feat: artifact versioning, draft+confirm auto-refresh, retro roll-up & command contract lint

[splashthree]

What this adds

Four additive, advisory layers on top of the 1.3.0 artifact update & audit layer. Protected core is byte-for-byte unchanged; audit_artifacts.py's existing record/impact/report output is byte-identical (enforced by invariant tests); everything exits 0 on every path.

1. Content versioning (/sdlc-version)

version {list,show,diff,rollback,gc} folded into audit_artifacts.py. Version identity is derived from the change-ledger's existing 16-hex SHA-256 hashes via one new pure module (version_model.py) — the content-addressed object store (.sdlc/versions/objects/<xx>/<16hex>, gitignored) is just those hashes rehydrated to bytes, so there is no second index to drift. Rollback is preview → named-human confirm (--actor + echoed diffhash, --ack-signoff for signed-off artifacts), append-only ("restored from vX"), torn-write-safe with idempotent recovery. gc is cross-ledger refcounted and protects anything whose sign-off it can't prove.

2. Draft+confirm auto-refresh (/sdlc-refresh)

refresh {detect,scan,draft,apply,reject,status} — reverse propagation: a merged spec's shipped reality flows back up into requirements.md/epics.md/feature-brief.md/business-rules.md. Review-first and divergence-aware (a faithful spec drafts nothing without --draft); the discipline agent edits only a .proposed; a named human echoes the reviewed diffhash to apply (the One Rule); the refresh lands as a rollback-able refreshed version attributed via a source_spec rider key (artifact_model.py unchanged).

3. Cross-ledger retro roll-up (/sdlc-retro)

retro_report.py — read-only report across the ledgers for retro input: recurring findings (permanent-check candidates), repeat-stale artifacts, the refresh funnel per spec and per stem (the tuning signal for the divergence heuristic), and a disposition-debt rollup naming each source ledger. Same discipline as the scorecard: "no data" over fabricated zeros, patterns keyed by category/artifact/stem and never by actor, refuses activity metrics.

4. Command contract lint

scripts/tests/test_command_contracts.py — the static half of a command-prose safety harness: extracts every uv run … scripts/<name>.py invocation from fenced blocks in commands/*.md and validates script existence, subcommand chains, and every --flag against live --help (cached subprocesses), plus agent-name and references//templates/ cross-references. Conservative (ambiguous → skipped, never a false violation), with self-tests proving each detection class fires. It found zero drift in the existing 25 command docs and already caught one malformed invocation during this PR's own authoring.

1.3.0 integration

• Rebased on master (clean; the only overlapping file was audit_artifacts.py, where the _glyph fix and this PR's additions touch disjoint regions).
• All new output routed through the _glyph() Windows-console fallback introduced in 1.3.0 — verified under a forced cp1252 stdout.
• The three new commands registered in docs/commands.md; the count-word vocabulary in test_registry_docs_consistency.py extended (Thirteen–Eighteen) since the additional-commands table outgrew "Twelve".

Also included

• Multi-machine honesty: every "content not captured" message now explains why (local, gitignored store — fresh clone/CI, gc prune, or store fault) and what to do.
• Docs for endpoint-only capture semantics ("What a version is (and isn't)") and a team-portable .gitignore override.

Testing

• 807 passed, 1 skipped on the rebased tree (~192 new tests).
• New invariant tests assert: protected core untouched, report/impact JSON byte-identical with the version store deleted, no state.yaml writes from the new verbs, the ledger stays its own JSONL with no gate_results rows, and the .gitignore entries exist.
• See references/artifact-versioning.md for the design (R1–R6, canonical mutate order, gc policy, deletability caveat).

🤖 Generated with Claude Code