wendkeep 0.72.0 → 0.73.0

package/src/skills-seed.mjs

@@ -27,10 +27,15 @@ pode persistir \`profile use OFF\` explicitamente.
 
 - **FLOW:** ajuste local, reversível e de escopo fechado, sem contrato/spec, segurança,
   dependência, CI/release ou policy.
-- **GUIDE:** mudança compacta de comportamento que precisa de change/spec, sem revisão formal.
+- **GUIDE:** implementação compacta com change, sem spec/design/ADR automáticos quando contract_impact é none.
 - **GOVERN:** escolha conservadora em caso de dúvida ou risco e para superfícies sensíveis.
 - **ASSURE:** GOVERN quando confirmação explícita e handoff fazem parte do contrato.
 
+Classifique também o work kind: inspection, maintenance, implementation, delivery ou recovery.
+Risco operacional e impacto de contrato são independentes. Merge, push, tag e publish de código
+já aprovado usam delivery + ASSURE sem criar outra change; registre com delivery start e conclua
+com delivery finish para gerar receipt.
+
 O harness da LLM faz essa classificação semântica; o Wend Runtime valida e aplica a lease.
 Se não houver uma sessão causal identificada ou o comando falhar, não fabrique estado: use o
 perfil efetivo já injetado e trate \`GOVERN\` como fallback conservador quando ele for o padrão.
@@ -39,6 +44,7 @@ perfil efetivo já injetado e trate \`GOVERN\` como fallback conservador quando
 Antes de editar, leia o **perfil efetivo** injetado pelo WendKeep e siga somente sua rota:
 - \`OFF\`: não imponha processo Wend; a governança pertence ao **harness nativo da LLM**.
 - \`FLOW\`: inicie o microcontrato com \`wendkeep flow start\` antes de editar os paths permitidos.
+- \`delivery\`: inicie \`wendkeep delivery start\` antes das operações autorizadas; não crie change.
 - \`GUIDE\`, \`GOVERN\` ou \`ASSURE\`: não edite código antes de Propose / \`wendkeep change new\`.
 Este gate nunca transforma \`OFF\` ou \`FLOW\` silenciosamente em \`GOVERN\`.
 </HARD-GATE>
@@ -47,14 +53,16 @@ Este gate nunca transforma \`OFF\` ou \`FLOW\` silenciosamente em \`GOVERN\`.
 
 - **OFF — LLM nativa:** Wend Runtime desligado; esta skill devolve a execução ao harness nativo.
 - **FLOW — E → V:** \`flow start\` → implementar com wk-tdd → \`flow finish\`; sem change/ADR/verdict.
-- **GUIDE — P → E → V:** change compacta, sem revisão formal obrigatória.
+- **GUIDE — P → E → V:** change new --guide, sem design/spec/ADR automáticos quando não há impacto de contrato.
 - **GOVERN — P → R → E → V:** loop a2 atual, com design/revisão; é o padrão conservador.
 - **ASSURE — P → R → E → V → C:** GOVERN acrescido de confirmação e handoff explícitos.
 
 ## Passos para GUIDE, GOVERN e ASSURE
 
 1. **Explore** — entenda o problema antes de propor. Leia o código/contexto relevante.
-2. **Propose** — \`wendkeep change new <slug>\`. Isso cria \`08-Mudanças/<slug>/\` com:
+2. **Propose** — GUIDE usa \`wendkeep change new <slug> --guide\`; GOVERN/ASSURE usam
+   \`wendkeep change new <slug>\`. O GUIDE compacto exige objetivo, critérios de aceite, áreas
+   afetadas, testes e resultado. GOVERN/ASSURE criam \`08-Mudanças/<slug>/\` com:
    - \`proposta.md\` — *por quê* e *o que muda* (o WHAT).
    - \`design.md\` — a abordagem técnica.
    - \`tarefas.md\` — a lista de tarefas \`- [ ] N.N descrição\`.
@@ -83,7 +91,7 @@ Este gate nunca transforma \`OFF\` ou \`FLOW\` silenciosamente em \`GOVERN\`.
    \`[req:]\`) recebe verdict automático — pula este passe.
 6. **Archive** — \`wendkeep change archive <slug>\`. O *gate* exige sensores verdes **E**
    \`verdict.json\` cobrindo os \`[req:]\`. Passando, promove os deltas pro \`07-Specs\`,
-   move a change pro \`_arquivo\` e gera um ADR em \`04-Decisões/\`.
+   move a change pro \`_arquivo\`; GUIDE com contract_impact none não gera ADR automático.
 
 ## Regras
 
@@ -296,10 +304,15 @@ persist it explicitly through \`profile use OFF\`.
 
 - **FLOW:** a local, reversible, bounded adjustment with no contract/spec, security, dependency,
   CI/release, or policy impact.
-- **GUIDE:** a compact behavior change that needs a change/spec but no formal review.
+- **GUIDE:** compact implementation with a change, but no automatic spec/design/ADR when contract impact is none.
 - **GOVERN:** the conservative choice when uncertain or risky, and for sensitive surfaces.
 - **ASSURE:** GOVERN when explicit confirmation and handoff are part of the contract.
 
+Also classify work kind as inspection, maintenance, implementation, delivery, or recovery.
+Operational risk and contract impact are independent. Merge, push, tag, and publish for
+already-approved code use delivery + ASSURE without another change; use delivery start and
+delivery finish to produce a receipt.
+
 The LLM harness owns semantic classification; Wend Runtime validates and applies the lease. If
 there is no causally identified session or the command fails, do not fabricate state: use the
 already injected effective profile, with \`GOVERN\` as the conservative configured fallback.
@@ -308,6 +321,7 @@ already injected effective profile, with \`GOVERN\` as the conservative configur
 Before editing, read the injected **effective profile** and follow only its route:
 - \`OFF\`: impose no Wend process; governance belongs to the **native LLM harness**.
 - \`FLOW\`: start the microcontract with \`wendkeep flow start\` before editing allowed paths.
+- \`delivery\`: run \`wendkeep delivery start\` before authorized operations; do not create a change.
 - \`GUIDE\`, \`GOVERN\`, or \`ASSURE\`: do not edit code before Propose / \`wendkeep change new\`.
 This gate never silently turns \`OFF\` or \`FLOW\` into \`GOVERN\`.
 </HARD-GATE>
@@ -316,15 +330,16 @@ This gate never silently turns \`OFF\` or \`FLOW\` into \`GOVERN\`.
 
 - **OFF — native LLM:** Wend Runtime is disabled; this skill returns execution to the native harness.
 - **FLOW — E → V:** \`flow start\` → implement with wk-tdd → \`flow finish\`; no change/ADR/verdict.
-- **GUIDE — P → E → V:** a compact change with no mandatory formal review.
+- **GUIDE — P → E → V:** change new --guide, with no automatic design/spec/ADR when contract impact is none.
 - **GOVERN — P → R → E → V:** the current a2 loop with design/review; the conservative default.
 - **ASSURE — P → R → E → V → C:** GOVERN plus explicit confirmation and handoff.
 
 ## Steps for GUIDE, GOVERN, and ASSURE
 
 1. **Explore** — understand the problem before proposing.
-2. **Propose** — \`wendkeep change new <slug>\` scaffolds \`08-Changes/<slug>/\`
-   (proposta/design/tarefas + a \`specs/\` delta). The change becomes *current* through global
+2. **Propose** — GUIDE uses \`wendkeep change new <slug> --guide\`; GOVERN/ASSURE use
+   \`wendkeep change new <slug>\`. Compact GUIDE requires objective, acceptance criteria,
+   affected areas, tests, and result. The change becomes *current* through global
    \`.brain/CURRENT_CHANGE.md\`. Multiple changes may stay open; hooks and \`change list/status\`
    show every pending task, while commands without \`--change\` use only the current change.
    Before implementation, resolve \`spec_impact\`: \`required\` needs the capability listed in
@@ -341,7 +356,8 @@ This gate never silently turns \`OFF\` or \`FLOW\` into \`GOVERN\`.
 5. **Verify deep** — the **wk-verify** skill (fresh, author≠verifier) writes \`verdict.json\`.
    A trivial change (no \`[req:]\`) gets an auto verdict.
 6. **Archive** — \`wendkeep change archive <slug>\`. The gate needs green sensors AND a
-   verdict AND no open tasks. It promotes the delta into \`07-Specs\` and mints an ADR.
+   verdict AND no open tasks. It promotes the delta into \`07-Specs\`; compact GUIDE does not
+   mint an automatic ADR.
 
 ## Rules
 - Multiple changes may stay open. \`CURRENT_CHANGE.md\` marks one current change without hiding

package/src/sync-defs.mjs

@@ -66,7 +66,7 @@ The persistent profile is selected explicitly; missing or invalid configuration
 
 Before every implementation, the native LLM harness **MUST run the routing gate**:
 1. Inspect \`wendkeep profile status\`.
-2. Classify the request and choose FLOW, GUIDE, GOVERN, or ASSURE from its scope and risk.
+2. Classify work kind, contract impact, and operation risk independently; then choose the profile.
 3. Register the choice with
    \`wendkeep profile route <FLOW|GUIDE|GOVERN|ASSURE> --session <id> --reason <text>\`.
 4. Re-check \`wendkeep profile status\` and follow the effective profile before editing.
@@ -82,12 +82,15 @@ fallback when configuration is missing or invalid. The lease expires when the re
 Route work by the effective profile:
 - **OFF** — Wend Runtime is disabled and governance belongs to the native LLM harness; Keep Core stays active.
 - **FLOW** — Execute → Validate through \`wendkeep flow start/finish\`, without creating a change.
-- **GUIDE** — Plan → Execute → Validate through a compact change.
+- **GUIDE** — Plan → Execute → Validate through \`change new --guide\`; no automatic spec/design/ADR for contract_impact none.
 - **GOVERN** — the default a2 loop: \`wendkeep change new <slug>\` → review → implement tasks test-first
   (tag proof \`[sensor:id]\` and requirement \`[req:ID]\`) → \`wendkeep verify\` →
   \`wendkeep verify --deep\` + independent read-only verdict → \`wendkeep change archive\`.
 - **ASSURE** — GOVERN plus explicit confirmation and handoff.
 
+Delivery of already-approved behavior uses \`wendkeep delivery start/status/finish/abandon\` with
+ASSURE authorization and an append-only receipt. It does not create a new change, spec, or ADR.
+
 Inspect with \`wendkeep profile status\` / \`wendkeep change status\` /
 \`spec effective --change <slug>\` / \`sensors list\`. Author specs only in
 \`08-Mudanças/<slug>/specs/\`; \`07-Specs\` is generated and must not be edited directly.

package/src/sync.mjs

@@ -81,11 +81,11 @@ export async function runSync(argv) {
   // código é propagado sem ser tratado como falha da cadeia.
   step(3, 'doctor');
   const { runDoctor } = await import('./doctor.mjs');
-  const doctorCode = runDoctor(['--vault', vaultBase, '--project', projectPath]);
+  const doctorCode = runDoctor(['--vault', vaultBase, '--project', projectPath, '--scope', 'core']);
 
   // Nunca afirmar "tudo em dia": o doctor sai 0 mesmo tendo listado órfãos, seções
   // desatualizadas ou modelos sem preço — essas checagens não são fatais. Uma linha final
   // otimista contradiria o relatório logo acima dela.
-  process.stdout.write(`\nwendkeep sync: 3 passo(s) concluído(s)${doctorCode ? ' — doctor reportou erros' : ' — veja o relatório do doctor acima'}\n`);
+  process.stdout.write(`\nwendkeep sync: ${doctorCode ? 'falhou — Keep Core comprometido' : 'concluído — Keep Core saudável'}\n`);
   return doctorCode;
 }

package/src/taxonomy.mjs

@@ -131,7 +131,7 @@ export const RUNNABLE_HOOKS = [
 // the MOST agent-agnostic mechanism it supports; the Claude Code plugin entry
 // (extraKnownMarketplaces + enabledPlugins) is an additive bonus, never the base.
 //   - mcp:          .mcp.json server entry (works on any MCP-capable agent)
-//   - wendkeepHook: a wendkeep-authored hook (runs via `npx wendkeep hook`, any agent)
+//   - wendkeepHook: a wendkeep-authored hook (runs via `npx --no-install wendkeep hook`, any agent)
 //   - installer:    cross-agent install script (used on non-Claude agents)
 // marketplace/plugin shapes are verified against a real ~/.claude/settings.json.
 export const COMPANIONS = [

package/src/vault-readme.mjs

@@ -52,7 +52,7 @@ export function renderVaultReadme({ projectName, vaultPath, withMcp = true, loca
     const mcpIntro = withMcp ? ', and read/written by the **MCPVault** MCP server' : '';
     const access = [`- **Obsidian:** open this folder with "Open folder as vault" → \`${vaultPath}\``];
     if (withMcp) access.push('- **Agent (MCP):** the `wendkeep-vault` server (MCPVault) points at this vault (set in `.mcp.json`), giving the agent read/write on the notes.');
-    access.push('- **Hooks:** Codex and Claude Code call `npx wendkeep hook <name>`; the vault is discovered from the project-local `.wendkeep.json` binding and checked against `.brain/PROJECT.json`.');
+    access.push('- **Hooks:** Codex and Claude Code call `npx --no-install wendkeep hook <name>`; the vault is discovered from the project-local `.wendkeep.json` binding and checked against `.brain/PROJECT.json`.');
     return `# Obsidian vault — ${name}
 
 > Knowledge base of **${name}**, captured automatically by wendkeep from AI coding-agent
@@ -84,7 +84,7 @@ ${access.join('\n')}
   const mcpIntro = withMcp ? ', e lida/escrita pelo MCP server **MCPVault**' : '';
   const access = [`- **Obsidian:** abra esta pasta com "Open folder as vault" → \`${vaultPath}\``];
   if (withMcp) access.push('- **Agente (MCP):** o servidor `wendkeep-vault` (MCPVault) é apontado para este vault pelo `wendkeep init` (em `.mcp.json`), dando ao agente leitura/escrita das notas.');
-  access.push('- **Hooks:** Codex e Claude Code chamam `npx wendkeep hook <name>`; o vault é descoberto pelo vínculo local `.wendkeep.json` e validado contra `.brain/PROJECT.json`.');
+  access.push('- **Hooks:** Codex e Claude Code chamam `npx --no-install wendkeep hook <name>`; o vault é descoberto pelo vínculo local `.wendkeep.json` e validado contra `.brain/PROJECT.json`.');
   return `# Vault Obsidian — ${name}
 
 > Base de conhecimento de **${name}**, capturada automaticamente pelo wendkeep a

package/src/work-kind.mjs

@@ -0,0 +1,62 @@
+export const WORK_KINDS = Object.freeze([
+  'inspection',
+  'maintenance',
+  'implementation',
+  'delivery',
+  'recovery',
+]);
+
+export const CONTRACT_IMPACTS = Object.freeze(['none', 'internal', 'public']);
+
+function normalize(value, values, code, label) {
+  const normalized = String(value || '').trim().toLowerCase();
+  if (values.includes(normalized)) return normalized;
+  const error = new Error(`${label} inválido: ${String(value || '(vazio)')}. Use ${values.join(', ')}.`);
+  error.code = code;
+  throw error;
+}
+
+export function normalizeWorkKind(value) {
+  return normalize(value, WORK_KINDS, 'WENDKEEP_WORK_KIND_INVALID', 'work kind');
+}
+
+export function normalizeContractImpact(value) {
+  return normalize(value, CONTRACT_IMPACTS, 'WENDKEEP_CONTRACT_IMPACT_INVALID', 'contract impact');
+}
+
+export function createWorkRoute({
+  workKind,
+  profile = '',
+  contractImpact = 'none',
+  operationRisk = [],
+  sourceChange = '',
+  sourceCommit = '',
+} = {}) {
+  const kind = normalizeWorkKind(workKind);
+  const impact = normalizeContractImpact(contractImpact);
+  const risks = [...new Set((Array.isArray(operationRisk) ? operationRisk : [operationRisk])
+    .map((item) => String(item || '').trim()).filter(Boolean))];
+  if (kind === 'delivery' && impact !== 'none') {
+    const error = new Error('delivery só aceita contract_impact none; alteração de contrato exige implementation.');
+    error.code = 'WENDKEEP_DELIVERY_CONTRACT_IMPACT';
+    throw error;
+  }
+  return {
+    work_kind: kind,
+    profile: String(profile || (kind === 'delivery' ? 'ASSURE' : '')).trim().toUpperCase(),
+    contract_impact: impact,
+    operation_risk: risks,
+    ...(sourceChange ? { source_change: String(sourceChange) } : {}),
+    ...(sourceCommit ? { source_commit: String(sourceCommit) } : {}),
+  };
+}
+
+export function classifyWorkRequest(prompt) {
+  const text = String(prompt || '').toLowerCase();
+  if (/acompanhar|acompanhe|status|actions|diff|inspecion/.test(text)) return 'inspection';
+  if (/token\s+(?:expir|venc)|credencial.*(?:expir|venc)/.test(text)) return 'recovery';
+  if (/corrig|corrij|alter|implementar|package\.json.*errad|workflow.*(?:errad|falh)/.test(text)) return 'implementation';
+  if (/merge|push|public|publish|tag|release/.test(text)) return 'delivery';
+  if (/texto|formata|manuten/.test(text)) return 'maintenance';
+  return 'implementation';
+}