SDP v0.9.5: Phase 0 + protocol E2E — unified OSS update

.beads-sdp-mapping.jsonl

@@ -0,0 +1,54 @@
+{"sdp_id":"00-001-01","beads_id":"sdp_dev-8gt","updated_at":"2026-02-22T20:18:42.000Z"}
+{"sdp_id":"00-001-02","beads_id":"sdp_dev-p3y","updated_at":"2026-02-22T20:18:42.000Z"}
+{"sdp_id":"00-002-01","beads_id":"sdp_dev-63h","updated_at":"2026-02-22T20:18:42.000Z"}
+{"sdp_id":"00-002-02","beads_id":"sdp_dev-y2h","updated_at":"2026-02-22T20:18:42.000Z"}
+{"sdp_id":"00-002-03","beads_id":"sdp_dev-1gh","updated_at":"2026-02-22T20:18:42.000Z"}
+{"sdp_id":"00-003-01","beads_id":"sdp_dev-0o2","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-003-02","beads_id":"sdp_dev-3xi","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-004-01","beads_id":"sdp_dev-uyn","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-004-02","beads_id":"sdp_dev-45l","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-004-03","beads_id":"sdp_dev-5jb","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-005-01","beads_id":"sdp_dev-6mi","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-006-01","beads_id":"sdp_dev-dcq","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-006-02","beads_id":"sdp_dev-e5n","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-007-01","beads_id":"sdp_dev-qet","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-007-02","beads_id":"sdp_dev-5xd","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-008-01","beads_id":"sdp_dev-9661","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-008-02","beads_id":"sdp_dev-dlok","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-009-01","beads_id":"sdp_dev-ktfr","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-009-02","beads_id":"sdp_dev-bxfn","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-010-01","beads_id":"sdp_dev-5ngw","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-011-01","beads_id":"sdp_dev-5cn2","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-011-02","beads_id":"sdp_dev-lb2p","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-012-01","beads_id":"sdp_dev-yall","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-013-01","beads_id":"sdp_dev-l6xx","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-013-02","beads_id":"sdp_dev-7ms2","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-013-03","beads_id":"sdp_dev-x9j1","updated_at":"2026-02-22T22:00:00.000Z"}
+{"sdp_id":"00-014-01","beads_id":"sdp_dev-u7db","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-014-02","beads_id":"sdp_dev-3vtt","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-015-01","beads_id":"sdp_dev-jt9x","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-015-02","beads_id":"sdp_dev-3l1m","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-016-01","beads_id":"sdp_dev-kvsi","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-016-02","beads_id":"sdp_dev-dhip","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-016-03","beads_id":"sdp_dev-yxql","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-017-01","beads_id":"sdp_dev-8n59","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-017-02","beads_id":"sdp_dev-iv35","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-018-01","beads_id":"sdp_dev-mfs9","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-018-02","beads_id":"sdp_dev-7a1a","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-018-03","beads_id":"sdp_dev-tivd","updated_at":"2026-02-23T20:00:00.000Z"}
+{"sdp_id":"00-019-01","beads_id":"sdp_dev-b5hl","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-019-02","beads_id":"sdp_dev-hbum","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-019-03","beads_id":"sdp_dev-0fld","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-020-01","beads_id":"sdp_dev-s8ky","updated_at":"2026-02-23T12:00:00.000Z"}
+{"sdp_id":"00-016-04","beads_id":"sdp_dev-5xsz","updated_at":"2026-02-23T12:08:00.000Z"}
+{"sdp_id":"00-021-01","beads_id":"sdp_dev-ap8x","updated_at":"2026-02-23T13:00:00.000Z"}
+{"sdp_id":"00-022-01","beads_id":"sdp_dev-bdwr","updated_at":"2026-02-23T19:00:00.000Z"}
+{"sdp_id":"00-023-01","beads_id":"sdp_dev-tisy","updated_at":"2026-02-23T19:00:00.000Z"}
+{"sdp_id":"00-023-02","beads_id":"sdp_dev-h3y5","updated_at":"2026-02-23T19:00:00.000Z"}
+{"sdp_id":"00-024-01","beads_id":"sdp_dev-bl3s","updated_at":"2026-02-23T19:00:00.000Z"}
+{"sdp_id":"00-025-01","beads_id":"sdp_dev-h7qu","updated_at":"2026-02-23T19:00:00.000Z"}
+{"sdp_id":"00-026-01","beads_id":"sdp_dev-5pl6","updated_at":"2026-02-23T19:00:00.000Z"}
+{"sdp_id":"00-027-01","beads_id":"sdp_dev-78hc","updated_at":"2026-02-23T19:00:00.000Z"}
+{"sdp_id":"00-028-01","beads_id":"sdp_dev-jd2q","updated_at":"2026-02-23T00:00:00.000Z"}
+{"sdp_id":"00-029-01","beads_id":"sdp_dev-w69o","updated_at":"2026-02-23T00:00:00.000Z"}
+{"sdp_id":"00-030-01","beads_id":"sdp_dev-tsi6","updated_at":"2026-02-23T00:00:00.000Z"}

.claude/hooks/PreToolUse.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Block destructive git commands before execution.
+# Pre-tool constraint enforcement for SDP agent sessions.
+# Blocks destructive commands and evaluates agent-constraints.yaml rules.
 
 set -euo pipefail
 
@@ -16,6 +17,7 @@ if [ "$TOOL_NAME" != "Bash" ] || [ -z "$COMMAND" ]; then
   exit 0
 fi
 
+# Hard-blocked commands (always, regardless of constraints file)
 if echo "$COMMAND" | grep -Eiq '(^|[[:space:]])git[[:space:]]+reset[[:space:]]+--hard([[:space:]]|$)'; then
   echo "BLOCKED: destructive git command is not allowed: git reset --hard"
   exit 2
@@ -36,4 +38,39 @@ if echo "$COMMAND" | grep -Eiq '(^|[[:space:]])git[[:space:]]+restore[[:space:]]
   exit 2
 fi
 
+# SDP agent-constraints.yaml enforcement.
+# Reads the current phase from .sdp/checkpoints/ if available.
+if command -v sdp-guard >/dev/null 2>&1 && [ -f ".sdp/agent-constraints.yaml" ]; then
+  # Determine current phase from checkpoint (default: build)
+  CURRENT_PHASE="build"
+  for cp_file in .sdp/checkpoints/*.json; do
+    if [ -f "$cp_file" ]; then
+      PHASE_FROM_CP=$(jq -r '.phase // ""' "$cp_file" 2>/dev/null || true)
+      if [ -n "$PHASE_FROM_CP" ] && [ "$PHASE_FROM_CP" != "done" ]; then
+        CURRENT_PHASE="$PHASE_FROM_CP"
+        break
+      fi
+    fi
+  done
+
+  # Check the command against constraint rules
+  RESULT=$(sdp-guard --check-constraints --phase="$CURRENT_PHASE" --command="$COMMAND" 2>&1 || true)
+  EXIT_CODE=$?
+
+  if [ $EXIT_CODE -eq 2 ]; then
+    # halt/escalate: stop agent session
+    echo "$RESULT"
+    echo "HALT: SDP constraint violation requires agent session to stop."
+    exit 2
+  elif [ $EXIT_CODE -eq 1 ]; then
+    # block: reject this specific action
+    echo "$RESULT"
+    exit 2
+  fi
+  # warn (exit 0): log and continue
+  if [ -n "$RESULT" ] && echo "$RESULT" | grep -q "WARN"; then
+    echo "$RESULT" >&2
+  fi
+fi
+
 exit 0

.dockerignore

@@ -0,0 +1,2 @@
+# Exclude .beads so E2E gets fresh sqlite init (host may have dolt/daemon state)
+.beads/

.github/workflows/go-ci.yml

@@ -44,16 +44,17 @@ jobs:
 
       - name: Check coverage threshold
         run: |
-          # Coverage check excludes cmd/sdp (needs integration tests) and internal/quality (external tools)
+          # Coverage check excludes cmd/sdp (integration tests), internal/quality (external tools), internal/watcher (UI-heavy)
+          # Use -count=1 so cached results from other steps don't report stale coverage
           echo "Running coverage check for internal packages..."
-          PACKAGES=$(go list ./... | grep -v -E "cmd/sdp$|internal/quality$")
-          go test -cover $PACKAGES 2>&1 | grep "coverage:"
+          PACKAGES=$(go list ./... | grep -v -E "cmd/sdp$|internal/quality$|internal/watcher$")
+          go test -count=1 -cover $PACKAGES 2>&1 | grep "coverage:"
           echo ""
           # Check if any package is below 80%
-          LOW=$(go test -cover $PACKAGES 2>&1 | grep -E "coverage: (7[0-9]|[0-6][0-9])" | wc -l | tr -d ' ')
+          LOW=$(go test -count=1 -cover $PACKAGES 2>&1 | grep -E "coverage: (7[0-9]|[0-6][0-9])" | wc -l | tr -d ' ')
           if [ "$LOW" -gt "0" ]; then
             echo "❌ Coverage check FAILED - $LOW packages below 80%"
-            go test -cover $PACKAGES 2>&1 | grep -E "coverage: (7[0-9]|[0-6][0-9])"
+            go test -count=1 -cover $PACKAGES 2>&1 | grep -E "coverage: (7[0-9]|[0-6][0-9])"
             exit 1
           else
             echo "✅ Coverage check PASSED - all packages >= 80%"

.github/workflows/go-release.yml

@@ -11,7 +11,14 @@ permissions:
   attestations: write
 
 jobs:
+  protocol-e2e:
+    name: Protocol E2E
+    uses: ./.github/workflows/protocol-e2e-reusable.yml
+    with:
+      submodules: false
+
   release:
+    needs: protocol-e2e
     name: Release with GoReleaser
     runs-on: ubuntu-latest
     defaults:

.github/workflows/protocol-e2e-reusable.yml

@@ -0,0 +1,45 @@
+# Reusable workflow for Protocol E2E (Docker)
+# Called from protocol-e2e.yml, go-release.yml, and sdp_dev release.yml
+name: Protocol E2E (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      submodules:
+        description: 'Checkout with submodules (true for sdp_dev)'
+        required: false
+        default: false
+        type: boolean
+      dockerfile_path:
+        description: 'Path to Dockerfile (sdp_dev uses sdp/ci/Dockerfile.protocol-e2e)'
+        required: false
+        default: 'ci/Dockerfile.protocol-e2e'
+        type: string
+      build_args:
+        description: 'Extra docker build args (e.g. --build-arg SDP_PLUGIN_PATH=sdp/sdp-plugin)'
+        required: false
+        default: ''
+        type: string
+
+jobs:
+  protocol-e2e:
+    name: Protocol E2E (Docker)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: ${{ inputs.submodules }}
+
+      - name: Overlay sdp ci (for sdp_dev build)
+        if: inputs.build_args != ''
+        run: |
+          cp sdp/ci/protocol-e2e-test.sh ci/
+          cp -r sdp/ci/protocol-e2e-fixtures ci/
+
+      - name: Protocol E2E (Docker)
+        env:
+          GLM_API_KEY: ${{ secrets.GLM_API_KEY }}
+        run: |
+          docker build -f ${{ inputs.dockerfile_path }} ${{ inputs.build_args }} -t sdp-protocol-e2e:latest .
+          docker run --rm -e GLM_API_KEY="${GLM_API_KEY}" sdp-protocol-e2e:latest

.github/workflows/protocol-e2e.yml

@@ -0,0 +1,47 @@
+# Protocol E2E - full SDP protocol test before release
+# Runs on PR and tag push; required before release
+name: Protocol E2E
+
+on:
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - "cmd/**"
+      - "internal/**"
+      - "sdp-plugin/**"
+      - "docs/workstreams/**"
+      - ".beads-sdp-mapping.jsonl"
+      - "ci/**"
+      - "schema/**"
+
+permissions:
+  contents: read
+
+jobs:
+  build-test:
+    name: Build and test sdp-plugin
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.26'
+          cache: true
+          cache-dependency-path: sdp-plugin/go.sum
+
+      - name: Build and test sdp-plugin
+        run: |
+          cd sdp-plugin
+          go build ./...
+          go test ./... -count=1
+
+  protocol-e2e:
+    name: Protocol E2E (Docker)
+    needs: [build-test]
+    uses: ./.github/workflows/protocol-e2e-reusable.yml
+    with:
+      submodules: false

AGENTS.md

@@ -12,6 +12,16 @@ bd close <id>         # Complete work
 bd sync               # Sync with git
 ```
 
+## Quality Gates
+
+Before pushing code changes:
+
+```bash
+go build ./...              # must succeed
+go test ./...               # must pass
+go vet ./...                # no issues
+```
+
 ## Canonical Prompt Source
 
 - Canonical prompts live in `prompts/skills/*/SKILL.md` and `prompts/agents/*.md`.

CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to the Spec-Driven Protocol (SDP).
 
+## [0.9.5] - 2026-02-24
+
+### Phase 0 + Roadmap v2: Skills, Schema, Constraints
+
+**New:**
+- **Coding Workflow Predicate (in-toto v1)** — `schema/coding-workflow-predicate.schema.json` for attestations. Predicate type: `https://sdp.dev/attestation/coding-workflow/v1`. See [docs/attestation/coding-workflow-v1.md](docs/attestation/coding-workflow-v1.md).
+- **@feature --auto** — Generate workstreams directly from roadmap. Skip full discovery for features already in ROADMAP.md.
+- **@design** — Workstream file format with Scope Files, beads mapping, INDEX.md update. Required sections documented.
+- **PreToolUse constraint enforcement** — `sdp-guard --check-constraints` integration. Reads `.sdp/agent-constraints.yaml` for phase-specific rules (scope, force-push, destructive git).
+
+**Phase 0 (F018, F016, F021, F020):**
+- Removed phantom guard CLI refs (context, branch, complete, finding)
+- Slim @oneshot skill; outer loop via sdp-orchestrate
+- Language-agnostic skills: quality gates per AGENTS.md, `master` not `dev`
+- @build scope fix; stripped evidence boilerplate
+- Deleted `help.md`, `init.md`; compressed deploy, review, implementer
+
+**Install:**
+- `SDP_REF` env var for branch/ref (e.g. `SDP_REF=v0.9.5` for testing)
+- OpenCode/Windsurf: `SDP_IDE=opencode` or `SDP_IDE=all`
+
+---
+
 ## [0.9.4] - 2026-02-18
 
 ### Patch Release

CLAUDE.md

@@ -42,7 +42,7 @@ New project?
 +-- No --> Working on existing project?
     |-- Yes --> What's the state?
     |   |-- Don't know --> @reality --quick
-    |   +-- Know state --> @feature "add feature" (or @discovery for pre-check only)
+    |   +-- Know state --> @feature "add feature"
     +-- No --> Workstreams exist?
         |-- Yes --> @oneshot F050
         +-- No --> @feature "plan feature"
@@ -54,7 +54,7 @@ New project?
 |-------|-------------|---------|--------|
 | **Strategic** | @vision (7 agents) | Product planning | VISION, PRD, ROADMAP |
 | **Analysis** | @reality (8 agents) | Codebase analysis | Reality report |
-| **Feature** | @feature (@discovery + @idea + @ux + @design) | Requirements + WS | Workstreams |
+| **Feature** | @feature (roadmap pre-check + @idea + @ux + @design) | Requirements + WS | Workstreams |
 | **Execution** | @oneshot (@build) | Parallel execution | Implemented code |
 
 ### When to Use Each Level
@@ -65,8 +65,6 @@ New project?
 
 **@feature** — Feature idea but no workstreams, need interactive planning (full discovery flow)
 
-**@discovery** — Roadmap pre-check, product research, feature brief (standalone or via @feature)
-
 **@ux** — UX research for user-facing features (standalone or auto-triggered by @feature)
 
 **@oneshot** — Workstreams exist, want autonomous execution with checkpoint/resume
@@ -83,8 +81,7 @@ New project?
 |-------|---------|-------|
 | `@vision` | Strategic product planning (7 expert agents) | Strategic |
 | `@reality` | Codebase analysis (8 expert agents) | Analysis |
-| `@feature` | Planning orchestrator (discovery + idea + ux + design) | Planning |
-| `@discovery` | Product discovery gate (roadmap check, research loop) | Planning |
+| `@feature` | Planning orchestrator (roadmap pre-check + idea + ux + design) | Planning |
 | `@idea` | Requirements gathering (AskUserQuestion) | Planning |
 | `@ux` | UX research (mental model elicitation) | Planning |
 | `@design` | Workstream design (EnterPlanMode) | Planning |
@@ -109,7 +106,7 @@ New project?
 | `@init` | Initialize SDP in current project |
 | `@help` | Interactive skill discovery |
 | `@prototype` | Rapid prototyping shortcut |
-| `@prd` | PRD generation and maintenance |
+| `@vision --update` | PRD/ diagram regeneration |
 | `@test` | Contract test generation |
 | `@reality-check` | Quick documentation vs code validation |
 | `@verify-workstream` | Validate workstream against codebase |
@@ -267,8 +264,6 @@ The SDP CLI provides terminal commands for planning, executing, and tracking wor
 | `sdp guard check <file>` | Verify file is in scope |
 | `sdp guard status` | Show guard status |
 | `sdp guard deactivate` | Clear edit scope |
-| `sdp guard finding list` | List guard findings |
-| `sdp guard finding resolve <id>` | Resolve a finding |
 
 ### Session Commands
 

README.md

@@ -40,7 +40,7 @@ Each phase has a contract. Skip a phase and the state machine blocks the next on
 
 Every run creates a strict evidence envelope — a JSON document proving intent, plan, execution, verification, review, boundary compliance, and provenance (SHA-256 hash chain). [Details in the Manifesto](docs/MANIFESTO.md#the-evidence-envelope).
 
-**Schema:** Validate evidence against `schema/evidence-envelope.schema.json` (version `evidence-envelope/v1`).
+**Schemas:** `schema/evidence-envelope.schema.json` (legacy), `schema/coding-workflow-predicate.schema.json` (in-toto v1). See [docs/attestation/coding-workflow-v1.md](docs/attestation/coding-workflow-v1.md).
 
 ### 3. Gates PRs on evidence
 
@@ -212,6 +212,7 @@ We're exploring multi-persona adversarial review, self-improvement loops, cross-
 |------|---------|
 | [docs/MANIFESTO.md](docs/MANIFESTO.md) | Why SDP exists, what's real, what's next |
 | [docs/PROTOCOL.md](docs/PROTOCOL.md) | Full specification |
+| [docs/attestation/coding-workflow-v1.md](docs/attestation/coding-workflow-v1.md) | in-toto predicate spec (evidence v2) |
 | [CLAUDE.md](CLAUDE.md) | Quick reference for Claude Code |
 | [docs/vision/ROADMAP.md](docs/vision/ROADMAP.md) | Roadmap and milestones |
 | [CHANGELOG.md](CHANGELOG.md) | Version history |