universal-dev-standards 6.3.5 → 6.3.7

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.3.5
-translation_version: 6.3.5
+source_version: 6.3.7
+translation_version: 6.3.7
 last_synced: 2026-08-07
 status: current
 ---
@@ -17,6 +17,20 @@ status: current
 
 ## [Unreleased]
 
+## [6.3.7] - 2026-08-07
+
+### Fixed
+
+- **`uds deps` 只读 root 的 manifest，于是 monorepo 得到一个关于自己一部分的干净答案。** npm workspaces 会把声明放在不只一份 `package.json`，而这个命令只看了其中一份。实测于一个真实项目：回报 34 个依赖，实际声明 47 个——**在 workspace 里的那 13 个是隐形的，而其中一个带着 high 级别的公告**。**一个没有带着自己范围的计数，与一个完整的计数无从分辨**，而那正是这个命令存在要回报的失效。现在会从 `workspaces` 字段展开、检查每一份 manifest，并在报告中打印纳入了哪些 workspace，让分母自己带着范围。每一行漂移都标明它来自哪个 workspace——否则读者知道某个包漂移了，却不知道该去改哪一份 `package.json`。
+- 三个细节决定了「有覆盖 workspaces」与「看起来有覆盖」的差别。lockfile 的条目可能被 hoist 到 root，**也可能**嵌套在 workspace 底下，所以两处都查；只查一处会把另一处回报成「not present in package-lock.json」，而**一个被捏造出来的未知读起来像一个发现**。workspace 依赖于另一个 workspace 时是文件链接而非已发布包，因此跳过而不查询——问 npm 会得到 404 并被记成 unverifiable。以及，比「最后一段结尾一个 `*`」更复杂的 `workspaces` 模式现在会**大声失败**而非匹配一个子集：**静静地覆盖得比作者本意少，是同一个缺陷换个地方发生**。
+
+## [6.3.6] - 2026-08-07
+
+### Fixed
+
+- **6.3.5 说出货的标准全部可解析。它数的是 287 份里的 141 份。** 6.3.5 加的那道闸门**明文列举三个目录且不递归**，于是 `ai/options/`、`locales/`、`skills/`——三者皆由 `prepack` 打包进 tarball——都落在它的分母之外。6.3.5 发布后，那些目录里仍有 **10 份无法解析**，散在两个中文语系与 `skills/`。**一道自行列举范围的闸门，在下一次有人新增目录时就过期了**，因此它已改为走访整个 repo、检查构建与 vendor 路径之外的每一份 `.ai.yaml`——本 repo 为 759 份，而它先前宣称「完整」的是 423 份。
+- **另有 8 份能解析、但解析出来是错的——这是任何「能不能解析」的检查都看不见的。** `{UT:70%,IT:20%}` 不是映射：冒号后没有空格时，YAML 读到的是一个纯量键 `UT:70%`、其值为 null。未加引号的 `- git commit -m "feat: add model"` 会变成 `{'git commit -m "feat': 'add model"'}`。**它们通过每一项语法检查，同时交给 agent 一堆胡言。** 闸门现在也会拒绝「键含引号字符」或「冒号后无空格」——那是纯量被静默读成映射的指纹——两个分支皆以对照组实测而非假设。
+
 ## [6.3.5] - 2026-08-07
 
 ### Fixed

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.3.5 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.3.7 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-CN/ai/options/git-workflow/gitflow.ai.yaml

@@ -76,7 +76,7 @@ workflow:
       commands:
         - "# 进行变更..."
         - git add .
-        - git commit -m "feat: {描述}"
+        - 'git commit -m "feat: {描述}"'
 
     - step: 合併到 develop
       commands:
@@ -114,7 +114,7 @@ workflow:
     - step: 修正并完成
       commands:
         - "# 修正問題"
-        - git commit -m "fix: {描述}"
+        - 'git commit -m "fix: {描述}"'
         - git checkout main
         - git merge --no-ff hotfix/{問題}
         - git tag -a v{版本}
@@ -126,8 +126,8 @@ quick_reference:
   branches:
     columns: [分支, 用途, 来源, 合併到]
     rows:
-      - [main, 正式發布, -, -]
-      - [develop, 集成, main, -]
+      - [main, 正式發布, "-", "-"]
+      - [develop, 集成, main, "-"]
       - [feature/*, 新功能, develop, develop]
       - [release/*, 發布准备, develop, "main, develop"]
       - [hotfix/*, 緊急修正, main, "main, develop"]

package/bundled/locales/zh-CN/ai/options/git-workflow/github-flow.ai.yaml

@@ -53,7 +53,7 @@ workflow:
     commands:
       - "# 进行变更..."
       - git add .
-      - git commit -m "feat: {描述}"
+      - 'git commit -m "feat: {描述}"'
 
   - step: 推送并建立 PR
     description: 推送到遠端并開啟 Pull Request

package/bundled/locales/zh-CN/ai/options/git-workflow/merge-commit.ai.yaml

@@ -44,9 +44,9 @@ workflow:
 
   - step: 进行多次有意義的提交
     commands:
-      - git commit -m "feat: add user model"
-      - git commit -m "feat: add user service"
-      - git commit -m "test: add user tests"
+      - 'git commit -m "feat: add user model"'
+      - 'git commit -m "feat: add user service"'
+      - 'git commit -m "test: add user tests"'
 
   - step: 使用合併提交合併
     commands:

package/bundled/locales/zh-CN/ai/options/git-workflow/rebase-ff.ai.yaml

@@ -49,8 +49,8 @@ workflow:
 
   - step: 进行提交
     commands:
-      - git commit -m "feat: implement feature part 1"
-      - git commit -m "feat: implement feature part 2"
+      - 'git commit -m "feat: implement feature part 1"'
+      - 'git commit -m "feat: implement feature part 2"'
 
   - step: 变基到最新 main
     commands:

package/bundled/locales/zh-CN/ai/options/git-workflow/squash-merge.ai.yaml

@@ -43,9 +43,9 @@ workflow:
 
   - step: 进行多次提交
     commands:
-      - git commit -m "wip: initial implementation"
-      - git commit -m "wip: add tests"
-      - git commit -m "wip: fix lint errors"
+      - 'git commit -m "wip: initial implementation"'
+      - 'git commit -m "wip: add tests"'
+      - 'git commit -m "wip: fix lint errors"'
 
   - step: 壓縮合併（通過 GitHub/GitLab）
     commands:
@@ -56,7 +56,7 @@ workflow:
     commands:
       - git checkout main
       - git merge --squash feature/{功能名称}
-      - git commit -m "feat(scope): 總結消息 (#PR号)"
+      - 'git commit -m "feat(scope): 總結消息 (#PR号)"'
 
 example:
   before: |

package/bundled/locales/zh-CN/ai/options/git-workflow/trunk-based.ai.yaml

@@ -61,7 +61,7 @@ workflow:
       commands:
         - "# 进行小而聚焦的变更"
         - git add .
-        - git commit -m "feat: {描述}"
+        - 'git commit -m "feat: {描述}"'
 
     - step: 推送到 trunk
       commands:
@@ -79,7 +79,7 @@ workflow:
       commands:
         - "# 进行变更..."
         - git add .
-        - git commit -m "feat: {描述}"
+        - 'git commit -m "feat: {描述}"'
 
     - step: 快速合併
       commands:

package/bundled/locales/zh-CN/ai/options/testing/security-testing.ai.yaml

@@ -157,4 +157,4 @@ quick_reference:
       - [动态分析, DAST, 预备環境, OWASP ZAP/Burp]
       - [相依套件掃描, SCA, 每次建置, Snyk/Dependabot]
       - [滲透测试, Pentest, 每年, 人工/專业]
-      - [机密掃描, -, 提交前, GitLeaks/TruffleHog]
+      - [机密掃描, "-", 提交前, GitLeaks/TruffleHog]

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.3.5
-translation_version: 6.3.5
+source_version: 6.3.7
+translation_version: 6.3.7
 last_synced: 2026-08-07
 status: current
 ---
@@ -17,6 +17,20 @@ status: current
 
 ## [Unreleased]
 
+## [6.3.7] - 2026-08-07
+
+### Fixed
+
+- **`uds deps` 只讀 root 的 manifest，於是 monorepo 得到一個關於自己一部分的乾淨答案。** npm workspaces 會把宣告放在不只一份 `package.json`，而這個指令只看了其中一份。實測於一個真實專案：回報 34 個相依，實際宣告 47 個——**在 workspace 裡的那 13 個是隱形的，而其中一個帶著 high 等級的公告**。**一個沒有帶著自己範圍的計數，與一個完整的計數無從分辨**，而那正是這個指令存在要回報的失效。現在會從 `workspaces` 欄位展開、檢查每一份 manifest，並在報告中印出納入了哪些 workspace，讓分母自己帶著範圍。每一列漂移都標明它來自哪個 workspace——否則讀者知道某個套件漂移了，卻不知道該去改哪一份 `package.json`。
+- 三個細節決定了「有涵蓋 workspaces」與「看起來有涵蓋」的差別。lockfile 的條目可能被 hoist 到 root，**也可能**巢狀在 workspace 底下，所以兩處都查；只查一處會把另一處回報成「not present in package-lock.json」，而**一個被捏造出來的未知讀起來像一個發現**。workspace 相依於另一個 workspace 時是檔案連結而非已發布套件，因此跳過而不查詢——問 npm 會得到 404 並被記成 unverifiable。以及，比「最後一段結尾一個 `*`」更複雜的 `workspaces` 模式現在會**大聲失敗**而非匹配一個子集：**靜靜地涵蓋得比作者本意少，是同一個缺陷換個地方發生**。
+
+## [6.3.6] - 2026-08-07
+
+### Fixed
+
+- **6.3.5 說出貨的標準全部可解析。它數的是 287 份裡的 141 份。** 6.3.5 加的那道閘門**明文列舉三個目錄且不遞迴**，於是 `ai/options/`、`locales/`、`skills/`——三者皆由 `prepack` 打包進 tarball——都落在它的分母之外。6.3.5 發布後，那些目錄裡仍有 **10 份無法解析**，散在兩個中文語系與 `skills/`。**一道自行列舉範圍的閘門，在下一次有人新增目錄時就過期了**，因此它已改為走訪整個 repo、檢查建置與 vendor 路徑之外的每一份 `.ai.yaml`——本 repo 為 759 份，而它先前宣稱「完整」的是 423 份。
+- **另有 8 份能解析、但解析出來是錯的——這是任何「能不能解析」的檢查都看不見的。** `{UT:70%,IT:20%}` 不是對映：冒號後沒有空格時，YAML 讀到的是一個純量鍵 `UT:70%`、其值為 null。未加引號的 `- git commit -m "feat: add model"` 會變成 `{'git commit -m "feat': 'add model"'}`。**它們通過每一項語法檢查，同時交給 agent 一堆胡言。** 閘門現在也會拒絕「鍵含引號字元」或「冒號後無空格」——那是純量被靜默讀成對映的指紋——兩個分支皆以對照組實測而非假設。
+
 ## [6.3.5] - 2026-08-07
 
 ### Fixed

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.3.5 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.3.7 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/bundled/locales/zh-TW/ai/options/git-workflow/gitflow.ai.yaml

@@ -76,7 +76,7 @@ workflow:
       commands:
         - "# 進行變更..."
         - git add .
-        - git commit -m "feat: {描述}"
+        - 'git commit -m "feat: {描述}"'
 
     - step: 合併到 develop
       commands:
@@ -114,7 +114,7 @@ workflow:
     - step: 修正並完成
       commands:
         - "# 修正問題"
-        - git commit -m "fix: {描述}"
+        - 'git commit -m "fix: {描述}"'
         - git checkout main
         - git merge --no-ff hotfix/{問題}
         - git tag -a v{版本}
@@ -126,8 +126,8 @@ quick_reference:
   branches:
     columns: [分支, 用途, 來源, 合併到]
     rows:
-      - [main, 正式發布, -, -]
-      - [develop, 整合, main, -]
+      - [main, 正式發布, "-", "-"]
+      - [develop, 整合, main, "-"]
       - [feature/*, 新功能, develop, develop]
       - [release/*, 發布準備, develop, "main, develop"]
       - [hotfix/*, 緊急修正, main, "main, develop"]

package/bundled/locales/zh-TW/ai/options/git-workflow/github-flow.ai.yaml

@@ -53,7 +53,7 @@ workflow:
     commands:
       - "# 進行變更..."
       - git add .
-      - git commit -m "feat: {描述}"
+      - 'git commit -m "feat: {描述}"'
 
   - step: 推送並建立 PR
     description: 推送到遠端並開啟 Pull Request

package/bundled/locales/zh-TW/ai/options/git-workflow/merge-commit.ai.yaml

@@ -44,9 +44,9 @@ workflow:
 
   - step: 進行多次有意義的提交
     commands:
-      - git commit -m "feat: add user model"
-      - git commit -m "feat: add user service"
-      - git commit -m "test: add user tests"
+      - 'git commit -m "feat: add user model"'
+      - 'git commit -m "feat: add user service"'
+      - 'git commit -m "test: add user tests"'
 
   - step: 使用合併提交合併
     commands:

package/bundled/locales/zh-TW/ai/options/git-workflow/rebase-ff.ai.yaml

@@ -49,8 +49,8 @@ workflow:
 
   - step: 進行提交
     commands:
-      - git commit -m "feat: implement feature part 1"
-      - git commit -m "feat: implement feature part 2"
+      - 'git commit -m "feat: implement feature part 1"'
+      - 'git commit -m "feat: implement feature part 2"'
 
   - step: 變基到最新 main
     commands:

package/bundled/locales/zh-TW/ai/options/git-workflow/squash-merge.ai.yaml

@@ -43,9 +43,9 @@ workflow:
 
   - step: 進行多次提交
     commands:
-      - git commit -m "wip: initial implementation"
-      - git commit -m "wip: add tests"
-      - git commit -m "wip: fix lint errors"
+      - 'git commit -m "wip: initial implementation"'
+      - 'git commit -m "wip: add tests"'
+      - 'git commit -m "wip: fix lint errors"'
 
   - step: 壓縮合併（通過 GitHub/GitLab）
     commands:
@@ -56,7 +56,7 @@ workflow:
     commands:
       - git checkout main
       - git merge --squash feature/{功能名稱}
-      - git commit -m "feat(scope): 總結訊息 (#PR號)"
+      - 'git commit -m "feat(scope): 總結訊息 (#PR號)"'
 
 example:
   before: |

package/bundled/locales/zh-TW/ai/options/git-workflow/trunk-based.ai.yaml

@@ -61,7 +61,7 @@ workflow:
       commands:
         - "# 進行小而聚焦的變更"
         - git add .
-        - git commit -m "feat: {描述}"
+        - 'git commit -m "feat: {描述}"'
 
     - step: 推送到 trunk
       commands:
@@ -79,7 +79,7 @@ workflow:
       commands:
         - "# 進行變更..."
         - git add .
-        - git commit -m "feat: {描述}"
+        - 'git commit -m "feat: {描述}"'
 
     - step: 快速合併
       commands:

package/bundled/locales/zh-TW/ai/options/testing/security-testing.ai.yaml

@@ -157,4 +157,4 @@ quick_reference:
       - [動態分析, DAST, 預備環境, OWASP ZAP/Burp]
       - [相依套件掃描, SCA, 每次建置, Snyk/Dependabot]
       - [滲透測試, Pentest, 每年, 人工/專業]
-      - [機密掃描, -, 提交前, GitLeaks/TruffleHog]
+      - [機密掃描, "-", 提交前, GitLeaks/TruffleHog]

package/bundled/skills/ai/standards/checkin.ai.yaml

@@ -2,20 +2,20 @@
 v: 1.3.0
 philosophy: [complete_unit,working_state,reversible,has_tests,understandable]
 checklist:
-  build: {compile:"0 errors/warnings",deps:"installed,locked"}
-  test: {pass:"100%",new_tested:true,"cov":"not_decreased"}
-  quality: {standards:true,smells:"methods≤50,nest≤3,complex≤10,no_dup",security:"no_secrets,no_sqli,no_xss"}
-  docs: {api:true,readme:"if_needed",changelog:"user_facing→[Unreleased]"}
-  workflow: {branch:"feature/|fix/|docs/|chore/",commit:conventional,synced:true}
+  build: {compile: "0 errors/warnings",deps: "installed,locked"}
+  test: {pass: "100%",new_tested: true,"cov": "not_decreased"}
+  quality: {standards: true,smells: "methods≤50,nest≤3,complex≤10,no_dup",security: "no_secrets,no_sqli,no_xss"}
+  docs: {api: true,readme: "if_needed",changelog: "user_facing→[Unreleased]"}
+  workflow: {branch: "feature/|fix/|docs/|chore/",commit: conventional,synced: true}
 never_commit: [build_error,test_fail,incomplete_feature,WIP_critical,debug_code,commented_code]
 timing:
   good: [completed_unit,bug_fixed_with_test,independent_refactor,runnable]
   bad: [build_fail,test_fail,incomplete,experimental_TODO]
 granularity:
-  size: {files:"1-10",lines:"50-300",scope:single_concern}
+  size: {files: "1-10",lines: "50-300",scope: single_concern}
   combine: [feature+tests,tightly_related]
   separate: [A+B,refactor+feature,fix+incidental]
 special:
-  emergency: {stash:"git stash save WIP:desc",wip_branch:"git checkout -b wip/name"}
-  experimental: {branch:"experiment/name",free_commits:true,success:"squash→merge",fail:"doc_lessons→delete"}
-  hotfix: {from:main,minimal:true,mark:"[URGENT]"}
+  emergency: {stash: "git stash save WIP:desc",wip_branch: "git checkout -b wip/name"}
+  experimental: {branch: "experiment/name",free_commits: true,success: "squash→merge",fail: "doc_lessons→delete"}
+  hotfix: {from: main,minimal: true,mark: "[URGENT]"}

package/bundled/skills/ai/standards/commit.ai.yaml

@@ -3,17 +3,17 @@ v: 1.0.0
 format: "<type>(<scope>): <subject>\n\n<body>\n\n<footer>"
 types: [feat,fix,refactor,docs,style,test,perf,build,ci,chore,revert,security]
 types_zh: [功能,修復,重構,文件,樣式,測試,效能,建置,CI,雜項,回退,安全]
-subject: {len:"≤72(50ideal)",tense:imperative,cap:first,period:no}
+subject: {len: "≤72(50ideal)",tense: imperative,cap: first,period: no}
 lang_decision:
   tree: [open_source?→EN, intl_team?→EN, single_lang_team?→team_pref|EN, mixed→bilingual]
   matrix:
-    open_source: {l:EN,r:"intl contributors"}
-    intl_team: {l:EN,r:"common lang"}
-    local_EN: {l:EN,r:"tools,mobility"}
-    local_ZH: {l:ZH,r:"clarity,preference"}
-    mixed: {l:bilingual,r:"best of both"}
+    open_source: {l: EN,r: "intl contributors"}
+    intl_team: {l: EN,r: "common lang"}
+    local_EN: {l: EN,r: "tools,mobility"}
+    local_ZH: {l: ZH,r: "clarity,preference"}
+    mixed: {l: bilingual,r: "best of both"}
 bilingual_format: "type(scope): EN subject. 中文 subject.\n\nEN body\n\n中文 body\n\nfooter"
-refs: {closes:"#N→auto_close",fixes:"#N→auto_close",refs:"#N→link_only"}
+refs: {closes: "#N→auto_close",fixes: "#N→auto_close",refs: "#N→link_only"}
 breaking: "BREAKING CHANGE: description\n\nMigration guide:\n1. step"
 examples:
   good: ["feat(auth): Add OAuth2 Google login","fix(api): Resolve memory leak"]

package/bundled/skills/ai/standards/refactoring.ai.yaml

@@ -2,33 +2,33 @@
 # Token-optimized for AI assistants
 v: 1.0.0
 decision:
-  tree: [in_prod?→n:rewrite|y:next, understand?→n:char_tests|y:next, "cov>60%?"→n:add_tests|y:next, arch_ok?→n:strangler|y:incr_refactor]
+  tree: [in_prod?→n:rewrite|y:next, understand?→n:char_tests|y:next, '"cov>60%?"→n:add_tests|y:next', arch_ok?→n:strangler|y:incr_refactor]
   refactor: [large_code,good_tests,critical_biz,team_knows,sound_arch,tight_deadline,low_risk]
   rewrite: [small,no_tests,downtime_ok,no_knowledge,flawed_arch,flex_time,high_risk]
 warn: "Second-System Effect: Don't add features, over-abstract, ignore lessons"
 scales:
-  S: {t:"5-15m",s:method,tech:[extract,rename,inline,const]}
-  M: {t:"hrs-days",s:module,req:"cov>80%"}
-  L: {t:"wks-mos",s:system,patterns:[strangler,branch_abstract,expand_contract]}
+  S: {t: "5-15m",s: method,tech: [extract,rename,inline,const]}
+  M: {t: "hrs-days",s: module,req: "cov>80%"}
+  L: {t: "wks-mos",s: system,patterns: [strangler,branch_abstract,expand_contract]}
 patterns:
-  strangler: {1:intercept,2:migrate_partial,3:complete_decommission}
-  branch_abstract: {1:"client→iface→old",2:"→[old,new_toggled]",3:"→new_only"}
-  expand_contract: {expand:"add_both",migrate:"switch_clients",contract:"remove_old"}
+  strangler: {1: intercept,2: migrate_partial,3: complete_decommission}
+  branch_abstract: {1: "client→iface→old",2: "→[old,new_toggled]",3: "→new_only"}
+  expand_contract: {expand: "add_both",migrate: "switch_clients",contract: "remove_old"}
 legacy:
   def: "code without tests"
   char_test: [call,expect_fail,run,update_assert,repeat]
-  seams: {obj:polymorphism,preproc:macros,link:DI}
-  sprout: {method:"new_fn→call_from_old",class:"new_class→ref_from_old"}
-  wrap: {method:"rename→wrapper",class:decorator}
+  seams: {obj: polymorphism,preproc: macros,link: DI}
+  sprout: {method: "new_fn→call_from_old",class: "new_class→ref_from_old"}
+  wrap: {method: "rename→wrapper",class: decorator}
 db:
-  expand_contract: {1:"add_new,write_both",2:"copy,verify,read_new",3:"drop_old"}
+  expand_contract: {1: "add_new,write_both",2: "copy,verify,read_new",3: "drop_old"}
 workflow:
   before: [success_criteria,"cov>80%",clean_dir,branch,communicate]
   during: [one_change,test_every,revert_if_fail,commit_often,no_new_func]
   after: [tests_pass,measurably_better,docs,reviewed]
 metrics:
-  code: {complexity:"<10",dup:"<3%"}
-  test: {cov:"≥80%",speed:faster,flaky:decrease}
+  code: {complexity: "<10",dup: "<3%"}
+  test: {cov: "≥80%",speed: faster,flaky: decrease}
 debt:
-  quadrant: {prudent_delib:"know_debt",reckless_delib:"no_time",prudent_inadv:"learned_now",reckless_inadv:"what_layering?"}
-  priority: {H:"blocks→immediate",M:"slows→next_sprint",L:"minor→opportunistic"}
+  quadrant: {prudent_delib: "know_debt",reckless_delib: "no_time",prudent_inadv: "learned_now",reckless_inadv: "what_layering?"}
+  priority: {H: "blocks→immediate",M: "slows→next_sprint",L: "minor→opportunistic"}

package/bundled/skills/ai/standards/testing.ai.yaml

@@ -1,31 +1,31 @@
 # Testing Standards - Ultra Compressed
 v: 1.1.0
-pyramid: {UT:70%,IT:20%,E2E:10%}
+pyramid: {UT: 70%,IT: 20%,E2E: 10%}
 levels:
-  UT: {scope:fn/class,speed:"<100ms",deps:mocked}
-  IT: {scope:components,speed:"1-10s",deps:"real_db(container)"}
-  ST: {scope:full_system,speed:min,deps:prod_like}
-  E2E: {scope:user_journey,speed:"30s+",deps:all_real}
-coverage: {line:"70→85%",branch:"60→80%",fn:"80→90%"}
+  UT: {scope: fn/class,speed: "<100ms",deps: mocked}
+  IT: {scope: components,speed: "1-10s",deps: "real_db(container)"}
+  ST: {scope: full_system,speed: min,deps: prod_like}
+  E2E: {scope: user_journey,speed: "30s+",deps: all_real}
+coverage: {line: "70→85%",branch: "60→80%",fn: "80→90%"}
 theory:
   chain: "error(human)→defect(code)→failure(runtime)"
   oracle: [spec,reference,consistency,heuristic]
-  static: {def:"no_exec",tech:[review,analysis],tools:[ESLint,SonarQube]}
-  dynamic: {def:"execute",tech:[unit,integration,system]}
+  static: {def: "no_exec",tech: [review,analysis],tools: [ESLint,SonarQube]}
+  dynamic: {def: "execute",tech: [unit,integration,system]}
 design:
   black_box:
     equiv_partition: "divide inputs→classes"
     boundary: "test at edges"
     decision_table: "conditions→actions"
     state_trans: "valid state sequences"
-  white_box: {stmt:"every_stmt",branch:"every_decision",cond:"T/F",path:"all_paths"}
-risk: {formula:"likelihood×impact",HH:extensive,HL:good,LH:good,LL:basic}
+  white_box: {stmt: "every_stmt",branch: "every_decision",cond: "T/F",path: "all_paths"}
+risk: {formula: "likelihood×impact",HH: extensive,HL: good,LH: good,LL: basic}
 doubles:
   stub: "predefined returns"
   mock: "verify interactions"
   fake: "simplified impl"
   spy: "record+delegate"
-use: {UT:mock_all,IT:"fake_db,stub_api",ST:"real,fake_external",E2E:all_real}
+use: {UT: mock_all,IT: "fake_db,stub_api",ST: "real,fake_external",E2E: all_real}
 FIRST: [Fast,Independent,Repeatable,Self_validating,Timely]
 AAA: [Arrange,Act,Assert]
 antipatterns: [interdependence,flaky,impl_details,over_mock,no_assert,magic_values]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.3.5",
+  "version": "6.3.7",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/commands/deps.js

@@ -37,6 +37,15 @@ export function render(result) {
   lines.push('');
   lines.push(`${label} — ${result.examined} runtime dependenc${result.examined === 1 ? 'y' : 'ies'} checked`);
 
+  // The scope of the count, printed whenever it is more than the root. A
+  // denominator without its scope is what let this command report "34
+  // dependencies checked" for a repository that declared 47 across two
+  // manifests — the reader has no way to tell a complete answer from a subset.
+  const wsCount = result.workspaces?.length ?? 0;
+  if (wsCount > 0) {
+    lines.push(chalk.dim(`  across the root and ${wsCount} workspace${wsCount === 1 ? '' : 's'}: ${result.workspaces.join(', ')}`));
+  }
+
   if (!result.hasLockfile) {
     lines.push(chalk.yellow('  no package-lock.json — nothing to compare the registry against'));
   }
@@ -52,9 +61,12 @@ export function render(result) {
     // underneath it" shape that R4 rewrote the supply-chain standard to stop.
     lines.push(chalk.yellow(`  ${result.drifted.length} tested ≠ resolves:`));
     for (const d of result.drifted) {
+      // The workspace is part of the finding, not decoration: without it the
+      // reader knows a package drifted but not which package.json to edit.
+      const where = d.workspaceDir ? chalk.dim(`  [${d.workspaceDir}]`) : '';
       lines.push(
         `    ${chalk.bold(d.name)}  ${chalk.dim(d.range)}` +
-          `  tested=${chalk.cyan(d.locked)}  resolves=${chalk.yellow(d.resolved)}`
+          `  tested=${chalk.cyan(d.locked)}  resolves=${chalk.yellow(d.resolved)}${where}`
       );
     }
     lines.push('');

package/src/utils/dependency-resolution.js

@@ -66,7 +66,7 @@
  */
 
 import { spawn } from 'node:child_process';
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import semver from 'semver';
 
@@ -200,6 +200,66 @@ function spawnNpm(cwd) {
     });
 }
 
+/**
+ * Expand npm's `workspaces` field into directories that contain a
+ * package.json. // implements XSPEC-366 R1 (workspaces)
+ *
+ * Accepts both spellings — an array, or `{ packages: [...] }` — and supports a
+ * trailing `*` in the last segment, which is what `packages/*` needs and is the
+ * shape npm's own docs use. A pattern that matches nothing is returned as
+ * nothing rather than as an error: an empty `packages/*` is a normal state for
+ * a repository that has not added one yet.
+ */
+function expandWorkspaces(root, field) {
+  const patterns = Array.isArray(field) ? field : Array.isArray(field?.packages) ? field.packages : [];
+  const dirs = [];
+  for (const pattern of patterns) {
+    if (typeof pattern !== 'string' || pattern.length === 0) continue;
+    const star = pattern.indexOf('*');
+    if (star === -1) {
+      if (existsSync(join(root, pattern, 'package.json'))) dirs.push(pattern);
+      continue;
+    }
+    // Only a trailing `*` in the final segment is supported. Anything more
+    // exotic is rejected loudly rather than silently matching less than the
+    // author meant — a workspace quietly outside the denominator is the defect
+    // this module exists to report.
+    const prefix = pattern.slice(0, star);
+    if (!pattern.endsWith('*') || prefix.includes('*') || (prefix.length > 0 && !prefix.endsWith('/'))) {
+      throw new Error(
+        `unsupported workspaces pattern ${JSON.stringify(pattern)} — only a trailing "*" in the last segment is understood`
+      );
+    }
+    const parent = join(root, prefix);
+    if (!existsSync(parent)) continue;
+    for (const entry of readdirSync(parent, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      const rel = `${prefix}${entry.name}`;
+      if (existsSync(join(root, rel, 'package.json'))) dirs.push(rel);
+    }
+  }
+  return dirs;
+}
+
+/**
+ * Where the lockfile records this dependency.
+ *
+ * npm hoists what it can to the root `node_modules` and nests the rest under
+ * the workspace, so both have to be tried; checking only one under-reports and
+ * calls the miss "unverifiable", which is noise that trains people to ignore
+ * the report.
+ */
+function lockedVersionFor(lock, workspaceDir, name) {
+  const candidates = workspaceDir
+    ? [`${workspaceDir}/node_modules/${name}`, `node_modules/${name}`]
+    : [`node_modules/${name}`];
+  for (const key of candidates) {
+    const entry = lock?.packages?.[key];
+    if (entry?.version) return entry.version;
+  }
+  return null;
+}
+
 /** Map over `items` with a bounded number of concurrent workers. */
 async function mapWithConcurrency(items, limit, worker) {
   const results = new Array(items.length);
@@ -238,16 +298,37 @@ export async function measureResolutionDrift(root, options = {}) {
   const lockPath = join(root, 'package-lock.json');
   const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, 'utf8')) : null;
 
-  const declared = [
-    ...Object.entries(pkg.dependencies ?? {}).map(([name, range]) => ({ name, range, kind: 'dependencies' })),
-    ...Object.entries(pkg.optionalDependencies ?? {}).map(([name, range]) => ({ name, range, kind: 'optionalDependencies' })),
-  ];
+  // Workspaces are examined too. A monorepo that declares its shipped
+  // front-end in a workspace and its server at the root has two manifests, and
+  // reading only the root reports a clean subset as if it were the whole — the
+  // failure this module exists to catch, performed by the tool itself.
+  const workspaceDirs = expandWorkspaces(root, pkg.workspaces);
+  const manifests = [{ dir: null, name: pkg.name ?? null, pkg }];
+  for (const dir of workspaceDirs) {
+    const wsPkg = JSON.parse(readFileSync(join(root, dir, 'package.json'), 'utf8'));
+    manifests.push({ dir, name: wsPkg.name ?? dir, pkg: wsPkg });
+  }
+  // A workspace depending on a sibling workspace is a file link, not a
+  // registry package. Querying npm for it returns 404, which would be recorded
+  // as unverifiable — a fabricated unknown, which is worse than a missing one
+  // because it looks like a finding.
+  const localNames = new Set(manifests.map((m) => m.pkg.name).filter(Boolean));
+
+  const declared = [];
+  for (const { dir, name: workspace, pkg: manifest } of manifests) {
+    for (const kind of ['dependencies', 'optionalDependencies']) {
+      for (const [name, range] of Object.entries(manifest[kind] ?? {})) {
+        if (localNames.has(name)) continue;
+        declared.push({ name, range, kind, workspace, workspaceDir: dir });
+      }
+    }
+  }
 
   const run = options.run ?? spawnNpm(root);
   const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;
 
   const rows = await mapWithConcurrency(declared, concurrency, async (dep) => {
-    const locked = lock?.packages?.[`node_modules/${dep.name}`]?.version ?? null;
+    const locked = lockedVersionFor(lock, dep.workspaceDir, dep.name);
     let resolved;
     try {
       resolved = await resolveViaNpm(dep.name, dep.range, run);
@@ -282,6 +363,13 @@ export async function measureResolutionDrift(root, options = {}) {
     root,
     packageName: pkg.name ?? null,
     hasLockfile: lock !== null,
+    /**
+     * Workspace directories examined alongside the root, so a reader can tell
+     * "no workspaces here" from "workspaces were not looked at". The count
+     * printed by the report is the denominator, and a denominator without its
+     * scope is the shape this module was written to refuse.
+     */
+    workspaces: workspaceDirs,
     examined: rows.length,
     consistent,
     drifted,

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.3.5",
+  "version": "6.3.7",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.3.5"
+      "version": "6.3.7"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.3.5",
+      "version": "6.3.7",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.3.5",
+      "version": "6.3.7",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.3.5",
+      "version": "6.3.7",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.3.5",
+      "version": "6.3.7",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.3.5",
+      "version": "6.3.7",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"