pactkit 2.3.5__tar.gz → 2.4.0__tar.gz

{pactkit-2.3.5 → pactkit-2.4.0}/.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -e .
+          pip install -e ".[multilang]"
           pip install pytest ruff==0.15.1
 
       - name: Lint with ruff

{pactkit-2.3.5 → pactkit-2.4.0}/.github/workflows/pactkit.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -e ".[dev]" || pip install -e .
+          pip install -e ".[multilang]"
           pip install pytest ruff
           pactkit init
 

{pactkit-2.3.5 → pactkit-2.4.0}/.opencode/pactkit.yaml

@@ -2,7 +2,7 @@
 # Edit this file to customize which components are deployed.
 # Remove items from a list to disable them. Default: all enabled.
 
-version: "2.3.4"
+version: "2.4.0"
 stack: python
 root: .
 developer: "slim"
@@ -114,6 +114,24 @@ agent_models:
   system-medic: haiku
   visual-architect: sonnet
 
+# Visualize — configure directory scan exclusions
+visualize:
+  scan_excludes:
+    - venv
+    - _venv
+    - .venv
+    - .env
+    - env
+    - __pycache__
+    - .git
+    - .claude
+    - tests
+    - docs
+    - node_modules
+    - site-packages
+    - dist
+    - build
+
 # Custom — user-defined keys (preserved by PactKit)
 e2e:
   blocking: false

{pactkit-2.3.5 → pactkit-2.4.0}/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to PactKit will be documented in this file.
 
 Format follows [Keep a Changelog](https://keepachangelog.com/).
 
+## [2.4.0] - 2026-03-25
+
+### Added
+- **Multi-Architecture Topology System** (STORY-slim-039~048) — 10 stories implementing a complete topology analysis framework:
+  - **TopologyParser ABC** — Abstract base class with `detect()` + `parse()` and zero-config auto-detection via `_TOPOLOGY_MARKERS`
+  - **PdcaParser** — Refactored Epic 1 logic into TopologyParser; added PDCA sequence edges (Plan→Act→Check→Done dashed arrows)
+  - **ServiceParser** — Parses `docker-compose.yml`, `openapi.yaml`, `*.proto`; extracts service→api→service dependency graph with MQ topic support
+  - **FrontendParser** — Parses Next.js (App/Pages Router), Vue Router routes; extracts page→component→hook→store dependency chain
+  - **Cross-topology Impact** — `reverse_reach()` works across all topologies; `regression_workflow_impact()` detects service/hook/store changes
+  - **Unified Layered Graph** — `build_unified_graph()` merges code + topology dimensions with bridge edges; `to_mermaid()` renders dimension-based subgraphs
+  - **MAX_WORKFLOW_NODES=500** — Performance ceiling for unified graph node count
+
+### Fixed
+- **detect_topology() DRY fix** — Now delegates to parser's own `detect()` method first, falling back to `_TOPOLOGY_MARKERS` for unregistered topologies only. Fixes empty workflow graph on pactkit's own project.
+- **pyproject.toml metadata** — Moved `authors/keywords/classifiers` from `[project.optional-dependencies]` back to `[project]` (caused CI hatchling validation failure)
+- **CI multilang deps** — Both CI workflows now install `[multilang]` extras for tree-sitter test coverage
+- **Spec/PRD consistency** (HOTFIX-slim-049) — Fixed 040 AC1 wording, 042 markers, PRD database/reads_db removal, PRD roadmap checkboxes
+
+## [2.3.6] - 2026-03-24
+
+### Fixed
+- **Issue Sync Substring Matching** (STORY-slim-027 R1) — `issue_sync.py` now uses word-boundary regex instead of `in` substring check, preventing `STORY-1` from matching `STORY-10`.
+- **E007 Per-Subsection GWT Check** (R3) — Spec linter E007 now validates Given/When/Then keywords per AC subsection instead of flat-scanning the entire Acceptance Criteria section. Uses raw text (with code fences) to avoid false positives on specs wrapping Gherkin in ` ```gherkin ` blocks.
+- **W008 Scaffold Placeholder Detection** (R4) — New warning W008 fires when `## Background` or `## Target Call Chain` still contains default scaffold placeholder text.
+- **Schema-Linter Alignment** (R2/R10) — `## Security Scope` moved from OPTIONAL to REQUIRED in `schemas.py` to match E009 enforcement; `## Non-Goals` added to OPTIONAL.
+- **RFC Pattern Consistency** (R11) — Spec linter fallback RFC pattern now derived from `SPEC_RFC_KEYWORDS` tuple instead of a separate hardcoded regex.
+- **Scaffold Skill Path** (R8) — `scaffold.py` usage hint now uses resolved `root` path instead of hardcoded `~/.claude/skills/`.
+
+### Changed
+- **Design Prompt** (R5) — Phase 3 now includes `pactkit sec-scope` step after filling each Spec.
+- **Act Prompt** (R6/R7) — Phase 0.6 adds "Move to In Progress" board step; Phase 3 adds lint gate before regression.
+
 ## [2.3.5] - 2026-03-23
 
 ### Fixed

{pactkit-2.3.5 → pactkit-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pactkit
-Version: 2.3.5
+Version: 2.4.0
 Summary: Spec-driven agentic DevOps toolkit for AI coding assistants
 Project-URL: Homepage, https://pactkit.dev
 Project-URL: Repository, https://github.com/pactkit/pactkit
@@ -22,6 +22,11 @@ Classifier: Topic :: Software Development :: Build Tools
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.10
 Requires-Dist: pyyaml>=6.0
+Provides-Extra: multilang
+Requires-Dist: tree-sitter-go>=0.25; extra == 'multilang'
+Requires-Dist: tree-sitter-java>=0.23; extra == 'multilang'
+Requires-Dist: tree-sitter-typescript>=0.23; extra == 'multilang'
+Requires-Dist: tree-sitter>=0.25; extra == 'multilang'
 Description-Content-Type: text/markdown
 
 <p align="center">

pactkit-2.4.0/docs/specs/BUG-slim-007.md

@@ -0,0 +1,138 @@
+# BUG-slim-007: W007 substring matching causes false negatives and inconsistency
+
+| Field | Value |
+|-------|-------|
+| ID | BUG-slim-007 |
+| Status | Draft |
+| Priority | P1 |
+| Release | 2.3.6 |
+| Origin | Cross-model code review (2026-03-24) |
+
+## Background
+
+W007 (Req-AC coverage check) was introduced in STORY-slim-024 (v2.3.4) and patched in v2.3.5 to use `SPEC_RFC_KEYWORDS` instead of hardcoded `SHOULD`. Code review found that the implementation uses Python `in` (substring) matching in two places where word-boundary regex is required, plus a pattern divergence from the canonical source.
+
+### Bug 1: R{N} coverage check — substring false negative
+
+`spec_linter.py:241`:
+```python
+if req_id.lower() not in ac_lower:
+```
+
+When AC section mentions `R10`, the string `"r1"` is a substring of `"r10"` — so `R1` is falsely reported as covered. Similarly `"r1" in "r12"`, `"r2" in "r20"`, etc. Also non-R prefixed text like `"CR1"`, `"ERROR1"`, `"PR1"` would suppress W007 for `R1`.
+
+**Impact**: Any spec with 10+ requirements silently passes W007 for R1-R9 when R10+ exists in AC. This directly undermines W007's purpose.
+
+### Bug 2: RFC keyword detection — substring inconsistency with W003
+
+`spec_linter.py:244`:
+```python
+found_keyword = next((kw for kw in SPEC_RFC_KEYWORDS if kw in req_upper), None)
+```
+
+W003 at line 172 uses `_RFC2119.search(body)` which is `SPEC_RFC_PATTERN` — a compiled regex with `\b` word boundaries. W007 uses plain `kw in req_upper` (substring). This means `"MAYONNAISE"` matches `MAY`, `"SHALLOW"` matches `SHALL`, etc.
+
+Two rules in the same file detecting RFC 2119 keywords with different strategies is a consistency violation.
+
+### Bug 3: _REQ_ID_PATTERN diverges from SPEC_REQUIREMENT_PATTERN
+
+`spec_linter.py:203`:
+```python
+_REQ_ID_PATTERN = re.compile(r"###\s+(R\d+)[:\s]", re.MULTILINE)
+```
+
+`schemas.py:32`:
+```python
+SPEC_REQUIREMENT_PATTERN = r"### R\d+[:\s]"
+```
+
+E004 uses `SPEC_REQUIREMENT_PATTERN` (literal single space after `###`), while W007 uses `_REQ_ID_PATTERN` (`\s+` — allows tab, multiple spaces). A heading `###  R1:` (double space) would be found by W007 but missed by E004. Both patterns should derive from the same canonical source.
+
+## Requirements
+
+### R1: Word-boundary matching for R{N} coverage (MUST)
+
+W007 MUST use word-boundary regex to check whether an R{N} ID appears in the AC section. `R1` MUST NOT match `R10`, `R12`, `CR1`, `ERROR1`, or any other superstring.
+
+Pattern: `re.search(rf"\b{req_id}\b", ac_section, re.IGNORECASE)`
+
+### R2: Word-boundary matching for RFC 2119 keywords (MUST)
+
+W007's RFC 2119 keyword detection MUST use `SPEC_RFC_PATTERN` (from `schemas.py`) — the same compiled regex with `\b` word boundaries that W003 already uses. `MAY` MUST NOT match `MAYONNAISE`.
+
+### R3: _REQ_ID_PATTERN MUST derive from SPEC_REQUIREMENT_PATTERN (SHOULD)
+
+`_REQ_ID_PATTERN` SHOULD be constructed from `SPEC_REQUIREMENT_PATTERN` or share the same whitespace semantics, so that E004 and W007 agree on what constitutes a valid `### R{N}` heading.
+
+If intentional divergence is needed (e.g., W007 is more tolerant), document the reason inline.
+
+### R4: Test coverage for multi-digit R{N} (MUST)
+
+Tests MUST include a spec with R1 through R10+ where only R10 is referenced in AC, to verify R1 is correctly flagged as uncovered.
+
+### R5: Test coverage for all 7 RFC 2119 keywords (SHOULD)
+
+Tests SHOULD cover all 7 keywords from `SPEC_RFC_KEYWORDS`, not just MUST/SHOULD/MAY. Tests SHOULD also cover the no-keyword case (empty emphasis).
+
+## Acceptance Criteria
+
+### AC1: R1 not falsely covered by R10 (R1, R4)
+
+- **Given** a spec with `### R1: First` and `### R10: Tenth` in Requirements
+- **When** AC section mentions only `R10` (not `R1`)
+- **Then** W007 fires for R1 with message "Requirement R1 has no corresponding AC reference"
+- **And** W007 does NOT fire for R10
+
+### AC2: Non-R prefix text does not suppress W007 (R1)
+
+- **Given** a spec with `### R1: Something` in Requirements
+- **When** AC section contains `ERROR1` or `CR1` but not standalone `R1`
+- **Then** W007 fires for R1
+
+### AC3: RFC keyword word-boundary (R2)
+
+- **Given** a spec with unreferenced `### R1: The system MAYONNAISE handler`
+- **When** spec linter runs
+- **Then** W007 message does NOT contain `(MAY)` — substring `MAY` inside `MAYONNAISE` is not a match
+- **And** emphasis is empty (no RFC keyword found)
+
+### AC4: All 7 RFC keywords detected (R2, R5)
+
+- **Given** specs with unreferenced requirements containing each of: MUST, SHOULD, MAY, SHALL, REQUIRED, RECOMMENDED, OPTIONAL
+- **When** spec linter runs
+- **Then** each W007 message contains the correct keyword in parentheses: `(MUST)`, `(SHOULD)`, etc.
+
+### AC5: W003 and W007 use same detection mechanism (R2)
+
+- **Given** the spec_linter.py source code
+- **When** inspecting both W003 and W007 RFC 2119 detection
+- **Then** both use `SPEC_RFC_PATTERN` (or `_RFC2119` alias) for matching — no plain `kw in string`
+
+### AC6: Existing tests still pass (regression)
+
+- **Given** all pre-existing tests in test_story_slim024.py and test_story042_spec_linter.py
+- **When** running the full test suite
+- **Then** all tests pass — no regressions from word-boundary change
+
+## Implementation Steps
+
+| Step | File | Action | Dependencies | Risk |
+|------|------|--------|-------------|------|
+| 1 | `src/pactkit/skills/spec_linter.py:241` | Replace `req_id.lower() not in ac_lower` with `re.search(rf"\b{re.escape(req_id)}\b", ac_section, re.IGNORECASE)` | None | Low |
+| 2 | `src/pactkit/skills/spec_linter.py:244` | Replace `next((kw for kw in SPEC_RFC_KEYWORDS if kw in req_upper), None)` with `SPEC_RFC_PATTERN.search(req_body)` using match group | Step 1 | Low |
+| 3 | `src/pactkit/skills/spec_linter.py:203` | Add inline comment documenting why `_REQ_ID_PATTERN` uses `\s+` vs `SPEC_REQUIREMENT_PATTERN`'s literal space, or unify | None | Low |
+| 4 | `tests/unit/test_story_slim024.py` | Add R10 multi-digit test (AC1), non-R-prefix test (AC2), MAYONNAISE test (AC3), all-7-keywords test (AC4), no-keyword test (AC5 empty emphasis) | Steps 1-2 | Low |
+| 5 | `tests/unit/test_story_slim024.py` | Migrate from `tempfile.NamedTemporaryFile(delete=False)` to pytest `tmp_path` fixture (consistency with test_story042) | None | Low |
+
+## Security Scope
+
+| Check | Applicable | Reason |
+|-------|------------|--------|
+| SEC-1~8 | No | Lint rule logic change, no I/O or auth |
+
+## Out of Scope
+
+- `_section_text()` returning heading line (fragile but extremely unlikely to cause false suppression)
+- Sectional write rule 150 vs 300 inconsistency in `rules.py:359` (trivial fix, separate commit)
+- `config.py:961` api_spec empty string default (docs already fixed, code default is cosmetic)
+- Board archive section ordering (functional, not a bug)

{pactkit-2.3.5 → pactkit-2.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pactkit"
-version = "2.3.5"
+version = "2.4.0"
 description = "Spec-driven agentic DevOps toolkit for AI coding assistants"
 readme = "README.md"
 license = "MIT"
@@ -12,6 +12,7 @@ requires-python = ">=3.10"
 dependencies = [
     "pyyaml>=6.0",
 ]
+
 authors = [
     { name = "Slim" },
 ]
@@ -44,6 +45,14 @@ classifiers = [
     "Topic :: Software Development :: Quality Assurance",
 ]
 
+[project.optional-dependencies]
+multilang = [
+    "tree-sitter>=0.25",
+    "tree-sitter-go>=0.25",
+    "tree-sitter-java>=0.23",
+    "tree-sitter-typescript>=0.23",
+]
+
 [project.urls]
 Homepage = "https://pactkit.dev"
 Repository = "https://github.com/pactkit/pactkit"
@@ -80,6 +89,6 @@ select = ["E", "F", "I", "W"]
 "src/pactkit/prompts/skills.py" = ["E501"]
 "src/pactkit/prompts/workflows.py" = ["E501"]
 "src/pactkit/generators/deployer.py" = ["E402"]
-"src/pactkit/skills/*.py" = ["E501", "E701", "E702", "E722", "E731"]
+"src/pactkit/skills/*.py" = ["E501", "E701", "E702", "E722", "E731", "I001"]
 "src/pactkit/scripts.py" = ["E501"]
-"tests/**/*.py" = ["E402", "E501", "E741", "F841"]
+"tests/**/*.py" = ["E402", "E501", "E741", "F841", "I001"]

{pactkit-2.3.5 → pactkit-2.4.0}/src/pactkit/__init__.py

@@ -1,3 +1,3 @@
 """PactKit - Spec-driven agentic DevOps toolkit."""
 
-__version__ = "2.3.5"
+__version__ = "2.4.0"

{pactkit-2.3.5 → pactkit-2.4.0}/src/pactkit/cli.py

@@ -399,6 +399,15 @@ def main():
             files = [f for f in result.stdout.strip().split("\n") if f]
         strategy, reason = classify_changes(files)
         print(f"{strategy.upper()} — {reason}")
+        # Workflow impact — informational only (STORY-slim-038)
+        try:
+            from pactkit.skills.visualize import regression_workflow_impact
+
+            wf_lines = regression_workflow_impact(".", files)
+            for line in wf_lines:
+                print(line)
+        except Exception:
+            pass  # Graceful degradation (R4)
         raise SystemExit(0 if strategy == "skip" else 0)
 
     elif args.command == "context":

{pactkit-2.3.5 → pactkit-2.4.0}/src/pactkit/config.py

@@ -178,6 +178,14 @@ def get_default_config() -> dict:
         "done": {
             "lesson_quality_threshold": 15,
         },
+        "visualize": {
+            "scan_excludes": [
+                "venv", "_venv", ".venv", ".env", "env",
+                "__pycache__", ".git", ".claude",
+                "tests", "docs",
+                "node_modules", "site-packages", "dist", "build",
+            ],
+        },
         "command_models": {
             "project-act": "sonnet",
             "project-check": "sonnet",
@@ -365,6 +373,7 @@ def load_config(path: Path | str | None = None) -> dict:
         "done",
         "e2e",
         "command_models",
+        "visualize",
     }
 
     # Merge: user keys override defaults; missing keys inherit
@@ -460,6 +469,7 @@ def auto_merge_config_file(path: Union[Path, str]) -> list[str]:
         "check",
         "done",
         "e2e",  # STORY-slim-022
+        "visualize",  # STORY-slim-028
     )
     for key in _BACKFILL_KEYS:
         if key not in user_data:
@@ -506,6 +516,7 @@ def _rewrite_yaml(path: Path, data: dict) -> None:
         "agent_models",
         "command_models",
         "rule_scopes",
+        "visualize",
     }
 
     lines = [
@@ -672,6 +683,16 @@ def _rewrite_yaml(path: Path, data: dict) -> None:
                 lines.append(f'  {rule_id}: "{pattern}"')
         lines.append("")
 
+    # Write visualize section (STORY-slim-028)
+    visualize = data.get("visualize", {})
+    if isinstance(visualize, dict) and "scan_excludes" in visualize:
+        lines.append("# Visualize — configure directory scan exclusions")
+        lines.append("visualize:")
+        lines.append("  scan_excludes:")
+        for item in visualize["scan_excludes"]:
+            lines.append(f"    - {item}")
+        lines.append("")
+
     # BUG-023: Preserve unknown user-defined keys
     unknown_keys = {k: v for k, v in data.items() if k not in KNOWN_KEYS}
     if unknown_keys:
@@ -961,6 +982,15 @@ def generate_default_yaml() -> str:
     lines.append(f"  api_spec: \"{e2e.get('api_spec', '')}\"  # OpenAPI spec path for frontend/backend")
     lines.append(f"  compose_file: {e2e.get('compose_file', 'docker-compose.test.yml')}  # for fullstack")
 
+    # Write visualize section (STORY-slim-028)
+    visualize = cfg.get("visualize", {})
+    if isinstance(visualize, dict) and "scan_excludes" in visualize:
+        lines.extend(["", "# Visualize — configure directory scan exclusions"])
+        lines.append("visualize:")
+        lines.append("  scan_excludes:")
+        for item in visualize["scan_excludes"]:
+            lines.append(f"    - {item}")
+
     # Write command_models section (STORY-073)
     cmd_models = cfg.get("command_models", {})
     if cmd_models:

{pactkit-2.3.5 → pactkit-2.4.0}/src/pactkit/issue_sync.py

@@ -5,6 +5,7 @@ Replaces prompt-based issue tracker verification from Done Phase 3.5.5/3.6.
 from __future__ import annotations
 
 import json
+import re
 import subprocess
 from pathlib import Path
 
@@ -68,7 +69,8 @@ def _search_issue(item_id: str) -> dict | None:
             return None
         issues = json.loads(result.stdout)
         for issue in issues:
-            if item_id in issue.get("title", ""):
+            title = issue.get("title", "")
+            if re.search(rf"(?<!\w){re.escape(item_id)}(?!\w)", title):
                 return issue
         return None
     except Exception:

{pactkit-2.3.5 → pactkit-2.4.0}/src/pactkit/prompts/commands.py

@@ -86,53 +86,33 @@ allowed-tools: [Read, Write, Edit, Bash, Glob, Grep]
 1.  Run `pactkit next-id` to get the next Story ID (reads developer prefix from pactkit.yaml, scans `docs/specs/`).
 2.  **Output checkpoint**: Print "Story ID determined: {ID}. Writing Spec now."
 
-## 🎬 Phase 3.2a: Spec Skeleton (Metadata + Requirements)
-1.  **Create file**: Create `docs/specs/{ID}.md` with the following sections:
-    - **MUST — Metadata Table**: Include a metadata table at the top using this EXACT format:
-      ```markdown
-      | Field | Value |
-      |-------|-------|
-      | ID | {ID} |
-      | Status | Draft |
-      | Priority | P2 |
-      | Release | {version} |
-      ```
-      Field names MUST be exact case (ID, Status, Priority, Release) — not bold, not different names.
-    - **MUST**: Fill in the `Release` metadata field by reading the `version` field from `{PACTKIT_YAML}` or `pyproject.toml`. Use that EXACT value — do NOT increment or predict a future version. If the file cannot be read, use `TBD`.
-    - **MUST**: Include `## Background` and `## Target Call Chain` sections based on your Trace findings.
-    - **MUST**: Fill in the `## Requirements` section using RFC 2119 keywords (MUST/SHOULD/MAY).
-2.  **Output checkpoint**: Print "Spec skeleton written. Adding acceptance criteria."
+## 🎬 Phase 3.2a: Scaffold + Metadata Table & Requirements
+1.  **Scaffold**: Run `{SCAFFOLD_CMD} create_spec "{ID}" "{title}"` to generate `docs/specs/{ID}.md` from SPEC_TEMPLATE. This creates all sections, tables, and Given/When/Then skeleton — format is guaranteed by Code.
+2.  **Read**: Read `docs/specs/{ID}.md` to see the scaffolded template.
+3.  **Edit placeholders** (use Edit tool, NOT Write):
+    - Edit `Release | TBD` → `Release | {version}` (read version from `{PACTKIT_YAML}` or `pyproject.toml`; if unreadable, keep TBD)
+    - Edit `(Description of the problem or feature)` → actual Background content from your Trace findings
+    - Edit `## Target Call Chain` placeholder → actual call chain from Phase 1
+    - Edit `### R1: (Requirement Name) (MUST)` → actual requirements using RFC 2119 keywords (MUST/SHOULD/MAY). Add more R{N} sections as needed.
+4.  **Output checkpoint**: Print "Spec skeleton filled. Adding acceptance criteria."
 
 ## 🎬 Phase 3.2b: Acceptance Criteria & Implementation Steps
-1.  **MUST**: Add `## Acceptance Criteria` section with Given/When/Then scenarios.
+1.  **Edit AC** (use Edit tool): Replace `### AC1: (Scenario Name) (R1)` and its Given/When/Then placeholders with actual scenarios. The template already provides the `- **Given**` / `- **When**` / `- **Then**` structure — fill in the content. Add more AC{N} sections as needed.
     - Each Scenario SHOULD map to a verifiable test case in `docs/test_cases/`.
-2.  **OPTIONAL — Implementation Steps**: If Phase 1 Trace identifies 2+ files to modify, add `## Implementation Steps` section with table format:
-    ```
-    | Step | File | Action | Dependencies | Risk |
-    |------|------|--------|--------------|------|
-    | 1 | `src/foo.py` | Description | None | Low |
-    ```
-    The `Dependencies` column accepts `None`, `Step N`, or comma-separated step references. The `Risk` column accepts `Low`, `Medium`, `High`.
+2.  **Edit Implementation Steps** (optional): If Phase 1 Trace identifies 2+ files to modify, replace the placeholder rows in `## Implementation Steps` with actual steps. The table skeleton (headers + separator) is already in the template.
 3.  **Output checkpoint**: Print "Acceptance criteria written. Running security scope."
 
 ## 🎬 Phase 3.2c: Security Scope
-1.  **MUST**: Run `pactkit sec-scope <changed-files>` to auto-detect SEC-1~SEC-8 applicability. Append the output to `## Security Scope` in the Spec.
-2.  **Fallback**: If `pactkit sec-scope` is unavailable, manually assess each SEC-1 through SEC-8 check based on changed file paths and code patterns. Apply docs/tests-only shortcut if applicable (mark ALL N/A with Reason "docs/tests only").
-3.  **Output format** (the table must include a Reason column):
-    ```markdown
-    ## Security Scope
-    | Check | Applicable | Reason |
-    |-------|------------|--------|
-    | SEC-1 | Yes | Source code modified |
-    | SEC-2 | N/A | No user input handling |
-    ```
-4.  **Output checkpoint**: Print "Security scope appended. Running lint."
+1.  **MUST**: Run `pactkit sec-scope <changed-files>` to auto-detect SEC-1~SEC-8 applicability.
+2.  **Edit** the `## Security Scope` section already in the template: replace the placeholder SEC-1 row with actual SEC-* assessments from the output above. The table skeleton (Check/Applicable/Reason headers) is already in the template.
+3.  **Fallback**: If `pactkit sec-scope` is unavailable, manually Edit each SEC-1 through SEC-8 entry. Apply docs/tests-only shortcut if applicable (mark ALL N/A with Reason "docs/tests only").
+4.  **Output checkpoint**: Print "Security scope filled. Running lint."
 
 ## 🎬 Phase 3.2d: Spec Lint Self-Check
 1.  Run `pactkit spec-lint docs/specs/{ID}.md`.
-2.  If ERROR rules fail, self-correct the Spec immediately (you wrote it — you have authority to fix it). Re-run until clean.
+2.  If any ERROR or WARNING rules fire, self-correct the Spec immediately (you wrote it — you have authority to fix it). Re-run until `pactkit spec-lint` reports 0 errors AND 0 warnings.
 3.  This prevents the Spec from being rejected at Act Phase 0.5.
-4.  **Output checkpoint**: Print "Spec lint passed."
+4.  **Output checkpoint**: Print "Spec lint passed (0 errors AND 0 warnings)."
 
 ## 🎬 Phase 3.3: Board, Memory & Handover
 1.  **Board**: Add Story using `add_story`.
@@ -180,7 +160,8 @@ allowed-tools: [Read, Write, Edit, Bash, Glob, Grep]
 > **NON-BLOCKING**: This phase NEVER stops Act.
 1.  **Spec exists?**: Check if `docs/specs/{STORY_ID}.md` exists. If not: WARN "Spec not found".
 2.  **Board entry exists?**: Check if `{STORY_ID}` appears in `docs/product/sprint_board.md`. If not: WARN "Board entry not found".
-3.  **Continue**: Regardless of findings, proceed to Phase 1.
+3.  **Move to In Progress**: If `{STORY_ID}` is found on the board, move it to In Progress section.
+4.  **Continue**: Regardless of findings, proceed to Phase 1.
 
 ## 🎬 Phase 1: Precision Targeting
 1.  **Targeted Visual Scan**: Run `visualize --focus <module>` only (single targeted mode). For large codebases, add `--depth 2`. Do NOT run full 3-mode visualize here — that is handled by Phase 4 Lazy Visualize after implementation.
@@ -205,6 +186,7 @@ allowed-tools: [Read, Write, Edit, Bash, Glob, Grep]
     - Run `pactkit regression` (uses `git diff` + `LANG_PROFILES` to classify: SKIP/FULL/IMPACT). Doc-only changes are auto-skipped.
     - If IMPACT: run `pactkit test-map <changed-files>` for incremental test selection. If any changed file has 3+ importers in `code_graph.mmd`, run full suite. Fallback: full suite.
     - **CRITICAL — Pre-existing test failure protocol**: If a pre-existing test fails, **DO NOT modify** it. **STOP** and report to the user. This is a one-shot check, not an iterative loop.
+4.  **Lint Gate**: Run `pactkit lint` to check code style. If lint errors are found, fix them before proceeding. If `pactkit lint` is unavailable, run the stack's lint command directly.
 
 ## 🎬 Phase 4: Sync & Document
 1.  Run `pactkit clean` and `pactkit visualize --lazy` (runs file, `--mode class`, `--mode call` if source changed).

{pactkit-2.3.5 → pactkit-2.4.0}/src/pactkit/prompts/rules.py

@@ -356,7 +356,7 @@ When generating **any file** (code, document, test, HTML, etc.) that will exceed
 3. **Checkpoint between blocks**: After each Edit, print a brief progress message (e.g., "Block 2/5 written.")
 4. **Never accumulate**: Do NOT compose the entire file in reasoning before writing — write as you go
 
-## Applies To — any file type over 150 lines
+## Applies To — any file type over 300 lines
 - Documents: PRD, specs, README, architecture guides
 - Source code: large modules, multi-endpoint API files, data models
 - Tests: test files with many test classes or scenarios

{pactkit-2.3.5 → pactkit-2.4.0}/src/pactkit/prompts/workflows.py

@@ -738,7 +738,8 @@ Assign each Story to a horizon:
       - `## Requirements` — using RFC 2119 keywords (MUST/SHOULD/MAY)
       - `## Acceptance Criteria` — Given/When/Then scenarios
       - Add Priority Score to the spec header: `- **Priority**: {score} (Impact {I} / Effort {E})`
-4.  **Spec Lint Self-Check**: After each Spec is generated, run `pactkit spec-lint docs/specs/{STORY_ID}.md`. If ERRORs found, self-correct and re-run until clean. This prevents malformed Specs from blocking the Sprint pipeline at Act Phase 0.5.
+4.  **Security Scope**: After filling each Spec, run `pactkit sec-scope <changed-files>` to populate the `## Security Scope` section. If `pactkit sec-scope` is unavailable, manually fill SEC-1 through SEC-8.
+5.  **Spec Lint Self-Check**: After each Spec is generated, run `pactkit spec-lint docs/specs/{STORY_ID}.md`. If ERRORs found, self-correct and re-run until clean. This prevents malformed Specs from blocking the Sprint pipeline at Act Phase 0.5.
 5.  **Batch Checkpoint**: Every 3 Specs completed, print a progress checkpoint (e.g., "3/8 Specs created. Continuing."). This prevents unbounded continuous output.
 6.  **Dependency Graph**: Add a Mermaid dependency graph at the end of the PRD showing Story execution order and critical path.
 

{pactkit-2.3.5 → pactkit-2.4.0}/src/pactkit/schemas.py

@@ -18,14 +18,14 @@ When adding a new document type:
 
 SPEC_REQUIRED_METADATA_FIELDS = ("ID", "Status", "Priority", "Release")
 
-SPEC_REQUIRED_SECTIONS = ("## Requirements", "## Acceptance Criteria")
+SPEC_REQUIRED_SECTIONS = ("## Requirements", "## Acceptance Criteria", "## Security Scope")
 
 SPEC_OPTIONAL_SECTIONS = (
     "## Background",
     "## Target Call Chain",
     "## Implementation Steps",
-    "## Security Scope",
     "## Out of Scope",
+    "## Non-Goals",
 )
 
 # E004: requirement subsection pattern
@@ -45,6 +45,10 @@ import re as _re  # noqa: E402
 
 SPEC_RFC_PATTERN = _re.compile(r"\b(" + "|".join(SPEC_RFC_KEYWORDS) + r")\b")
 
+# E009: Security Scope section name and SEC-* entry pattern
+SPEC_SECURITY_SCOPE_SECTION = "Security Scope"
+SPEC_SEC_PATTERN = r"\|\s*SEC-"
+
 # ─── Spec Template ──────────────────────────────────────────────────────────
 # Used by scaffold.py create_spec(). Must be consistent with spec_linter rules.
 # IMPORTANT: scaffold.py (deployed as standalone script) inlines a copy of this
@@ -72,12 +76,28 @@ SPEC_TEMPLATE = """\
 
 ## Acceptance Criteria
 
-### AC1: (Scenario Name)
+### AC1: (Scenario Name) (R1)
 
 - **Given** (precondition)
 - **When** (action)
 - **Then** (expected result)
 
+## Target Call Chain
+
+(Trace call chain here)
+
+## Implementation Steps
+
+| Step | File | Action | Dependencies | Risk |
+|------|------|--------|-------------|------|
+| 1 | `src/example.py` | (Description) | None | Low |
+
+## Security Scope
+
+| Check | Applicable | Reason |
+|-------|------------|--------|
+| SEC-1 | N/A | (Reason) |
+
 ## Out of Scope
 
 - (Items explicitly excluded)

{pactkit-2.3.5 → pactkit-2.4.0}/src/pactkit/skills/__init__.py

@@ -8,7 +8,8 @@ from pathlib import Path
 
 _SCRIPTS_DIR = Path(__file__).parent
 
-_SHARED_HEADER = r"""import re, os, sys, json, datetime, argparse, subprocess, shutil, ast
+_SHARED_HEADER = r"""import abc, re, os, sys, json, datetime, argparse, subprocess, shutil, ast
+from dataclasses import dataclass
 from pathlib import Path
 
 def nl(): return chr(10)

{pactkit-2.3.5 → pactkit-2.4.0}/src/pactkit/skills/scaffold.py

@@ -133,12 +133,28 @@ _SPEC_TEMPLATE = """\
 
 ## Acceptance Criteria
 
-### AC1: (Scenario Name)
+### AC1: (Scenario Name) (R1)
 
 - **Given** (precondition)
 - **When** (action)
 - **Then** (expected result)
 
+## Target Call Chain
+
+(Trace call chain here)
+
+## Implementation Steps
+
+| Step | File | Action | Dependencies | Risk |
+|------|------|--------|-------------|------|
+| 1 | `src/example.py` | (Description) | None | Low |
+
+## Security Scope
+
+| Check | Applicable | Reason |
+|-------|------------|--------|
+| SEC-1 | N/A | (Reason) |
+
 ## Out of Scope
 
 - (Items explicitly excluded)
@@ -190,7 +206,7 @@ def create_skill(name, desc, base_dir=None):
             "",
             "### [command_name] -- [Brief description]",
             "```",
-            f"python3 ~/.claude/skills/{name}/scripts/{clean}.py [subcommand] [args]",
+            f"python3 {root}/scripts/{clean}.py [subcommand] [args]",
             "```",
             "",
             "## Usage Scenarios",