wendkeep 0.72.0 → 0.73.0

package/CHANGELOG.md

@@ -4,6 +4,69 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.73.0] — 2026-08-20
+
+### Added
+
+- **Work kind independente do perfil.** `inspection`, `maintenance`, `implementation`, `delivery`
+  e `recovery` passam a ser classificados separadamente de perfil, impacto de contrato e risco
+  operacional.
+- **Delivery com autorização e receipt.** `delivery start/status/finish/abandon` captura repositório,
+  branch/worktree, SHA, change de origem e capabilities; comprova target, CI, versão, tag,
+  integridade npm e GitHub Release quando aplicável, sem criar change, spec ou ADR.
+- **GUIDE realmente compacta.** `change new --guide` gera somente objetivo, critérios de aceite,
+  áreas afetadas, testes e resultado. Sem impacto de contrato, seu archive não fabrica design,
+  delta de spec ou ADR.
+
+### Changed
+
+- **Doctor proporcional.** O diagnóstico separa erro estrutural, atenção de workflow, dívida
+  reparável e ambiguidade semântica. `--scope core|runtime` isola as superfícies e `--strict`
+  promove pendências a falha para CI/release.
+- **Sync valida somente o Keep Core.** Trabalho em andamento no Wend Runtime deixa de transformar
+  uma instalação saudável em falha; a conclusão informa separadamente a saúde do Core.
+- **Conflitos semânticos degradam por chave.** Candidates ativos aguardam curadoria sem bloquear o
+  bundle inteiro; corrupção de ledger, boundary, identidade ou projeção continua falhando fechada.
+
+### Fixed
+
+- **Proveniência preserva lifecycle scripts.** A comparação de integridade executa `npm pack`
+  normalmente em uma cópia isolada, mantendo `prepack`/`postpack` e impedindo que a verificação
+  altere o working tree de origem.
+
+## [0.72.1] — 2026-08-20
+
+### Added
+
+- **Proveniência verificável de release.** A publicação gera um receipt com commit, versão, tag,
+  integridade npm, execução do workflow e GitHub Release, e recusa divergências entre o SHA testado,
+  a tag e o tarball publicado.
+- **Contrato seguro do Observer.** O Keep Core permanece em Node.js 18+, enquanto comandos SQL
+  diagnosticam `WENDKEEP_OBSERVER_NODE_UNSUPPORTED` abaixo do Node.js 22.13. Mutações exigem Bearer,
+  non-loopback exige token e requisições validam Host e Origin.
+- **Níveis de captura.** `metadata` é o padrão sem mensagens; `messages` e `full-transcript` são
+  opt-in. Caminhos absolutos não são publicados e init recomenda ignorar state e outbox SQL.
+
+### Changed
+
+- **Release somente após CI verde.** O workflow publica o SHA aprovado pela matriz Core (Node 18/20)
+  e Observer (Node 22.13/24), cria a tag no mesmo commit e pode reconciliar execuções repetidas.
+- **Dogfooding pelo working tree.** O repositório não depende mais de `wendkeep` em devDependencies;
+  seus hooks chamam `node ./bin/wendkeep.mjs`, enquanto projetos consumidores usam
+  `npx --no-install wendkeep` e o tarball continua testado isoladamente.
+
+### Fixed
+
+- **Identidade de arquivos de memória no Windows.** A revalidação compara o índice do arquivo como
+  inteiro exato e tolera a inconsistência conhecida do serial de volume do libuv antigo, evitando
+  falsos `VAULT_PATH_UNSAFE` no Node.js 22.13 sem relaxar a rejeição de hardlinks ou reparses.
+- **Ingestão SQL grande em runners lentos.** O timeout HTTP cresce com o tamanho bruto do lote até
+  120 segundos, preservando 15 segundos para payloads vazios/pequenos e evitando outbox falsa para
+  lotes gzip válidos acima de 64 MB.
+- **Trusted Publisher preservado após o gate de CI.** `auto-tag.yml`, o workflow já autorizado no
+  npm, passa a executar a matriz da `main` e mantém o publish em um job com `needs: test`;
+  `test.yml` fica exclusivo para pull requests.
+
 ## [0.72.0] — 2026-08-17
 
 ### Added
@@ -1029,7 +1092,7 @@ All notable changes to **wendkeep** are documented here. Format based on
   enum de eventos de hook do Codex.
 - A projeção Codex tem três diferenças em relação ao formato do `settings.json`, todas
   **silenciosas quando erradas** — daí valerem registro. (1) A chave de timeout é `timeoutSec`,
-  não `timeout`. (2) O comando é sempre `npx wendkeep hook <nome>`, nunca a forma node-direta:
+  não `timeout`. (2) O comando é sempre `npx --no-install wendkeep hook <nome>`, nunca a forma node-direta:
   aquela emite `${CLAUDE_PROJECT_DIR}`, que não existe no Codex, então a flag `preferLocal` é
   ignorada de propósito na projeção. (3) As chaves de evento são PascalCase — o snake_case que
   se vê em `[hooks.state]` no `~/.codex/config.toml` é o rótulo interno do evento, não a chave
@@ -1613,7 +1676,7 @@ they only read + append.
 
 ### Note
 - You do **not** need `wendkeep init` for a routine update: the hooks live in the package
-  (`settings.json` calls `npx wendkeep hook …`), so `npm i -D wendkeep@latest` updates them.
+  (`settings.json` calls `npx --no-install wendkeep hook …`), so `npm i -D wendkeep@latest` updates them.
   Re-run `init` only when a release adds new wiring (the CHANGELOG says so); it's idempotent.
 
 ## [0.26.0] — 2026-07-08
@@ -1793,7 +1856,7 @@ Fix: memory + active-change injection wired by default.
 
 ### Upgrade
 - Existing installs pick it up by re-running `wendkeep init --force` (idempotent — it only adds the
-  missing hook), or by adding `npx wendkeep hook brain-inject` to the SessionStart hooks manually.
+  missing hook), or by adding `npx --no-install wendkeep hook brain-inject` to the SessionStart hooks manually.
 
 ## [0.18.0] — 2026-07-06
 

package/README.en.md

@@ -127,7 +127,7 @@ npx wendkeep init
 6. Install a **color system** into the vault's `.obsidian/`: a CSS snippet that accents notes by type (session/decision/bug/learning, via the `cssclasses` the hooks emit) plus graph color groups by folder. Non-destructive merge into `appearance.json`/`graph.json`; skip with `--no-colors`. Re-apply it any time on an existing vault with `wendkeep theme sync` — Obsidian owns `graph.json` and can drop the color groups (a grey graph); the re-sync restores them without a full re-`init`.
 7. Seed **Shared Project Memory v2** without overwriting existing artifacts: `.brain/CORE.md` (hand-curated canonical truth), `.brain/SHARED_MEMORY.md` (generated operational state), `.brain/MEMORY_EVENTS.jsonl` (append-only ledger), `.brain/MEMORY_CANDIDATES.jsonl` (curation queue), and `.brain/COMPACTION_PROTOCOL.md`. The durable outbox appears under `.brain/memory-outbox/` when events exist; `DIGEST.md` and `index.jsonl` remain deep recall. Everything stays local to the vault.
 8. Seed the **definitions + skills layer**: `.brain/agents/` + `.brain/skills/` (versioned source of truth), including the native process skills `wk-workflow` / `wk-tdd` / `wk-debugging` / `wk-brainstorming` / `wk-planning` / `wk-verify` (some ship templates — e.g. `wk-verify`'s `verdict-template.json` + reviewer prompt). `init` runs `wendkeep sync-defs` for you, delivering the skills to `.claude/skills/` and `.agents/skills/`, and the agent definitions (`.brain/agents/*.toml`) to `.codex/agents/`, plus a managed section in `AGENTS.md` that indexes the skills for Codex; `sync-defs --check` detects stale copies (re-run `sync-defs` after editing `.brain`).
-9. Seed the **change/spec lifecycle**: the `07-Specs/` + `08-Mudanças/` folders and a native `wendkeep.sensors.json` — critical memory validation/health sensors plus one for each of `typecheck` / `test` / `lint` / `build` found in your `package.json`. `memory-health` blocks delivery on corruption, projection divergence, or an active conflict; pending outbox events and ordinary candidates are warnings. Add sensors with `wendkeep sensors add`. Drives `wendkeep change` / `wendkeep verify` — see **Change lifecycle** below.
+9. Seed the **change/spec lifecycle**: the `07-Specs/` + `08-Mudanças/` folders and a native `wendkeep.sensors.json` — critical memory validation/health sensors plus one for each of `typecheck` / `test` / `lint` / `build` found in your `package.json`. `memory-health` blocks delivery on corruption or projection divergence; semantic conflicts degrade only the affected keys and await curation. Pending outbox events and ordinary candidates are warnings. Add sensors with `wendkeep sensors add`. Drives `wendkeep change` / `wendkeep verify` — see **Change lifecycle** below.
 
 ```bash
 npx wendkeep init --vault "~/vaults/work" --project . --yes   # non-interactive (no companions unless you ask)
@@ -257,7 +257,7 @@ deliberate opt-in and runs that command's own validations:
 |---|---|---|
 | `OFF` | LLM-native harness | No Wend router, skill gate, or gates; explicit selection only. |
 | `FLOW` | E → V | Microcontract with Git baseline, allowlist, sensor, and receipt, without a change. |
-| `GUIDE` | P → E → V | Compact guided change. |
+| `GUIDE` | P → E → V | Compact change; no automatic design/spec/ADR when contract impact is none. |
 | `GOVERN` | P → R → E → V | Current a2 loop and compatible fallback. |
 | `ASSURE` | P → R → E → V → C | Governance with confirmation and handoff. |
 
@@ -317,13 +317,25 @@ positive causal turn and sequence that agree in the registry.
 “Small” describes size, not risk. The harness uses this matrix to choose and record a temporary
 route; semantic inference remains in the agent, not Wend Runtime:
 
-| Situation | Suggested profile |
-|---|---|
-| Question, inspection, or diagnosis with no mutation | No profile transition |
-| Local, reversible fix with an allowlist and no contract/spec change | `FLOW` (`E → V`) |
-| Small behavior change that needs a change but not formal Wend Runtime review | `GUIDE` (`P → E → V`) |
-| Normal, ambiguous, public-contract, security, dependency, CI/release, or policy change | `GOVERN` (`P → R → E → V`) |
-| Work requiring explicit confirmation and handoff | `ASSURE` (`P → R → E → V → C`) |
+| Situation | Work kind | Suggested profile | New change |
+|---|---|---|---|
+| Question, inspection, or diagnosis with no mutation | `inspection` | No transition | No |
+| Local, reversible fix with an allowlist and no contract/spec change | `maintenance` | `FLOW` (`E → V`) | No |
+| Small behavior change without formal review | `implementation` | `GUIDE` (`P → E → V`) | Yes, compact |
+| Public contract, security, schema, dependency, CI/release workflow, or policy | `implementation` | `GOVERN`/`ASSURE` | Yes |
+| Merge, push, tag, or publication of approved behavior | `delivery` | `ASSURE` | No |
+| Operational recovery without code/config correction | `recovery` | `FLOW`/`ASSURE` | No |
+
+Work kind, profile, contract impact, and operational risk are independent dimensions. A
+`delivery` records authorized capabilities and an append-only receipt without creating a change,
+spec, or ADR. If delivery requires a code/config edit, it pauses and work returns to
+`implementation`:
+
+```bash
+npx wendkeep delivery start release-0-73-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha>
+npx wendkeep delivery status release-0-73-0
+npx wendkeep delivery finish release-0-73-0 --target main --ci-url <url> --version 0.73.0 --npm-integrity <sha512> --release-url <url>
+```
 
 If the harness does not record a lease, a small fix remains under the configured profile —
 `GOVERN` by default. `OFF` does not mean “simple task”: it is a persistent human choice that hands
@@ -344,6 +356,11 @@ and owner+lease locks validate physical topology. Concurrent promotion elects on
 retry through `--change-slug`. Read the complete
 [Operating profiles guide](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md).
 
+`wendkeep doctor` separates structural errors, workflow attention, repairable debt, and semantic
+ambiguity. Use `--scope core` for Keep Core health, `--scope runtime` for governance, and
+`--strict` in CI/release; `wendkeep sync` validates Core only so work in progress does not become
+an installation failure.
+
 ## Shared Project Memory v2
 
 Hot memory now separates human authorship, operational state, and evidence:
@@ -487,10 +504,10 @@ Beyond capturing sessions, wendkeep is a **harness**: a native, zero‑dependenc
 explore → propose → apply (TDD) → verify → archive
 ```
 
-- **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
+- **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). `--guide` creates the compact GUIDE contract and omits automatic design/spec/ADR when `contract_impact:none`. It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
 - **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags.
 - **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. Failures retain only a bounded, sanitized diagnostic; green output is not persisted. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
-- **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each capability's spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md`, moves the change to `_arquivo/`, and mints an ADR in `04-Decisões/`.
+- **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each applicable spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md` and moves the change to `_arquivo/`. GOVERN/ASSURE mint an ADR in `04-Decisões/`; compact GUIDE with no contract impact does not mint one automatically.
 
 > The gate blocks unless the scaffold is filled, no task is open, evidence is fresh, and every declared requirement is covered. **`--force` waives exactly one of those — the open-task check — and is the human's call, never the agent's.** An unfilled scaffold, a red critical sensor, stale evidence, an orphan requirement or a missing verdict block regardless.
 

package/README.md

@@ -127,7 +127,7 @@ npx wendkeep init
 6. Install a **color system** into the vault's `.obsidian/`: a CSS snippet that accents notes by type (session/decision/bug/learning, via the `cssclasses` the hooks emit) plus graph color groups by folder. Non-destructive merge into `appearance.json`/`graph.json`; skip with `--no-colors`. Re-apply it any time on an existing vault with `wendkeep theme sync` — Obsidian owns `graph.json` and can drop the color groups (a grey graph); the re-sync restores them without a full re-`init`.
 7. Seed **Shared Project Memory v2** without overwriting existing artifacts: `.brain/CORE.md` (hand-curated canonical truth), `.brain/SHARED_MEMORY.md` (generated operational state), `.brain/MEMORY_EVENTS.jsonl` (append-only ledger), `.brain/MEMORY_CANDIDATES.jsonl` (curation queue), and `.brain/COMPACTION_PROTOCOL.md`. The durable outbox appears under `.brain/memory-outbox/` when events exist; `DIGEST.md` and `index.jsonl` remain deep recall. Everything stays local to the vault.
 8. Seed the **definitions + skills layer**: `.brain/agents/` + `.brain/skills/` (versioned source of truth), including the native process skills `wk-workflow` / `wk-tdd` / `wk-debugging` / `wk-brainstorming` / `wk-planning` / `wk-verify` (some ship templates — e.g. `wk-verify`'s `verdict-template.json` + reviewer prompt). `init` runs `wendkeep sync-defs` for you, delivering the skills to `.claude/skills/` and `.agents/skills/`, and the agent definitions (`.brain/agents/*.toml`) to `.codex/agents/`, plus a managed section in `AGENTS.md` that indexes the skills for Codex; `sync-defs --check` detects stale copies (re-run `sync-defs` after editing `.brain`).
-9. Seed the **change/spec lifecycle**: the `07-Specs/` + `08-Mudanças/` folders and a native `wendkeep.sensors.json` — critical memory validation/health sensors plus one for each of `typecheck` / `test` / `lint` / `build` found in your `package.json`. `memory-health` blocks delivery on corruption, projection divergence, or an active conflict; pending outbox events and ordinary candidates are warnings. Add sensors with `wendkeep sensors add`. Drives `wendkeep change` / `wendkeep verify` — see **Change lifecycle** below.
+9. Seed the **change/spec lifecycle**: the `07-Specs/` + `08-Mudanças/` folders and a native `wendkeep.sensors.json` — critical memory validation/health sensors plus one for each of `typecheck` / `test` / `lint` / `build` found in your `package.json`. `memory-health` blocks delivery on corruption or projection divergence; semantic conflicts degrade only the affected keys and await curation. Pending outbox events and ordinary candidates are warnings. Add sensors with `wendkeep sensors add`. Drives `wendkeep change` / `wendkeep verify` — see **Change lifecycle** below.
 
 ```bash
 npx wendkeep init --vault "~/vaults/work" --project . --yes   # non-interactive (no companions unless you ask)
@@ -257,7 +257,7 @@ deliberate opt-in and runs that command's own validations:
 |---|---|---|
 | `OFF` | LLM-native harness | No Wend router, skill gate, or gates; explicit selection only. |
 | `FLOW` | E → V | Microcontract with Git baseline, allowlist, sensor, and receipt, without a change. |
-| `GUIDE` | P → E → V | Compact guided change. |
+| `GUIDE` | P → E → V | Compact change; no automatic design/spec/ADR when contract impact is none. |
 | `GOVERN` | P → R → E → V | Current a2 loop and compatible fallback. |
 | `ASSURE` | P → R → E → V → C | Governance with confirmation and handoff. |
 
@@ -317,13 +317,25 @@ positive causal turn and sequence that agree in the registry.
 “Small” describes size, not risk. The harness uses this matrix to choose and record a temporary
 route; semantic inference remains in the agent, not Wend Runtime:
 
-| Situation | Suggested profile |
-|---|---|
-| Question, inspection, or diagnosis with no mutation | No profile transition |
-| Local, reversible fix with an allowlist and no contract/spec change | `FLOW` (`E → V`) |
-| Small behavior change that needs a change but not formal Wend Runtime review | `GUIDE` (`P → E → V`) |
-| Normal, ambiguous, public-contract, security, dependency, CI/release, or policy change | `GOVERN` (`P → R → E → V`) |
-| Work requiring explicit confirmation and handoff | `ASSURE` (`P → R → E → V → C`) |
+| Situation | Work kind | Suggested profile | New change |
+|---|---|---|---|
+| Question, inspection, or diagnosis with no mutation | `inspection` | No transition | No |
+| Local, reversible fix with an allowlist and no contract/spec change | `maintenance` | `FLOW` (`E → V`) | No |
+| Small behavior change without formal review | `implementation` | `GUIDE` (`P → E → V`) | Yes, compact |
+| Public contract, security, schema, dependency, CI/release workflow, or policy | `implementation` | `GOVERN`/`ASSURE` | Yes |
+| Merge, push, tag, or publication of approved behavior | `delivery` | `ASSURE` | No |
+| Operational recovery without code/config correction | `recovery` | `FLOW`/`ASSURE` | No |
+
+Work kind, profile, contract impact, and operational risk are independent dimensions. A
+`delivery` records authorized capabilities and an append-only receipt without creating a change,
+spec, or ADR. If delivery requires a code/config edit, it pauses and work returns to
+`implementation`:
+
+```bash
+npx wendkeep delivery start release-0-73-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha>
+npx wendkeep delivery status release-0-73-0
+npx wendkeep delivery finish release-0-73-0 --target main --ci-url <url> --version 0.73.0 --npm-integrity <sha512> --release-url <url>
+```
 
 If the harness does not record a lease, a small fix remains under the configured profile —
 `GOVERN` by default. `OFF` does not mean “simple task”: it is a persistent human choice that hands
@@ -344,6 +356,11 @@ and owner+lease locks validate physical topology. Concurrent promotion elects on
 retry through `--change-slug`. Read the complete
 [Operating profiles guide](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md).
 
+`wendkeep doctor` separates structural errors, workflow attention, repairable debt, and semantic
+ambiguity. Use `--scope core` for Keep Core health, `--scope runtime` for governance, and
+`--strict` in CI/release; `wendkeep sync` validates Core only so work in progress does not become
+an installation failure.
+
 ## Shared Project Memory v2
 
 Hot memory now separates human authorship, operational state, and evidence:
@@ -487,10 +504,10 @@ Beyond capturing sessions, wendkeep is a **harness**: a native, zero‑dependenc
 explore → propose → apply (TDD) → verify → archive
 ```
 
-- **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
+- **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). `--guide` creates the compact GUIDE contract and omits automatic design/spec/ADR when `contract_impact:none`. It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
 - **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags.
 - **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. Failures retain only a bounded, sanitized diagnostic; green output is not persisted. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
-- **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each capability's spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md`, moves the change to `_arquivo/`, and mints an ADR in `04-Decisões/`.
+- **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each applicable spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md` and moves the change to `_arquivo/`. GOVERN/ASSURE mint an ADR in `04-Decisões/`; compact GUIDE with no contract impact does not mint one automatically.
 
 > The gate blocks unless the scaffold is filled, no task is open, evidence is fresh, and every declared requirement is covered. **`--force` waives exactly one of those — the open-task check — and is the human's call, never the agent's.** An unfilled scaffold, a red critical sensor, stale evidence, an orphan requirement or a missing verdict block regardless.
 

package/docs/en/commands/changes-and-verification.md

@@ -25,7 +25,7 @@ Initialize the project, keep the vault healthy, and provide a valid `wendkeep.se
 ## Syntax
 
 ```bash
-npx wendkeep change new <slug>
+npx wendkeep change new <slug> [--simple|--guide]
 npx wendkeep change status [slug]
 npx wendkeep spec effective --change <slug>
 npx wendkeep sensors list
@@ -35,8 +35,10 @@ npx wendkeep change archive <slug>
 
 ## Options and exit codes
 
-- `wendkeep change new <slug> [--simple]` creates a change; `--simple` only skips design, is not
-  `FLOW`, and preserves the legacy lifecycle/ADR contract.
+- `wendkeep change new <slug> [--simple|--guide]` creates a change. `--simple` only skips design,
+  is not `FLOW`, and preserves the legacy lifecycle/ADR contract. `--guide` creates the compact
+  GUIDE contract (objective, acceptance, areas, tests, and result), with no automatic
+  design/spec/ADR when `contract_impact:none`.
 - `change use`, `list`, `show`, `status`, `diff`, `done`, and `undone` inspect or update work
   without archiving it.
 - `change continue <archived> <new>` starts follow-up work without inheriting stale proof.
@@ -52,6 +54,7 @@ npx wendkeep change archive <slug>
 
 ```bash
 npx wendkeep change new tenant-login
+npx wendkeep change new internal-adjustment --guide
 npx wendkeep spec effective --change tenant-login
 npx wendkeep change done 1.1 --change tenant-login
 npx wendkeep verify --change tenant-login
@@ -67,8 +70,10 @@ npx wendkeep sensors add api-contracts "npm run test:contracts" --severity criti
 
 ## Expected result
 
-An archived change promotes its delta into the living spec, preserves proposal/design/tasks/proof,
-and mints an ADR. Archive passes only with closed tasks, green required sensors, and a fresh verdict.
+An archived change promotes its delta into the living spec when applicable and preserves proposal,
+tasks/proof, and design when present. GOVERN/ASSURE mint an ADR; compact GUIDE with no contract
+impact does not mint one automatically. Archive passes only with closed tasks, green required
+sensors, and a fresh verdict.
 
 ## Tool-scope fence
 

package/docs/en/commands/maintenance-and-diagnostics.md

@@ -23,7 +23,7 @@ Run from the project root or provide `--project` and `--vault` explicitly.
 ## Syntax
 
 ```bash
-npx --no-install wendkeep doctor [--vault <vault>]
+npx --no-install wendkeep doctor [--vault <vault>] [--scope all|core|runtime] [--strict]
 npx --no-install wendkeep memory curate --vault <vault>
 npx --no-install wendkeep sync-defs [--check|--reseed] --vault <vault> --project <root>
 npx --no-install wendkeep theme sync --vault <vault>
@@ -33,7 +33,10 @@ npx --no-install wendkeep --help
 
 ## Options and exit codes
 
-- `doctor` is read-only; exit `0` accepts recoverable warnings, while non-zero means failure.
+- `doctor` is read-only. By default only structural errors produce a non-zero exit; `--strict`
+  also fails on workflow attention, repairable debt, semantic degradation, and warnings.
+- `--scope core` checks the installation, binding, ledger, and Keep Core only. `--scope runtime`
+  checks changes, sensors, and governance only. The default `all` reports both surfaces.
 - `doctor` uses human-readable output with `[integrity]` and `[memory]` sections, friendly
   categories, and a copyable next action. The `vault-health.mjs` hook remains the JSON surface for
   automation; neither surface applies curation.
@@ -44,8 +47,9 @@ npx --no-install wendkeep --help
   IDs, and checkpoint) with outbox, ledger, and SHARED; they do not infer health from revision alone.
 - `revision: 0` after a valid migration, with no v2 attempt, is healthy. A `degraded` attempt whose
   events remain durable in the outbox/ledger is a recoverable warning.
-- An ambiguous attempt, a lost event ID (absent from ledger and outbox), `projected` state found
-  only in the outbox, or a mismatched checkpoint is blocking.
+- An ambiguous publication attempt, a lost event ID (absent from ledger and outbox), `projected`
+  state found only in the outbox, or a mismatched checkpoint is a structural block. Active
+  semantic candidates degrade memory by key and remain available for explicit curation.
 - For session observability, `legacy`, `degraded`, `stale`, and `manifest-unproven` require
   reconciliation or more evidence. Only fresh `none` and fresh `complete` are healthy: frontier,
   checkpoint, root stat, and source manifest must agree.
@@ -63,6 +67,8 @@ Post-update checklist:
 npx --no-install wendkeep --version
 npx --no-install wendkeep sync-defs --check --vault .MyApp-vault --project .
 npx --no-install wendkeep doctor --vault .MyApp-vault
+npx --no-install wendkeep doctor --scope core --vault .MyApp-vault
+npx --no-install wendkeep doctor --scope runtime --strict --vault .MyApp-vault
 npx --no-install wendkeep memory status --gate --vault .MyApp-vault
 npx --no-install wendkeep memory curate --vault .MyApp-vault
 npx --no-install wendkeep memory candidates --active --vault .MyApp-vault
@@ -72,10 +78,11 @@ npx --no-install wendkeep cost rebuild --session <id> --json --vault .MyApp-vaul
 
 ## Expected result
 
-Doctor names sessions, registry, links, notes, prices, derived sections, and memory as healthy or
+Doctor separates structural errors, workflow attention, repairable debt, and semantic ambiguity.
+It names sessions, registry, links, notes, prices, derived sections, and memory as healthy or
 provides a specific diagnostic/repair command. For memory, it distinguishes a valid initial empty
-state, recoverable pending replay, and lost/divergent lifecycle state. It never repairs implicitly
-or echoes private projector-error content into its report. For session observability, it separates
+state, recoverable pending replay, key-scoped conflicts, and lost/divergent lifecycle state. It
+never repairs implicitly or echoes private projector-error content into its report. For session observability, it separates
 fresh `none`/`complete` from legacy, degraded, stale, or manifest-unproven state and gives a
 dry-run path before any write.
 
@@ -87,10 +94,11 @@ dry-run path before any write.
   `npx --no-install wendkeep memory migrate --apply --vault <vault>` with the resolved Vault, but
   migration remains opt-in and must be planned separately.
 - `degraded` plus an intact outbox: warning; preserve the outbox and allow idempotent replay.
-- `ambiguous`, lost publication, or a mismatched checkpoint: blocking; preserve registry, ledger,
+- Ambiguous publication, lost publication, or a mismatched checkpoint: blocking; preserve registry, ledger,
   outbox, and SHARED so `last_memory_attempt` can be correlated before repair.
 - Corrupt bundle: preserve evidence and run `memory status --gate` before `memory repair`.
-- An active semantic conflict requires a human decision: `memory repair` does not choose a winner.
+- An active semantic conflict degrades only the affected memory key and requires a human decision:
+  `memory repair` does not choose a winner.
   Start with the guided menu `memory curate --vault <vault>`. For advanced inspection or a
   non-interactive terminal, list safe IDs with `memory candidates --active --vault <vault>`, review
   the evidence, and then use

package/docs/en/commands/observer.md

@@ -6,7 +6,7 @@
 
 The Observer consolidates observability for multiple WendKeep projects in a local service. The
 Docker volume keeps `/data/observer.sqlite` as the single authority for documents, sessions,
-agents, usage, calls, and complete transcripts. The content can be browsed and searched in the
+agents, usage, and calls. Complete transcripts are optional and require explicit capture. The content can be browsed and searched in the
 container without depending on Obsidian for queries.
 
 ## When to use
@@ -24,8 +24,9 @@ WendKeep hooks.
 
 ## Prerequisites
 
-Initialize projects with WendKeep and explicitly register each project before starting the HTTP
-server. The default local mode has no token to configure.
+Use Node.js 22.13 or newer for the SQL Observer. Keep Core and the remaining commands continue to
+support Node.js 18 or newer. Explicitly register each project and set `WENDKEEP_OBSERVER_TOKEN`;
+loopback reads remain open, while every mutation requires a Bearer token.
 
 ## Syntax
 
@@ -33,8 +34,8 @@ server. The default local mode has no token to configure.
 npx wendkeep observer status --data-dir <directory> --json
 npx wendkeep observer register --project <project> --vault <vault> --data-dir <directory>
 npx wendkeep observer publish --project <project> --vault <vault> --data-dir <directory>
-npx wendkeep observer memory import --project <project> --vault <vault> --url http://127.0.0.1:8787 --json
-npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory>
+npx wendkeep observer memory import --project <project> --vault <vault> --url http://127.0.0.1:8787 --token <token> --json
+npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory> --token <token>
 ```
 
 ## Options and exit codes
@@ -44,8 +45,9 @@ npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory>
 - `--project` and `--vault` identify a project for `register`, `publish`, and `memory import`.
 - `--host` accepts only `127.0.0.1`, `localhost`, or `::1`; other hosts are rejected before
   listening.
-- `/v1` is open in the default local mode; keep `--host 127.0.0.1` and do not publish the port on
-  a network address.
+- `--token` or `WENDKEEP_OBSERVER_TOKEN` authenticates mutations; `--allow-non-loopback` fails without one.
+- `WENDKEEP_OBSERVER_CAPTURE_LEVEL` accepts `metadata` (default, no messages), `messages`, or
+  `full-transcript`. Absolute local paths are never published.
 - Exit `0` means success; exit `1` means configuration or operation failure; the publisher hook
   also returns `0` when the Observer is unavailable.
 
@@ -53,7 +55,8 @@ npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory>
 
 ```powershell
 npx wendkeep observer register --project C:\GitHub\WendKeep --vault C:\GitHub\WendKeep\.WendKeep-vault --data-dir C:\WendKeepObserver
-npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir C:\WendKeepObserver
+$env:WENDKEEP_OBSERVER_TOKEN = '<strong-local-token>'
+npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir C:\WendKeepObserver --token $env:WENDKEEP_OBSERVER_TOKEN
 $env:WENDKEEP_OBSERVER_URL = 'http://127.0.0.1:8787'
 ```
 
@@ -66,14 +69,14 @@ docker compose -f docker/wendkeep-observer/compose.yaml up -d --build
 ## Local web dashboard
 
 With the server running, open [http://127.0.0.1:8787/](http://127.0.0.1:8787/) in a browser. The
-dashboard is served by the same process and opens directly, without a form or token. Keep the port
+dashboard is served by the same process and opens directly for reads, without a form or token. Keep the port
 bound to the computer loopback; do not expose this address on a network interface.
 
 The dashboard shows the multi-project list, version, health, latest session, active change, change
 count, and last capture time. Opening a project exposes Overview, Consumption, Sessions, Memory,
 Changes, and Sync screens. Consumption shows total cost, token categories, primary agents,
 subagents, providers, models, daily trend, historical coverage, and calls with prompt, response,
-and complete transcript. Loading, empty, unavailable-server, conflict, no-pricing, and stale-data
+and transcript content according to the selected capture level. Loading, empty, unavailable-server, conflict, no-pricing, and stale-data
 states are visible, with manual refresh and an automatic 15-second refresh.
 
 If the browser shows the shell but the list fails, check the service health at
@@ -84,7 +87,8 @@ If the browser shows the shell but the list fails, check the service health at
 `register` stores `project_id`, name, version, and registration time. `publish` reads the local
 vault, produces the snapshot, and sends idempotent events to SQLite containing the complete content
 of sessions, decisions, bugs, learnings, specs, changes, CORE, DIGEST, SHARED_MEMORY, brain state,
-agent sessions, cost rollups, calls, and transcripts. The container stores everything in
+agent sessions, cost rollups, and calls. Messages and transcripts are only sent by capture levels
+that explicitly enable them. The container stores everything in
 `/data/observer.sqlite`; it does not mount `C:\GitHub` or any `.WendKeep-vault`. Markdown is only
 the text held in SQL and is recreated as files only by an explicit read-only export.
 `memory import` performs the initial load and returns file/hash parity. During migration, the
@@ -104,7 +108,9 @@ outbox is temporary transport, not authority.
 - `project_not_registered`: run `observer register` before publishing.
 - `host loopback`: replace `0.0.0.0` or a LAN address with `127.0.0.1`.
 - Pending outbox: the service was unavailable; preserve `.brain/observer-outbox/` and
-  `.brain/observer-sql-outbox/`, then rerun the publisher. Do not delete events manually.
+  `.brain/observer-sql-outbox/`, then rerun the publisher. Also ignore
+  `.brain/observer-sql-state.json` and `.brain/observer-sql-outbox/` in a versioned vault. Do not delete events manually.
+- `WENDKEEP_OBSERVER_NODE_UNSUPPORTED`: run the Observer on Node.js 22.13 or newer.
 - If memory or usage is incomplete, check the Sync screen, preserve the outbox, and run
   `observer memory import` to rebuild the load from the vault.
 

package/docs/en/commands/operating-profiles.md

@@ -1,4 +1,4 @@
-# Operating profiles and FLOW
+# Operating profiles, work kind, FLOW, and delivery
 
 **English** · [Português](../../pt-BR/commands/operating-profiles.md)
 
@@ -17,6 +17,8 @@ opt-in and runs that command's own validations and gates.
 Use `profile use` for a persistent human selection and `profile route` for the harness to record
 the temporary route for the current implementation. Use `FLOW` for local, reversible
 `spec_impact:none` maintenance that fits an Execute → Validate microcontract without a change.
+Use `delivery` for merge, push, tag, and publication of already-approved behavior: operational
+risk needs authorization and a receipt, not a new change or spec.
 
 ## When not to use
 
@@ -55,6 +57,10 @@ npx wendkeep flow status [<id>]
 npx wendkeep flow show <id> [--session <id>]
 npx wendkeep flow finish <id> [--session <id>]
 npx wendkeep flow promote <id> [--change-slug <slug>] [--session <id>]
+npx wendkeep delivery start [id] --allow <capability> [--source-change <slug>] [--source-commit <sha>]
+npx wendkeep delivery status [id]
+npx wendkeep delivery finish [id] [--target <ref>] [--ci-url <url>] [--version <x.y.z>] [--npm-integrity <sha512>] [--release-url <url>]
+npx wendkeep delivery abandon [id] --reason <text>
 ```
 
 Every FLOW subcommand also accepts `--project <path>`, `--vault <path>`, and `--json`. When
@@ -84,7 +90,7 @@ Harness. The workspaces remain private and are not published as independent npm
 |---|---|---|
 | `OFF` | LLM-native harness | Automatic governance off; Keep Core and explicit commands available. |
 | `FLOW` | E → V | Microcontract with Git baseline, allowlist, sensors, and receipt, without a change. |
-| `GUIDE` | P → E → V | Compact change; policy recognized for compatible evolution. |
+| `GUIDE` | P → E → V | `change new --guide`; objective, acceptance, areas, tests, and result; no automatic design/spec/ADR for `contract_impact:none`. |
 | `GOVERN` | P → R → E → V | Current a2 loop and conservative fallback. |
 | `ASSURE` | P → R → E → V → C | Governance plus confirmation and handoff. |
 
@@ -164,6 +170,14 @@ ownership to the native LLM harness.
   loser remains active and can retry with `--change-slug`. Retries idempotently resume the same
   promotion instead of creating another change.
   No FLOW command accepts `--force`.
+- Work kind (`inspection`, `maintenance`, `implementation`, `delivery`, `recovery`), profile,
+  `contract_impact`, and `operation_risk` are independent dimensions. `delivery start` captures
+  repo, branch/worktree, SHA, source change, and capabilities in `.brain/runtime/deliveries/`;
+  it creates no `08-Changes` folder, delta, spec, or ADR.
+- `delivery finish` requires a clean worktree, proves that the target contains the source commit,
+  and for `publish` requires CI, version, npm integrity, and GitHub Release evidence. Receipts are
+  append-only in `.brain/runtime/delivery-receipts.jsonl`. If code/config must change, delivery
+  stops with `WENDKEEP_DELIVERY_IMPLEMENTATION_REQUIRED` and work returns to implementation.
 - Exit `0` means a successful query or transition; exit `1` means a policy/red-sensor block; exit
   `2` means invalid profile, session, flow, or arguments, with no partial mutation.
 
@@ -229,13 +243,22 @@ again with an explicit destination:
 npx wendkeep flow promote $flowId --change-slug another-slug
 ```
 
+Deliver an approved version without manufacturing another change:
+
+```bash
+npx wendkeep delivery start release-0-73-0 --source-change proportional-governance --allow git:merge --allow git:push --allow publish
+npx wendkeep delivery status release-0-73-0
+npx wendkeep delivery finish release-0-73-0 --target v0.73.0 --ci-url <run> --version 0.73.0 --npm-integrity <sha512> --release-url <release>
+```
+
 ## Expected result
 
 Changing profile neither creates a new session nor interrupts the Vault. In `OFF`, memory and
 lessons are still injected and Stop still persists the session/memory lifecycle, while automatic
 router, skill gate, change context/warn/nag/guard, and plan capture are inactive. Explicit commands
 remain available and run their own contracts. A completed FLOW leaves a durable, inspectable
-receipt; a promoted FLOW enters the normal change lifecycle.
+receipt; a promoted FLOW enters the normal change lifecycle. Completed delivery leaves a receipt
+without an ADR; compact GUIDE archives its result without artificial spec/design/ADR.
 
 ## Common errors and diagnosis
 
@@ -254,6 +277,8 @@ receipt; a promoted FLOW enters the normal change lifecycle.
   retry `flow finish` or `flow promote`; the idempotent marker prevents duplication.
 - Pre-existing dirt appeared in the diff: it must match the initial fingerprint and must never be
   silently attributed to the FLOW.
+- Delivery without `--allow`, with a dirty worktree, or with incomplete publish evidence: resume
+  the real implementation or provide the receipts; do not create a change only to publish.
 
 ## Next steps
 

package/docs/en/commands/sessions-and-import.md

@@ -26,11 +26,11 @@ and a vault bound to the correct project.
 ## Syntax
 
 ```bash
-npx wendkeep hook <name>
+npx --no-install wendkeep hook <name>
 npx wendkeep session list
 npx wendkeep session show <id>
 npx wendkeep session use <id>
-npx wendkeep hook session-backfill --session <id> [--write]
+npx --no-install wendkeep hook session-backfill --session <id> [--write]
 npx wendkeep import [options]
 ```
 
@@ -96,8 +96,8 @@ npx wendkeep import [options]
 ```bash
 npx wendkeep session list
 npx wendkeep session show 019abc-session-id
-npx wendkeep hook session-backfill --session 019abc-session-id
-npx wendkeep hook session-backfill --session 019abc-session-id --write
+npx --no-install wendkeep hook session-backfill --session 019abc-session-id
+npx --no-install wendkeep hook session-backfill --session 019abc-session-id --write
 npx wendkeep import --source codex --since 2026-07-01 --dry-run --json
 ```
 

package/docs/pt-BR/commands/changes-and-verification.md

@@ -25,7 +25,7 @@ Tenha o projeto inicializado, um vault saudável e `wendkeep.sensors.json` váli
 ## Sintaxe
 
 ```bash
-npx wendkeep change new <slug>
+npx wendkeep change new <slug> [--simple|--guide]
 npx wendkeep change status [slug]
 npx wendkeep spec effective --change <slug>
 npx wendkeep sensors list
@@ -35,8 +35,10 @@ npx wendkeep change archive <slug>
 
 ## Opções e códigos de saída
 
-- `wendkeep change new <slug> [--simple]` cria uma change; `--simple` só pula o design, não é nem
-  equivale a `FLOW` e preserva o lifecycle/ADR legado.
+- `wendkeep change new <slug> [--simple|--guide]` cria uma change. `--simple` só pula o design,
+  não equivale a `FLOW` e preserva o lifecycle/ADR legado. `--guide` cria o contrato GUIDE
+  compacto (objetivo, aceite, áreas, testes e resultado), sem design/spec/ADR automático quando
+  `contract_impact:none`.
 - `change use`, `list`, `show`, `status`, `diff`, `done` e `undone` inspecionam ou atualizam o
   trabalho sem arquivar.
 - `change continue <arquivada> <nova>` abre continuação sem herdar evidência antiga.
@@ -52,6 +54,7 @@ npx wendkeep change archive <slug>
 
 ```bash
 npx wendkeep change new login-tenant
+npx wendkeep change new ajuste-interno --guide
 npx wendkeep spec effective --change login-tenant
 npx wendkeep change done 1.1 --change login-tenant
 npx wendkeep verify --change login-tenant
@@ -67,8 +70,10 @@ npx wendkeep sensors add api-contracts "npm run test:contracts" --severity criti
 
 ## Resultado esperado
 
-A change arquivada move seu delta para o spec vivo, preserva proposta/design/tarefas/evidência e
-gera um ADR. O archive só passa com tarefas fechadas, sensores exigidos verdes e verdict atual.
+A change arquivada move seu delta para o spec vivo quando aplicável e preserva proposta,
+tarefas/evidência e design quando existente. GOVERN/ASSURE geram ADR; GUIDE compacta sem impacto
+de contrato não gera ADR automático. O archive só passa com tarefas fechadas, sensores exigidos
+verdes e verdict atual.
 
 ## Cerca de escopo para ferramentas