Tier 1: engine readiness for trove adoption

[markmals]

Makes the SpecKit engine able to scan + verify trove — the first real Workbench-shaped repo to convert. Holding for your review (not merged).

Validated end-to-end against ~/Developer/Projects/trove: scan went from 46 findings → clean, and a live verify (real go test) joins trove's Go bindings — 4 scenarios passed, 0 dangling, 0 unbound, 2 honestly unjoinable (cross-target). trove's tree left pristine.

What changed

specmodel — accept trove's spec shape

• protocol kind — a contract kind (protocol.<producer>.<op>, dir specs/protocol/, no scenarios). Cleared trove's 17 I2s.
• Filename rule accepts both the id-tail stem (engine.scan.md) and the full-id stem (story.engine.scan.md). Cleared trove's 29 I1s; backward-compatible (SpecKit's own specs unchanged).
• Nested scenario headings — parseScenarios now reads ### Scenario N: under ## Acceptance Criteria, not just top-level ## Scenario. (An audit miss — without this, trove's scenarios parsed empty and every binding dangled.)

engine + reports — verify trove's Go suite

• gotest format — parses go test -json (top-level funcs; subtests rolled up; skips omitted).
• Leading // [scenario.id] binding reader — .go added to the source walk; binds the tag to the next func Test… (Go) or it/test(…) title (TS). This is the form trove uses across 156 Go + 12 TS tags (the in-title Vitest + Swift-trait forms still work).
• bindings: scoped mode (see decision below).

⚠️ One decision for you — the bindings mode

A blocker the audit didn't surface: trove's Go suite is deliberately partly-bound (it has plain unit tests like TestOutputPath with no scenario tag). SpecKit's documented philosophy is "any untagged test is a hard error" (unbound = D12 failure, blocks all locking) — so verify would lock nothing on trove.

I added an opt-in, per-target bindings mode:

• strict (default, unchanged) — every test must bind a scenario. The scaffold + SpecKit's own repo are untouched.
• scoped — untagged tests are out of scope, so a mixed suite verifies what it does bind. Dangling bindings + failing bound tests remain violations in both modes.

This softens a documented philosophy, but only when a target opts in. Confirm the name/shape (or reject in favor of "trove must fully-bind its suite").

Also note

• The x-spec / OpenAPI protocol-coverage reader is deferred (protocol specs scan clean + drift-track as contract-only for now; covering them needs the OpenAPI reader — a separate milestone).
• The trove .speckit/specs.json that worked (a go-service/gotest/scoped target) is in docs/config.md as the example.

Tests

New coverage for every change (protocol kind/prefix, both filename conventions, nested-scenario parsing, the Go + TS leading-comment readers, the gotest parser, the scoped-vs-strict integration, and config validation). mise run ci green; init goldens unaffected.

Deferred Tier-1 follow-ups (next milestone)

protocol x-spec coverage reader · an init-into-existing path that authors .speckit/specs.json · the go-service stack pack/scaffold.