@agile-team/wl-skills-gate 0.6.1 → 0.9.0

package/CHANGELOG.md

@@ -1,3 +1,27 @@
+# 0.9.0 — 2026-10-15
+
+- 修复接入环境与依赖准备、候选Review上下文和索引、删除/暂存区修复恢复、真实阻断与必要环境关闭、消息隔离。
+- 补齐真实CI发现与可恢复调度、九维原件采集/补证/认证确认、授权前CI重新核验、OIDC处理页与投递恢复。
+- 补齐独立签发、前后端组合与API/数据库/顺序约束、单次部署授权、实际冒烟和显式故障恢复。
+- 重整README为接入、运行流程与文档入口，提供可复用的WL系列字标及Gate品牌资产。
+- 本地源码和独立tgz分别验收；业务仓库、远端权限/群/SSO与真实业务必测仍以现场回执确认。
+
+# 0.8.0 — 2026-10-15（本地交付候选，未发布）
+
+- Gate 收入版本化前后端接入资产和 onboard，识别实际项目、显示完整差异并绑定确认；quality-tools 明确为后端私有 Node 依赖目录。
+- 九维 Review 草稿、同口径修前修后对比、原始证据重算和逐维独立授权；正式签发及晋级强制要求 v2 记录，旧的仅身份/SHA批准不再放行。
+- 固定 GitLab/Jenkins API 只读采集、真实 SHA/ref/全部必需作业与精确工件校验；拒绝 WebHook 自报成功、allow_failure、缺项、取消/跳过旧报告和采集中漂移。
+- 飞书分类卡片、Review/构建/部署独立事实流共用签名台账与待发箱；构建成功、投递成功不会关闭质量问题。
+- 文档明确包内实现、项目实接、远端权限/身份/存储与业务复验的验收责任；本地候选不代表 registry 发布或生产已接通。
+
+# 0.7.0 — 2026-10-13（源码修订，未发布）
+
+- JUnit 多模块明确 files/reportDirs/requiredSuites，报告全集、必测计数、生产一次和终轮摘要验证；拒绝旧 XML、源码覆盖、解析损坏与后续篡改。
+- doctor 只读预检项目接线，Java 单测包装器明确模块/报告全集与依赖准备，补充前后端 GitLab 和 Jenkins 接线片段。
+- governance 最小中央签名事件台账、独立复核关闭、漏跑对账、自然分钟 SLA、消息摘要/认证跳转、飞书签名与企业微信投递；默认预览。并发租约、未知投递和死信显式失败。
+- 台账固定配置/公钥身份，动作和通知绑定当前 revision；拒绝过期卡片、输出路径别名与损坏台账。平台 API/SSO 查询、真实接线、服务和群投递仍须操作手册实测。
+- 同步 V3 三份文档职责与精选 code-scan-kit 规则已正式集成的定位；无需 AI API。
+
 # 0.6.1 — 2026-10-12
 
 - npm 发布访问策略改为 public；公开获取与使用授权分开，保留 UNLICENSED，不授予开源许可。

package/README.md

@@ -1,79 +1,114 @@
-# wl-skills-gate
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/ChenyCHENYU/wl-skills-gate/v0.9.0/assets/wl-gate-logo-dark.svg" />
+    <img src="https://raw.githubusercontent.com/ChenyCHENYU/wl-skills-gate/v0.9.0/assets/wl-gate-logo.svg" width="920" alt="WL Gate — Automated quality workflow" />
+  </picture>
+</p>
 
-统一质量门禁引擎，当前版本 **0.6.1**。对应《工程化与代码质量管控体系-落地执行（V3）》V3.2 主体、V3.3 附录 B/C 及质量成本与隔离增补；包配置为 npm 公开发布；公开获取不授予使用授权，使用前须取得 AGILE TEAM 事先书面授权，详见 [LICENSE](LICENSE)。发布流程核验版本与工件摘要。
+<p align="center">
+  <strong>从提交检查到复验关闭的质量工程执行包</strong><br />
+  自动接入 · 脚本修复与复扫 · 九维 Review · 构建发布门禁
+</p>
 
-包集中维护检查执行、结果归一、门禁裁决、修复计划和证据验证。项目引用固定版本；平台分别配置检查、Review、证明签发、分支更新、部署、台账与通知的权限。代码自测通过不代表内网接线已验收。
+<p align="center">
+  <a href="https://www.npmjs.com/package/@agile-team/wl-skills-gate"><img src="https://img.shields.io/npm/v/@agile-team/wl-skills-gate?color=0D9488&label=npm" alt="npm version" /></a>
+  <img src="https://img.shields.io/badge/Node.js-%E2%89%A522.12-172B43" alt="Node.js 22.12 or later" />
+  <img src="https://img.shields.io/badge/runtime_dependencies-0-0D9488" alt="Zero runtime dependencies" />
+  <a href="./LICENSE"><img src="https://img.shields.io/badge/license-authorization_required-64748B" alt="Authorization required" /></a>
+</p>
 
-完整手册见 [docs/README.md](docs/README.md)，当前接入建议见 [质量分级、执行成本与测试隔离](docs/13-quality-cost-and-isolation.md) 和 [低 token 执行](docs/14-low-token-execution.md)。11/12 手册保留为历史验证记录，既有 test-qa 接入尚未自动升级。
+<p align="center">
+  <a href="#三步接入"><strong>快速接入</strong></a> ·
+  <a href="#接入后怎么运行">运行流程</a> ·
+  <a href="#wl-系列怎么配合">包与目录</a> ·
+  <a href="./templates/ci">CI 模板</a> ·
+  <a href="./docs/README.md">完整文档</a> ·
+  <a href="./CHANGELOG.md">更新记录</a>
+</p>
 
-日常目标是提前发现缺陷并减少返工：静态检查不修改业务源码，自动修复需独立明确执行；构建和测试在隔离 Runner 运行。新增缺陷与质量底线阻断，历史问题按审批治理，警告保留责任与时限。源码未变不代表没有外部系统副作用。
+---
 
-共享 `cmd-json` 已支持 Kit/UI/BD 原生 JSON 转换及文件描述符接收大报告；`java-xml` 统一解析 Checkstyle、PMD、P3C、SpotBugs，保留真实原生身份并由 Gate 单源风险表分级。七项 PMD 安全/正确性底线不可基线化；SpotBugs 表征泄露与构造期异常保留为需上下文复核的 warning，不自动豁免整类。多模块源定位须声明项目内 `sourceRoots`，缺失/歧义/符号链接拒绝，不能任取同名文件。详见 [Java 原生报告分级与复核](docs/15-java-report-triage.md)。项目无需各自维护这些解析脚本。类型、关键测试、权限/数据底线仍不能放进历史基线。
+## Gate 做什么
 
-质量扫描默认由确定性脚本执行，包内没有大模型 API 调用。Hook、CI 裁决、报告归档和通知模板无需 AI；策略中的自定义命令仍须由平台审查。AI 阅读命令输出、规则和源码会消耗上下文，不能将“脚本没有调用模型”说成整个 AI 会话零 token。完整报告留作工件，AI 先用 `inspect` 看摘要，再按需分页读取问题；不因阅读分页重跑扫描。Java XML 可显式共用本轮一次生产；离线 cost 从既有工件汇总耗时，宿主实际 usage 不可获取时保持未知。Kit/UI 的 resultCursor 源码优化同步完成，业务安装态尚未升级。
+Gate 把项目检查器、Git Hook、CI、Review 与处置记录接成同一条流程。开发者正常提交代码即可触发检查，技术经理和运维统一维护规则、必测、权限与通知。
 
-## 能力与边界
+| 需要解决的事 | Gate 的处理方式 |
+| --- | --- |
+| 问题到构建时才暴露 | 提交、推送阶段自动检查；CI 再做完整核验 |
+| 修复依赖反复问 AI | 先展示问题和修复计划，确认后执行批准脚本，自动复扫 |
+| Review 只有一张扫描结果 | 汇总九维证据、代码差异和修前修后变化，由非作者逐维确认 |
+| 构建成功就被当作闭环 | 分别记录检查、Review、构建、部署和复验；满足关闭条件才结项 |
 
-| 能力 | 命令 | 当前边界 |
-|---|---|---|
-| 三档检查 | `run --profile fast/standard/release` | 退出码 0/1/2；失败也归档；release 要求真实干净 HEAD、合法环境、最低检查集与实际工具版本锁 |
-| 报告 | `validate-report` | JSON/Markdown/HTML；Code Quality JSON 自动导出；JUnit 保留真实生产者 XML，不能拿转换后的计数替代原始测试报告 |
-| 精简查询 | `inspect <quality-summary.json>` | 默认摘要；按规则/等级/状态分页；默认 12,000 UTF-8 字节上限；只读现有报告，保留原判定与全量计数，不能替代可信门禁证据 |
-| 成本统计 | `cost <artifact-dir> --out <metrics.json>` | 离线汇总各档/各检查 P50/P95、共享生产次数、候选重复；真实 usage 可选导入，缺失保持未知，不调用模型 |
-| 机械修复 | `fix --plan`、`fix --apply --confirm` | standard 全量报告；文件快照、白名单、防漂移、异常回滚、强制复扫；只进入待复验，不能自动关闭业务问题 |
-| 候选检查 | `promote` | 在无特权 Runner 中合并、准备依赖、检查并归档 bundle；不更新共享分支 |
-| 受控晋级 | `promote-apply` | 核验签名证明和独立 Review，在新 bare 仓库中核验最新远端 HEAD 后核验父提交后以批准的旧 HEAD 条件更新；不运行项目脚本或 Hook |
-| 制品清单 | `manifest` | 绑定真实 HEAD、环境、实际文件/目录及可选配置、数据脚本摘要 |
-| 证明签发 | `attest` | 受控独立作业签发 Ed25519 证明；仅签通过的 standard/release 证据 |
-| Review 签发 | `review-sign` | 受控 Reviewer 作业，身份取自平台认证；非作者、候选绑定、阻断问题已处置 |
-| 部署验证 | `verify-artifact` | 固定公钥、签发者和作业 ID、SHA、release 档、环境、策略/基线/例外、时效、真实制品摘要全部核验 |
-| 自测 | `self-test`、`npm test` | self-test 只跑 29 个 fixture；npm test 额外跑单元与本地 Git/签名/制品集成 |
+**九维范围：** 提交 · 分支 · 编码 · UI 与交互 · Code Review · 测试 · 扫描门禁 · CI/CD · 工程治理。
 
-## 先只读试运行
+## 三步接入
 
-取得事先书面授权并按授权范围使用后，可从公共 npm registry 安装固定版本：
+准备 **Node.js ≥22.12**，并使用项目固定的包管理器、检查器及 Java 工具链。以下命令由接入维护者执行一次；安装源可替换为团队批准的镜像。
+
+**1. 预览。** 在实际 Git 项目上识别技术栈，查看文件差异、固定依赖、Hook、检查范围和阻断项。
+
+```bash
+npx --yes @agile-team/wl-skills-gate@0.9.0 onboard \
+  --root /path/to/project --complete --registry https://registry.npmjs.org
+```
+
+**2. 确认执行。** 审核预览后，使用本次返回的 `planHash` 应用同一计划。
 
 ```bash
-# 公开获取不构成使用授权；先申请授权，再按其约定使用。
-pnpm add -D --save-exact @agile-team/wl-skills-gate@0.6.1
-# 按真实技术栈配置 quality/policy.yml 和 rules.lock.json；工具需实际安装。
-pnpm exec wl-skills-gate run --profile standard
-pnpm exec wl-skills-gate validate-report quality-reports/quality-summary.json
-# 给人工/AI 查看现有报告，不再执行扫描；完整报告仍独立归档。
-pnpm exec wl-skills-gate inspect quality-reports/quality-summary.json
-pnpm exec wl-skills-gate inspect quality-reports/quality-summary.json --view findings --status new --limit 10
+npx --yes @agile-team/wl-skills-gate@0.9.0 onboard \
+  --root /path/to/project --complete --registry https://registry.npmjs.org \
+  --apply --plan-hash "<本次 planHash>" --confirm
 ```
 
-Gate 自身零依赖。前端仍需 ESLint/TypeScript 和工程检查器；后端 Runner 仍需 JDK/Maven/Node 与实际质量 profile。只有已安装且适用的规则包进入版本锁，不安装无关兄弟包。
+接入任务按计划安装依赖、同步适用规则、配置 Hook，并验证真实检查和报告。失败保留阶段回执，修正后续跑。
+
+**3. 验证效果。** 查看首份报告及 Hook 正反例，再接入下表的 CI 与中央服务。日常提交、推送自动检查，开发者不用输入扫描命令。
+
+| 项目 | 工具装在哪里 | 业务构建 |
+| --- | --- | --- |
+| PC Vue 前端，如 `wl-ui-produce` | 现有 `package.json` / `node_modules` | 沿用原前端构建 |
+| Java/Maven 后端，如 `wl-produce` | 独立的 `quality-tools/` 目录 | 沿用 Maven，Node 工具不进入 jar |
+
+内置后端配套针对 `wl-produce` PL 模块；其他 Maven 项目先批准自己的模块与必测配套。移动端、UniApp 不套用 PC 配套。完整步骤见 [项目接入](./docs/17-onboarding.md)。
+
+## 接入后怎么运行
 
-退出码：0=passed；1=blocked；2=invalid。1/2 都停止后续晋级和部署，报告用 `when: always` 归档。无效证据不能当成“没有问题”。
+| 环节 | 自动执行 | 人员操作与结果 |
+| --- | --- | --- |
+| 提交 / 推送 | Hook 执行快速或标准检查，生成报告 | 有阻断先处理，保留项目已有提交约定 |
+| 修复 / 复扫 | 按批准计划执行脚本，核对变更范围并复扫 | 确认后修复；查看新问题、剩余项与真实差异 |
+| 九维 Review | 收集 Git、CI、测试及责任证据，生成待确认记录 | 非作者补充实际 UI / 影响 / 外部测试材料，再逐维确认 |
+| 合并 / 发布 | 核验候选 SHA、正式 Review、制品、环境和发布组合 | 合并、部署和恢复分别授权；冒烟由独立验证人确认 |
+| 通知 / 关闭 | 分类推送，漏跑与超时对账，失败重试并留证 | 主备认领，按必要环境复验后关闭；复发重新打开 |
 
-## 0.5.x → 0.6 迁移
+**项目接入与远端接线分别验收。** 运维配置受保护分支、必需作业、固定 Runner 和独立凭据；中央服务连接真实 CI、SSO、证据存储与飞书群。可直接使用包内 [CI 模板](./templates/ci) 和 [中央配置](./templates/platform/README.md)。
 
-- 保留原 CLI、主模块和直接 lib 路径；Gate 仍可独立安装，扫描器和规则包按真实技术栈分别配置。
-- P3C 使用 `format: p3c`；XML 的 PMD 引擎版本与 P3C 提供者版本分开记录，未提供的版本保持未知。
-- SpotBugs 多模块配置显式 `sourceRoots`。未配置只兼容实际存在的单模块 `src/main/java`；缺失、歧义和符号链接定位返回 invalid。
-- 成员身份进入 Java 指纹，旧成员基线可能需要重新审查。七项 PMD 底线不可基线/豁免；SpotBugs 四类上下文复核 warning 保留发现，不自动排除。
-- `rules.lock.json` 的 Gate 版本须与实际安装版本一致；模板中的检查器版本占位值仍需替换为真实版本。
+检查退出码：`0` 通过、`1` 阻断、`2` 执行或证据无效。扫描通过、消息送达和人工补证都不会自动清除必需测试失败或批准发布。
 
-## 打包与版本冻结
+## wl 系列怎么配合
 
-使用 Node ≥20 执行 `npm test` 后运行 `npm pack --ignore-scripts --json --pack-destination <工件目录>`；对这个 tgz 独立安装、调用 CLI/自测并校验哈希，再提交和发布同一产物。`files` 包含所有运行模块、schema、模板、手册、fixture 与自测脚本，不依赖兄弟包源码。
+| 名称 | 职责 |
+| --- | --- |
+| **Gate** | 统一接入、执行检查、裁决、修复复扫、证据与处置流程 |
+| **Kit** | PC Vue 管理端编码与工程约定 |
+| **UI** | PC 管理端 UI、样式与交互检查 |
+| **BD** | Java 后端规范、规则资产及检查能力 |
+| `quality-tools/` | Java 仓库的 Node 工具目录，里面安装 Gate / BD；不是另一个包 |
 
-npm 发布访问策略为 `public`，授权状态仍为 `UNLICENSED`。未经 AGILE TEAM 事先书面授权，不得使用、复制、修改或再分发；公开获取不等于使用授权。授权申请通过 [仓库 Issues](https://github.com/ChenyCHENYU/wl-skills-gate/issues)，完整条款见 [LICENSE](LICENSE)。源仓库为 [ChenyCHENYU/wl-skills-gate](https://github.com/ChenyCHENYU/wl-skills-gate)，默认分支 `main`；仓库推送与 npm 发布由发布流程分别核验。平台接线、真实权限、部署和群通知仍按下文单独验收。
+Gate 复用项目已有 ESLint、类型检查、Maven、JUnit 及适用规则包，统一报告与裁决。检查、修复、归档和通知由脚本执行，Gate 不调用大模型 API。按需查看报告可用 [`inspect`](./docs/14-low-token-execution.md)，无需重复扫描。
 
-## 0.4 → 0.5 迁移
+## 文档入口
 
-- `promote --push`、`--allow-any` 禁用，更新分支改走隔离的 `promote-apply`。
-- `run` 生成的是 `unsigned-gate-result`；部署拒收 unsigned。签发与检查使用不同凭据和执行环境。
-- `verify-artifact` 必须提供固定公钥、受控期望、环境、清单与实际制品根目录，详见 [Jenkins](docs/07-jenkins.md)。
-- `cmd-json` 默认成功退出码为 `[0]`；工具“发现问题返回 1”需显式登记 `[0,1]`，且报告有相应问题证据。
-- 基线项增加 `severity`、`occurrenceCount`。blocker、类型/关键测试等质量底线不能基线化或豁免。
-- 旧修复计划需重新生成。报告中的任意 `fixCommand` 不再执行；仅使用内置 ESLint 修复或政策登记的 fixer。
-- 必需测试跳过、零用例、计数与明细不一致会阻断。部分暂存存在未暂存修改时，快检拒绝。
+| 要做什么 | 从这里开始 |
+| --- | --- |
+| 项目接入、Hook 与首扫 | [接入指南](./docs/17-onboarding.md) · [项目与运维集成](./docs/16-project-ci-integration.md) |
+| 配置检查器、范围与等级 | [配置](./docs/02-config.md) · [适配器](./docs/05-adapters.md) · [Java 报告](./docs/15-java-report-triage.md) |
+| CI、SSO、飞书与处置 | [可信 CI 来源](./docs/18-ci-source.md) · [中央接线](./templates/platform/README.md) |
+| 九维证据与正式 Review | [Review 契约](./docs/19-nine-dimension-review.md) |
+| 验证、升级与排障 | [完整索引](./docs/README.md) · [自测与环境验收](./docs/09-selftest-coverage.md) · [更新记录](./CHANGELOG.md) |
 
-## 平台待接入能力
+## 开发与授权
 
-受保护分支、固定 CI/Runner、签发密钥与授权、平台作业来源查询、独立 Review、双仓发布组合、真实业务/UI/性能验证、台账与飞书/企业微信通知均需平台接线和实测。本包不自动创建这些权限或服务。
+仓库验证使用 `npm test`，包含单元、规则场景及本地 Git / 签名 / 制品集成测试。发布前对固定 tgz 独立安装并复验。
 
-D1～D4（台账、责任路由、通知、SLA 升级）属于首期，与前后端样板同步验收。先证明一个真实问题从发现到复验关闭，再推广项目数量。
+[WL 系列标识](./assets/wl-mark.svg)与[品牌配色](./assets/brand-tokens.json)随包交付，后续 wl 包可复用同一字标并区分模块色。使用授权见 [LICENSE](./LICENSE)；npm 公开可下载不等于开源授权，授权申请通过[仓库 Issues](https://github.com/ChenyCHENYU/wl-skills-gate/issues)。

package/assets/brand-tokens.json

@@ -0,0 +1,45 @@
+{
+  "schemaVersion": 1,
+  "series": "WL Engineering",
+  "product": "WL Gate",
+  "tagline": "Automated quality workflow",
+  "mark": {
+    "file": "wl-mark.svg",
+    "viewBox": "0 0 128 128",
+    "color": "currentColor",
+    "minimumSizePx": 32,
+    "clearSpaceViewBoxUnits": 16,
+    "construction": "Geometric W and L, open gate frame, check node. Keep the same paths across the WL series."
+  },
+  "banner": {
+    "viewBox": "0 0 920 220",
+    "light": "wl-gate-logo.svg",
+    "dark": "wl-gate-logo-dark.svg",
+    "cornerRadius": 28
+  },
+  "palette": {
+    "navy": "#102E46",
+    "navyDeep": "#0B2034",
+    "navySurface": "#173B59",
+    "mint": "#49D9BA",
+    "mintAccessibleOnLight": "#159D82",
+    "paper": "#F7FAFC",
+    "mist": "#EEF6F8",
+    "textLight": "#F2F8FC",
+    "textMutedLight": "#537083",
+    "textMutedDark": "#9EBDC9"
+  },
+  "typography": {
+    "family": "Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, Segoe UI, sans-serif",
+    "productSize": 66,
+    "productWeight": 750,
+    "seriesSize": 14,
+    "seriesTracking": 3.8,
+    "taglineSize": 20
+  },
+  "extension": {
+    "shared": ["WL monogram paths", "banner geometry", "typographic hierarchy", "navy base"],
+    "perProduct": ["product name", "tagline", "accent color"],
+    "examples": ["WL Kit", "WL UI", "WL BD"]
+  }
+}

package/assets/wl-gate-logo-dark.svg

@@ -0,0 +1,38 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 920 220" role="img" aria-labelledby="wl-gate-dark-title wl-gate-dark-desc">
+  <title id="wl-gate-dark-title">WL Gate — WL Engineering</title>
+  <desc id="wl-gate-dark-desc">WL Gate. Automated quality workflow. An open gate frames a geometric WL monogram and a mint check node, on a deep blue background.</desc>
+  <defs>
+    <linearGradient id="wl-gate-dark-background" x1="0" y1="0" x2="920" y2="220" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#0B2034"/>
+      <stop offset="1" stop-color="#102D43"/>
+    </linearGradient>
+    <linearGradient id="wl-gate-dark-tile" x1="34" y1="30" x2="194" y2="190" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#1B405B"/>
+      <stop offset="1" stop-color="#102B42"/>
+    </linearGradient>
+  </defs>
+  <rect width="920" height="220" rx="28" fill="url(#wl-gate-dark-background)"/>
+  <rect x=".75" y=".75" width="918.5" height="218.5" rx="27.25" fill="none" stroke="#9CC9D8" stroke-opacity=".12" stroke-width="1.5"/>
+  <rect x="34" y="30" width="160" height="160" rx="36" fill="url(#wl-gate-dark-tile)"/>
+  <rect x="34.75" y="30.75" width="158.5" height="158.5" rx="35.25" fill="none" stroke="#91C4D7" stroke-opacity=".16" stroke-width="1.5"/>
+  <g transform="translate(50 46)" fill="none" stroke-linecap="round" stroke-linejoin="round">
+    <g stroke="#F2F8FC">
+      <path d="M18 106V22h92v19M18 106h60" stroke-width="9"/>
+      <path d="m31 50 10 37 13-25 13 25 10-37M90 50v37h18" stroke-width="8"/>
+    </g>
+    <circle cx="105" cy="105" r="17" stroke="#49D9BA" stroke-width="7"/>
+    <path d="m97 105 5 5 11-12" stroke="#49D9BA" stroke-width="6"/>
+  </g>
+  <g font-family="Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif">
+    <text x="246" y="63" fill="#88B5C5" font-size="14" font-weight="700" letter-spacing="3.8">WL ENGINEERING</text>
+    <text x="242" y="132" fill="#F2F8FC" font-size="66" font-weight="750" letter-spacing="-2.4">WL Gate</text>
+    <text x="246" y="174" fill="#9EBDC9" font-size="20" font-weight="450" letter-spacing=".2">Automated quality workflow</text>
+  </g>
+  <g fill="none" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M739 110h95" stroke="#33596C" stroke-width="2"/>
+    <circle cx="739" cy="110" r="6" fill="#102D43" stroke="#6A96A8" stroke-width="2"/>
+    <circle cx="786" cy="110" r="6" fill="#102D43" stroke="#6A96A8" stroke-width="2"/>
+    <circle cx="841" cy="110" r="17" fill="#153F45" stroke="#49D9BA" stroke-width="2"/>
+    <path d="m834 110 5 5 9-10" stroke="#49D9BA" stroke-width="2.5"/>
+  </g>
+</svg>

package/assets/wl-gate-logo.svg

@@ -0,0 +1,37 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 920 220" role="img" aria-labelledby="wl-gate-title wl-gate-desc">
+  <title id="wl-gate-title">WL Gate — WL Engineering</title>
+  <desc id="wl-gate-desc">WL Gate. Automated quality workflow. An open gate frames a geometric WL monogram and a mint check node.</desc>
+  <defs>
+    <linearGradient id="wl-gate-background" x1="0" y1="0" x2="920" y2="220" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#F7FAFC"/>
+      <stop offset="1" stop-color="#EEF6F8"/>
+    </linearGradient>
+    <linearGradient id="wl-gate-tile" x1="34" y1="30" x2="194" y2="190" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#173B59"/>
+      <stop offset="1" stop-color="#0C233A"/>
+    </linearGradient>
+  </defs>
+  <rect width="920" height="220" rx="28" fill="url(#wl-gate-background)"/>
+  <rect x=".75" y=".75" width="918.5" height="218.5" rx="27.25" fill="none" stroke="#173B59" stroke-opacity=".08" stroke-width="1.5"/>
+  <rect x="34" y="30" width="160" height="160" rx="36" fill="url(#wl-gate-tile)"/>
+  <g transform="translate(50 46)" fill="none" stroke-linecap="round" stroke-linejoin="round">
+    <g stroke="#F2F8FC">
+      <path d="M18 106V22h92v19M18 106h60" stroke-width="9"/>
+      <path d="m31 50 10 37 13-25 13 25 10-37M90 50v37h18" stroke-width="8"/>
+    </g>
+    <circle cx="105" cy="105" r="17" stroke="#49D9BA" stroke-width="7"/>
+    <path d="m97 105 5 5 11-12" stroke="#49D9BA" stroke-width="6"/>
+  </g>
+  <g font-family="Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif">
+    <text x="246" y="63" fill="#3B6A80" font-size="14" font-weight="700" letter-spacing="3.8">WL ENGINEERING</text>
+    <text x="242" y="132" fill="#102E46" font-size="66" font-weight="750" letter-spacing="-2.4">WL Gate</text>
+    <text x="246" y="174" fill="#537083" font-size="20" font-weight="450" letter-spacing=".2">Automated quality workflow</text>
+  </g>
+  <g fill="none" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M739 110h95" stroke="#B9CFD6" stroke-width="2"/>
+    <circle cx="739" cy="110" r="6" fill="#F2F8FA" stroke="#7296A5" stroke-width="2"/>
+    <circle cx="786" cy="110" r="6" fill="#F2F8FA" stroke="#7296A5" stroke-width="2"/>
+    <circle cx="841" cy="110" r="17" fill="#E0F5EE" stroke="#159D82" stroke-width="2"/>
+    <path d="m834 110 5 5 9-10" stroke="#159D82" stroke-width="2.5"/>
+  </g>
+</svg>

package/assets/wl-mark.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" fill="none" role="img" aria-labelledby="wl-mark-title wl-mark-desc">
+  <title id="wl-mark-title">WL</title>
+  <desc id="wl-mark-desc">The WL Engineering monogram: geometric W and L inside an open gate, completed by a check node.</desc>
+  <g stroke="currentColor" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M18 106V22h92v19" stroke-width="9"/>
+    <path d="m31 50 10 37 13-25 13 25 10-37M90 50v37h18" stroke-width="8"/>
+    <path d="M18 106h60" stroke-width="9"/>
+    <circle cx="105" cy="105" r="17" stroke-width="7"/>
+    <path d="m97 105 5 5 11-12" stroke-width="6"/>
+  </g>
+</svg>

package/bin/wl-skills-gate.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import path from "node:path";
-import { mkdirSync, writeFileSync } from "node:fs";
+import { mkdirSync, writeFileSync, lstatSync, statSync, realpathSync } from "node:fs";
+import { git } from "../lib/source-state.js";
 import { runGate } from "../lib/run.js";
 import { buildFixPlan, applyFixPlan } from "../lib/fix.js";
 import { verifyArtifact } from "../lib/verify-artifact.js";
@@ -9,7 +10,7 @@ import { signGateProof, createArtifactManifest, signReviewRecord } from "../lib/
 import { validateCommitMessage } from "../lib/commit-message.js";
 
 const [command, ...rest] = process.argv.slice(2);
-const FLAGS = new Set(["--confirm", "--push", "--allow-any"]);
+const FLAGS = new Set(["--confirm", "--push", "--allow-any", "--include-digest", "--send", "--watch"]);
 
 function options(allowed) {
   const out = { positional: [] };
@@ -33,6 +34,27 @@ function writeJson(file, value) {
   console.log(`[${command}] 已写入 ${file}`);
 }
 
+function protectOutput(file, inputs = [], projectRoot) {
+  if (!file) return;
+  const destination = path.resolve(file); let current = path.parse(destination).root;
+  for (const part of destination.slice(current.length).split(path.sep)) {
+    current = path.join(current, part); let info;
+    try { info = lstatSync(current); } catch (error) { if (error.code !== "ENOENT") throw error; }
+    if (info?.isSymbolicLink()) throw new Error("输出路径不能包含符号链接或断链");
+  }
+  let outputStat; try { outputStat = statSync(destination); } catch (error) { if (error.code !== "ENOENT") throw error; }
+  for (const input of inputs.filter(Boolean)) {
+    if (path.resolve(input) === destination) throw new Error("输出不能覆盖台账/配置/原输入或密钥");
+    if (outputStat) { let inputStat; try { inputStat = statSync(input); } catch (error) { if (error.code !== "ENOENT") throw error; }
+      if (inputStat && inputStat.dev === outputStat.dev && inputStat.ino === outputStat.ino) throw new Error("输出不能覆盖原输入的硬链接别名"); }
+  }
+  if (projectRoot) {
+    const root = path.resolve(projectRoot), relative = path.relative(root, destination);
+    let tracked = []; try { tracked = git(["ls-files", "-z"], root).split("\0"); } catch {}
+    if (tracked.includes(relative)) throw new Error("只读预检输出不能覆盖已跟踪项目文件");
+  }
+}
+
 const PROOF_FLAGS = ["--summary", "--sha", "--project", "--env", "--expect-policy-hash", "--expect-rules-hash",
   "--expect-baseline-hash", "--expect-waivers-hash",
   "--expect-pipeline-id", "--expect-job-id",
@@ -51,6 +73,142 @@ function proofOptions(o) {
 try {
   if (command === "run") {
     process.exitCode = (await runGate({ argv: rest })).exitCode;
+  } else if (command === "onboard") {
+    const { runOnboardCli } = await import("../lib/onboard.js");
+    process.exitCode = await runOnboardCli(rest);
+  } else if (command === "doctor") {
+    const o = options(["--root", "--kind", "--out"]);
+    if (o.positional.length) throw new Error("doctor 不接受位置参数");
+    const { doctor } = await import("../lib/doctor.js");
+    if (o["--out"]) { const root = path.resolve(o["--root"] || "."), canonicalRoot = realpathSync(root), out = path.resolve(o["--out"]); if ([root, canonicalRoot].some((r) => out === r || out.startsWith(r + path.sep))) throw new Error("doctor 只读项目，--out 必须放在项目外证据目录"); }
+    const result = doctor({ root: o["--root"], kind: o["--kind"] });
+    protectOutput(o["--out"], [], o["--root"] || ".");
+    if (o["--out"]) writeJson(o["--out"], result); else process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    process.exitCode = result.status === "gaps" ? 2 : 0;
+  } else if (command === "automation") {
+    const o = options(["--config", "--send", "--watch"]);
+    if (o.positional.length || !o["--config"]) throw new Error("automation 要求中央 --config；--watch 定时运行；--send 实际投递");
+    const { automationTick, startAutomation } = await import("../lib/automation.js");
+    if (o["--watch"]) { const loop = startAutomation({ configFile: o["--config"], send: !!o["--send"] }); for (const signal of ["SIGINT", "SIGTERM"]) process.once(signal, () => loop.stop()); }
+    else { const result = await automationTick({ configFile: o["--config"], send: !!o["--send"] }); process.stdout.write(JSON.stringify(result, null, 2) + "\n"); process.exitCode = result.status === "ok" ? 0 : 2; }
+  } else if (command === "control") {
+    const operation = rest.shift();
+    const o = options(["--config", "--port", "--review-id", "--record", "--evidence-root", "--provenance", "--plan-id", "--config-id", "--plan", "--release-set"]);
+    if (o.positional.length || !o["--config"]) throw new Error("control 要求 --config；子命令 serve/register-review/register-deployment");
+    const control = await import("../lib/control-service.js"); let result;
+    if (operation === "serve") {
+      const server = await control.serveControl({ configFile: o["--config"], port: o["--port"] === undefined ? 8787 : Number(o["--port"]) });
+      for (const signal of ["SIGINT", "SIGTERM"]) process.once(signal, () => server.close());
+      result = { status: "listening", host: "127.0.0.1", port: server.address().port };
+    } else if (operation === "register-review") result = await control.registerControlReview({ configFile: o["--config"], reviewId: o["--review-id"], recordFile: o["--record"], evidenceRoot: o["--evidence-root"], provenanceFile: o["--provenance"] });
+    else if (operation === "register-deployment") { const { registerControlDeployment } = await import("../lib/control-deployment.js"); result = await registerControlDeployment({ config: control.loadControlConfig(o["--config"]), planId: o["--plan-id"], configId: o["--config-id"], planFile: o["--plan"], releaseSetFile: o["--release-set"] }); }
+    else throw new Error("control 子命令 serve/register-review/register-deployment");
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+  } else if (command === "review-facts") {
+    const o = options(["--root", "--summary", "--plan", "--out-dir", "--base-sha"]);
+    if (o.positional.length) throw new Error("review-facts 不接受位置参数");
+    const { produceReviewFacts } = await import("../lib/review-facts.js");
+    process.stdout.write(JSON.stringify(produceReviewFacts({ root: o["--root"] || process.cwd(), summaryFile: o["--summary"] || "quality-reports/quality-summary.json", planFile: o["--plan"], outDir: o["--out-dir"] || "quality-reports/review", baseSha: o["--base-sha"] }), null, 2) + "\n");
+  } else if (command === "review-publish") {
+    const o = options(["--config"]); if (o.positional.length || !o["--config"]) throw new Error("review-publish 要求独立签发作业 --config");
+    const { publishReviewAuthorizations } = await import("../lib/review-publish.js"); const result = await publishReviewAuthorizations({ configFile: o["--config"] });
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n"); process.exitCode = result.status === "ok" ? 0 : 2;
+  } else if (command === "review-ci") {
+    const o = options(["--config", "--source", "--out"]);
+    if (o.positional.length || !o["--config"] || !o["--source"] || !o["--out"]) throw new Error("review-ci 要求 --config --source --out 新证据目录");
+    const { createCiReview } = await import("../lib/review-ci.js");
+    process.stdout.write(JSON.stringify(await createCiReview({ configFile: o["--config"], sourceFile: o["--source"], outDir: o["--out"] }), null, 2) + "\n");
+  } else if (command === "review-collect") {
+    const o = options(["--config", "--source", "--input", "--record", "--evidence-root", "--out"]);
+    if (o.positional.length) throw new Error("review-collect 不接受位置参数");
+    for (const flag of ["--config", "--source", "--input", "--record", "--evidence-root", "--out"]) if (!o[flag]) throw new Error(`review-collect 缺少 ${flag}`);
+    const { collectReviewEvidence } = await import("../lib/review-collect.js");
+    const result = collectReviewEvidence({ configFile: o["--config"], sourceFile: o["--source"], inputFile: o["--input"], recordFile: o["--record"], evidenceRoot: o["--evidence-root"], outDir: o["--out"] });
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+  } else if (command === "release-set") {
+    const operation = rest.shift(), o = options(["--input", "--evidence-root", "--expect-input-hash", "--private-key", "--issuer", "--out", "--release-set", "--public-key", "--expect-issuer", "--expect-release-set-hash", "--env"]);
+    if (o.positional.length) throw new Error("release-set 不接受位置参数");
+    const { createReleaseSet, verifyReleaseSet } = await import("../lib/release-set.js"); let result;
+    if (operation === "create") { protectOutput(o["--out"], [o["--input"], o["--private-key"]]); result = createReleaseSet({ inputFile: o["--input"], evidenceRoot: o["--evidence-root"], expectInputHash: o["--expect-input-hash"], privateKeyFile: o["--private-key"], issuer: o["--issuer"], outFile: o["--out"] }); }
+    else if (operation === "verify") result = verifyReleaseSet({ releaseSetFile: o["--release-set"], publicKeyFile: o["--public-key"], expectIssuer: o["--expect-issuer"], expectReleaseSetHash: o["--expect-release-set-hash"], env: o["--env"] });
+    else throw new Error("release-set 子命令 create/verify");
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+  } else if (command === "deployment") {
+    const operation = rest.shift(), o = options(["--config", "--release-set", "--expect-release-set-hash", "--state", "--action", "--out", "--out-dir", "--plan", "--authorization", "--private-key", "--send", "--execution", "--executor-public-key", "--project", "--sequence", "--pipeline-id", "--job-id", "--pipeline-url", "--report-url", "--requests-dir", "--plan-id", "--config-id", "--authorization-dir", "--timeout-ms", "--delivery-dir"]);
+    if (o.positional.length) throw new Error("deployment 不接受位置参数");
+    const d = await import("../lib/deployment.js"), base = { configFile: o["--config"], releaseSetFile: o["--release-set"], expectReleaseSetHash: o["--expect-release-set-hash"], stateFile: o["--state"] }; let result;
+    if (operation === "plan") { protectOutput(o["--out"], [o["--config"], o["--release-set"], o["--state"]]); result = d.planDeployment({ ...base, action: o["--action"], outFile: o["--out"] }); }
+    else if (operation === "queue") { const { queueDeploymentPlan } = await import("../lib/deployment-queue.js"); result = queueDeploymentPlan({ requestsDir: o["--requests-dir"], planId: o["--plan-id"], configId: o["--config-id"], planFile: o["--plan"], releaseSetFile: o["--release-set"] }); }
+    else if (operation === "run-authorized") {
+      const { waitForDeploymentAuthorization } = await import("../lib/deployment-queue.js");
+      if (!o["--authorization-dir"]) throw new Error("run-authorized 要求中央固定 --authorization-dir");
+      // A preview never waits for or consumes a human authorization.
+      if (!o["--send"]) result = d.runDeployment({ ...base, planFile: o["--plan"], privateKeyFile: o["--private-key"], outDir: o["--out-dir"], send: false });
+      else {
+        const selected = await waitForDeploymentAuthorization({ configFile: o["--config"], planFile: o["--plan"], authorizationDir: o["--authorization-dir"], timeoutMs: o["--timeout-ms"] === undefined ? 900000 : Number(o["--timeout-ms"]) });
+        result = selected.status === "authorized" ? d.runDeployment({ ...base, planFile: o["--plan"], authorizationFile: selected.authorizationFile, privateKeyFile: o["--private-key"], outDir: o["--out-dir"], send: true }) : selected;
+      }
+    }
+    else if (operation === "deliver") { const { queueDeploymentDelivery } = await import("../lib/deployment-queue.js"); result = queueDeploymentDelivery({ deliveryDir: o["--delivery-dir"], configId: o["--config-id"], executionFile: o["--execution"], releaseSetFile: o["--release-set"], expectReleaseSetHash: o["--expect-release-set-hash"] }); }
+    else if (operation === "run") result = d.runDeployment({ ...base, planFile: o["--plan"], authorizationFile: o["--authorization"], privateKeyFile: o["--private-key"], outDir: o["--out-dir"], send: !!o["--send"] });
+    else if (operation === "lifecycle") result = d.createDeploymentLifecycle({ ...base, executionFile: o["--execution"], executorPublicKeyFile: o["--executor-public-key"], project: o["--project"], sequence: Number(o["--sequence"]), pipelineId: o["--pipeline-id"], jobId: o["--job-id"], pipelineUrl: o["--pipeline-url"], reportUrl: o["--report-url"], outDir: o["--out-dir"] });
+    else throw new Error("deployment 子命令 plan/queue/run-authorized/run/deliver/lifecycle");
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n"); if (result.exitCode) process.exitCode = result.exitCode;
+  } else if (command === "attest-collected") {
+    const o = options(["--config", "--source", "--sha", "--env", "--manifest", "--private-key", "--issuer", "--out", "--expect-policy-hash", "--expect-rules-hash", "--expect-baseline-hash", "--expect-waivers-hash"]);
+    if (o.positional.length) throw new Error("attest-collected 不接受位置参数");
+    const { signCollectedReleaseProof } = await import("../lib/lifecycle-source.js");
+    protectOutput(o["--out"], [o["--config"], o["--source"], o["--private-key"]]);
+    const result = signCollectedReleaseProof({ configFile: o["--config"], sourceFile: o["--source"], sha: o["--sha"], env: o["--env"], manifestPath: o["--manifest"], privateKeyFile: o["--private-key"], issuer: o["--issuer"], outFile: o["--out"], expectPolicyHash: o["--expect-policy-hash"], expectRulesHash: o["--expect-rules-hash"], expectBaselineHash: o["--expect-baseline-hash"], expectWaiversHash: o["--expect-waivers-hash"] });
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+  } else if (command === "collect-ci") {
+    const o = options(["--config", "--request", "--out"]);
+    if (o.positional.length || !o["--config"] || !o["--request"] || !o["--out"]) throw new Error("collect-ci 要求 --config --request --out 新证据目录");
+    const { collectCiSource } = await import("../lib/ci-source.js");
+    const result = await collectCiSource({ configFile: o["--config"], requestFile: o["--request"], outDir: o["--out"] });
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    process.exitCode = result.passed ? 0 : 2;
+  } else if (command === "lifecycle-build" || command === "lifecycle-review") {
+    const allowed = ["--config", "--source", "--sha", "--env", "--out", "--manifest", "--record", "--evidence-root", "--public-key", "--authorization-public-key", "--expect-authorization-issuer", "--report-url", "--sequence", "--profile", "--expect-review-policy-hash", "--expect-policy-hash", "--expect-rules-hash", "--expect-baseline-hash", "--expect-waivers-hash"];
+    const o = options(allowed);
+    if (o.positional.length || !o["--config"] || !o["--source"] || !o["--sha"] || !o["--out"]) throw new Error("生命周期构造要求 --config --source --sha --out 新目录");
+    const { createBuildLifecycle, createReviewLifecycle } = await import("../lib/lifecycle-source.js");
+    const base = { configFile: o["--config"], sourceFile: o["--source"], sha: o["--sha"], env: o["--env"], outDir: o["--out"] };
+    const result = command === "lifecycle-build" ? createBuildLifecycle({ ...base, manifestPath: o["--manifest"] }) : createReviewLifecycle({ ...base,
+      recordFile: o["--record"], evidenceRoot: o["--evidence-root"], publicKeyFile: o["--public-key"], authorizationPublicKeyFile: o["--authorization-public-key"], expectAuthorizationIssuer: o["--expect-authorization-issuer"],
+      reportUrl: o["--report-url"], sequence: Number(o["--sequence"]), profile: o["--profile"], expectReviewPolicyHash: o["--expect-review-policy-hash"], expectPolicyHash: o["--expect-policy-hash"], expectRulesHash: o["--expect-rules-hash"], expectBaselineHash: o["--expect-baseline-hash"], expectWaiversHash: o["--expect-waivers-hash"] });
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+  } else if (command === "governance") {
+    const operation = rest.shift();
+    const allowed = {
+      receipt: ["--input", "--private-key", "--issuer", "--out"],
+      ingest: ["--config", "--state", "--event", "--summary", "--out"],
+      lifecycle: ["--config", "--state", "--event", "--source", "--out"],
+      action: ["--config", "--state", "--action", "--out"],
+      reconcile: ["--config", "--state", "--expectations", "--out"],
+      outbox: ["--config", "--state", "--include-digest", "--out"],
+      dispatch: ["--config", "--state", "--include-digest", "--send", "--out"],
+      migrate: ["--config", "--new-config", "--state", "--authorization", "--out"],
+    };
+    if (!Object.hasOwn(allowed, operation)) throw new Error("governance 子命令: receipt/ingest/lifecycle/action/reconcile/outbox/dispatch");
+    const o = options(allowed[operation]); if (o.positional.length) throw new Error("governance 不接受多余位置参数");
+    const g = await import("../lib/governance.js");
+    const required = operation === "receipt" ? ["--input", "--private-key", "--issuer", "--out"] : ["--config", "--state", ...(operation === "ingest" ? ["--event", "--summary"] : operation === "lifecycle" ? ["--event", "--source"] : operation === "action" ? ["--action"] : operation === "reconcile" ? ["--expectations"] : operation === "migrate" ? ["--new-config", "--authorization"] : [])];
+    for (const key of required) if (!o[key]) throw new Error(`缺少 ${key}`);
+    protectOutput(o["--out"], [o["--state"], o["--config"], o["--input"], o["--event"], o["--summary"], o["--source"], o["--action"], o["--expectations"], o["--private-key"]]);
+    if (operation !== "receipt") protectOutput(o["--out"], [g.loadGovernanceConfig(o["--config"]).publicKeyFile]);
+    let result;
+    const base = { configFile: o["--config"], stateFile: o["--state"], includeDigest: !!o["--include-digest"] };
+    if (operation === "receipt") { const { readFileSync } = await import("node:fs"); result = g.signPlatformReceipt(JSON.parse(readFileSync(o["--input"], "utf8")), { privateKeyFile: o["--private-key"], issuer: o["--issuer"] }); }
+    else if (operation === "ingest") result = g.ingestGovernance({ ...base, eventFile: o["--event"], summaryFile: o["--summary"] });
+    else if (operation === "lifecycle") result = g.ingestLifecycleGovernance({ ...base, eventFile: o["--event"], sourceFile: o["--source"] });
+    else if (operation === "action") result = g.actionGovernance({ ...base, actionFile: o["--action"] });
+    else if (operation === "reconcile") result = g.reconcileGovernance({ ...base, expectationsFile: o["--expectations"] });
+    else if (operation === "outbox") result = g.outboxGovernance(base);
+    else if (operation === "migrate") result = g.migrateGovernanceConfig({ ...base, newConfigFile: o["--new-config"], authorizationFile: o["--authorization"] });
+    else result = await g.dispatchGovernance({ ...base, send: !!o["--send"] });
+    if (o["--out"]) writeJson(o["--out"], result); else process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    if (result.results?.some((x) => x.status !== "delivered") || result.unknownDeliveries?.length || result.deadLetters?.length) process.exitCode = 2;
   } else if (command === "cost") {
     const o = options(["--usage", "--out"]);
     if (!o.positional[0] || !o["--out"]) throw new Error("cost 必须提供工件目录和 --out；不默认将完整统计塞入控制台");
@@ -93,10 +251,24 @@ try {
     writeJson(o["--out"], signGateProof({ ...proofOptions(o), summaryFile: o["--summary"] || o.positional[0],
       profile: o["--profile"], privateKeyFile: o["--private-key"], issuer: o["--issuer"],
       pipelineId: o["--pipeline-id"], jobId: o["--job-id"], promotionRecordFile: o["--promotion-record"] }));
+  } else if (command === "review-draft") {
+    const o = options(["--input", "--evidence-root", "--out"]);
+    if (o.positional.length || !o["--input"] || !o["--out"]) throw new Error("review-draft 要求 --input --out，证据须放在 --evidence-root 内");
+    const { createReviewDraft } = await import("../lib/review.js");
+    const result = createReviewDraft({ inputFile: o["--input"], evidenceRoot: o["--evidence-root"], outDir: o["--out"] });
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
   } else if (command === "review-sign") {
-    const o = options(["--private-key", "--reviewer-id", "--author-id", "--project", "--sha", "--out"]);
-    writeJson(o["--out"], signReviewRecord({ recordFile: o.positional[0], privateKeyFile: o["--private-key"],
-      reviewerId: o["--reviewer-id"], authorId: o["--author-id"], project: o["--project"], sha: o["--sha"] }));
+    const o = options(["--private-key", "--reviewer-id", "--author-id", "--project", "--sha", "--out", "--authorization", "--authorization-public-key", "--expect-authorization-issuer", "--evidence-root", "--expect-review-policy-hash", "--profile", "--env", "--expect-policy-hash", "--expect-rules-hash", "--expect-baseline-hash", "--expect-waivers-hash"]);
+    const recordFile = o.positional[0];
+    protectOutput(o["--out"], [recordFile, o["--private-key"], o["--authorization"]]);
+    const { validateReviewOutputLocation } = await import("../lib/review.js");
+    const destination = validateReviewOutputLocation({ outFile: o["--out"], recordFile, evidenceRoot: o["--evidence-root"] });
+    const signedReview = signReviewRecord({ recordFile, privateKeyFile: o["--private-key"],
+      reviewerId: o["--reviewer-id"], authorId: o["--author-id"], project: o["--project"], sha: o["--sha"],
+      authorizationFile: o["--authorization"], authorizationPublicKeyFile: o["--authorization-public-key"], expectAuthorizationIssuer: o["--expect-authorization-issuer"], evidenceRoot: o["--evidence-root"], expectReviewPolicyHash: o["--expect-review-policy-hash"],
+      profile: o["--profile"], env: o["--env"], expectPolicyHash: o["--expect-policy-hash"], expectRulesHash: o["--expect-rules-hash"], expectBaselineHash: o["--expect-baseline-hash"], expectWaiversHash: o["--expect-waivers-hash"] });
+    writeFileSync(destination, JSON.stringify(signedReview, null, 2) + "\n", { flag: "wx", mode: 0o600 });
+    console.log(`[review-sign] 已写入 ${destination}`);
   } else if (command === "verify-artifact") {
     const r = verifyArtifact(proofOptions(options(PROOF_FLAGS)));
     if (!r.ok) throw new Error(r.errors.join("; "));
@@ -111,9 +283,9 @@ try {
     for (const reason of r.reasons) console.error(reason);
     process.exitCode = r.exitCode;
   } else if (command === "promote-apply") {
-    const o = options([...PROOF_FLAGS, "--record", "--remote-url", "--bundle", "--review", "--review-public-key", "--out"]);
+    const o = options([...PROOF_FLAGS, "--record", "--remote-url", "--bundle", "--review", "--review-public-key", "--review-evidence-root", "--expect-review-policy-hash", "--authorization-public-key", "--expect-authorization-issuer", "--out"]);
     const r = applyPromotion({ ...proofOptions(o), recordFile: o["--record"], remoteUrl: o["--remote-url"],
-      bundleFile: o["--bundle"], reviewFile: o["--review"], reviewPublicKeyFile: o["--review-public-key"], outDir: o["--out"] });
+      bundleFile: o["--bundle"], reviewFile: o["--review"], reviewPublicKeyFile: o["--review-public-key"], reviewEvidenceRoot: o["--review-evidence-root"], expectReviewPolicyHash: o["--expect-review-policy-hash"], authorizationPublicKeyFile: o["--authorization-public-key"], expectAuthorizationIssuer: o["--expect-authorization-issuer"], outDir: o["--out"] });
     console.log(`[promote-apply] ${r.status}`);
     for (const reason of r.reasons) console.error(reason);
     process.exitCode = r.exitCode;
@@ -121,5 +293,5 @@ try {
     if (rest.length) throw new Error("self-test 不接受额外参数");
     const { runAllFixtures } = await import("../scripts/run-fixtures.mjs");
     process.exitCode = await runAllFixtures();
-  } else throw new Error("用法: wl-skills-gate <run|inspect|cost|fix|validate-report|commit-message|manifest|attest|review-sign|verify-artifact|promote|promote-apply|self-test>，详见 docs/README.md");
+  } else throw new Error("用法: wl-skills-gate <onboard|run|doctor|automation|control|collect-ci|review-facts|review-ci|review-collect|review-publish|lifecycle-build|lifecycle-review|governance|inspect|cost|fix|validate-report|commit-message|manifest|attest|attest-collected|release-set|deployment|review-draft|review-sign|verify-artifact|promote|promote-apply|self-test>，详见 docs/README.md");
 } catch (e) { console.error(`[${command || "wl-skills-gate"}] ${e.message}`); process.exitCode = 2; }