@boyingliu01/xp-gate 0.31.0 → 0.31.2

package/principles/rules/solid/lsp.ts

@@ -1,8 +1,16 @@
 import { Rule, Violation, Adapter, Severity } from '../../types';
 import { getActiveConfig } from '../../config';
 
+/**
+ * Primitive type names whose compatibility with any base contract can be assumed.
+ *
+ * Covers TypeScript and Java/Kotlin spellings: a `string` or an `int` parameter is never
+ * the kind of narrowing this rule looks for.
+ */
 const PRIMITIVE_TYPES = new Set([
-  'string', 'number', 'boolean', 'any', 'void', 'null', 'undefined', 'Object', 'Array',
+  'string', 'number', 'boolean', 'any', 'void', 'null', 'undefined', 'unknown', 'Object',
+  'Array', 'int', 'long', 'short', 'byte', 'char', 'float', 'double', 'boolean', 'String',
+  'Integer', 'Long', 'Short', 'Byte', 'Character', 'Float', 'Double', 'Boolean', 'Object',
 ]);
 
 interface ClassInfo {
@@ -11,30 +19,198 @@ interface ClassInfo {
   name?: string;
 }
 
-function extractParamType(param: string): string | null {
-  if (!param.includes(':')) return null;
-  const typeMatch = param.match(/:\s*(\w+)/);
-  return typeMatch ? typeMatch[1] : null;
+/**
+ * Tokens that are never a type: keywords, control-flow words and single-letter locals.
+ *
+ * #588: the message text used to be able to say `Parameter type "false"` or
+ * `Parameter type "public"`, which is the signature of the old matcher having read a
+ * call site or an expression fragment. Filtering them here means a parse that goes wrong
+ * produces no finding instead of a nonsense one.
+ */
+const NOT_A_TYPE = new Set([
+  'false', 'true', 'null', 'undefined', 'this', 'super', 'new', 'return', 'if', 'for',
+  'while', 'switch', 'catch', 'public', 'private', 'protected', 'static', 'final',
+  'abstract', 'synchronized', 'native', 'default', 'class', 'interface', 'enum', 'record',
+]);
+
+/** Parameter type from a TypeScript-style `name: Type` fragment, or null. */
+function extractTsParamType(param: string): string | null {
+  const typeMatch = param.match(/:\s*([\w$<>[\].]+)/);
+  if (!typeMatch) return null;
+  return normaliseTypeName(typeMatch[1]);
+}
+
+/** Reduce `Map<String, List<Item>>[]` / `Foo?` to a bare type name, or null. */
+function normaliseTypeName(raw: string): string | null {
+  const stripped = raw.replace(/<.*$/, '').replace(/\[\]$/, '').replace(/\?$/, '').trim();
+  if (!stripped) return null;
+  // Only the last dotted segment matters for compatibility: `java.util.List` -> `List`.
+  const last = stripped.split('.').filter(Boolean).pop();
+  if (!last) return null;
+  if (!/^[\w$]+$/.test(last)) return null;
+  if (NOT_A_TYPE.has(last)) return null;
+  return last;
+}
+
+/**
+ * Parameter type from a Java/Kotlin-style `Type name` fragment, or null.
+ *
+ * Java puts the type first and has no colon, which is why the TypeScript-only extractor
+ * returned null for virtually every Java parameter — and the rule's `return false`
+ * default then read that null as "incompatible", flagging every `extends` class.
+ */
+function extractJavaParamType(param: string): string | null {
+  // `final Foo bar`, `@NotNull Foo bar`, `Foo... bar`, `Map<String, X> bar`
+  const cleaned = param
+    .replace(/@\w+(\([^)]*\))?/g, ' ')
+    .replace(/\bfinal\b/g, ' ')
+    .replace(/\.\.\./g, ' ')
+    .trim();
+  if (!cleaned) return null;
+  // Everything except the trailing identifier is the type.
+  const m = cleaned.match(/^(.+?)\s+[\w$]+$/);
+  if (!m) return null;
+  return normaliseTypeName(m[1]);
+}
+
+function isPrimitive(paramType: string): boolean {
+  return PRIMITIVE_TYPES.has(paramType);
+}
+
+/**
+ * Parameter type names declared by the base class in the same file, keyed by method name.
+ *
+ * #588's core problem is that LSP cannot be judged without the base contract. A
+ * single-file analysis usually lacks it — but when the base class IS in the file (the
+ * common shape for these projects, and the only shape a per-file rule can honestly
+ * address), the contract is right there. Extracting it is what lets the rule keep a
+ * discriminating power instead of degenerating into unconditional silence.
+ *
+ * Returns an empty map when the base class is not analysable, which the caller reads as
+ * "cannot determine" rather than "no violations".
+ *
+ * @param code the derived class body, which names its base in the `extends` clause
+ * @param allClasses every class the adapter found in this file
+ * @returns method name -> parameter type names, for the base class only
+ */
+function baseContract(
+  code: string,
+  allClasses: ClassInfo[],
+  isJava: boolean,
+): Map<string, string[]> {
+  const contract = new Map<string, string[]>();
+  const extendsMatch = code.match(/\bextends\s+([\w$.]+)/);
+  if (!extendsMatch) return contract;
+  const baseName = extendsMatch[1].split('.').pop() ?? extendsMatch[1];
+  const base = allClasses.find((c) => c.name === baseName && typeof c.code === 'string');
+  if (!base || !base.code) return contract;
+  const declRe = new RegExp(declarationMatcher(isJava).source, 'g');
+  let m: RegExpExecArray | null;
+  while ((m = declRe.exec(base.code)) !== null) {
+    contract.set(m[1], extractParamTypes(m[2], isJava));
+  }
+  return contract;
 }
 
-function isCompatibleParamType(paramType: string, className: string | undefined): boolean {
-  if (PRIMITIVE_TYPES.has(paramType)) return true;
+/**
+ * Can this parameter type be declared incompatible with the base class contract?
+ *
+ * Tri-state, and that is the whole point: `true` = compatible, `false` = incompatible,
+ * `null` = **cannot tell**. A single-file regex analysis does not always have the base
+ * class, so it often cannot tell — and the honest answer to "cannot tell" is silence.
+ *
+ * #588: the previous version was `return false` for anything it did not recognise, which
+ * turned a parse failure into a verdict. On Java the parse failed for nearly every
+ * parameter, so every class with `extends` was reported.
+ *
+ * When the base method IS known, a parameter type that the base also declares is
+ * compatible and one it does not is reported. That is a real comparison, not a guess:
+ * both sides come from declarations in the same file.
+ *
+ * @param paramType the derived method's parameter type
+ * @param className the derived class name
+ * @param baseParamTypes the base method's parameter types, or undefined when unavailable
+ * @returns true/false when decidable, null when not
+ */
+function compatibilityVerdict(
+  paramType: string,
+  className: string | undefined,
+  baseParamTypes?: string[],
+): boolean | null {
+  if (isPrimitive(paramType)) return true;
   if (className && paramType.startsWith(className)) return true;
-  return false;
+  if (baseParamTypes && baseParamTypes.length > 0) {
+    // A type the base method also accepts is compatible; one it does not is the LSP
+    // violation this rule exists to find. Compared by simple name with generics erased,
+    // which is the precision a regex analysis can honestly claim.
+    return baseParamTypes.includes(paramType);
+  }
+  // An unresolved generic, a lambda's inferred type, or a base we could not find: not
+  // enough information to judge.
+  return null;
+}
+
+/**
+ * Build the "I could not determine this" outcome, which is nothing at all.
+ *
+ * Kept as a named function so the rule's silence is a decision with a documented reason
+ * rather than an accident of a filter chain.
+ */
+function undetermined(): Violation[] {
+  return [];
+}
+
+/**
+ * Split a parameter list on top-level commas only.
+ *
+ * #588: `split(',')` broke `Map<String, Item> index` into `Map<String` and `Item> index`,
+ * losing the real type and inventing a second one. Generic parameters are the normal
+ * case in both Java and TypeScript, so a comma-blanking split is wrong in both.
+ *
+ * @param paramsText parameter list without surrounding parens
+ * @returns parameter fragments
+ */
+function splitParams(paramsText: string): string[] {
+  const parts: string[] = [];
+  let depth = 0;
+  let current = '';
+  for (const ch of paramsText) {
+    if (ch === '<' || ch === '(' || ch === '[' || ch === '{') depth += 1;
+    else if (ch === '>' || ch === ')' || ch === ']' || ch === '}') depth -= 1;
+    if (ch === ',' && depth <= 0) {
+      parts.push(current);
+      current = '';
+      continue;
+    }
+    current += ch;
+  }
+  parts.push(current);
+  return parts.map((p) => p.trim()).filter(Boolean);
 }
 
-function collectMethodParamTypes(methodSignature: string): string[] {
-  const paramsMatch = methodSignature.match(/\(([^)]+)\)/);
-  if (!paramsMatch) return [];
+function extractParamTypes(paramsText: string, isJava: boolean): string[] {
   const types: string[] = [];
-  for (const param of paramsMatch[1].split(',').map((p) => p.trim())) {
-    const paramType = extractParamType(param);
+  for (const param of splitParams(paramsText)) {
+    const paramType = isJava ? extractJavaParamType(param) : extractTsParamType(param);
     if (paramType) types.push(paramType);
   }
   return types;
 }
 
-function buildViolation(file: string, cls: ClassInfo, paramType: string): Violation {
+/**
+ * Build a violation record for a class whose parameter type was decided incompatible.
+ *
+ * Exported for the line-fallback case: after #588 the rule can only report types it can
+ * PROVE incompatible, so a fixture can no longer reach `buildViolation` through
+ * `lspRule.check`. Asserting it directly keeps the `?? 0` fallback covered instead of
+ * letting the case pass vacuously.
+ *
+ * @param file path reported in the violation
+ * @param cls the class, whose `line` may be absent
+ * @param paramType the offending parameter type
+ * @returns the violation record
+ */
+export function buildViolation(file: string, cls: ClassInfo, paramType: string): Violation {
   // Read the ACTIVE severity here rather than at module load (#457).
   const settings = getActiveConfig().rules['solid']['lsp'];
   return {
@@ -46,23 +222,169 @@ function buildViolation(file: string, cls: ClassInfo, paramType: string): Violat
   };
 }
 
-function checkClass(file: string, cls: ClassInfo): Violation[] {
-  if (!cls.code || !cls.code.includes('extends')) return [];
+/**
+ * Method DECLARATIONS in a class body — not call sites.
+ *
+ * `\w+\s*\(([^)]+)\)` matched calls too, split `foo(a, b)` on the comma and made `a`/`b`
+ * into "parameter types". Requiring a declaration shape (modifiers/return type before the
+ * name, and `{`/`;` after the parameter list) is what tells the two apart.
+ */
+const METHOD_DECL_RE = new RegExp(
+  '(?:^|\\n)[ \\t]*(?:@[\\w$.]+(?:\\([^)]*\\))?[ \\t]*)*' +
+    '(?:(?:public|private|protected|static|final|abstract|synchronized|native|default|strictfp|sealed|non-sealed|override|suspend|inline|fun)[ \\t]+)*' +
+    '(?:<[^<>]*(?:<[^<>]*>[^<>]*)*>[ \\t]+)?' +
+    '[\\w$][\\w$.]*(?:[ \\t]*<[^<>]*(?:<[^<>]*>[^<>]*)*>[ \\t]*)?(?:\\[\\][ \\t]*)*[ \\t]+' +
+    '(\\w+)[ \\t]*\\(([^;{}=]*)\\)' +
+    '(?:\\s*(?:throws|:)[^{;]+)?\\s*[{;]',
+  'g',
+);
 
-  const violations: Violation[] = [];
-  const methodSignatures = cls.code.match(/\w+\s*\(([^)]+)\)/g) || [];
+/**
+ * Declaration matcher for `name(params): ReturnType` (TypeScript, and where a language
+ * puts the return type AFTER the parameter list).
+ *
+ * The Java matcher above requires a return type BEFORE the name, so it never matches a
+ * TypeScript method. Without this second shape the base-contract lookup silently found no
+ * methods in TypeScript and every TypeScript override degraded to silence — the exact
+ * failure mode #588 is about, reached from the other side.
+ *
+ * The trailing `:` return-type annotation is what distinguishes a declaration from a call:
+ * a call is followed by `;`/`,`/`)`, not by `: Type`.
+ */
+const TS_METHOD_DECL_RE = new RegExp(
+  '(?:^|[\\n{};])[ \\t]*(?:public|private|protected|static|readonly|abstract|async|override|declare)?[ \\t]*' +
+    '(\\w+)[ \\t]*\\(([^;{}=]*)\\)[ \\t]*:[ \\t]*[\\w$][\\w$<>[\\].| ]*' +
+    '\\s*[{;]',
+  'g',
+);
 
-  for (const methodSignature of methodSignatures) {
-    for (const paramType of collectMethodParamTypes(methodSignature)) {
-      if (!isCompatibleParamType(paramType, cls.name)) {
+/**
+ * The declaration matcher for a language.
+ *
+ * @param isJava true for Java/Kotlin (`Type name`), false for TypeScript (`name: Type`)
+ * @returns the regex to scan declarations with
+ */
+function declarationMatcher(isJava: boolean): RegExp {
+  return isJava ? METHOD_DECL_RE : TS_METHOD_DECL_RE;
+}
+
+function methodParamTypes(code: string, isJava: boolean): string[] {
+  const types: string[] = [];
+  const matcher = new RegExp(declarationMatcher(isJava).source, 'g');
+  let m: RegExpExecArray | null;
+  while ((m = matcher.exec(code)) !== null) {
+    types.push(...extractParamTypes(m[2], isJava));
+  }
+  return types;
+}
+
+/**
+ * Check one derived class against its base class contract.
+ *
+ * The rule reports a parameter type only when the base method is visible in the SAME file
+ * and does not accept that type. Every other case is silence, because a single-file
+ * analysis cannot know the base contract otherwise (#588).
+ *
+ * `allClasses` is passed in so the base class can be located by name; the rule does not
+ * enumerate classes itself, keeping class discovery the adapter's job.
+ *
+ * @param file path reported in violations
+ * @param cls the derived class
+ * @param allClasses every class the adapter found in this file
+ * @param isJava true for Java/Kotlin parameter syntax
+ * @returns violations, possibly none
+ */
+function checkClass(
+  file: string,
+  cls: ClassInfo,
+  allClasses: ClassInfo[],
+  isJava: boolean,
+): Violation[] {
+  if (!cls.code || !cls.code.includes('extends')) return undetermined();
+
+  const contract = baseContract(cls.code, allClasses, isJava);
+  if (contract.size === 0) return undetermined();
+
+  const violations: Violation[] = [];
+  for (const [methodName, paramTypes] of declaredDeclarations(cls.code, isJava)) {
+    const baseParamTypes = contract.get(methodName);
+    if (!baseParamTypes) continue;
+    for (const paramType of paramTypes) {
+      if (compatibilityVerdict(paramType, cls.name, baseParamTypes) === false) {
         violations.push(buildViolation(file, cls, paramType));
       }
     }
   }
-
   return violations;
 }
 
+/**
+ * Method name -> parameter types, for the declarations in a class body.
+ *
+ * Unlike `methodParamTypes` this keeps the method name, which is what makes the base
+ * lookup possible.
+ *
+ * @param code a class body
+ * @param isJava true for Java/Kotlin parameter syntax
+ * @returns declarations, in source order
+ */
+function declaredDeclarations(code: string, isJava: boolean): Array<[string, string[]]> {
+  const declarations: Array<[string, string[]]> = [];
+  const declRe = new RegExp(declarationMatcher(isJava).source, 'g');
+  let m: RegExpExecArray | null;
+  while ((m = declRe.exec(code)) !== null) {
+    declarations.push([m[1], extractParamTypes(m[2], isJava)]);
+  }
+  return declarations;
+}
+
+/**
+ * Parameter types of the METHOD DECLARATIONS in a body, in source order.
+ *
+ * Exported for the same reason as `parseJavaParamTypes`: the rule's verdict cannot tell a
+ * correct declaration matcher from one that also matches call sites, because both end in
+ * silence for unparseable types. #588's anti-vacuity check is what proved that.
+ *
+ * @param code a class body
+ * @param isJava true for Java/Kotlin (`Type name`), false for TypeScript (`name: Type`)
+ * @returns parsed parameter type names
+ */
+export function declaredParamTypes(code: string, isJava = true): string[] {
+  return methodParamTypes(code, isJava);
+}
+
+/**
+ * Parameter types parsed out of a Java parameter list.
+ *
+ * Exported so the #588 suite can assert on the PARSE rather than only on the rule's
+ * verdict. Without this the rule's silence is ambiguous: "parsed and judged
+ * undeterminable" and "never parsed at all" look identical from the outside, which is how
+ * the first version of this fix survived its own anti-vacuity check.
+ *
+ * @param paramsText a Java parameter list without the surrounding parens
+ * @returns parsed type names
+ */
+export function parseJavaParamTypes(paramsText: string): string[] {
+  return extractParamTypes(paramsText, true);
+}
+
+/**
+ * Does this adapter's language declare parameters as `Type name` (Java/Kotlin) rather
+ * than `name: Type` (TypeScript and friends)?
+ *
+ * Split out of `lspRule.check` to keep that function's cyclomatic complexity where it was:
+ * #588 pushed it from 2 to 4, and Gate 3's ratchet blocks a worsening. It also gives the
+ * one piece of language knowledge a name, which is where a future adapter should look.
+ *
+ * @param adapter the adapter under inspection
+ * @returns true for Java/Kotlin parameter syntax
+ */
+function usesTypeFirstName(adapter: Adapter): boolean {
+  if (typeof adapter.detectLanguage !== 'function') return false;
+  const language = adapter.detectLanguage();
+  return language === 'java' || language === 'kotlin';
+}
+
 export const lspRule: Rule = {
   id: 'solid.lsp',
   name: 'Liskov Substitution Principle Rule',
@@ -72,6 +394,9 @@ export const lspRule: Rule = {
     // #392-#4: no empty catch — let adapter/rule errors bubble up to
     // analyzer.runRuleOnFile() so they surface as gate errors, not silent [].
     const classes = (adapter.extractClasses() || []) as ClassInfo[];
-    return classes.flatMap((cls) => checkClass(file, cls));
+    // The adapter decides which parameter syntax applies; the rule holds no language
+    // knowledge of its own (#588 suggestion 2, taken as far as a single file allows).
+    const isJava = usesTypeFirstName(adapter);
+    return classes.flatMap((cls) => checkClass(file, cls, classes, isJava));
   },
 };

package/scripts/__tests__/sync-package-content.test.js

@@ -314,7 +314,16 @@ describe('syncHooks', () => {
   it('syncHooks keeps every hook library as a regular byte-identical mirror', () => {
     expect(syncOk, 'sync script must exit 0').toBe(true);
     const canonicalDir = path.join(WORKTREE_PATH, 'githooks', 'lib');
-    for (const name of fs.readdirSync(canonicalDir)) {
+    // #587/#588: `readdirSync` also returns directories, and `__pycache__` appears the
+    // moment anything imports prepush-score.py. The sync script deliberately does not
+    // mirror build artefacts into the package, so demanding a mirror for every entry made
+    // this case assert the OPPOSITE of the behaviour it exists to protect — and fail on a
+    // cache directory that is not a hook library at all.
+    const libraryNames = fs
+      .readdirSync(canonicalDir)
+      .filter((name) => fs.statSync(path.join(canonicalDir, name)).isFile());
+    expect(libraryNames.length, 'no hook libraries found to compare').toBeGreaterThan(0);
+    for (const name of libraryNames) {
       const canonical = path.join(canonicalDir, name);
       const mirror = path.join(HOOKS_DIR, 'lib', name);
       expect(fs.lstatSync(canonical).isSymbolicLink(), `${canonical} must not be a symlink`).toBe(false);
@@ -325,6 +334,28 @@ describe('syncHooks', () => {
     }
   });
 
+  it('syncHooks does not mirror Python bytecode caches into the package', () => {
+    // The positive half of the case above. Asserting only "the run did not fail" would
+    // pass on a clean checkout where no cache was ever created — which is exactly the
+    // state CI starts from, so it would prove nothing. Creating the cache first makes the
+    // assertion bite.
+    const canonicalCache = path.join(WORKTREE_PATH, 'githooks', 'lib', '__pycache__');
+    fs.mkdirSync(canonicalCache, { recursive: true });
+    fs.writeFileSync(path.join(canonicalCache, 'probe.cpython-312.pyc'), 'bytecode');
+
+    const result = spawnSync(nodeExe, [syncScript], {
+      cwd: WORKTREE_PATH,
+      stdio: 'pipe',
+      timeout: 15000,
+    });
+
+    expect(result.status, 'sync script must exit 0').toBe(0);
+    expect(
+      fs.existsSync(path.join(HOOKS_DIR, 'lib', '__pycache__')),
+      'a Python bytecode cache was mirrored into the shipped package',
+    ).toBe(false);
+  });
+
   it('syncHooks removes stale generated hook libraries', () => {
     const staleFile = path.join(HOOKS_DIR, 'lib', 'stale-generated-file.sh');
     fs.mkdirSync(path.dirname(staleFile), { recursive: true });

package/scripts/sync-package-content.js

@@ -36,7 +36,12 @@ function rmrf(target) {
   fs.rmSync(target, { recursive: true, force: true });
 }
 
-const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'coverage', '.opencode']);
+// `.opencode` is a tool state directory; `__pycache__` is Python bytecode, created the
+// moment anything imports a `.py` in the tree. It is gitignored, so it is not part of the
+// package — but `find -type f` in scripts/check-hook-mirror.sh saw it in the mirror and
+// reported "hook mirror file set drifted", which blocks the push with no fix the operator
+// can apply from their own code (#587/#588).
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'coverage', '.opencode', '__pycache__']);
 const SKIP_FILES = new Set(['package-lock.json']);
 const SKIP_FILE_SUFFIXES = ['.lock', '.js.map'];
 

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-22
-**Commit:** fcd717af
+**Generated:** 2026-10-25
+**Commit:** 1ab53eff
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/delphi-review/SKILL.md

@@ -392,6 +392,11 @@ delphi-review(
 )
 ```
 
+> **先确认该工具真的存在（#574）**：不是所有 DSH profile 都装了它。若当前会话的工具列表里
+> 没有 `delphi-review`，说明插件未安装 —— 此时**不要**推断"那就用 subagent / workflow 吧"。
+> 按下方【通道白名单】处理：要么装插件（`dsh plugin add @boyingliu01/dsh-plugin-xp-gate`），
+> 要么走 external 脚本路径，要么 BLOCK。
+
 该工具**直连外部 OpenAI 兼容网关**，每个席位绑定一个不同模型，因此不依赖宿主配置即可
 满足不变量。它复用**同一份** `.delphi-config.json`，无需额外配置。
 
@@ -431,6 +436,51 @@ delphi-review(
 - 降级证据落盘 `delphi-reviewed.json`：`channel`、`fallback_reason`（如 `dsh_subagent_model_selection_disabled`）、`probe_evidence`（①②③ 的实测摘录）。
 - 两通道同不变量：三专家齐全、`requested_model` 互异、consensus ≥90%、**无单专家路径**。
 - 可用性探测可用 `xp-gate doctor delphi` 复核（DSH 环境下含 `subagentModelSelection` 持久化设置检查）。
+
+##### 通道白名单（default-deny，#574）
+
+上面的双通道契约是**允许清单**，不是"除 subagent 外都能用"。**只有这两条通道合法**：
+`subagent`（native，需通过 ①②③）与 external（插件工具 / `delphi-external-review.cjs`）。
+
+**其余一切扇出机制一律禁止**，包括但不限于：
+
+| 禁止的通道 | 为什么禁止 |
+|---|---|
+| `workflow` 工具的 `agent()` 扇出 | `agent()` 的 `provider`/`model` **不受** `allowedModels` 约束（`dsh-workflow-ptc` 里没有任何白名单校验，直达 `subagents.start`）。脚本里写什么模型就真的跑什么模型。 |
+| 手写脚本 / 循环里逐个调 `subagent` 但省略 `model` | 缺 `model` 时子代理**静默继承宿主会话模型**，三席变一席。 |
+| Agent Teams / `spawn_teammate` | 团队成员模型不可逐条指定，且 `TeamMemberView.model` 是输出字段、可能是继承值。 |
+| 任何"从网关模型清单里挑三个"的做法 | 网关可能注册上百个模型，任意三个互异都满足旧不变量 —— 这正是 #574 的事故形态。 |
+
+**推荐通道不可用时，必须 BLOCK 并如实报告，不得自行选一条"看起来能跑"的路径。**
+判定句：*如果我正在用的派发机制不在上面两条之内，立即停止，输出 BLOCK 并说明缺什么。*
+
+##### 席位解析（派发前强制步骤，#574）
+
+模型 ID **只能来自 `.delphi-config.json`**，不得来自会话默认模型、网关模型清单、
+记忆、或上一次评审的残留。派发前依次执行：
+
+1. 读取 `<项目根>/.delphi-config.json`，取 `active_profile` 指向的 profile。
+   （查找顺序：项目根 → `~/.config/xp-gate/.delphi-config.json`；多份存在时以项目根为准。）
+2. 解出 `architecture` / `technical` / `feasibility` 三个席位的 `model`，**去空白**。
+3. **原样打印**这三个 ID 与 `active_profile`，作为本轮派发的凭据。
+4. 只用这三个字面量派发；脚本里**不得出现配置中不存在的模型 ID**。
+5. 三席位必须互异 —— 若配置本身有重复，这是配置错误，BLOCK，不要去"挑一个换掉"。
+
+> 反例（2026-10-22 实测事故）：某次 code-walkthrough 的 workflow 脚本硬编码了
+> `s-deepseek-v4.1-flash` / `g-deepseek-v4-pro` / `doubao-seed-2.0-pro`，
+> 而配置写的是三个 `local-*` 免费席位。三者互异、评审"成功"、Gate MW 判 APPROVED，
+> 但付费模型被真实调用，而 `local-*` 只落了 1/3。16 次 workflow 运行中读取配置的次数为 **0**。
+
+##### 执行后核验（#574）
+
+评审结束后必须逐席位核对**实际解析到的模型**，不能只看请求值：
+
+- 证据来源：子会话的 `request/header`（平台日志）或 external 脚本的回执 `resolved_model`。
+- 三席 `requested_model` 必须**逐一等于**配置中同角色的席位（按角色对应，不是"三者在集合里"）。
+- 任一不匹配 → 本次评审**作废**，不得写入 `.code-walkthrough-result.json`，按 BLOCK 处理。
+- Gate MW 会独立复核这一点（#574）：存在 `.delphi-config.json` 时，
+  证据里每个 `requested_model` 必须等于该角色的配置席位，否则 pre-push 直接 BLOCK。
+
 #### WorkBuddy 平台（Expert 团队模式）
 
 WorkBuddy 侧以 Team 型专家团（示例：`delphi-review-team`，安装在 `~/.workbuddy/plugins/marketplaces/my-experts/plugins/`，创建方式见 [docs/platform-workbuddy.md](../../docs/platform-workbuddy.md)）承载评审，触发本技能后按此路由执行：

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-22
-**Commit:** fcd717af
+**Generated:** 2026-10-25
+**Commit:** 1ab53eff
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.2.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-22
-**Commit:** fcd717af
+**Generated:** 2026-10-25
+**Commit:** 1ab53eff
 **Branch:** main
-**Version:** 0.31.0.0
+**Version:** 0.31.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/sprint-gate.sh

@@ -35,6 +35,17 @@
 #   - JSON parser fallback chain: jq → Node.js → explicit degradation message
 #
 # OUTPUT: JSON to stdout — {"decision":"allow|deny|skip",...}
+#
+# #584: every `allow` also carries `"allow_reason"`, because `allow` alone was
+# ambiguous. It meant three different things and pre-commit mapped all of them to
+# Gate 11 PASS:
+#
+#   checks-passed      the sprint was actually validated      -> PASS is honest
+#   phase-not-reached  the sprint has not reached this gate's phase
+#   no-json-parser     nothing could be read at all
+#
+# The last two examine nothing, so reporting them as PASS inflated the score.
+# `checks-passed` is the only reason that licenses a PASS.
 # EXIT: 0 = pass/skip, 1 = block
 
 set -euo pipefail
@@ -264,7 +275,7 @@ if [ "$MODE" = "pre-commit" ]; then
 
     # If no JSON parser available, warn but allow (graceful degradation)
     if [ "$JSON_PARSER" = "none" ]; then
-      echo '{"decision":"allow","warning":"neither jq nor node available, cannot verify delphi-review verdict. Install jq or node for full protection."}'
+      echo '{"decision":"allow","allow_reason":"no-json-parser","warning":"neither jq nor node available, cannot verify delphi-review verdict. Install jq or node for full protection."}'
       exit 0
     fi
 
@@ -299,7 +310,7 @@ if [ "$MODE" = "pre-commit" ]; then
     # claim: a 29-day-old sprint under a 30-day threshold is a very different
     # situation from one opened today, and the log should say which it is.
     if [ -n "$SPRINT_AGE_DAYS" ]; then
-      echo "{\"decision\":\"allow\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated (sprint open ${SPRINT_AGE_DAYS} day(s), staleness threshold ${SPRINT_STALE_DAYS})\"}"
+      echo "{\"decision\":\"allow\",\"allow_reason\":\"checks-passed\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated (sprint open ${SPRINT_AGE_DAYS} day(s), staleness threshold ${SPRINT_STALE_DAYS})\"}"
     else
       echo "{\"decision\":\"allow\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated (sprint age unknown — started_at unreadable)\"}"
     fi
@@ -307,7 +318,7 @@ if [ "$MODE" = "pre-commit" ]; then
   fi
 
   # Phase < 1 (pre-PLAN) — no delphi enforcement needed
-  echo "{\"decision\":\"allow\",\"reason\":\"sprint phase ${PHASE} (pre-PLAN), no delphi enforcement required\"}"
+  echo "{\"decision\":\"allow\",\"allow_reason\":\"phase-not-reached\",\"reason\":\"sprint phase ${PHASE} (pre-PLAN), no delphi enforcement required\"}"
   exit 0
 fi