` rejected it with "unknown option".
+  .option('--offline', 'No network access at all: no CLI version check, and --report does not submit')
   .option('--score', 'Run multi-dimensional health score analysis')
   .option('--self', 'Self mode: analyze UDS repo itself (use with --score)')
   .option('--save', 'Save score snapshot for trend tracking (use with --score)')

package/bundled/ai/standards/ai-response-navigation.ai.yaml

@@ -3,14 +3,17 @@
 
 id: ai-response-navigation
 meta:
-  version: "1.3.0"
-  updated: "2026-08-17"
+  version: "1.4.0"
+  updated: "2026-10-05"
   source: core/ai-response-navigation.md
   description: >
     Every substantive AI response must include contextual next-step suggestions with recommended
     options (rules 1-6, required). Optional rules 7-11 govern the answer itself: lead with the
     finding, restate state across turns, no preamble, plain language as the subject, and a
-    trade-off on every option rather than only the recommended one.
+    trade-off on every option rather than only the recommended one. Rule 12 is controlled
+    language: one required clause (a simplified text keeps the writer's hedges, never turning
+    "might" into "is") and optional language-neutral plain-writing principles. It ships no
+    English dictionary.
 
 rules:
   - id: navigation-footer
@@ -127,6 +130,8 @@ rules:
       Distinct from lead-with-the-finding: that rule orders finding before evidence, this one
       governs register. A response can lead with its finding and still state that finding in
       vocabulary only its author holds; both leave the reader unable to act.
+      Putting a claim in plain words is a rewrite, and a rewrite is where hedges get lost: when
+      the claim was hedged, keep-uncertainty-markers (rule 12.1, required) governs.
     priority: optional
 
   - id: every-option-carries-its-trade-off
@@ -143,6 +148,41 @@ rules:
       costlier to read, so the 1-5 cap matters more, not less.
     priority: optional
 
+  # ── Rule 12 (v1.4.0): controlled language, split into two entries ──
+  # One rule in the Markdown, two entries here because priority is one value per entry and the
+  # two halves are not the same strength. 12.1 is required: it is the only part whose failure makes
+  # the reader believe something untrue, and it needs no calibration (compare before and after).
+  # 12.2 is optional: its ranges are uncalibrated starting points with no checker, and a required
+  # rule with a threshold nobody can verify produces mechanical compliance.
+  # Takes the principles of ASD-STE100 and none of its English dictionary or tense rules.
+
+  - id: keep-uncertainty-markers
+    trigger: shortening, simplifying, rewriting or translating text for a reader who is not its author
+    instruction: >
+      Keep the writer's hedges (might, could, probably, appears to, not yet confirmed; 可能, 推斷,
+      大概, 尚未確認). Do NOT turn an uncertain claim into a certain one, do NOT drop a hedge to save
+      words, and do NOT add a fact the source did not state (an invented cause, an invented
+      "confirmed"). A shorter sentence is the goal; a more certain one is not allowed. A hedge may go
+      only when the claim has since been verified, and then the verification (what was checked, with
+      what result) takes its place; deleting the hedge alone is not verification.
+    priority: required
+
+  - id: controlled-language
+    trigger: writing for a non-specialist reader who has to judge or approve something from the text
+    instruction: >
+      Apply language-neutral plain-writing principles, each in the unit the language itself uses and
+      with no word list: (1) short sentences, one idea each, counted in the language's own unit —
+      as a starting range not a limit, roughly 15-25 words in English and 25-40 characters in
+      Chinese, calibrated per language and reader; (2) one name per thing for the whole text;
+      (3) a clear subject and the active voice, the passive only when the actor is unknown or
+      irrelevant; (4) one step, one action, as a numbered list; (5) few semicolons; (6) numbers carry
+      units. Do NOT use ASD-STE100's approved dictionary or tense restrictions: they depend on English
+      and do not apply to Chinese or other non-English text. Do NOT gauge non-English text with a
+      counter that splits on whitespace or ASCII; it reads a Chinese paragraph as one word and always
+      passes. Optional because the ranges are uncalibrated and unchecked; keep-uncertainty-markers is
+      the part that does not bend.
+    priority: optional
+
 related_standards:
   - ai-command-behavior
   - ai-instruction-standards

package/bundled/ai/standards/checkin-standards.ai.yaml

@@ -12,7 +12,7 @@ standard:
     - "Documentation: docs updated, CHANGELOG updated"
 
   meta:
-    version: "2.2.0"
+    version: "2.2.1"
     updated: "2026-07-09"
     source: core/checkin-standards.md
     description: Quality gates that must be passed before committing code
@@ -167,10 +167,29 @@ standard:
 
 physical_spec:
   type: custom_script
+  # Fail-closed (XSPEC-444 R1): a failing lint or test script fails this check.
+  # A script that is genuinely absent is reported (printed) and does not fail it —
+  # the hint is printed only for that case, never as a fallback for a failure.
+  # Inline Node keeps it portable (sh and cmd.exe) and lets it read package.json
+  # instead of guessing from exit codes. The npm-init placeholder test script
+  # ("no test specified") counts as absent. A package.json that exists but cannot
+  # be read fails the check. No package.json (not an npm project): hint, no failure.
   validator:
     command: >
-      echo "🔍 UDS Check-in Gates:" && 
-      (npm run lint --if-present || echo "ℹ️ No lint script") && 
-      (npm test --if-present || echo "ℹ️ No test script") && 
-      (test -f CHANGELOG.md || echo "ℹ️ No CHANGELOG.md")
-    rule: "checkin_gates_passed"
+      node -e "
+      const fs=require('fs'),cp=require('child_process');
+      console.log('🔍 UDS Check-in Gates:');
+      let pkg;
+      try{pkg=JSON.parse(fs.readFileSync('package.json','utf8').replace(/^\uFEFF/,''))}
+      catch(e){if(e.code!=='ENOENT'){console.error('package.json cannot be read: '+e.message);process.exit(1)}}
+      if(pkg===undefined){console.log('ℹ️ No package.json - lint and tests were NOT run by this check (not an npm project)')}
+      else{const sc=(pkg&&pkg.scripts)||{};
+      for(const n of ['lint','test']){
+      const s=sc[n];
+      if(!s||(n==='test'&&/no test specified/.test(s))){console.log('ℹ️ No '+n+' script');continue}
+      const r=cp.spawnSync('npm run '+n,{stdio:'inherit',shell:true});
+      if(r.status!==0){console.error('FAILED: npm run '+n+' exited with '+r.status);process.exit(1)}
+      }}
+      if(!fs.existsSync('CHANGELOG.md'))console.log('ℹ️ No CHANGELOG.md');
+      "
+    rule: "checkin_gates_passed"

package/bundled/ai/standards/full-coverage-testing.ai.yaml

@@ -8,11 +8,11 @@ standard:
   description: Behavior-completeness full coverage paradigm replacing pyramid thresholds. Enforces anti-fake-test rules, STUB marker protocol, ratchet CI, and @ac traceability.
 
   meta:
-    version: "1.1.0"
-    updated: "2026-06-17"
+    version: "1.2.0"
+    updated: "2026-10-06"
     source: core/full-coverage-testing.md
     replaces: "testing pyramid thresholds (UT≥80%/IT≥70%/E2E happy-path-only)"
-    xspec: "XSPEC-178"
+    xspec: "XSPEC-178, XSPEC-444"
     description: AI-era full coverage paradigm — cost of writing tests equals cost of writing code, so there is no reason to set lower thresholds for any test layer.
 
   rationale: |
@@ -180,6 +180,32 @@ standard:
       trigger: '"// WARNING: STUB" marker found in src/'
       message: "[STUB-WARN] STUB markers found. Must remove before merging to main."
 
+  # XSPEC-444 R2 + R5: what UDS itself ships so these rules are not only prose.
+  # Everything here WARNS by default; `mode: block` in the policy file tightens it.
+  shipped_gates:
+    default_mode: warn
+    policy_file: ".standards/test-policy.json"   # optional; every list adds to the defaults
+    scripts:                                     # written to scripts/ by `uds init`; never overwritten
+      - file: scripts/check-anti-fake-tests.mjs
+        finds: [no-assertion, tautology, all-skipped]
+        exit: "0 clean | 1 findings | 2 could not judge (never a pass)"
+      - file: scripts/check-stubs.mjs
+        finds: [stub-marker, not-implemented, empty-function]
+        exit: "0 clean | 1 findings | 2 could not judge (never a pass)"
+    pre_commit_checks:                           # run by `uds check` on what is staged
+      - id: code-without-test
+        finds: "code files changed and no test file changed in the same commit"
+        exempt: ["pure rename (git R100)", "policy exempt entry WITH a reason"]
+      - id: unclassified-file
+        finds: "a changed file of a type UDS does not recognise — listed, never assumed fine, never blocks"
+    language_coverage:
+      test_files: [javascript, typescript, python, java, kotlin, scala, csharp, go, rust, ruby, elixir, php, swift, dart, lua, cpp]
+      empty_function: [javascript, typescript, python, go, rust, ruby, php]
+      other_languages: "listed as NOT scanned — never counted as clean"
+    not_implemented_yet:
+      - "ratchet on the number of unpaired changes (spec does not define the baseline location or unit)"
+      - "per-commit exemption reason (a pre-commit hook cannot read the commit message)"
+
   migration_from_pyramid:
     deprecated:
       - "UT ≥ 80% coverage threshold"
@@ -225,7 +251,22 @@ standard:
 
 physical_spec:
   type: custom_script
+  # XSPEC-444 R5: this used to check that two scripts EXIST — scripts UDS did not ship.
+  # Now it RUNS them (`uds check --standard full-coverage-testing`); a missing script,
+  # or a scanner that exits non-zero, fails the check. The scanners' findings go to stderr
+  # (`stdio: ['ignore', 2, 2]`) because a failing validator's stdout is not shown. Inline Node
+  # keeps it portable.
   validator:
     command: >
-      test -f scripts/check-stubs.sh && test -f scripts/check-anti-fake-tests.sh
-    rule: "xspec178_enforcement_scripts_present"
+      node -e "
+      const fs=require('fs'),cp=require('child_process');
+      let bad=0;
+      for(const f of ['check-anti-fake-tests.mjs','check-stubs.mjs']){
+      const p='scripts/'+f;
+      if(!fs.existsSync(p)){console.error('MISSING: '+p+' (uds update offers to write it)');bad=1;continue}
+      const r=cp.spawnSync(process.execPath,[p],{stdio:['ignore',2,2]});
+      if(r.status!==0){console.error('FAILED: '+p+' exited with '+r.status);bad=1}
+      }
+      process.exit(bad)
+      "
+    rule: "full_coverage_gate_scripts_clean"

package/bundled/ai/standards/pipeline-security-gates.ai.yaml

@@ -81,5 +81,9 @@ integration_points:
 physical_spec:
   type: custom_script
   validator:
-    command: "grep -r 'secrets\\|sast\\|sca\\|dast' .github/workflows/ .gitlab-ci.yml Jenkinsfile 2>/dev/null | head -1 || echo 'no-ci-pipeline'"
+    # Fail-closed (XSPEC-444 R1 class sweep): the old form piped grep into `head -1`
+    # and fell back to `|| echo 'no-ci-pipeline'` — `head` always exits 0, so the
+    # check passed even when no pipeline mentioned any security gate. -q makes grep's
+    # own exit status the verdict: 0 only when a gate keyword is found.
+    command: "grep -rqE 'secrets|sast|sca|dast' .github/workflows/ .gitlab-ci.yml Jenkinsfile 2>/dev/null"
     rule: "security_gates_in_pipeline"

package/bundled/core/ai-response-navigation.md

@@ -2,8 +2,8 @@
 
 > **Language**: English | [繁體中文](../locales/zh-TW/core/ai-response-navigation.md) | [简体中文](../locales/zh-CN/core/ai-response-navigation.md)
 
-**Version**: 1.3.0
-**Last Updated**: 2026-08-17
+**Version**: 1.4.0
+**Last Updated**: 2026-10-05
 **Applicability**: All projects using AI-assisted development
 **Scope**: universal
 **Industry Standards**: None (Emerging AI tool practice)
@@ -19,12 +19,15 @@ This standard defines navigation behavior for AI responses: every substantive AI
 
 **Solution**: A standard "Navigation Footer" appended to every substantive AI response, with contextual templates, recommendation marking, and adaptive option quantities.
 
-**Scope note (v1.2.0, extended in 1.3.0)**: Rules 1–6 govern what comes *after* the answer.
-Rules 7–11 — **all optional** — govern the answer itself: lead with the finding (R7), restate state
-across turns (R8), no preamble (R9), plain language as the subject (R10), and a trade-off on every
-option rather than only the recommended one (R11). They exist because a response can satisfy every
-one of Rules 1–6 while burying its conclusion, stating it in vocabulary only its author holds, or
-listing options the reader still has to compare themselves.
+**Scope note (v1.2.0, extended in 1.3.0 and 1.4.0)**: Rules 1–6 govern what comes *after* the answer.
+Rules 7–12 govern the answer itself: lead with the finding (R7), restate state
+across turns (R8), no preamble (R9), plain language as the subject (R10), a trade-off on every
+option rather than only the recommended one (R11), and controlled language (R12). Rules 7–11 are
+**optional**. **Rule 12 is the one exception, and only in part**: its clause that a simplified text
+must keep the writer's hedges is **required**; the rest of R12 is optional. They exist because a
+response can satisfy every one of Rules 1–6 while burying its conclusion, stating it in vocabulary
+only its author holds, listing options the reader still has to compare themselves, or being made
+easy to read by being made more certain than the evidence.
 
 ---
 
@@ -104,11 +107,14 @@ Tier names are **vendor-neutral**. Each tool or platform maps these tiers to its
 
 ---
 
-## The Answer Before the Navigation (Rules 7–11, Optional)
+## The Answer Before the Navigation (Rules 7–12)
 
 > **R7–R9 borrowed from**: [`ayghri/i-have-adhd`](https://github.com/ayghri/i-have-adhd) (MIT), 3 of its 10 rules.
 > **R10–R11 added in 1.3.0** from a different source — a user telling the author, twice in one session,
 > that a correct and complete answer was unreadable. R7–R9 had already shipped and were being followed.
+> **R12 added in 1.4.0** from a third source: a public suggestion to ask an LLM to write at "about
+> 80% of the way to" ASD-STE100, a controlled-English standard for technical documentation. Only its
+> principles are taken; its English dictionary and tense rules are not (see Rule 12).
 > The other 7 were dropped: 2 are already covered by Rules 1–2 above, and 5 either conflict with
 > this standard (its "no recap / no closers" contradicts Rule 1's Navigation Footer; its
 > "cap lists at 5" would truncate evidence tables and traversal denominators) or duplicate
@@ -119,10 +125,12 @@ itself — a response could bury its conclusion under a wall of evidence and sti
 in this standard by appending a correct Navigation Footer. A reader who cannot find the answer is
 not helped by being told what to do next.
 
-**These five rules are optional**, in the same sense as Rule 6: adopting projects are not required
+**Rules 7–11 are optional**, in the same sense as Rule 6: adopting projects are not required
 to enable them, and existing skills need no retroactive update. A project MAY promote any of them to
-required in its own configuration. What is *not* optional is that they have precise triggers — a rule
-phrased so loosely that it never fires is indistinguishable from not having the rule.
+required in its own configuration. **Rule 12 has one required clause** (12.1) and an optional rest
+(12.2); the split is argued inside the rule. What is *not* optional anywhere is that every rule has
+a precise trigger — a rule phrased so loosely that it never fires is indistinguishable from not
+having the rule.
 
 ### Rule 7: Lead With the Finding, Not the Process （Optional）
 
@@ -187,6 +195,11 @@ It governs which of the two is the subject of the sentence.
 response can lead with its finding and still state that finding in vocabulary only its author
 holds. Both failures leave the reader unable to act; they are different failures.
 
+**Plain wording must not buy its plainness with certainty.** Putting an explanation in the
+reader's words is a rewrite, and a rewrite is exactly where "might" quietly becomes "is". When R10
+is applied to a claim the writer had hedged, [Rule 12](#rule-12-controlled-language-partly-required)
+clause 12.1 (required) governs: the hedge stays.
+
 ### Rule 11: Every Option Carries Its Own Trade-off （Optional）
 
 **Trigger**: a response that asks the reader to choose between two or more courses of action.
@@ -214,6 +227,107 @@ worth stating, say so explicitly rather than leaving the column empty — an emp
 **Composes with Rule 4**: the option count stays bounded (1–5). Trade-offs make each option
 costlier to read, so this rule makes Rule 4's cap matter more, not less.
 
+### Rule 12: Controlled Language （Partly Required）
+
+**Trigger**: writing, rewriting, shortening, simplifying or translating text for a reader who is
+not its author — typically a non-specialist who has to judge or approve something from it.
+
+Controlled languages (writing rules that trade variety for predictability) make text easier to
+read. They have a known way of failing: the easiest sentence to read is a confident one, so
+"simplification" drifts toward certainty. This rule takes the principles of controlled writing and
+puts a hard stop on that drift.
+
+#### 12.1 A simplified text keeps its hedges （Required）
+
+A hedge is a word that tells the reader how far to trust a claim: *might, could, probably,
+appears to, not yet confirmed* — 可能、推斷、大概、尚未確認. It is information, not padding.
+
+When you shorten, simplify, rewrite or translate:
+
+- **Do not turn an uncertain claim into a certain one.** If the source says "might", the result
+  says "might" (or the equivalent in the language of the result).
+- **Do not drop the hedge to save words.** A shorter sentence is the goal; a more certain one is
+  not allowed.
+- **Do not add facts the source did not state** — an invented cause or an invented "confirmed" is
+  the same failure in another form.
+- A hedge may go only when the claim has since been verified, and then the verification (what was
+  checked, with what result) takes its place. Deleting the hedge alone is not verification.
+
+**Why this one is required and the rest are not**: it is the only part whose failure misleads the
+reader about what is true, rather than only making the text harder to read. It also needs no
+calibration — the check is a comparison of the text before and after, which a person or a model
+can do in any language — whereas every threshold below depends on language and audience.
+
+#### 12.2 Plain-writing principles （Optional）
+
+Apply these when the reader is a non-specialist. They are language-neutral: each is stated in the
+unit the language itself uses, with no word list.
+
+| Principle | What it asks for |
+|-----------|------------------|
+| **Short sentences, counted in the language's own unit** | One idea per sentence. As a *starting range*, not a limit: roughly 15–25 words in English, roughly 25–40 characters in Chinese. A sentence far beyond the range is a signal to split it, not a defect to count. Calibrate per language and per reader |
+| **One thing, one name** | Pick one name for each thing and use it for the whole text. Do not vary it for style: a reader who sees a second name assumes a second thing |
+| **A clear subject and the active voice** | Say who does what. The passive is acceptable when the actor is unknown or does not matter |
+| **One step, one action** | A procedure is a numbered list with one action per item, not a paragraph |
+| **Few semicolons** | A semicolon joins two ideas the reader must hold at once. Split into two sentences or a list |
+| **Numbers carry units** | "30 seconds", "3 files", "NT$1,200" — never a bare "30" |
+
+**Why optional**: the ranges above are starting points that have not been calibrated against
+reader outcomes, and no checker enforces them. A *required* rule with a threshold nobody can
+verify produces mechanical compliance — sentences split until they stop reading as sentences —
+and an expert reader may be better served by denser text. These principles are guidance a writer
+applies with judgment; 12.1 is the part that does not bend.
+
+#### What this rule does not take from ASD-STE100
+
+ASD-STE100's **approved dictionary** (one meaning per approved English word, with a closed list
+of allowed words) and its **tense restrictions** depend on the English language. They do not apply
+to Chinese or to other non-English text, and this standard ships **no word list of any kind**.
+Only the principles in 12.2 are taken, restated so that each can be applied in any language.
+
+For the same reason, do not use a counter that splits on whitespace or ASCII characters to gauge
+non-English text: it reads a Chinese paragraph as one "word" and passes it however long it is. A
+gauge that is always green on a language measures nothing in that language.
+
+#### Example: one passage, three rewrites, and one that is not allowed
+
+The example is in Chinese on purpose: the rule is language-neutral, and Chinese is where an
+English-only approach does not carry over. The three valid versions keep the hedges 可能 (might),
+推斷 (inferred) and 尚未 (not yet) and add no fact the original lacks.
+
+**Original**
+
+```text
+經過檢查，登入頁面在高流量時段回應變慢，這個問題可能是資料庫連線池被耗盡所造成的，我們推斷是因為上週的改版新增了一個會長時間佔用連線的查詢；目前尚未在測試環境重現，所以修復後的效果還需要被確認，建議在確認之前先不要對外宣布已經解決。
+```
+
+**About 80%** — shorter sentences, still reads as prose
+
+```text
+登入頁面在高流量時段回應變慢。原因可能是資料庫連線池被耗盡。我們推斷，上週改版新增了一個查詢，它會長時間佔用連線。這一點尚未在測試環境重現，修復後有沒有效，也還沒確認。確認之前，建議先不要對外宣布已經解決。
+```
+
+**Strict** — one idea per line, labelled, hedges kept
+
+```text
+登入頁面在高流量時段回應變慢。
+1. 原因：可能是資料庫連線池被耗盡。
+2. 推斷：上週改版新增了一個查詢，這個查詢可能長時間佔用連線。
+3. 狀態：尚未在測試環境重現。
+4. 修復效果：尚未確認。
+5. 建議：確認之前，不要對外宣布已解決。
+```
+
+**Not a valid rewrite** — shortest of all, and wrong
+
+```text
+登入頁面變慢，原因是資料庫連線池被耗盡，已確認由上週改版造成。
+```
+
+The last version is the shortest and the easiest to read, and it fails 12.1 twice: "可能" became
+a flat statement of cause, and "尚未重現" became "已確認" (confirmed), a fact the original never
+stated. A reader who approves a fix on the strength of it has been given something untrue.
+
 ---
 
 ## Contextual Templates
@@ -408,6 +522,7 @@ Each tool's integration layer is responsible for rendering the Navigation Footer
 | R9 | *(Optional)* No preamble. Closers still required — see R1 |
 | R10 | *(Optional)* Plain language is the subject; identifiers support it, after the claim |
 | R11 | *(Optional)* Every option states what it buys and costs — not only the recommended one |
+| R12 | **12.1 *(Required)***: when simplifying, shortening or translating, keep the hedges — never turn "might" into "is". 12.2 *(Optional)*: short sentences in the language's own unit, one name per thing, active voice, one action per step, few semicolons, numbers with units. No English dictionary — it does not carry to other languages |
 
 | Exempt | Not Exempt |
 |--------|------------|
@@ -431,6 +546,7 @@ Each tool's integration layer is responsible for rendering the Navigation Footer
 
 | Version | Date | Changes |
 |---------|------|---------|
+| 1.4.0 | 2026-10-05 | Add R12, controlled language, language-neutral. One clause is required (12.1: a simplified text keeps the writer's hedges — "might" does not become "is" and no unstated fact is added); the rest (12.2: sentence length in the language's own unit, one name per thing, active voice, one action per step, few semicolons, numbers with units) is optional, with the reason recorded. Takes the principles of ASD-STE100 and none of its English dictionary or tense rules, and says so in the standard. Ships a Chinese before/after example in three strictness levels plus one rewrite that is shorter and wrong. R10 now points to R12, because putting a claim in plain words is a rewrite and a rewrite is where hedges get lost |
 | 1.3.0 | 2026-08-17 | Add optional R10–R11. R10 governs register: plain language is the subject of the sentence and identifiers support it — distinct from R7, which orders finding before evidence, because a response can lead with its finding and still state it in vocabulary only its author holds. R11 extends Rule 2 from the recommended option to all of them: a list where only the recommendation is argued hands the comparison back to the reader, and an option shown without its cost reads as having none |
 | 1.2.0 | 2026-08-17 | Add optional R7–R9 governing the answer itself (lead with the finding, restate state, no preamble). Borrowed from `ayghri/i-have-adhd` (MIT), 3 of its 10 rules; the other 7 were dropped as duplicated by R1–R2, in conflict with R1, or covered by estimation-standards. Rules 1–6 could all be satisfied by a response that buries its conclusion — R7–R9 close that |
 | 1.1.0 | 2026-06-10 | Add R6 optional model tier annotation (`〔model: Fast\|Standard\|Capable〕`); vendor-neutral; no forced changes to existing skills |

package/bundled/core/full-coverage-testing.md

@@ -1,7 +1,7 @@
 # Full Coverage Testing Standards
 
 > **AI-optimized version**: `ai/standards/full-coverage-testing.ai.yaml`
-> **XSPEC**: XSPEC-178
+> **XSPEC**: XSPEC-178, XSPEC-444 (R2, R5 — pre-commit warnings and shipped gate scripts)
 > **Replaces**: Pyramid threshold model (UT≥80%, IT≥70%, E2E happy-path-only)
 
 ## Overview
@@ -228,6 +228,60 @@ Axis ⑨ is satisfied when this section declares all three: **derive** (Step 1 m
 
 ---
 
+## Pre-commit Warnings and Gate Scripts Shipped by UDS (XSPEC-444 R2, R5)
+
+The rules above used to depend on scripts the standard told you to write yourself. `uds init` now writes the scanners for you, and `uds check` — the command UDS's pre-commit hook runs — prints what they and one more check find. **All of it warns by default and blocks nothing**; tightening is opt-in (see "Warn first, tighten later").
+
+### The two scanners (`uds init` writes them to `scripts/`)
+
+| Script | Finds |
+|--------|-------|
+| `scripts/check-anti-fake-tests.mjs` | a test with **no assertion**; a test whose only assertions are **tautologies** (`expect(true).toBe(true)`, `assert 200 == 200`); a test file in which **every test is skipped or todo** |
+| `scripts/check-stubs.mjs` | `// WARNING: STUB` markers; a body that says it is **not implemented** (`raise NotImplementedError`, `todo!()`, `TODO()` ...) with no marker beside it; a named function whose body is **empty** with no marker beside it |
+
+- Pure Node, no dependencies, no test framework assumed. They are **your files**: edit them, wire them into CI. Run on its own, each exits non-zero when it finds something — `node scripts/check-stubs.mjs` is the pre-push/deploy gate this standard's deployment gates describe.
+- `uds init` never overwrites a file that exists, and `uds update` never overwrites one either; for a project initialised earlier, `uds update` offers to write them (the prompt defaults to no; `uds update -y` answers it yes).
+- With files staged they read only those files; with nothing staged (a CI run, a manual `uds check`) each walks the whole project — the walk stops at 200,000 files, and `uds check` gives each scanner 120 seconds (past that it reports "could not judge", never a pass) — so in a very large repository run them in CI rather than expecting them to be instant.
+- A placeholder is *declared* by `STUB` or `COVERAGE_EXEMPT` on its line or the three above; a declared placeholder is reported once, as its marker.
+- **Languages.** Test-file rules exist for JavaScript/TypeScript, Python, Java/Kotlin/Scala/C#, Go, Rust, Ruby, Elixir, PHP, Swift, Dart, Lua and C/C++. A test file in any **other** language is listed as "NOT scanned" — never counted as clean. Empty-function rules exist for JavaScript/TypeScript, Python, Go, Rust, Ruby and PHP; elsewhere markers and "not implemented" bodies are still found and the output says which languages had no empty-function rule.
+- They read text; they do not run your tests. A helper that asserts under a name the scanner cannot recognise is reported as "no-assertion": name it `assert*` / `verify*` / `expect*`, or list its pattern under `assertionPatterns` in the policy file.
+- Each run first checks itself against known fakes and known good tests; if that fails it exits `2` ("could not judge"), which is never a pass.
+
+### Code changed without a test (`uds check`, on staged changes)
+
+When files are staged for commit, `uds check` compares what changed:
+
+- code files changed and **no test file** changed in the same commit → a warning that lists the code files;
+- a changed file of a type UDS does not recognise → a warning that lists it and says how to classify it (never assumed fine, never blocks);
+- a deletion is not a change that needs a test; a **pure rename** (git's `R100`) and a path matching an `exempt` entry are exempt, and the output records the reason.
+
+With nothing staged (a CI run, a manual `uds check`) the diff check says nothing; the two scanners then look at the whole project.
+
+### The policy file `.standards/test-policy.json` (optional)
+
+Which paths are tests and which are code is data with defaults for the common ecosystems, not a list of frameworks. Every list **adds to** the defaults:
+
+```json
+{
+  "mode": "warn",
+  "testDirs": ["integration"],
+  "testPatterns": ["*.itest.*"],
+  "sourceExtensions": ["zig"],
+  "nonCodeExtensions": ["gradle"],
+  "ignore": ["generated/**"],
+  "exempt": [{ "pattern": "src/gen/**", "reason": "generated by protoc" }],
+  "assertionPatterns": ["\\bmustMatch\\w*\\s*\\("]
+}
+```
+
+An `exempt` entry without a `reason` is not honored and is reported: an exemption must say why.
+
+### Warn first, tighten later
+
+`"mode": "warn"` (the default) prints and lets the commit through. `"mode": "block"` makes `uds check` exit non-zero — and so stops the commit — when a scanner finds something, a scanner cannot judge, or code changed without a test. A file type UDS does not recognise never blocks. **Not implemented yet** (the specification does not say where a baseline would live or what it counts): a ratchet on the number of unpaired changes, and a per-commit exemption reason (a pre-commit hook cannot read the commit message).
+
+---
+
 ## Migration from Pyramid Model
 
 If your project previously used pyramid thresholds:
@@ -235,8 +289,8 @@ If your project previously used pyramid thresholds:
 1. **Delete** any hardcoded coverage thresholds from `jest.config.js` / `vitest.config.ts` (`coverageThreshold` option)
 2. **Install** `.coverage-baseline.json` with current coverage as the starting ratchet
 3. **Add** `scripts/check-coverage-ratchet.sh` to CI
-4. **Add** `scripts/check-stubs.sh` to deploy.sh and pre-push hook
-5. **Add** `scripts/check-anti-fake-tests.sh` to pre-commit or CI
+4. **Add** `scripts/check-stubs.mjs` to deploy.sh and pre-push hook (written by `uds init`; `uds update` offers it to an existing project)
+5. **Add** `scripts/check-anti-fake-tests.mjs` to pre-commit or CI (written by `uds init`; `uds check` already runs it and warns)
 
 The ratchet starts at your current coverage. From that point on, it can only increase.