universal-dev-standards 6.8.0 → 6.10.0

package/bin/uds.js

@@ -130,10 +130,13 @@ program
   .option('--framework <framework>', 'Framework extension (fat-free)')
   .option('--locale <locale>', 'Locale extension (zh-tw)')
   .option('--skills-location <location>', 'Skills location (marketplace, user, project, none) [default: marketplace]')
-  .option('--content-mode <mode>', 'Content mode for integration files (minimal, index, full) [default: index]')
+  // No double quotes in this description: generate-usage-docs.mjs parses the
+  // option table out of this file and truncates at the first one, which turned
+  // the retirement note into a dangling semicolon in three locales.
+  .option('--content-mode <mode>', 'Content mode for integration files (minimal, index) [default: index]; full is retired and resolves to index')
   .option('--agents-md', 'Generate AGENTS.md universal summary')
   .option('--no-agents-md', 'Skip AGENTS.md generation')
-  .option('--with-hooks', 'Install enforcement hooks (commit-msg, security, logging)')
+  .option('--with-hooks', 'Install enforcement hooks declared by the installed standards')
   .option('--content-layout <layout>', 'Content layout (flat, layered) [default: flat]')
   .option('-y, --yes', 'Use defaults, skip interactive prompts')
   .option('-E, --experimental', 'Enable experimental features (methodology)')
@@ -223,6 +226,7 @@ program
   .option('--plan', 'Show reconciliation plan without executing (like terraform plan); combines with --skills/--commands to plan just that scope, still writing nothing')
   .option('--apply', 'Apply exactly the plan --plan prints (plain `uds update` does not); with --skills/--commands it does the reconciliation AND that scope, not only the scope')
   .option('--force', 'Force update all files, ignoring hash comparison')
+  .option('--prune', 'Delete .standards/ files UDS wrote but no longer ships (listed without this flag; never touches files UDS did not write)')
   .option('--rollback', 'Rollback to the most recent backup')
   .option('--locale <locale>', 'Override locale for skills install (zh-tw, zh-cn, en); also reads .uds/install.yaml + UDS_LOCALE env')
   .action(updateCommand);
@@ -250,6 +254,12 @@ program
   .option('--trend', 'Show historical score trend (use with --score)')
   .option('--ci', 'CI mode: output score only, exit 1 if below threshold (use with --score)')
   .option('--threshold <n>', 'Score threshold for CI mode (default: 75)', '75')
+  // XSPEC-383 R8 — static effect boundary gate. Exits 0 clean / 1 findings /
+  // 2 cannot measure. Attached to `audit` rather than a new top-level command
+  // because `audit` already means "walk the code looking for a shape", and a new
+  // command is surface every adopter has to learn.
+  .option('--effects', 'Static effect boundary gate: do the implementations of each declared effect interface reach anything outside this process')
+  .option('--effects-config <path>', 'Path to the effect-family config (default: .uds/effect-boundary.json)')
   .action(auditCommand);
 
 program

package/bundled/ai/standards/acceptance-criteria-traceability.ai.yaml

@@ -7,8 +7,8 @@ standard:
   description: AC-to-test traceability matrix, coverage calculation, and spec generation quality rules
 
   meta:
-    version: "1.1.0"
-    updated: "2026-03-18"
+    version: "1.2.0"
+    updated: "2026-08-24"
     source: core/acceptance-criteria-traceability.md
     references:
       - "ISO/IEC/IEEE 29119-3 (Test Documentation — Traceability Matrix)"
@@ -268,3 +268,15 @@ related_standards:
   - testing-standards.md
   - checkin-standards.md
   - test-governance.md
+
+# ── Deferred items produced here ─────────────────────────────────────────────
+# Pointer, not a summary: the exit invariant is stated once, in deferred-item-exit.
+deferred_items:
+  produced_here:
+    - "Gaps: Uncovered AC / Partial AC"
+    - "Threshold Exceptions"
+    - "report Action Items"
+  governed_by: deferred-item-exit
+  note: >
+    規則只在 core/deferred-item-exit.md 一處陳述；此處放指標不放摘要。
+    摘要會腐壞，指標不會。

package/bundled/ai/standards/adr-standards.ai.yaml

@@ -3,8 +3,8 @@
 
 id: adr-standards
 meta:
-  version: "1.0.0"
-  updated: "2026-03-26"
+  version: "1.1.0"
+  updated: "2026-08-24"
   source: core/adr-standards.md
   guide: skills/adr-assistant/guide.md
   description: Architecture Decision Records for tracking significant technical decisions
@@ -91,3 +91,15 @@ dec_borrowing_rules:
   tech_radar_index:
     location: "cross-project/decisions/TECH-RADAR.md"
     sync_rule: "Update TECH-RADAR.md whenever a DEC's radar state changes"
+
+# ── Deferred items produced here ─────────────────────────────────────────────
+# Pointer, not a summary: the exit invariant is stated once, in deferred-item-exit.
+deferred_items:
+  produced_here:
+    - "Consequences → Bad / Accepted risk"
+    - "Links"
+    - "options considered but not taken up"
+  governed_by: deferred-item-exit
+  note: >
+    規則只在 core/deferred-item-exit.md 一處陳述；此處放指標不放摘要。
+    摘要會腐壞，指標不會。

package/bundled/ai/standards/code-review.ai.yaml

@@ -12,8 +12,8 @@ standard:
     - "Be constructive and explain 'why'"
 
   meta:
-    version: "2.1.0"
-    updated: "2026-06-18"
+    version: "2.2.0"
+    updated: "2026-08-24"
     source: core/code-review-checklist.md
     description: Systematic checklist for reviewing code quality and security
 
@@ -137,4 +137,14 @@ physical_spec:
   type: filesystem_schema
   validator:
     command: "test -d .github/PULL_REQUEST_TEMPLATE || test -f .github/pull_request_template.md || test -f .github/PULL_REQUEST_TEMPLATE.md"
-    rule: "pr_template_exists"
+    rule: "pr_template_exists"
+
+# ── Deferred items produced here ─────────────────────────────────────────────
+# Pointer, not a summary: the exit invariant is stated once, in deferred-item-exit.
+deferred_items:
+  produced_here:
+    - "non-blocking comments accepted without a change in this change"
+  governed_by: deferred-item-exit
+  note: >
+    規則只在 core/deferred-item-exit.md 一處陳述；此處放指標不放摘要。
+    摘要會腐壞，指標不會。

package/bundled/ai/standards/commit-message.ai.yaml

@@ -119,9 +119,13 @@ physical_spec:
     command: 'echo "{input}" | npx commitlint'
 
 enforcement:
-  hook_type: PreCommit
-  trigger: UserPromptSubmit
-  script_ref: "scripts/hooks/validate-commit-msg.js"
-  hook_script: "scripts/hooks/validate-commit-msg.js"
+  # 🔴 hook_type was "PreCommit" — Claude Code has no such event — and the
+  # trigger was UserPromptSubmit, so the validator ran on every prompt and
+  # exited 1 every time. It belongs on the Bash call that makes the commit.
+  hook_type: PreToolUse
+  trigger: PreToolUse
+  matcher: Bash
+  script_ref: "scripts/hooks/validate-commit-msg.mjs"
+  hook_script: "scripts/hooks/validate-commit-msg.mjs"
   severity: error
   timeout_ms: 500

package/bundled/ai/standards/deferred-item-exit.ai.yaml

@@ -0,0 +1,225 @@
+# Deferred Item Exit Standard - AI Optimized
+# Source: core/deferred-item-exit.md
+
+standard:
+  id: deferred-item-exit
+  name: Deferred Item Exit Standard
+  description: 延後項目出口標準——延後項目必須離開文件
+
+  meta:
+    version: "1.0.0"
+    updated: "2026-08-24"
+    source: core/deferred-item-exit.md
+    description: >
+      有一批標準會產出延後項目（ADR 的既受風險、規格的未納入清單、retrospective 的
+      action items、探索矩陣的未確認候選、review 的非阻斷建議、AC 報告的缺口），
+      每一條都規定了那份文件要怎麼寫好，沒有一條規定那些項目之後去哪。
+      於是文件寫完就是終點。本標準補上那個缺失的關係：延後項目必須有一個
+      在文件之外的可追蹤出口，而出口的識別字寫在文件裡。
+
+  iron_law: >
+    一個記錄在文件裡的延後項目，必須在該文件之外有一個可追蹤的出口，
+    而該出口的識別字必須寫在文件裡、緊鄰該項目。
+    判準是「這個項目離開文件了嗎」，不是「用了什麼工具」。
+
+  # ── 寫法約束：先讀這一段，它拘束下面每一條 ────────────────────────────────
+  # DEC-049「UDS defines activities, adoption layers orchestrate」曾據以在 6.0.0
+  # 刪掉八條機器可讀標準（其中七條正是工作流狀態）。寫成編排協定會被同一條理由擋下。
+  writing_constraint:
+    basis: DEC-049
+    reference: docs/MIGRATION-v6.md §2
+    admissible_what:
+      - "artefact 之間必須存在的關係"
+      - "一項宣稱要算作證據所必須具備的性質"
+      - "一份回報必須保留的區別"
+      - "延後項目必須有出口"
+    inadmissible_how:
+      - "artefact 必須通過的狀態機"
+      - "必須產出該宣稱的 pipeline 階段"
+      - "回報格式、工具或 schema"
+      - "哪一個 issue tracker／看板／檔案是那個出口"
+    rule: >
+      每一條要求都寫成「必須存在什麼關係」，絕不寫成「應使用什麼機制維持它」。
+      UDS 本來就有一整類這個形狀的標準——acceptance-criteria-traceability
+      要求每一條 AC 都能被某個測試到達，而不規定用什麼維持那條可達性。
+    consequence: >
+      本標準不附帶任何閘門。它只說什麼必須為真；有沒有東西在檢查是採用專案的決定，
+      而 DEX-004 是用來讓那個決定沒辦法被默默做掉的。
+
+  guidelines:
+    - "延後項目必須離開文件——**判準是「離開了嗎」，不是「用了什麼工具」**"
+    - "出口的載體刻意不指定：issue／tracked TODO／manifest 條目／backlog 一列都算"
+    - "**出口必須在產出該文件的那次變更落地之後仍然解析得到**，且仍承載該項目"
+    - "**連結存在不等於連結有效**——必須驗證那個出口確實承載這個項目"
+    - "「有連結且已驗證內容」與「有連結但內容未驗證」**不得印出同一個綠**"
+    - "**錨點走訪結構，不走訪措辭**——結構可窮舉，措辭不可"
+    - "措辭清單的涵蓋率是未知的，必須明示；它的綠燈不得被讀成完整"
+    - "任何窗口／閾值必須寫下來歷，或標為未校準"
+    - "**一支從未紅過的檢查，與一支不可能紅的檢查，輸出一模一樣**"
+
+  # ── 出口的三條關係，全部成立才滿足不變量 ──────────────────────────────────
+  exit_relations:
+    - order: 1
+      relation: "出口存在於這份文件之外"
+      fails_when: "該項目唯一的紀錄就是這份文件的文字"
+    - order: 2
+      relation: "出口可由一個寫在文件裡的識別字定址"
+      fails_when: "文件寫著「之後再處理」而沒有任何可定址的東西"
+    - order: 3
+      relation: "產出該文件的那次變更落地之後，出口仍然解析得到"
+      fails_when: "出口被同一次變更關閉、刪除或取代"
+      observed_leaks:
+        - "待辦寫進會被本次合併關閉的 issue——文件指向一筆在工作被接受當下就停止存在的紀錄"
+        - "待辦寫進出口的留言而非本體，被後續留言推走——出口解析得到，讀出口卻讀不到那個項目"
+
+  # ── 連結存在 ≠ 連結有效 ────────────────────────────────────────────────
+  link_validity:
+    instance: >
+      文件寫著「與 issue #19 一併決定」，而 #19 裡根本沒有這件事。
+      三條關係全部成立，項目照樣不見了。一道只問識別字在不在的閘門會放行這份文件，
+      而它印出的綠燈與「出口都為真」的綠燈逐位元相同。
+    two_states_required:
+      - state: linked_verified
+        meaning: "讀過出口，它承載這個項目"
+      - state: linked_unverified
+        meaning: "識別字在，但它有沒有承載這個項目未知"
+      - state: no_exit
+        meaning: "違反 DEX-001"
+    why_not_one_state: >
+      把前兩態合併成單一通過數，不是通往規則的捷徑——那正是這條規則要防的缺陷，
+      被制度化並給了一個編號。一個被回報成通過的未知，比一個被回報成未知的未知更糟，
+      因為後者還找得到。
+    partial_adoption: >
+      只做得起便宜那一半，屬於 verification-evidence VE-012 / class-level-fix CLF-008
+      已經在管的涵蓋缺口：**必須登記到帶到期日的例外清冊，不能只寫一句揭露**。此處不複述。
+
+  # ── 錨點：走訪結構，不走訪措辭 ────────────────────────────────────────────
+  anchors:
+    principle: "結構由「要求產出這份文件的那條標準」定義，因此可窮舉；措辭不可窮舉，而且沒有任何一張措辭清單能被證明完整"
+    structural_locations:
+      adr: ["Consequences → Bad / Accepted risk", "Links", "被考慮而未採用的選項"]
+      spec: ["未納入／不在本版的段落", "open questions", "待確認的 assumptions"]
+      retrospective: ["Action Items", "Previous Action Items Review 中仍為 Open 的列", "附理由 Cancelled 的項目"]
+      feature_discovery: ["零打勾候選", "dead_code_candidates", "升級為人工觀察的候選"]
+      code_review: ["非阻斷留言類別（⚠️ IMPORTANT／💡 SUGGESTION／[SUGGESTION]／[NIT]）本次未改而被接受者"]
+      ac_coverage_report: ["Gaps → Uncovered AC / Partial AC", "Threshold Exceptions", "Action Items"]
+    wording_list:
+      allowed: true
+      but: >
+        DEX-008 隨即適用：涵蓋率未知必須明示，綠燈不得被讀成「沒有漏掉延後項目」。
+        一張含「待決定」「未納入」的清單，對「這一點我們先放著」這句話什麼也沒說。
+      general_form: class-level-fix
+      note: "閘門自行列舉範圍，正確到有人新增第四個成員為止——措辭清單在構造上就是這個失敗"
+    thresholds: >
+      「識別字須出現在項目後 3 行內」這類判準決定了建立其上的一切的召回率。
+      沒有東西記下 3 是怎麼來的，就沒有人能評估把它改成 2 或 5，也沒有人分得出它是量出來的還是猜的。
+      寫下來歷，或標為未校準——兩者都可接受，沉默不行。
+
+  # ── 證據可採性 ────────────────────────────────────────────────────────
+  evidence_admissibility:
+    rule: >
+      一支被提出作為本標準證據的檢查，必須已經被觀察到「對一個刻意違規的樣本回報失敗」。
+      從未紅過的檢查不是可採信的證據。
+    why: "一支從未失敗過的檢查，與一支不可能失敗的檢查，輸出一模一樣"
+    procedure_lives_in: class-level-fix   # 逐子集合成成員；此處不複述
+    exit_code_caveat_lives_in: verification-evidence
+
+  anti_patterns:
+    - pattern: "記下延後項目，然後核准文件"
+      why: "文件是唯一的載體，而它現在被視為完成了"
+    - pattern: "出口被產出該文件的同一次變更關閉"
+      why: "指標在工作進行中解析得到，工作結束後就不再解析得到"
+    - pattern: "項目寫進出口的留言而不是出口本體"
+      why: "出口解析得到；讀出口卻讀不到那個項目"
+    - pattern: "檢查識別字在不在"
+      why: "「在」與「對」印出同一個綠"
+    - pattern: "已驗證與未驗證的連結共用一個通過狀態"
+      why: "把上一列的缺陷變成永久的，還給了它一個編號"
+    - pattern: "把措辭清單當成「延後」的定義"
+      why: "正確到有人換一種寫法為止，而沒有東西會說"
+    - pattern: "沒有記下來歷的窗口大小"
+      why: "它決定整個判定的召回率，而沒有人能檢查它"
+    - pattern: "從未被觀察到失敗的檢查"
+      why: "與一支不可能失敗的檢查無從分辨"
+
+  rules:
+    - id: DEX-001
+      rule: "文件裡記下的延後項目，必須在文件之外有可追蹤的出口，且文件在該項目旁載明出口識別字"
+      severity: error
+    - id: DEX-002
+      rule: "產出該文件的變更落地之後，出口仍然解析得到且仍承載該項目"
+      severity: error
+    - id: DEX-003
+      rule: "本標準的每一條要求都必須可表述為 artefact 之間可判定的關係；不能如此表述的要求不得進入本標準"
+      severity: error
+    - id: DEX-004
+      rule: "被提出作為本標準證據的檢查，必須已被觀察到對刻意違規的樣本回報失敗；從未紅過的檢查不是可採信的證據"
+      severity: error
+    - id: DEX-005
+      rule: "驗證必須確立「那個出口承載這個項目」，而不只是「識別字解析得到」"
+      severity: error
+    - id: DEX-006
+      rule: "「有連結且已驗證內容」與「有連結但內容未驗證」須回報為兩個相異狀態；合併為單一通過狀態即不滿足 DEX-005"
+      severity: error
+    - id: DEX-007
+      rule: "「這裡有一個延後項目」的錨點，必須是可由該文件自身既定結構窮舉出來的位置"
+      severity: error
+    - id: DEX-008
+      rule: "以措辭清單補充結構錨點時，須明示其涵蓋率未知，且其綠燈不得被回報為完整"
+      severity: warning
+    - id: DEX-009
+      rule: "該判定所用的任何窗口或閾值，須載明來歷，或標為未校準"
+      severity: warning
+
+  # ── 本標準在 UDS 側沒有閘門，這件事被記錄而非被暗示 ──────────────────────
+  enforcement:
+    automated_gate: false
+    why_not: >
+      依上面的寫法約束，UDS 陳述關係，有沒有東西判定它是採用專案的決定。
+      UDS 不出貨這些文件本身，只出貨要求產出它們的標準。
+    what_it_does_instead: >
+      DEX-003 保證這裡每一條「能」被判定；DEX-004 固定「一次判定要算數需要什麼」；
+      DEX-006／DEX-008 固定「一次不完整的判定容許印出什麼」。
+    honest_boundary: >
+      一個採用本標準而什麼都沒建的專案並未違反它——但它同樣不能宣稱自己的延後項目有出口，
+      因為它沒有任何可採信的證據說明有。
+    reopen_condition: >
+      若 UDS 開始出貨那些文件本身而不只是產出它們的標準，
+      走訪 anchors.structural_locations 就在本 repo 內變得可能，屆時誠實的做法是去跑它。
+
+  # ── 產出延後項目的標準：各自放指標，不放摘要 ────────────────────────────
+  producers:
+    list:
+      - id: adr-standards
+        produces: "既受風險、負面後果、被考慮而未採用的選項"
+      - id: spec-driven-development
+        produces: "未納入項目、open questions、待確認的 assumptions"
+      - id: retrospective-standards
+        produces: "action items，以及仍為 Open 的上期項目"
+      - id: feature-discovery-standards
+        produces: "未確認候選與 dead_code_candidates"
+      - id: code-review-checklist
+        produces: "本次未改而被接受的非阻斷留言"
+      - id: acceptance-criteria-traceability
+        produces: "涵蓋缺口、閾值例外、報告的 action items"
+    pointer_not_summary: >
+      六條各加一行指回本標準，**不各自複述規則**——同一條規則複述六次會各自腐壞。
+      摘要會腐壞，指標不會。指標會斷，但斷了是可檢查的（走訪六條，缺指標即失敗）。
+
+  related:
+    - id: acceptance-criteria-traceability
+      relation: "上一層的同一個形狀：要求每條 AC 都能被驗證項到達，而不規定用什麼維持。本標準要求每個延後項目都能被出口到達"
+    - id: class-level-fix
+      relation: "提供 DEX-004 所要求證據的產生程序；也是 DEX-008 所揭露之措辭清單失敗的通則形式"
+    - id: verification-evidence
+      relation: "VE-012 的帶到期日例外清冊，正是 DEX-006 那群「未驗證」項目該被登記進去的地方，而不是揭露一次就放著"
+    - id: self-review-protocol
+      relation: "自我複查抓得到矛盾、抓不到缺漏；沒有出口的延後項目正是缺漏"
+
+physical_spec:
+  applies_to:
+    - "任何標準要求產出、且可能記下延後項目的文件"
+  deliverables:
+    - "每個延後項目旁的出口識別字"
+    - "已驗證／未驗證兩態分開的回報，而非單一通過數"
+    - "任何措辭清單的涵蓋率未知聲明，與任何閾值的來歷（或未校準標示）"

package/bundled/ai/standards/feature-discovery-standards.ai.yaml

@@ -3,8 +3,8 @@
 
 id: feature-discovery-standards
 meta:
-  version: "1.0.0"
-  updated: "2026-05-13"
+  version: "1.1.0"
+  updated: "2026-08-24"
   source: core/feature-discovery-standards.md
   description: Language-agnostic methodology for exhaustive feature discovery in legacy systems; defines Deterministic-First principle, Software Form Taxonomy, five static foundations, dynamic/human observation protocols, and cross-layer validation matrix
   pipeline_position: "Discovery → feature-manifest-standard → behavior-snapshot"
@@ -457,3 +457,15 @@ related_standards:
   - anti-hallucination.ai.yaml
   - acceptance-criteria-traceability.ai.yaml
   - refactoring-standards.ai.yaml
+
+# ── Deferred items produced here ─────────────────────────────────────────────
+# Pointer, not a summary: the exit invariant is stated once, in deferred-item-exit.
+deferred_items:
+  produced_here:
+    - "zero-checkmark candidates"
+    - "dead_code_candidates"
+    - "candidates escalated to human observation"
+  governed_by: deferred-item-exit
+  note: >
+    規則只在 core/deferred-item-exit.md 一處陳述；此處放指標不放摘要。
+    摘要會腐壞，指標不會。

package/bundled/ai/standards/governance-layer.ai.yaml

@@ -3,8 +3,8 @@
 
 id: governance-layer
 meta:
-  version: "1.0.0"
-  updated: "2026-05-07"
+  version: "1.1.0"
+  updated: "2026-08-20"
   source: core/governance-layer.md
   description: "治理層標準（Vision/Mission/Goals 三層架構 + KPI + 紅線清單）"
   scope: universal
@@ -83,7 +83,119 @@ risk_acceptance:
     - signatory
     - gates_bypassed
     - risks_accepted
+    - review_by      # Date the acceptance stops being valid and must be decided again
   fail_closed: "Pipeline MUST refuse to start without a valid Risk Acceptance Clause"
+  expiry:
+    rule: "A clause whose review_by has passed is NOT valid; the pipeline fails closed as if no clause existed"
+    why: >
+      `date` records when the risk was accepted, not when it should be re-examined. Without
+      review_by an acceptance signed once stays in force forever while every field still reads
+      as correct.
+    dispositions:
+      re_accept: "A current signatory signs again with a new review_by"
+      withdraw: "The bypass is removed and human gates are restored"
+      extend: "A new review_by AND a written reason, recorded together"
+    prohibited: >
+      Automatic extension of review_by. It converts a fail-closed gate into a fail-open one
+      while leaving every field looking correct.
+
+# R3 — pending decisions are governed at the same level as accepted risks
+pending_decisions:
+  principle: "'Undecided' is a governance state, not the absence of one"
+  requirements:
+    - id: GOV-PD-001
+      priority: required
+      rule: >
+        Declare WHERE pending decisions are recorded and WHAT marks one — a fixed token
+        (status value, label, literal marker string), never free prose. Enumeration must not
+        depend on guessing the wording.
+    - id: GOV-PD-002
+      priority: required
+      rule: >
+        Enumeration MUST report a total AND the number of sources that could not be parsed.
+        "No pending decisions found" carries no information without the size of the walked set.
+    - id: GOV-PD-003
+      priority: required
+      rule: >
+        Every pending decision carries a decide-by date. On expiry apply one of three
+        dispositions — decide / withdraw the question / extend with a written reason.
+        Automatic extension is prohibited.
+    - id: GOV-PD-004
+      priority: required
+      rule: >
+        If nothing enumerates pending decisions on a schedule, carry an Unattended Declaration
+        naming owner, review cadence, and last-review date. Unenumerated is acceptable;
+        unenumerated and undeclared is not.
+
+# R4 — every aggregate report must declare what it could not evaluate
+aggregate_reporting:
+  principle: "A report is a claim about a set; it is worth what its account of the unevaluable is worth"
+  requirements:
+    - id: GOV-RPT-001
+      priority: required
+      rule: "Print three counts, never two: passed, failed, and undecidable (unparseable / missing field / unreachable source / unsupported format)"
+    - id: GOV-RPT-002
+      priority: required
+      rule: "undecidable MUST NOT be folded into passed and MUST NOT be omitted. An unparseable file is not a clean file"
+    - id: GOV-RPT-003
+      priority: required
+      rule: >
+        State the denominator and how it was derived. A report whose scope comes from a
+        hardcoded list reports on that list, not on the project. Derive by walking and
+        excluding, never by enumerating (see class-level-fix).
+    - id: GOV-RPT-004
+      priority: required
+      rule: >
+        Report positive and negative counts separately; never collapse into one score.
+        A metric on which doing nothing scores the same as doing the work is not measuring
+        the work ("5 of 11 passed" and "the checker never started" give the same figure).
+    - id: GOV-RPT-005
+      priority: recommended
+      rule: >
+        Include a canary — a check with a known-failing input that MUST fail. If the canary
+        passes, report the whole run as undecidable, not green.
+
+# R5 — freshness indicators must name which clock they read
+freshness_metrics:
+  clocks:
+    edit_time:
+      answers: "How long since this artifact was last changed?"
+      readable_from: "File mtime / last commit touching the file / a 'last updated' field"
+    reconciliation_time:
+      answers: "How long since this artifact was last compared against the source of truth it describes?"
+      readable_from: "The recorded date of that comparison — nothing else can supply it"
+  requirements:
+    - id: GOV-FRESH-001
+      priority: required
+      rule: "Any freshness/staleness indicator MUST name which of the two clocks it reads"
+    - id: GOV-FRESH-002
+      priority: required
+      rule: >
+        The two MUST NOT share a field or a column heading. A document edited today whose
+        contents were never checked against reality is zero days old by edit time and
+        unbounded by reconciliation time.
+    - id: GOV-FRESH-003
+      priority: required
+      rule: >
+        Where only edit time is available, label the column as edit time AND report
+        reconciliation age as undecidable — never as fresh, never by omission.
+    - id: GOV-FRESH-004
+      priority: recommended
+      rule: >
+        Reconciliation time is meaningful only if recorded by whatever performed the
+        comparison. A date typed in afterwards is an assertion, not a measurement — label it.
+
+enforcement_reality:
+  ships_a_checker: false
+  note: >
+    Applies to every rule in this standard, including the fail-closed Risk Acceptance
+    requirement present since 1.0.0 — measured 2026-08-20, `review_by` / `risks_accepted` /
+    `gates_bypassed` appear in no program at all, so that clause has never stopped a pipeline.
+    UDS defines these requirements but ships no program that enforces them. Adopters must
+    write the enumerator, the three-count reporter, and the reconciliation-date recorder
+    themselves, and most will not — the same failure this standard describes. The minimum bar
+    is therefore not "build the tooling" but: anything recorded as pending, accepted, or fresh
+    must either point at something that runs, or say plainly that nothing is watching it.
 
 # Governance file structure
 file_structure:
@@ -112,3 +224,17 @@ compliance_checks:
     check: "If gate.mode=trace_only, Risk Acceptance Clause exists in mission.md"
   - id: CK-07
     check: "Evaluator weights 0.4/0.3/0.3 with fail-closed veto at < 0.3"
+  - id: CK-08
+    check: "Every Risk Acceptance Clause has a review_by date and none is past it"
+  - id: CK-09
+    check: "The project declares where pending decisions live and what fixed token marks one"
+  - id: CK-10
+    check: "Every pending decision has a decide-by date"
+  - id: CK-11
+    check: "Pending decisions are either enumerated by something that runs, or covered by an Unattended Declaration"
+  - id: CK-12
+    check: "Every governance report prints passed / failed / undecidable separately and states its denominator and how it was derived"
+  - id: CK-13
+    check: "No report collapses positive and negative counts into a single score"
+  - id: CK-14
+    check: "Every freshness indicator names edit time vs reconciliation time, and the two do not share a field"

package/bundled/ai/standards/logging.ai.yaml

@@ -281,7 +281,7 @@ enforcement:
   matcher:
     tool: Write
     path: "src/**/*.ts"
-  script_ref: "scripts/hooks/check-logging-standard.js"
-  hook_script: "scripts/hooks/check-logging-standard.js"
+  script_ref: "scripts/hooks/check-logging-standard.mjs"
+  hook_script: "scripts/hooks/check-logging-standard.mjs"
   severity: warning
   timeout_ms: 500

package/bundled/ai/standards/retrospective-standards.ai.yaml

@@ -3,8 +3,8 @@
 
 id: retrospective-standards
 meta:
-  version: "1.0.0"
-  updated: "2026-03-26"
+  version: "1.1.0"
+  updated: "2026-08-24"
   source: core/retrospective-standards.md
   guide: skills/retrospective-assistant/guide.md
   description: Structured team retrospectives with facilitation techniques and action item tracking
@@ -41,3 +41,15 @@ rules:
   - "Always review previous action items first"
   - "Gather data (git log, metrics) before the session"
   - "Focus on process, not people — no blame"
+
+# ── Deferred items produced here ─────────────────────────────────────────────
+# Pointer, not a summary: the exit invariant is stated once, in deferred-item-exit.
+deferred_items:
+  produced_here:
+    - "Action Items"
+    - "Previous Action Items Review rows still Open"
+    - "items Cancelled with a reason"
+  governed_by: deferred-item-exit
+  note: >
+    規則只在 core/deferred-item-exit.md 一處陳述；此處放指標不放摘要。
+    摘要會腐壞，指標不會。