@agile-team/wl-skills-gate 0.12.0 → 0.13.0

package/lib/automation.js

@@ -4,19 +4,21 @@ import { createHash, createPrivateKey, createPublicKey, randomUUID, verify } fro
 import { loadCiSourceConfig, collectCiSource } from "./ci-source.js";
 import { discoverCiRuns } from "./ci-discovery.js";
 import { loadGovernanceConfig, signPlatformReceipt, ingestGovernance, ingestLifecycleGovernance, reconcileGovernance, dispatchGovernance, readGovernanceState } from "./governance.js";
-import { createBuildLifecycle, createReviewLifecycle } from "./lifecycle-source.js";
+import { createBuildLifecycle, createValidationBuildLifecycle, createReviewLifecycle } from "./lifecycle-source.js";
+import {BUILD_RESULT_PATH,BUILD_ARCHIVE_PATH} from './build-artifacts.js';
 import { controlledPath, readControlledJson, writeExclusiveJson, lockedJson } from "./control-store.js";
 import { stableStringify } from "./util.js";
 import { createCiReview } from "./review-ci.js";
 import { ingestReviewPublications } from "./review-publication.js";
 import { ingestDeploymentDeliveries } from "./deployment-delivery.js";
+import {loadBuildDispatch,dispatchApprovedBuilds} from './jenkins-dispatch.js';
 const assert = (value, message) => { if (!value) throw new Error(message); };
 const hash = (value) => createHash("sha256").update(value).digest("hex");
 const safeId = (value) => typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/.test(value) && !["__proto__", "constructor", "prototype"].includes(value);
 
 export function loadAutomationConfig(file) {
   const c = readControlledJson(file), base = path.dirname(path.resolve(file));
-  assert(c.schemaVersion === 1 && Array.isArray(c.sources) && c.sources.length > 0 && c.sources.length <= 100, "自动执行器必须登记固定CI来源");
+  assert(c.schemaVersion === 1 && Array.isArray(c.sources) && c.sources.length > 0 && c.sources.length <= 1000, "自动执行器必须登记固定CI来源");
   for (const field of ["governanceConfigFile", "stateFile", "dataDir", "receiptPrivateKeyFile"]) { assert(c[field], `自动执行器缺少${field}`); c[field] = controlledPath(path.resolve(base, c[field])); }
   const g = loadGovernanceConfig(c.governanceConfigFile), key = createPrivateKey(readFileSync(c.receiptPrivateKeyFile));
   assert(key.asymmetricKeyType === "ed25519" && createPublicKey(key).export({ type: "spki", format: "der" }).equals(createPublicKey(readFileSync(g.publicKeyFile)).export({ type: "spki", format: "der" })), "自动执行器事件密钥未绑定治理公钥");
@@ -24,12 +26,18 @@ export function loadAutomationConfig(file) {
   for (const source of c.sources) {
     assert(safeId(source.id) && source.configFile && source.actors && Object.keys(source.actors).length > 0 && Object.values(source.actors).every(safeId), "CI来源编号/已认证用户映射缺失");
     source.configFile = controlledPath(path.resolve(base, source.configFile)); source.config = loadCiSourceConfig(source.configFile);
-    const scopeKey = source.config.project + ":" + source.config.scope;
-    assert(!seen.has(source.id) && !seen.has(scopeKey), "一个项目范围只能绑定一个CI来源，避免运行顺序串线"); seen.add(source.id); seen.add(scopeKey);
+    const scopeKey = source.config.project + ":" + source.config.scope + (source.buildResultPath?':build':':quality');
+    assert(!seen.has(source.id) && !seen.has(scopeKey), "一个项目范围的同类检查/构建只能绑定一个CI来源，避免运行顺序串线"); seen.add(source.id); seen.add(scopeKey);
     assert(g.projects[source.config.project]?.scopes[source.config.scope] && g.allowedLinkOrigins.includes(source.config.baseUrl), "CI来源项目/范围/链接未在治理批准");
     assert(typeof source.since === "string" && Number.isFinite(Date.parse(source.since)), "首次发现窗口必须明确，禁止默认只看最新一次");
-    assert(["dev", "sit", "uat", "pre", "prd"].includes(source.environment), "必须固定构建目标环境");
-    if (source.manifestPath !== undefined) assert(source.config.artifacts.paths.includes(source.manifestPath), "构建清单必须登记在固定来源工件内");
+    if(source.buildResultPath!==undefined){
+      assert(source.buildResultPath===BUILD_RESULT_PATH && source.manifestPath===undefined && source.environment===undefined && source.config.system==='jenkins' && !source.config.qualitySummary,'验证构建来源需独立BUILD Job与固定结果，不声明部署环境');
+      assert([BUILD_RESULT_PATH,BUILD_ARCHIVE_PATH].every(p=>source.config.artifacts.paths.includes(p)),'验证构建来源缺少固定归档');
+    }
+    if (source.manifestPath !== undefined) {
+      assert(["dev", "sit", "uat", "pre", "prd"].includes(source.environment), "必须固定构建目标环境");
+      assert(source.config.artifacts.paths.includes(source.manifestPath), "构建清单必须登记在固定来源工件内");
+    } else assert(source.environment === undefined || source.environment === null || ["dev", "sit", "uat", "pre", "prd"].includes(source.environment), "纯检查来源不需要构建环境；不能用test冒充正式发布环境");
     if (source.review !== undefined) {
       assert(source.review && typeof source.review.configFile === "string" && typeof source.review.outRoot === "string", "自动Review必须固定接线配置和中央证据根目录");
       source.review.configFile = controlledPath(path.resolve(base, source.review.configFile)); source.review.outRoot = controlledPath(path.resolve(base, source.review.outRoot));
@@ -38,6 +46,17 @@ export function loadAutomationConfig(file) {
         assert(source.review.publication.expectAuthorizationIssuer && /^[a-f0-9]{64}$/.test(source.review.publication.expectReviewPolicyHash || ""), "正式Review订阅身份/策略摘要无效");
       }
     }
+    if(source.buildDispatch){
+      assert(source.review?.publication,'自动续建须先登记正式Review交付');
+      source.buildDispatch.registryFile=controlledPath(path.resolve(base,source.buildDispatch.registryFile));
+      loadBuildDispatch({config:source.buildDispatch,ciConfigFile:source.configFile});
+    }
+  }
+  for(const source of c.sources)if(source.buildResultPath){
+    const companion=c.sources.filter(other=>other!==source && other.config.qualitySummary && other.config.project===source.config.project && other.config.scope===source.config.scope && other.config.ref.replace(/^(?:origin\/|refs\/heads\/)/,'')===source.config.ref.replace(/^(?:origin\/|refs\/heads\/)/,''));
+    assert(companion.length===1 && companion[0].buildDispatch,'验证构建须绑定同范围CHECK与正式Review续建，不能独立冒充完整九维');
+    const dispatch=loadBuildDispatch({config:companion[0].buildDispatch,ciConfigFile:companion[0].configFile});
+    assert(dispatch.b.jobs.build===source.config.jobPath && dispatch.registry.jenkinsOrigin===source.config.baseUrl+'/','验证构建采集必须对应受控续建的实际BUILD任务');
   }
   if (c.deployments !== undefined) {
     assert(c.deployments && typeof c.deployments.deliveryDir === "string" && c.deployments.configs && typeof c.deployments.configs === "object" && !Array.isArray(c.deployments.configs) && Object.keys(c.deployments.configs).length > 0, "部署回流必须登记固定交付目录和配置映射");
@@ -57,9 +76,11 @@ export async function automationTick({ configFile, send = false, env = process.e
   const monotonicStart = performance.now(), currentInstant = () => now + Math.ceil(performance.now() - monotonicStart);
   const c = loadAutomationConfig(configFile), executionId = `tick-${randomUUID()}`, tickDir = path.join(c.dataDir, executionId);
   const binding = hash(stableStringify({ ...c, governance: c.governance }));
+  assert(!existsSync(path.join(c.dataDir, "fleet-maintenance.json")), "批量接入维护中；完成原批次续跑或回退，不删除业务台账");
   // Acquire the scheduler lock across discovery, receipt ingestion and outbox;
   // governance has a separate lock so authenticated actions remain serializable.
   return lockedJson(path.join(c.dataDir, "automation-state.json"), { schemaVersion: 1, binding, runs: {}, history: [], health: {}, discovery: {}, reviewPublications: {} }, async (state, checkpoint) => {
+    assert(!existsSync(path.join(c.dataDir, "fleet-maintenance.json")), "批量接入维护中，稍后再采集");
     assert(state.schemaVersion === 1 && state.binding === binding && state.runs && Array.isArray(state.history) && state.health && typeof state.health === "object" && !Array.isArray(state.health), "自动执行器配置身份变化或状态损坏，不能静默重置");
     state.discovery ??= {}; state.reviewPublications ??= {};
     // Fail before querying/signing anything if the ledger itself cannot be read.
@@ -119,7 +140,7 @@ export async function automationTick({ configFile, send = false, env = process.e
             assert(Number.isSafeInteger(Number(run.runId)) && Number(run.runId) > 0 && Number(run.runId) <= Math.floor((Number.MAX_SAFE_INTEGER - 9999) / 10000) && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(run.sha), "发现的流水线身份超出顺序预算");
             assert(new URL(run.pipelineUrl).origin === source.config.baseUrl && run.ref === source.config.ref && Number.isFinite(Date.parse(run.dueAt)), "发现的流水线范围/截止时间无效");
             if (record) assert(record.sha === run.sha && record.project === source.config.project && record.scope === source.config.scope, "同runId源码身份发生变化，禁止覆盖原证据");
-            else record = state.runs[runKey] = { project: source.config.project, scope: source.config.scope, sha: run.sha, pipelineId: String(run.runId), pipelineUrl: run.pipelineUrl, dueAt: run.dueAt, generation: 0, revisions: {} };
+            else record = state.runs[runKey] = { project: source.config.project, scope: source.config.scope, qualitySource:!!source.config.qualitySummary,sha: run.sha, pipelineId: String(run.runId), pipelineUrl: run.pipelineUrl, dueAt: run.dueAt, generation: 0, revisions: {} };
             assert(record.revisions && typeof record.revisions === "object" && Number.isSafeInteger(record.generation), "运行进度损坏，不能重置");
             const revision = run.observedRevision || hash(stableStringify({ status: run.status, missingJobs: run.missingJobs, actorSource: run.actorSource, sha: run.sha }));
             assert(/^[a-f0-9]{64}$/.test(revision), "发现快照摘要无效");
@@ -128,7 +149,7 @@ export async function automationTick({ configFile, send = false, env = process.e
               if (!progress.qualityDone && alreadyIngested(progress.qualityReceiptFile, progress.collection.sourceFile, progress.collection.summaryFile)) progress.qualityDone = true;
               if (!progress.buildDone && alreadyIngested(progress.buildReceiptFile, progress.build?.sourceFile)) progress.buildDone = true;
               if (!progress.reviewDone && alreadyIngested(progress.reviewReceiptFile, progress.reviewLifecycle?.sourceFile)) progress.reviewDone = true;
-              if ((!progress.collection.eventFile || progress.qualityDone) && (!source.manifestPath || progress.buildDone) && (!source.review || progress.review && progress.reviewDone)) progress.done = true;
+              if ((!progress.collection.eventFile || progress.qualityDone) && (!(source.manifestPath || source.buildResultPath) || progress.buildDone) && (!source.review || progress.review && progress.reviewDone)) progress.done = true;
               checkpoint();
             }
             if (progress?.collection && !progress.done) {
@@ -173,9 +194,10 @@ export async function automationTick({ configFile, send = false, env = process.e
               await afterStage("quality-ingested", { source: source.id, runId: run.runId, revision });
               progress.qualityDone = true; checkpoint();
             }
-            if (source.manifestPath && !progress.buildDone) {
+            if ((source.manifestPath || source.buildResultPath) && !progress.buildDone) {
               if (!progress.build) {
-                progress.build = createBuildLifecycle({ configFile: source.configFile, sourceFile: collection.sourceFile, manifestPath: source.manifestPath, env: source.environment, sha: run.sha, outDir: path.join(tickDir, source.id, `build-${run.runId}`), now });
+                const create=source.buildResultPath?createValidationBuildLifecycle:createBuildLifecycle;
+                progress.build = create({ configFile: source.configFile, sourceFile: collection.sourceFile, manifestPath: source.manifestPath, resultPath:source.buildResultPath,env: source.environment, sha: run.sha, outDir: path.join(tickDir, source.id, `build-${run.runId}`), now });
                 progress.buildReceiptFile = sign(readControlledJson(progress.build.eventFile), `${source.id}/build-${run.runId}`); checkpoint();
               }
               progress.buildReceiptFile = refreshReceipt(progress.buildReceiptFile, `${source.id}/build-${run.runId}`); checkpoint();
@@ -209,7 +231,7 @@ export async function automationTick({ configFile, send = false, env = process.e
         window.pendingRunIds = window.pendingRunIds.filter((id) => { const run = state.runs[`${source.id}:${id}`]; return failedRunIds.has(id) || !run?.terminal || !run.revisions?.[run.lastObservation]?.done; }); checkpoint();
         // Include all remembered runs, even when an API lookback no longer
         // returns an old missing/canceled job. A later healthy run cannot erase it.
-        const expectedRuns = Object.entries(state.runs).filter(([key]) => key.slice(0, key.lastIndexOf(":")) === source.id).flatMap(([, r]) => Object.values(r.revisions).map((p) => ({ project: r.project, scope: r.scope, sha: r.sha, pipelineId: r.pipelineId, sequence: p.sequence, pipelineUrl: r.pipelineUrl, dueAt: r.dueAt })));
+        const expectedRuns = Object.entries(state.runs).filter(([key,r]) => r.qualitySource!==false && key.slice(0, key.lastIndexOf(":")) === source.id).flatMap(([, r]) => Object.values(r.revisions).map((p) => ({ project: r.project, scope: r.scope, sha: r.sha, pipelineId: r.pipelineId, sequence: p.sequence, pipelineUrl: r.pipelineUrl, dueAt: r.dueAt })));
         item.reconciliation = reconcileGovernance({ configFile: c.governanceConfigFile, stateFile: c.stateFile, expectationsFile: sign({ schemaVersion: 1, kind: "pipeline-expectations", eventId: `query-${source.id}-${randomUUID()}`, expectedRuns }, `${source.id}/expectations`), now });
       } catch (error) { item.errors.push({ stage: "source", reason: error.message }); }
       if (source.review?.publication) {
@@ -219,6 +241,12 @@ export async function automationTick({ configFile, send = false, env = process.e
           item.errors.push(...item.formalReviews.errors.map((e) => ({ stage: "formal-review", ...e })));
         } catch (error) { item.errors.push({ stage: "formal-review", reason: error.message }); }
       }
+      if(source.buildDispatch){
+        try{
+          item.buildDispatch=await dispatchApprovedBuilds({config:source.buildDispatch,ciConfigFile:source.configFile,dataDir:path.join(c.dataDir,'build-dispatch',source.id),send,env,fetchImpl,now:currentInstant(),afterStage});
+          item.errors.push(...item.buildDispatch.errors.map(e=>({stage:'build-dispatch',...e})),...item.buildDispatch.unknown.map(id=>({stage:'build-dispatch',reason:'续建结果待自动对账，不盲目重复触发',id})));
+        }catch(error){item.errors.push({stage:'build-dispatch',reason:error.message});}
+      }
     }
     const deploymentErrors = [];
     if (c.deployments) {
@@ -286,7 +314,7 @@ export async function automationTick({ configFile, send = false, env = process.e
     // A source outage still leaves a durable health result and allows retries /
     // SLA escalation / other projects' pending notifications to make progress.
     try {
-      reconcileGovernance({ configFile: c.governanceConfigFile, stateFile: c.stateFile, expectationsFile: sign({ schemaVersion: 1, kind: "pipeline-expectations", eventId: `sla-${randomUUID()}`, expectedRuns: Object.values(state.runs).flatMap((r) => Object.values(r.revisions || {}).map((p) => ({ project: r.project, scope: r.scope, sha: r.sha, pipelineId: r.pipelineId, sequence: p.sequence, pipelineUrl: r.pipelineUrl, dueAt: r.dueAt }))) }, "all-expectations"), now });
+      reconcileGovernance({ configFile: c.governanceConfigFile, stateFile: c.stateFile, expectationsFile: sign({ schemaVersion: 1, kind: "pipeline-expectations", eventId: `sla-${randomUUID()}`, expectedRuns: Object.values(state.runs).filter(r=>r.qualitySource!==false).flatMap((r) => Object.values(r.revisions || {}).map((p) => ({ project: r.project, scope: r.scope, sha: r.sha, pipelineId: r.pipelineId, sequence: p.sequence, pipelineUrl: r.pipelineUrl, dueAt: r.dueAt }))) }, "all-expectations"), now });
       result.delivery = await dispatchGovernance({ configFile: c.governanceConfigFile, stateFile: c.stateFile, includeDigest: true, send, env, fetchImpl, now: currentInstant() });
       if (result.delivery.results?.some((r) => r.status !== "delivered") || result.delivery.deadLetters?.length || result.delivery.unknownDeliveries?.length) result.errors.push({ stage: "delivery", reason: "消息存在待恢复投递；查看认证操作入口" });
     } catch (error) { result.errors.push({ stage: "outbox", reason: error.message }); }

package/lib/build-artifacts.js

@@ -0,0 +1,42 @@
+import path from 'node:path';
+import {globSync,lstatSync,readFileSync,mkdirSync,writeFileSync} from 'node:fs';
+import {safePath} from './source-state.js';
+import {createHash} from 'node:crypto';
+const sha256=value=>createHash('sha256').update(value).digest('hex');
+
+export const BUILD_RESULT_PATH='quality-reports/ci-integration/build-result.json';
+export const BUILD_ARCHIVE_PATH='quality-reports/ci-integration/business-artifacts.zip';
+const MAX_BYTES=256*1024*1024,MAX_FILES=5000;
+const assert=(ok,message)=>{if(!ok)throw Error(message);};
+const table=Array.from({length:256},(_,i)=>{let c=i;for(let n=0;n<8;n++)c=c&1?0xedb88320^(c>>>1):c>>>1;return c>>>0;});
+const crc32=bytes=>{let c=0xffffffff;for(const b of bytes)c=table[(c^b)&255]^(c>>>8);return (c^0xffffffff)>>>0;};
+
+// A deterministic ZIP with ordinary stored files; no shell, package download,
+// platform-specific archiver or executable metadata. The collector downloads
+// exactly this fixed artifact, rather than trusting a workspace glob remotely.
+export function archiveBuildArtifacts({root,artifactGlob}) {
+  const names=new Set();let matched=0;
+  for(const pattern of artifactGlob.split(',').map(v=>v.trim()))for(const file of globSync(pattern,{cwd:root})) {
+    assert(++matched<=MAX_FILES*4,'制品匹配超过预算，请收紧批准范围');
+    const relative=file.split(path.sep).join('/');
+    assert(!relative.split('/').some(p=>['.git','node_modules','quality-reports'].includes(p)),'制品范围不能夹带Git、依赖或门禁记录');
+    const stat=lstatSync(safePath(root,relative));assert(!stat.isSymbolicLink(),'制品不能含符号链接');
+    if(stat.isFile())names.add(relative);else assert(stat.isDirectory(),'制品包含特殊文件');
+  }
+  assert(names.size && names.size<=MAX_FILES,'批准范围没有实际制品或超过5000文件预算');
+  const local=[],central=[],entries=[];let offset=0,total=0,centralSize=0;
+  for(const name of [...names].sort()) {
+    const stat=lstatSync(safePath(root,name));assert(stat.size<=MAX_BYTES-total,'制品超过256MiB预算，请拆分批准构建范围');
+    const bytes=readFileSync(safePath(root,name));total+=bytes.length;
+    assert(bytes.length===stat.size && total<=MAX_BYTES,'制品读取期间变化或超过预算');
+    const filename=Buffer.from(name),crc=crc32(bytes);assert(filename.length<=65535,'制品文件名过长');
+    const header=Buffer.alloc(30);header.writeUInt32LE(0x04034b50);header.writeUInt16LE(20,4);header.writeUInt16LE(0x800,6);header.writeUInt16LE(0x21,12);header.writeUInt32LE(crc,14);header.writeUInt32LE(bytes.length,18);header.writeUInt32LE(bytes.length,22);header.writeUInt16LE(filename.length,26);
+    const index=Buffer.alloc(46);index.writeUInt32LE(0x02014b50);index.writeUInt16LE(20,4);index.writeUInt16LE(20,6);index.writeUInt16LE(0x800,8);index.writeUInt16LE(0x21,14);index.writeUInt32LE(crc,16);index.writeUInt32LE(bytes.length,20);index.writeUInt32LE(bytes.length,24);index.writeUInt16LE(filename.length,28);index.writeUInt32LE(offset,42);
+    local.push(header,filename,bytes);central.push(index,filename);centralSize+=46+filename.length;offset+=30+filename.length+bytes.length;
+    entries.push({path:name,bytes:bytes.length,sha256:sha256(bytes)});
+  }
+  const end=Buffer.alloc(22);end.writeUInt32LE(0x06054b50);end.writeUInt16LE(entries.length,8);end.writeUInt16LE(entries.length,10);end.writeUInt32LE(centralSize,12);end.writeUInt32LE(offset,16);
+  assert(offset+centralSize+22<=MAX_BYTES,'制品ZIP超过256MiB采集预算');
+  const archive=Buffer.concat([...local,...central,end]),file=safePath(root,BUILD_ARCHIVE_PATH);mkdirSync(path.dirname(file),{recursive:true});writeFileSync(file,archive,{flag:'wx',mode:0o600});
+  return {path:BUILD_ARCHIVE_PATH,sha256:sha256(archive),bytes:archive.length,entries};
+}

package/lib/central-check-notification.js

@@ -0,0 +1,33 @@
+import {pipelineCheckNotification} from './pipeline-notification.js';
+import {findingPreview} from './notification-style.js';
+import {sha256,stableStringify} from './util.js';
+
+export const scopeNotification=(config,project,scope)=>config.projects[project].scopes[scope].notification;
+export const scopeChannel=(config,project,scope)=>scopeNotification(config,project,scope)?.channel || config.projects[project].channel;
+const branch=ref=>ref?.replace(/^(?:refs\/remotes\/origin\/|refs\/heads\/|origin\/)/,'');
+const short=(value,max=500)=>typeof value==='string'?[...value].slice(0,max).join(''):value;
+
+// Immutable, bounded view of an already validated full source report. The full
+// nine-dimensional report stays archived; one outbox row per run, not per risk.
+export function checkSnapshot(report,event,notification){
+  const findings=report.decision.status==='invalid'?[{severity:'error',ruleId:'GOV/CHECK-INVALID',file:'quality/policy',message:'检查执行失效，修复接线后重跑',dimension:'scan'}]:report.findings;
+  const totals=Object.fromEntries(['blocker','error','warning','info'].map(level=>[level,findings.filter(f=>f.severity===level).length]));
+  const preview=findingPreview(findings).visible.map(f=>Object.fromEntries(['severity','ruleId','file','line','endLine','message','suggestion','dimension'].filter(k=>f[k]!==undefined).map(k=>[k,short(f[k])])));
+  const actualBranch=branch(event.ref);
+  if(actualBranch!==notification.branch)throw Error('质量事件实际分支与通知批准分支不一致');
+  const commit=report.run.trace?.commits?.[0];
+  return {schemaVersion:1,kind:'quality-check-notification',eventId:event.eventId,project:event.project,scope:event.scope,sha:event.sha,authorId:event.authorId,reportHash:event.reportHash,
+    reportUrl:event.reportUrl,pipelineUrl:event.pipelineUrl,totals,
+    summary:{run:{project:event.project,commitSha:event.sha,stage:'ci',eventId:event.reportEventId || event.eventId,startedAt:report.run.startedAt,...(report.run.finishedAt?{finishedAt:report.run.finishedAt}:{}),
+      trace:{branch:actualBranch,...(commit?{commits:[{subject:short(commit.subject,250)}]}:{})}},decision:{status:report.decision.status},findings:preview},
+    presentation:{submitterId:event.authorId,reportUrl:event.reportUrl,pipelineLabel:`${event.jobId} · 运行 ${event.pipelineId}`,surface:notification.surface,approvedBranch:notification.branch,validationBranch:notification.validationBranch===true,requireResolvedFindings:notification.requireResolvedFindings===true,
+      executionStates:[{name:'完整代码检查',status:report.decision.status==='passed'?'passed':'blocked',result:report.decision.status==='passed'?'机器结果已记录':'未通过，修复后复扫'},{name:'正式Review / 业务构建',status:'pending',result:'本条仅为检查结果；以独立正式记录为准'}]}};
+}
+export function checkSnapshotHash(snapshot){return sha256(stableStringify(snapshot));}
+export function centralCheckNotification(snapshot,config){
+  const project=config.projects[snapshot.project],n=scopeNotification(config,snapshot.project,snapshot.scope);
+  const viewConfig={...config,projects:{...config.projects,[snapshot.project]:{...project,...(n.technicalManager?{technicalManager:n.technicalManager}:{})}}};
+  const result=pipelineCheckNotification({summary:snapshot.summary,notificationTotals:snapshot.totals,presentation:snapshot.presentation},viewConfig);
+  if(!result.payload)throw Error('批准检查消息被错误跳过');
+  return result;
+}

package/lib/ci-discovery.js

@@ -1,3 +1,4 @@
+import { jenkinsJobConfigHash } from './jenkins-job-config.js';
 import { createHash } from "node:crypto";
 import { loadCiSourceConfig } from "./ci-source.js";
 import { stableStringify } from "./util.js";
@@ -170,7 +171,7 @@ let pipelineUrl;
   } else {
     const jobPath = config.jobPath.split("/").map((part) => `job/${encodeURIComponent(part)}`).join("/");
     const xml = await get(`/${jobPath}/config.xml`, { xml: true });
-    assert(createHash("sha256").update(xml.body).digest("hex") === config.jobConfigHash, "Jenkins发现作业配置与批准摘要不一致");
+    assert(jenkinsJobConfigHash(xml.body, config.jobConfigHashScheme) === config.jobConfigHash, "Jenkins发现作业配置与批准摘要不一致");
     const processed = new Set();
     const inspect = async (runId, listedTimestamp, recheck = false) => {
       if(processed.has(runId)) return; requireTime(); processed.add(runId); highWatermarkRunId=Math.max(highWatermarkRunId,runId);
@@ -188,11 +189,16 @@ let pipelineUrl;
           const status = build.building ? "running" : states[build.result]; assert(status, "Jenkins发现构建状态未知");
           const causes = (build.actions || []).flatMap((action) => action.causes || []).filter((cause) => cause._class === "hudson.model.Cause$UserIdCause" && typeof cause.userId === "string" && cause.userId);
           const users = [...new Set(causes.map((cause) => cause.userId))], userId = users.length === 1 ? users[0] : null;
-          const actor = userId === null && actorSource ? await mergedCommitOwner(sha) : owner(userId, userId !== null);
+          // A person clicking Build can differ from the candidate author. When
+          // an approved upstream source exists, always verify that association;
+          // manual retries must not silently replace the author with the clicker.
+          const trigger = owner(userId, userId !== null);
+          const actor = actorSource ? await mergedCommitOwner(sha) : trigger;
           const final = (await get(`${buildPath}api/json`)).value;
           const facts = (value) => ({ number: value.number, timestamp: value.timestamp, building: value.building, result: value.result, actions: value.actions, artifacts: value.artifacts, url: value.url ?? null });
           assert(digest(facts(build)) === digest(facts(final)), "Jenkins发现期间构建事实改变，等待下次稳定发现");
           push({ runId, sha, ref: config.ref, occurredAt, pipelineUrl, ...actor,
+            ...(actorSource ? { triggerSource: { ...trigger.actorSource, employeeId: trigger.authorId, role: "build-trigger" } } : {}),
             terminal: !build.building, missingJobs: [], status, sourceStatus: status, requiredJobs: [{ id: runId, name: config.jobPath, status, trusted: true }], issues: actor.authorId === null ? [{ reason: actor.actorSource.reason || "no-unique-authenticated-author" }] : [],
             observedRevision: digest({ build: facts(final), configHash: config.jobConfigHash, actorSource: actor.actorSource }) });
         } catch (error) { if (error.code === "CI_DISCOVERY_TIME_BUDGET") throw error; discoveryErrors.push({ runId, ...(pipelineUrl ? { pipelineUrl } : {}), reason: error.message }); }
@@ -215,7 +221,7 @@ let pipelineUrl;
     }
     jenkinsFinalCheck = true;
     const final = await get(`/${jobPath}/config.xml`, { xml: true });
-    assert(createHash("sha256").update(final.body).digest("hex") === config.jobConfigHash, "Jenkins发现期间作业配置变化");
+    assert(jenkinsJobConfigHash(final.body, config.jobConfigHashScheme) === config.jobConfigHash, "Jenkins发现期间作业配置变化");
   }
   } catch (error) {
     if (error.code !== "CI_DISCOVERY_TIME_BUDGET") throw error;

package/lib/ci-source.js

@@ -1,3 +1,5 @@
+import {ENTRY_CONTEXT_PATH,validateNativeSource,assertNativeProof} from './jenkins-entry-contract.js';
+import { jenkinsJobConfigHash } from './jenkins-job-config.js';
 import { readFileSync, mkdirSync, writeFileSync, lstatSync, existsSync, rmSync } from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
@@ -25,6 +27,7 @@ export function loadCiSourceConfig(file) {
   assert(typeof config.ref === "string" && config.ref && !/[\u0000-\u001f]/.test(config.ref), "必须固定实际分支/候选ref");
   assert(config.artifacts && config.requiredJobs.includes(config.artifacts.job) && Array.isArray(config.artifacts.paths) && config.artifacts.paths.length && config.artifacts.paths.every(relative) && new Set(config.artifacts.paths).size === config.artifacts.paths.length, "必须固定证据作业和工件路径，不能使用glob/越界路径");
   if (config.qualitySummary !== undefined) assert(config.artifacts.paths.includes(config.qualitySummary), "qualitySummary未登记在固定工件清单");
+  if (config.reportPublication !== undefined) assert(config.system === "jenkins" && config.qualitySummary && relative(config.reportPublication.manifestPath) && config.artifacts.paths.includes(config.reportPublication.manifestPath) && !config.artifacts.optionalPaths?.includes(config.reportPublication.manifestPath), "在线报告需绑定Jenkins和固定必需归档清单");
   if (config.artifacts.optionalPaths !== undefined) assert(Array.isArray(config.artifacts.optionalPaths) && new Set(config.artifacts.optionalPaths).size === config.artifacts.optionalPaths.length && config.artifacts.optionalPaths.every((p) => config.artifacts.paths.includes(p) && p !== config.qualitySummary), "可选Review工件必须在固定清单内且不能包含原始Gate报告");
   if (config.system === "gitlab") {
     assert(positive(config.projectId), "GitLab必须固定数字projectId");
@@ -34,7 +37,9 @@ export function loadCiSourceConfig(file) {
     assert(relative(config.jobPath) && config.requiredJobs.length === 1 && config.requiredJobs[0] === config.jobPath, "Jenkins必须固定唯一jobPath；多条作业分别采集并由受控发布作业汇总");
     assert(/^[A-Z][A-Z0-9_]+$/.test(config.userEnv || ""), "Jenkins用户必须用环境变量引用");
     assert(/^[a-f0-9]{64}$/.test(config.jobConfigHash || ""), "Jenkins必须固定批准job config.xml摘要");
+    assert(config.jobConfigHashScheme === undefined || ["raw", "stable-v1"].includes(config.jobConfigHashScheme), "未知Jenkins作业摘要协议");
   }
+  if(config.nativeEntry)validateNativeSource(config);
   config.maxArtifactBytes ??= 64 * 1024 * 1024;
   assert(Number.isSafeInteger(config.maxArtifactBytes) && config.maxArtifactBytes > 0 && config.maxArtifactBytes <= 256 * 1024 * 1024, "工件预算无效");
   return config;
@@ -61,7 +66,7 @@ export async function collectCiSource({ configFile, requestFile, outDir, env = p
   const headers = config.system === "gitlab" ? { "PRIVATE-TOKEN": token } : { Authorization: `Basic ${Buffer.from(`${env[config.userEnv] || ""}:${token}`).toString("base64")}` };
   if (config.system === "jenkins") assert(env[config.userEnv] && !/[:\r\n]/.test(env[config.userEnv]), "缺少有效Jenkins只读用户");
   const responses = [], artifacts = [], missingArtifacts = [];
-  const get = async (route, binary = false, snapshot) => {
+  const get = async (route, binary = false, snapshot, html = false) => {
     const url = new URL(route, config.baseUrl);
     assert(url.origin === config.baseUrl && !url.username && !url.password, "CI来源越出固定origin");
     let response;
@@ -69,6 +74,7 @@ export async function collectCiSource({ configFile, requestFile, outDir, env = p
     catch { throw new Error("CI只读查询连接失败；没有接受webhook自报结果"); }
     assert(!response.url || new URL(response.url).origin === config.baseUrl, "CI响应来源发生跳转");
     if (!response.ok) { const error = new Error(`CI只读查询失败: HTTP ${response.status}`); error.ciStatus = response.status; throw error; }
+    if (html) assert(response.status === 200 && /^text\/html(?:;|$)/i.test(response.headers.get("content-type") || ""), "在线报告没有返回HTML，拒绝发送详情按钮");
     const body = await bytes(response, binary ? config.maxArtifactBytes : 10 * 1024 * 1024);
     if (binary) return body;
     const raw = body.toString("utf8"); let parsed;
@@ -119,7 +125,7 @@ export async function collectCiSource({ configFile, requestFile, outDir, env = p
   } else {
     const jobPath = config.jobPath.split("/").map((v) => `job/${encodeURIComponent(v)}`).join("/");
     const configXml = await get(`/${jobPath}/config.xml`, true);
-    assert(digest(configXml) === config.jobConfigHash, "Jenkins作业配置与批准摘要不一致");
+    assert(jenkinsJobConfigHash(configXml, config.jobConfigHashScheme) === config.jobConfigHash, "Jenkins作业配置与批准摘要不一致");
     // Job XML can contain legacy inline secrets. Keep its verified digest,
     // never copy configuration text into the report/chat evidence bundle.
     responses.push({ url: `${config.baseUrl}/${jobPath}/config.xml`, sha256: digest(configXml), rawOmitted: "controlled-job-configuration" });
@@ -147,6 +153,7 @@ export async function collectCiSource({ configFile, requestFile, outDir, env = p
     try { const body = await get(artifactRoute(file), true); artifacts.push({ path: file, sha256: digest(body), bytes: body.byteLength, body }); }
     catch (error) { if (optional && [404, 410].includes(error.ciStatus)) missingArtifacts.push({ path: file, reason: "optional-unavailable" }); else { if (jobStatus === "success") throw error; missingArtifacts.push({ path: file, reason: "download-unavailable" }); } }
   }
+  if(config.nativeEntry&&terminal){const proof=artifacts.find(a=>a.path===ENTRY_CONTEXT_PATH);assert(proof,'当前作业缺少公共入口原始执行证据，不能按成功或质量结果采集');let value;try{value=JSON.parse(proof.body);}catch{throw Error('公共入口执行证据不是JSON');}assertNativeProof(value,config,request);}
   // A concurrent retry, erase, SCM update or result change invalidates the
   // collection instead of mixing one run's status with another run's bytes.
   const final = (await get(recheckRoute, false, config.system === "gitlab" ? "final-artifact-job" : "final-build")).parsed;
@@ -154,7 +161,7 @@ export async function collectCiSource({ configFile, requestFile, outDir, env = p
   else {
     assert(String(final.number) === String(request.runId) && final.building === job.building && final.result === job.result && stableStringify(final.actions) === stableStringify(job.actions) && stableStringify(final.artifacts) === stableStringify(job.artifacts), "工件采集后Jenkins构建改变，重新采集");
     const jobPath = config.jobPath.split("/").map((v) => `job/${encodeURIComponent(v)}`).join("/");
-    assert(digest(await get(`/${jobPath}/config.xml`, true)) === config.jobConfigHash, "采集期间Jenkins作业配置变化，重新采集");
+    assert(jenkinsJobConfigHash(await get(`/${jobPath}/config.xml`, true), config.jobConfigHashScheme) === config.jobConfigHash, "采集期间Jenkins作业配置变化，重新采集");
   }
   if (recheckJobs) await recheckJobs();
   const passed = jobs.every((v) => v.status === "success");
@@ -163,7 +170,7 @@ export async function collectCiSource({ configFile, requestFile, outDir, env = p
     status: passed ? "success" : "not-passed", pipelineUrl, jobUrl, jobId: String(job.id ?? job.number), jobStatus,
     configHash: digest(stableStringify(config)), requiredJobsSnapshot: config.system === "gitlab" ? "final-required-jobs" : "final-build", requiredJobs: jobs.map((v) => ({ id: String(v.id ?? v.number), name: v.name, status: v.status })),
     responses, artifacts: artifacts.map(({ body, ...v }) => v), missingArtifacts };
-  let event;
+  let event, publishedHtml;
   if (config.qualitySummary && terminal) {
     const content = artifacts.find((v) => v.path === config.qualitySummary)?.body;
     let summary, reason;
@@ -184,6 +191,19 @@ export async function collectCiSource({ configFile, requestFile, outDir, env = p
       reportHash: digest(content), reportUrl: new URL(artifactRoute(config.qualitySummary), config.baseUrl).href, pipelineUrl,
       occurredAt: new Date(now).toISOString(),ref:config.ref };
   }
+  if (event && config.reportPublication) {
+    const body = artifacts.find((a) => a.path === config.reportPublication.manifestPath)?.body;
+    assert(body, "本轮缺少报告发布归档，不能生成详情按钮");
+    const p = JSON.parse(body), report = JSON.parse(artifacts.find((a) => a.path === config.qualitySummary).body);
+    assert(p.kind === "quality-report-archive" && p.schemaVersion === 1 && p.project === config.project && p.commitSha === request.sha && p.eventId === report.run.eventId && p.stage === report.run.stage && ["local-hook", "ci"].includes(p.stage) && /^[a-f0-9]{64}$/.test(p.archiveId || "") && /^[a-f0-9]{64}$/.test(p.htmlSha256 || ""), "在线报告没有绑定本项目、本轮SHA和检查阶段");
+    assert(p.summarySha256 === digest(json(report)) && p.buildUrl === jobUrl && p.relativeDirectory === `${config.project}/${p.stage}/${p.archiveId}`, "在线报告归档与当前作业或原始报告不一致");
+    const url = new URL(`wl-quality/${p.relativeDirectory}/index.html`, jobUrl);
+    assert(p.reportUrl === url.href, "在线报告链接不是本次构建的固定归档");
+    publishedHtml = await get(url.pathname, true, undefined, true);
+    assert(digest(publishedHtml) === p.htmlSha256, "在线报告是登录页、旧报告或已被修改；禁止发送失效详情按钮");
+    observation.publishedReport = { url: url.href, htmlSha256: p.htmlSha256, archiveId: p.archiveId, verifiedAt: new Date(now).toISOString() };
+    event.reportUrl = url.href;
+  }
   const sourceText = json(observation);
   if (event) event.source = { system: config.system, recordId: String(request.runId), recordHash: digest(sourceText), observedAt: new Date(now).toISOString(), url: jobUrl };
   // Persist only after the final source identity/state checks. A failed job may
@@ -195,6 +215,7 @@ export async function collectCiSource({ configFile, requestFile, outDir, env = p
   mkdirSync(output, { mode: 0o700 });
   try {
     writeFileSync(path.join(output, "source.json"), sourceText, { flag: "wx", mode: 0o600 });
+    if (publishedHtml) writeFileSync(path.join(output, "published-report.html"), publishedHtml, { flag: "wx", mode: 0o600 });
     for (const item of artifacts) { const dest = path.join(output, "artifacts", item.path); mkdirSync(path.dirname(dest), { recursive: true }); writeFileSync(dest, item.body, { flag: "wx", mode: 0o600 }); }
     if (event) writeFileSync(path.join(output, "quality-event.json"), json(event), { flag: "wx", mode: 0o600 });
   } catch (error) { rmSync(output, { recursive: true, force: true }); throw error; }

package/lib/feishu-members.js

@@ -0,0 +1,43 @@
+// Read one approved group. No message sending, membership mutation or config writes.
+export async function fetchFeishuMembers({ appId, appSecret, chatId, fetchImpl = fetch }) {
+  if (!/^cli_[A-Za-z0-9]+$/.test(appId || "") || !appSecret || !/^oc_[A-Za-z0-9]+$/.test(chatId || "")) throw new Error("需要应用App ID、App Secret及oc_开头的群ID");
+  async function request(url, options) {
+    const response = await fetchImpl(url, { ...options, redirect: "error", signal: AbortSignal.timeout(15000) });
+    if (!response.ok) throw new Error(`飞书接口HTTP ${response.status}，未生成成员清单`);
+    const result = await response.json();
+    if (result.code !== 0) throw new Error(`飞书接口拒绝（code=${Number.isSafeInteger(result.code) ? result.code : "invalid"}）；核对应用发布、只读权限与入群状态`);
+    return result;
+  }
+  const auth = await request("https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal", {
+    method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ app_id: appId, app_secret: appSecret }),
+  });
+  if (typeof auth.tenant_access_token !== "string" || !auth.tenant_access_token) throw new Error("飞书未返回有效应用令牌");
+  const members = new Map(), visited = new Set();
+  let pageToken = "";
+  for (let page = 0; page < 1000; page++) {
+    const url = new URL(`https://open.feishu.cn/open-apis/im/v1/chats/${encodeURIComponent(chatId)}/members`);
+    url.searchParams.set("member_id_type", "open_id"); url.searchParams.set("page_size", "100");
+    if (pageToken) url.searchParams.set("page_token", pageToken);
+    const result = await request(url.href, { method: "GET", headers: { Authorization: `Bearer ${auth.tenant_access_token}` } });
+    const data = result.data;
+    if (!data || !Array.isArray(data.items) || typeof data.has_more !== "boolean") throw new Error("群成员响应不完整，禁止将半份名单作为完整结果");
+    for (const member of data.items) {
+      if (member.member_id_type !== "open_id" || !/^ou_[A-Za-z0-9_-]+$/.test(member.member_id || "") || typeof member.name !== "string" || !member.name.trim()) throw new Error("群成员姓名/ID类型无效，拒绝猜测身份");
+      const entry = { name: member.name.trim(), idType: "open_id", id: member.member_id };
+      if (members.has(entry.id) && members.get(entry.id).name !== entry.name) throw new Error("群成员在分页期间发生身份信息变化，请重新读取");
+      members.set(entry.id, entry);
+    }
+    if (!data.has_more) return { schemaVersion: 1, kind: "feishu-group-members", appId, chatId, collectedAt: new Date().toISOString(), complete: true, count: members.size, members: [...members.values()].sort((a, b) => a.name.localeCompare(b.name, "zh-CN")) };
+    if (typeof data.page_token !== "string" || !data.page_token || visited.has(data.page_token)) throw new Error("群成员分页无有效进展，未导出残缺名单");
+    visited.add(data.page_token); pageToken = data.page_token;
+  }
+  throw new Error("群成员分页超出预算，未导出残缺名单");
+}
+
+export function matchFeishuNames(names, directory) {
+  if (directory?.complete !== true || !Array.isArray(directory.members)) throw new Error("只允许使用完整群成员清单匹配");
+  return [...new Set(names)].map((name) => {
+    const matches = directory.members.filter((member) => member.name === name);
+    return { name, status: matches.length === 1 ? "matched" : matches.length > 1 ? "ambiguous" : "missing", matches };
+  });
+}

package/lib/governance-notifications.js

@@ -1,8 +1,19 @@
 // Pure presentation: no credentials, network, approval, or issue-state mutation.
+import { formatNotificationTime } from "./notification-time.js";
+import { notificationText, riskCountsElement } from "./notification-style.js";
+import { notificationActors, responsibilityReminder } from "./notification-people.js";
 const clean = (value, max = 200) => String(value ?? "").replace(/[\u0000-\u001f\u007f\u202a-\u202e\u2066-\u2069]/g, " ").slice(0, max);
 const md = (value, max) => clean(value, max).replace(/[\\`*_~\[\]<>]/g, "\\$&");
 const button = (label, url) => ({ tag: "button", type: "default", text: { tag: "plain_text", content: label }, behaviors: [{ type: "open_url", default_url: url }] });
-const card = (title, template, content, links) => ({ msg_type: "interactive", card: { schema: "2.0", header: { template, title: { tag: "plain_text", content: clean(title, 160) } }, body: { elements: [{ tag: "markdown", content }, ...links.map(([label, url]) => button(label, url))] } } });
+const card = (title, template, content, links) => {
+  const [conclusion, next, ...metadata] = content.split("\n");
+  return { msg_type: "interactive", card: { schema: "2.0", header: { template, title: { tag: "plain_text", content: clean(title, 160) } }, body: { elements: [
+    notificationText(conclusion.replace(/^\*\*结论\*\*：/, ""), template, "heading-4"),
+    { tag: "markdown", text_size: "normal", content: metadata.join("\n") },
+    notificationText(next.replace(/^\*\*下一步\*\*：/, "下一步："), "blue"),
+    ...links.map(([label, url]) => button(label, url)),
+  ] } } };
+};
 function bounded(message, detailsUrl) {
   if (Buffer.byteLength(message.text, "utf8") <= 1800) return message;
   const suffix = `\n…内容已精简，查看完整详情：${detailsUrl}`;
@@ -24,52 +35,71 @@ function renderIssueNotification(items, config) {
   const label = category === "reminder" ? "处理提醒" : "代码质量";
   const status = issueStatus[issue.status];
   const next = issue.status === "closed" ? "查看独立复验记录；复发会重新打开" : issue.status === "awaitingVerification" ? "独立非作者复核人查看当前修复版本和实际业务复验，确认后关闭" : "主备查看定位与建议，确认修复方案后由脚本执行并复扫";
-  const links = [["查看报告", evidence.reportUrl], ["查看流水线", evidence.pipelineUrl], ["登录处理", `${project.issueBaseUrl.replace(/\/$/, "")}/${issue.id}`]];
-  const text = `${label} ${issue.severity} / ${item.kind}\n项目/范围：${issue.project}/${issue.scope}\n规则：${clean(issue.ruleId, 100)}\n位置：${clean(issue.file)}${issue.line ? ":" + issue.line : ""}\n状态/版本：${status}/${issue.revision}\n主责/备份/升级：${issue.owner}/${issue.backup}/${issue.escalationOwner}\n处理期限：${issue.resolveDueAt}\nSHA：${evidence.sha}\n${links.map(([name, url]) => `${name}：${url}`).join("\n")}`;
+  const links = [["查看报告", evidence.reportUrl], ...(evidence.stage === "local-hook" ? [] : [["查看流水线", evidence.pipelineUrl]]), ["登录处理", `${project.issueBaseUrl.replace(/\/$/, "")}/${issue.id}`]];
+  const text = `${label} ${issue.severity} / ${item.kind}\n项目/范围：${issue.project}/${issue.scope}\n规则：${clean(issue.ruleId, 100)}\n位置：${clean(issue.file)}${issue.line ? ":" + issue.line : ""}\n状态/版本：${status}/${issue.revision}\n主责/备份/升级：${issue.owner}/${issue.backup}/${issue.escalationOwner}\n处理期限：${formatNotificationTime(issue.resolveDueAt)}\nSHA：${evidence.sha}\n${links.map(([name, url]) => `${name}：${url}`).join("\n")}`;
   const template = issue.status === "closed" ? "green" : issue.status === "awaitingVerification" || issue.severity === "warning" ? "orange" : "red";
-  return bounded({ category, text, payload: card(`[${label}] ${issue.project} · ${status}`, template, `**结论**：${md(status)}\n**下一步**：${next}\n**项目/范围**：${md(issue.project)}/${md(issue.scope)}\n**规则/位置**：${md(issue.ruleId, 100)} · ${md(issue.file, 160)}${issue.line ? ":" + issue.line : ""}\n**主责/备份/升级**：${md(issue.owner)}/${md(issue.backup)}/${md(issue.escalationOwner)}\n**期限**：${md(issue.resolveDueAt)}\n**SHA**：${md(evidence.sha)}\n**事件/版本**：${md(item.kind)}/${issue.revision}`, links) }, project.issueBaseUrl);
+  return bounded({ category, text, payload: card(`[${label}] ${issue.project} · ${status}`, template, `**结论**：${md(status)}\n**下一步**：${next}\n**项目/范围**：${md(issue.project)}/${md(issue.scope)}\n**规则/位置**：${md(issue.ruleId, 100)} · ${md(issue.file, 160)}${issue.line ? ":" + issue.line : ""}\n**主责/备份/升级**：${md(issue.owner)}/${md(issue.backup)}/${md(issue.escalationOwner)}\n**期限**：${formatNotificationTime(issue.resolveDueAt)}\n**SHA**：${md(evidence.sha)}\n**事件/版本**：${md(item.kind)}/${issue.revision}`, links) }, project.issueBaseUrl);
 }
 
 export function issueNotification(items, config) {
+  const subject=items[0].snapshot,override=config.projects[subject.project].scopes?.[subject.scope]?.notification?.technicalManager;
+  if(override)config={...config,projects:{...config.projects,[subject.project]:{...config.projects[subject.project],technicalManager:override}}};
   const message=renderIssueNotification(items,config), issue=items[0].snapshot, project=config.projects[issue.project];
   const evidence=issue.pendingEvidence || issue.latestEvidence, executor=evidence.authorId;
-  const manager=project.technicalManager, actors=[...new Set([executor,manager].filter(Boolean))];
+  const manager=project.technicalManager, {actors,observer}=notificationActors(executor,project,config.people);
   const people=actors.map(actor=>({actor,...config.people?.[actor]}));
   const high=items.some(item=>["blocker","error"].includes(item.snapshot.severity));
   const mapped=people.length===actors.length && actors.length>0 && people.every(person=>person.name && person.feishu?.id && person.feishu.id!=="all" && /^[A-Za-z0-9_-]{1,128}$/.test(person.feishu.id));
-  if(high && project.requireRiskMentions===true && (!executor || !manager || !mapped)) throw new Error("阻断报告缺执行人/技术经理实名@映射；禁止伪造@或@全体，需走渠道故障兜底");
-  const mentions=high && mapped ? [...new Set(people.map(person=>person.feishu.id))].map(id=>`<at id="${id}"></at>`).join(" ") : "";
-  const display=actor=>config.people?.[actor]?.name ? `${md(config.people[actor].name)}（${md(actor)}）` : md(actor || "未核验");
+  if((high || observer) && project.requireRiskMentions===true && (!executor || !manager || !mapped)) throw new Error("报告缺执行人/技术经理/同步人实名@映射；禁止伪造@或@全体，需走渠道故障兜底");
+  const mentionIds=mapped ? [...new Set(people.filter(person=>high || person.actor===observer).map(person=>person.feishu.id))] : [];
+  const display=actor=>config.people?.[actor]?.name ? md(config.people[actor].name) : md(actor || "未核验");
   const counts=evidence.riskCounts;
   const summary=[`**项目领域**：【${md(project.domain || "未登记")}】 ${md(issue.project)}`,
     `**检查阶段**：${evidence.stage==="local-hook"?"第一道 · 项目Hook":evidence.stage==="ci"?"第二道 · CI合并/构建":"阶段待核验"}`,
-    `**执行人 / 技术经理**：${display(executor)} / ${display(manager)}`,
-    `**发生 / 通知**：${md(evidence.occurredAt || issue.firstSourceOccurredAt || "未提供")} / ${md(items[0].createdAt || issue.openedAt)}（ISO时区）`,
+    `**提交人**：${display(executor)}　｜　**技术经理**：${display(manager)}${observer ? `　｜　**同步**：${display(observer)}` : ""}`,
+    `**发生时间**：${formatNotificationTime(evidence.occurredAt || issue.firstSourceOccurredAt)}`,
+    `**通知时间**：${formatNotificationTime(items[0].createdAt || issue.openedAt)}`,
     ...(evidence.trace ? [`**分支**：${md(evidence.trace.sourceBranch || "未提供")} → ${md(evidence.trace.targetBranch || evidence.trace.branch || "未提供")}`,
       `**提交**：${md(evidence.trace.commits?.[0]?.subject || "无提交说明",160)}`] : []),
-    ...(counts ? [`**本轮问题**：极高 ${counts.blocker || 0} · 严重 ${counts.error || 0} · 警告 ${counts.warning || 0} · 提示 ${counts.info || 0}`] : []),
-    ...(mentions ? [`**请处理 / 核验**：${mentions}`] : [])].join("\n");
-  message.payload.card.body.elements[0].content=summary+"\n\n"+message.payload.card.body.elements[0].content;
-  return {...message,mentions:mentions ? [...new Set(people.map(person=>person.feishu.id))] : [],mentionMappingComplete:!!mentions};
+    ].join("\n");
+  const elements=message.payload.card.body.elements, metadata=elements.find((element)=>element.tag==="markdown");
+  metadata.content=summary+"\n\n"+metadata.content;
+  if(counts) elements.splice(2,0,riskCountsElement(Object.fromEntries(["blocker","error","warning","info"].map((level)=>[level,counts[level]??0]))));
+  elements.push({tag:"markdown",text_size:"normal",content:responsibilityReminder({executor,manager,observer,people:config.people,mentions:mentionIds,closed:issue.status==="closed"})});
+  return {...message,mentions:mentionIds,mentionMappingComplete:mapped};
 }
 
 const stages = {
-  review: { label: "Review", status: { draft: "草稿 · 待确认", "changes-requested": "需修复 · 待复审", approved: "已授权确认", rejected: "未批准", canceled: "已取消 · 无有效批准" } },
+  review: { label: "代码审核", status: { draft: "待技术经理审核", "changes-requested": "审核未通过 · 修复后再审核", approved: "审核已确认", rejected: "审核未通过", canceled: "审核已取消 · 不作为通过记录" } },
   build: { label: "构建", status: { running: "正在构建", success: "构建成功 · 待部署验证", failed: "构建失败", canceled: "已取消 · 无有效构建结果", "not-run": "未运行 · 无有效构建结果" } },
   deploy: { label: "发布验证", status: { running: "正在部署", success: "已部署 · 验证待完成", failed: "部署或验证失败", canceled: "已取消 · 无有效部署结果", "not-run": "未运行 · 无有效部署结果", verified: "环境验证通过 · 问题待独立关闭" } },
 };
-export function lifecycleNotification(fact, config) {
+function renderLifecycleNotification(fact, config) {
   if (fact.category === "collection") {
     const project = config.projects[fact.project], recovered = fact.status === "recovered", status = recovered ? "采集已恢复" : "采集执行异常";
     const next = recovered ? "中央周期已恢复查询；项目质量和问题关闭仍以真实报告及独立复验为准" : "运维检查只读凭据、网络、必需作业和中央执行记录；恢复后自动补采，不将失联当作通过";
     const links = [["治理入口", fact.reportUrl], ["CI来源", fact.source.url]];
-    const text = `执行提醒：${status}\n下一步：${next}\n项目/范围/来源：${fact.project}/${fact.scope}/${fact.sourceId}\n异常阶段/数量：${fact.errorStages.join(",") || "无"}/${fact.errorCount}\n主责/备份/升级：${project.owner}/${project.backup}/${project.escalationOwner}\n首次异常/当前观察：${fact.firstFailureAt}/${fact.source.observedAt}\n执行记录：${fact.executionId}\n${links.map(([name, url]) => `${name}：${url}`).join("\n")}`;
-    return bounded({ category: "reminder", text, payload: card(`[执行提醒] ${fact.project} · ${status}`, recovered ? "blue" : "red", `**结论**：${status}\n**下一步**：${next}\n**项目/范围/来源**：${md(fact.project)}/${md(fact.scope)}/${md(fact.sourceId)}\n**异常阶段/数量**：${md(fact.errorStages.join(",") || "无")}/${fact.errorCount}\n**主责/备份/升级**：${md(project.owner)}/${md(project.backup)}/${md(project.escalationOwner)}\n**首次异常/当前观察**：${md(fact.firstFailureAt)}/${md(fact.source.observedAt)}\n**执行记录**：${md(fact.executionId)}`, links) }, project.issueBaseUrl);
+    const text = `执行提醒：${status}\n下一步：${next}\n项目/范围/来源：${fact.project}/${fact.scope}/${fact.sourceId}\n异常阶段/数量：${fact.errorStages.join(",") || "无"}/${fact.errorCount}\n主责/备份/升级：${project.owner}/${project.backup}/${project.escalationOwner}\n首次异常/当前观察：${formatNotificationTime(fact.firstFailureAt)} / ${formatNotificationTime(fact.source.observedAt)}\n执行记录：${fact.executionId}\n${links.map(([name, url]) => `${name}：${url}`).join("\n")}`;
+    return bounded({ category: "reminder", text, payload: card(`[执行提醒] ${fact.project} · ${status}`, recovered ? "blue" : "red", `**结论**：${status}\n**下一步**：${next}\n**项目/范围/来源**：${md(fact.project)}/${md(fact.scope)}/${md(fact.sourceId)}\n**异常阶段/数量**：${md(fact.errorStages.join(",") || "无")}/${fact.errorCount}\n**主责/备份/升级**：${md(project.owner)}/${md(project.backup)}/${md(project.escalationOwner)}\n**首次异常/当前观察**：${formatNotificationTime(fact.firstFailureAt)} / ${formatNotificationTime(fact.source.observedAt)}\n**执行记录**：${md(fact.executionId)}`, links) }, project.issueBaseUrl);
   }
   const stage = stages[fact.category], label = stage.label, status = stage.status[fact.status], project = config.projects[fact.project];
   const next = fact.category === "review" ? fact.status === "draft" ? "非作者复核人核对九维证据、修前修后差异，再明确授权正式记录" : fact.status === "approved" ? "按当前候选版本进入受控构建；发布仍需独立授权" : "查看当前Review记录和要求" : fact.category === "build" ? fact.status === "success" ? "核对制品摘要并进入授权部署与环境验证" : "查看当前作业和失败原因；重新运行生成新事实" : fact.status === "verified" ? "独立复核当前修复问题；环境验证成功不自动关闭台账" : fact.status === "success" ? "执行实际环境验证，保留验证证据" : "核对部署结果与恢复记录";
   const links = [["查看记录", fact.reportUrl], ["查看流水线", fact.pipelineUrl], ["登录处理", project.issueBaseUrl]];
-  const text = `${label}：${status}\n下一步：${next}\n项目/范围/环境：${fact.project}/${fact.scope}/${fact.environment || "无"}\nSHA：${fact.sha}\n主责/备份：${project.owner}/${project.backup}\n来源核验：${fact.source.system}/${fact.source.recordId}\n发生/采集：${fact.occurredAt}/${fact.source.observedAt}\n${links.map(([name, url]) => `${name}：${url}`).join("\n")}`;
+  const text = `${label}：${status}\n下一步：${next}\n项目/范围/环境：${fact.project}/${fact.scope}/${fact.environment || "无"}\nSHA：${fact.sha}\n主责/备份：${project.owner}/${project.backup}\n来源核验：${fact.source.system}/${fact.source.recordId}\n发生/采集：${formatNotificationTime(fact.occurredAt)} / ${formatNotificationTime(fact.source.observedAt)}\n${links.map(([name, url]) => `${name}：${url}`).join("\n")}`;
   const template = ["failed", "rejected", "changes-requested"].includes(fact.status) ? "red" : ["canceled", "not-run", "draft"].includes(fact.status) ? "orange" : "blue";
-  return bounded({ category: fact.category, text, payload: card(`[${label}] ${fact.project} · ${status}`, template, `**结论**：${md(status)}\n**下一步**：${next}\n**项目/范围/环境**：${md(fact.project)}/${md(fact.scope)}/${md(fact.environment || "无")}\n**SHA**：${md(fact.sha)}\n**主责/备份**：${md(project.owner)}/${md(project.backup)}\n**来源核验**：${md(fact.source.system)}/${md(fact.source.recordId)}\n**发生/采集**：${md(fact.occurredAt)}/${md(fact.source.observedAt)}${fact.artifactHash ? `\n**制品摘要**：${md(fact.artifactHash)}` : ""}`, links) }, project.issueBaseUrl);
+  return bounded({ category: fact.category, text, payload: card(`[${label}] ${fact.project} · ${status}`, template, `**结论**：${md(status)}\n**下一步**：${next}\n**项目/范围/环境**：${md(fact.project)}/${md(fact.scope)}/${md(fact.environment || "无")}\n**SHA**：${md(fact.sha)}\n**主责/备份**：${md(project.owner)}/${md(project.backup)}\n**来源核验**：${md(fact.source.system)}/${md(fact.source.recordId)}\n**发生/采集**：${formatNotificationTime(fact.occurredAt)} / ${formatNotificationTime(fact.source.observedAt)}${fact.artifactHash ? `\n**制品摘要**：${md(fact.artifactHash)}` : ""}`, links) }, project.issueBaseUrl);
+}
+
+export function lifecycleNotification(fact,config){
+  const override=config.projects[fact.project].scopes?.[fact.scope]?.notification?.technicalManager;
+  if(override)config={...config,projects:{...config.projects,[fact.project]:{...config.projects[fact.project],technicalManager:override}}};
+  const message=renderLifecycleNotification(fact,config);
+  if(!fact.authorId)return message;
+  const project=config.projects[fact.project],executor=fact.authorId,manager=project.technicalManager,{actors,observer}=notificationActors(executor,project,config.people);
+  const high=['failed','rejected','changes-requested'].includes(fact.status),people=actors.map(actor=>({actor,...config.people?.[actor]}));
+  const mapped=!!manager && !!executor && people.every(p=>p.name && ['open_id','user_id'].includes(p.feishu?.idType) && /^[A-Za-z0-9_-]{1,128}$/.test(p.feishu.id || '') && p.feishu.id!=='all');
+  if((high || observer) && project.requireRiskMentions===true && !mapped)throw Error('运行结果缺执行人/技术经理/同步人真实飞书ID');
+  const mentions=mapped?[...new Set(people.filter(p=>high || p.actor===observer).map(p=>p.feishu.id))]:[];
+  message.payload.card.body.elements.push({tag:'markdown',text_size:'normal',content:responsibilityReminder({executor,manager,observer,people:config.people,mentions,hasFindings:high})});
+  return {...message,mentions,mentionMappingComplete:mapped};
 }