wendkeep 0.72.1 → 0.73.0

package/src/delivery.mjs

@@ -0,0 +1,303 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { basename, join, resolve } from 'node:path';
+import {
+  assertVaultPathSafe, mkdirVaultPath, writeVaultFileSync,
+} from '../hooks/vault-path-safety.mjs';
+import { resolveProjectVault } from './project-vault.mjs';
+import { createWorkRoute } from './work-kind.mjs';
+
+export const DELIVERY_HELP = `wendkeep delivery <subcommand>
+
+  start [id] --allow <capability> [--source-change <slug>] [--source-commit <sha>]
+  status [id]
+  finish [id] [--target <ref>] [--ci-url <url>] [--version <x.y.z>]
+              [--npm-integrity <sha512-...>] [--release-url <url>]
+  abandon [id] --reason <text>
+
+Common options: --project <path> --vault <path> --json
+Delivery authorizes operational risk and creates an append-only receipt. It never creates a change,
+spec, or ADR. If code/config must change, abandon or pause delivery and resume an implementation.
+`;
+
+export const DELIVERY_CAPABILITIES = Object.freeze([
+  'git:merge', 'git:pull', 'git:push', 'git:tag', 'publish',
+]);
+
+const VALUE_OPTIONS = new Set([
+  '--project', '--vault', '--allow', '--source-change', '--source-commit', '--target',
+  '--ci-url', '--version', '--npm-integrity', '--release-url', '--reason',
+]);
+
+function parseArgv(argv) {
+  const values = new Map();
+  const positionals = [];
+  let json = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const item = argv[index];
+    if (item === '--json') { json = true; continue; }
+    if (item.startsWith('--')) {
+      const eq = item.indexOf('=');
+      const name = eq > 0 ? item.slice(0, eq) : item;
+      if (!VALUE_OPTIONS.has(name)) throw new Error(`opção desconhecida: ${name}`);
+      const value = eq > 0 ? item.slice(eq + 1) : argv[++index];
+      if (!value || value.startsWith('--')) throw new Error(`${name} requer um valor`);
+      const list = values.get(name) || [];
+      list.push(value);
+      values.set(name, list);
+      continue;
+    }
+    positionals.push(item);
+  }
+  return {
+    json,
+    positionals,
+    value: (name) => values.get(name)?.at(-1) || '',
+    all: (name) => values.get(name) || [],
+  };
+}
+
+function git(projectRoot, args, optional = false) {
+  try {
+    return execFileSync('git', args, {
+      cwd: projectRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim();
+  } catch (error) {
+    if (optional) return '';
+    throw new Error(`git ${args.join(' ')} falhou: ${String(error.stderr || error.message).trim()}`);
+  }
+}
+
+function deliveryPaths(vaultBase, id = '') {
+  const runtime = join(vaultBase, '.brain', 'runtime');
+  const deliveries = join(runtime, 'deliveries');
+  return {
+    runtime,
+    deliveries,
+    pointer: join(runtime, 'CURRENT_DELIVERY'),
+    receipts: join(runtime, 'delivery-receipts.jsonl'),
+    state: id ? join(deliveries, `${id}.json`) : '',
+  };
+}
+
+function safeId(value) {
+  const id = String(value || '').trim();
+  if (!/^[a-z0-9][a-z0-9._-]{1,100}$/i.test(id)) throw new Error('id de delivery inválido');
+  return id;
+}
+
+function generatedId(now = new Date()) {
+  return `delivery-${now.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}Z$/, 'Z').toLowerCase()}`;
+}
+
+function readPointer(vaultBase) {
+  const { pointer } = deliveryPaths(vaultBase);
+  try { return safeId(readFileSync(pointer, 'utf8').trim()); } catch { return ''; }
+}
+
+export function activeDelivery(vaultBase) {
+  const id = readPointer(vaultBase);
+  if (!id) return null;
+  try {
+    const state = readState(vaultBase, id);
+    return state.state === 'active' ? state : null;
+  } catch {
+    return null;
+  }
+}
+
+function readState(vaultBase, id) {
+  const path = deliveryPaths(vaultBase, id).state;
+  const checked = assertVaultPathSafe(vaultBase, path, {
+    allowMissing: false, expectedType: 'file', label: `delivery ${id}`,
+  });
+  return JSON.parse(readFileSync(checked.target, 'utf8'));
+}
+
+function writeState(vaultBase, state) {
+  const paths = deliveryPaths(vaultBase, state.id);
+  mkdirVaultPath(vaultBase, paths.runtime, { label: 'runtime de delivery' });
+  mkdirVaultPath(vaultBase, paths.deliveries, { label: 'estados de delivery' });
+  writeVaultFileSync(vaultBase, paths.state, `${JSON.stringify(state, null, 2)}\n`, 'utf8', {
+    label: `delivery ${state.id}`,
+  });
+}
+
+function setPointer(vaultBase, id = '') {
+  const paths = deliveryPaths(vaultBase);
+  mkdirVaultPath(vaultBase, paths.runtime, { label: 'runtime de delivery' });
+  writeVaultFileSync(vaultBase, paths.pointer, id ? `${id}\n` : '', 'utf8', {
+    label: 'ponteiro de delivery',
+  });
+}
+
+function appendReceipt(vaultBase, receipt) {
+  const paths = deliveryPaths(vaultBase);
+  mkdirVaultPath(vaultBase, paths.runtime, { label: 'runtime de delivery' });
+  let previous = '';
+  if (existsSync(paths.receipts)) {
+    const checked = assertVaultPathSafe(vaultBase, paths.receipts, {
+      allowMissing: false, expectedType: 'file', label: 'ledger de receipts de delivery',
+    });
+    previous = readFileSync(checked.target, 'utf8');
+  }
+  writeVaultFileSync(vaultBase, paths.receipts, `${previous}${JSON.stringify(receipt)}\n`, 'utf8', {
+    label: 'ledger de receipts de delivery',
+  });
+}
+
+function context(parsed) {
+  const projectRoot = resolve(parsed.value('--project') || process.cwd());
+  const resolved = resolveProjectVault({
+    startDir: projectRoot,
+    explicitVault: parsed.value('--vault'),
+  });
+  const repoRoot = git(projectRoot, ['rev-parse', '--show-toplevel']);
+  return { projectRoot, repoRoot, vaultBase: resolved.base };
+}
+
+function currentId(parsed, vaultBase) {
+  return safeId(parsed.positionals[1] || readPointer(vaultBase));
+}
+
+function ensureClean(repoRoot) {
+  const dirty = git(repoRoot, ['status', '--porcelain']);
+  if (dirty) {
+    const error = new Error('delivery requer working tree limpa; alterações de código/config exigem implementation.');
+    error.code = 'WENDKEEP_DELIVERY_IMPLEMENTATION_REQUIRED';
+    throw error;
+  }
+}
+
+export function startDelivery({ vaultBase, repoRoot, id, capabilities, sourceChange = '', sourceCommit = '', now = new Date() }) {
+  ensureClean(repoRoot);
+  const deliveryId = safeId(id || generatedId(now));
+  const paths = deliveryPaths(vaultBase, deliveryId);
+  if (existsSync(paths.state)) throw new Error(`delivery já existe: ${deliveryId}`);
+  const commit = sourceCommit || git(repoRoot, ['rev-parse', 'HEAD']);
+  git(repoRoot, ['cat-file', '-e', `${commit}^{commit}`]);
+  const requestedCapabilities = [...new Set((capabilities || []).map((item) => String(item).trim()).filter(Boolean))];
+  const invalidCapabilities = requestedCapabilities.filter((item) => !DELIVERY_CAPABILITIES.includes(item));
+  if (invalidCapabilities.length) {
+    throw new Error(`capability inválida: ${invalidCapabilities.join(', ')}. Use ${DELIVERY_CAPABILITIES.join(', ')}.`);
+  }
+  const route = createWorkRoute({
+    workKind: 'delivery', profile: 'ASSURE', contractImpact: 'none',
+    operationRisk: requestedCapabilities, sourceChange, sourceCommit: commit,
+  });
+  if (!route.operation_risk.length) throw new Error('delivery start requer ao menos um --allow <capability>');
+  const state = {
+    schema_version: 1,
+    id: deliveryId,
+    state: 'active',
+    route,
+    repository: repoRoot,
+    worktree: repoRoot,
+    branch: git(repoRoot, ['branch', '--show-current'], true),
+    source_commit: commit,
+    started_at: now.toISOString(),
+  };
+  writeState(vaultBase, state);
+  setPointer(vaultBase, deliveryId);
+  return state;
+}
+
+export function finishDelivery({ vaultBase, repoRoot, id, target = 'HEAD', evidence = {}, now = new Date() }) {
+  ensureClean(repoRoot);
+  const state = readState(vaultBase, safeId(id));
+  if (state.state !== 'active') throw new Error(`delivery ${id} não está ativa`);
+  const targetCommit = git(repoRoot, ['rev-parse', `${target}^{commit}`]);
+  git(repoRoot, ['merge-base', '--is-ancestor', state.source_commit, targetCommit]);
+  const capabilities = state.route?.operation_risk || [];
+  if (capabilities.includes('git:tag') || capabilities.includes('publish')) {
+    if (!evidence.version) throw new Error('delivery com tag/publicação requer --version');
+    const pkg = JSON.parse(readFileSync(join(repoRoot, 'package.json'), 'utf8'));
+    if (pkg.version !== evidence.version) throw new Error(`package.json ${pkg.version} diverge de ${evidence.version}`);
+    const tagCommit = git(repoRoot, ['rev-list', '-n', '1', `refs/tags/v${evidence.version}`]);
+    if (tagCommit !== targetCommit) throw new Error(`v${evidence.version} não aponta para o target comprovado`);
+  }
+  if (capabilities.includes('publish')) {
+    for (const [key, label] of [
+      ['ci_url', '--ci-url'], ['npm_integrity', '--npm-integrity'], ['release_url', '--release-url'],
+    ]) if (!evidence[key]) throw new Error(`delivery com publish requer ${label}`);
+  }
+  const receipt = {
+    schema_version: 1,
+    delivery_id: state.id,
+    outcome: 'completed',
+    work_kind: 'delivery',
+    source_change: state.route.source_change || '',
+    source_commit: state.source_commit,
+    target,
+    target_commit: targetCommit,
+    capabilities,
+    evidence,
+    finished_at: now.toISOString(),
+  };
+  appendReceipt(vaultBase, receipt);
+  writeState(vaultBase, { ...state, state: 'completed', target, target_commit: targetCommit, finished_at: receipt.finished_at, receipt });
+  if (readPointer(vaultBase) === state.id) setPointer(vaultBase);
+  return receipt;
+}
+
+export function abandonDelivery({ vaultBase, id, reason, now = new Date() }) {
+  const state = readState(vaultBase, safeId(id));
+  if (state.state !== 'active') throw new Error(`delivery ${id} não está ativa`);
+  if (!String(reason || '').trim()) throw new Error('delivery abandon requer --reason <text>');
+  const receipt = {
+    schema_version: 1, delivery_id: state.id, outcome: 'abandoned',
+    reason: String(reason).trim(), abandoned_at: now.toISOString(),
+  };
+  appendReceipt(vaultBase, receipt);
+  writeState(vaultBase, { ...state, state: 'abandoned', reason: receipt.reason, abandoned_at: receipt.abandoned_at });
+  if (readPointer(vaultBase) === state.id) setPointer(vaultBase);
+  return receipt;
+}
+
+function emit(payload, json) {
+  if (json) process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+  else process.stdout.write(`${payload.id || payload.delivery_id}: ${payload.state || payload.outcome}\n`);
+}
+
+export function runDelivery(argv = []) {
+  try {
+    const parsed = parseArgv(argv);
+    const sub = parsed.positionals[0] || 'status';
+    const { repoRoot, vaultBase } = context(parsed);
+    if (sub === 'start') {
+      const state = startDelivery({
+        vaultBase, repoRoot, id: parsed.positionals[1], capabilities: parsed.all('--allow'),
+        sourceChange: parsed.value('--source-change'), sourceCommit: parsed.value('--source-commit'),
+      });
+      emit(state, parsed.json);
+      return 0;
+    }
+    if (sub === 'status') {
+      const state = readState(vaultBase, currentId(parsed, vaultBase));
+      emit(state, parsed.json);
+      return 0;
+    }
+    if (sub === 'finish') {
+      const receipt = finishDelivery({
+        vaultBase, repoRoot, id: currentId(parsed, vaultBase), target: parsed.value('--target') || 'HEAD',
+        evidence: {
+          ci_url: parsed.value('--ci-url'), version: parsed.value('--version'),
+          npm_integrity: parsed.value('--npm-integrity'), release_url: parsed.value('--release-url'),
+        },
+      });
+      emit(receipt, parsed.json);
+      return 0;
+    }
+    if (sub === 'abandon') {
+      const receipt = abandonDelivery({
+        vaultBase, id: currentId(parsed, vaultBase), reason: parsed.value('--reason'),
+      });
+      emit(receipt, parsed.json);
+      return 0;
+    }
+    throw new Error(`subcomando desconhecido: ${sub}`);
+  } catch (error) {
+    process.stderr.write(`wendkeep delivery: ${error.message}\n`);
+    return 2;
+  }
+}

package/src/doctor.mjs

@@ -7,7 +7,7 @@ import { checkSyncDefs } from './sync-defs.mjs';
 import { resolveProjectVault } from './project-vault.mjs';
 
 const healthStatusLabel = (status) => ({
-  healthy: 'saudável', warning: 'atenção', blocked: 'bloqueada', legacy: 'legado',
+  healthy: 'saudável', warning: 'atenção', degraded: 'degradada', blocked: 'bloqueada', legacy: 'legado',
 }[status] || status || 'desconhecido');
 
 const metricValue = (value) => value === null || value === undefined || value === '' ? 'n/a' : value;
@@ -55,6 +55,8 @@ export function runDoctor(argv) {
   let vault;
   let project;
   let session = '';
+  let scope = 'all';
+  let strict = false;
   for (let i = 0; i < argv.length; i += 1) {
     const a = argv[i];
     if (a === '--vault') vault = argv[++i];
@@ -63,6 +65,13 @@ export function runDoctor(argv) {
     else if (a.startsWith('--project=')) project = a.slice(10);
     else if (a === '--session') session = argv[++i] || '';
     else if (a.startsWith('--session=')) session = a.slice(10);
+    else if (a === '--scope') scope = argv[++i] || '';
+    else if (a.startsWith('--scope=')) scope = a.slice(8);
+    else if (a === '--strict') strict = true;
+  }
+  if (!['all', 'core', 'runtime'].includes(scope)) {
+    process.stderr.write('wendkeep doctor: --scope deve ser all, core ou runtime\n');
+    return 2;
   }
 
   const projectRoot = resolve(project || process.cwd());
@@ -97,18 +106,29 @@ export function runDoctor(argv) {
       memoryStatus: 'blocked',
     };
   }
-  process.stdout.write(`${renderVaultHealthLines(health).join('\n')}\n`);
+  if (scope !== 'runtime') process.stdout.write(`${renderVaultHealthLines(health).join('\n')}\n`);
   const healthStatus = health.ok ? 0 : 1;
 
+  if (scope === 'core') {
+    const strictDebt = strict && (
+      (health.warnings || []).length > 0
+      || !['healthy'].includes(health.memoryStatus)
+    );
+    process.stdout.write(`\n[core] ${healthStatus ? 'erro estrutural' : health.memoryStatus === 'degraded' ? 'saudável com memória degradada' : 'saudável'}\n`);
+    return healthStatus || strictDebt ? 1 : 0;
+  }
+
   // 2. Harness integrity (Wave B).
-  const { errors, warnings } = checkHarness(vaultBase, projectRoot);
+  const { errors, warnings, attention, repairable } = checkHarness(vaultBase, projectRoot);
   const defs = checkSyncDefs(vaultBase, projectRoot);
   if (!defs.ok) {
-    warnings.push(...defs.issues.map((issue) => `defs: ${issue}`));
-    warnings.push('defs stale — rode `wendkeep sync-defs --reseed` e reinicie Claude Code/Codex');
+    repairable.push(...defs.issues.map((issue) => `defs: ${issue}`));
+    repairable.push('defs stale — rode `wendkeep sync-defs --reseed` e reinicie Claude Code/Codex');
   }
-  process.stdout.write(`\n[harness] ${errors.length} erro(s), ${warnings.length} aviso(s)\n`);
+  process.stdout.write(`\n[runtime] ${errors.length} erro(s) estrutural(is), ${attention.length} atenção(ões), ${repairable.length} reparável(is), ${warnings.length} aviso(s)\n`);
   for (const e of errors) process.stdout.write(`  ✗ ${e}\n`);
+  for (const item of attention) process.stdout.write(`  ! ${item}\n`);
+  for (const item of repairable) process.stdout.write(`  → ${item}\n`);
   for (const w of warnings) process.stdout.write(`  ! ${w}\n`);
 
   // 3. Link/graph health — órfãos que o grafo do Obsidian mostraria, com o comando de reparo.
@@ -125,13 +145,16 @@ export function runDoctor(argv) {
   process.stdout.write(`\n${renderStackedFrontmatterLines(vaultBase, stacked).join('\n')}\n`);
 
   // 3c. Modelo fora de pricing.json fecha a sessão com custo zero, sem erro — só aparece aqui.
-  process.stdout.write(`\n${renderUnpricedModelLines(checkUnpricedModels(vaultBase)).join('\n')}\n`);
+  const unpriced = checkUnpricedModels(vaultBase);
+  process.stdout.write(`\n${renderUnpricedModelLines(unpriced).join('\n')}\n`);
 
   // 3d. Seções derivadas do corpo que ficaram para trás do Encerramento (notas pré-0.53.0).
-  process.stdout.write(`\n${renderStaleDerivedSectionLines(checkStaleDerivedSections(vaultBase)).join('\n')}\n`);
+  const staleDerived = checkStaleDerivedSections(vaultBase);
+  process.stdout.write(`\n${renderStaleDerivedSectionLines(staleDerived).join('\n')}\n`);
 
   // 3e. Observabilidade materializada: schema vigente não basta sem frontier + manifest frescos.
-  process.stdout.write(`\n${renderSessionObservabilityLines(checkSessionObservability(vaultBase)).join('\n')}\n`);
+  const observability = checkSessionObservability(vaultBase);
+  process.stdout.write(`\n${renderSessionObservabilityLines(observability).join('\n')}\n`);
 
   // 4. Sessão: não mente "inativa" quando há atividade recente (workflow/subagente em background).
   const act = checkSessionActivity(vaultBase);
@@ -146,5 +169,19 @@ export function runDoctor(argv) {
 
   // Devolve o código em vez de sair: `wendkeep sync` encadeia este comando, e um
   // process.exit aqui mataria a cadeia. Quem faz o exit é o bin.
-  return healthStatus !== 0 || errors.length ? 1 : 0;
+  const strictDebt = strict && (
+    (scope !== 'runtime' && (health.warnings || []).length)
+    || (scope !== 'runtime' && health.memoryStatus !== 'healthy')
+    || attention.length
+    || repairable.length
+    || warnings.length
+    || links.derivedOrphans
+    || links.artifactOrphans
+    || links.graphColors === false
+    || stacked.count
+    || (unpriced.models || unpriced.items || []).length
+    || (staleDerived.notes || staleDerived.items || []).length
+    || !observability.ok
+  );
+  return (scope !== 'runtime' && healthStatus !== 0) || errors.length || strictDebt ? 1 : 0;
 }

package/src/release-provenance.mjs

@@ -1,3 +1,8 @@
+import { execFileSync } from 'node:child_process';
+import { cpSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, join } from 'node:path';
+
 const DEPENDENCY_FIELDS = Object.freeze([
   'dependencies',
   'devDependencies',
@@ -5,6 +10,48 @@ const DEPENDENCY_FIELDS = Object.freeze([
   'peerDependencies',
 ]);
 
+export function parsePackIntegrity(raw) {
+  const text = String(raw || '');
+  const start = text.indexOf('[');
+  const end = text.lastIndexOf(']');
+  if (start < 0 || end < start) return '';
+  try {
+    return String(JSON.parse(text.slice(start, end + 1))[0]?.integrity || '');
+  } catch {
+    return '';
+  }
+}
+
+export function packIntegrityInIsolatedCopy(root, { execute = execFileSync } = {}) {
+  const tempRoot = mkdtempSync(join(tmpdir(), 'wendkeep-release-pack-'));
+  const packageRoot = join(tempRoot, 'package');
+  const ignored = new Set(['.git', 'node_modules']);
+  try {
+    const binding = JSON.parse(readFileSync(join(root, '.wendkeep.json'), 'utf8'));
+    const vault = String(binding.vault || '');
+    if (vault && !vault.includes('/') && !vault.includes('\\')) ignored.add(vault);
+  } catch { /* unbound package: nothing else to exclude */ }
+  try {
+    cpSync(root, packageRoot, {
+      recursive: true,
+      filter(source) {
+        if (source === root) return true;
+        const relativeName = basename(source);
+        return !ignored.has(relativeName);
+      },
+    });
+    const command = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+    const raw = execute(command, ['pack', '--dry-run', '--json'], {
+      cwd: packageRoot,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return parsePackIntegrity(raw);
+  } finally {
+    rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
 export function packageHasSelfDependency(pkg = {}) {
   const name = String(pkg.name || '');
   if (!name) return false;

package/src/skills-seed.mjs

@@ -27,10 +27,15 @@ pode persistir \`profile use OFF\` explicitamente.
 
 - **FLOW:** ajuste local, reversível e de escopo fechado, sem contrato/spec, segurança,
   dependência, CI/release ou policy.
-- **GUIDE:** mudança compacta de comportamento que precisa de change/spec, sem revisão formal.
+- **GUIDE:** implementação compacta com change, sem spec/design/ADR automáticos quando contract_impact é none.
 - **GOVERN:** escolha conservadora em caso de dúvida ou risco e para superfícies sensíveis.
 - **ASSURE:** GOVERN quando confirmação explícita e handoff fazem parte do contrato.
 
+Classifique também o work kind: inspection, maintenance, implementation, delivery ou recovery.
+Risco operacional e impacto de contrato são independentes. Merge, push, tag e publish de código
+já aprovado usam delivery + ASSURE sem criar outra change; registre com delivery start e conclua
+com delivery finish para gerar receipt.
+
 O harness da LLM faz essa classificação semântica; o Wend Runtime valida e aplica a lease.
 Se não houver uma sessão causal identificada ou o comando falhar, não fabrique estado: use o
 perfil efetivo já injetado e trate \`GOVERN\` como fallback conservador quando ele for o padrão.
@@ -39,6 +44,7 @@ perfil efetivo já injetado e trate \`GOVERN\` como fallback conservador quando
 Antes de editar, leia o **perfil efetivo** injetado pelo WendKeep e siga somente sua rota:
 - \`OFF\`: não imponha processo Wend; a governança pertence ao **harness nativo da LLM**.
 - \`FLOW\`: inicie o microcontrato com \`wendkeep flow start\` antes de editar os paths permitidos.
+- \`delivery\`: inicie \`wendkeep delivery start\` antes das operações autorizadas; não crie change.
 - \`GUIDE\`, \`GOVERN\` ou \`ASSURE\`: não edite código antes de Propose / \`wendkeep change new\`.
 Este gate nunca transforma \`OFF\` ou \`FLOW\` silenciosamente em \`GOVERN\`.
 </HARD-GATE>
@@ -47,14 +53,16 @@ Este gate nunca transforma \`OFF\` ou \`FLOW\` silenciosamente em \`GOVERN\`.
 
 - **OFF — LLM nativa:** Wend Runtime desligado; esta skill devolve a execução ao harness nativo.
 - **FLOW — E → V:** \`flow start\` → implementar com wk-tdd → \`flow finish\`; sem change/ADR/verdict.
-- **GUIDE — P → E → V:** change compacta, sem revisão formal obrigatória.
+- **GUIDE — P → E → V:** change new --guide, sem design/spec/ADR automáticos quando não há impacto de contrato.
 - **GOVERN — P → R → E → V:** loop a2 atual, com design/revisão; é o padrão conservador.
 - **ASSURE — P → R → E → V → C:** GOVERN acrescido de confirmação e handoff explícitos.
 
 ## Passos para GUIDE, GOVERN e ASSURE
 
 1. **Explore** — entenda o problema antes de propor. Leia o código/contexto relevante.
-2. **Propose** — \`wendkeep change new <slug>\`. Isso cria \`08-Mudanças/<slug>/\` com:
+2. **Propose** — GUIDE usa \`wendkeep change new <slug> --guide\`; GOVERN/ASSURE usam
+   \`wendkeep change new <slug>\`. O GUIDE compacto exige objetivo, critérios de aceite, áreas
+   afetadas, testes e resultado. GOVERN/ASSURE criam \`08-Mudanças/<slug>/\` com:
    - \`proposta.md\` — *por quê* e *o que muda* (o WHAT).
    - \`design.md\` — a abordagem técnica.
    - \`tarefas.md\` — a lista de tarefas \`- [ ] N.N descrição\`.
@@ -83,7 +91,7 @@ Este gate nunca transforma \`OFF\` ou \`FLOW\` silenciosamente em \`GOVERN\`.
    \`[req:]\`) recebe verdict automático — pula este passe.
 6. **Archive** — \`wendkeep change archive <slug>\`. O *gate* exige sensores verdes **E**
    \`verdict.json\` cobrindo os \`[req:]\`. Passando, promove os deltas pro \`07-Specs\`,
-   move a change pro \`_arquivo\` e gera um ADR em \`04-Decisões/\`.
+   move a change pro \`_arquivo\`; GUIDE com contract_impact none não gera ADR automático.
 
 ## Regras
 
@@ -296,10 +304,15 @@ persist it explicitly through \`profile use OFF\`.
 
 - **FLOW:** a local, reversible, bounded adjustment with no contract/spec, security, dependency,
   CI/release, or policy impact.
-- **GUIDE:** a compact behavior change that needs a change/spec but no formal review.
+- **GUIDE:** compact implementation with a change, but no automatic spec/design/ADR when contract impact is none.
 - **GOVERN:** the conservative choice when uncertain or risky, and for sensitive surfaces.
 - **ASSURE:** GOVERN when explicit confirmation and handoff are part of the contract.
 
+Also classify work kind as inspection, maintenance, implementation, delivery, or recovery.
+Operational risk and contract impact are independent. Merge, push, tag, and publish for
+already-approved code use delivery + ASSURE without another change; use delivery start and
+delivery finish to produce a receipt.
+
 The LLM harness owns semantic classification; Wend Runtime validates and applies the lease. If
 there is no causally identified session or the command fails, do not fabricate state: use the
 already injected effective profile, with \`GOVERN\` as the conservative configured fallback.
@@ -308,6 +321,7 @@ already injected effective profile, with \`GOVERN\` as the conservative configur
 Before editing, read the injected **effective profile** and follow only its route:
 - \`OFF\`: impose no Wend process; governance belongs to the **native LLM harness**.
 - \`FLOW\`: start the microcontract with \`wendkeep flow start\` before editing allowed paths.
+- \`delivery\`: run \`wendkeep delivery start\` before authorized operations; do not create a change.
 - \`GUIDE\`, \`GOVERN\`, or \`ASSURE\`: do not edit code before Propose / \`wendkeep change new\`.
 This gate never silently turns \`OFF\` or \`FLOW\` into \`GOVERN\`.
 </HARD-GATE>
@@ -316,15 +330,16 @@ This gate never silently turns \`OFF\` or \`FLOW\` into \`GOVERN\`.
 
 - **OFF — native LLM:** Wend Runtime is disabled; this skill returns execution to the native harness.
 - **FLOW — E → V:** \`flow start\` → implement with wk-tdd → \`flow finish\`; no change/ADR/verdict.
-- **GUIDE — P → E → V:** a compact change with no mandatory formal review.
+- **GUIDE — P → E → V:** change new --guide, with no automatic design/spec/ADR when contract impact is none.
 - **GOVERN — P → R → E → V:** the current a2 loop with design/review; the conservative default.
 - **ASSURE — P → R → E → V → C:** GOVERN plus explicit confirmation and handoff.
 
 ## Steps for GUIDE, GOVERN, and ASSURE
 
 1. **Explore** — understand the problem before proposing.
-2. **Propose** — \`wendkeep change new <slug>\` scaffolds \`08-Changes/<slug>/\`
-   (proposta/design/tarefas + a \`specs/\` delta). The change becomes *current* through global
+2. **Propose** — GUIDE uses \`wendkeep change new <slug> --guide\`; GOVERN/ASSURE use
+   \`wendkeep change new <slug>\`. Compact GUIDE requires objective, acceptance criteria,
+   affected areas, tests, and result. The change becomes *current* through global
    \`.brain/CURRENT_CHANGE.md\`. Multiple changes may stay open; hooks and \`change list/status\`
    show every pending task, while commands without \`--change\` use only the current change.
    Before implementation, resolve \`spec_impact\`: \`required\` needs the capability listed in
@@ -341,7 +356,8 @@ This gate never silently turns \`OFF\` or \`FLOW\` into \`GOVERN\`.
 5. **Verify deep** — the **wk-verify** skill (fresh, author≠verifier) writes \`verdict.json\`.
    A trivial change (no \`[req:]\`) gets an auto verdict.
 6. **Archive** — \`wendkeep change archive <slug>\`. The gate needs green sensors AND a
-   verdict AND no open tasks. It promotes the delta into \`07-Specs\` and mints an ADR.
+   verdict AND no open tasks. It promotes the delta into \`07-Specs\`; compact GUIDE does not
+   mint an automatic ADR.
 
 ## Rules
 - Multiple changes may stay open. \`CURRENT_CHANGE.md\` marks one current change without hiding

package/src/sync-defs.mjs

@@ -66,7 +66,7 @@ The persistent profile is selected explicitly; missing or invalid configuration
 
 Before every implementation, the native LLM harness **MUST run the routing gate**:
 1. Inspect \`wendkeep profile status\`.
-2. Classify the request and choose FLOW, GUIDE, GOVERN, or ASSURE from its scope and risk.
+2. Classify work kind, contract impact, and operation risk independently; then choose the profile.
 3. Register the choice with
    \`wendkeep profile route <FLOW|GUIDE|GOVERN|ASSURE> --session <id> --reason <text>\`.
 4. Re-check \`wendkeep profile status\` and follow the effective profile before editing.
@@ -82,12 +82,15 @@ fallback when configuration is missing or invalid. The lease expires when the re
 Route work by the effective profile:
 - **OFF** — Wend Runtime is disabled and governance belongs to the native LLM harness; Keep Core stays active.
 - **FLOW** — Execute → Validate through \`wendkeep flow start/finish\`, without creating a change.
-- **GUIDE** — Plan → Execute → Validate through a compact change.
+- **GUIDE** — Plan → Execute → Validate through \`change new --guide\`; no automatic spec/design/ADR for contract_impact none.
 - **GOVERN** — the default a2 loop: \`wendkeep change new <slug>\` → review → implement tasks test-first
   (tag proof \`[sensor:id]\` and requirement \`[req:ID]\`) → \`wendkeep verify\` →
   \`wendkeep verify --deep\` + independent read-only verdict → \`wendkeep change archive\`.
 - **ASSURE** — GOVERN plus explicit confirmation and handoff.
 
+Delivery of already-approved behavior uses \`wendkeep delivery start/status/finish/abandon\` with
+ASSURE authorization and an append-only receipt. It does not create a new change, spec, or ADR.
+
 Inspect with \`wendkeep profile status\` / \`wendkeep change status\` /
 \`spec effective --change <slug>\` / \`sensors list\`. Author specs only in
 \`08-Mudanças/<slug>/specs/\`; \`07-Specs\` is generated and must not be edited directly.

package/src/sync.mjs

@@ -81,11 +81,11 @@ export async function runSync(argv) {
   // código é propagado sem ser tratado como falha da cadeia.
   step(3, 'doctor');
   const { runDoctor } = await import('./doctor.mjs');
-  const doctorCode = runDoctor(['--vault', vaultBase, '--project', projectPath]);
+  const doctorCode = runDoctor(['--vault', vaultBase, '--project', projectPath, '--scope', 'core']);
 
   // Nunca afirmar "tudo em dia": o doctor sai 0 mesmo tendo listado órfãos, seções
   // desatualizadas ou modelos sem preço — essas checagens não são fatais. Uma linha final
   // otimista contradiria o relatório logo acima dela.
-  process.stdout.write(`\nwendkeep sync: 3 passo(s) concluído(s)${doctorCode ? ' — doctor reportou erros' : ' — veja o relatório do doctor acima'}\n`);
+  process.stdout.write(`\nwendkeep sync: ${doctorCode ? 'falhou — Keep Core comprometido' : 'concluído — Keep Core saudável'}\n`);
   return doctorCode;
 }