universal-dev-standards 6.4.0 → 6.5.0

package/bundled/core/mutation-testing.md

@@ -1,7 +1,7 @@
 # Mutation Testing Standards
 
-**Version**: 1.0.0
-**Last Updated**: 2026-05-04
+**Version**: 1.1.0
+**Last Updated**: 2026-08-14
 **Applicability**: All software projects with unit/integration tests
 **Scope**: universal
 **Industry Standards**: ISTQB Foundation Syllabus (test effectiveness metrics)
@@ -30,6 +30,42 @@ A test with `expect(x).toBeDefined()` can achieve 100% line coverage but survive
 
 ---
 
+## Attribution: Kill Is Credited to the First Failing Test
+
+`Killed` means *some* test in the run failed against the mutant — most tools do not record *which* test killed it, and none records *which test level*. A 7/7 kill score therefore verifies the **whole suite that ran against the mutant**, not any single test, and not any single test level (unit vs. integration vs. property).
+
+**Consequence**: "the property suite verifies X" is not a claim an aggregate mutation run supports. To support it, re-run mutation testing with *only* the property suite active:
+
+```bash
+npx stryker run --mutate 'src/module/**' -- --project=property
+```
+
+If the isolated run kills fewer mutants than the aggregate run, the gap is exactly what the unit/integration tests were quietly covering.
+
+**Rule**: high-risk modules (the same set the 80% threshold applies to — auth/license/payment/security) must re-run mutants against the property suite in isolation before any claim of "property-verified" is made.
+
+---
+
+## One-Sided Invariants Miss Fail-Closed Defects
+
+A property like "output never exceeds the limit" is one-sided: it cannot detect a mutant that makes the code **fail closed** — reject everything, including valid input — because a fail-closed mutant never produces an over-limit output. The mutation score looks unaffected while an entire class of defect (denial of service, wrongly rejected requests) is invisible to the suite.
+
+**Fix**: pair every one-sided invariant with its opposite boundary. "Never exceeds the limit" needs a companion property — e.g. "accepts everything at or below the limit" — so that both over-permissive and over-restrictive mutants have a path to detection.
+
+---
+
+## Equivalent Mutants Are Not Survivors to Chase
+
+A surviving mutant is not automatically a test gap. Some mutants are **semantically equivalent** to the original — no input can distinguish their behavior — and no test can kill them, regardless of how it's written. Forcing a kill with an assertion that exists only to move the score (`expect(x).toBeDefined()` on an incidental value) produces a hollow test without closing any real gap.
+
+**Required classification for every reviewed survivor**:
+- **Genuine gap** → write a test that exercises the distinguishing behavior.
+- **`equivalent, because <reason>`** → recorded with the input(s) checked to reach that conclusion.
+
+An unclassified survivor is not the same as a classified-equivalent one. Only a classified-equivalent mutant may be excluded from the score's denominator.
+
+---
+
 ## Tools
 
 | Language | Tool | Command |
@@ -87,6 +123,9 @@ npm install --save-dev @stryker-mutator/core @stryker-mutator/vitest-runner
 - Adding mutation testing to CI for every PR (too slow)
 - Accepting AI-generated tests without mutation score validation
 - Killing mutations by adding `toBeDefined()` assertions
+- Claiming "the property suite verifies X" from an aggregate (not isolated) mutation run
+- Using only a one-sided invariant for a property that has a fail-closed failure mode
+- Forcing a kill on a semantically equivalent mutant instead of classifying it `equivalent, because <reason>`
 
 ---
 

package/bundled/core/test-governance.md

@@ -2,8 +2,8 @@
 
 > **Language**: English | [繁體中文](../locales/zh-TW/core/test-governance.md)
 
-**Version**: 1.1.0
-**Last Updated**: 2026-04-20
+**Version**: 1.2.0
+**Last Updated**: 2026-08-14
 **Applicability**: All software projects
 **Scope**: universal
 
@@ -62,6 +62,23 @@ Run static analysis tools before test execution:
 - `eslint .` (TypeScript/JavaScript)
 - `mypy .` (Python type checking)
 
+### Threshold Gates Must Fail Closed
+
+A measurement layer that prints a percentage but exits `0` regardless of whether that number cleared its threshold is a report, not a gate. It stays green while the number it prints drifts downward across commits, and nothing stops the next merge.
+
+Every check with a pass/fail threshold — coverage, lint, mutation score, or any other bounded metric — must translate "below threshold" into a non-zero exit code, using the tool's own enforcement flag rather than a wrapper script that re-parses printed output after the fact:
+
+| Tool | Fail-closed flag |
+|------|-------------------|
+| pytest-cov | `--cov-fail-under=<N>` |
+| coverage.py | `coverage report --fail-under=<N>` |
+| diff-cover | `diff-cover coverage.xml --fail-under=<N>` |
+| nyc / Istanbul | `--check-coverage --lines <N>` |
+| Stryker Mutator | `thresholds.break` in `stryker.config.json` |
+| ESLint | `--max-warnings 0` |
+
+A wrapper script that computes the number, prints it, and always `exit 0` satisfies neither this rule nor `verification-evidence`'s Evidence Validity rule 1 — the tool's exit code no longer carries any information about the artefact it measured.
+
 ---
 
 ## Completion Criteria
@@ -124,6 +141,7 @@ Release completion criteria (checked before release):
 | pyramid-compliance | Planning test strategy | Follow the 70/20/7/3 pyramid ratio as a guideline. Deviation is acceptable with documented justification | Required |
 | sit-isolation | Running system tests | System tests should stub external dependencies but use real internal services. Use SIT environment for system-level validation | Recommended |
 | test-execution-continuity | Adding or completing a test case | A test case must be wired to an automated execution trigger (CI gate, build hook, or scheduled run). A test that exists but is never run provides false confidence and is worse than no test at all. Verify that execution history exists before marking test coverage as complete. | Required |
+| fail-closed-threshold-gate | Configuring or reviewing any coverage/lint/mutation/other threshold check | The check must use the tool's fail-under (or equivalent) enforcement flag so it exits non-zero when the threshold is not met. A script that only prints the number and always exits 0 is a report, not a gate, and does not satisfy this rule | Required |
 
 ---
 
@@ -139,6 +157,7 @@ Release completion criteria (checked before release):
 - [Testing Standards](testing-standards.md) — Testing pyramid and coverage ratios
 - [Test Completeness Dimensions](test-completeness-dimensions.md) — 8-dimension test coverage
 - [Check-in Standards](checkin-standards.md) — Pre-commit quality gates
+- [Verification Evidence](verification-evidence.md) — Evidence Validity governs how to *read* an exit code once produced; `fail-closed-threshold-gate` governs how the gate must be *built* so that exit code carries real information in the first place
 
 ---
 
@@ -147,3 +166,4 @@ Release completion criteria (checked before release):
 | Version | Date | Changes |
 |---------|------|---------|
 | 1.0.0 | 2026-03-11 | Initial version — test policy, completion criteria, environment management |
+| 1.2.0 | 2026-08-14 | Added `fail-closed-threshold-gate` — coverage/lint/mutation threshold checks must exit non-zero below threshold, not just print the number |

package/bundled/core/translation-lifecycle-standards.md

@@ -2,8 +2,8 @@
 
 > **Language**: English | [繁體中文](../locales/zh-TW/core/translation-lifecycle-standards.md)
 
-**Version**: 1.0.0
-**Last Updated**: 2026-04-20
+**Version**: 1.0.1
+**Last Updated**: 2026-08-12
 **Status**: Trial (expires 2026-10-20)
 **Applicability**: All projects with multi-language documentation
 **Scope**: universal
@@ -100,7 +100,7 @@ When updating a translation after a source change:
 
 When `core/*.md` files are staged, the pre-commit hook runs `check-translation-sync.sh` and shows OUTDATED warnings. The hook **never blocks** the commit (blocking at commit time is too disruptive) — it is a reminder only.
 
-Setup: `./scripts/install-hooks.sh` (one-time, after clone)
+Setup: `node scripts/install-hooks.mjs` (one-time, after clone; `./scripts/install-hooks.sh` is a POSIX wrapper around the same logic)
 
 ### Release Gate (`check-translation-sync.sh`)
 
@@ -112,9 +112,9 @@ bash scripts/check-translation-sync.sh
 # exit 0 if only MINOR/PATCH gaps (with advisory output)
 ```
 
-### Version Bump Integration (`bump-version.sh`)
+### Version Bump Integration (`bump-version.mjs`)
 
-`bump-version.sh` automatically runs `check-translation-sync.sh` after version files are updated, showing the translation health snapshot at the moment of bump — giving the author immediate feedback on what needs updating before publish.
+`bump-version.mjs` automatically runs `check-translation-sync.sh` after version files are updated, showing the translation health snapshot at the moment of bump — giving the author immediate feedback on what needs updating before publish. `scripts/bump-version.sh` is a thin POSIX wrapper that execs `bump-version.mjs` — the bump logic itself lives only in the `.mjs` file.
 
 ---
 
@@ -159,4 +159,4 @@ bash scripts/check-translation-sync.sh
 - [standard-admission-criteria.md](standard-admission-criteria.md) — How new standards are admitted (triggers TRANS-001)
 - `scripts/check-translation-sync.sh` — Implementation of this standard's automation rules
 - `.githooks/pre-commit` — Pre-commit integration
-- `scripts/install-hooks.sh` — Hook installation
+- `scripts/install-hooks.mjs` — Hook installation (`scripts/install-hooks.sh` is a POSIX wrapper)

package/bundled/core/verification-evidence.md

@@ -2,8 +2,8 @@
 
 > **Language**: English | [繁體中文](../locales/zh-TW/core/verification-evidence.md)
 
-**Version**: 1.2.0
-**Last Updated**: 2026-07-17
+**Version**: 1.3.0
+**Last Updated**: 2026-08-14
 **Applicability**: All AI-assisted development workflows
 **Scope**: universal
 **Inspired by**: [Superpowers](https://github.com/obra/superpowers) — verification-before-completion (MIT)
@@ -39,6 +39,7 @@ The first is a form of hallucination. **The second is not** — nothing was inve
 | Environment Layer | Which environment the evidence was collected from (`local` / `uat` / `prd`) |
 | Evidence Validity | Whether the evidence *itself* is trustworthy — i.e. whether the verification command actually ran and actually measured what it claims |
 | Silent Tool Failure | A verification command that fails to run, or runs without measuring anything, yet produces output indistinguishable from a genuine result |
+| Evidence Freshness | Whether evidence was produced by a run executed *after* the most recent edit to the code, prompt, or configuration under test — not carried over from a run against an earlier state |
 
 ---
 
@@ -178,7 +179,7 @@ The Iron Law stops an agent from claiming success **without** evidence. It does
 
 This is not hallucination. Hallucination is inventing what you did not check. This is the reverse: **you checked, and the checking tool lied to you.** The `anti-hallucination` standard does not cover it — every prohibition there is a form of "don't make things up", and here nothing was made up.
 
-### The four validity rules
+### The five validity rules
 
 **1. `exit_code = 0` means success only for tools that return 0 on success.**
 
@@ -196,6 +197,20 @@ Suppressing stderr (`2>/dev/null` and equivalents) silences precisely the channe
 
 With `set -o pipefail`, `producer | grep -q pattern` inherits a non-zero from `producer` regardless of whether `grep` matched. When the decision depends on content, **capture the output first, then evaluate it** — do not let a pipeline collapse two questions into one number.
 
+**5. Evidence must postdate the last edit to what it verifies.**
+
+A verification run captured *before* the most recent change to the code, prompt, or configuration under test proves something — just not the thing being claimed. The trap is silent: the full suite ran green, something was edited afterward (a prompt, a config value, a threshold), and only a narrower check (lint, a partial suite) ran after that edit — yet the earlier green run gets cited as evidence for the current state. **Evidence is a single fresh execution captured after the last edit, not the most recent execution that happened to pass.**
+
+### Stale Evidence — a failure shape
+
+Rules 1–4 assume the evidence was collected in the right place and read correctly. They say nothing about *when*. A command that ran, measured correctly, and returned a true result can still fail to support a completion claim, if something changed after it ran.
+
+**Shape of the failure**: the full test suite runs and passes. Afterward, a prompt or a configuration value is edited — no test exercises that edit directly. Before committing, only `lint` is run, and it also passes. The commit is made citing "tests pass" as evidence. CI then fails, red on a test that pins the exact content that was just changed — the suite that "passed" ran against a version of the artefact that no longer exists by the time the claim was made.
+
+規則 1–4 假設證據**在正確的地方**被蒐集且被正確解讀。它們沒有回答「**什麼時候**」這個問題。一個執行了、量測正確、也回傳真結果的指令，依然可能撐不起一個完成聲明——如果它跑完之後有東西又變了。
+
+**失效樣態**：完整測試套件跑過且通過。之後，某個提示詞或設定值被編輯——沒有任何測試直接涵蓋那次編輯。提交前只跑了 `lint`，也通過。commit 引用「測試通過」作為證據。接著 CI 紅在一個釘住剛剛被改掉那份內容的測試上——那個「通過」的套件，跑的是一個在主張被提出時已經不存在的版本。
+
 ### Evidence of the failure mode
 
 The following are real verification commands run by an AI agent on 2026-07-17, each of which produced a confident, wrong conclusion that was then reported as fact:
@@ -225,11 +240,32 @@ The following are real verification commands run by an AI agent on 2026-07-17, e
 | `verification_evidence` exists but `exit_code ≠ 0` | Mark as **verification failed** — **unless** the tool is known to exit non-zero in the state under test (Evidence Validity rule 1), in which case judge by output |
 | `exit_code = 0` but the command could not have measured the claim | Mark as **unverified** — a passing command that ran in the wrong place, or never ran at all, is not evidence |
 | Evidence asserts absence (`0`, empty, "not found") | Mark as **unverified** until the query tool is shown to have executed successfully |
+| Evidence's timestamp precedes the most recent edit to what it verifies | Mark as **stale** — re-run after the edit; do not cite the earlier pass |
 | Multiple verification steps | **All** steps must pass |
 | Agent provides evidence for wrong command | Mark as **unverified** |
 
 ---
 
+## Narrow Coverage Must Be Registered, Not Just Disclosed
+
+Evidence Validity and the Environment Stratification Matrix both allow a documented gap — an environment that cannot exercise a dimension, a check whose measurement is narrower than the claim it is cited for. A written disclosure of that gap is not, by itself, enough: prose is cheaper than closing the gap, and a disclosure that is never revisited quietly becomes a permanent excuse for evidence that no longer supports what it is used to support.
+
+**Requirement**: any such documented gap must also be registered in a dated exception inventory — external to the standard or the matrix entry itself — naming the gap, its reason, and a review or expiry date. A footnote with no corresponding inventory entry does not satisfy this rule.
+
+**Falsifiable condition**: an inventory entry left unchanged across two consecutive review cycles means the disclosure has become an escape hatch, and the rule is violated for that entry — not "partially satisfied", violated. The inventory's location, format, and cadence are left to the adopting project; this standard requires only that one exists and that entries move.
+
+This is the same requirement as [class-level-fix](class-level-fix.md)'s narrow-coverage rule, applied to verification evidence rather than to class-level checks: in both cases, a disclosure that never has to change is not a disclosure — it is a permanent exemption wearing a disclosure's clothes.
+
+Evidence Validity 與 Environment Stratification Matrix 都允許一個被記錄下來的缺口——一個無法驗證某個維度的環境層次、一項量測範圍窄於它所支撐主張的檢查。單純寫下這個缺口本身並不夠：散文比真正補上缺口便宜，而一個從未被重新檢視的揭露，會悄悄變成「這份證據其實撐不起它被用來支撐的主張」的永久藉口。
+
+**要求**：任何這一類已記錄的缺口，必須同時登記到一份**帶到期日的例外清冊**——獨立於標準本文或 matrix 條目本身之外——指名缺口、其成因、並附上覆核或到期日期。只有一則註腳而沒有對應清冊條目，不滿足本條。
+
+**可證偽條件**：一則清冊條目連續兩期審查都未變動，代表該揭露已經變成逃生口，本條對該條目失效——不是「部分滿足」，是失效。清冊放在哪裡、什麼格式、多久審一次，留給採用專案自行決定；本標準只要求「有這麼一份東西存在，且條目會動」。
+
+這與 [class-level-fix](class-level-fix.md) 的窄涵蓋規則是同一條要求，套用在驗證證據而非類別層檢查上：兩種情況下，一個永遠不必改變的揭露都不是揭露，是一份穿著揭露外衣的永久豁免。
+
+---
+
 ## Rules
 
 | ID | Trigger | Action | Priority |
@@ -244,6 +280,8 @@ The following are real verification commands run by an AI agent on 2026-07-17, e
 | VE-008 | Evidence claims absence (`0`, empty output, "not found") | Invalid until the query tool is shown to have run successfully. Re-run without stderr suppression | High |
 | VE-009 | An existence/absence check suppresses stderr (`2>/dev/null` or equivalent) | Evidence does not stand. Re-run with stderr visible | High |
 | VE-010 | Evidence's `exit_code` comes from a pipeline (esp. under `pipefail`) | The code attributes to no single stage. Capture the output and evaluate content instead | Medium |
+| VE-011 | Evidence's execution timestamp precedes the most recent edit to the artefact it claims to verify | Mark **stale** — not valid evidence for the current state; require a fresh single run captured after the edit | High |
+| VE-012 | A documented evidence/coverage gap (environment-stratification ⚠️/❌, or any check narrower than the claim it supports) has no entry in a dated exception inventory | Disclosure alone does not satisfy this rule — require a registered, dated inventory entry naming the gap and its review/expiry | Required |
 
 ---
 
@@ -323,6 +361,7 @@ verification_evidence:
 - [Testing Standards](testing-standards.md) — how the tests that produce most evidence are written
 - [Agent Dispatch](agent-dispatch.md) — delegated work returns claims that need this standard applied to them
 - [Deployment Standards](deployment-standards.md) — defines the Environment Stratification Responsibility Matrix referenced by VE-005 / VE-006
+- [Class-Level Fix](class-level-fix.md) — the same narrow-coverage-must-be-registered requirement (VE-012), applied to class-level checks rather than to verification evidence
 
 ---
 

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,8 +1,8 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.4.0
-translation_version: 6.4.0
-last_synced: 2026-08-10
+source_version: 6.5.0
+translation_version: 6.5.0
+last_synced: 2026-08-14
 status: current
 ---
 
@@ -17,6 +17,15 @@ status: current
 
 ## [Unreleased]
 
+## [6.5.0] - 2026-08-14
+
+> ⚠️ **本节简体译文待补。** 本次发布包含两批内容：XSPEC 借鉴 B-01 的五条标准补强
+> （`verification-evidence` VE-011/VE-012、`test-governance` 门槛闸须 fail-closed、
+> `mutation-testing` kill 归因、`class-level-fix` 负向控制极限声明），
+> 以及 XSPEC-362 的 `model-selection` 2.1.0 与 `agent-dispatch` 复位。
+> 完整内容见 [English](../../CHANGELOG.md) 或 [繁體中文](../zh-TW/CHANGELOG.md)。
+> **此处明示未翻译，而非以繁体内容充当简体译文。**
+
 ## [6.4.0] - 2026-08-10
 
 ### 新增

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.4.0 | **发布日期**: 2026-08-10 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.5.0 | **发布日期**: 2026-08-14 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-CN/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支持状态 |
 |------|--------|
-| 6.3.10 | ✅ 最新正式版 |
+| 6.5.0 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已终止支持 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->