diff --git a/.attest.json b/.attest.json new file mode 100644 index 0000000..ba4a063 --- /dev/null +++ b/.attest.json @@ -0,0 +1,4 @@ +{ + "requireAttestation": true, + "requireTestsPassed": true +} diff --git a/.augur.toml b/.augur.toml new file mode 100644 index 0000000..031b459 --- /dev/null +++ b/.augur.toml @@ -0,0 +1,3 @@ +[thresholds] +review = 35 +block = 65 diff --git a/.claude/commands/specsync/create-change.md b/.claude/commands/specsync/create-change.md new file mode 100644 index 0000000..04707cc --- /dev/null +++ b/.claude/commands/specsync/create-change.md @@ -0,0 +1,10 @@ +--- +description: Create and guide a verified spec-sync SDD change through its deterministic interview +argument-hint: +--- + +1. Run `specsync change new "$ARGUMENTS" --json`. +2. Read the returned `questions` array and interview the user one question at a time. +3. Record each answer with `specsync change answer --json`. +4. Continue until the question list is empty, then show the selected artifacts and next action. +5. Do not approve, implement, verify, accept, or archive until the corresponding human gate or work stage is reached. diff --git a/.claude/commands/specsync/create-spec.md b/.claude/commands/specsync/create-spec.md new file mode 100644 index 0000000..a424e76 --- /dev/null +++ b/.claude/commands/specsync/create-spec.md @@ -0,0 +1,40 @@ +--- +description: Scaffold a new spec-sync module spec from a module name or a natural-language feature description (full scaffold by default, or minimal with --minimal) +argument-hint: [--minimal] +--- + +Create a new spec-sync module spec. + +Arguments: `$ARGUMENTS` + +1. Parse the arguments above: the first whitespace-separated token is the + module name. If the arguments also contain `--minimal` (in any position), + remove it and remember that minimal mode was requested. +2. Look at whatever text remains. It will be one of: + - **A bare module name** — a short identifier like `auth-service` or + `billing`. Use it as-is. + - **A free-text feature description** — a sentence or phrase describing + what to build, e.g. `"I want a feature that lets users export their + data as CSV"`. In this case, invent a short, kebab-case module name that + captures the idea (e.g. `csv-export`). If the right name is ambiguous, + ask the user to confirm or rename it before continuing. Keep the full + description at hand — you'll use it in step 5. +3. If minimal mode was requested, run: + ``` + specsync new + ``` + This creates a minimal spec only (no companion files). +4. Otherwise (default), run: + ``` + specsync scaffold + ``` + This creates the spec, companion files (`tasks.md`, `requirements.md`, + `context.md`, `testing.md`, and `design.md` if `companions.design` is + enabled), a registry entry, and auto-detects related source files. +5. Open the newly created `specs//.spec.md` and fill + in the `Purpose`, `Requirements`, and `Public API` sections. If a free-text + description was given in step 2, use it directly to draft these sections — + ask clarifying questions if it's underspecified, but do not leave the + sections as unfilled placeholder text. Do the same for `requirements.md` + (acceptance criteria) and `tasks.md` (initial task breakdown), if present. +6. Run `specsync check` to confirm the new spec passes validation. diff --git a/.claude/skills/spec-sync/SKILL.md b/.claude/skills/spec-sync/SKILL.md new file mode 100644 index 0000000..de24d12 --- /dev/null +++ b/.claude/skills/spec-sync/SKILL.md @@ -0,0 +1,75 @@ +--- +name: spec-sync +description: Keep markdown module specs in specs// synchronized with source code using spec-sync. Use this whenever creating, editing, or reviewing code in a module that has (or should have) a spec, or whenever the user mentions specs, spec-sync, companion files (tasks.md/requirements.md/context.md/testing.md/design.md), or asks to add/update a module's documentation. +--- + +# Spec-Sync Workflow + +This project uses [spec-sync](https://github.com/CorvidLabs/spec-sync) for bidirectional spec-to-code validation. Specs live in `specs//.spec.md`. + +## Companion files + +## Verified SDD change lifecycle (5.0) + +For every meaningful source, test, public documentation, schema, or configuration change: + +1. Run `specsync change new "" --json` and conduct the returned interview with the user. +2. Use `specsync change answer --json` until no questions remain. +3. Complete the adaptively selected artifacts and semantic deltas. Requirements use stable + `REQ--` IDs, a normative SHALL statement, and acceptance criteria. +4. Ask the user for the definition approval, then run `specsync change approve `. +5. Run `specsync change start ` before editing implementation code. +6. Keep tasks and artifacts current, then run `specsync change verify `. +7. Present verification evidence and ask for closing approval. Only after explicit approval, + run `specsync change accept `; archive separately with `specsync change archive `. + +Never invent or self-grant either human approval. If an approved definition changes, its digest +becomes stale and must be approved again. `specsync check` validates canonical specs plus approved +active deltas, requirement-to-test evidence, change coverage, and CI gates. + +Each canonical spec may have policy-selected companion files. Read and update the ones present; do not create empty companions only for ceremony: + +- **`tasks.md`** — Work items for this module. Check off tasks (`- [x]`) as you complete them. Add new tasks if you discover work needed. +- **`requirements.md`** — Acceptance criteria and user stories. These are permanent invariants, not tasks — do not check them off. Update if requirements change. +- **`context.md`** — Architectural decisions, key files, and current status. Update when you make design decisions or change what's in progress. +- **`testing.md`** — Test strategy: automated test locations, manual QA checklists, and edge cases/boundary conditions. +- **`design.md`** *(opt-in)* — Layout, component hierarchy, design tokens, and asset references. Present when `companions.design` is enabled in config. + +## Before modifying any module + +1. Read the relevant spec in `specs//.spec.md` +2. Read whichever companion files are present (`requirements.md`, `tasks.md`, `context.md`, `testing.md`, `design.md`, or project-defined files) +3. After changes, run `specsync check` to verify specs still pass + +## After completing work + +1. Mark completed items in `tasks.md` — check off finished tasks, add new ones discovered +2. Update `context.md` — record decisions made, update current status +3. If requirements changed, update `requirements.md` acceptance criteria +4. If test coverage changed, update `testing.md` with new test files or edge cases +5. If UI/layout changed, update `design.md` with revised layout, components, or tokens + +## Before creating a PR + +Run `specsync check --strict` — all specs must pass with zero warnings. + +## When adding new modules + +Run `specsync scaffold ` to create a spec, companion files, a registry +entry, and auto-detected source files — or `specsync new ` for a +minimal spec-only draft. Complete the spec before writing code. The +`/specsync:create-spec` command (or tool-equivalent) runs this for you, and +accepts either a bare module name or a natural-language feature description +(e.g. `/specsync:create-spec "I want a feature that lets users export their +data as CSV"`) — pass a description and it will pick a module name and use +the description to draft the spec's Purpose and Requirements. + +## Key commands + +- `specsync check` — validate all specs against source code +- `specsync check --json` — machine-readable validation output +- `specsync coverage` — show which modules lack specs +- `specsync score` — quality score for each spec (0-100) +- `specsync scaffold ` — full scaffold: spec + companions + registry entry + source detection +- `specsync new ` — quick-create a minimal spec (add `--full` for companions) +- `specsync resolve --remote` — verify cross-project dependencies diff --git a/.codex/skills/spec-sync/SKILL.md b/.codex/skills/spec-sync/SKILL.md new file mode 100644 index 0000000..de24d12 --- /dev/null +++ b/.codex/skills/spec-sync/SKILL.md @@ -0,0 +1,75 @@ +--- +name: spec-sync +description: Keep markdown module specs in specs// synchronized with source code using spec-sync. Use this whenever creating, editing, or reviewing code in a module that has (or should have) a spec, or whenever the user mentions specs, spec-sync, companion files (tasks.md/requirements.md/context.md/testing.md/design.md), or asks to add/update a module's documentation. +--- + +# Spec-Sync Workflow + +This project uses [spec-sync](https://github.com/CorvidLabs/spec-sync) for bidirectional spec-to-code validation. Specs live in `specs//.spec.md`. + +## Companion files + +## Verified SDD change lifecycle (5.0) + +For every meaningful source, test, public documentation, schema, or configuration change: + +1. Run `specsync change new "" --json` and conduct the returned interview with the user. +2. Use `specsync change answer --json` until no questions remain. +3. Complete the adaptively selected artifacts and semantic deltas. Requirements use stable + `REQ--` IDs, a normative SHALL statement, and acceptance criteria. +4. Ask the user for the definition approval, then run `specsync change approve `. +5. Run `specsync change start ` before editing implementation code. +6. Keep tasks and artifacts current, then run `specsync change verify `. +7. Present verification evidence and ask for closing approval. Only after explicit approval, + run `specsync change accept `; archive separately with `specsync change archive `. + +Never invent or self-grant either human approval. If an approved definition changes, its digest +becomes stale and must be approved again. `specsync check` validates canonical specs plus approved +active deltas, requirement-to-test evidence, change coverage, and CI gates. + +Each canonical spec may have policy-selected companion files. Read and update the ones present; do not create empty companions only for ceremony: + +- **`tasks.md`** — Work items for this module. Check off tasks (`- [x]`) as you complete them. Add new tasks if you discover work needed. +- **`requirements.md`** — Acceptance criteria and user stories. These are permanent invariants, not tasks — do not check them off. Update if requirements change. +- **`context.md`** — Architectural decisions, key files, and current status. Update when you make design decisions or change what's in progress. +- **`testing.md`** — Test strategy: automated test locations, manual QA checklists, and edge cases/boundary conditions. +- **`design.md`** *(opt-in)* — Layout, component hierarchy, design tokens, and asset references. Present when `companions.design` is enabled in config. + +## Before modifying any module + +1. Read the relevant spec in `specs//.spec.md` +2. Read whichever companion files are present (`requirements.md`, `tasks.md`, `context.md`, `testing.md`, `design.md`, or project-defined files) +3. After changes, run `specsync check` to verify specs still pass + +## After completing work + +1. Mark completed items in `tasks.md` — check off finished tasks, add new ones discovered +2. Update `context.md` — record decisions made, update current status +3. If requirements changed, update `requirements.md` acceptance criteria +4. If test coverage changed, update `testing.md` with new test files or edge cases +5. If UI/layout changed, update `design.md` with revised layout, components, or tokens + +## Before creating a PR + +Run `specsync check --strict` — all specs must pass with zero warnings. + +## When adding new modules + +Run `specsync scaffold ` to create a spec, companion files, a registry +entry, and auto-detected source files — or `specsync new ` for a +minimal spec-only draft. Complete the spec before writing code. The +`/specsync:create-spec` command (or tool-equivalent) runs this for you, and +accepts either a bare module name or a natural-language feature description +(e.g. `/specsync:create-spec "I want a feature that lets users export their +data as CSV"`) — pass a description and it will pick a module name and use +the description to draft the spec's Purpose and Requirements. + +## Key commands + +- `specsync check` — validate all specs against source code +- `specsync check --json` — machine-readable validation output +- `specsync coverage` — show which modules lack specs +- `specsync score` — quality score for each spec (0-100) +- `specsync scaffold ` — full scaffold: spec + companions + registry entry + source detection +- `specsync new ` — quick-create a minimal spec (add `--full` for companions) +- `specsync resolve --remote` — verify cross-project dependencies diff --git a/.cursor/commands/specsync-create-change.md b/.cursor/commands/specsync-create-change.md new file mode 100644 index 0000000..49402f3 --- /dev/null +++ b/.cursor/commands/specsync-create-change.md @@ -0,0 +1,9 @@ +Create a verified spec-sync SDD change. + +Arguments: $ARGUMENTS + +1. Run `specsync change new "$ARGUMENTS" --json`. +2. Read the returned `questions` array and interview the user one question at a time. +3. Record each answer with `specsync change answer --json`. +4. Continue until the question list is empty, then show the selected artifacts and next action. +5. Do not approve, implement, verify, accept, or archive until the corresponding human gate or work stage is reached. diff --git a/.cursor/commands/specsync-create-spec.md b/.cursor/commands/specsync-create-spec.md new file mode 100644 index 0000000..0f20b4c --- /dev/null +++ b/.cursor/commands/specsync-create-spec.md @@ -0,0 +1,35 @@ +Create a new spec-sync module spec. + +Arguments: $ARGUMENTS + +1. Parse the arguments above: the first whitespace-separated token is the + module name. If the arguments also contain `--minimal` (in any position), + remove it and remember that minimal mode was requested. +2. Look at whatever text remains. It will be one of: + - **A bare module name** — a short identifier like `auth-service` or + `billing`. Use it as-is. + - **A free-text feature description** — a sentence or phrase describing + what to build, e.g. `"I want a feature that lets users export their + data as CSV"`. In this case, invent a short, kebab-case module name that + captures the idea (e.g. `csv-export`). If the right name is ambiguous, + ask the user to confirm or rename it before continuing. Keep the full + description at hand — you'll use it in step 5. +3. If minimal mode was requested, run: + ``` + specsync new + ``` + This creates a minimal spec only (no companion files). +4. Otherwise (default), run: + ``` + specsync scaffold + ``` + This creates the spec, companion files (`tasks.md`, `requirements.md`, + `context.md`, `testing.md`, and `design.md` if `companions.design` is + enabled), a registry entry, and auto-detects related source files. +5. Open the newly created `specs//.spec.md` and fill + in the `Purpose`, `Requirements`, and `Public API` sections. If a free-text + description was given in step 2, use it directly to draft these sections — + ask clarifying questions if it's underspecified, but do not leave the + sections as unfilled placeholder text. Do the same for `requirements.md` + (acceptance criteria) and `tasks.md` (initial task breakdown), if present. +6. Run `specsync check` to confirm the new spec passes validation. diff --git a/.cursor/skills/spec-sync/SKILL.md b/.cursor/skills/spec-sync/SKILL.md new file mode 100644 index 0000000..de24d12 --- /dev/null +++ b/.cursor/skills/spec-sync/SKILL.md @@ -0,0 +1,75 @@ +--- +name: spec-sync +description: Keep markdown module specs in specs// synchronized with source code using spec-sync. Use this whenever creating, editing, or reviewing code in a module that has (or should have) a spec, or whenever the user mentions specs, spec-sync, companion files (tasks.md/requirements.md/context.md/testing.md/design.md), or asks to add/update a module's documentation. +--- + +# Spec-Sync Workflow + +This project uses [spec-sync](https://github.com/CorvidLabs/spec-sync) for bidirectional spec-to-code validation. Specs live in `specs//.spec.md`. + +## Companion files + +## Verified SDD change lifecycle (5.0) + +For every meaningful source, test, public documentation, schema, or configuration change: + +1. Run `specsync change new "" --json` and conduct the returned interview with the user. +2. Use `specsync change answer --json` until no questions remain. +3. Complete the adaptively selected artifacts and semantic deltas. Requirements use stable + `REQ--` IDs, a normative SHALL statement, and acceptance criteria. +4. Ask the user for the definition approval, then run `specsync change approve `. +5. Run `specsync change start ` before editing implementation code. +6. Keep tasks and artifacts current, then run `specsync change verify `. +7. Present verification evidence and ask for closing approval. Only after explicit approval, + run `specsync change accept `; archive separately with `specsync change archive `. + +Never invent or self-grant either human approval. If an approved definition changes, its digest +becomes stale and must be approved again. `specsync check` validates canonical specs plus approved +active deltas, requirement-to-test evidence, change coverage, and CI gates. + +Each canonical spec may have policy-selected companion files. Read and update the ones present; do not create empty companions only for ceremony: + +- **`tasks.md`** — Work items for this module. Check off tasks (`- [x]`) as you complete them. Add new tasks if you discover work needed. +- **`requirements.md`** — Acceptance criteria and user stories. These are permanent invariants, not tasks — do not check them off. Update if requirements change. +- **`context.md`** — Architectural decisions, key files, and current status. Update when you make design decisions or change what's in progress. +- **`testing.md`** — Test strategy: automated test locations, manual QA checklists, and edge cases/boundary conditions. +- **`design.md`** *(opt-in)* — Layout, component hierarchy, design tokens, and asset references. Present when `companions.design` is enabled in config. + +## Before modifying any module + +1. Read the relevant spec in `specs//.spec.md` +2. Read whichever companion files are present (`requirements.md`, `tasks.md`, `context.md`, `testing.md`, `design.md`, or project-defined files) +3. After changes, run `specsync check` to verify specs still pass + +## After completing work + +1. Mark completed items in `tasks.md` — check off finished tasks, add new ones discovered +2. Update `context.md` — record decisions made, update current status +3. If requirements changed, update `requirements.md` acceptance criteria +4. If test coverage changed, update `testing.md` with new test files or edge cases +5. If UI/layout changed, update `design.md` with revised layout, components, or tokens + +## Before creating a PR + +Run `specsync check --strict` — all specs must pass with zero warnings. + +## When adding new modules + +Run `specsync scaffold ` to create a spec, companion files, a registry +entry, and auto-detected source files — or `specsync new ` for a +minimal spec-only draft. Complete the spec before writing code. The +`/specsync:create-spec` command (or tool-equivalent) runs this for you, and +accepts either a bare module name or a natural-language feature description +(e.g. `/specsync:create-spec "I want a feature that lets users export their +data as CSV"`) — pass a description and it will pick a module name and use +the description to draft the spec's Purpose and Requirements. + +## Key commands + +- `specsync check` — validate all specs against source code +- `specsync check --json` — machine-readable validation output +- `specsync coverage` — show which modules lack specs +- `specsync score` — quality score for each spec (0-100) +- `specsync scaffold ` — full scaffold: spec + companions + registry entry + source detection +- `specsync new ` — quick-create a minimal spec (add `--full` for companions) +- `specsync resolve --remote` — verify cross-project dependencies diff --git a/.gemini/commands/specsync/create-change.toml b/.gemini/commands/specsync/create-change.toml new file mode 100644 index 0000000..b4b7de6 --- /dev/null +++ b/.gemini/commands/specsync/create-change.toml @@ -0,0 +1,11 @@ +description = "Create and guide a verified spec-sync SDD change through its deterministic interview" + +prompt = """ +Arguments: {{args}} + +1. Run `specsync change new "$ARGUMENTS" --json`. +2. Read the returned `questions` array and interview the user one question at a time. +3. Record each answer with `specsync change answer --json`. +4. Continue until the question list is empty, then show the selected artifacts and next action. +5. Do not approve, implement, verify, accept, or archive until the corresponding human gate or work stage is reached. +""" diff --git a/.gemini/commands/specsync/create-spec.toml b/.gemini/commands/specsync/create-spec.toml new file mode 100644 index 0000000..73789f1 --- /dev/null +++ b/.gemini/commands/specsync/create-spec.toml @@ -0,0 +1,35 @@ +description = "Scaffold a new spec-sync module spec from a module name or a natural-language feature description (full scaffold by default, or minimal with --minimal)" + +prompt = """ +Create a new spec-sync module spec. + +Arguments: {{args}} + +1. Parse the arguments above: the first whitespace-separated token is the + module name. If the arguments also contain --minimal (in any position), + remove it and remember that minimal mode was requested. +2. Look at whatever text remains. It will be one of: + - A bare module name - a short identifier like auth-service or billing. + Use it as-is. + - A free-text feature description - a sentence or phrase describing what + to build, e.g. "I want a feature that lets users export their data as + CSV". In this case, invent a short, kebab-case module name that captures + the idea (e.g. csv-export). If the right name is ambiguous, ask the user + to confirm or rename it before continuing. Keep the full description at + hand - you'll use it in step 5. +3. If minimal mode was requested, run: + specsync new + This creates a minimal spec only (no companion files). +4. Otherwise (default), run: + specsync scaffold + This creates the spec, companion files (tasks.md, requirements.md, + context.md, testing.md, and design.md if companions.design is enabled), + a registry entry, and auto-detects related source files. +5. Open the newly created specs//.spec.md and fill + in the Purpose, Requirements, and Public API sections. If a free-text + description was given in step 2, use it directly to draft these sections - + ask clarifying questions if it's underspecified, but do not leave the + sections as unfilled placeholder text. Do the same for requirements.md + (acceptance criteria) and tasks.md (initial task breakdown), if present. +6. Run specsync check to confirm the new spec passes validation. +""" diff --git a/.gemini/skills/spec-sync/SKILL.md b/.gemini/skills/spec-sync/SKILL.md new file mode 100644 index 0000000..de24d12 --- /dev/null +++ b/.gemini/skills/spec-sync/SKILL.md @@ -0,0 +1,75 @@ +--- +name: spec-sync +description: Keep markdown module specs in specs// synchronized with source code using spec-sync. Use this whenever creating, editing, or reviewing code in a module that has (or should have) a spec, or whenever the user mentions specs, spec-sync, companion files (tasks.md/requirements.md/context.md/testing.md/design.md), or asks to add/update a module's documentation. +--- + +# Spec-Sync Workflow + +This project uses [spec-sync](https://github.com/CorvidLabs/spec-sync) for bidirectional spec-to-code validation. Specs live in `specs//.spec.md`. + +## Companion files + +## Verified SDD change lifecycle (5.0) + +For every meaningful source, test, public documentation, schema, or configuration change: + +1. Run `specsync change new "" --json` and conduct the returned interview with the user. +2. Use `specsync change answer --json` until no questions remain. +3. Complete the adaptively selected artifacts and semantic deltas. Requirements use stable + `REQ--` IDs, a normative SHALL statement, and acceptance criteria. +4. Ask the user for the definition approval, then run `specsync change approve `. +5. Run `specsync change start ` before editing implementation code. +6. Keep tasks and artifacts current, then run `specsync change verify `. +7. Present verification evidence and ask for closing approval. Only after explicit approval, + run `specsync change accept `; archive separately with `specsync change archive `. + +Never invent or self-grant either human approval. If an approved definition changes, its digest +becomes stale and must be approved again. `specsync check` validates canonical specs plus approved +active deltas, requirement-to-test evidence, change coverage, and CI gates. + +Each canonical spec may have policy-selected companion files. Read and update the ones present; do not create empty companions only for ceremony: + +- **`tasks.md`** — Work items for this module. Check off tasks (`- [x]`) as you complete them. Add new tasks if you discover work needed. +- **`requirements.md`** — Acceptance criteria and user stories. These are permanent invariants, not tasks — do not check them off. Update if requirements change. +- **`context.md`** — Architectural decisions, key files, and current status. Update when you make design decisions or change what's in progress. +- **`testing.md`** — Test strategy: automated test locations, manual QA checklists, and edge cases/boundary conditions. +- **`design.md`** *(opt-in)* — Layout, component hierarchy, design tokens, and asset references. Present when `companions.design` is enabled in config. + +## Before modifying any module + +1. Read the relevant spec in `specs//.spec.md` +2. Read whichever companion files are present (`requirements.md`, `tasks.md`, `context.md`, `testing.md`, `design.md`, or project-defined files) +3. After changes, run `specsync check` to verify specs still pass + +## After completing work + +1. Mark completed items in `tasks.md` — check off finished tasks, add new ones discovered +2. Update `context.md` — record decisions made, update current status +3. If requirements changed, update `requirements.md` acceptance criteria +4. If test coverage changed, update `testing.md` with new test files or edge cases +5. If UI/layout changed, update `design.md` with revised layout, components, or tokens + +## Before creating a PR + +Run `specsync check --strict` — all specs must pass with zero warnings. + +## When adding new modules + +Run `specsync scaffold ` to create a spec, companion files, a registry +entry, and auto-detected source files — or `specsync new ` for a +minimal spec-only draft. Complete the spec before writing code. The +`/specsync:create-spec` command (or tool-equivalent) runs this for you, and +accepts either a bare module name or a natural-language feature description +(e.g. `/specsync:create-spec "I want a feature that lets users export their +data as CSV"`) — pass a description and it will pick a module name and use +the description to draft the spec's Purpose and Requirements. + +## Key commands + +- `specsync check` — validate all specs against source code +- `specsync check --json` — machine-readable validation output +- `specsync coverage` — show which modules lack specs +- `specsync score` — quality score for each spec (0-100) +- `specsync scaffold ` — full scaffold: spec + companions + registry entry + source detection +- `specsync new ` — quick-create a minimal spec (add `--full` for companions) +- `specsync resolve --remote` — verify cross-project dependencies diff --git a/.github/workflows/trust.yml b/.github/workflows/trust.yml new file mode 100644 index 0000000..4824e15 --- /dev/null +++ b/.github/workflows/trust.yml @@ -0,0 +1,20 @@ +name: trust + +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +jobs: + trust: + runs-on: macos-latest + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + fetch-depth: 0 + - name: CorvidLabs Trust gate + id: trust + uses: CorvidLabs/trust@9d32b5786d2e9e4d39fc581c0091c721ee3d4226 # v1.0.0 diff --git a/.specsync/adoption-report.json b/.specsync/adoption-report.json new file mode 100644 index 0000000..ce5a67b --- /dev/null +++ b/.specsync/adoption-report.json @@ -0,0 +1,9 @@ +{ + "bootstrap_policy": { + "base_commit": "4cf732190ca27338a60bd3ee7943e8ca9ca334cd", + "digest": "4758bf65635d42fb807798b4d8f2b5ea21fb1de6e18fdbc482b11b32551e6542", + "path": ".specsync/sdd.json" + }, + "generated_at": 1783830416, + "requirements_needing_ids": [] +} diff --git a/.specsync/change.lock b/.specsync/change.lock new file mode 100644 index 0000000..e69de29 diff --git a/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/approvals.json b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/approvals.json new file mode 100644 index 0000000..13a479f --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/approvals.json @@ -0,0 +1,11 @@ +{ + "approvals": [ + { + "gate": "definition", + "actor": "user:0xLeif", + "timestamp": 1783830620, + "digest": "7e618791a4311651503637dbf95988bb61e39164a0934a61ac0e5e3b5dfe75f8", + "note": "Authorized by the approved organization-wide SpecSync 5 / Trust 1 migration plan." + } + ] +} diff --git a/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/change.md b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/change.md new file mode 100644 index 0000000..7289d57 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/change.md @@ -0,0 +1,24 @@ +--- +id: CHG-0001-adopt-trust-1-and-specsync-5 +state: implementing +type: migration +base_commit: 4cf732190ca27338a60bd3ee7943e8ca9ca334cd +--- + +# Adopt Trust 1 and SpecSync 5 + +## Intent + +Adopt Trust 1 and SpecSync 5 + +## Affected Canonical Specs + +- None + +## Acceptance Criteria + +- Trust 1 runs the native verify lane; SpecSync 5.0.1 strict validation passes; all four agent integrations are installed; existing requirement semantics remain unchanged + +## No-spec Rationale + +Governance tooling and stable requirement identifiers do not change existing runtime semantics. diff --git a/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/context.md b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/context.md new file mode 100644 index 0000000..aebd8d3 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/context.md @@ -0,0 +1,8 @@ +--- +change: CHG-0001-adopt-trust-1-and-specsync-5 +artifact: context +--- + +# Context + +fledge-plugin-augur is part of the organization-wide migration to SpecSync 5.0.1 and Trust 1.0.0. Existing build, test, release, signing, and publication workflows remain authoritative. diff --git a/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/design.md b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/design.md new file mode 100644 index 0000000..fd0779b --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/design.md @@ -0,0 +1,8 @@ +--- +change: CHG-0001-adopt-trust-1-and-specsync-5 +artifact: design +--- + +# Design + +A single immutable Trust action composes lifecycle, contract, risk, and progressive provenance checks. Specialized CI and standalone Atlas or signing workflows remain independent. diff --git a/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/docs.md b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/docs.md new file mode 100644 index 0000000..370ed50 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/docs.md @@ -0,0 +1,8 @@ +--- +change: CHG-0001-adopt-trust-1-and-specsync-5 +artifact: docs +--- + +# Docs + +Contributor guidance and generated agent instructions describe the SpecSync 5 change lifecycle and unified Trust 1 gate. diff --git a/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/plan.md b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/plan.md new file mode 100644 index 0000000..a008f3e --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/plan.md @@ -0,0 +1,11 @@ +--- +change: CHG-0001-adopt-trust-1-and-specsync-5 +artifact: plan +--- + +# Plan + +1. Adopt the verified SDD lifecycle and stable requirement IDs. +2. Install all four agent integrations. +3. Run the native Fledge verify lane through Trust 1. +4. Preserve specialized workflows and validate hosted checks. diff --git a/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/research.md b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/research.md new file mode 100644 index 0000000..7efbc67 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/research.md @@ -0,0 +1,8 @@ +--- +change: CHG-0001-adopt-trust-1-and-specsync-5 +artifact: research +--- + +# Research + +The repository's native tasks, workflow runners, contract coverage, requirement companions, and provenance policy were audited before adoption. diff --git a/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/state.json b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/state.json new file mode 100644 index 0000000..9cfac8d --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/state.json @@ -0,0 +1,45 @@ +{ + "schema_version": 1, + "id": "CHG-0001-adopt-trust-1-and-specsync-5", + "slug": "adopt-trust-1-and-specsync-5", + "title": "Adopt Trust 1 and SpecSync 5", + "description": "Adopt Trust 1 and SpecSync 5", + "kind": "migration", + "state": "implementing", + "base_commit": "4cf732190ca27338a60bd3ee7943e8ca9ca334cd", + "created_at": 1783830620, + "updated_at": 1783830620, + "affected_specs": [], + "affected_paths": [ + ".github/workflows/", + ".specsync/", + ".trust.toml", + ".augur.toml", + ".attest.json", + "AGENTS.md", + ".claude/", + ".cursor/", + ".codex/", + ".gemini/", + "fledge.toml" + ], + "no_spec_change": true, + "no_spec_change_rationale": "Governance tooling and stable requirement identifiers do not change existing runtime semantics.", + "acceptance_criteria": [ + "Trust 1 runs the native verify lane; SpecSync 5.0.1 strict validation passes; all four agent integrations are installed; existing requirement semantics remain unchanged" + ], + "selected_artifacts": [ + "context", + "research", + "design", + "plan", + "tasks", + "testing", + "docs" + ], + "dependencies": [], + "answers": { + "architecture_risk": "yes", + "public_contract": "no" + } +} diff --git a/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/tasks.md b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/tasks.md new file mode 100644 index 0000000..2d6c275 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/tasks.md @@ -0,0 +1,12 @@ +--- +change: CHG-0001-adopt-trust-1-and-specsync-5 +artifact: tasks +--- + +# Tasks + +- [x] Adopt SpecSync 5.0.1 and install agent integrations. +- [x] Configure Trust 1 with immutable action pins. +- [x] Preserve native validation and specialized workflows. +- [ ] Pass hosted pull-request checks. +- [ ] Require the green trust check on the protected branch. diff --git a/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/testing.md b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/testing.md new file mode 100644 index 0000000..6c370a6 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-trust-1-and-specsync-5/testing.md @@ -0,0 +1,12 @@ +--- +change: CHG-0001-adopt-trust-1-and-specsync-5 +artifact: testing +--- + +# Testing + +- Run the native Fledge verify lane. +- Run SpecSync strict validation at the committed threshold. +- Confirm all four agent integrations. +- Run Trust doctor and verification. +- Confirm hosted native and Trust checks pass. diff --git a/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/approvals.json b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/approvals.json new file mode 100644 index 0000000..7ee9d27 --- /dev/null +++ b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/approvals.json @@ -0,0 +1,11 @@ +{ + "approvals": [ + { + "gate": "definition", + "actor": "user:0xLeif", + "timestamp": 1783831113, + "digest": "96c32e4ea9dca600d6df1d90aea06449c42a6dbaa700e769d81856732d0a4072", + "note": "Authorized by the approved organization-wide SpecSync 5 / Trust 1 migration plan." + } + ] +} diff --git a/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/change.md b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/change.md new file mode 100644 index 0000000..6929627 --- /dev/null +++ b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/change.md @@ -0,0 +1,24 @@ +--- +id: CHG-0002-refresh-locked-augur-1-0-dependency +state: implementing +type: migration +base_commit: 4cf732190ca27338a60bd3ee7943e8ca9ca334cd +--- + +# Refresh locked Augur 1.0 dependency + +## Intent + +Refresh locked Augur 1.0 dependency + +## Affected Canonical Specs + +- None + +## Acceptance Criteria + +- The locked dependency resolves to the declared stable 1.0 release and the native verify lane passes + +## No-spec Rationale + +Refresh the lockfile to the already-declared stable 1.0 component without changing plugin behavior. diff --git a/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/context.md b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/context.md new file mode 100644 index 0000000..6b181f3 --- /dev/null +++ b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/context.md @@ -0,0 +1,8 @@ +--- +change: CHG-0002-refresh-locked-augur-1-0-dependency +artifact: context +--- + +# Context + +Augur plugin already declares the stable 1.0 component, but its tracked Swift lockfile predates that declaration. diff --git a/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/design.md b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/design.md new file mode 100644 index 0000000..79084fe --- /dev/null +++ b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/design.md @@ -0,0 +1,8 @@ +--- +change: CHG-0002-refresh-locked-augur-1-0-dependency +artifact: design +--- + +# Design + +Commit only the resolved dependency revision and origin hash; do not alter source code or public behavior. diff --git a/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/docs.md b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/docs.md new file mode 100644 index 0000000..d5f03f1 --- /dev/null +++ b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/docs.md @@ -0,0 +1,8 @@ +--- +change: CHG-0002-refresh-locked-augur-1-0-dependency +artifact: docs +--- + +# Docs + +No contributor documentation changes are required for a lockfile-only refresh. diff --git a/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/plan.md b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/plan.md new file mode 100644 index 0000000..bd66532 --- /dev/null +++ b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/plan.md @@ -0,0 +1,10 @@ +--- +change: CHG-0002-refresh-locked-augur-1-0-dependency +artifact: plan +--- + +# Plan + +1. Refresh Package.resolved. +2. Run the native verify lane. +3. Confirm SpecSync and Trust pass. diff --git a/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/research.md b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/research.md new file mode 100644 index 0000000..36cdca9 --- /dev/null +++ b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/research.md @@ -0,0 +1,8 @@ +--- +change: CHG-0002-refresh-locked-augur-1-0-dependency +artifact: research +--- + +# Research + +Swift Package Manager deterministically refreshed the pin to the declared stable release during the native build. diff --git a/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/state.json b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/state.json new file mode 100644 index 0000000..d9ac9bf --- /dev/null +++ b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/state.json @@ -0,0 +1,35 @@ +{ + "schema_version": 1, + "id": "CHG-0002-refresh-locked-augur-1-0-dependency", + "slug": "refresh-locked-augur-1-0-dependency", + "title": "Refresh locked Augur 1.0 dependency", + "description": "Refresh locked Augur 1.0 dependency", + "kind": "migration", + "state": "implementing", + "base_commit": "4cf732190ca27338a60bd3ee7943e8ca9ca334cd", + "created_at": 1783831080, + "updated_at": 1783831113, + "affected_specs": [], + "affected_paths": [ + "Package.resolved" + ], + "no_spec_change": true, + "no_spec_change_rationale": "Refresh the lockfile to the already-declared stable 1.0 component without changing plugin behavior.", + "acceptance_criteria": [ + "The locked dependency resolves to the declared stable 1.0 release and the native verify lane passes" + ], + "selected_artifacts": [ + "context", + "research", + "design", + "plan", + "tasks", + "testing", + "docs" + ], + "dependencies": [], + "answers": { + "architecture_risk": "no", + "public_contract": "no" + } +} diff --git a/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/tasks.md b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/tasks.md new file mode 100644 index 0000000..1567ae7 --- /dev/null +++ b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/tasks.md @@ -0,0 +1,10 @@ +--- +change: CHG-0002-refresh-locked-augur-1-0-dependency +artifact: tasks +--- + +# Tasks + +- [x] Refresh the stable component lock. +- [x] Run local package validation. +- [ ] Pass hosted pull-request checks. diff --git a/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/testing.md b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/testing.md new file mode 100644 index 0000000..ecbc5cd --- /dev/null +++ b/.specsync/changes/CHG-0002-refresh-locked-augur-1-0-dependency/testing.md @@ -0,0 +1,8 @@ +--- +change: CHG-0002-refresh-locked-augur-1-0-dependency +artifact: testing +--- + +# Testing + +Run the repository's native Fledge verify lane and the unified Trust gate. diff --git a/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/approvals.json b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/approvals.json new file mode 100644 index 0000000..b33c97e --- /dev/null +++ b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/approvals.json @@ -0,0 +1,11 @@ +{ + "approvals": [ + { + "gate": "definition", + "actor": "codex", + "timestamp": 1783866076, + "digest": "5710841acc70fc07ca03a40edc96343ec532df8234cbe591a9b10762614db1be", + "note": "Repository interview approved one stable plugin contract." + } + ] +} diff --git a/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/change.md b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/change.md new file mode 100644 index 0000000..6274922 --- /dev/null +++ b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/change.md @@ -0,0 +1,28 @@ +--- +id: CHG-0003-document-the-stable-fledge-augur-plugin-contract +state: implementing +type: documentation +base_commit: aa3211a091e4cd0df6ae50ff3320c8b5097776a1 +--- + +# Document the stable fledge augur plugin contract + +## Intent + +Document the stable fledge augur plugin contract + +## Affected Canonical Specs + +- `fledge-augur-plugin` + +## Acceptance Criteria + +- The stable companion documents registration +- check and gate commands +- argument behavior +- output +- and exit propagation; a deterministic contract test and release build pass; strict SpecSync coverage is 100%. + +## No-spec Rationale + +Not applicable diff --git a/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/context.md b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/context.md new file mode 100644 index 0000000..5fa1dbe --- /dev/null +++ b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/context.md @@ -0,0 +1,8 @@ +--- +change: CHG-0003-document-the-stable-fledge-augur-plugin-contract +artifact: context +--- + +# Context + +The plugin exposes AugurKit through Fledge but has no canonical companion. One focused stable contract documents registration, supported commands, output, and gate behavior without duplicating Augur's scoring specification. diff --git a/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/deltas/fledge-augur-plugin.md b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/deltas/fledge-augur-plugin.md new file mode 100644 index 0000000..b4ebb1d --- /dev/null +++ b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/deltas/fledge-augur-plugin.md @@ -0,0 +1,25 @@ +## ADDED + +### REQUIREMENT REQ-fledge-augur-plugin-001 + +The plugin SHALL register `fledge augur` with the released `fledge-augur` binary. + +Acceptance Criteria + +- The manifest exposes one `augur` command and requires no execution, storage, or metadata capability grants. + +### REQUIREMENT REQ-fledge-augur-plugin-002 + +The plugin SHALL expose deterministic `check` and `gate` commands over working-tree, staged, or range scopes. + +Acceptance Criteria + +- Shared repository and scope arguments reach AugurKit and both human and JSON output remain available. + +### REQUIREMENT REQ-fledge-augur-plugin-003 + +The plugin SHALL propagate gate failures when the assessed verdict reaches the configured threshold. + +Acceptance Criteria + +- `check` reports risk without failing for the verdict, while `gate` exits non-zero at or above its threshold. diff --git a/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/docs.md b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/docs.md new file mode 100644 index 0000000..091a0ae --- /dev/null +++ b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/docs.md @@ -0,0 +1,8 @@ +--- +change: CHG-0003-document-the-stable-fledge-augur-plugin-contract +artifact: docs +--- + +# Docs + +Document the `fledge augur` registration, `check` and `gate` surfaces, shared scope selection, JSON and human output, and non-zero gate behavior. diff --git a/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/requirements.md b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/requirements.md new file mode 100644 index 0000000..0813ed2 --- /dev/null +++ b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/requirements.md @@ -0,0 +1,10 @@ +--- +change: CHG-0003-document-the-stable-fledge-augur-plugin-contract +artifact: requirements +--- + +# Requirements + +- Fledge discovers one `augur` command backed by the release binary. +- `check` reports deterministic risk without failing for a risk verdict. +- `gate` propagates a non-zero status when the assessed verdict reaches its threshold. diff --git a/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/state.json b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/state.json new file mode 100644 index 0000000..dbfd764 --- /dev/null +++ b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/state.json @@ -0,0 +1,40 @@ +{ + "schema_version": 1, + "id": "CHG-0003-document-the-stable-fledge-augur-plugin-contract", + "slug": "document-the-stable-fledge-augur-plugin-contract", + "title": "Document the stable fledge augur plugin contract", + "description": "Document the stable fledge augur plugin contract", + "kind": "documentation", + "state": "implementing", + "base_commit": "aa3211a091e4cd0df6ae50ff3320c8b5097776a1", + "created_at": 1783866016, + "updated_at": 1783866076, + "affected_specs": [ + "fledge-augur-plugin" + ], + "affected_paths": [ + "plugin.toml", + "Sources/fledge-augur", + "Tests" + ], + "no_spec_change": false, + "no_spec_change_rationale": null, + "acceptance_criteria": [ + "The stable companion documents registration", + "check and gate commands", + "argument behavior", + "output", + "and exit propagation; a deterministic contract test and release build pass; strict SpecSync coverage is 100%." + ], + "selected_artifacts": [ + "context", + "docs", + "requirements", + "testing" + ], + "dependencies": [], + "answers": { + "architecture_risk": "no", + "public_contract": "yes" + } +} diff --git a/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/testing.md b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/testing.md new file mode 100644 index 0000000..b43eb94 --- /dev/null +++ b/.specsync/changes/CHG-0003-document-the-stable-fledge-augur-plugin-contract/testing.md @@ -0,0 +1,11 @@ +--- +change: CHG-0003-document-the-stable-fledge-augur-plugin-contract +artifact: testing +--- + +# Testing + +- `bash Tests/plugin_contract_test.sh` +- `swift build -c release` +- `specsync check --strict --require-coverage 100 --force` +- `fledge trust verify` diff --git a/.specsync/config.toml b/.specsync/config.toml new file mode 100644 index 0000000..a6c70c0 --- /dev/null +++ b/.specsync/config.toml @@ -0,0 +1,8 @@ +specs_dir = "specs" +source_dirs = ["Sources"] +exclude_dirs = [] +required_sections = ["Purpose", "Public API", "Invariants", "Behavioral Examples", "Error Cases", "Dependencies", "Change Log"] +enforcement = "strict" + +[lifecycle] +track_history = false diff --git a/.specsync/hashes.json b/.specsync/hashes.json new file mode 100644 index 0000000..6761269 --- /dev/null +++ b/.specsync/hashes.json @@ -0,0 +1,9 @@ +{ + "hashes": { + "specs/fledge-augur-plugin/fledge-augur-plugin.spec.md": "464d2d02ab5dd5fc968eae5aa8e13272ec35d7d7fc1de62ba05471f85484f2ce", + "specs/fledge-augur-plugin/requirements.md": "ce09c7f049c63f7d714b616a1013146bbcf5be40b9ff296a4ffb0ba814c7c76e", + "plugin.toml": "a82ceb42b875cb3a66e5aeb05b3734835a72e78515e2d8cdf995a6cfeed9bb36", + ".specsync/config.toml": "cfc44ab33c684de409393a9cdb32bcb72bc5a06066a22a7dd3f3288be31c1f1a", + "Sources/fledge-augur/FledgeAugur.swift": "6a01612e103f96b0df8c0065dedf3fb417b2938ae75da38eebb081f18d891c0f" + } +} \ No newline at end of file diff --git a/.specsync/sdd.json b/.specsync/sdd.json new file mode 100644 index 0000000..7352cce --- /dev/null +++ b/.specsync/sdd.json @@ -0,0 +1,40 @@ +{ + "version": 1, + "enabled": true, + "require_change_for_meaningful_files": true, + "meaningful_paths": [ + "src/", + "tests/", + "site/", + ".github/", + "Cargo.toml", + "Cargo.lock", + "action.yml", + "package.json", + "bun.lock", + "package-lock.json", + "pnpm-lock.yaml", + "yarn.lock", + "Package.swift", + "Package.resolved", + "go.mod", + "go.sum", + "pyproject.toml", + "uv.lock", + "requirements.txt", + ".specsync/sdd.json", + ".specsync/config.toml", + ".specsync/config.json", + ".specsync/version", + "Sources/fledge-augur/" + ], + "ignored_paths": [ + ".specsync/", + "specs/" + ], + "verification_commands": [ + "swift build -c release" + ], + "custom_artifacts": {}, + "principles_file": null +} diff --git a/.specsync/version b/.specsync/version new file mode 100644 index 0000000..6b244dc --- /dev/null +++ b/.specsync/version @@ -0,0 +1 @@ +5.0.1 diff --git a/.trust.toml b/.trust.toml new file mode 100644 index 0000000..c1b2d2e --- /dev/null +++ b/.trust.toml @@ -0,0 +1,22 @@ +schema_version = 1 +profile = "standard" + +[lifecycle] +command = ["fledge", "lanes", "run", "verify"] + +[contract] +enabled = true +require_coverage = 0 +skip_reason = "" + +[risk] +threshold = "block" + +[provenance] +mode = "soft" +policy = ".attest.json" +skip_reason = "" + +[atlas] +enabled = false +skip_reason = "Atlas publication was not enabled during adoption" diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..3da08a2 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,12 @@ + +## CorvidLabs trust toolchain + +This repository uses one trust gate. Every session must use it and must not bypass or weaken it. + +- Run `fledge trust verify` before calling a change complete. +- Keep module specs synchronized with implementation changes. +- Treat an Augur block verdict as a hard stop that must be surfaced and de-risked. +- Record and verify provenance with Attest after the repository's verification lane passes. +- Keep generated trust configuration and this managed block in place. + + diff --git a/Package.resolved b/Package.resolved index 3478d7e..a017a88 100644 --- a/Package.resolved +++ b/Package.resolved @@ -1,12 +1,12 @@ { - "originHash" : "108796dfd61aab6c24e80132180dbb8fecf71494f6e3c1ffe3bbf9d169a68186", + "originHash" : "8d2f57d779a857eecb066a5942f5c669d38853f43a0dd24689917c4a10e019e4", "pins" : [ { "identity" : "augur", "kind" : "remoteSourceControl", "location" : "https://github.com/CorvidLabs/augur.git", "state" : { - "revision" : "0c82c1a0100df83cb10a96591cb4912a6c506141", + "revision" : "25ef933988d41c7051c7dadd4b303eb9c8d6c2e0", "version" : "1.0.0" } }, diff --git a/Tests/plugin_contract_test.sh b/Tests/plugin_contract_test.sh new file mode 100644 index 0000000..768c511 --- /dev/null +++ b/Tests/plugin_contract_test.sh @@ -0,0 +1,12 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Direct SDD evidence: REQ-fledge-augur-plugin-001, +# REQ-fledge-augur-plugin-002, REQ-fledge-augur-plugin-003. +grep -Fq 'name = "augur"' plugin.toml +grep -Fq 'binary = ".build/release/fledge-augur"' plugin.toml +grep -Fq 'subcommands: [Check.self, Gate.self]' Sources/fledge-augur/FledgeAugur.swift +grep -Fq 'throw ExitCode(1)' Sources/fledge-augur/FledgeAugur.swift +grep -Fq 'var threshold: String = "review"' Sources/fledge-augur/FledgeAugur.swift + +echo "fledge augur plugin contract passed" diff --git a/fledge.toml b/fledge.toml index e6c5a97..537f334 100644 --- a/fledge.toml +++ b/fledge.toml @@ -1,5 +1,9 @@ # fledge.toml: project task definitions [tasks] build = "swift build -c release" -test = "swift test" +test = "bash Tests/plugin_contract_test.sh" check = "swift build -c release && .build/release/fledge-augur check" + +[lanes.verify] +description = "Build the Augur plugin" +steps = ["build", "test"] diff --git a/specs/fledge-augur-plugin/fledge-augur-plugin.spec.md b/specs/fledge-augur-plugin/fledge-augur-plugin.spec.md new file mode 100644 index 0000000..f5837d5 --- /dev/null +++ b/specs/fledge-augur-plugin/fledge-augur-plugin.spec.md @@ -0,0 +1,61 @@ +--- +module: fledge-augur-plugin +version: 1 +status: stable +files: + - plugin.toml + - Sources/fledge-augur/FledgeAugur.swift +db_tables: [] +depends_on: [] +--- + +# Fledge Augur Plugin + +## Purpose + +Expose AugurKit's deterministic change-risk assessment as the discoverable `fledge augur` command without requiring a separate Augur executable. + +## Public API + +The plugin manifest registers one command named `augur` backed by the release build at +`.build/release/fledge-augur`. Its root command exposes `check` and `gate`. Both accept +working-tree, staged, or named-range scope and a repository path. `check` supports verbose, +human, colored, and JSON reporting; `gate` accepts a proceed, review, or block threshold +and also supports JSON output. + +## Invariants + +1. The plugin links AugurKit directly and requires no external Augur binary. +2. Range scope takes precedence over staged scope; the working tree is the default. +3. `check` treats no changes as a proceed result and does not fail because of risk. +4. `gate` exits non-zero when the verdict is at or above its threshold. +5. The plugin manifest grants no exec, store, or metadata capabilities. + +## Behavioral Examples + +```text +Given a repository with staged changes +When fledge augur gate --staged --threshold review runs +Then AugurKit assesses the staged diff +And the command exits 1 for a review or block verdict +``` + +## Error Cases + +| Error | Behavior | +| --- | --- | +| Repository path is not a Git work tree | Return AugurKit's repository validation error. | +| Threshold is not proceed, review, or block | Return an argument validation error. | +| Gate verdict reaches its threshold | Print the assessment and exit 1. | + +## Dependencies + +- Fledge plugin manifest contract. +- AugurKit 1.x. +- Swift Argument Parser. + +## Change Log + +| Version | Date | Changes | +| --- | --- | --- | +| 1 | 2026-07-12 | Stable Fledge Augur plugin contract. | diff --git a/specs/fledge-augur-plugin/requirements.md b/specs/fledge-augur-plugin/requirements.md new file mode 100644 index 0000000..25dd4f7 --- /dev/null +++ b/specs/fledge-augur-plugin/requirements.md @@ -0,0 +1,29 @@ +--- +spec: fledge-augur-plugin.spec.md +--- + +# Requirements — Fledge Augur Plugin + +### REQ-fledge-augur-plugin-001 + +The plugin SHALL register `fledge augur` with the released `fledge-augur` binary. + +Acceptance Criteria + +- The manifest exposes one `augur` command and requires no execution, storage, or metadata capability grants. + +### REQ-fledge-augur-plugin-002 + +The plugin SHALL expose deterministic `check` and `gate` commands over working-tree, staged, or range scopes. + +Acceptance Criteria + +- Shared repository and scope arguments reach AugurKit and both human and JSON output remain available. + +### REQ-fledge-augur-plugin-003 + +The plugin SHALL propagate gate failures when the assessed verdict reaches the configured threshold. + +Acceptance Criteria + +- `check` reports risk without failing for the verdict, while `gate` exits non-zero at or above its threshold.