sddflow 2.7.77__tar.gz → 2.7.82__tar.gz

{sddflow-2.7.77 → sddflow-2.7.82}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sddflow
-Version: 2.7.77
+Version: 2.7.82
 Summary: SDD Framework CLI — initialize and upgrade Spec-Driven Development packs
 Project-URL: Homepage, https://github.com/sunil1983us/universalguide
 Project-URL: Repository, https://github.com/sunil1983us/universalguide
@@ -574,6 +574,7 @@ Shows, per feature under `.specify/features/`:
     BRD"), which would misleadingly suggest the doc doesn't exist yet.
     sdd-micro has no Virtual Team, so none of this ever appears there.
 - **Documents** — every generated doc and its `Status:` (Draft/Approved/etc.), with a best-effort "what's next" guess, including the same persona ask shown on the Full Pipeline's Next box when the next doc has an owner. Each doc has a **View** button that reads the raw `.md` straight from disk into the page — no need to leave the browser to check content.
+- **Business Objectives** — chains `brd.md` §2 Business Objectives → §5's `Serves BO` column → `srd.md`'s Functional Requirements → `tasks.md`'s completion status, so each `BO-NNN` shows which `UC-NNN`s implement it and how much of that work is actually done (0% → Not Started, partial → In Progress, 100% → Done). Shown per-feature, plus a **cross-feature rollup card** above all the feature blocks — "of these business objectives across all features, which are met, which are pending, and where." Empty until `brd.md` §5 rows cite a `Serves BO`.
 - **Tasks** — parsed from `tasks.md` (works with both the full packs' checkbox-based tasks and sdd-micro's `**Status:**` field)
 - **Token Usage** — the running totals from `token-usage.md`, if token usage logging is enabled for that feature
 - **Jira Export** — the Epic/Story/Task links from the progressive export (`docs/jira/{feature}/keys.yml`), if you've run `/jira-push` or `sdd jira push`

{sddflow-2.7.77 → sddflow-2.7.82}/README.md

@@ -539,6 +539,7 @@ Shows, per feature under `.specify/features/`:
     BRD"), which would misleadingly suggest the doc doesn't exist yet.
     sdd-micro has no Virtual Team, so none of this ever appears there.
 - **Documents** — every generated doc and its `Status:` (Draft/Approved/etc.), with a best-effort "what's next" guess, including the same persona ask shown on the Full Pipeline's Next box when the next doc has an owner. Each doc has a **View** button that reads the raw `.md` straight from disk into the page — no need to leave the browser to check content.
+- **Business Objectives** — chains `brd.md` §2 Business Objectives → §5's `Serves BO` column → `srd.md`'s Functional Requirements → `tasks.md`'s completion status, so each `BO-NNN` shows which `UC-NNN`s implement it and how much of that work is actually done (0% → Not Started, partial → In Progress, 100% → Done). Shown per-feature, plus a **cross-feature rollup card** above all the feature blocks — "of these business objectives across all features, which are met, which are pending, and where." Empty until `brd.md` §5 rows cite a `Serves BO`.
 - **Tasks** — parsed from `tasks.md` (works with both the full packs' checkbox-based tasks and sdd-micro's `**Status:**` field)
 - **Token Usage** — the running totals from `token-usage.md`, if token usage logging is enabled for that feature
 - **Jira Export** — the Epic/Story/Task links from the progressive export (`docs/jira/{feature}/keys.yml`), if you've run `/jira-push` or `sdd jira push`

{sddflow-2.7.77 → sddflow-2.7.82}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sddflow"
-version = "2.7.77"
+version = "2.7.82"
 description = "SDD Framework CLI — initialize and upgrade Spec-Driven Development packs"
 readme = "README.md"
 requires-python = ">=3.9"

sddflow-2.7.82/sdd/__init__.py

@@ -0,0 +1 @@
+__version__ = "2.7.82"

{sddflow-2.7.77 → sddflow-2.7.82}/sdd/commands/dashboard.py

@@ -350,6 +350,44 @@ function renderTasks(tasks) {
   `;
 }
 
+function renderBusinessObjectives(bos, opts) {
+  opts = opts || {};
+  if (!bos || bos.length === 0) {
+    return '<div class="empty">No BO-NNN rows in brd.md yet, or its Business Requirements section doesn’t cite a Serves BO column.</div>';
+  }
+  const rows = bos.map(bo => {
+    const ucCell = (bo.uc_ids && bo.uc_ids.length) ? escapeHtml(bo.uc_ids.join(', ')) : '<span class="sub">none linked</span>';
+    const progressCell = bo.task_count
+      ? `${bo.percent_done}% <span class="sub">(${bo.tasks_done}/${bo.task_count})</span>`
+      : '<span class="sub">no tasks linked</span>';
+    const featureCell = opts.showFeature
+      ? `<td><a href="#${featureAnchorId(bo.feature)}">${escapeHtml(bo.feature)}</a></td>`
+      : '';
+    return `
+      <tr>
+        <td>${bo.bo_id}</td>
+        <td>${escapeHtml(bo.objective)}${bo.metric ? `<div class="sub">${escapeHtml(bo.metric)}</div>` : ''}</td>
+        ${featureCell}
+        <td>${ucCell}</td>
+        <td>${badge(bo.status, 'task')}</td>
+        <td>${progressCell}</td>
+      </tr>`;
+  }).join('');
+  const featureHeader = opts.showFeature ? '<th>Feature</th>' : '';
+  return `
+    <table><thead><tr><th>BO</th><th>Objective</th>${featureHeader}<th>Use Cases</th><th>Status</th><th>Progress</th></tr></thead><tbody>${rows}</tbody></table>`;
+}
+
+function renderBusinessObjectivesOverview(businessObjectives) {
+  if (!businessObjectives || businessObjectives.length === 0) return '';
+  return `
+    <div class="card card-wide" style="margin-bottom:1.5rem">
+      <h2>Business Objectives</h2>
+      <div class="sub" style="margin-bottom:.5rem">Rolled up from each feature's brd.md (§2 Business Objectives → §5 Serves BO) through srd.md and tasks.md — which use cases implement each objective, and how much of that work is done.</div>
+      ${renderBusinessObjectives(businessObjectives, {showFeature: true})}
+    </div>`;
+}
+
 function linkPill(kind, link) {
   if (!link) return '';
   if (link.error) return `<span class="pill pill-bad" title="${escapeHtml(link.error)}">${kind} ⚠</span>`;
@@ -673,6 +711,7 @@ function renderFeature(f, project) {
     <div class="grid feature-grid">
       <div class="card card-wide"><h2>Full Pipeline</h2>${renderPipelineFlow(f, project)}</div>
       <div class="card card-wide"><h2>Documents</h2>${renderDocs(f.docs, f.current_stage, f.name, local.confluence, local.jira_review)}</div>
+      <div class="card card-wide"><h2>Business Objectives</h2>${renderBusinessObjectives(f.business_objectives)}</div>
       <div class="card"><h2>Tasks</h2>${renderTasks(f.tasks)}</div>
       <div class="card"><h2>Token Usage</h2>${renderTokenUsage(f.token_usage)}</div>
       <div class="card"><h2>Jira Export</h2>${renderJiraExport(local.jira, exportEntry)}</div>
@@ -712,6 +751,7 @@ function render() {
   const data = lastData;
   document.getElementById('generated-at').textContent = 'Generated ' + data.generated_at;
   const overview = renderFeatureOverview(data.features);
+  const boOverview = renderBusinessObjectivesOverview(data.business_objectives);
   const features = data.features.length
     ? data.features.map(f => renderFeature(f, data.project)).join('')
     : '<div class="empty">No features under .specify/features/ yet — run <code>/specify</code> (or <code>sdd specify</code>) to create your first one.</div>';
@@ -737,7 +777,7 @@ function render() {
     };
   }
 
-  root.innerHTML = renderProject(data.project, data.constitution) + overview + features;
+  root.innerHTML = renderProject(data.project, data.constitution) + overview + boOverview + features;
 
   if (focus) {
     const selector = `.${focus.cls}[data-feature="${CSS.escape(focus.feature)}"][data-doc="${CSS.escape(focus.doc)}"]`;

{sddflow-2.7.77 → sddflow-2.7.82}/sdd/commands/upgrade.py

@@ -3007,6 +3007,219 @@ MIGRATIONS = [
         ],
         "migrate": lambda m: {**m, "sdd_version": "2.7.77"},
     },
+    {
+        "from":        "2.7.77",
+        "to":          "2.7.78",
+        "description": "Fix: sdd-universal missing UI templates, brd-template.md drift, design-template.md numbering gap -- template quality review found real gaps beyond docs/CI",
+        "notes": [
+            "sdd-universal was missing ux-flow-template.md, "
+            "screen-spec-template.md, component-spec-template.md, and "
+            "component-library-template.md even though its own "
+            "specify-doc.prompt.md documents /specify-doc "
+            "component-spec|ux-flow|screen-spec as valid commands and "
+            "reads .specify/templates/{doc}-template.md directly -- a "
+            "broken reference for exactly the mobile/frontend project "
+            "types sdd-universal auto-detects. Added all four",
+            "ux-flow-template.md, screen-spec-template.md, and "
+            "component-spec-template.md had no ID scheme or Version "
+            "History table, unlike every other template in the system. "
+            "Added FLOW/ERR/EDGE-NNN, SCR-NNN, and COMP-NNN respectively, "
+            "plus Version History to all three. Enrolled into "
+            "_shared/full/ since they were already byte-identical across "
+            "every pack that ships them",
+            "brd-template.md had drifted uncoordinated: sdd-universal's "
+            "copy had a Section 9 Investment Summary and domain-aware "
+            "regulation pre-seeding (PCI/HIPAA/GDPR) the other four packs "
+            "(byte-identical to each other) never received. Unlike "
+            "api-spec/data-model/security-design/runbook -- which "
+            "legitimately vary by project type -- BRD content has no "
+            "such reason to differ. Enrolled into _shared/full/ using "
+            "sdd-universal's fuller version as canonical",
+            "design-template.md Section 3 skipped from 3.2 to 3.5 with "
+            "no 3.3/3.4 content anywhere in the file -- renumbered to "
+            "3.3",
+            "Known gaps NOT fixed in this pass: sdd-universal's "
+            "specify-doc.prompt.md has no project-type branching for "
+            "which flavor of data-model/security-design template to use "
+            "(a detected frontend/mobile project would get the "
+            "DB-schema/server-side flavor); sdd-universal's api-spec, "
+            "data-model, runbook, and openapi templates are each missing "
+            "content sdd-backend-service's same-flavor copies already "
+            "have; security-design-template.md has a structural (not "
+            "content) mismatch between backend and universal",
+            "This migration only bumps sdd_version -- no manifest.yml "
+            "field changes for any pack",
+        ],
+        "migrate": lambda m: {**m, "sdd_version": "2.7.78"},
+    },
+    {
+        "from":        "2.7.78",
+        "to":          "2.7.79",
+        "description": "Fix: runbook-template.md missing living-doc framing in 4 packs, security-design/data-model/api-spec inconsistencies across packs, release-template.md pilot-scope broken rollback reference, sdd-universal had no project-type flavor branching for data-model/security/runbook",
+        "notes": [
+            "runbook-template.md was missing its 'Living artifact' framing "
+            "paragraph and used '# Feature: {Feature Name}' instead of "
+            "'# Service:'/'# App:' in frontend-spa, mobile, fullstack, and "
+            "sdd-universal (only sdd-backend-service had it correct) -- an "
+            "agent following the template literally would treat the "
+            "runbook as a fresh per-feature doc instead of extending the "
+            "living one, silently dropping a prior feature's additions. "
+            "Fixed all four",
+            "security-design-template.md was inconsistent across packs: "
+            "only sdd-backend-service had a Version History table; only "
+            "sdd-universal had the CVSS scoring column and the 2-row "
+            "Security Officer/Tech Lead Approvals table. Reconciled all "
+            "five packs to have all three",
+            "data-model-template.md and api-spec-template.md were missing "
+            "Version History tables in sdd-universal (both docs) and "
+            "sdd-fullstack (api-spec only). Added. Also fixed "
+            "sdd-universal's api-spec-template.md References row, which "
+            "cited 'arch.summary.md ... ports/adapters' -- leftover text "
+            "that didn't match how api-spec.md is actually fed (per "
+            "plan-design.prompt.md Section 3: design.summary.md, which "
+            "feature added/changed which endpoints)",
+            "release-template.md Section 7 Rollback Plan pointed to "
+            "docs/runbook/local-setup.md in sdd-backend-service, "
+            "frontend-spa, mobile, and fullstack even at pilot scope, "
+            "where the runbook is never generated -- a broken reference. "
+            "Backported sdd-universal's pilot-scope fallback rollback "
+            "table (already correct there) to all four packs, plus two "
+            "extra Post-Deploy Smoke Test monitoring rows sdd-universal "
+            "already had",
+            "sdd-universal's specify-doc.prompt.md read one single "
+            "template flavor for data-model and security-design "
+            "regardless of detected project_type -- a frontend-spa or "
+            "mobile project would get the DB-schema/server-side flavor "
+            "instead of state/storage-model or local-cache-model content. "
+            "Added project_type branching (frontend-spa/desktop -> "
+            "*-template-frontend.md, mobile -> *-template-mobile.md, "
+            "else -> default) to the shared specify-doc.prompt.md source "
+            "(safe no-op for the other four packs, which have no "
+            "project_type field) and shipped the new frontend/mobile "
+            "flavor template files for sdd-universal. Same fix applied to "
+            "runbook generation in implement.prompt.md",
+            "Verified: sync-blocks.sh clean, cli-python pytest 648/648, "
+            "assert-output.sh 33/33 on both worked examples, setup smoke "
+            "tests 15/15",
+        ],
+        "migrate": lambda m: {**m, "sdd_version": "2.7.79"},
+    },
+    {
+        "from":        "2.7.79",
+        "to":          "2.7.80",
+        "description": "Fix: data-model-template.md missing Version History in frontend-spa/mobile/fullstack, security-design-template.md STRIDE column wording inconsistency in sdd-universal -- found while verifying the v2.7.79 fix batch's own consistency",
+        "notes": [
+            "data-model-template.md was missing '## Version History' in "
+            "sdd-frontend-spa, sdd-mobile, and sdd-fullstack -- only "
+            "sdd-backend-service and (as of 2.7.79) sdd-universal had it. "
+            "Found because sdd-universal's new data-model-template-frontend.md/"
+            "-mobile.md flavor files (copied verbatim from those packs' own "
+            "templates) diffed non-empty against their source -- the "
+            "source packs were the ones missing content, not the copies. "
+            "Added Version History to all three",
+            "security-design-template.md's STRIDE threat table column was "
+            "'Threat (STRIDE)' in sdd-universal but 'Threat (STRIDE "
+            "category)' in the other four packs -- pre-existing wording "
+            "drift, not something the 2.7.79 CVSS-column fix introduced. "
+            "Normalized sdd-universal to match",
+            "Verified: sync-blocks.sh clean, cli-python pytest 648/648, "
+            "assert-output.sh 33/33",
+        ],
+        "migrate": lambda m: {**m, "sdd_version": "2.7.80"},
+    },
+    {
+        "from":        "2.7.80",
+        "to":          "2.7.81",
+        "description": "Fix: sdd-micro/setup.sh had zero test coverage -- test-setup.sh only ever tested sdd-universal's setup.sh (hardcoded PACK_DIR); no manifest.yml field changes for any pack, including sdd-micro (this is a CI/test-harness fix, not a pack-content change)",
+        "notes": [
+            "Found while reviewing sdd-micro end-to-end: "
+            "packs/_shared/tests/test-setup.sh's own header says 'Smoke "
+            "tests for sdd-universal/setup.sh' and hardcodes "
+            "PACK_DIR=packs/sdd-universal -- sdd-micro/setup.sh (a "
+            "materially different script: --project/--feature only, no "
+            "--type/--scope, its own non-interactive default fallback to "
+            "'untitled-project'/'main') was never exercised by CI despite "
+            "root CLAUDE.md describing the smoke-test suite as covering "
+            "'injection-class names, all project types, and "
+            "non-interactive execution' in a way that read as a blanket "
+            "guarantee",
+            "Added packs/_shared/tests/test-setup-micro.sh, mirroring "
+            "test-setup.sh's ok()/nok() structure and covering the same "
+            "injection classes (quotes, backslash, ampersand, slash, "
+            "unicode) plus two cases specific to this script: the "
+            "no-args non-interactive default path, and the 'unknown "
+            "option' rejection (sdd-micro's setup.sh has no --type flag, "
+            "unlike sdd-universal's)",
+            "Wired into .github/workflows/ci.yml's existing "
+            "setup-smoke-tests job as a second step, and documented in "
+            "root CLAUDE.md's Testing Setup Scripts section",
+            "Verified the new test actually has teeth: temporarily "
+            "disabled sdd-micro/setup.sh's double-quote validation guard, "
+            "confirmed the 2 double-quote-rejection cases failed as "
+            "expected (exit 1), then restored the original file (git "
+            "diff clean) and re-ran clean (12/12)",
+            "Deliberately kept sdd-micro's own manifest.yml sdd_version "
+            "untouched (still 2.7.41) -- this fix only adds test/CI "
+            "infrastructure in this repo, it does not change any file "
+            "sdd-micro itself ships to a user's project via `sdd init "
+            "--pack sdd-micro`",
+        ],
+        "migrate": lambda m: {**m, "sdd_version": "2.7.81"},
+    },
+    {
+        "from":        "2.7.81",
+        "to":          "2.7.82",
+        "description": "Feature: Business Objectives traceability + dashboard rollup -- brd.md's Business Objectives (§2) and Business Requirements (§5) were previously unlinked siblings; adds a 'Serves BO' column to §5 and rolls BO -> BR -> FR -> TASK up into a per-feature and cross-feature Business Objectives view in `sdd dashboard`",
+        "notes": [
+            "Added 'Serves BO' column to brd-template.md's §5 Business "
+            "Requirements table (all 5 non-micro packs) -- every BR-NNN "
+            "must now cite which BO-NNN from §2 it serves. Updated "
+            "specify-brd.prompt.md with fill instructions",
+            "Added status.py parsers: _parse_brd_bo (brd.md §2/§5, "
+            "tolerant of 3- or 4-column Business Objectives tables and "
+            "legacy 'Satisfies' column headers), _parse_uc_traces "
+            "(use-cases.md Use Case Index table, falls back to scanning "
+            "narrative '### UC-NNN' sections' '**Trace:**'/'**BR "
+            "Traces:**' lines when no Index table exists), _parse_srd_fr "
+            "(srd.md Functional Requirements table, tolerant of the "
+            "5-column canonical shape and a 4-column 'Satisfies' "
+            "variant, plus §4 Use Case Coverage as a UC-link fallback)",
+            "Added build_bo_rollup(): chains BO -> BR (brd.md 'Serves "
+            "BO') -> FR (srd.md 'Source'/'Satisfies', the reliable "
+            "bridge since use-cases.md's FR Traces column is only "
+            "backfilled by a manual /specify-srd re-run and is often "
+            "skipped in practice) -> TASK (tasks.md 'Satisfies:' field + "
+            "completion status). UC-NNN is gathered from both "
+            "use-cases.md and srd.md for display, but status/percent-done "
+            "is computed from the BR->FR->TASK bridge only",
+            "Wired into build_feature_status() (per-feature "
+            "'business_objectives' key) and build_project_status() (flat "
+            "cross-feature 'business_objectives' list, each row tagged "
+            "with its feature name -- BO-NNN numbering is local to each "
+            "feature's brd.md, same as the existing Actor Registry "
+            "pattern)",
+            "Added a 'Business Objectives' card to `sdd dashboard`: a "
+            "cross-feature rollup card (BO, Objective, Feature, Use "
+            "Cases, Status, Progress) shown above the per-feature blocks, "
+            "plus a per-feature card in each feature's block",
+            "Status computed by task completion percentage (0 done -> "
+            "Not Started, some done or in-progress -> In Progress, all "
+            "done -> Done), not release.md's BO closure field -- picked "
+            "so the dashboard reflects live task state rather than a "
+            "field only updated at /release time",
+            "Verified end-to-end against examples/todo-api's real "
+            "brd.md/use-cases.md/srd.md/tasks.md (which deviate from the "
+            "raw templates in exactly the ways the tolerant parsing "
+            "above accounts for) via the dashboard's live HTTP server, "
+            "screenshotted in both light and dark mode",
+            "Added 20 pytest cases covering 3-vs-4-column BO tables, "
+            "legacy 'Satisfies' headers, unfilled template placeholders, "
+            "the Use Case Index fallback, orphaned BRs, and the flattened "
+            "cross-feature rollup",
+            "Verified: sync-blocks.sh clean, cli-python pytest 664/664",
+        ],
+        "migrate": lambda m: {**m, "sdd_version": "2.7.82"},
+    },
 ]
 
 

{sddflow-2.7.77/sdd/packs/sdd-fullstack → sddflow-2.7.82/sdd/packs/sdd-backend-service}/.github/prompts/specify-brd.prompt.md

@@ -32,6 +32,11 @@ Generate `brd.md` for the current feature:
   identifiers are assigned when actors are defined. Omit roles not present in `roles.yml`.
 - Every business goal: **BG-NNN**
 - Every non-functional requirement: **NFR-NNN** — must include a measurable target (e.g. "< 200ms p99", "99.9% uptime")
+- **§5 Business Requirements — Serves BO column:** every `BR-NNN` must cite
+  which `BO-NNN` from §2 it serves. If a requirement doesn't trace to any
+  stated objective, either it's scope creep (flag it, don't silently include
+  it) or §2 is missing an objective — surface this rather than leaving the
+  column blank. A BR may serve more than one BO; list all that apply.
 - Marker discipline:
   - `[ASSUMPTION-NNN: {what}]` — safe default applied; needs sign-off
   - `[NEEDS CLARIFICATION-NNN: {question}]` — no safe default; human decision

{sddflow-2.7.77/sdd/packs/sdd-fullstack → sddflow-2.7.82/sdd/packs/sdd-backend-service}/.github/prompts/specify-doc.prompt.md

@@ -27,7 +27,27 @@ If no argument given — list the remaining ungenerated documents for this scope
   - `.specify/features/{manifest.project.feature}/brd.summary.md` (or `brd.md`)
   - `.specify/features/{manifest.project.feature}/use-cases.summary.md` (or `use-cases.md`)
   - `.specify/features/{manifest.project.feature}/srd.summary.md` (or `srd.md`)
-- Read `.specify/templates/{doc}-template.md`
+- Read `.specify/templates/{doc}-template.md` — **except for `data-model`
+  and `security`/`security-design` when `manifest.yml` has a
+  `project_type` field (sdd-universal only — the other packs have no
+  such field and always use their own single template as before):
+  content shape for these two living docs differs by target
+  (server-side schema vs. client-side state/storage vs. local device
+  cache), so branch by `project_type` before reading:**
+  - `project_type` = `frontend-spa` or `desktop` → read
+    `.specify/templates/{doc}-template-frontend.md`
+  - `project_type` = `mobile` → read
+    `.specify/templates/{doc}-template-mobile.md`
+  - any other `project_type` (`backend-service`, `fullstack`,
+    `serverless`, `cli`, `library`, `iac`, `data-ml`, ...), or no
+    `project_type` field at all → read
+    `.specify/templates/{doc}-template.md` (the default/server-side
+    flavor) as before
+  - `fullstack` intentionally uses the default (server-side) flavor for
+    both docs — a fullstack service still has one server-side schema and
+    one server-side security baseline; frontend-specific state/XSS
+    concerns belong in that project's own `component-spec.md`/`ux-flow.md`
+    if generated, not in these two living documents
 
 ## Verify Gate
 
@@ -132,7 +152,7 @@ an existing shared artifact" instead of "a requirement changed."
 
 **Exception — `component-spec`'s "Shared Components Used" section is
 living, app-level** (packs with a `component-spec-template.md`: frontend-spa,
-fullstack). The rest of `component-spec.md` (component hierarchy, this
+fullstack, sdd-universal). The rest of `component-spec.md` (component hierarchy, this
 feature's own page/container components) stays per-feature as above, but
 any component this feature intends to be **reused by other features**
 (a shared/design-system component, not a one-off page component) is

{sddflow-2.7.77 → sddflow-2.7.82}/sdd/packs/sdd-backend-service/.specify/manifest.yml

@@ -43,5 +43,5 @@ testing_style: "paired"
 # If using sdd-universal instead, set project_type: "backend-service" in its manifest.yml
 # project_type: "backend-service"
 
-sdd_version: "2.7.77"   # set by sdd init; used by sdd upgrade
+sdd_version: "2.7.82"   # set by sdd init; used by sdd upgrade
 ai_tool: ""             # set by sdd init: claude-code | copilot | cursor | windsurf | other

{sddflow-2.7.77/sdd/packs/sdd-universal → sddflow-2.7.82/sdd/packs/sdd-backend-service}/.specify/templates/brd-template.md

@@ -49,10 +49,15 @@ Out of Scope:
 
 ## 5. Business Requirements
 
-| ID | Requirement | Priority |
-|---|---|---|
-| BR-{NNN} | {description} | Must Have |
-| BR-{NNN} | {description} | Should Have |
+| ID | Requirement | Priority | Serves BO |
+|---|---|---|---|
+| BR-{NNN} | {description} | Must Have | BO-{NNN} |
+| BR-{NNN} | {description} | Should Have | BO-{NNN} |
+
+> **Serves BO** — every BR-NNN must trace to at least one BO-{NNN} from §2. This is
+> what lets a later rollup (across features) answer "what's actually delivering on
+> this business objective" — a BR with no BO it serves is either scope creep or a
+> missed objective in §2; resolve one or the other before /validate.
 
 ## 6. Regulatory and Compliance
 

{sddflow-2.7.77/sdd/packs/sdd-mobile → sddflow-2.7.82/sdd/packs/sdd-backend-service}/.specify/templates/design-template.md

@@ -216,7 +216,7 @@ per-feature, as this isn't something the component itself owns:
 
 {Repeat block per endpoint}
 
-### 3.5 NFR Budget Allocation
+### 3.3 NFR Budget Allocation
 
 > Every measurable NFR target from srd.md is split across the components on
 > its critical path — so "P99 ≤ 500ms" becomes budgets a developer can test

{sddflow-2.7.77 → sddflow-2.7.82}/sdd/packs/sdd-backend-service/.specify/templates/release-template.md

@@ -78,6 +78,8 @@ Choose deployment strategy based on NFR requirements:
 | {key happy-path endpoint} | {expected response} | [ ] |
 | Logs show no ERROR within {N} min | true | [ ] |
 | {key NFR — e.g. P99 latency} | within target (NFR-{NNN}) | [ ] |
+| No new P1/P2 alerts in monitoring system within {N} min of deploy | Zero new alerts | [ ] |
+| Error rate in APM/dashboard | < 1% baseline | [ ] |
 
 ---
 
@@ -109,7 +111,19 @@ Choose deployment strategy based on NFR requirements:
 
 ## 7. Rollback Plan
 
-{Summary — full detail in docs/runbook/local-setup.md §6}
+> **MVP+ scope:** Full rollback detail is in `docs/runbook/local-setup.md §6`. Summary below for quick reference.
+>
+> **Pilot scope:** Runbook not generated at pilot scope. Document your rollback steps here before proceeding to §5 Go-Live Gate. Minimum required:
+
+| Step | Action | Owner | Time Estimate |
+|---|---|---|---|
+| 1 | Revert application to previous image / deployment | {devops_sre} | {N} min |
+| 2 | Roll back DB migrations if any were applied (run V{NNN}__down.sql) | {devops_sre} | {N} min |
+| 3 | Verify health endpoint returns 200 on previous version | {devops_sre} | {N} min |
+| 4 | Notify stakeholders — rollback complete | {tech_lead} | {N} min |
+
+**Rollback decision owner:** Tech Lead — triggers rollback if smoke test fails or P1 alert fires within {N} min of go-live.
+**Maximum acceptable rollback time:** {N} minutes (from decision to stable previous state).
 
 ---
 

{sddflow-2.7.77/sdd/packs/sdd-universal → sddflow-2.7.82/sdd/packs/sdd-backend-service}/.specify/templates/security-design-template.md

@@ -61,7 +61,7 @@
 
 ## 3. Full — Threat Model (STRIDE)
 
-| ID | Component | Threat (STRIDE) | Description | Mitigation | CVSS (qualitative) | Residual Risk |
+| ID | Component | Threat (STRIDE category) | Description | Mitigation | CVSS (qualitative) | Residual Risk |
 |---|---|---|---|---|---|---|
 | THR-{NNN} | {component} | Spoofing | {description} | {mitigation} | {Critical 9-10 / High 7-8.9 / Med 4-6.9 / Low 0-3.9 or "QA"} | Low/Med/High |
 | THR-{NNN} | {component} | Tampering | {description} | {mitigation} | {CVSS} | Low/Med/High |
@@ -115,3 +115,9 @@
 |---|---|---|---|
 | Security Officer (accountable — controls adequacy) | | Pending | |
 | Tech Lead (consulted — implementation feasibility) | | Pending | |
+
+## Version History
+
+| Version | Date | Feature | Change | CR |
+|---|---|---|---|---|
+| 1.0 | {date} | {feature that first created this document} | Initial security baseline | — |

{sddflow-2.7.77 → sddflow-2.7.82}/sdd/packs/sdd-frontend-spa/.github/prompts/specify-brd.prompt.md

@@ -32,6 +32,11 @@ Generate `brd.md` for the current feature:
   identifiers are assigned when actors are defined. Omit roles not present in `roles.yml`.
 - Every business goal: **BG-NNN**
 - Every non-functional requirement: **NFR-NNN** — must include a measurable target (e.g. "< 200ms p99", "99.9% uptime")
+- **§5 Business Requirements — Serves BO column:** every `BR-NNN` must cite
+  which `BO-NNN` from §2 it serves. If a requirement doesn't trace to any
+  stated objective, either it's scope creep (flag it, don't silently include
+  it) or §2 is missing an objective — surface this rather than leaving the
+  column blank. A BR may serve more than one BO; list all that apply.
 - Marker discipline:
   - `[ASSUMPTION-NNN: {what}]` — safe default applied; needs sign-off
   - `[NEEDS CLARIFICATION-NNN: {question}]` — no safe default; human decision

{sddflow-2.7.77/sdd/packs/sdd-backend-service → sddflow-2.7.82/sdd/packs/sdd-frontend-spa}/.github/prompts/specify-doc.prompt.md

@@ -27,7 +27,27 @@ If no argument given — list the remaining ungenerated documents for this scope
   - `.specify/features/{manifest.project.feature}/brd.summary.md` (or `brd.md`)
   - `.specify/features/{manifest.project.feature}/use-cases.summary.md` (or `use-cases.md`)
   - `.specify/features/{manifest.project.feature}/srd.summary.md` (or `srd.md`)
-- Read `.specify/templates/{doc}-template.md`
+- Read `.specify/templates/{doc}-template.md` — **except for `data-model`
+  and `security`/`security-design` when `manifest.yml` has a
+  `project_type` field (sdd-universal only — the other packs have no
+  such field and always use their own single template as before):
+  content shape for these two living docs differs by target
+  (server-side schema vs. client-side state/storage vs. local device
+  cache), so branch by `project_type` before reading:**
+  - `project_type` = `frontend-spa` or `desktop` → read
+    `.specify/templates/{doc}-template-frontend.md`
+  - `project_type` = `mobile` → read
+    `.specify/templates/{doc}-template-mobile.md`
+  - any other `project_type` (`backend-service`, `fullstack`,
+    `serverless`, `cli`, `library`, `iac`, `data-ml`, ...), or no
+    `project_type` field at all → read
+    `.specify/templates/{doc}-template.md` (the default/server-side
+    flavor) as before
+  - `fullstack` intentionally uses the default (server-side) flavor for
+    both docs — a fullstack service still has one server-side schema and
+    one server-side security baseline; frontend-specific state/XSS
+    concerns belong in that project's own `component-spec.md`/`ux-flow.md`
+    if generated, not in these two living documents
 
 ## Verify Gate
 
@@ -132,7 +152,7 @@ an existing shared artifact" instead of "a requirement changed."
 
 **Exception — `component-spec`'s "Shared Components Used" section is
 living, app-level** (packs with a `component-spec-template.md`: frontend-spa,
-fullstack). The rest of `component-spec.md` (component hierarchy, this
+fullstack, sdd-universal). The rest of `component-spec.md` (component hierarchy, this
 feature's own page/container components) stays per-feature as above, but
 any component this feature intends to be **reused by other features**
 (a shared/design-system component, not a one-off page component) is

{sddflow-2.7.77 → sddflow-2.7.82}/sdd/packs/sdd-frontend-spa/.specify/manifest.yml

@@ -32,5 +32,5 @@ testing_style: "paired"
 # If using sdd-universal instead, set project_type: "frontend-spa" in its manifest.yml
 # project_type: "frontend-spa"
 
-sdd_version: "2.7.77"   # set by sdd init; used by sdd upgrade
+sdd_version: "2.7.82"   # set by sdd init; used by sdd upgrade
 ai_tool: ""             # set by sdd init: claude-code | copilot | cursor | windsurf | other

{sddflow-2.7.77/sdd/packs/sdd-backend-service → sddflow-2.7.82/sdd/packs/sdd-frontend-spa}/.specify/templates/brd-template.md

@@ -49,16 +49,25 @@ Out of Scope:
 
 ## 5. Business Requirements
 
-| ID | Requirement | Priority |
-|---|---|---|
-| BR-{NNN} | {description} | Must Have |
-| BR-{NNN} | {description} | Should Have |
+| ID | Requirement | Priority | Serves BO |
+|---|---|---|---|
+| BR-{NNN} | {description} | Must Have | BO-{NNN} |
+| BR-{NNN} | {description} | Should Have | BO-{NNN} |
+
+> **Serves BO** — every BR-NNN must trace to at least one BO-{NNN} from §2. This is
+> what lets a later rollup (across features) answer "what's actually delivering on
+> this business objective" — a BR with no BO it serves is either scope creep or a
+> missed objective in §2; resolve one or the other before /validate.
 
 ## 6. Regulatory and Compliance
 
-| Regulation | Requirement | Impact |
-|---|---|---|
-| {regulation} | {requirement} | {design impact} |
+> **Domain-aware seeding:** Agent pre-populates known regulations from domain signals in `context.md`.
+> Common signals: "payment / card / PCI" → PCI-DSS | "health / patient / PHI" → HIPAA | "EU / GDPR / personal data" → GDPR | "financial / SOX" → SOX | "government / FedRAMP" → FedRAMP.
+> Rows without a confirmed regulation are marked `[NEEDS CLARIFICATION: which regulation applies to {area}?]` — these block /validate.
+
+| Regulation | Requirement | Design Impact | Confirmed? |
+|---|---|---|---|
+| {regulation — pre-seeded from domain or [NEEDS CLARIFICATION]} | {requirement} | {design impact} | [ ] |
 
 ## 7. Assumptions
 
@@ -75,11 +84,30 @@ Out of Scope:
 
 ---
 
+## 9. Investment Summary
+
+> **Purpose:** Gives the executive sponsor the cost and return context needed to sign off on BRD scope and priority.
+> Agent extracts from `context.md` if present; otherwise marks items `[NEEDS CLARIFICATION]`.
+
+| Item | Value | Source / Notes |
+|---|---|---|
+| Delivery scope | {pilot / mvp / full} | manifest.yml |
+| Build effort (T-shirt) | {S < 1 sprint / M 1–3 / L 3–6 / XL 6+} | Derived from analyze.md (filled after /analyze) |
+| Estimated team cost | {currency amount or [NEEDS CLARIFICATION]} | {from context.md or business case at {link}} |
+| Expected ROI / payback period | {e.g. 12-month payback / {N}× ROI or [NEEDS CLARIFICATION]} | {from context.md or business case} |
+| Cost of inaction | {what happens if this is NOT built} | {from context.md problem statement} |
+| Business case reference | {link / document title or N/A} | |
+
+> If cost and ROI are commercially sensitive and not appropriate for this document, state: "Investment details are in the business case at {link} — not reproduced here."
+
+---
+
 ## Approvals
 
 | Role | Approver | Status | Date |
 |---|---|---|---|
-| {Reviewer — see this command's Review: gate in CLAUDE.md} | | Pending | |
+| Product Owner (accountable — business objectives sign-off) | | Pending | |
+| Business Analyst (responsible — requirements accuracy) | | Pending | |
 
 ## Version History
 

{sddflow-2.7.77/sdd/packs/sdd-fullstack → sddflow-2.7.82/sdd/packs/sdd-frontend-spa}/.specify/templates/component-spec-template.md

@@ -1,4 +1,5 @@
 # Component Specification — {Feature Name}
+> Version: 1.0 | Status: Draft | Date: {date} | Author: {author}
 
 ## References
 | Source | Sections / IDs Used |
@@ -17,7 +18,7 @@
 
 ## Component Specs
 
-### {ComponentName}
+### COMP-{NNN}: {ComponentName}
 | Property | Value |
 |---|---|
 | Type | Page / Container / Presentational |
@@ -48,7 +49,12 @@ this feature's hierarchy — see the living-doc-update shared block in
 |---|---|---|---|
 | {Reviewer — see this command's Review: gate in CLAUDE.md} | | Pending | |
 
+## Version History
+| Version | Date | Changed By | Summary of Changes | CHG-NNN |
+|---|---|---|---|---|
+| 1.0 | {date} | {author} | Initial draft | — |
+
 ## Summary
 > Lines: {N} / {SUMMARY_MAX_LINES}
-## Components — {list}
+## Components — {list of COMP-NNN}
 ## State — {global vs local}