feat: stores cover their tree, undone attempts read, contradicted origins blocked (v0.25.0)

AGENTS.md

@@ -373,7 +373,10 @@ baseline captured before changes, and a "what stays untouched" spec section.
    dispatch contract still apply.
 4. **Monorepos.** One `.sdlc/` per shipping unit — usually the service or
    package, not the repo root; a root `.sdlc/` only for cross-unit changes.
-   intent.md names the owning unit.
+   intent.md names the owning unit. A store covers its whole tree: a change
+   in a unit without its own `.sdlc/` runs the loop in the nearest store
+   above it, with gates run from that store's directory. A unit without a
+   store is never outside the loop.
 
 ## If your harness lacks a feature
 

README.ko.md

@@ -322,7 +322,7 @@ sdlc-kit은 프로세스 계층이지 프로젝트 규칙의 대체물이 아닙
 - 프로세스는 sdlc-kit이 이깁니다. 단계, 승인 게이트, 증거, 메모리.
 - 기존 지식이 이깁니다. `DOMAIN.md`는 기존 용어집, `CONTEXT.md`, ADR을 복사하지 않고 가리킵니다.
 - 기존 에이전트가 이깁니다. 로컬 QA, 브라우저, API, 리뷰어, DB 전문 에이전트가 킷의 역할 계약을 실행합니다.
-- 모노레포는 범위를 지킵니다. 배포 단위마다 `.sdlc/` 하나, 루트는 단위를 가로지르는 변경에만.
+- 모노레포는 범위를 지킵니다. 배포 단위마다 `.sdlc/` 하나, 루트는 단위를 가로지르는 변경에만. 자기 저장소가 없는 단위는 가장 가까운 상위 저장소에서 루프를 돌며, 루프 밖에 두지 않습니다.
 
 진짜 규칙 충돌은 양쪽 원문을 인용해 사람에게 보여줍니다. 에이전트가 조용히 해소하지 않습니다.
 

README.md

@@ -322,7 +322,7 @@ sdlc-kit is a process layer, not a replacement for the project's existing rules:
 - **sdlc-kit wins on process:** stages, approval gates, evidence, memory.
 - **Existing knowledge wins:** `DOMAIN.md` points to existing glossaries, `CONTEXT.md`, and ADRs instead of copying them.
 - **Existing agents win:** local QA, browser, API, reviewer, or DB specialists execute the kit's role contract.
-- **Monorepos stay scoped:** use one `.sdlc/` per shipping unit; root only for cross-unit changes.
+- **Monorepos stay scoped:** use one `.sdlc/` per shipping unit; root only for cross-unit changes. A unit without its own store runs in the nearest one above it, never outside the loop.
 
 A genuine rule conflict is shown to the human with both texts quoted. The agent does not resolve it silently.
 

SKILL.md

@@ -14,7 +14,8 @@ before the first stage of a session, then return here.
 
 ## When this skill runs
 
-In a project with `.sdlc/`, any request that CHANGES the product runs through
+In a project with `.sdlc/` — in the changed files' directory or any directory
+above it (AGENTS.md "Monorepos") — any request that CHANGES the product runs through
 this loop — "add a filter to the report", "fix the login redirect", "make the
 export faster". No SDLC vocabulary is required; the words the human used are
 not the trigger, the change is.

VERSION

@@ -1 +1 @@
-0.24.0
+0.25.0

log/changelog-v0.25.0.md

@@ -0,0 +1,33 @@
+# v0.25.0 — no unit outside the loop, undone attempts read, contradicted origins blocked
+
+Three gaps let a change skip the kit's checks. A unit in a monorepo with no
+`.sdlc/` of its own was read as "no loop here". The History probe said "read
+reverts" without saying how, so an earlier attempt that was rolled back for a
+side effect went unread. And the Intent match lens counted Covered, Missing
+and Beyond only, so a build that handled an origin detail with the opposite
+rule (origin: expired coupons greyed out; build: hidden) could pass as
+Covered. No new gate or check; no script-read line
+changed.
+
+## Changes
+
+- **AGENTS.md "Monorepos", SKILL.md "When this skill runs":** a store covers
+  its whole tree. A change in a unit without its own `.sdlc/` runs the loop in
+  the nearest store above it, gates run from that store's directory.
+- **skills/1-intent "History":** run `git log --no-merges -i -E
+  --grep='revert|rollback|back out' -- <paths>` on the shipping branch, plus
+  the project's own words for an undo; read each hit's ticket for the side
+  effect that forced it.
+- **templates/intent.md:** Researcher findings opens with a `History:` line —
+  the search run and its hits, or `none found` with the command.
+- **roles/verifier.md Lens 3, templates/evidence.md:** a fourth class,
+  **Contradicts** — an origin detail built with a different rule. Blocking
+  unless the origin owner's decision is recorded; an agent-proposed rule is
+  not an override. The evidence line gains `Contradicts: <list or none>`.
+- **templates/spec.md:** new **Origin overrides** section (R → origin text →
+  owner's decision: who, date, words; `none` by default).
+- **roles/adversary.md Traceability:** the same contradiction is blocking at
+  the spec gate, before anything is built.
+- **README.md, README.ko.md:** the monorepo line says the same.
+
+Nothing to migrate.

roles/adversary.md

@@ -12,6 +12,9 @@ Attack, in order:
 1. **Traceability.** Does every element trace to the upstream artifact —
    every spec R to an intent O-item, every O-item to an R or a flagged
    concern? Flag added features and dropped requirements or questions.
+   A spec R that states a different rule than the origin.md text it traces
+   to is blocking at the spec gate unless spec.md's **Origin overrides**
+   records the origin owner's decision.
 2. **Domain and data shapes.** Check that schemas, contracts, migrations, and
    serialized data use the same shapes end to end.
 3. **User claims.** Do `[assumed]` claims carry enough risk to block? Does the

roles/verifier.md

@@ -132,8 +132,14 @@ the origin text names — screens, fields, messages, roles, limits, error cases:
 2. **Missing** — an O-item or origin detail absent from the build. A detail
    dropped between the origin and spec.md is a finding even though spec.md was
    approved without it.
-3. **Beyond** — behavior no O-item asked for.
-4. intent.md's Goal line, checked the same way.
+3. **Contradicts** — an origin detail the build carries with a different
+   rule than the origin states: the origin says expired coupons show greyed
+   out, the build hides them. It is blocking unless spec.md's **Origin
+   overrides** (compact route: an intent.md Evidence line) records the origin
+   owner's decision — who, when, their words.
+   A rule the agent proposed is not an override.
+4. **Beyond** — behavior no O-item asked for.
+5. intent.md's Goal line, checked the same way.
 
 No origin.md → check O-items alone and report `origin NOT VERIFIED — none
 snapshotted`; live source unreachable → say so, the snapshot stands.
@@ -162,7 +168,7 @@ human's explicit call, recorded in evidence.md.
 - Baseline diff: clean | differences: <what> · untouched: <U-items → result> · neighbouring flows: <named → result>
 - Data consistency: <shape> → <producers/consumers checked> → consistent | skew: <what>
 - AS-IS → TO-BE: <pair> → <observed> · unlisted changes: <what, or none>
-- Origin: <ref> · live: unchanged | drifted: <what> | unreachable · O1 → R1 → <observed> … · Covered <n>/<n> · Missing: <list> · Beyond: <list>
+- Origin: <ref> · live: unchanged | drifted: <what> | unreachable · O1 → R1 → <observed> … · Covered <n>/<n> · Missing: <list> · Contradicts: <list> · Beyond: <list>
 VERDICT: PASS | FAIL (findings, each with evidence) | PASS WITH GAP (<what was NOT VERIFIED>)
 ```
 

skills/1-intent/SKILL.md

@@ -36,7 +36,12 @@ in parallel, then start the interview:
 
 - **History** for brownfield work. Check whether this was tried before. Read
   reverts, related tickets, prior fixes, and why they failed in git history
-  and commit messages.
+  and commit messages. At minimum run `git log --no-merges -i -E
+  --grep='revert|rollback|back out' -- <paths the change touches>` on the
+  branch that ships, adding the words the project's commits use for an undo
+  in their own language. Each hit names an attempt that was undone: read its
+  ticket for the side effect that forced it. intent.md's History line
+  records the command and the hits, or `none found` with the command.
 - **Affected area**: entry points, data shapes, callers, side effects of the
   code the request touches.
 - **Existing analogous flow**: before any option exists, find a flow the

templates/evidence.md

@@ -41,7 +41,7 @@ VERDICT: <the E2E report's VERDICT line, verbatim>
 VERDICT: <the Side effects report's VERDICT line, verbatim>
 ### Intent match   <!-- per O-item, against origin.md — not only spec.md -->
 - O1 → R1 → <observed> · O2 → <none> → MISSING: <what>
-- Covered: <n>/<n> · Missing: <list or none> · Beyond: <list or none>
+- Covered: <n>/<n> · Missing: <list or none> · Contradicts: <list or none> · Beyond: <list or none>
 VERDICT: <the Intent match report's VERDICT line, verbatim>
 ### Fix loop   <!-- copied from deviations.md; cap 3 rounds -->
 - round 1/3: <lens> · accepted <findings> · declined <findings — reason each> · re-check: resolved | open: <what>

templates/intent.md

@@ -80,4 +80,5 @@ else the human's. Name a command or test where possible.>
 - <question>
 
 ## Researcher findings   <!-- brownfield: summary + pointer to full report -->
+- History: <the revert search run (skills/1-intent "History") → each undone attempt and the side effect that forced it | none found>
 <key facts; contradictions with user claims and how they were resolved>

templates/spec.md

@@ -16,6 +16,12 @@ concerns alone.>
 with no R is a flagged concern, never a silent drop.>
 - R1: <requirement> (O1)
 
+## Origin overrides   <!-- an R whose rule departs from origin.md's text; the adversary and the Intent match lens block on one missing here -->
+<R → the origin text it departs from → the origin owner's decision: who, date,
+their words. A rule the agent proposed stays a Flagged concern until the owner
+decides. `none` when every R matches the origin.>
+- none
+
 ## Data shapes
 <schemas, API contracts, migrations, and serialization end to end>