@abelxiaoxing/cadence 1.2.1 → 1.2.3

package/README.md

@@ -20,6 +20,8 @@ Implement 只暴露 `start`、`status`、`resume`、`rebind`、`cancel` 和 `dis
 `status` 完全本地可用；相同 operation id 幂等重放，进程、会话或 Worker 更换后仍从 durable checkpoint 继续。
 Design 从第一步起统一使用 `action: "design"`：新需求通过 `start(requirement)` 进入，已有 change 通过 `start(change)` 进入，后续只携带返回的 `runId`。
 需求、决策合同与 Gate A 合同由控制面规范化并计算哈希，调用方无需 SHA-256 工具；Gate B 自动绑定当前已编译 canonical plan，原始瞬时文本不会写入 durable journal。
+`validate-plan-draft` 可在 `compile-plan` 前只读运行同一套编译检查，并以结构化 `taskId` / phase / field / verification 诊断定位问题；Design finalization 的安全诊断码也会进入错误详情与可展开 TUI，而不再只显示统一失败标题。
+Design status 将可调用的 `legalOperations` 与顶层 `packetActions` 分开；显式退出只能发送 `{"action":"finish"}`，不能伪装成 `operation: "finish"`。
 
 普通 artifact、错误 Red、transport、environment、stale、conflict、baseline 与验证失败都留在同一 Implement run 中恢复。
 累计验证发现 introduced failure 时会自动重开责任任务做有界修复；自动预算耗尽后 `resume` 复用已有 baseline 和 phase facts。
@@ -28,7 +30,7 @@ Design 激活期间，父模型只保留进入前已启用的 `read`、`grep`、
 Implementation Worker 不再手写 unified-diff header、hunk range、分段或哈希；它一次提交有序的 `replace`、`rewrite`、`create`、`delete` 操作。
 可信控制面在隔离 workspace 中校验精确文本、批准路径和 symlink 安全，生成并内部分块 sealed candidate；超限时保留可恢复状态而不接受截断 patch。
 OpenSpec change 制品只能通过私有 `write-artifact` / `delete-artifact` 原子操作变更；产品文件、AGENTS、`gate-a.yaml`、`ready.yaml` 和 `implement-plan.json` 对该通道不可达。
-Gate A/B 收据使用 schema v4，并在 Implement admission 时同时对照同一 root/change 的私有批准事实与 finalization revision/hash 事实验证。
+Gate A/B 收据只有一套 canonical 结构，并在 Implement admission 时同时对照同一 root/change 的私有批准事实与 finalization revision/hash 事实验证。
 
 只有继续工作确实需要新增行为、架构/策略、依赖、路径、资源、验证或 AGENTS 权限时才进入 `approval-needed`。
 结果保留原 Implement run，明确给出 authority category、所需 Gate、引用和 `/abel-design --change <change>` 用户指引；不会自动调用另一阶段。
@@ -75,6 +77,10 @@ npm install -g @abelxiaoxing/cadence
 只有需要自定义模型、显式顺序或 failover 时，才复制 [`config/routes.example.json`](config/routes.example.json) 到项目级 `.pi/cadence/routes.json` 或用户级 `~/.pi/agent/cadence/routes.json`。
 项目文件按整文件优先；route 必须显式列入对应角色，custom route 只引用 `apiKeyEnv` 的变量名，不能把凭据值写进 JSON。
 一旦显式文件存在，它就是完整策略；损坏、缺字段或角色引用不一致会 fail closed，不会悄悄退回默认父模型。
+旧配置的顶层数字标记 `2` 会被安全迁移为当前 canonical 结构；其他编号会以专用诊断码明确拒绝。
+inherited route 声明的能力会与当前父模型真实能力取交集，不能通过夸大的配置绕过 admission。
+transport 与 malformed structural result 都只在声明的 route 顺序内做有界 failover；只有一个 route 时会原地重试一次，多个 route 时按顺序切换。
+相同 pause 的安全指纹与重复计数通过 `status` 暴露，凭据、URL 和原始输出仍保持私有。
 `rebind` 只能选择已获 policy 授权且能力匹配的 route，不会扩大任务边界。
 
 ## 跨项目验证合同（Cross-project verification）

package/agents/diagnosis-worker.md

@@ -9,8 +9,12 @@ The fixed algorithm order is reproduce, falsify, failing-regression, then minimu
 An evidence packet submits exactly one compact structured evidence object through `abel_submit_result` with the reported symptoms, candidate causes, confirming or refuting citations, and a supported root-cause conclusion or an explicit evidence gap.
 Only the parent may claim that command-based reproduction succeeded.
 
-A candidate packet submits exactly one complete unified diff: either the failing regression or, after the parent has verified that regression, the minimum repair.
-It includes task identity, expected parent-owned verification, risks, and typed blockers, and never claims that it ran the verification.
+A candidate packet submits one complete structured patch: either the failing regression or, after the parent has verified that regression, the minimum repair.
+Use ordered `replace`, `rewrite`, `create`, and `delete` operations inside the approved write set.
+Never write unified-diff headers or hunk ranges because the trusted control plane generates them.
+If approved context is insufficient, submit a small typed context request instead of a partial patch.
+The trusted submit tool validates the accepted payload; brief accompanying text is harmless.
+Never claim that you ran the parent-owned verification.
 
 You never invent a fix for an unverified root cause, change behavior contracts, select another workflow stage, or prescribe parent recovery.
 Scope-expanding repairs are reported as evidence for a user decision.

package/agents/implementation-worker.md

@@ -20,8 +20,15 @@ Your output is one complete structured patch delivered through `abel_submit_resu
 - every operation path is within the declared phase boundary; paths that do
   not need a change may remain untouched;
 - preserve the expected parent-owned verification contract without claiming a result;
-- use a typed `context-request` for bounded context, task splitting, or an
-  approval-boundary blocker instead of submitting a partial patch.
+- use a typed `context-request` for bounded context or task splitting instead
+  of submitting a partial patch; classify every ref as a requested path with
+  `read | write` access, a source citation with path and line, or a
+  contract-diagnostic ref;
+- report only the missing context and structural facts: never select
+  `approval-needed`, `boundary-review-needed`, a Gate, or a workflow stage;
+- an `AGENTS.md` path is never a Worker write path;
+- report an AGENTS read need separately, and leave every sealed AGENTS contract
+  and managed-block update to the parent control plane.
 
 If the submit tool rejects malformed operations, use its concrete error to correct the submission once in this same disposable session; a second rejected structural submission ends the session.
 

package/config/routes.example.json

@@ -1,5 +1,4 @@
 {
-  "version": 2,
   "routes": {
     "parent": {
       "kind": "inherited",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abelxiaoxing/cadence",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Four explicit Abel workflow prompts with stage-isolated design and diagnosis, durable resumable implementation, and three package-owned professional Agents.",
   "license": "MIT",
   "type": "module",

package/prompts/abel-design.md

@@ -152,13 +152,22 @@ The plan admits only shell-free `vitest`, `package-script`, `static-check`, or o
 Pin local runners, package scripts, arguments, `minTests`, classifications, and `noInstall` behavior.
 Reject shell operators, implicit downloads, absolute/escaping paths, missing local capability, and unsupported verification shapes during Design readiness.
 
-After current Gate A approval, send the complete draft through `write-artifact` only to the relative path `plan-draft.json`, then invoke code-owned compilation:
+After current Gate A approval, send the complete draft through `write-artifact` only to the relative path `plan-draft.json`.
+Before mutation-owning compilation, use the read-only typed preflight; it validates the same fixed draft and returns task/output counts plus hashes without installing canonical files or journaling a plan revision:
+
+```json
+{"action":"design","request":{"operation":"validate-plan-draft","runId":"<run-id>"}}
+```
+
+If preflight fails, use its safe structured diagnostics (`code`, and when applicable `taskId`, `phase`, `field`, `category`, `owner`, `verificationId`, or `outputId`) to repair the exact boundary.
+Do not bisect the draft blindly or repeat an unchanged validation/finalization request.
+After preflight succeeds, invoke code-owned compilation:
 
 ```json
 {"action":"design","request":{"operation":"compile-plan","runId":"<run-id>","operationId":"<unique-operation>"}}
 ```
 
-The compiler reads only that fixed safe path, validates capability and graph closure, atomically installs canonical `implement-plan.json`, and returns its raw and canonical hashes.
+The compiler reads only that fixed safe path, validates capability and graph closure again, atomically installs canonical `implement-plan.json`, and returns its raw and canonical hashes.
 Do not hand-assemble canonical plan bytes, hashes, generated task Markdown, or receipts.
 The canonical `ImplementPlan` contains:
 
@@ -196,8 +205,8 @@ Finalization revalidates both current private Gate proofs, the stored plan, stri
 It atomically installs canonical `gate-a.yaml`, writes `ready.yaml` last, rereads the installed delivery, removes `plan-draft.json`, marks the Design run completed, and returns `deliveryRevision` plus `receiptHash`.
 Any failure leaves Design nonterminal and installs no new `ready.yaml`.
 
-Receipt schema version 4 binds the Gate A and Gate B approval revisions, canonical contract hashes, and owner-private record hashes.
-`ready.yaml` references the plan path, schema version, raw-byte hash, canonical plan hash, executable verification closure, Gate A hash, artifact hashes, and traceability hash.
+The canonical receipts bind the Gate A and Gate B approval revisions, canonical contract hashes, and owner-private record hashes.
+`ready.yaml` references the plan path, raw-byte hash, canonical plan hash, executable verification closure, Gate A hash, artifact hashes, and traceability hash.
 It does not embed caller-owned runtime task state, completed/blocked arrays, snapshots, launch identities, or retry budgets.
 
 Only the sealed task checkboxes may be normalized from `[x]`/`[X]` to `[ ]` when validating the tracked `tasks.md` hash.
@@ -219,6 +228,8 @@ Report `READY_TO_IMPLEMENT` only when strict validation passes, both Gates have
 Successful finalization deactivates private dispatch before an unrelated later request.
 Gate waits remain active for direct follow-up; if the user explicitly ends an unfinished Design interaction, send `{"action":"finish"}`.
 Otherwise report the current Design state, retained evidence, and the one unresolved decision or artifact that prevents readiness.
+Design `status` exposes only Design `legalOperations`; explicit stage exit is separately exposed as top-level `packetActions: ["finish"]`.
+Never send `operation: "finish"`; exit only with `{"action":"finish"}`.
 
 Do not implement product code and do not archive, publish, release, stage, or commit implicitly.
 

package/skills/abel-workflow/SKILL.md

@@ -21,10 +21,10 @@ Neither Gate grants tool permission, repository permission, identity, or authori
 Design and Implement may run in fresh contexts.
 Trusted delivery requires:
 
-- canonical receipt-schema-v4 Gate A and Gate B proofs for the same root/change/schema, each binding its approval revision, canonical contract hash, and owner-private journal record hash;
+- canonical Gate A and Gate B proofs for the same root/change/schema, each binding its approval revision, canonical contract hash, and owner-private journal record hash;
 - an owner-private finalization fact binding the exact delivery revision, ready-receipt raw hash, both Gate proofs, and canonical plan hash;
 - safe relative artifact paths and exact raw SHA-256 bindings;
-- a canonical `implement-plan.json` with schema version, raw hash, and canonical hash;
+- a canonical `implement-plan.json` with raw hash and canonical hash;
 - OpenSpec strict validity and planning completeness;
 - Requirement → Scenario → Verification → Task traceability exactly once;
 - executable verification closure and complete output/path/dependency/AGENTS contracts.
@@ -54,7 +54,7 @@ Cross-stage calls fail closed.
 
 ## Durable Design control
 
-Design uses one closed private `action: "design"` family from its first operation onward: `start`, `status`, `bind-change`, `record-decision`, `approve-gate`, `write-artifact`, `delete-artifact`, `compile-plan`, and `finalize-delivery`.
+Design uses one closed private `action: "design"` family from its first operation onward: `start`, `status`, `bind-change`, `record-decision`, `approve-gate`, `write-artifact`, `delete-artifact`, `validate-plan-draft`, `compile-plan`, and `finalize-delivery`.
 `start` accepts either the complete transient requirement or an existing change name; `status` uses the returned run id; `bind-change` names a provisional run only after current Gate A approval.
 The control plane normalizes and hashes transient requirement, decision-contract, and Gate-A contract text itself, and Gate B binds a plan compiled after the current Gate A approval and latest substantive decisions without a caller-supplied hash.
 The owner-private SQLite journal retains only normalized evidence identities/hashes, versioned decision hashes and refs, Gate proof facts, canonical compiled-plan identity/bytes, finalization identity, and idempotent operation outcomes.
@@ -73,6 +73,7 @@ Code-owned `gate-a.yaml` and `ready.yaml` receipts remain forbidden; `implement-
 All filesystem-mutating Design operations serialize against the durable expiring finalization lease.
 A competing or stale owner cannot inspect, replace, remove, or commit another operation's receipt bytes, and cleanup is fenced by the current operation's raw receipt hash.
 After current Gate A, the parent sends the fixed `plan-draft.json` input only through `write-artifact`.
+Read-only `validate-plan-draft` runs the same compiler checks without installing files or recording a plan revision and returns bounded task/phase/field diagnostics; unchanged invalid requests are not retried blindly.
 `compile-plan` owns canonical plan construction and installation.
 Gate B binds that exact stored canonical plan hash.
 `finalize-delivery` validates current proofs, OpenSpec, artifacts, traceability, and executable closure, writes Gate A and ready receipts atomically with `ready.yaml` last, rereads them, removes the draft, and completes Design.
@@ -199,5 +200,6 @@ Its absence pauses that verification only and does not block unrelated tasks or
 Tool settlement is not completion.
 Only durable `completed` after cumulative apply and postconditions receives success.
 Successful Design finalization, terminal Implement settlement, Diagnose `finish`, explicit stage finish, and session shutdown deactivate only `abel_dispatch`, drain packets, clear the parent bridge, and clear active stage identity.
+Design status separates `legalOperations` from top-level `packetActions`; `finish` is never a Design operation and is sent only as `{"action":"finish"}`.
 Gate waits and resumable pauses remain active for direct follow-up.
 Never archive, publish, release, stage, or commit implicitly.

package/src/apply-transaction.ts

@@ -32,7 +32,6 @@ import type {
 
 const IDENTIFIER = /^[a-z0-9](?:[a-z0-9._:-]{0,126}[a-z0-9])?$/iu;
 const SHA256 = /^[a-f0-9]{64}$/u;
-const JOURNAL_VERSION = 2 as const;
 
 type TransactionState =
   | "prepared"
@@ -58,7 +57,6 @@ interface TransactionEvent {
 }
 
 interface TransactionJournal {
-  version: typeof JOURNAL_VERSION;
   transactionId: string;
   consumerRoot: string;
   baselineRevisionId: string;
@@ -208,7 +206,7 @@ function hashBytes(bytes: Uint8Array): string {
 
 function journalHash(journal: TransactionJournal): string {
   return createHash("sha256")
-    .update("cadence-apply-transaction-v2\0")
+    .update("cadence-apply-transaction\0")
     .update(JSON.stringify(journal))
     .digest("hex");
 }
@@ -449,7 +447,6 @@ function validateJournal(value: unknown): TransactionJournal {
   }
   const journal = value as TransactionJournal;
   if (
-    journal.version !== JOURNAL_VERSION ||
     !IDENTIFIER.test(journal.transactionId) ||
     !path.isAbsolute(journal.consumerRoot) ||
     !SHA256.test(journal.baselineRevisionId) ||
@@ -821,7 +818,6 @@ export class ApplyTransaction {
     ].sort();
     for (const hash of retainedHashes) this.#artifacts.retain(hash);
     const journal: TransactionJournal = {
-      version: JOURNAL_VERSION,
       transactionId: input.transactionId,
       consumerRoot,
       baselineRevisionId: baseline.revisionId,

package/src/child-session.ts

@@ -26,6 +26,7 @@ import {
   type CandidateArtifactSubmission,
   type CandidateArtifactSubmissionResult,
   createCandidateArtifactTool,
+  createStructuredPatchTool,
   createSubmitTool,
   type FinalCategory,
   type SubmitClassification,
@@ -200,10 +201,6 @@ function structuralSubmitCount(message: AssistantMessage | undefined) {
   ).length;
 }
 
-function hasOneStructuralSubmit(message: AssistantMessage | undefined) {
-  return message?.role === "assistant" && structuralSubmitCount(message) === 1;
-}
-
 function safeChildError(failure: ChildFailure): string {
   switch (failure.kind) {
     case "environment":
@@ -308,19 +305,34 @@ export async function runChildSession(input: {
   ledgerProjection?: unknown;
   captureObservations?: boolean;
   candidateArtifact?: CandidateArtifactSubmission;
+  structuredPatch?: {
+    workspaceRoot: string;
+    writePaths: string[];
+    deletePaths: string[];
+  };
   onStreamStart?: () => void;
   onStreamProgress?: () => void;
 }): Promise<ChildSessionResult> {
   const candidateProtocol = input.candidateArtifact !== undefined;
   const submit = input.candidateArtifact
     ? createCandidateArtifactTool(input.candidateArtifact)
-    : createSubmitTool({
-        requestId: input.requestId,
-        taskId: input.taskId,
-        role: input.role,
-        phase: input.phase ?? "red",
-        output: input.output,
-      });
+    : input.structuredPatch
+      ? createStructuredPatchTool({
+          requestId: input.requestId,
+          taskId: input.taskId,
+          role: input.role,
+          phase: input.phase ?? "red",
+          workspaceRoot: input.structuredPatch.workspaceRoot,
+          writePaths: input.structuredPatch.writePaths,
+          deletePaths: input.structuredPatch.deletePaths,
+        })
+      : createSubmitTool({
+          requestId: input.requestId,
+          taskId: input.taskId,
+          role: input.role,
+          phase: input.phase ?? "red",
+          output: input.output,
+        });
   const observationCollector = input.captureObservations
     ? new ScopedObservationCollector()
     : undefined;
@@ -396,19 +408,16 @@ export async function runChildSession(input: {
     const assistants =
       session?.messages.filter((m) => m.role === "assistant") ?? [];
     const last = assistants.at(-1);
-    const lastSubmit = assistants.findLast((message) =>
-      hasStructuralSubmit(message),
-    );
     const structuralAttempts = assistants.reduce(
       (count, message) => count + structuralSubmitCount(message),
       0,
     );
     let finalCategory: FinalCategory;
-    if (!last) {
-      finalCategory = "no-final-assistant";
-    } else if (hasOneStructuralSubmit(lastSubmit)) {
+    if (submit.getResult() !== undefined) {
       finalCategory =
         structuralAttempts > 1 ? "multiple-submit" : "single-submit-only";
+    } else if (!last) {
+      finalCategory = "no-final-assistant";
     } else {
       const content = finalDeliveryContent(last);
       finalCategory =
@@ -481,7 +490,7 @@ export async function runChildSession(input: {
       cwd: input.cwd,
       modelRuntime: input.modelRuntime,
       model: input.model,
-      thinkingLevel: "off",
+      thinkingLevel: "low",
       tools: toolNames,
       customTools,
       resourceLoader: new EmptyResourceLoader(effectivePrompt),
@@ -563,13 +572,18 @@ export async function runChildSession(input: {
     const result = submit.getResult();
     const attempts = submit.getAttempts();
     const classification = classifySession();
+    const terminalSubmitFailure = submit.getFailure();
     const candidateComplete =
       candidateProtocol &&
       result !== undefined &&
       (result.kind === "sealed-candidate" || result.kind === "context-request");
-    if (!result || (candidateProtocol && !candidateComplete)) {
+    if (
+      !result ||
+      terminalSubmitFailure !== undefined ||
+      (candidateProtocol && !candidateComplete)
+    ) {
       const failure = withSubmitDetails(
-        submit.getFailure() ??
+        terminalSubmitFailure ??
           input.failureOverride?.() ??
           transportFailure() ??
           noStructuralSubmit(),
@@ -589,32 +603,9 @@ export async function runChildSession(input: {
         ...observationMetadata(),
       };
     }
-    const assistants = session.messages.filter((m) => m.role === "assistant");
-    const final = assistants.at(-1);
-    if (
-      !(candidateProtocol
-        ? candidateComplete && structuralSubmitCount(final) === 1
-        : hasOneStructuralSubmit(final))
-    ) {
-      const failure = {
-        kind: "artifact",
-        code: "invalid-structural-result",
-        stage: "child-finalization",
-        details: submitDetails(classification),
-      } as const;
-      disposeOnce();
-      return {
-        ok: false,
-        error: safeChildError(failure),
-        failure,
-        failureKind: "failed",
-        transportFailure: false,
-        disposeCount,
-        usage: usage.total(),
-        classification,
-        ...observationMetadata(),
-      };
-    }
+    // The trusted submit tool already validates and seals the one accepted
+    // result. Harmless text or read-only calls do not alter that admission;
+    // another terminal submission does.
     disposeOnce();
     return {
       ok: true,