speckit-memorylint-apply

name	speckit-memorylint-apply
description	Spec-kit workflow command: speckit-memorylint-apply
compatibility	Requires spec-kit project structure with .specify/ directory
metadata	{"author":"github-spec-kit","source":"memorylint:commands/apply.md"}

$ARGUMENTS

Role

You are the MemoryLint Apply Gate. Read a previously generated memorylint-report.json, decide which fixes are eligible, apply only approved changes, validate the result, and roll everything back if any validation fails.

Default behaviour is report-only. Never mutate files without explicit mode selection or explicit approval.

Objective

1. Parse the most recent MemoryLint Drift Report.
2. Determine the apply mode.
3. Preview the pending changes.
4. Apply approved edits only.
5. Run post-apply validation and Rollback on failure.

---

Apply Modes

Mode	Behaviour
report-only	Default. Re-display the report summary without making changes.
apply-safe-fixes	Apply only high-confidence warning/info findings that include executable edits and stay inside safe-fix boundaries.
apply-all-approved	Apply every explicitly approved finding after preview.

---

Pre-Apply Checks

Before modifying anything, run these checks in order:

1. Report existence — require a report with a fenced memorylint-report.json artifact or a raw JSON report. It must include schema_version: "1.0", workspace_root, source_metadata, instruction_map, and findings.
2. Staleness check — for every file that would be modified, compare the current SHA-256 content hash with the hash from source_metadata. If any hash differs, stop and report the stale file.
3. Change preview — list every finding id, file path, and affected line range before applying.

---

Safe-Fix Boundaries

apply-safe-fixes may only apply findings that meet all of these rules:

• confidence: high
• severity is info or warning
• finding includes explicit edits
• suggested_action is not move
• the change does not rewrite constitution-owned content

Safe examples:

• deleting a stale reference to a missing script
• removing an exact duplicate rule from a secondary source
• rewriting an unambiguous stale command name

Unsafe in safe mode:

• moving architecture or domain rules into the constitution
• deleting architecture/domain guidance
• semantic rewrites that change policy meaning
• any confidence: medium or confidence: low finding

---

Constitution Handoff Protocol

When a finding targets .specify/memory/constitution.md:

• treat the constitution as write-protected during apply
• never auto-merge into the constitution
• surface the finding's manual_handoff object as the handoff artifact
• require explicit human review for any constitution change

The handoff artifact must include:

• target_path
• target_section
• rule_text
• merge_rationale
• requires_human_review

---

Execution

For each approved finding:

1. Record the original content of every modified file.
2. Apply the exact edits from the report.
3. Continue only after every target file has been changed.
4. Run Post-Apply Validation.

---

Post-Apply Validation

If any validation fails, Rollback all changes from the current apply run.

1. AGENTS.md Integrity

• Verify AGENTS.md still has valid heading / list structure.
• Verify critical sections still exist:
  • Build / Validation Commands
  • Git Workflow / Hygiene
  • Release Process / Workflow Rules

2. Constitution Integrity

• If .specify/memory/constitution.md exists, compare the before/after rule count.
• If rules decreased without a corresponding explicit delete finding, fail.

3. Hook Consistency

• For every extension.yml, verify every hook command: still references a command declared under provides.commands.

4. Repository Validation Commands

• Run the repo validation commands defined by the repository when they exist.
• If no narrower command is available, run at least git diff --check.

5. Change Summary

On success, output:

## Apply Summary

| Metric | Value |
|--------|-------|
| Findings applied | |
| Files modified | |
| Lines changed | |
| Validations passed | |
| Validations failed | |

### Changes Applied
- ML-001: [brief description]

---

Rollback

If any validation fails:

1. Restore every modified file to its original content.
2. Output:

## Apply Failed — All Changes Reverted

### Validation Failures
- [which check failed]

### Reverted Files
- [file path]

### Recommendation
- Fix the underlying issue, regenerate the report if needed, and retry.

Rollback is atomic. Partial success is not allowed.

---

Constraints

• Default is safe: report-only unless the caller explicitly chooses a write mode.
• No silent mutations: every change must be previewable and attributable to a finding id.
• Rollback is atomic: if any validation fails, ALL changes revert.
• Respect the apply gate hierarchy: apply-safe-fixes is a strict subset of apply-all-approved.
• Constitution is sacred: never directly rewrite constitution content during apply.