wendkeep 0.33.0 → 0.34.0

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.34.0] — 2026-07-11
+
+### Added
+
+- **Spec efetiva por change**: `wendkeep spec effective --change <slug> [--json]` combina o
+  contrato consolidado com somente o delta selecionado, incluindo origem e operação por requisito.
+- `change use <slug>` troca o ponteiro global; `change continue <arquivada> <novo-slug>` cria
+  continuação com backlink sem reabrir arquivo nem herdar evidência/verdict.
+- `sync-defs --check`, metadata de versão/hash e entrega idêntica de skills em `.claude/skills`
+  e `.agents/skills`.
+- `SPECS_STATE.json`, baseline por change e `spec migrate/rebase` para detectar edição direta e
+  conflitos concorrentes no mesmo requisito.
+
+### Changed
+
+- `08-Mudanças/<slug>/specs/` é o único local de autoria. `07-Specs` permanece como contrato
+  consolidado gerado/read-only, preservando ADRs e links históricos.
+- `verify --deep` agora grava requisitos completos em `verificacao.json` e sela o pacote com
+  `effectiveSpecHash`; `wk-verify` não relê `07-Specs`.
+- `doctor` valida todas as changes abertas e avisa quando skills precisam de reseed + reinício.
+
+### Fixed
+
+- Requisitos `ADDED` ainda não arquivados deixam de ficar invisíveis ao verificador independente.
+- Archives concorrentes bloqueiam somente quando outra change alterou o mesmo requisito; mudanças
+  não relacionadas na mesma capability podem prosseguir.
+
+### Migration
+
+- Rode `wendkeep spec migrate --vault <vault>` uma vez para adotar os contratos consolidados atuais.
+- Rode `wendkeep sync-defs --reseed --vault <vault> --project .` e reinicie Claude Code/Codex.
+
 ## [0.33.0] — 2026-07-11
 
 ### Added

package/README.md

@@ -71,7 +71,7 @@ npx wendkeep init
    Control with `--companions <csv>` or `--no-companions`. The Claude Code plugin layer (`extraKnownMarketplaces` + `enabledPlugins`) is wired as a bonus where the companion has one.
 5. Install a **color system** into the vault's `.obsidian/`: a CSS snippet that accents notes by type (session/decision/bug/learning, via the `cssclasses` the hooks emit) plus graph color groups by folder. Non-destructive merge into `appearance.json`/`graph.json`; skip with `--no-colors`.
 6. Seed the **curated memory layer**: `.brain/CORE.md` (the hand-curated hot layer, with the 3 required sections) and `.brain/COMPACTION_PROTOCOL.md` (the protocol guide). The auto layers (`DIGEST.md`, `index.jsonl`) are generated by the hooks. Validate the curated layer with `wendkeep validate-memory` (cap 25 lines, 3 sections, no secrets/PII).
-7. Seed the **definitions + skills layer**: `.brain/agents/` + `.brain/skills/` (versioned source of truth), including the native process skills `wk-workflow` / `wk-tdd` / `wk-debugging` / `wk-brainstorming` / `wk-planning` / `wk-verify` (some ship bundled templates, e.g. `wk-verify`'s `verdict-template.json` + reviewer prompt). `init` runs `wendkeep sync-defs` for you, delivering them to `.codex/agents/` + `.claude/skills/` (re‑run `sync-defs` after editing `.brain`).
+7. Seed the **definitions + skills layer**: `.brain/agents/` + `.brain/skills/` (versioned source of truth), including the native process skills `wk-workflow` / `wk-tdd` / `wk-debugging` / `wk-brainstorming` / `wk-planning` / `wk-verify`. `init` delivers them to `.codex/agents/`, `.claude/skills/`, and `.agents/skills/`; `sync-defs --check` detects stale copies.
 8. Seed the **change/spec lifecycle**: the `07-Specs/` + `08-Mudanças/` folders and a native `wendkeep.sensors.json` (a `validate-memory` sensor plus one per detected `package.json` script). Drives `wendkeep change` / `wendkeep verify` — see **Change lifecycle** below.
 
 ```bash
@@ -114,12 +114,12 @@ No re‑copying, no snapshot to re‑sync — the package is the single source o
 | `wendkeep hook <name>` | Run a session hook; invoked by `settings.json` (reads agent JSON on stdin). |
 | `wendkeep change <sub>` | Change lifecycle: `new [--simple]` / `list` (global backlog) / `show` / `status [slug]` / `done <id> [--change slug]` / `undone <id> [--change slug]` / `diff` / `archive [--force]`. |
 | `wendkeep verify [--deep]` | Run the change's task sensors; `--deep` assembles the independent-verification package. |
-| `wendkeep spec <sub>` | Living specs: `list` / `show <capability>`. |
+| `wendkeep spec <sub>` | `list` / `show` generated contracts; `effective --change <slug>`; `migrate`; `rebase`. |
 | `wendkeep sensors <sub>` | `list` / `add <id> "<command>"` — view/edit `wendkeep.sensors.json` (JSON Schema shipped). |
 | `wendkeep cost [--since d]` | Aggregate AI-coding spend across the vault's sessions — total, by model, by day (`--json`). |
 | `wendkeep import [opts]` | **Retroactive memory** — backfill past **Claude + Codex** sessions into the vault (deduped by `session_id`). `--source all\|claude\|codex` / `--from <dir>` / `--codex-from <dir>` / `--since d` / `--limit n` / `--dry-run` / `--json`. |
 | `wendkeep lesson add "t" "l"` | Record a project-local lesson (injected at the next SessionStart). |
-| `wendkeep sync-defs` | Copy `.brain/agents\|skills` into the project (`.codex/agents`, `.claude/skills`). |
+| `wendkeep sync-defs` | Copy `.brain/agents\|skills` into `.codex/agents`, `.claude/skills`, `.agents/skills`; `--check` detects drift. |
 | `wendkeep validate-memory [path]` | Validate `.brain/CORE.md` (cap 25, 3 sections, no secrets/PII). |
 | `wendkeep doctor [--vault P]` | Run a vault health check (integrity of sessions, registry, links). |
 | `wendkeep --version` / `--help` | Version / usage. |
@@ -148,14 +148,14 @@ Beyond capturing sessions, wendkeep is a **harness**: a native, zero‑dependenc
 explore → propose → apply (TDD) → verify → archive
 ```
 
-- **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`, and a `specs/` delta). It becomes the global *current* change. Multiple changes may remain open: hooks and `change list/status` expose every pending task, while commands without `--change` use only the current one.
+- **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`, and a `specs/` delta). It becomes the global *current* change. Multiple changes may remain open; `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
 - **Apply** — implement each `tarefas.md` task. Tag a task that needs machine proof with `[sensor:<id>]`.
-- **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and records `evidencia.json`. A critical red fails the gate; a `warning` red is advisory.
+- **Verify** — `wendkeep verify` records sensor evidence. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`.
 - **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each capability's spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md`, moves the change to `_arquivo/`, and mints an ADR in `04-Decisões/`.
 
 > The gate blocks unless the scaffold is filled, no task is open, evidence is fresh, and every declared requirement is covered. **`--force` is the human's call — never the agent's.**
 
-`wendkeep init` also seeds **native process skills** (`wk-workflow`, `wk-tdd`, `wk-debugging`, `wk-brainstorming`, `wk-planning`, `wk-verify`) into `.brain/skills` and delivers them to `.claude/skills` — the *how* layer, zero‑dep. Optional companions (`context-mode`, `dotcontext`, `understand-anything`, `caveman`) remain an opt‑in extra layer.
+`wendkeep init` seeds process skills into `.brain/skills` and delivers identical copies to Claude Code and Codex. Every skill carries source hash/version metadata; `doctor` warns when reseed + agent restart is required.
 
 ### The loop in five minutes
 
@@ -170,13 +170,14 @@ Edit `tarefas.md` — tag proof and requirement per task:
 - [ ] 1.1 toggle persists across sessions [req:UI-1] [sensor:tests]
 ```
 
-Declare the capability in `proposta.md` (`specs: [ui]`) and author its delta in
-`specs/ui/spec.md` (`## ADDED Requirements` → `### Requisito: UI-1 — dark mode toggle`). Then:
+Declare the capability in `proposta.md` (`specs: [ui]`) and author its delta only in
+`08-Mudanças/<slug>/specs/ui/spec.md`. `07-Specs` is generated/read-only. Then:
 
 ```bash
 npx wendkeep change status                     # one screen: tasks / sensors / verdict
 npx wendkeep change list                       # all open changes + pending tasks
 npx wendkeep change status dark-mode           # one change in detail
+npx wendkeep spec effective --change dark-mode # living contract + this change's delta
 npx wendkeep change done 1.1                   # tick a task from the CLI
 npx wendkeep verify                            # run the declared sensors -> evidencia.json
 npx wendkeep verify --deep                     # assemble the verification package
@@ -185,7 +186,7 @@ npx wendkeep change diff                       # preview what will land in 07-Sp
 npx wendkeep change archive dark-mode          # gate: sensors + verdict + no open tasks
 ```
 
-The archive promotes the delta into the living `07-Specs/ui.md`, mints an ADR, and the
+The archive promotes the delta into generated `07-Specs/ui.md`, mints an ADR, and the
 Obsidian graph now links *session ↔ change ↔ requirement ↔ decision*. A change that names
 no `[req:]` skips the independent verdict — the sensor gate is its proof.
 

package/bin/wendkeep.mjs

@@ -43,10 +43,10 @@ Usage:
                            agent's JSON on stdin. Names: ${RUNNABLE_HOOKS.join(', ')}.
 
   wendkeep doctor [--vault P]  Run a vault health check.
-  wendkeep change <sub>        Change lifecycle: new [--simple] | list | show | status |
-                           done <id> | undone <id> | diff | archive [--force] | abandon [slug].
+  wendkeep change <sub>        Change lifecycle: new [--simple] | use | continue | list | show |
+                           status | done <id> | undone <id> | diff | archive [--force] | abandon.
                            archive exige verdict (rode verify --deep); abandon descarta sem ADR.
-  wendkeep spec <sub>          Living specs: list | show <capability>.
+  wendkeep spec <sub>          Specs: list | show | effective [--change] [--json] | migrate | rebase.
   wendkeep sensors <sub>       list | add <id> "<command>" [--severity --type --report].
   wendkeep cost [opts]         Aggregate AI-coding spend across the vault's sessions.
                            --since <date> · --top [N] (priciest) · --trend [day|week|month]
@@ -70,9 +70,10 @@ Usage:
                            --vault <path> or OBSIDIAN_VAULT_PATH if no path given.
   wendkeep sync-defs [opts]    Copy versioned defs from the vault's .brain into the
                            project: .brain/agents/*.toml -> .codex/agents,
-                           .brain/skills/<name> -> .claude/skills. --vault P --project P.
+                           .brain/skills/<name> -> .claude/skills + .agents/skills. --vault P --project P.
                            --reseed re-semeia as skills wk-* com os seeds da versão instalada
                            (sobrescreve edições manuais nas wk-*) antes de copiar.
+                           --check detecta drift sem modificar arquivos.
   wendkeep --version           Print version.
   wendkeep --help              Show this help.
 `;

package/hooks/change-core.mjs

@@ -4,7 +4,7 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { ensureDir, wikilinkFromRel, monthFolderRelFromDateStr } from './obsidian-common.mjs';
-import { parseSpecsList, promoteSpecs, discoverSpecDeltas, tasksHashOf } from './spec-core.mjs';
+import { parseSpecsList, promoteSpecs, discoverSpecDeltas, tasksHashOf, captureSpecBaseline } from './spec-core.mjs';
 import { getLocale } from './locale.mjs';
 
 export const ARCHIVE_DIR = '_arquivo';
@@ -119,10 +119,44 @@ export function newChange(vaultBase, slug, { sessionRel = '', dateStr, simple =
       writeFileSync(exampleDelta, files.specDelta, 'utf8');
     }
   }
+  if (!existed) captureSpecBaseline(vaultBase, dir);
   setActiveChange(vaultBase, slug);
   return { rel: changeDirRel(slug, vaultBase), created: !existed };
 }
 
+export function useChange(vaultBase, slug) {
+  const dir = join(vaultBase, getLocale(vaultBase).folders.changes, slug);
+  if (!existsSync(join(dir, 'proposta.md'))) return { ok: false, error: `change aberta não encontrada: ${slug}` };
+  setActiveChange(vaultBase, slug);
+  return { ok: true, rel: changeDirRel(slug, vaultBase) };
+}
+
+export function continueChange(vaultBase, archivedSlug, newSlug, options = {}) {
+  const loc = getLocale(vaultBase);
+  const archiveDir = join(vaultBase, loc.folders.changes, ARCHIVE_DIR);
+  let names = [];
+  try { names = readdirSync(archiveDir).filter((name) => statSync(join(archiveDir, name)).isDirectory()); } catch { /* no archive */ }
+  const matches = names.filter((name) => name === archivedSlug || name.endsWith(`-${archivedSlug}`));
+  if (!matches.length) return { ok: false, error: `change arquivada não encontrada: ${archivedSlug}` };
+  if (matches.length > 1) return { ok: false, error: `change arquivada ambígua: ${archivedSlug} (${matches.join(', ')})` };
+  if (existsSync(join(vaultBase, loc.folders.changes, newSlug, 'proposta.md'))) {
+    return { ok: false, error: `change de continuação já existe: ${newSlug}` };
+  }
+  const archivedName = matches[0];
+  const archivedProposal = join(loc.folders.changes, ARCHIVE_DIR, archivedName, 'proposta');
+  const result = newChange(vaultBase, newSlug, options);
+  const proposalPath = join(vaultBase, loc.folders.changes, newSlug, 'proposta.md');
+  let proposal = readFileSync(proposalPath, 'utf8');
+  proposal = proposal.replace(/^specs:/m, `continues: "${wikilinkFromRel(archivedProposal)}"\nspecs:`);
+  const heading = loc.id === 'en' ? '## Continuation' : '## Continuação';
+  const note = loc.id === 'en'
+    ? `Continues ${wikilinkFromRel(archivedProposal)}. Archived evidence and verdict are not inherited.`
+    : `Continua ${wikilinkFromRel(archivedProposal)}. Evidências e verdict da change arquivada não são herdados.`;
+  proposal = `${proposal.trimEnd()}\n\n${heading}\n\n${note}\n`;
+  writeFileSync(proposalPath, proposal, 'utf8');
+  return { ok: true, ...result, archived: archivedName };
+}
+
 export function parseTasks(md) {
   const tasks = [];
   const re = /^-\s+\[( |x)\]\s+(\S+)\s+(.*)$/gm;
@@ -219,7 +253,7 @@ export function renderOpenChanges(state, { tag = 'open_changes' } = {}) {
     else for (const task of change.openTasks) lines.push(`- [ ] ${task.id} ${task.text}`);
   }
   if (state.current) lines.push('Para change atual: `wendkeep change done <id>`; antes de archive: `wendkeep verify`.');
-  lines.push('Qualquer agente pode assumir uma change: selecione-a com `wendkeep change new <slug-existente>` ou use `--change <slug>` quando disponível.');
+  lines.push('Qualquer agente pode assumir uma change: selecione-a com `wendkeep change use <slug>` ou use `--change <slug>` quando disponível.');
   if (tag) lines.push(`</${tag}>`);
   return lines.join('\n');
 }

package/hooks/harness-doctor.mjs

@@ -3,13 +3,12 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { activeChange, parseTasks } from './change-core.mjs';
-import { parseRequirements, parseSpecsList, parseDelta, evaluateVerdict, validateSpecImpact } from './spec-core.mjs';
+import { buildEffectiveRequirementPackage, checkSpecsState, evaluateVerdict, tasksHashOf, validateSpecImpact } from './spec-core.mjs';
 import { getLocale } from './locale.mjs';
 
 export function checkHarness(vaultBase, projectRoot) {
   const loc = getLocale(vaultBase);
   const CHANGES_DIR = loc.folders.changes;
-  const SPECS_DIR = loc.folders.specs;
   const errors = [];
   const warnings = [];
 
@@ -23,16 +22,9 @@ export function checkHarness(vaultBase, projectRoot) {
     } catch { errors.push('wendkeep.sensors.json: JSON inválido'); }
   }
 
-  // Known requirement ids across the living specs (+ spec-without-source warning).
-  const knownReqs = new Set();
-  try {
-    for (const f of readdirSync(join(vaultBase, SPECS_DIR))) {
-      if (!f.endsWith('.md') || f === 'README.md') continue;
-      const md = readFileSync(join(vaultBase, SPECS_DIR, f), 'utf8');
-      for (const r of parseRequirements(md)) if (r.id) knownReqs.add(r.id);
-      if (!/^>\s+Atualizado por/m.test(md)) warnings.push(`spec sem origem: ${SPECS_DIR}/${f}`);
-    }
-  } catch { /* sem 07-Specs */ }
+  const specState = checkSpecsState(vaultBase);
+  if (specState.missing) warnings.push('SPECS_STATE ausente — rode `wendkeep spec migrate`; 07-Specs deve ser gerado/read-only');
+  else if (!specState.ok) errors.push(`07-Specs alterado fora do WendKeep: ${specState.changed.join(', ')} — mova a alteração para 08-Mudanças/<change>/specs`);
 
   // 2/3. Changes: malformed dirs; the active change's deltas add to knownReqs.
   const active = activeChange(vaultBase);
@@ -46,15 +38,18 @@ export function checkHarness(vaultBase, projectRoot) {
     const impact = validateSpecImpact(dir);
     errors.push(...impact.errors.map((e) => `${name}: ${e}`));
     warnings.push(...impact.warnings.map((w) => `${name}: ${w}`));
-    if (name === active) {
-      try {
-        for (const cap of parseSpecsList(readFileSync(join(dir, 'proposta.md'), 'utf8'))) {
-          try {
-            const d = parseDelta(readFileSync(join(dir, 'specs', cap, 'spec.md'), 'utf8'));
-            for (const r of [...d.added, ...d.modified]) if (r.id) knownReqs.add(r.id);
-          } catch { /* sem delta pra essa cap */ }
-        }
-      } catch { /* proposta ilegível */ }
+    let tasks = [];
+    let tarefasMd = '';
+    try { tarefasMd = readFileSync(join(dir, 'tarefas.md'), 'utf8'); tasks = parseTasks(tarefasMd); } catch { /* sem tarefas */ }
+    const reqIds = [...new Set(tasks.map((t) => t.req).filter(Boolean))];
+    const effective = buildEffectiveRequirementPackage(vaultBase, dir, reqIds);
+    errors.push(...effective.errors.map((e) => `${name}: spec efetiva inválida: ${e}`));
+    if (effective.missing.length) errors.push(`req órfão em ${name}: ${effective.missing.map((id) => `[req:${id}]`).join(', ')} não existe na spec efetiva`);
+    let verdict = null;
+    try { verdict = JSON.parse(readFileSync(join(dir, 'verdict.json'), 'utf8')); } catch { /* sem verdict */ }
+    if (verdict && reqIds.length) {
+      const v = evaluateVerdict(verdict, reqIds, { tasksHash: tasksHashOf(tarefasMd), effectiveSpecHash: effective.hash });
+      if (!v.ok) warnings.push(`verdict stale/incompleto em ${name}${v.missing.length ? `: falta cobrir ${v.missing.join(', ')}` : ''}`);
     }
   }
 
@@ -63,17 +58,6 @@ export function checkHarness(vaultBase, projectRoot) {
     const dir = join(vaultBase, CHANGES_DIR, active);
     if (!existsSync(join(dir, 'proposta.md'))) {
       errors.push(`ponteiro CURRENT_CHANGE aponta pra change inexistente: ${active}`);
-    } else {
-      let tasks = [];
-      try { tasks = parseTasks(readFileSync(join(dir, 'tarefas.md'), 'utf8')); } catch { /* sem tarefas */ }
-      const reqIds = [...new Set(tasks.map((t) => t.req).filter(Boolean))];
-      for (const rid of reqIds) if (!knownReqs.has(rid)) errors.push(`req órfão em ${active}: [req:${rid}] não existe em 07-Specs nem no delta`);
-      let verdict = null;
-      try { verdict = JSON.parse(readFileSync(join(dir, 'verdict.json'), 'utf8')); } catch { /* sem verdict */ }
-      if (verdict && reqIds.length) {
-        const v = evaluateVerdict(verdict, reqIds);
-        if (!v.ok) warnings.push(`verdict stale em ${active}: falta cobrir ${v.missing.join(', ')}`);
-      }
     }
   }
 

package/hooks/spec-core.mjs

@@ -11,6 +11,14 @@ export function tasksHashOf(md) {
   return createHash('sha1').update(String(md)).digest('hex').slice(0, 12);
 }
 
+export function contentHashOf(value) {
+  return createHash('sha256').update(String(value)).digest('hex');
+}
+
+export const SPECS_STATE_FILE = '.brain/SPECS_STATE.json';
+export const SPEC_BASELINE_FILE = '.spec-base.json';
+export const MANAGED_SPEC_MARKER = '<!-- wendkeep:managed-spec — generated from 08-Mudanças; do not edit directly -->';
+
 // Parse is BILINGUAL always (mixed vaults never break); rendering follows the vault locale.
 const REQ_RE = /^### (?:Requisito|Requirement):\s*(.+)$/gm;
 
@@ -21,7 +29,7 @@ export function parseRequirements(md) {
   for (let i = 0; i < matches.length; i += 1) {
     const raw = matches[i][1].trim();
     // Identity is the ID (e.g. GATE-1) when the heading is "<ID> — <nome>"; else the whole text.
-    const idM = raw.match(/^([A-Z][A-Z0-9]*-\d+)\s*—\s*(.+)$/);
+    const idM = raw.match(/^([A-Z][A-Z0-9]*(?:-[A-Z0-9]+)*-\d+)\s*—\s*(.+)$/);
     const id = idM ? idM[1] : null;
     const name = idM ? idM[2].trim() : raw;
     const start = matches[i].index + matches[i][0].length;
@@ -75,7 +83,148 @@ export function applyDelta(reqs, delta) {
 export function renderSpec(capability, reqs, { footer, reqHeading = 'Requisito' } = {}) {
   const blocks = reqs.map((r) => `### ${reqHeading}: ${r.id ? `${r.id} — ${r.name}` : r.name}\n${r.body}`).join('\n\n');
   const foot = footer ? `\n\n> ${footer}\n` : '\n';
-  return `---\ntype: spec\ncssclasses:\n  - topic-spec\ntags:\n  - spec\n---\n\n# ${capability}\n\n## Requisitos\n\n${blocks}${foot}`;
+  return `${MANAGED_SPEC_MARKER}\n---\ntype: spec\ncssclasses:\n  - topic-spec\ntags:\n  - spec\n---\n\n# ${capability}\n\n## Requisitos\n\n${blocks}${foot}`;
+}
+
+function readLivingSpecs(vaultBase) {
+  const specsDir = join(vaultBase, getLocale(vaultBase).folders.specs);
+  const specs = {};
+  let files = [];
+  try { files = readdirSync(specsDir).filter((f) => f.endsWith('.md') && f !== 'README.md'); } catch { return specs; }
+  for (const file of files) {
+    const capability = file.replace(/\.md$/, '');
+    const md = readFileSync(join(specsDir, file), 'utf8');
+    specs[capability] = {
+      hash: contentHashOf(md),
+      requirements: Object.fromEntries(parseRequirements(md).map((r) => [r.id || r.name, contentHashOf(JSON.stringify(r))])),
+    };
+  }
+  return specs;
+}
+
+export function livingSpecCapabilities(vaultBase) {
+  return Object.keys(readLivingSpecs(vaultBase));
+}
+
+export function adoptSpecsState(vaultBase) {
+  const state = { version: 1, generatedAt: new Date().toISOString(), specs: readLivingSpecs(vaultBase) };
+  ensureDir(join(vaultBase, '.brain'));
+  writeFileSync(join(vaultBase, SPECS_STATE_FILE), `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+  return state;
+}
+
+export function readSpecsState(vaultBase) {
+  try { return JSON.parse(readFileSync(join(vaultBase, SPECS_STATE_FILE), 'utf8')); } catch { return null; }
+}
+
+export function checkSpecsState(vaultBase) {
+  const recorded = readSpecsState(vaultBase);
+  if (!recorded) return { ok: false, missing: true, changed: [] };
+  const current = readLivingSpecs(vaultBase);
+  const names = new Set([...Object.keys(recorded.specs || {}), ...Object.keys(current)]);
+  const changed = [...names].filter((name) => recorded.specs?.[name]?.hash !== current[name]?.hash);
+  return { ok: changed.length === 0, missing: false, changed, current, recorded };
+}
+
+function recordPromotedSpecs(vaultBase, capabilities) {
+  const existing = readSpecsState(vaultBase);
+  if (!existing) return adoptSpecsState(vaultBase);
+  const current = readLivingSpecs(vaultBase);
+  const specs = { ...(existing.specs || {}) };
+  for (const capability of capabilities) {
+    if (current[capability]) specs[capability] = current[capability];
+    else delete specs[capability];
+  }
+  const state = { version: 1, generatedAt: new Date().toISOString(), specs };
+  writeFileSync(join(vaultBase, SPECS_STATE_FILE), `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+  return state;
+}
+
+export function captureSpecBaseline(vaultBase, changeDir, { refresh = false } = {}) {
+  const path = join(changeDir, SPEC_BASELINE_FILE);
+  if (!refresh && existsSync(path)) {
+    try { return JSON.parse(readFileSync(path, 'utf8')); } catch { /* rebuild malformed baseline */ }
+  }
+  const baseline = { version: 1, capturedAt: new Date().toISOString(), specs: readLivingSpecs(vaultBase) };
+  writeFileSync(path, `${JSON.stringify(baseline, null, 2)}\n`, 'utf8');
+  return baseline;
+}
+
+export function specConflicts(vaultBase, changeDir, capabilities = discoverSpecDeltas(changeDir)) {
+  let baseline = null;
+  try { baseline = JSON.parse(readFileSync(join(changeDir, SPEC_BASELINE_FILE), 'utf8')); } catch { /* legacy change */ }
+  if (!baseline) return [];
+  const current = readLivingSpecs(vaultBase);
+  const conflicts = [];
+  for (const capability of capabilities) {
+    let delta;
+    try { delta = parseDelta(readFileSync(join(changeDir, 'specs', capability, 'spec.md'), 'utf8')); } catch { continue; }
+    const baseReqs = baseline.specs?.[capability]?.requirements || {};
+    const currentReqs = current[capability]?.requirements || {};
+    for (const req of delta.added || []) {
+      const key = req.id || req.name;
+      if (!(key in baseReqs) && key in currentReqs) conflicts.push(`${capability}:${key} foi adicionado por outra change`);
+    }
+    for (const req of delta.modified || []) {
+      const key = req.id || req.name;
+      if (baseReqs[key] !== currentReqs[key]) conflicts.push(`${capability}:${key} mudou desde a abertura da change`);
+    }
+    for (const key of delta.removed || []) {
+      if (baseReqs[key] !== currentReqs[key]) conflicts.push(`${capability}:${key} mudou desde a abertura da change`);
+    }
+  }
+  return conflicts;
+}
+
+export function resolveEffectiveSpecs(vaultBase, changeDir, capabilities = discoverSpecDeltas(changeDir)) {
+  const specsDir = join(vaultBase, getLocale(vaultBase).folders.specs);
+  const result = [];
+  const warnings = [];
+  const errors = [];
+  for (const capability of capabilities) {
+    let living = [];
+    try { living = parseRequirements(readFileSync(join(specsDir, `${capability}.md`), 'utf8')); } catch { /* new capability */ }
+    let deltaMd = '';
+    try { deltaMd = readFileSync(join(changeDir, 'specs', capability, 'spec.md'), 'utf8'); } catch { /* unchanged living capability */ }
+    if (deltaMd && isPlaceholderDelta(deltaMd)) deltaMd = '';
+    const delta = deltaMd ? parseDelta(deltaMd) : { added: [], modified: [], removed: [] };
+    const operations = new Map(living.map((r) => [r.id || r.name, { operation: 'BASE', source: 'living' }]));
+    for (const r of delta.added) operations.set(r.id || r.name, { operation: 'ADDED', source: 'change' });
+    for (const r of delta.modified) operations.set(r.id || r.name, { operation: 'MODIFIED', source: 'change' });
+    for (const key of delta.removed) operations.delete(key);
+    const applied = applyDelta(living, delta);
+    warnings.push(...applied.warnings.map((w) => `${capability}: ${w}`));
+    for (const warning of applied.warnings) {
+      if (/^(ADDED já existe|MODIFIED inexistente|REMOVED inexistente)/.test(warning)) errors.push(`${capability}: ${warning}`);
+    }
+    result.push({
+      capability,
+      requirements: applied.reqs.map((r) => ({ ...r, capability, ...(operations.get(r.id || r.name) || { operation: 'BASE', source: 'living' }) })),
+    });
+  }
+  const serializable = result.map((s) => ({ capability: s.capability, requirements: s.requirements }));
+  return { specs: result, requirements: result.flatMap((s) => s.requirements), warnings, errors, hash: contentHashOf(JSON.stringify(serializable)) };
+}
+
+export function buildEffectiveRequirementPackage(vaultBase, changeDir, reqIds = []) {
+  let listed = [];
+  try { listed = parseSpecsList(readFileSync(join(changeDir, 'proposta.md'), 'utf8')); } catch { /* caller validates change */ }
+  const changed = [...new Set([...listed, ...discoverSpecDeltas(changeDir)])];
+  const capabilities = [...new Set([...livingSpecCapabilities(vaultBase), ...changed])];
+  const effective = resolveEffectiveSpecs(vaultBase, changeDir, capabilities);
+  const byId = new Map(effective.requirements.filter((r) => r.id).map((r) => [r.id, r]));
+  const missing = reqIds.filter((id) => !byId.has(id));
+  const requirements = reqIds.map((id) => byId.get(id)).filter(Boolean);
+  const relevantCaps = new Set([...changed, ...requirements.map((r) => r.capability)]);
+  const relevant = effective.specs.filter((spec) => relevantCaps.has(spec.capability));
+  return {
+    ...effective,
+    specs: relevant,
+    requirements,
+    missing,
+    changedCapabilities: changed,
+    hash: contentHashOf(JSON.stringify(relevant)),
+  };
 }
 
 export function parseSpecsList(propostaMd) {
@@ -160,6 +309,13 @@ export function promoteSpecs(vaultBase, changeDir, specs, { changeWikilink, date
   const specsDir = loc.folders.specs;
   const promoted = [];
   const warnings = [];
+  const state = checkSpecsState(vaultBase);
+  const unmanaged = state.missing ? [] : state.changed.filter((capability) => specs.includes(capability));
+  if (unmanaged.length) {
+    throw new Error(`07-Specs alterado fora do WendKeep: ${unmanaged.join(', ')} — mova o delta para 08-Mudanças/<change>/specs`);
+  }
+  const conflicts = specConflicts(vaultBase, changeDir, specs);
+  if (conflicts.length) throw new Error(`conflito de spec: ${conflicts.join('; ')} — reconcilie o delta e rode \`wendkeep spec rebase --change <slug> --accept-current\``);
   for (const cap of specs) {
     let deltaMd;
     try { deltaMd = readFileSync(join(changeDir, 'specs', cap, 'spec.md'), 'utf8'); }
@@ -176,13 +332,14 @@ export function promoteSpecs(vaultBase, changeDir, specs, { changeWikilink, date
     writeFileSync(livePath, renderSpec(cap, applied.reqs, { footer, reqHeading: loc.reqHeading }), 'utf8');
     promoted.push(cap);
   }
+  recordPromotedSpecs(vaultBase, promoted);
   return { promoted, warnings };
 }
 
 // Gate check for the independent verdict (Wave A). A requirement-bearing change must have
 // a verdict that is ok and covers every declared req id. A requirement-less change passes:
 // nothing for an independent verifier to check — the sensor gate is already the proof.
-export function evaluateVerdict(verdict, reqIds, { tasksHash } = {}) {
+export function evaluateVerdict(verdict, reqIds, { tasksHash, effectiveSpecHash } = {}) {
   const ids = reqIds || [];
   if (ids.length === 0) return { ok: true, missing: [] };
   if (!verdict || verdict.ok !== true) return { ok: false, missing: [] };
@@ -191,6 +348,9 @@ export function evaluateVerdict(verdict, reqIds, { tasksHash } = {}) {
   if (tasksHash && verdict.tasksHash && verdict.tasksHash !== tasksHash) {
     return { ok: false, missing: [], stale: true };
   }
+  if (effectiveSpecHash && verdict.effectiveSpecHash && verdict.effectiveSpecHash !== effectiveSpecHash) {
+    return { ok: false, missing: [], stale: true };
+  }
   const covered = new Set((verdict.coverage || []).filter((c) => c.covered).map((c) => c.req));
   const missing = ids.filter((r) => !covered.has(r));
   return { ok: missing.length === 0, missing };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "A persistent-memory harness for AI coding agents on your Obsidian vault: turn-by-turn session capture plus a native, zero-dependency spec→change→verify→archive loop (sensor-gated, independent verdict, mutation discrimination). Local-first, agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "bin": {

package/src/change.mjs

@@ -3,6 +3,8 @@ import { readFileSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 import {
   newChange,
+  useChange,
+  continueChange,
   activeChange,
   allChangesState,
   listChanges,
@@ -14,7 +16,7 @@ import {
   scaffoldPlaceholders,
 } from '../hooks/change-core.mjs';
 import { evaluateGate, requiredSensors } from '../hooks/sensors-core.mjs';
-import { evaluateVerdict, tasksHashOf, parseSpecsList, parseDelta, parseRequirements, applyDelta, validateSpecImpact } from '../hooks/spec-core.mjs';
+import { buildEffectiveRequirementPackage, evaluateVerdict, tasksHashOf, parseSpecsList, parseDelta, parseRequirements, applyDelta, validateSpecImpact } from '../hooks/spec-core.mjs';
 import { getNextAdrNumber, readControl } from '../hooks/obsidian-common.mjs';
 import { getLocale } from '../hooks/locale.mjs';
 
@@ -62,6 +64,32 @@ export function runChange(argv) {
     process.exit(0);
   }
 
+  if (sub === 'use') {
+    const slug = slugArg();
+    if (!slug) { process.stderr.write('wendkeep change use: missing <slug>\n'); process.exit(2); }
+    const r = useChange(vaultBase, slug);
+    if (!r.ok) { process.stderr.write(`wendkeep change use: ${r.error}\n`); process.exit(2); }
+    process.stdout.write(`current change: ${slug}\n`);
+    process.exit(0);
+  }
+
+  if (sub === 'continue') {
+    const positionals = rest.filter((a, i) => !a.startsWith('-') && !VALUE_FLAGS.has(rest[i - 1]));
+    const [archivedSlug, newSlug] = positionals;
+    if (!archivedSlug || !newSlug) {
+      process.stderr.write('wendkeep change continue: use <archived-slug> <new-slug>\n');
+      process.exit(2);
+    }
+    let sessionRel = '';
+    try { sessionRel = readControl(vaultBase).session_file || ''; } catch { /* no control */ }
+    const r = continueChange(vaultBase, archivedSlug, newSlug, {
+      dateStr: today(), simple: rest.includes('--simple'), sessionRel,
+    });
+    if (!r.ok) { process.stderr.write(`wendkeep change continue: ${r.error}\n`); process.exit(2); }
+    process.stdout.write(`change created: ${r.rel} (continues ${r.archived}; active)\n`);
+    process.exit(0);
+  }
+
   if (sub === 'list') {
     const state = allChangesState(vaultBase);
     const { archived } = listChanges(vaultBase);
@@ -113,12 +141,16 @@ export function runChange(argv) {
     if (evidence) for (const e of evidence) process.stdout.write(`  ${e.status === 'green' ? '✓' : '✗'} ${e.id} (${e.severity || 'critical'})\n`);
     else process.stdout.write('evidencia: ausente\n');
     const reqIds = [...new Set(tasks.map((t) => t.req).filter(Boolean))];
+    const effective = buildEffectiveRequirementPackage(vaultBase, dir, reqIds);
+    if (effective.errors.length || effective.missing.length) {
+      process.stdout.write(`spec efetiva: inválida (${[...effective.errors, ...effective.missing.map((id) => `req órfão ${id}`)].join('; ')})\n`);
+    }
     let verdict = null;
     try { verdict = JSON.parse(readFileSync(join(dir, 'verdict.json'), 'utf8')); } catch { /* sem verdict */ }
     if (!verdict) process.stdout.write(`verdict: ausente — rode \`wendkeep verify --deep\`${reqIds.length ? ' + wk-verify' : ' (verdict trivial automático)'}\n`);
     else if (!reqIds.length) process.stdout.write(`verdict: ${verdict.ok === true ? 'ok (trivial)' : 'não-ok — re-verifique'}\n`);
     else {
-      const v = evaluateVerdict(verdict, reqIds, { tasksHash: tasksHashOf(tarefasMd) });
+      const v = evaluateVerdict(verdict, reqIds, { tasksHash: tasksHashOf(tarefasMd), effectiveSpecHash: effective.hash });
       process.stdout.write(`verdict: ${v.ok ? 'ok' : v.stale ? 'stale — re-verifique' : `incompleto: falta ${v.missing.join(', ')}`}\n`);
     }
     try { process.stdout.write(`mutation-round: ${readFileSync(join(dir, '.mutation-round'), 'utf8').trim()}/3\n`); } catch { /* sem rodadas */ }
@@ -195,6 +227,9 @@ export function runChange(argv) {
         }
       }
       const reqIds = [...new Set(tasks.map((t) => t.req).filter(Boolean))];
+      const effective = buildEffectiveRequirementPackage(vaultBase, dir, reqIds);
+      if (effective.errors.length) return { ok: false, failing: [`spec efetiva inválida: ${effective.errors.join('; ')}`] };
+      if (effective.missing.length) return { ok: false, failing: [`requisito(s) órfão(s) na spec efetiva: ${effective.missing.join(', ')}`] };
       let evidence = [];
       try { evidence = JSON.parse(readFileSync(join(dir, 'evidencia.json'), 'utf8')); } catch { /* no evidence */ }
       const s = evaluateGate(evidence, required);
@@ -214,8 +249,16 @@ export function runChange(argv) {
       if (verdict.tasksHash && verdict.tasksHash !== hash) {
         return { ok: false, failing: [`verdict stale (tarefas.md mudou depois da verificação) — re-verifique: \`wendkeep verify --deep\`${reqIds.length ? ' + wk-verify' : ''}`] };
       }
+      let verification = null;
+      try { verification = JSON.parse(readFileSync(join(dir, 'verificacao.json'), 'utf8')); } catch { /* none */ }
+      if (verification?.effectiveSpecHash && verification.effectiveSpecHash !== effective.hash) {
+        return { ok: false, failing: ['pacote de verificação stale (spec efetiva mudou) — rode `wendkeep verify --deep` novamente'] };
+      }
+      if (reqIds.length && verification?.effectiveSpecHash && !verdict.effectiveSpecHash) {
+        return { ok: false, failing: ['verdict sem effectiveSpecHash — rode a skill wk-verify novamente'] };
+      }
       if (reqIds.length) {
-        const v = evaluateVerdict(verdict, reqIds, { tasksHash: hash });
+        const v = evaluateVerdict(verdict, reqIds, { tasksHash: hash, effectiveSpecHash: effective.hash });
         if (!v.ok) {
           if (v.stale) return { ok: false, failing: ['verdict stale (tarefas.md mudou depois da verificação) — re-verifique: `wendkeep verify --deep` + wk-verify'] };
           return { ok: false, failing: [`verdict incompleto: falta ${v.missing.join(', ')}`] };
@@ -250,6 +293,6 @@ export function runChange(argv) {
     process.exit(0);
   }
 
-  process.stderr.write(`wendkeep change: unknown subcommand "${sub}". Known: new, list, show, status, done, undone, diff, archive, abandon.\n`);
+  process.stderr.write(`wendkeep change: unknown subcommand "${sub}". Known: new, use, continue, list, show, status, done, undone, diff, archive, abandon.\n`);
   process.exit(2);
 }

package/src/doctor.mjs

@@ -5,6 +5,7 @@ import { existsSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { checkHarness } from '../hooks/harness-doctor.mjs';
+import { checkSyncDefs } from './sync-defs.mjs';
 
 export function runDoctor(argv) {
   const here = dirname(fileURLToPath(import.meta.url));
@@ -40,6 +41,11 @@ export function runDoctor(argv) {
 
   // 2. Harness integrity (Wave B).
   const { errors, warnings } = checkHarness(vaultBase, projectRoot);
+  const defs = checkSyncDefs(vaultBase, projectRoot);
+  if (!defs.ok) {
+    warnings.push(...defs.issues.map((issue) => `defs: ${issue}`));
+    warnings.push('defs stale — rode `wendkeep sync-defs --reseed` e reinicie Claude Code/Codex');
+  }
   process.stdout.write(`\n[harness] ${errors.length} erro(s), ${warnings.length} aviso(s)\n`);
   for (const e of errors) process.stdout.write(`  ✗ ${e}\n`);
   for (const w of warnings) process.stdout.write(`  ! ${w}\n`);

package/src/init.mjs

@@ -3,7 +3,7 @@
 // OBSIDIAN_VAULT_PATH into .claude/settings.json, and adds the mcpvault server to
 // .mcp.json. Idempotent: re-running only adds what is missing.
 import { spawnSync } from 'node:child_process';
-import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { basename, isAbsolute, join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import {
@@ -40,6 +40,7 @@ import { seedDefinitions, syncDefs } from './sync-defs.mjs';
 import { seedWkSkills } from './skills-seed.mjs';
 import { LOCALES, DEFAULT_LOCALE, getLocale, clearLocaleCache, vaultFolders } from '../hooks/locale.mjs';
 import { seedDotcontext, globalHasDotcontext, resolveDotcontextSkipMcp, renderSensorsJson } from './dotcontext-seed.mjs';
+import { adoptSpecsState, SPECS_STATE_FILE } from '../hooks/spec-core.mjs';
 
 function parseArgs(argv) {
   const args = { mcp: true, yes: false, force: false };
@@ -278,7 +279,7 @@ const MESSAGES = {
     colorsOn: 'wendkeep-colors (snippet + grupos do grafo)',
     taxonomy: (n, c, loc, readme, views) => `  [1/4] taxonomia do vault: ${n} pastas (${c} criadas, locale ${loc})${readme}, .brain + change/spec + sensores semeados${views}`,
     readmeCreated: ', README.md criado', viewsNote: (n) => `, ${n} view(s) + dashboard`,
-    defs: (s, a) => `        defs entregues: ${s} skill(s) -> .claude/skills, ${a} agent(s) -> .codex/agents`,
+    defs: (s, a) => `        defs entregues: ${s} skill(s) -> .claude/skills + .agents/skills, ${a} agent(s) -> .codex/agents`,
     settingsBadJson: (p) => `  [2/4] settings.json existe mas não é JSON válido -> escrevi ${p}.new (mescle à mão)`,
     settings: (verb, added, bak) => `  [2/4] settings.json ${verb} (${added} hook(s) wirados, OBSIDIAN_VAULT_PATH setado${bak})`,
     mcpBadJson: (p) => `  [3/4] .mcp.json existe mas não é JSON válido -> escrevi ${p}.new (mescle à mão)`,
@@ -303,7 +304,7 @@ const MESSAGES = {
     colorsOn: 'wendkeep-colors (snippet + graph groups)',
     taxonomy: (n, c, loc, readme, views) => `  [1/4] vault taxonomy: ${n} folders (${c} created, locale ${loc})${readme}, .brain + change/spec + sensors seeded${views}`,
     readmeCreated: ', README.md created', viewsNote: (n) => `, ${n} view(s) + dashboard`,
-    defs: (s, a) => `        defs delivered: ${s} skill(s) -> .claude/skills, ${a} agent(s) -> .codex/agents`,
+    defs: (s, a) => `        defs delivered: ${s} skill(s) -> .claude/skills + .agents/skills, ${a} agent(s) -> .codex/agents`,
     settingsBadJson: (p) => `  [2/4] settings.json exists but is not valid JSON -> wrote ${p}.new (merge by hand)`,
     settings: (verb, added, bak) => `  [2/4] settings.json ${verb} (${added} hook(s) wired, OBSIDIAN_VAULT_PATH set${bak})`,
     mcpBadJson: (p) => `  [3/4] .mcp.json exists but is not valid JSON -> wrote ${p}.new (merge by hand)`,
@@ -482,8 +483,12 @@ export async function runInit(argv) {
   const specsReadme = join(vaultPath, loc.folders.specs, 'README.md');
   if (!existsSync(specsReadme)) {
     writeFileSync(specsReadme, en
-      ? `# Specs — living contract\n\nThe project's capabilities (requirements/scenarios). Changes in \`${loc.folders.changes}/\` promote deltas here on \`wendkeep change archive\`.\n`
-      : `# Specs — contrato vivo\n\nCapacidades do projeto (requisitos/cenários). Changes em \`${loc.folders.changes}/\` promovem deltas aqui no \`wendkeep change archive\`.\n`, 'utf8');
+      ? `# Specs — generated living contract\n\nRead-only: do not author here. Write deltas only in \`${loc.folders.changes}/<slug>/specs/\`; archive promotes them here.\n`
+      : `# Specs — contrato consolidado gerado\n\nSomente leitura: não edite aqui. Escreva deltas apenas em \`${loc.folders.changes}/<slug>/specs/\`; o archive promove para cá.\n`, 'utf8');
+  }
+  if (!existsSync(join(vaultPath, SPECS_STATE_FILE))) {
+    const livingSpecs = readdirSync(join(vaultPath, loc.folders.specs)).filter((name) => name.endsWith('.md') && name !== 'README.md');
+    if (!livingSpecs.length) adoptSpecsState(vaultPath);
   }
   const changeTpl = join(vaultPath, 'Templates', 'Change.md');
   if (!existsSync(changeTpl)) {

package/src/skills-seed.mjs

@@ -1,6 +1,6 @@
 // src/skills-seed.mjs — native, zero-dep process skills (Pilar A: the HOW layer).
 // Seeded into the vault's .brain/skills; distributed by `wendkeep sync-defs` to
-// .claude/skills. Wendkeep-flavored (reference change/verify), concise native prose.
+// .claude/skills + .agents/skills. Wendkeep-flavored, concise native prose.
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
@@ -41,12 +41,13 @@ vault cego. Exceção única: mudança trivial (typo, 1 linha).
    (teste vermelho antes do código). Marque \`- [x]\` ao concluir. Declare nas tarefas:
    - \`[sensor:<id>]\` — a prova automatizada (roda no verify).
    - \`[req:<ID>]\` — o requisito do spec que a tarefa satisfaz (ex.: \`[req:GATE-1]\`),
-     quando a change mexe numa capability de \`07-Specs\`.
+      quando a change mexe numa capability. Toda autoria de spec ocorre somente em
+      \`08-Mudanças/<slug>/specs/<capability>/spec.md\`; \`07-Specs\` é gerado/read-only.
    Ex.: \`- [ ] 2.1 valida CORE [req:MEM-1] [sensor:memory-validation]\`.
 4. **Verify** — \`wendkeep verify\` roda os sensores → \`evidencia.json\`. Depois
    \`wendkeep verify --deep\` monta o *pacote de verificação* pro passe independente.
 5. **Verify deep** — a skill **wk-verify** (passe fresco, autor≠verificador) lê o pacote,
-   re-deriva a cobertura do \`07-Specs\` e grava \`verdict.json\`. Change trivial (sem
+   usa somente os requisitos autocontidos de \`verificacao.json\` e grava \`verdict.json\`. Change trivial (sem
    \`[req:]\`) recebe verdict automático — pula este passe.
 6. **Archive** — \`wendkeep change archive <slug>\`. O *gate* exige sensores verdes **E**
    \`verdict.json\` cobrindo os \`[req:]\`. Passando, promove os deltas pro \`07-Specs\`,
@@ -55,8 +56,8 @@ vault cego. Exceção única: mudança trivial (typo, 1 linha).
 ## Regras
 
 - Várias changes podem ficar abertas. \`CURRENT_CHANGE.md\` marca uma atual, sem esconder as
-  outras pendências. Claude, Codex ou outro agente podem assumir uma change existente com
-  \`wendkeep change new <slug-existente>\` ou \`--change <slug>\` quando disponível.
+  outras pendências. Claude, Codex ou outro agente assumem uma change existente com
+  \`wendkeep change use <slug>\` ou \`--change <slug>\` quando disponível.
 - Se uma tarefa não precisa de prova automatizada, não declare sensor — o gate só exige
   o que você declarou. Sem \`[sensor:]\`, o archive não trava.
 - A proposta linka a sessão de origem; a sessão linka a mudança ativa. É de propósito:
@@ -77,7 +78,8 @@ vermelho pedindo por ele — e nunca escreva um teste que passaria sob a impleme
 
 ## Derive do spec, não do código
 
-Escreva a asserção a partir do *critério de aceite* do requisito (\`07-Specs\`), não lendo a
+Escreva a asserção a partir do *critério de aceite* da spec efetiva
+(\`wendkeep spec effective --change <slug>\`), não lendo a
 implementação. Cada asserção mira o resultado que o spec definiu. Escrever o teste lendo o
 código = ele só confirma o que o código já faz, bugs inclusos.
 
@@ -214,13 +216,13 @@ nunca tivesse visto a implementação. Contexto fresco, read-only.
 ## O que fazer
 
 1. Leia o pacote \`08-Mudanças/<slug>/verificacao.json\` (requisitos, tarefas, evidência).
-2. **Re-derive a cobertura do \`07-Specs\`** — pra cada \`[req:ID]\` da change, cheque se o
-   comportamento definido no requisito está coberto por um teste que discrimina (não
+2. **Re-derive a cobertura do pacote autocontido** — pra cada requisito completo em
+   \`verificacao.json\`, cheque se o comportamento está coberto por um teste que discrimina (não
    passaria sob impl errada). Evidência \`arquivo:linha\`.
 3. Outcome check ancorado no spec: o resultado observável bate com o critério de aceite?
 4. Grave \`08-Mudanças/<slug>/verdict.json\`:
-   \`{ "slug": "...", "ok": true, "coverage": [{ "req": "GATE-1", "covered": true, "evidence": "arquivo:linha" }], "tasksHash": "<copie do verificacao.json>", "notes": [] }\`.
-   O \`tasksHash\` vem do pacote — é o selo de frescor; sem ele (ou com tarefas alteradas
+   \`{ "slug": "...", "ok": true, "coverage": [{ "req": "GATE-1", "covered": true, "evidence": "arquivo:linha" }], "tasksHash": "<copie do verificacao.json>", "effectiveSpecHash": "<copie do verificacao.json>", "notes": [] }\`.
+   \`tasksHash\` e \`effectiveSpecHash\` vêm do pacote — são selos de frescor; sem eles (ou com tarefas/spec alteradas
    depois), o gate rejeita o verdict como stale.
 
 ## Regras
@@ -259,6 +261,7 @@ leaves the vault blind. Single exception: a trivial change (typo, one line).
    needs a real \`spec_impact_reason\`. \`pending\` is never ready for implementation/archive.
 3. **Apply** — implement each task in tarefas.md with **wk-tdd** (red test first). Tag tasks:
    \`[sensor:<id>]\` (automated proof) and \`[req:<ID>]\` (the spec requirement it satisfies).
+   Author specs only in \`08-Changes/<slug>/specs/\`; \`07-Specs\` is generated/read-only.
 4. **Verify** — \`wendkeep verify\` runs the sensors; then \`wendkeep verify --deep\` builds
    the verification package.
 5. **Verify deep** — the **wk-verify** skill (fresh, author≠verifier) writes \`verdict.json\`.
@@ -269,7 +272,7 @@ leaves the vault blind. Single exception: a trivial change (typo, one line).
 ## Rules
 - Multiple changes may stay open. \`CURRENT_CHANGE.md\` marks one current change without hiding
   other pending tasks. Any agent may take over an existing change with
-  \`wendkeep change new <existing-slug>\` or \`--change <slug>\` where available.
+  \`wendkeep change use <slug>\` or \`--change <slug>\` where available.
 - No \`[sensor:]\` on a task = no automated gate for it. No \`[req:]\` = no independent verdict.
 - The graph links session ↔ change ↔ requirement ↔ decision. That is the point.
 `;
@@ -286,7 +289,7 @@ would pass under the wrong implementation.
 4. **Refactor** with the greens protecting you.
 
 ## Derive from the spec, not the code
-Write assertions from the requirement's acceptance criteria (\`07-Specs\`), not by reading the
+Write assertions from the effective requirement (\`wendkeep spec effective --change <slug>\`), not by reading the
 implementation. Reading the code to write the test = it only confirms what the code already does.
 
 ## Non-shallow litmus
@@ -375,17 +378,18 @@ the author — even if you wrote the code, enter as if you'd never seen it. Fres
 
 ## What to do
 1. Read the package \`08-Changes/<slug>/verificacao.json\` (requirements, tasks, evidence).
-2. **Re-derive coverage from \`07-Specs\`** — for each \`[req:ID]\`, check the requirement's behaviour
+2. **Re-derive coverage from the self-contained package** — for each complete requirement in
+   \`verificacao.json\`, check its behaviour
    is covered by a test that discriminates (wouldn't pass under a wrong impl). \`file:line\` evidence.
 3. Spec-anchored outcome check: does the observable result match the acceptance criterion?
 4. Write \`08-Changes/<slug>/verdict.json\`:
-   \`{ "slug": "...", "ok": true, "coverage": [{ "req": "GATE-1", "covered": true, "evidence": "file:line" }], "tasksHash": "<copy from the package>", "notes": [] }\`.
+   \`{ "slug": "...", "ok": true, "coverage": [{ "req": "GATE-1", "covered": true, "evidence": "file:line" }], "tasksHash": "<copy from the package>", "effectiveSpecHash": "<copy from the package>", "notes": [] }\`.
 
 ## Rules
 - **Author ≠ verifier.** On Claude, spawn a read-only sub-agent for real isolation.
 - \`ok: false\` if any requirement lacks discriminating coverage. A gap is red, not "almost".
 - Don't fix here — a gap becomes a fix task; re-verify after.
-- The archive gate **requires** a fresh \`verdict.json\` (matching \`tasksHash\`) covering every \`[req:]\`.
+- The archive gate **requires** a fresh \`verdict.json\` (matching \`tasksHash\` and \`effectiveSpecHash\`) covering every \`[req:]\`.
 
 ## Templates (in this folder)
 - \`spec-reviewer-prompt.md\` — hand it to the verifier sub-agent you spawn (read-only, author≠verifier).
@@ -402,6 +406,7 @@ const VERDICT_TEMPLATE = `{
     { "req": "GATE-1", "covered": true, "evidence": "tests/foo.test.mjs:42" }
   ],
   "tasksHash": "<copie de verificacao.json — selo de frescor / copy from verificacao.json — freshness seal>",
+  "effectiveSpecHash": "<copie de verificacao.json / copy from verificacao.json>",
   "notes": []
 }
 `;
@@ -415,8 +420,8 @@ Claude). Ele NÃO é o autor: entra fresco, read-only, não edita nada.
 Você é o verificador independente de uma mudança do wendkeep. Não escreveu este código —
 entre como se nunca o tivesse visto. Read-only.
 
-Leia o pacote \`08-Mudanças/<slug>/verificacao.json\` (requisitos, tarefas, evidência) e os
-specs vivos em \`07-Specs/<capability>.md\`.
+Leia somente o pacote autocontido \`08-Mudanças/<slug>/verificacao.json\` (requisitos completos,
+tarefas e evidência). Não reabra \`07-Specs\`: ele ainda não contém deltas não arquivados.
 
 Para cada \`[req:ID]\` da mudança:
 1. Leia o **critério de aceite do requisito** no spec — NÃO leia a implementação primeiro.
@@ -427,7 +432,7 @@ Para cada \`[req:ID]\` da mudança:
 
 Grave \`08-Mudanças/<slug>/verdict.json\` no formato de \`verdict-template.json\`. \`ok: false\` se
 qualquer \`[req:]\` não tem cobertura que discrimina. Não conserte aqui — gap vira tarefa de
-correção. O \`tasksHash\` vem do pacote (selo de frescor; alterou tarefa depois, o gate rejeita).
+correção. \`tasksHash\` e \`effectiveSpecHash\` vêm do pacote; alterações posteriores deixam o verdict stale.
 ---
 `;
 
@@ -440,8 +445,8 @@ It is NOT the author: fresh context, read-only, edits nothing.
 You are the independent verifier of a wendkeep change. You did not write this code — enter as if
 you'd never seen it. Read-only.
 
-Read the package \`08-Changes/<slug>/verificacao.json\` (requirements, tasks, evidence) and the
-living specs in \`07-Specs/<capability>.md\`.
+Read only the self-contained \`08-Changes/<slug>/verificacao.json\` package (complete requirements,
+tasks, evidence). Do not reopen \`07-Specs\`: it does not contain unarchived deltas yet.
 
 For each \`[req:ID]\`:
 1. Read the requirement's **acceptance criterion** in the spec — do NOT read the implementation first.
@@ -452,7 +457,7 @@ For each \`[req:ID]\`:
 
 Write \`08-Changes/<slug>/verdict.json\` in the shape of \`verdict-template.json\`. \`ok: false\` if any
 \`[req:]\` lacks discriminating coverage. Don't fix here — a gap becomes a fix task. \`tasksHash\`
-comes from the package (freshness seal; edit a task later and the gate rejects it as stale).
+and \`effectiveSpecHash\` come from the package (freshness seals; later task/spec edits make verdict stale).
 ---
 `;
 

package/src/spec.mjs

@@ -1,7 +1,15 @@
 // `wendkeep spec <sub>` — read-only views over the living specs in 07-Specs (0.7.0).
 import { readFileSync, readdirSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
-import { parseRequirements } from '../hooks/spec-core.mjs';
+import {
+  adoptSpecsState,
+  buildEffectiveRequirementPackage,
+  captureSpecBaseline,
+  discoverSpecDeltas,
+  parseRequirements,
+  specConflicts,
+} from '../hooks/spec-core.mjs';
+import { activeChange, parseTasks } from '../hooks/change-core.mjs';
 import { getLocale } from '../hooks/locale.mjs';
 
 function resolveVault(argv) {
@@ -24,6 +32,64 @@ export function runSpec(argv) {
   const vaultBase = resolveVault(rest);
   const specsDir = join(vaultBase, getLocale(vaultBase).folders.specs);
 
+  const option = (name) => {
+    const index = rest.indexOf(name);
+    if (index >= 0) return rest[index + 1];
+    const entry = rest.find((a) => a.startsWith(`${name}=`));
+    return entry ? entry.slice(name.length + 1) : undefined;
+  };
+
+  if (sub === 'effective') {
+    const slug = option('--change') || activeChange(vaultBase);
+    if (!slug) { process.stderr.write('wendkeep spec effective: no change (--change or current)\n'); process.exit(2); }
+    const changeDir = join(vaultBase, getLocale(vaultBase).folders.changes, slug);
+    let tasks = [];
+    try {
+      readFileSync(join(changeDir, 'proposta.md'), 'utf8');
+      tasks = parseTasks(readFileSync(join(changeDir, 'tarefas.md'), 'utf8'));
+    }
+    catch { process.stderr.write(`wendkeep spec effective: change not found: ${slug}\n`); process.exit(2); }
+    const reqIds = [...new Set(tasks.map((task) => task.req).filter(Boolean))];
+    const effective = buildEffectiveRequirementPackage(vaultBase, changeDir, reqIds);
+    if (effective.errors.length) {
+      process.stderr.write(`wendkeep spec effective: invalid delta: ${effective.errors.join('; ')}\n`);
+      process.exit(1);
+    }
+    if (rest.includes('--json')) {
+      process.stdout.write(`${JSON.stringify({ slug, effectiveSpecHash: effective.hash, specs: effective.specs }, null, 2)}\n`);
+    } else {
+      process.stdout.write(`change: ${slug}\neffective-spec-hash: ${effective.hash}\n`);
+      for (const spec of effective.specs) {
+        process.stdout.write(`spec: ${spec.capability}\n`);
+        for (const req of spec.requirements) process.stdout.write(`  ${req.operation === 'BASE' ? '=' : req.operation === 'ADDED' ? '+' : '~'} ${req.id || req.name} [${req.source}]\n`);
+      }
+    }
+    process.exit(0);
+  }
+
+  if (sub === 'migrate') {
+    const state = adoptSpecsState(vaultBase);
+    process.stdout.write(`spec state adopted: ${Object.keys(state.specs).length} living spec(s); 07-Specs is generated/read-only\n`);
+    process.exit(0);
+  }
+
+  if (sub === 'rebase') {
+    const slug = option('--change') || activeChange(vaultBase);
+    if (!slug) { process.stderr.write('wendkeep spec rebase: no change (--change or current)\n'); process.exit(2); }
+    const changeDir = join(vaultBase, getLocale(vaultBase).folders.changes, slug);
+    try { readFileSync(join(changeDir, 'proposta.md'), 'utf8'); }
+    catch { process.stderr.write(`wendkeep spec rebase: change not found: ${slug}\n`); process.exit(2); }
+    const capabilities = discoverSpecDeltas(changeDir);
+    const conflicts = specConflicts(vaultBase, changeDir, capabilities);
+    if (conflicts.length && !rest.includes('--accept-current')) {
+      process.stderr.write(`wendkeep spec rebase: conflicts: ${conflicts.join('; ')} — reconcile delta, then rerun with --accept-current\n`);
+      process.exit(1);
+    }
+    captureSpecBaseline(vaultBase, changeDir, { refresh: true });
+    process.stdout.write(`spec baseline rebased: ${slug}${conflicts.length ? ` (${conflicts.length} conflict(s) accepted)` : ''}\n`);
+    process.exit(0);
+  }
+
   if (sub === 'list') {
     let files = [];
     try { files = readdirSync(specsDir).filter((f) => f.endsWith('.md') && f !== 'README.md'); } catch { /* sem specs */ }
@@ -49,6 +115,6 @@ export function runSpec(argv) {
     process.exit(0);
   }
 
-  process.stderr.write(`wendkeep spec: unknown subcommand "${sub}". Known: list, show.\n`);
+  process.stderr.write(`wendkeep spec: unknown subcommand "${sub}". Known: list, show, effective, migrate, rebase.\n`);
   process.exit(2);
 }

package/src/sync-defs.mjs

@@ -2,11 +2,13 @@
 // they travel with the project in git. They have no automatic consumer — agents
 // read them from their own dirs — so `wendkeep sync-defs` copies them there:
 //   .brain/agents/*.toml  -> <project>/.codex/agents/   (Codex agent format)
-//   .brain/skills/<name>/ -> <project>/.claude/skills/   (skill format)
+//   .brain/skills/<name>/ -> <project>/.claude/skills/ + .agents/skills/ (skill format)
 // .brain is the source of truth; re-run sync after editing. Copy (not symlink) for
 // cross-platform robustness.
-import { copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
+import { createHash } from 'node:crypto';
+import { copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { seedWkSkills } from './skills-seed.mjs';
 import { getLocale } from '../hooks/locale.mjs';
 
@@ -15,6 +17,27 @@ import { getLocale } from '../hooks/locale.mjs';
 // the markers is ours; user content around it is never touched.
 const AG_START = '<!-- wendkeep:skills:start -->';
 const AG_END = '<!-- wendkeep:skills:end -->';
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const WENDKEEP_VERSION = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8')).version;
+const META_FILE = '.wendkeep-meta.json';
+
+function directoryHash(root) {
+  const hash = createHash('sha256');
+  const visit = (dir) => {
+    let names = [];
+    try { names = readdirSync(dir).sort(); } catch { return; }
+    for (const name of names) {
+      if (name === META_FILE) continue;
+      const path = join(dir, name);
+      const rel = relative(root, path).replaceAll('\\', '/');
+      const stat = statSync(path);
+      if (stat.isDirectory()) visit(path);
+      else { hash.update(rel); hash.update('\0'); hash.update(readFileSync(path)); hash.update('\0'); }
+    }
+  };
+  visit(root);
+  return hash.digest('hex');
+}
 
 function skillInventory(skillsSrc) {
   const out = [];
@@ -31,9 +54,10 @@ function skillInventory(skillsSrc) {
   return out;
 }
 
-function renderAgentsSection(skills) {
+function renderAgentsSection(skills, sourceHash = '') {
   const list = skills.map((s) => `- **${s.name}** — ${s.description}`).join('\n');
   return `${AG_START}
+<!-- wendkeep-version: ${WENDKEEP_VERSION}; skills-sha256: ${sourceHash} -->
 ## wendkeep — process skills & loop
 
 This project uses the [wendkeep](https://github.com/rogersialves/wendkeep) harness. Work
@@ -41,9 +65,10 @@ through its change loop: \`wendkeep change new <slug>\` → implement tasks test
 (tag proof \`[sensor:id]\` and requirement \`[req:ID]\`) → \`wendkeep verify\` →
 \`wendkeep verify --deep\` + an independent read-only verification pass writing
 \`verdict.json\` → \`wendkeep change archive\` (gated). Inspect with \`wendkeep change
-status\` / \`spec list\` / \`sensors list\`.
+status\` / \`spec effective --change <slug>\` / \`sensors list\`. Author specs only in
+\`08-Mudanças/<slug>/specs/\`; \`07-Specs\` is generated and must not be edited directly.
 
-Process skills (full text in \`.claude/skills/\` and the vault's \`.brain/skills/\`):
+Process skills (full text in \`.claude/skills/\`, \`.agents/skills/\`, and the vault's \`.brain/skills/\`):
 ${list}
 ${AG_END}`;
 }
@@ -52,7 +77,7 @@ function upsertAgentsMd(projectPath, skillsSrc) {
   const skills = skillInventory(skillsSrc);
   if (!skills.length) return false;
   const path = join(projectPath, 'AGENTS.md');
-  const section = renderAgentsSection(skills);
+  const section = renderAgentsSection(skills, directoryHash(skillsSrc));
   let content = '';
   try { content = readFileSync(path, 'utf8'); } catch { /* novo */ }
   if (content.includes(AG_START) && content.includes(AG_END)) {
@@ -67,7 +92,7 @@ function upsertAgentsMd(projectPath, skillsSrc) {
 }
 
 export function syncDefs(vaultBase, projectPath) {
-  const out = { agents: [], skills: [], agentsMd: false };
+  const out = { agents: [], skills: [], codexSkills: [], agentsMd: false };
 
   const agentsSrc = join(vaultBase, '.brain', 'agents');
   if (existsSync(agentsSrc)) {
@@ -85,10 +110,19 @@ export function syncDefs(vaultBase, projectPath) {
     for (const name of readdirSync(skillsSrc)) {
       const dir = join(skillsSrc, name);
       if (!statSync(dir).isDirectory()) continue; // skip skills/README.md
-      const dest = join(projectPath, '.claude', 'skills', name);
-      mkdirSync(dest, { recursive: true });
-      cpSync(dir, dest, { recursive: true });
+      const destinations = [
+        join(projectPath, '.claude', 'skills', name),
+        join(projectPath, '.agents', 'skills', name),
+      ];
+      const sourceHash = directoryHash(dir);
+      for (const dest of destinations) {
+        rmSync(dest, { recursive: true, force: true });
+        mkdirSync(dest, { recursive: true });
+        cpSync(dir, dest, { recursive: true });
+        writeFileSync(join(dest, META_FILE), `${JSON.stringify({ wendkeepVersion: WENDKEEP_VERSION, sourceHash }, null, 2)}\n`, 'utf8');
+      }
       out.skills.push(name);
+      out.codexSkills.push(name);
     }
   }
 
@@ -98,6 +132,33 @@ export function syncDefs(vaultBase, projectPath) {
   return out;
 }
 
+export function checkSyncDefs(vaultBase, projectPath) {
+  const issues = [];
+  const skillsSrc = join(vaultBase, '.brain', 'skills');
+  if (!existsSync(skillsSrc)) return { ok: false, issues: ['fonte .brain/skills ausente'] };
+  const names = readdirSync(skillsSrc).filter((name) => {
+    try { return statSync(join(skillsSrc, name)).isDirectory(); } catch { return false; }
+  });
+  for (const name of names) {
+    const expected = directoryHash(join(skillsSrc, name));
+    for (const relDest of [join('.claude', 'skills', name), join('.agents', 'skills', name)]) {
+      const dest = join(projectPath, relDest);
+      if (!existsSync(join(dest, 'SKILL.md'))) { issues.push(`${relDest}: ausente`); continue; }
+      if (directoryHash(dest) !== expected) issues.push(`${relDest}: conteúdo divergiu da fonte`);
+      let meta = null;
+      try { meta = JSON.parse(readFileSync(join(dest, META_FILE), 'utf8')); } catch { /* missing */ }
+      if (meta?.wendkeepVersion !== WENDKEEP_VERSION || meta?.sourceHash !== expected) {
+        issues.push(`${relDest}: metadata stale/ausente (esperado WendKeep ${WENDKEEP_VERSION})`);
+      }
+    }
+  }
+  const expectedSection = renderAgentsSection(skillInventory(skillsSrc), directoryHash(skillsSrc));
+  let agentsMd = '';
+  try { agentsMd = readFileSync(join(projectPath, 'AGENTS.md'), 'utf8'); } catch { /* missing */ }
+  if (!agentsMd.includes(expectedSection)) issues.push('AGENTS.md: bloco gerenciado stale/ausente');
+  return { ok: issues.length === 0, issues, version: WENDKEEP_VERSION, skills: names.length };
+}
+
 // CLI entry for `wendkeep sync-defs`.
 export function runSyncDefs(argv) {
   let vault;
@@ -116,6 +177,15 @@ export function runSyncDefs(argv) {
   }
   const vaultBase = isAbsolute(base) ? base : resolve(process.cwd(), base);
   const projectPath = resolve(project || process.cwd());
+  if (argv.includes('--check')) {
+    const r = checkSyncDefs(vaultBase, projectPath);
+    if (r.ok) process.stdout.write(`wendkeep sync-defs --check: ok (${r.skills} skill(s), ${r.version})\n`);
+    else {
+      process.stderr.write(`wendkeep sync-defs --check: drift detectado\n  - ${r.issues.join('\n  - ')}\n`);
+      process.stderr.write('rode `wendkeep sync-defs --reseed` e reinicie Claude Code/Codex\n');
+    }
+    process.exit(r.ok ? 0 : 1);
+  }
   // --reseed (0.31.0): sobrescreve as wk-* de .brain/skills com os seeds da versão instalada
   // ANTES de copiar — é como um vault existente recebe descriptions/HARD-GATE novos.
   if (argv.includes('--reseed')) {
@@ -124,7 +194,7 @@ export function runSyncDefs(argv) {
   }
   const r = syncDefs(vaultBase, projectPath);
   process.stdout.write(
-    `wendkeep sync-defs: ${r.agents.length} agent(s) -> .codex/agents, ${r.skills.length} skill(s) -> .claude/skills\n`,
+    `wendkeep sync-defs: ${r.agents.length} agent(s) -> .codex/agents, ${r.skills.length} skill(s) -> .claude/skills + .agents/skills\n`,
   );
   if (r.agents.length) process.stdout.write(`  agents: ${r.agents.join(', ')}\n`);
   if (r.skills.length) process.stdout.write(`  skills: ${r.skills.join(', ')}\n`);
@@ -151,8 +221,8 @@ model = "gpt-5.5"
 const SKILLS_README = `# .brain/skills — versioned custom skill definitions
 
 Canonical, versioned source for your project's custom skills (\`<name>/SKILL.md\`).
-\`wendkeep sync-defs\` copies each skill folder here into \`<project>/.claude/skills/\` so
-the agent loads them. Edit here (source of truth); re-run \`wendkeep sync-defs\` after changes.
+\`wendkeep sync-defs\` copies each skill folder here into \`<project>/.claude/skills/\` and
+\`<project>/.agents/skills/\`. Edit here (source of truth); re-run sync after changes.
 `;
 
 const EXAMPLE_SKILL = `---

package/src/verify.mjs

@@ -5,7 +5,11 @@ import { readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 import { parseTasks, activeChange, appendFixTasks } from '../hooks/change-core.mjs';
 import { loadSensors, requiredSensors, runSensors, evaluateGate } from '../hooks/sensors-core.mjs';
-import { tasksHashOf } from '../hooks/spec-core.mjs';
+import {
+  buildEffectiveRequirementPackage,
+  captureSpecBaseline,
+  tasksHashOf,
+} from '../hooks/spec-core.mjs';
 import { addLesson } from '../hooks/lessons-core.mjs';
 import { getLocale } from '../hooks/locale.mjs';
 
@@ -88,16 +92,36 @@ export function runVerify(argv) {
     const tasks = parseTasks(tarefas);
     const reqIds = [...new Set(tasks.map((t) => t.req).filter(Boolean))];
     const tasksHash = tasksHashOf(tarefas);
+    captureSpecBaseline(vaultBase, changeDir);
+    const effective = buildEffectiveRequirementPackage(vaultBase, changeDir, reqIds);
+    if (effective.errors.length) {
+      process.stderr.write(`verify --deep: spec efetiva inválida: ${effective.errors.join('; ')}\n`);
+      process.exit(1);
+    }
+    if (effective.missing.length) {
+      process.stderr.write(`verify --deep: requisito(s) órfão(s) na spec efetiva: ${effective.missing.join(', ')}\n`);
+      process.exit(1);
+    }
     const pkg = {
       slug,
       tasksHash,
-      requirements: reqIds.map((id) => ({ id })),
+      effectiveSpecHash: effective.hash,
+      requirements: effective.requirements.map((req) => {
+        return {
+          id: req.id,
+          name: req.name,
+          capability: req.capability,
+          operation: req.operation,
+          source: req.source,
+          body: req.body,
+        };
+      }),
       tasks: tasks.map((t) => ({ id: t.id, text: t.text, req: t.req || null, done: t.done })),
       sensors: evidence,
     };
     writeFileSync(join(changeDir, 'verificacao.json'), `${JSON.stringify(pkg, null, 2)}\n`, 'utf8');
     if (reqIds.length === 0) {
-      writeFileSync(join(changeDir, 'verdict.json'), `${JSON.stringify({ slug, ok: true, coverage: [], tasksHash, notes: ['trivial: sem requisito'] }, null, 2)}\n`, 'utf8');
+      writeFileSync(join(changeDir, 'verdict.json'), `${JSON.stringify({ slug, ok: true, coverage: [], tasksHash, effectiveSpecHash: effective.hash, notes: ['trivial: sem requisito'] }, null, 2)}\n`, 'utf8');
       process.stdout.write('verify --deep: pacote + verdict trivial escritos\n');
     } else {
       process.stdout.write('verify --deep: pacote escrito — rode a skill wk-verify pra gravar verdict.json\n');