wendkeep 0.88.0 → 0.89.0

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.89.0] — 2026-08-30
+
+### Added
+
+- **Bridges opcionais oficiais para Spec Kit e Superpowers.** Projeções read-only preservam IDs,
+  hashes e ownership canônico do WendKeep; adapters são habilitados separadamente, validam
+  versões compatíveis e degradam com diagnósticos tipados sem afetar o Core nativo.
+- **Prova externa vinculada ao Git e ao CI.** Dispatch deriva somente de contratos canônicos e
+  artifacts externos permanecem `reported` até que manifest, blob, task, sensor e Evidence
+  Envelope coincidam com o checkout versionado.
+
+### Security
+
+- **Autoridade única e drift fail-closed.** Ownership concorrente, projeção stale, hashes/paths
+  divergentes, claims fabricados e promoção autoafirmada para `verified` bloqueiam import,
+  dispatch e verify antes de qualquer execução externa.
+
 ## [0.88.0] — 2026-08-29
 
 ### Added

package/README.en.md

@@ -253,6 +253,7 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Native MCP** | semantic tools, effects/capabilities, stdio, schemas, pagination, budgets, audit, and client configuration | [Native MCP](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/mcp.md) |
 | **Evidence recall and embeddings** | cursor/byte budgets, bounded lexical/FTS sidecars, and an optional local plugin contract that is off by default | [Optional embedding plugin](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/evidence-embeddings.md) |
 | **Host capabilities** | versioned lifecycle/effect matrix, degraded mode, human waivers, and evidence/Observer coverage | [Host capabilities](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/capabilities.md) |
+| **Ecosystem bridges** | optional Spec Kit/Superpowers adapters, canonical baseline, single ownership, drift, and Git/CI/Envelope proof with an index/worktree-identical manifest | [Ecosystem bridges](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/ecosystem-bridges.md) |
 | **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
 | **Changes and verification** | `change`, specs, sensors, TDD, evidence, Task Contracts, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
 | **Shared memory** | CORE, SHARED, status, validation, repair, and curation | [Memory](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory.md) |
@@ -570,7 +571,7 @@ explore → propose → apply (TDD) → verify → archive
 
 - **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). `--guide` creates the compact GUIDE contract and omits automatic design/spec/ADR when `contract_impact:none`. It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
 - **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags. For causal TDD, add `[tdd]` and record `wendkeep tdd red|green`; the [TDD attestation guide](docs/en/commands/tdd.md) covers profiles, waivers, and exit codes.
-- **Verify** — `wendkeep verify` runs declared sensors and writes an **Evidence Envelope v2** to `evidencia.json`, SHA-256-bound to project/repository/worktree/session, HEAD, index tree, normalized worktree digest, tasks, effective spec, TDD attestations, and sensor configuration. Each sensor records a sanitized command, execution window, duration, exit code, output digest, and a sanitized tail bounded to 2,000 characters. If HEAD changes during the run, no new envelope is published. `change status` reports `bound`, `stale`, `context-mismatch`, or `legacy-unbound`; v1 evidence remains readable but cannot satisfy v2 authority. The public schema is [`schema/wendkeep.evidence-envelope-v2.schema.json`](schema/wendkeep.evidence-envelope-v2.schema.json). `verify --deep` binds the package, attestations, and verdict to the current `envelope_id`.
+- **Verify** — `wendkeep verify` runs declared sensors and writes an **Evidence Envelope v2** to `evidencia.json`, SHA-256-bound to project/repository/worktree/session, HEAD, index tree, normalized worktree digest, tasks, effective spec, TDD attestations, and sensor configuration. Each sensor records a sanitized command, execution window, duration, exit code, output digest, and a sanitized tail bounded to 2,000 characters; `artifact_results` binds explicit digests for versioned files without using stdout as proof. If HEAD changes during the run, no new envelope is published. `change status` reports `bound`, `stale`, `context-mismatch`, or `legacy-unbound`; v1 evidence remains readable but cannot satisfy v2 authority. The public schema is [`schema/wendkeep.evidence-envelope-v2.schema.json`](schema/wendkeep.evidence-envelope-v2.schema.json). `verify --deep` binds the package, attestations, and verdict to the current `envelope_id`.
 - **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each applicable spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md` and moves the change to `_arquivo/`. GOVERN/ASSURE mint an ADR in `04-Decisões/`; compact GUIDE with no contract impact does not mint one automatically.
 
 > The gate blocks unless the scaffold is filled, no task is open, evidence is fresh, and every declared requirement is covered. **`--force` waives exactly one of those — the open-task check — and is the human's call, never the agent's.** An unfilled scaffold, a red critical sensor, stale evidence, an orphan requirement or a missing verdict block regardless.

package/README.md

@@ -253,6 +253,7 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Native MCP** | semantic tools, effects/capabilities, stdio, schemas, pagination, budgets, audit, and client configuration | [Native MCP](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/mcp.md) |
 | **Evidence recall and embeddings** | cursor/byte budgets, bounded lexical/FTS sidecars, and an optional local plugin contract that is off by default | [Optional embedding plugin](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/evidence-embeddings.md) |
 | **Host capabilities** | versioned lifecycle/effect matrix, degraded mode, human waivers, and evidence/Observer coverage | [Host capabilities](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/capabilities.md) |
+| **Ecosystem bridges** | optional Spec Kit/Superpowers adapters, canonical baseline, single ownership, drift, and Git/CI/Envelope proof with an index/worktree-identical manifest | [Ecosystem bridges](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/ecosystem-bridges.md) |
 | **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
 | **Changes and verification** | `change`, specs, sensors, TDD, evidence, Task Contracts, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
 | **Shared memory** | CORE, SHARED, status, validation, repair, and curation | [Memory](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory.md) |
@@ -570,7 +571,7 @@ explore → propose → apply (TDD) → verify → archive
 
 - **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). `--guide` creates the compact GUIDE contract and omits automatic design/spec/ADR when `contract_impact:none`. It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
 - **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags. For causal TDD, add `[tdd]` and record `wendkeep tdd red|green`; the [TDD attestation guide](docs/en/commands/tdd.md) covers profiles, waivers, and exit codes.
-- **Verify** — `wendkeep verify` runs declared sensors and writes an **Evidence Envelope v2** to `evidencia.json`, SHA-256-bound to project/repository/worktree/session, HEAD, index tree, normalized worktree digest, tasks, effective spec, TDD attestations, and sensor configuration. Each sensor records a sanitized command, execution window, duration, exit code, output digest, and a sanitized tail bounded to 2,000 characters. If HEAD changes during the run, no new envelope is published. `change status` reports `bound`, `stale`, `context-mismatch`, or `legacy-unbound`; v1 evidence remains readable but cannot satisfy v2 authority. The public schema is [`schema/wendkeep.evidence-envelope-v2.schema.json`](schema/wendkeep.evidence-envelope-v2.schema.json). `verify --deep` binds the package, attestations, and verdict to the current `envelope_id`.
+- **Verify** — `wendkeep verify` runs declared sensors and writes an **Evidence Envelope v2** to `evidencia.json`, SHA-256-bound to project/repository/worktree/session, HEAD, index tree, normalized worktree digest, tasks, effective spec, TDD attestations, and sensor configuration. Each sensor records a sanitized command, execution window, duration, exit code, output digest, and a sanitized tail bounded to 2,000 characters; `artifact_results` binds explicit digests for versioned files without using stdout as proof. If HEAD changes during the run, no new envelope is published. `change status` reports `bound`, `stale`, `context-mismatch`, or `legacy-unbound`; v1 evidence remains readable but cannot satisfy v2 authority. The public schema is [`schema/wendkeep.evidence-envelope-v2.schema.json`](schema/wendkeep.evidence-envelope-v2.schema.json). `verify --deep` binds the package, attestations, and verdict to the current `envelope_id`.
 - **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each applicable spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md` and moves the change to `_arquivo/`. GOVERN/ASSURE mint an ADR in `04-Decisões/`; compact GUIDE with no contract impact does not mint one automatically.
 
 > The gate blocks unless the scaffold is filled, no task is open, evidence is fresh, and every declared requirement is covered. **`--force` waives exactly one of those — the open-task check — and is the human's call, never the agent's.** An unfilled scaffold, a red critical sensor, stale evidence, an orphan requirement or a missing verdict block regardless.

package/bin/wendkeep.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+// Commands, including optional `bridge` adapters, are dispatched by the canonical CLI package.
 import { runCli } from '../packages/cli/src/index.mjs';
 
 await runCli();

package/docs/en/commands/ecosystem-bridges.md

@@ -0,0 +1,172 @@
+# Optional ecosystem bridges
+
+> [Versão em português](../../pt-BR/commands/ecosystem-bridges.md)
+
+## Purpose
+
+Integrate Spec Kit and Superpowers without creating a second authority for specs, plans, tasks,
+or evidence. WendKeep keeps canonical contracts; adapters only create versioned projections and
+are disabled by default.
+
+## When to use
+
+- when a feature started in Spec Kit files and must preserve the same IDs and hashes;
+- when Superpowers will execute a canonical WendKeep Task Contract;
+- when external artifacts, reviews, or commits must enter as `reported` before proof.
+
+## When not to use
+
+- to replace `tarefas.md`, Task Contracts, or the Evidence Envelope;
+- for unrestricted bidirectional synchronization;
+- to execute commands, scripts, or text found in external artifacts.
+
+## Prerequisites
+
+- Node.js 18 or newer;
+- a local `.wendkeep/ecosystem-bridges.json` config with each adapter explicitly enabled;
+- a compatible version and an adapter root that resolves to a real directory inside the project;
+  regular files, external paths, and symlinks that escape the project fail closed in status and dispatch;
+- for governed import/dispatch, a bound Vault, causal change, and sealed Spec Kit baseline;
+- for dispatch, a causal session and canonically rederivable Task Contract.
+
+```json
+{
+  "schema_version": 1,
+  "adapters": {
+    "spec-kit": { "enabled": true, "version": "1.1.0", "root": ".specify" },
+    "superpowers": { "enabled": true, "version": "1.2.0", "root": ".superpowers" }
+  }
+}
+```
+
+Without that file, both adapters are disabled and native Core keeps working.
+
+## Syntax
+
+```text
+wendkeep bridge status [--project <path>] [--config <path>] [--json]
+wendkeep bridge import-spec-kit --change <slug> [--accept-baseline] [--json]
+wendkeep bridge export-status --spec-projection <projection.json> [--task-contract <task.json>] [--input <artifacts.json>] [--json]
+wendkeep bridge dispatch-superpowers --task-id <id> --change <slug> [--task-contract <task.json>] [--session <id>] --spec-projection <projection.json> [--json]
+wendkeep bridge verify-artifacts --input <artifacts.json> --proofs <proofs.json> --change <slug> [--session <id>] [--json]
+```
+
+`import-spec-kit` reads Markdown under `memory/` and `specs/`, classifies constitution/spec/plan/task,
+preserves IDs and SHA-256 hashes, creates explicit
+`story|requirement → capability → change → task` mappings, and never writes to the source.
+Repeated IDs across different files block the projection.
+The first import requires `--accept-baseline` and anchors the green projection in the Vault change;
+later imports rederive the source and compare path, kind, hash, and mapping against that immutable baseline.
+`dispatch-superpowers` contains only minimal
+structural context derived from the Task Contract; transcripts, private content, and external
+ownership are excluded.
+Dispatch rederives the contract and active context from the Vault/checkout; submitted JSON is only
+a comparison copy and never validates its own `binding`.
+With Spec Kit active, the baseline and `--spec-projection` are mandatory and the source is
+reimported before dispatch.
+The `spec-projection` contract belongs exclusively to the `spec-kit` adapter: an incompatible
+version, out-of-schema kind, or projection resealed by another adapter is rejected before producing `spec_refs`.
+An `ok: false` decision requires at least one blocking diagnostic, while `ok: true` cannot coexist
+with a blocking diagnostic; any inconsistency blocks dispatch without exposing references.
+`export-status` recomputes and validates `projection_id`, returns a `reported` projection only, and
+does not write to Spec Kit files.
+
+## Options and exit codes
+
+| Option | Effect |
+|---|---|
+| `--project <path>` | Selects the consumer root. |
+| `--config <path>` | Overrides `.wendkeep/ecosystem-bridges.json`. |
+| `--change <slug>` | Selects the change holding canonical baseline and Evidence Envelope. |
+| `--accept-baseline` | Anchors only the first green Spec Kit baseline; never overwrites drift. |
+| `--task-id <id>` | Selects the causal task and rederives its canonical contract. |
+| `--task-contract <path>` | Optional copy that must match the rederived contract. |
+| `--spec-projection <path>` | Links Spec Kit refs to dispatch without copying content. |
+| `--input` / `--proofs` | Classifies external artifacts and their Git/CI/Envelope proofs. |
+| `--json` | Emits the typed contract as one JSON line. |
+
+- `0`: valid operation; optional disabled adapters are healthy too;
+- `1`: enabled adapter blocked, drift, incompatibility, or missing proof;
+- `2`: invalid argument, configuration, or input file.
+
+## Examples
+
+Small flow without adapters:
+
+```powershell
+node ./bin/wendkeep.mjs bridge status --json
+```
+
+Medium read-only Spec Kit flow:
+
+```powershell
+node ./bin/wendkeep.mjs bridge import-spec-kit --change ecosystem-bridges --accept-baseline --json > spec-projection.json
+node ./bin/wendkeep.mjs bridge dispatch-superpowers --task-id 3.1 --change ecosystem-bridges --session "$env:CODEX_THREAD_ID" --spec-projection spec-projection.json --json
+node ./bin/wendkeep.mjs bridge export-status --spec-projection spec-projection.json --task-contract task-contract.json --json
+```
+
+Large flow with external report and proof ingestion:
+
+```powershell
+node ./bin/wendkeep.mjs verify --change ecosystem-bridges
+node ./bin/wendkeep.mjs bridge verify-artifacts --input artifacts.json --proofs ci-proofs.json --change ecosystem-bridges --json
+```
+
+Before `verify`, commit the artifact and `.wendkeep/bridge-artifacts.json` to the Git index. The v1
+manifest binds each item to `source`, `external_id`, `kind`, `path`, `sensor_id`, and `task_id`. The
+matching sensor in `wendkeep.sensors.json` declares v1 `artifact_results` with `external_id`, `path`,
+and `algorithm: sha256`; the runner computes the byte digest, including binary files, only after a
+green run. This explicit result contains no artifact content, transcript, or artifact output tail.
+The collector checks the index first and then requires the identical copy to exist in the worktree;
+deleting or changing only the working copy fails closed, while absence from both index and worktree
+still means that the optional bridge declared no artifacts.
+
+Each `ci-proofs.json` reference contains only
+`{"type":"evidence-envelope","external_id":"review-1"}`. Path, task, sensor, digests, and Git
+blobs are rederived from the canonical manifest and Envelope; self-declared state, SHA, or authority
+are ignored for promotion. `artifacts.json` remains only the external report to compare.
+
+An artifact starts as `reported`. External JSON that merely declares `state: verified` remains
+`reported`. Promotion to `verified` jointly requires a project-contained file equal to its Git
+index blob, a green CI sensor with an explicit `artifact_results.digest`, a canonical Evidence
+Envelope v2 bound to the checkout, and a matching Envelope `external_artifacts` entry.
+`output_sha256` does not prove artifacts. The result
+exposes a sealed proof bound to `evidence_envelope_id` without copying transcript or Vault content.
+
+## Expected result
+
+- Spec Kit remains a read-only external source;
+- canonical plan, task, and evidence remain owned by WendKeep;
+- Superpowers receives minimal dispatch without permission to rewrite scope;
+- worktree creation/reuse and finishing remain delegated to the `wendkeep worktree` argv derived in dispatch;
+- post-merge cleanup uses `wendkeep worktree finish <slug> --pr <number-or-url>`;
+- drift and competing ownership block before execution;
+- removing or disabling an adapter does not degrade Core.
+
+## Common errors and diagnosis
+
+| Code | Diagnosis |
+|---|---|
+| `BRIDGE_ADAPTER_DISABLED` | Normal optional state; enable explicitly when needed. |
+| `BRIDGE_ADAPTER_MISSING` | Adapter is enabled, but its root is absent. |
+| `BRIDGE_VERSION_INCOMPATIBLE` | Version falls outside the published compatibility range. |
+| `BRIDGE_OWNERSHIP_CONFLICT` | External tool tried to own plan/task/evidence. |
+| `BRIDGE_SOURCE_DRIFT` | Hash changed, a plan became stale, or a reference appeared/disappeared. |
+| `BRIDGE_SOURCE_ID_DUPLICATE` | The same story/requirement ID appears in different files. |
+| `BRIDGE_BASELINE_MISSING` | Spec Kit is active without canonical baseline or required projection. |
+| `BRIDGE_BASELINE_STALE` | Source/projection diverged from the sealed Vault baseline. |
+| `BRIDGE_PROJECTION_INVALID` | Content and `projection_id` differ or schema fields are incomplete. |
+| `BRIDGE_SCHEMA_INVALID` | Runtime envelope does not satisfy the published contract. |
+| `BRIDGE_ARTIFACT_MANIFEST_UNTRACKED` | Bridge manifest exists on only one side or differs between index and worktree. |
+| `BRIDGE_ARTIFACT_FORGED` | Artifact path/bytes do not match the versioned file. |
+| `BRIDGE_ARTIFACT_RESULT_MISSING` | A green sensor did not produce the explicit digest bound by the manifest. |
+| `BRIDGE_PROOF_MISSING` | External report has no bound independent proof yet. |
+| `BRIDGE_PROOF_UNVERIFIED` | Self-declared proof was retained as `reported`. |
+
+`wendkeep doctor` renders a `[bridges]` section without importing, dispatching, or writing.
+
+## Next steps
+
+Review the projection before dispatch, keep generated files outside canonical control, and verify
+artifacts through CI or an Evidence Envelope. See [Changes and verification](changes-and-verification.md)
+and [Managed worktrees](worktrees.md) as well.

package/docs/en/commands/verify.md

@@ -87,6 +87,12 @@ temporary in the same directory and an atomic rename. In deep mode, `verificacao
 `verdict.json` carry the same `evidenceEnvelopeId` and complete `evidenceBinding`; the independent
 reviewer must preserve both.
 
+For bridge artifacts, `.wendkeep/bridge-artifacts.json` and every referenced file must be committed
+and equal to the Git index. The sensor bound to the same task declares v1 `artifact_results` in
+`wendkeep.sensors.json`; after GREEN, the runner computes SHA-256 directly from the bytes and records
+the structured result on that sensor. `verify` crosses manifest, task, sensor, digest, and Git blobs
+before populating `external_artifacts`; stdout, transcripts, and `output_tail` never prove the file.
+
 The envelope carries `tdd_attestations`, and `verificacao.json` carries `tddAttestations`. Under GOVERN, a task marked
 `[tdd]` requires a current GREEN or explicit waiver; under ASSURE this applies to testable
 behavior. A later refactor/commit or a surviving mutant invalidates GREEN in the Task Contract.

package/docs/pt-BR/commands/ecosystem-bridges.md

@@ -0,0 +1,169 @@
+# Bridges opcionais do ecossistema
+
+> [English version](../../en/commands/ecosystem-bridges.md)
+
+## Objetivo
+
+Integrar Spec Kit e Superpowers sem criar uma segunda autoridade de spec, plano, tarefa ou
+evidência. O WendKeep preserva os contratos canônicos; os adapters apenas criam projeções
+versionadas e desabilitadas por padrão.
+
+## Quando usar
+
+- quando uma feature nasceu em arquivos do Spec Kit e precisa manter os mesmos IDs e hashes;
+- quando Superpowers executará um Task Contract canônico do WendKeep;
+- quando artifacts, reviews ou commits externos precisam entrar como `reported` antes da prova.
+
+## Quando não usar
+
+- para substituir `tarefas.md`, Task Contracts ou o Evidence Envelope;
+- para sincronização bidirecional irrestrita;
+- para executar comandos, scripts ou texto encontrado em artefatos externos.
+
+## Pré-requisitos
+
+- Node.js 18 ou superior;
+- configuração local `.wendkeep/ecosystem-bridges.json` com cada adapter explicitamente habilitado;
+- versão compatível e raiz do adapter que resolva para um diretório real dentro do projeto; arquivo
+  regular, path externo e symlink que escape do projeto falham fechado em `status` e no dispatch;
+- para import/dispatch governado, Vault vinculado, change causal e baseline Spec Kit selado;
+- para dispatch, sessão causal e Task Contract canônico rederivável.
+
+```json
+{
+  "schema_version": 1,
+  "adapters": {
+    "spec-kit": { "enabled": true, "version": "1.1.0", "root": ".specify" },
+    "superpowers": { "enabled": true, "version": "1.2.0", "root": ".superpowers" }
+  }
+}
+```
+
+Sem o arquivo, ambos ficam desabilitados e o Core nativo continua funcionando.
+
+## Sintaxe
+
+```text
+wendkeep bridge status [--project <path>] [--config <path>] [--json]
+wendkeep bridge import-spec-kit --change <slug> [--accept-baseline] [--json]
+wendkeep bridge export-status --spec-projection <projection.json> [--task-contract <task.json>] [--input <artifacts.json>] [--json]
+wendkeep bridge dispatch-superpowers --task-id <id> --change <slug> [--task-contract <task.json>] [--session <id>] --spec-projection <projection.json> [--json]
+wendkeep bridge verify-artifacts --input <artifacts.json> --proofs <proofs.json> --change <slug> [--session <id>] [--json]
+```
+
+`import-spec-kit` lê Markdown sob `memory/` e `specs/`, classifica constitution/spec/plan/task,
+preserva IDs e SHA-256, cria mappings explícitos `story|requirement → capability → change → task`
+e nunca escreve na origem. IDs repetidos em arquivos diferentes bloqueiam a projeção.
+O primeiro import exige `--accept-baseline` e ancora a projeção verde na change do Vault; imports
+seguintes rederivam a origem e comparam path, kind, hash e mapping contra esse baseline imutável.
+`dispatch-superpowers` contém somente o contexto estrutural
+mínimo derivado do Task Contract; transcript, conteúdo privado e ownership externo não entram.
+O dispatch rederiva o contrato e o active context do Vault/checkout; um JSON submetido é apenas
+uma cópia para comparação e nunca valida o próprio `binding`. Com Spec Kit ativo, baseline e
+`--spec-projection` são obrigatórios e a origem é reimportada antes do dispatch.
+O contrato `spec-projection` pertence exclusivamente ao adapter `spec-kit`: versão incompatível,
+kind fora do schema ou projeção re-selada por outro adapter é rejeitada antes de produzir `spec_refs`.
+Uma decisão `ok: false` exige ao menos um diagnóstico bloqueante, e `ok: true` não pode coexistir
+com diagnóstico bloqueante; qualquer incoerência bloqueia o dispatch sem expor referências.
+`export-status` recalcula e valida `projection_id`, devolve apenas uma projeção `reported` e não
+grava nos arquivos do Spec Kit.
+
+## Opções e códigos de saída
+
+| Opção | Efeito |
+|---|---|
+| `--project <path>` | Seleciona a raiz do consumidor. |
+| `--config <path>` | Substitui `.wendkeep/ecosystem-bridges.json`. |
+| `--change <slug>` | Seleciona a change que guarda baseline e Evidence Envelope canônicos. |
+| `--accept-baseline` | Ancora somente o primeiro baseline Spec Kit verde; não sobrescreve drift. |
+| `--task-id <id>` | Seleciona a tarefa no contexto causal e rederiva o contrato canônico. |
+| `--task-contract <path>` | Cópia opcional que deve coincidir com o contrato rederivado. |
+| `--spec-projection <path>` | Liga referências Spec Kit ao dispatch sem copiar o conteúdo. |
+| `--input` / `--proofs` | Classifica artifacts externos e suas provas Git/CI/Envelope. |
+| `--json` | Emite o contrato tipado em uma linha JSON. |
+
+- `0`: operação válida; adapters opcionais desabilitados também são saudáveis;
+- `1`: adapter habilitado bloqueado, drift, incompatibilidade ou prova ausente;
+- `2`: argumento, configuração ou arquivo de entrada inválido.
+
+## Exemplos
+
+Fluxo pequeno, sem adapters:
+
+```powershell
+node ./bin/wendkeep.mjs bridge status --json
+```
+
+Fluxo médio, Spec Kit somente leitura:
+
+```powershell
+node ./bin/wendkeep.mjs bridge import-spec-kit --change ecosystem-bridges --accept-baseline --json > spec-projection.json
+node ./bin/wendkeep.mjs bridge dispatch-superpowers --task-id 3.1 --change ecosystem-bridges --session "$env:CODEX_THREAD_ID" --spec-projection spec-projection.json --json
+node ./bin/wendkeep.mjs bridge export-status --spec-projection spec-projection.json --task-contract task-contract.json --json
+```
+
+Fluxo grande, ingestão de relato e prova externa:
+
+```powershell
+node ./bin/wendkeep.mjs verify --change ecosystem-bridges
+node ./bin/wendkeep.mjs bridge verify-artifacts --input artifacts.json --proofs ci-proofs.json --change ecosystem-bridges --json
+```
+
+Antes de `verify`, versione no índice Git o artefato e `.wendkeep/bridge-artifacts.json`. O manifest
+v1 liga cada item a `source`, `external_id`, `kind`, `path`, `sensor_id` e `task_id`. O sensor
+correspondente em `wendkeep.sensors.json` declara `artifact_results` v1 com `external_id`, `path` e
+`algorithm: sha256`; o runner calcula o digest dos bytes, inclusive binários, somente depois de uma
+execução verde. O resultado explícito não contém conteúdo, transcript nem output tail do artefato.
+O collector consulta primeiro o índice e então exige a mesma cópia presente na worktree; apagar ou
+alterar somente a cópia de trabalho falha fechado, enquanto a ausência simultânea no índice e na
+worktree continua significando que o bridge opcional não declarou artifacts.
+
+Cada referência em `ci-proofs.json` usa apenas
+`{"type":"evidence-envelope","external_id":"review-1"}`. Path, task, sensor, digests e blobs Git
+são rederivados do manifest e do Envelope canônicos; `state`, SHA ou autoridade autodeclarados são
+ignorados para promoção. `artifacts.json` continua sendo somente o relato externo a comparar.
+
+O artifact começa como `reported`. JSON externo que apenas declare `state: verified` continua
+`reported`. A promoção para `verified` exige, em conjunto: arquivo dentro do projeto e igual ao
+blob do índice Git, sensor CI verde com `artifact_results.digest` explícito, Evidence Envelope v2
+canônico e bound ao checkout, e entrada correspondente em `external_artifacts` do Envelope.
+`output_sha256` não prova artefatos.
+O resultado expõe uma proof selada ligada ao `evidence_envelope_id`, sem copiar transcript ou Vault.
+
+## Resultado esperado
+
+- Spec Kit permanece uma fonte externa somente leitura;
+- plano, tarefa e evidência canônicos continuam pertencendo ao WendKeep;
+- Superpowers recebe um dispatch mínimo sem poder reescrever o escopo;
+- criação/reuso e finalização de worktree permanecem nos comandos `wendkeep worktree` derivados no dispatch;
+- cleanup pós-merge usa `wendkeep worktree finish <slug> --pr <número-ou-url>`;
+- drift e ownership concorrente bloqueiam antes da execução;
+- remover ou desabilitar um adapter não degrada o Core.
+
+## Erros comuns e diagnóstico
+
+| Código | Diagnóstico |
+|---|---|
+| `BRIDGE_ADAPTER_DISABLED` | Estado opcional normal; habilite explicitamente se necessário. |
+| `BRIDGE_ADAPTER_MISSING` | Adapter habilitado, mas sua raiz não existe. |
+| `BRIDGE_VERSION_INCOMPATIBLE` | Versão fora do compatibility range publicado. |
+| `BRIDGE_OWNERSHIP_CONFLICT` | Ferramenta externa tentou possuir plano/tarefa/evidência. |
+| `BRIDGE_SOURCE_DRIFT` | Hash mudou, plano ficou obsoleto ou uma referência apareceu/desapareceu. |
+| `BRIDGE_SOURCE_ID_DUPLICATE` | O mesmo story/requirement ID apareceu em arquivos diferentes. |
+| `BRIDGE_BASELINE_MISSING` | Spec Kit ativo sem baseline canônico ou projeção obrigatória. |
+| `BRIDGE_BASELINE_STALE` | Origem/projeção divergiu do baseline selado no Vault. |
+| `BRIDGE_PROJECTION_INVALID` | Conteúdo e `projection_id` não coincidem ou o schema está incompleto. |
+| `BRIDGE_SCHEMA_INVALID` | Envelope runtime não cumpre o contrato publicado. |
+| `BRIDGE_ARTIFACT_MANIFEST_UNTRACKED` | Manifest bridge ausente em apenas um lado ou diferente entre índice e worktree. |
+| `BRIDGE_ARTIFACT_FORGED` | Path/bytes do artefato não correspondem ao arquivo versionado. |
+| `BRIDGE_ARTIFACT_RESULT_MISSING` | Sensor verde não produziu o digest explícito ligado ao manifest. |
+| `BRIDGE_PROOF_MISSING` | Relato externo ainda não possui prova independente vinculada. |
+| `BRIDGE_PROOF_UNVERIFIED` | Prova autodeclarada foi mantida como `reported`. |
+
+`wendkeep doctor` mostra a seção `[bridges]` sem fazer import, dispatch ou escrita.
+
+## Próximos passos
+
+Revise a projeção antes do dispatch, mantenha os arquivos gerados fora do controle canônico e
+valide artifacts pelo CI ou Evidence Envelope. Consulte também [Changes e verificação](changes-and-verification.md)
+e [Worktrees gerenciadas](worktrees.md).

package/docs/pt-BR/commands/verify.md

@@ -88,6 +88,12 @@ mesmo diretório e rename atômico. No deep, `verificacao.json` e `verdict.json`
 `evidenceEnvelopeId` e `evidenceBinding` completo; o verificador independente deve preservar ambos
 no verdict.
 
+Para artefatos de bridge, `.wendkeep/bridge-artifacts.json` e os arquivos referenciados precisam
+estar versionados e iguais ao índice Git. O sensor ligado à mesma task declara `artifact_results`
+v1 em `wendkeep.sensors.json`; após GREEN, o runner calcula o SHA-256 diretamente dos bytes e grava
+o resultado estruturado no sensor. `verify` cruza manifest, task, sensor, digest e blobs Git antes
+de preencher `external_artifacts`; stdout, transcript e `output_tail` nunca são prova do arquivo.
+
 O envelope carrega `tdd_attestations`, e `verificacao.json`, `tddAttestations`. Em GOVERN, uma tarefa marcada
 `[tdd]` precisa de GREEN atual ou waiver explícito; em ASSURE, isso vale para comportamento
 testável. Refactor/commit posterior ou mutante sobrevivente invalida o GREEN no Task Contract.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.88.0",
+  "version": "0.89.0",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [
@@ -46,7 +46,7 @@
   "scripts": {
     "precheck": "node --check src/capabilities.mjs && node --check src/host-capabilities.mjs && node --check src/task-contracts.mjs && node --check src/task-leases.mjs && node --check src/task.mjs && node --check src/change.mjs && node --check src/archive-operation-lock.mjs && node --check src/worktree.mjs && node --check src/worktree-cleanup.mjs && node --check src/provenance-gate.mjs && node --check src/provenance-sources.mjs && node --check src/receipt-ledger.mjs && node --check src/evidence-envelope.mjs && node --check src/context.mjs && node --check src/active-context-health.mjs && node --check src/active-context-runtime.mjs && node --check hooks/active-context-store.mjs && node --check hooks/change-core.mjs && node --check hooks/brain-inject.mjs && node --check hooks/change-context.mjs && node --check hooks/session-stop.mjs && node --check packages/vault/src/worktree-metadata.mjs && node --check packages/vault/src/evidence-envelope.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/integrations/src/capabilities.mjs && node --check packages/pi/src/index.mjs && node --check src/sync-protocol.mjs && node --check src/sync-outbox.mjs && node --check src/sync-adapters.mjs && node --check src/sync-protocol-cli.mjs && node --check packages/mcp/src/sync.mjs && node --check src/portable.mjs && node --check src/tdd.mjs && node --check src/tdd-attestation.mjs && node --check src/tdd-attestation-store.mjs",
     "check": "node --check scripts/validate-commit-range.mjs && node --check packages/commit/src/index.mjs && node --check packages/commit/src/cli.mjs && node --check packages/commit/src/git-runtime.mjs && node --check src/git-commit-hooks.mjs && node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check scripts/release-provenance.mjs && node --check scripts/run-scope.mjs && node --check src/release-provenance.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/mcp.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/active-context-health.mjs && node --check src/project-vault.mjs && node --check src/observer-auth.mjs && node --check src/observer-privacy.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-memory.mjs && node --check src/observer-memory-publish.mjs && node --check src/observer-sql-store.mjs && node --check src/observer-sql-migrate.mjs && node --check src/observer-sql-publish.mjs && node --check src/observer-transcript-store.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check src/work-kind.mjs && node --check src/delivery.mjs && node --check web/observer/app.mjs && node --check hooks/observer-publish.mjs && node --check hooks/evidence-context.mjs && node --check hooks/active-context-handoff-evidence.mjs && node --check hooks/evidence-recall.mjs && node --check hooks/memory-scope.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/audit.mjs && node --check packages/mcp/src/cli.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/effects.mjs && node --check packages/mcp/src/executor.mjs && node --check packages/mcp/src/server.mjs && node --check packages/mcp/src/stdio.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-scope.mjs && node --check packages/vault/src/memory-candidate-policy.mjs && node --check packages/vault/src/evidence-recall.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
-    "postcheck": "node --check packages/observer/src/index.mjs && node --check packages/observer/src/policy.mjs && node --check packages/observer/src/redaction.mjs && node --check packages/observer/src/authz.mjs && node --check packages/observer/src/token-registry.mjs && node --check packages/observer/src/encryption.mjs && node --check packages/observer/src/retention.mjs && node --check packages/observer/src/purge.mjs && node --check packages/observer/src/audit.mjs",
+    "postcheck": "node --check packages/observer/src/index.mjs && node --check packages/observer/src/policy.mjs && node --check packages/observer/src/redaction.mjs && node --check packages/observer/src/authz.mjs && node --check packages/observer/src/token-registry.mjs && node --check packages/observer/src/encryption.mjs && node --check packages/observer/src/retention.mjs && node --check packages/observer/src/purge.mjs && node --check packages/observer/src/audit.mjs && node --check src/ecosystem-bridges.mjs && node --check src/ecosystem-bridge-artifact-collector.mjs && node --check src/ecosystem-bridge-baseline.mjs && node --check src/ecosystem-bridge-proof.mjs && node --check packages/integrations/src/bridge-config.mjs && node --check packages/integrations/src/bridge-contract.mjs && node --check packages/integrations/src/bridge-diagnostics.mjs && node --check packages/integrations/src/canonical-bridge-authority.mjs && node --check packages/integrations/src/ecosystem-bridge.mjs && node --check packages/integrations/src/spec-kit-adapter.mjs && node --check packages/integrations/src/superpowers-adapter.mjs",
     "test": "node --test --test-concurrency=2",
     "test:core": "node scripts/run-scope.mjs core",
     "release": "node scripts/release.mjs",

package/packages/cli/src/index.mjs

@@ -61,6 +61,7 @@ Usage:
                            serve: --vault P · --timeout-ms N.
                            config: --client generic|claude|codex|cursor · --vault P.
   wendkeep capabilities [...]  Show declared lifecycle/effect coverage by host. --host <id> · --host-version <v> · --json.
+  wendkeep bridge <sub>        Optional ecosystem adapters: status | import-spec-kit | export-status | dispatch-superpowers | verify-artifacts.
   wendkeep observer <sub>     Local multi-project Observer: serve | register | publish | reconcile | status.
   wendkeep worktree create <slug> [--base ref] [--branch name] [--open vscode|none] [--json]
   wendkeep worktree list [--json]
@@ -237,6 +238,9 @@ async function main(argv) {
     } else if (cmd === 'commit') {
       const { COMMIT_HELP } = await import('../../commit/src/cli.mjs');
       process.stdout.write(COMMIT_HELP);
+    } else if (cmd === 'bridge') {
+      const { BRIDGE_HELP } = await import('../../../src/ecosystem-bridges.mjs');
+      process.stdout.write(BRIDGE_HELP);
     } else {
       process.stdout.write(HELP);
     }
@@ -250,7 +254,7 @@ async function main(argv) {
     // `sync` starts with `init` and resolves the freshly bound Vault itself. Pre-resolving
     // here would prevent that repair step from reporting a corrupt binding as its own
     // first-stage failure (and could never make it as far as the guarded init).
-    && !['init', 'sync', 'worktree', 'hook', 'observer', 'mcp', 'capabilities', 'commit', '--version', '-v', '--help', '-h', 'help'].includes(cmd)) {
+    && !['init', 'sync', 'worktree', 'hook', 'observer', 'mcp', 'capabilities', 'commit', 'bridge', '--version', '-v', '--help', '-h', 'help'].includes(cmd)) {
     await preferProjectVault(rest);
   }
   switch (cmd) {
@@ -294,6 +298,11 @@ async function main(argv) {
       process.exit(runCapabilities(rest));
       break;
     }
+    case 'bridge': {
+      const { runEcosystemBridge } = await import('../../../src/ecosystem-bridges.mjs');
+      process.exit(runEcosystemBridge(rest));
+      break;
+    }
     case 'worktree': {
       const { runWorktree } = await import('../../../src/worktree.mjs');
       process.exit(await runWorktree(rest));

package/packages/harness/src/sensors-core.mjs

@@ -3,12 +3,13 @@
 // at the PROJECT ROOT (wendkeep.sensors.json); evidence lives per-change in the vault.
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 
 export const SENSOR_VAULT_ENV = 'WENDKEEP_SENSOR_VAULT';
 const SENSOR_OUTPUT_MAX_BUFFER = 8 * 1024 * 1024;
 const SENSOR_DIAGNOSTIC_MAX_LENGTH = 2000;
+const SENSOR_ARTIFACT_MAX_BYTES = 1024 * 1024;
 
 function sanitizeSensorDiagnostic(value) {
   return String(value || '')
@@ -27,6 +28,41 @@ function sha256(value) {
   return `sha256:${createHash('sha256').update(String(value || '')).digest('hex')}`;
 }
 
+function containedPath(root, target) {
+  const rel = relative(root, target);
+  return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+
+function collectSensorArtifactResults(sensor, cwd) {
+  const declarations = sensor?.artifact_results;
+  if (declarations === undefined) return [];
+  if (!Array.isArray(declarations)) throw new Error('artifact_results must be an array');
+  const root = realpathSync(resolve(cwd || '.'));
+  const seen = new Set();
+  return declarations.map((declaration) => {
+    const externalId = String(declaration?.external_id || '').trim();
+    const configuredPath = String(declaration?.path || '').trim();
+    if (Object.keys(declaration || {}).some((key) => ![
+      'schema_version', 'external_id', 'path', 'algorithm',
+    ].includes(key)) || declaration?.schema_version !== 1 || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(externalId)
+      || !configuredPath || declaration?.algorithm !== 'sha256' || seen.has(externalId)) {
+      throw new Error('artifact result declaration is invalid');
+    }
+    seen.add(externalId);
+    const candidate = resolve(root, configuredPath);
+    if (!containedPath(root, candidate) || !existsSync(candidate) || !lstatSync(candidate).isFile()) {
+      throw new Error(`artifact result path is unavailable: ${externalId}`);
+    }
+    const file = realpathSync(candidate);
+    if (!containedPath(root, file) || lstatSync(file).size > SENSOR_ARTIFACT_MAX_BYTES) {
+      throw new Error(`artifact result path is unsafe: ${externalId}`);
+    }
+    const path = relative(root, file).replaceAll('\\', '/');
+    const digest = createHash('sha256').update(readFileSync(file)).digest('hex');
+    return { schema_version: 1, external_id: externalId, path, algorithm: 'sha256', digest };
+  });
+}
+
 function sensorNow(now) {
   const value = typeof now === 'function' ? now() : (now || new Date().toISOString());
   if (value instanceof Date) return value.toISOString();
@@ -167,7 +203,17 @@ export function runSensors(sensors, ids, { spawn = spawnSync, cwd, env, now } =
       output_sha256: sha256(rawOutput),
       output_tail: boundedOutputTail,
     };
-    if (entry.status === 'red') entry.note = sensorFailureNote(r);
+    if (entry.status === 'green' && s.artifact_results !== undefined) {
+      try {
+        entry.artifact_results = collectSensorArtifactResults(s, cwd);
+      } catch (error) {
+        entry.status = 'red';
+        entry.exit_code = 1;
+        entry.artifact_results = [];
+        entry.note = sanitizeSensorDiagnostic(error?.message || 'artifact result collection failed');
+      }
+    }
+    if (entry.status === 'red' && !entry.note) entry.note = sensorFailureNote(r);
     if (s.type === 'mutation' && s.report) {
       // Delegated mutation (Wave B): read the tool's mutation-testing-elements report and
       // attach surviving mutants so verify can turn them into fix tasks.