universal-dev-standards 6.3.7 → 6.3.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.3.7",
+  "version": "6.3.8",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",
@@ -69,10 +69,7 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@vitest/coverage-v8": "^4.1.5",
-    "ajv": "^8.20.0",
-    "ajv-formats": "^3.0.1",
     "eslint": "10.7.0",
-    "glob": "^13.0.1",
     "globals": "17.7.0",
     "husky": "^9.1.7",
     "lint-staged": "^17.0.3",

package/src/commands/check.js

@@ -7,8 +7,7 @@ import { execSync } from 'child_process';
 import { readManifest, writeManifest, isInitialized, copyStandard, copyIntegration } from '../utils/copier.js';
 import {
   getAllStandards,
-  getRepositoryInfo
-} from '../utils/registry.js';
+  getRepositoryInfo, resolveStandardFilename } from '../utils/registry.js';
 import {
   computeFileHash,
   compareFileHash,
@@ -1244,7 +1243,23 @@ function checkAgentsMdSync(manifest, projectPath, msg) {
   }
 
   const content = readFileSync(agentsMdPath, 'utf-8');
-  const installedStandards = (manifest.standards || []).map(s => basename(s));
+  // Resolved through the registry, not basename()d.
+  //
+  // This check reported "standards synced (7/7)" for a project with seventy
+  // standards in its manifest. basename() leaves a registry ID unchanged, the
+  // `.ai.yaml` filter below then drops every ID, and only the seven option
+  // entries — which are stored as paths — survived to become the denominator.
+  // Seven of seven were present, so it ticked, both before the AGENTS.md block
+  // listed the other sixty-three and after, when seven of its paths pointed at
+  // nothing. A drift check blind to ninety percent of the content.
+  //
+  // The AI-tool integration check ~170 lines above already builds this exact
+  // mapping and its comment names the exact case (`error-code-standards` ->
+  // `error-codes.ai.yaml`). The knowledge was in the file; it had not reached
+  // its sibling.
+  const installedStandards = (manifest.standards || [])
+    .map(entry => resolveStandardFilename(entry, manifest.format || 'ai'))
+    .filter(Boolean);
 
   // Same as the AI-tool integration check above: an index-mode block declares a
   // count instead of listing names, so the name grep below cannot apply to it.

package/src/commands/config.js

@@ -917,7 +917,10 @@ export async function runProjectConfiguration(options) {
     const intSpinner = ora(msgObj.regeneratingIntegrations).start();
 
     // Build installed standards list
-    const installedStandardsList = manifest.standards?.map(s => basename(s)) || [];
+    // Raw, not basename()d. Resolution needs the registry (an ID is not a
+    // filename) and the `/options/` segment (it is what classifies an entry).
+    // basename() removes both. See resolveStandardFilename.
+    const installedStandardsList = manifest.standards || [];
 
     // Determine language setting
     let commonLanguage = 'en';
@@ -941,6 +944,7 @@ export async function runProjectConfiguration(options) {
         categories: ['anti-hallucination', 'commit-standards', 'code-review'],
         language: commonLanguage,
         installedStandards: installedStandardsList,
+        standardsFormat: manifest.format || 'ai',
         contentMode: newContentMode,
         // Pass output_language for dynamic commit standards generation
         outputLanguage: newOptions.output_language || 'english'

package/src/commands/deps.js

@@ -47,7 +47,37 @@ export function render(result) {
   }
 
   if (!result.hasLockfile) {
-    lines.push(chalk.yellow('  no package-lock.json — nothing to compare the registry against'));
+    lines.push(
+      result.foreignLockfile
+        ? chalk.yellow(
+            `  found ${result.foreignLockfile}, and this command reads package-lock.json — the` +
+              ' tested column cannot be filled in',
+          )
+        : chalk.yellow('  no package-lock.json — nothing to compare the registry against'),
+    );
+  }
+
+  // Zero examined is reported before anything else can be said about the
+  // result, because everything else would be said about nothing. The three
+  // problem lists are empty here for the same reason an empty room has no
+  // untidy corners, and the tick below used to fire on exactly that.
+  if (result.examined === 0) {
+    lines.push('');
+    lines.push(chalk.yellow('  Nothing was examined, so nothing is being asserted.'));
+    lines.push(
+      chalk.dim(
+        result.hasLockfile
+          ? '  This package declares no runtime dependencies. If you expected some,'
+          : '  Without a readable lockfile there is no tested column. If you expected',
+      ),
+    );
+    lines.push(
+      chalk.dim(
+        result.hasLockfile
+          ? '  check that they are in "dependencies" rather than "devDependencies".'
+          : '  dependencies here, check the manifest and the lockfile format.',
+      ),
+    );
   }
 
   if (result.drifted.length > 0) {

package/src/commands/update.js

@@ -589,7 +589,10 @@ export async function updateCommand(options) {
     const intSpinner = ora(msg.syncingIntegrations).start();
 
     // Build installed standards list
-    const installedStandardsList = manifest.standards?.map(s => basename(s)) || [];
+    // Raw, not basename()d. Resolution needs the registry (an ID is not a
+    // filename) and the `/options/` segment (it is what classifies an entry).
+    // basename() removes both. See resolveStandardFilename.
+    const installedStandardsList = manifest.standards || [];
 
     // Determine language setting
     let commonLanguage = 'en';
@@ -617,6 +620,7 @@ export async function updateCommand(options) {
         categories: ['anti-hallucination', 'commit-standards', 'code-review'],
         language: commonLanguage,
         installedStandards: installedStandardsList,
+        standardsFormat: manifest.format || 'ai',
         contentMode: resolved.contentMode,
         level: resolved.level,
         // Pass output_language for dynamic commit standards generation
@@ -645,6 +649,7 @@ export async function updateCommand(options) {
     if (manifest.generateAgentsMd && !generatedFiles.has('AGENTS.md')) {
       const summaryConfig = {
         installedStandards: installedStandardsList,
+        standardsFormat: manifest.format || 'ai',
         language: manifest.options?.display_language || 'en',
         outputLanguage: manifest.options?.output_language || manifest.options?.commit_language || 'english',
         standardOptions: manifest.options || {}
@@ -1404,7 +1409,8 @@ export function regenerateIntegrations(projectPath, manifest) {
   // Regenerate universal AGENTS.md if enabled and not already covered
   if (manifest.generateAgentsMd && !generatedFiles.has('AGENTS.md')) {
     const summaryConfig = {
-      installedStandards: (manifest.standards || []).map(s => basename(s)),
+      // Raw — writeAgentsMdSummary resolves via the registry now.
+      installedStandards: manifest.standards || [],
       language: manifest.options?.display_language || 'en',
       outputLanguage: manifest.options?.output_language || manifest.options?.commit_language || 'english',
       standardOptions: manifest.options || {}
@@ -1469,7 +1475,14 @@ async function updateIntegrationsOnly(projectPath, manifest, options = {}) {
           ? 'bilingual'
           : (manifest.options?.output_language || manifest.options?.commit_language) === 'traditional-chinese'
             ? 'zh-tw' : 'en',
-        installedStandards: manifest.standards?.map((x) => basename(x)) || [],
+        // Passed raw. `basename()` here destroyed the two things the
+        // generator needs: a registry ID cannot be turned back into a
+        // filename once it has been through basename() (it comes out
+        // unchanged, and an ID is not a filename), and an option entry loses
+        // the `/options/` segment that classifies it. Resolution belongs
+        // where the registry is consulted, not at the call site.
+        installedStandards: manifest.standards || [],
+        standardsFormat: manifest.format || 'ai',
         contentMode: resolvedMode.contentMode,
         level: resolvedMode.level,
         outputLanguage: manifest.options?.output_language || manifest.options?.commit_language || 'english'

package/src/utils/dependency-resolution.js

@@ -298,6 +298,15 @@ export async function measureResolutionDrift(root, options = {}) {
   const lockPath = join(root, 'package-lock.json');
   const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, 'utf8')) : null;
 
+  // Which lockfile is present, when it is not npm's. Only package-lock.json is
+  // understood, and "not understood" has to be reported as a different thing
+  // from "not there" — a pnpm project told it had no lockfile will reasonably
+  // conclude the command is confused, and stop reading.
+  const foreignLockfile =
+    lock === null
+      ? ['pnpm-lock.yaml', 'yarn.lock', 'bun.lockb', 'bun.lock'].find((f) => existsSync(join(root, f))) ?? null
+      : null;
+
   // Workspaces are examined too. A monorepo that declares its shipped
   // front-end in a workspace and its server at the root has two manifests, and
   // reading only the root reports a clean subset as if it were the whole — the
@@ -375,7 +384,30 @@ export async function measureResolutionDrift(root, options = {}) {
     drifted,
     unverifiable,
     unpinnedNative,
-    /** True when every dependency was checked, agreed, and needs no pinning. */
-    clean: drifted.length === 0 && unverifiable.length === 0 && unpinnedNative.length === 0,
+    /**
+     * A lockfile in a format this command cannot read, when there is no
+     * package-lock.json. `hasLockfile: false` alone reads as "this project has
+     * no lockfile", which for a pnpm or yarn project is simply untrue, and the
+     * report said so out loud: "no package-lock.json — nothing to compare"
+     * printed against a repo holding a perfectly good pnpm-lock.yaml.
+     */
+    foreignLockfile,
+    /**
+     * True when every dependency was checked, agreed, and needs no pinning.
+     *
+     * `examined === 0` is excluded, and that exclusion is the point. Run
+     * against asiaostrich-telemetry-client — zero runtime dependencies, a
+     * pnpm lockfile this command cannot read — the three problem lists came
+     * back empty and the report printed "✓ every dependency resolves to the
+     * version you test against". Nothing had been examined. The tick was
+     * true and it was also the exact shape this command exists to refuse:
+     * "nothing to check" and "everything checked out" arriving as the same
+     * green line.
+     */
+    clean:
+      rows.length > 0 &&
+      drifted.length === 0 &&
+      unverifiable.length === 0 &&
+      unpinnedNative.length === 0,
   };
 }

package/src/utils/integration-generator.js

@@ -3,7 +3,7 @@ import { dirname, join, basename } from 'path';
 import { getLanguageRules } from '../prompts/integrations.js';
 import { computeIntegrationBlockHash } from './hasher.js';
 import { UDS_MARKERS, SUPPORTED_AI_TOOLS, LEGACY_TOOL_MAPPINGS } from '../core/constants.js';
-import { resolveSelectedOptionSources } from './registry.js';
+import { resolveSelectedOptionSources, resolveStandardFilename } from './registry.js';
 import { getAgentConfig, getAgentTier } from '../config/ai-agent-paths.js';
 
 /**
@@ -101,8 +101,14 @@ const STANDARD_TASK_MAPPING = {
   'test-completeness-dimensions.md': { task: 'Test coverage', when: 'When evaluating tests', priority: 'SHOULD' },
   'git-workflow.ai.yaml': { task: 'Git workflow', when: 'Branch/merge decisions', priority: 'SHOULD' },
   'developer-memory.ai.yaml': { task: 'Developer memory', when: 'Always (protocol)', priority: 'SHOULD' },
-  'project-context-memory.ai.yaml': { task: 'Project context', when: 'Planning & Coding', priority: 'MUST' },
-  'workflow-enforcement.ai.yaml': { task: 'Workflow gates', when: 'Before any workflow phase', priority: 'MUST' }
+  'project-context-memory.ai.yaml': { task: 'Project context', when: 'Planning & Coding', priority: 'MUST' }
+  // 'workflow-enforcement.ai.yaml' was removed in 6.0.0 (MIGRATION-v6 §2) along
+  // with seven other machine-readable standards whose runtime moved to the
+  // adoption layer. Its entry here pointed a task mapping at
+  // `.standards/workflow-enforcement.ai.yaml`, a file that has not shipped
+  // since. The human-readable core/workflow-enforcement.md was deliberately
+  // kept upstream, but adopters receive .standards/, not core/, so it is not a
+  // substitute path.
 };
 
 /**
@@ -2399,18 +2405,39 @@ All responses should be in **Traditional Chinese (繁體中文)**, with technica
  * @param {string} language - Language: 'en', 'zh-tw', or 'bilingual'
  * @returns {string} Generated minimal reference
  */
-export function generateMinimalStandardsReference(installedStandards, format, language = 'zh-tw') {
+export function generateMinimalStandardsReference(
+  installedStandards,
+  format,
+  language = 'zh-tw',
+  standardsFormat = 'ai',
+) {
   if (!installedStandards || installedStandards.length === 0) {
     return '';
   }
 
   const coreStandards = [];
   const optionStandards = [];
-
-  // Separate core standards from options
+  const unresolved = [];
+
+  // Separate core standards from options.
+  //
+  // `basename(entry)` used to serve for both, and it is only right for one:
+  // option entries are paths, core entries are registry IDs, and an ID is not
+  // a filename. That produced `.standards/error-code-standards` for a file
+  // installed as `error-codes.ai.yaml` — seven dead paths out of seventy in a
+  // real adopter's AGENTS.md, directly under a line telling the agent it must
+  // read them.
   for (const standardPath of installedStandards) {
-    const filename = basename(standardPath);
     const isOption = standardPath.includes('/options/') || standardPath.includes('\\options\\');
+    const filename = resolveStandardFilename(standardPath, standardsFormat);
+
+    // An entry we cannot resolve is not written out as if it were a path. A
+    // listed path that does not exist is worse than an omission: the reader
+    // cannot tell it apart from the ones that do, so it discredits the list.
+    if (!filename) {
+      unresolved.push(standardPath);
+      continue;
+    }
 
     if (isOption) {
       optionStandards.push({ filename, path: standardPath });
@@ -2446,6 +2473,15 @@ export function generateMinimalStandardsReference(installedStandards, format, la
       }
       sections.push('');
     }
+
+    // Said out loud rather than dropped quietly. A shorter list and a complete
+    // one read the same, and only the manifest knows which this is.
+    if (unresolved.length > 0) {
+      sections.push(language === 'en'
+        ? `> ${unresolved.length} manifest entr${unresolved.length === 1 ? 'y' : 'ies'} could not be matched to an installed file and ${unresolved.length === 1 ? 'is' : 'are'} not listed above: ${unresolved.join(', ')}. Run \`uds update\` — if that does not clear it, the manifest and the registry disagree.`
+        : `> 有 ${unresolved.length} 筆 manifest 項目對不到已安裝的檔案，未列於上方：${unresolved.join('、')}。請執行 \`uds update\`；若仍未消失，代表 manifest 與 registry 不一致。`);
+      sections.push('');
+    }
   } else {
     // Plaintext format
     sections.push(language === 'en'
@@ -2468,6 +2504,13 @@ export function generateMinimalStandardsReference(installedStandards, format, la
         sections.push(`- .standards/options/${std.filename}`);
       }
     }
+
+    if (unresolved.length > 0) {
+      sections.push('');
+      sections.push(language === 'en'
+        ? `NOTE: ${unresolved.length} manifest entries could not be matched to an installed file and are not listed: ${unresolved.join(', ')}`
+        : `注意：有 ${unresolved.length} 筆 manifest 項目對不到已安裝的檔案，未列出：${unresolved.join('、')}`);
+    }
     sections.push('');
   }
 
@@ -2562,7 +2605,7 @@ function generateWorkflowGateContent(language) {
     sections.push('| BDD | AUTOMATION | `.feature` file exists | → FORMULATION |');
     sections.push('| Commit | feat/fix | Check active specs | → Suggest `Refs: SPEC-XXX` |');
     sections.push('');
-    sections.push('Reference: `.standards/workflow-enforcement.ai.yaml`');
+
   } else if (language === 'zh-cn') {
     sections.push('## 工作流程强制闸门');
     sections.push('');
@@ -2585,7 +2628,7 @@ function generateWorkflowGateContent(language) {
     sections.push('| BDD | AUTOMATION | `.feature` 文件存在 | → FORMULATION |');
     sections.push('| Commit | feat/fix | 检查活跃 spec | → 建议 `Refs: SPEC-XXX` |');
     sections.push('');
-    sections.push('参考: `.standards/workflow-enforcement.ai.yaml`');
+
   } else {
     sections.push('## Workflow Enforcement Gates');
     sections.push('');
@@ -2608,7 +2651,7 @@ function generateWorkflowGateContent(language) {
     sections.push('| BDD | AUTOMATION | `.feature` file exists | → FORMULATION |');
     sections.push('| Commit | feat/fix | Check active specs | → Suggest `Refs: SPEC-XXX` |');
     sections.push('');
-    sections.push('Reference: `.standards/workflow-enforcement.ai.yaml`');
+
   }
 
   return sections.join('\n');
@@ -2631,6 +2674,10 @@ export function generateIntegrationContent(config) {
     // New fields for enhanced standards compliance
     installedStandards = [],
     contentMode = 'minimal',
+    // Content format of the installed standards ('ai' -> *.ai.yaml,
+    // 'human' -> *.md). Needed to turn a manifest's registry IDs into the
+    // filenames actually on disk; without it the block prints IDs as paths.
+    standardsFormat = 'ai',
     // Output language option for dynamic commit standards generation
     outputLanguage = 'english'
   } = config;
@@ -2691,7 +2738,8 @@ export function generateIntegrationContent(config) {
         standardsContent += generateMinimalStandardsReference(
           installedStandards,
           format,
-          language
+          language,
+          standardsFormat
         );
       } else {
         // Index/Full mode: detailed compliance instructions + index
@@ -2699,7 +2747,8 @@ export function generateIntegrationContent(config) {
           installedStandards,
           contentMode,
           format,
-          language
+          language,
+          standardsFormat
         );
 
         const standardsIndex = generateStandardsIndex(
@@ -2718,8 +2767,20 @@ export function generateIntegrationContent(config) {
     sections.push('\n---\n');
   }
 
-  // Add workflow enforcement gates if workflow-enforcement standard is installed
-  if (installedStandards.some(s => basename(s) === 'workflow-enforcement.ai.yaml')) {
+  // Add workflow enforcement gates if the project still declares the standard.
+  //
+  // Matched against both forms because a manifest can hold either: the legacy
+  // path (pre-3.4.0) or the ID. vibeops and dev-platform both still carry
+  // `workflow-enforcement` as an ID today, two majors after 6.0.0 removed the
+  // file — checking only the filename silently stopped honouring their
+  // declaration. The section's content is self-contained; what it no longer
+  // does is point at `.standards/workflow-enforcement.ai.yaml`, which has not
+  // existed since 6.0.0 and was being written into adopters' instruction
+  // files regardless (asiaostrich-telemetry-client/CLAUDE.md:145).
+  if (installedStandards.some(s => {
+    const name = basename(s);
+    return name === 'workflow-enforcement.ai.yaml' || name === 'workflow-enforcement';
+  })) {
     const workflowGateContent = generateWorkflowGateContent(language);
     sections.push(workflowGateContent);
     sections.push('\n---\n');
@@ -2868,7 +2929,13 @@ export function integrationFileExists(tool, projectPath) {
  * @param {string} language - Language: 'en', 'zh-tw', or 'bilingual'
  * @returns {string} Generated compliance instructions
  */
-export function generateComplianceInstructions(installedStandards, mode, format, language = 'zh-tw') {
+export function generateComplianceInstructions(
+  installedStandards,
+  mode,
+  format,
+  language = 'zh-tw',
+  standardsFormat = 'ai',
+) {
   if (mode === 'minimal' || !installedStandards || installedStandards.length === 0) {
     return '';
   }
@@ -2876,9 +2943,16 @@ export function generateComplianceInstructions(installedStandards, mode, format,
   const mustFollow = [];
   const shouldFollow = [];
 
-  // Categorize standards by priority
+  // Categorize standards by priority.
+  //
+  // Keyed by installed filename, so a registry ID has to be resolved first —
+  // `basename()` on an ID returns the ID, which matches nothing in the table,
+  // and the standard silently gets no task mapping. No error, no shorter
+  // output anyone would notice: just a standard the agent is never told when
+  // to apply.
   for (const standardPath of installedStandards) {
-    const filename = basename(standardPath);
+    const filename = resolveStandardFilename(standardPath, standardsFormat);
+    if (!filename) continue;
     const mapping = STANDARD_TASK_MAPPING[filename];
     if (mapping) {
       const entry = {
@@ -3155,7 +3229,6 @@ export function getToolFilePath(tool) {
 }
 
 
-
 /**
  * Get default commands based on ecosystem
  * @param {'node'|'python'|'go'|'java_maven'|'java_gradle'|'rust'|'ruby'} ecosystem
@@ -3327,15 +3400,18 @@ export function generateAgentsMdSummary(config = {}) {
     lines.push('All standards are in `.standards/`. Installed standards:');
     lines.push('');
 
-    const keyStandards = installedStandards
-      .filter(s => {
-        const name = basename(s);
-        return name.endsWith('.ai.yaml');
-      });
-
-    for (const std of keyStandards) {
-      const name = basename(std).replace('.ai.yaml', '');
-      lines.push(`- \`.standards/${basename(std)}\` — ${name}`);
+    // Resolved before filtering, not after. The filter asks for an `.ai.yaml`
+    // suffix and a manifest's core entries are registry IDs, which carry no
+    // suffix — so every core standard failed the test and the block listed
+    // only the option files. On one adopter that meant seven lines standing in
+    // for seventy, under a heading reading "Installed Standards", with nothing
+    // anywhere reporting the sixty-three that had been dropped.
+    const resolved = installedStandards
+      .map((s) => resolveStandardFilename(s, 'ai'))
+      .filter((name) => name?.endsWith('.ai.yaml'));
+
+    for (const filename of resolved) {
+      lines.push(`- \`.standards/${filename}\` — ${filename.replace('.ai.yaml', '')}`);
     }
   } else {
     lines.push('No standards installed yet. Run `npx uds init` to install.');

package/src/utils/registry.js

@@ -244,3 +244,48 @@ export function resolveSelectedOptionSources(manifestOptions, format = 'ai') {
 
   return paths;
 }
+
+/**
+ * The filename a manifest entry has on disk under `.standards/`.
+ *
+ * The `standards` array in a manifest is deliberately mixed: core standards are
+ * stored as registry IDs (v3.4.0 onwards), option files as their upstream
+ * source path, because options have no registry ID. Anything that turns those
+ * entries into paths has to handle both, and three places in
+ * integration-generator.js did not — each failing differently and silently:
+ *
+ *   - minimal mode printed `.standards/<id>`, and an ID is not a filename.
+ *     `error-code-standards` installs as `error-codes.ai.yaml`, `ai-agreement`
+ *     as `ai-agreement-standards.ai.yaml`. Seven of seventy paths in a real
+ *     adopter's AGENTS.md pointed at nothing, in a block whose first line tells
+ *     the agent it must read them.
+ *   - the index block filtered entries by an `.ai.yaml` suffix, which no ID
+ *     has, so every core standard was dropped. That is why the same adopter's
+ *     previous block listed seven options and none of its sixty-three core
+ *     standards.
+ *   - the task-mapping lookup is keyed by filename, so an ID missed every
+ *     time and the standard quietly got no mapping.
+ *
+ * Returns null when the entry cannot be resolved — a caller must not fall back
+ * to printing the raw entry, which is the bug above.
+ *
+ * @param {string} entry - A manifest `standards` entry: registry ID or path
+ * @param {string} format - Content format: 'ai' or 'human'
+ * @returns {string|null} Basename as installed, or null if unresolvable
+ */
+export function resolveStandardFilename(entry, format = 'ai') {
+  if (typeof entry !== 'string' || entry.length === 0) return null;
+
+  // A path (option files, and legacy pre-3.4.0 manifests) already names itself.
+  if (entry.includes('/') || entry.includes('.')) {
+    const parts = entry.split(/[/\\]/);
+    return parts[parts.length - 1] || null;
+  }
+
+  const found = getAllStandards().find((s) => s.id === entry);
+  if (!found) return null;
+  const source = getStandardSource(found, format);
+  if (!source) return null;
+  const parts = source.split(/[/\\]/);
+  return parts[parts.length - 1] || null;
+}

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.3.7",
+  "version": "6.3.8",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.3.7"
+      "version": "6.3.8"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.3.7",
+      "version": "6.3.8",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.3.7",
+      "version": "6.3.8",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.3.7",
+      "version": "6.3.8",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.3.7",
+      "version": "6.3.8",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.3.7",
+      "version": "6.3.8",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"