Migrate pjson to requirements-strict policy

[konard]

Fixes #19

Summary

• Treats repo-policy.json as the expanded pjson requirements-strict downstream profile while repo-guard 0.3.0 has no schema-supported top-level profile field.
• Adds requirement_json_req_ref plus requirement-json-req-refs-must-resolve, so repo-guard now owns requirement JSON ID resolution.
• Extends declared-anchor evidence from anchors.affects to anchors.implements and anchors.verifies.
• Reduces bespoke validation by removing trace-reference existence checks from scripts/validate-requirements.js; graph-only checks remain there until repo-guard has first-class graph rules.
• Documents the expanded profile, pjson overrides, remaining legacy checks, and migration target in docs/requirements-strict-profile.md.

Reproduction

Before this change, a requirement JSON file could contain a valid-looking but nonexistent trace reference such as FR-999, and repo-guard would not enforce that JSON trace reference resolution. The new experiments/test-requirements-strict-profile.sh creates that case in a temp repo and verifies repo-guard fails it through requirement-json-req-refs-must-resolve.

The same experiment verifies that declared anchors.implements and anchors.verifies fail without configured evidence surfaces and pass once script or experiment evidence is present.

Change Contract

change_type: requirements-policy
scope:
  - "repo-policy.json"
  - "README.md"
  - "requirements/README.md"
  - "docs/requirements-strict-profile.md"
  - "scripts/**"
  - "experiments/**"
budgets:
  max_new_files: 2
  max_new_docs: 1
  max_net_added_lines: 450
anchors:
  affects:
    - FR-005
    - FR-006
  implements:
    - FR-006
  verifies:
    - FR-006
must_touch:
  - "repo-policy.json"
  - "experiments/test-requirements-strict-profile.sh"
must_not_touch:
  - "requirements/**/*.json"
expected_effects:
  - repo-guard enforces requirement JSON trace reference resolution.
  - PR declared implements/verifies anchors require evidence surfaces.
  - Legacy requirement validator keeps graph checks but no longer duplicates JSON trace ref resolution.

Verification

• node scripts/validate-requirements.js
• node scripts/validate-repo-guard-workflow.js
• node /tmp/repo-guard/src/repo-guard.mjs --repo-root .
• node /tmp/repo-guard/src/repo-guard.mjs --repo-root . --enforcement blocking check-diff --base upstream/main --head HEAD --format summary
• bash experiments/test-validation.sh
• bash experiments/test-docs-headings-validation.sh
• bash experiments/test-requirements-strict-profile.sh
• git diff --check upstream/main...HEAD

[konard]

Solution summary

Implemented and pushed PR #23: #23

The PR is ready for review, working tree is clean, and latest CI is green:

• Валидация требований: success
• repo-guard policy check: success on latest commit f9ba891

What changed:

• Added the expanded requirements-strict policy in repo-policy.json, including requirement_json_req_ref, JSON requirement-ref resolution, and evidence rules for anchors.implements / anchors.verifies.
• Documented the profile, pjson overrides, remaining legacy checks, and future native-profile migration in docs/requirements-strict-profile.md.
• Removed duplicated trace-reference existence checks from scripts/validate-requirements.js; graph checks remain there.
• Added regression coverage in experiments/test-requirements-strict-profile.sh.

Verification run:

• node scripts/validate-requirements.js
• node scripts/validate-repo-guard-workflow.js
• node /tmp/repo-guard/src/repo-guard.mjs --repo-root .
• node /tmp/repo-guard/src/repo-guard.mjs --repo-root . --enforcement blocking check-diff --base upstream/main --head HEAD --format summary
• bash experiments/test-validation.sh
• bash experiments/test-docs-headings-validation.sh
• bash experiments/test-requirements-strict-profile.sh
• git diff --check upstream/main...HEAD

One implementation note: current repo-guard schema 0.3.0 rejects unknown top-level fields, so I did not add a literal profile key to repo-policy.json. The PR uses the schema-compatible expanded profile form and documents the native profile: requirements-strict target for when repo-guard supports it.

Next useful follow-ups:

1. Add native requirements-strict preset support in netkeep80/repo-guard.
2. Move remaining graph checks from scripts/validate-requirements.js once repo-guard has first-class requirement graph rules.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.4
• Provider: OpenAI
• Public pricing estimate: $5.150211

📊 Context and tokens usage:

• 7.3M / 1.1M (698%) input tokens, 31.2K / 128K (24%) output tokens

Total: (174.2K + 7.2M cached) input tokens, 31.2K output tokens, $5.150211 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.4
• Model: GPT-5.4 (gpt-5.4)

📎 Log file uploaded as Repository (36052KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• All CI checks have passed
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag