@chenmk/superflow 0.2.5 → 0.4.0

package/assets/skills/superflow-clarify/SKILL.md

@@ -50,6 +50,15 @@ any full SDD document or implementation prompt is generated.
   external input. If semantics are unclear, mark the feature blocked instead of
   inventing a fallback.
 - Process one feature at a time, in product-document order.
+- When the pipeline selected embedded deep-clarification mode, investigate facts
+  from the repository, source documents, configuration, tests, logs, and tools
+  before asking. Ask the user only about an unresolved decision that needs owner
+  intent; do not ask for facts that can be found locally.
+- In embedded deep-clarification mode, ask exactly one decision question at a
+  time. Include the recommended answer and its important consequence, wait for
+  the answer, then record the result before asking the next question. Do not
+  create SDD artifacts or implementation prompts while a current-feature
+  decision remains pending.
 - For long PRDs, Lark/Feishu exports, screenshots, or mixed product docs, do
   not read the whole document and generate all tasks in one pass. First create
   a source index, then process one bounded section or feature at a time. Each
@@ -85,6 +94,10 @@ Create or update these files in the active OpenSpec change directory:
 - Business semantic evidence when status/enum/sync/default behavior is involved:
   source-of-truth field, enum mapping, consumer interpretation, business basis,
   explicitly rejected fallback/default choices, and unresolved owner questions.
+- Deep-clarification decision evidence when this mode is active: each question,
+  recommendation, user decision, consequence, and the resulting
+  `confirmed`/`candidate`/`pending`/`rejected` entry in
+  `.sdd/handoff/brainstorm-summary.md`.
 
 Use the detailed workflow in:
 
@@ -127,14 +140,20 @@ Use the detailed workflow in:
     If a proposed default, fallback, old-value retention, or null conversion is
     not explicitly approved by the requirement or owner, mark it rejected and do
     not include it in the design.
-11. Ask only current-feature clarification questions.
-12. Wait for programmer confirmation.
-13. Draft a rough API contract: path, action, core request, core response. Field types can be approximate.
-14. Wait for programmer confirmation of the rough API.
-15. Produce a precise API section with field names, types, requiredness, defaults, enums, errors, examples, and curl.
-16. Mark the feature as `已冻结` only when understanding, rough API, precise API,
+11. If embedded deep-clarification mode is active, resolve one decision at a
+    time. For each question, state the recommended answer and consequence, wait
+    for the programmer response, then update
+    `.sdd/handoff/brainstorm-summary.md` under `confirmed`, `candidate`,
+    `pending`, or `rejected`. Stop asking once only repository-verifiable facts
+    remain.
+12. Ask only any remaining current-feature clarification questions.
+13. Wait for programmer confirmation.
+14. Draft a rough API contract: path, action, core request, core response. Field types can be approximate.
+15. Wait for programmer confirmation of the rough API.
+16. Produce a precise API section with field names, types, requiredness, defaults, enums, errors, examples, and curl.
+17. Mark the feature as `已冻结` only when understanding, rough API, precise API,
     and validation data needs are confirmed or explicitly blocked.
-17. Only after the current feature is frozen or blocked, move to the next
+18. Only after the current feature is frozen or blocked, move to the next
     indexed feature. Do not batch-confirm multiple features from memory or a
     compressed chat summary.
 

package/assets/skills/superflow-design/SKILL.md

@@ -46,7 +46,16 @@ Superpowers own source-level HOW without weakening OpenSpec/SDD contracts.
 4. Write:
    `docs/superpowers/specs/YYYY-MM-DD-<change-id>-technical-design.md`
    using `../superflow-pipeline/references/superpower-technical-design-template.md`.
-5. For cross-repository, service-to-service, SDK, MQ, scheduler, device,
+5. Complete `复杂度减法评审` before expanding source-level HOW. For every new
+   table, field, API, Service/component, abstraction, cache, async/MQ/event
+   flow, scheduled job, or compatibility layer, prove existing reuse options,
+   necessity, and why the simplest direct implementation is insufficient.
+   Prefer one owner, one write path, one transaction, and set-based operations
+   when they satisfy the contract. Remove speculative extension points,
+   duplicate DTO/API layers, derivable persistence, premature caches, and
+   async compensation without measured need. Record the retained and removed
+   counts; unresolved simpler alternatives keep the design blocked.
+6. For cross-repository, service-to-service, SDK, MQ, scheduler, device,
    callback, third-party, mini-program, gateway, or adapter changes, include
    `Architecture Boundary And Call Direction`. Prove owner module, call
    direction, existing entry/exit points, proposed entry/exit points, evidence
@@ -54,17 +63,39 @@ Superpowers own source-level HOW without weakening OpenSpec/SDD contracts.
    adapter/protocol translator/device gateway into a business-entry
    orchestrator, stop and return to `$superflow-docs` unless the OpenSpec/SDD
    contract explicitly grants that ownership with approval evidence.
-6. For field/status/enum/sync changes, include `Field And Status Reverse
+7. For third-party platforms/tools, SDKs, MQ/Kafka, callbacks, payment
+   gateways, cloud services, or other external integrations, include
+   `External Integration Configuration And Deployment Contract`. Inventory
+   every endpoint, app/tenant/project ID, Topic, Tag, Consumer Group,
+   namespace, webhook, ACL/role, feature switch, timeout, and credential
+   reference. Prove the source and injection/provisioning method for local,
+   test, and production environments, plus owner, creation timing, readiness
+   check, rollback, and unresolved blockers. Runtime values and server-side
+   resources must not exist only as hard-coded annotations/constants. Test
+   auto-creation or pre-existing resources must not be treated as proof that
+   production will provision them. Missing production provisioning evidence
+   blocks design completion.
+8. For concurrent requests, batch issue/activation/renewal, duplicate callbacks,
+   duplicate consumption, or repeated external delivery, include
+   `Concurrency And Idempotency Ownership`. Use a stable business idempotency
+   key and an application-layer atomic claim in a short transaction; persist
+   `PENDING` before the external call, release database locks before calling
+   externally, model success/failure/uncertain states, and reuse the original
+   business code on retry. A unique index is not the default and may only be an
+   optional fallback with proven natural uniqueness, historical cleanup,
+   NULL/soft-delete semantics, and a conflict contract. Check-then-insert,
+   process-local locks, and random IDs alone are blocked.
+9. For field/status/enum/sync changes, include `Field And Status Reverse
 Impact` and prove writers, readers, filters, derived sync paths, consumers,
    and tests. Direct setter-only design is blocked.
-7. For third-party, SDK, BEM/parking, payment/refund, financial display,
+10. For third-party, SDK, BEM/parking, payment/refund, financial display,
    source/origin, status sync, or external dictionary fields, include
    `External Enum Binding`. Prove local source fields/enums, external fields,
    external enum values, display/business/financial meaning, source evidence,
    owner confirmation, unresolved handling, and test evidence. A request
    succeeding or a field being non-null is not enough; unconfirmed values are
    blockers and must be returned to `$superflow-docs` or the user.
-8. For amount, fee, discount, deduction, refund, sharing, payment, invoice,
+11. For amount, fee, discount, deduction, refund, sharing, payment, invoice,
    balance, electricity fee, service fee, package settlement, proration,
    allocation, reconciliation, or financial display changes,
    include `Money Precision Boundary`. Prove calculation-state fields,
@@ -83,12 +114,12 @@ Impact` and prove writers, readers, filters, derived sync paths, consumers,
    level and policy source, deterministic residual strategy with stable
    tie-breaker, and positive/zero/negative evidence. For FX changes, freeze the
    directional rate metadata and one canonical conversion path.
-9. Record state:
+12. Record state:
    ```bash
    ../superflow-pipeline/scripts/superflow-state.sh set <change-dir> technical_design docs/superpowers/specs/YYYY-MM-DD-<change-id>-technical-design.md
    ../superflow-pipeline/scripts/superflow-state.sh set <change-dir> design_doc design.md
    ```
-10. Update `design.md` with `Superpowers Technical Design Handoff`, update
+13. Update `design.md` with `Superpowers Technical Design Handoff`, update
    `sdd-quality-gate.md` with the technical design path and hash, then run
    `../superflow-pipeline/scripts/superflow-handoff.sh <change-dir> --refresh`.
    If the guard reports a stale or missing hash, record the printed hash in
@@ -96,7 +127,7 @@ Impact` and prove writers, readers, filters, derived sync paths, consumers,
    `--refresh` again. Do not set `design_doc` to the Superpowers document;
    `design_doc` is the OpenSpec/SDD contract design, while `technical_design`
    is the Superpowers HOW document.
-11. Run:
+14. Run:
 
 ```bash
 ../superflow-pipeline/scripts/superflow-yaml-validate.sh <change-dir>

package/assets/skills/superflow-docs/SKILL.md

@@ -76,6 +76,17 @@ For complex requirements, verify these before writing docs:
   If the docs only prove that a value exists, is non-null, or lets the request
   succeed, stop and return to `$superflow-clarify`. If fallback/default/keep-old-value
   behavior is proposed without explicit requirement or owner approval, stop.
+- For third-party platforms/tools, SDKs, MQ/Kafka, callbacks, payment gateways,
+  cloud services, or other external integrations, `api.md` and
+  `sdd-quality-gate.md` must include `外部集成配置与部署合同` / `External
+  Integration Configuration And Deployment Contract`. Inventory endpoints,
+  app/tenant/project IDs, Topic/Tag/Consumer Group, namespace, webhook,
+  ACL/role, feature switches, timeout, and credential references across local,
+  test, and production environments. Record injection/provisioning method,
+  runtime owner, provisioning owner/time, readiness evidence, rollback, secret
+  handling, and blockers. Environment-dependent values must not be hard-coded;
+  test auto-creation or existing test resources do not prove production
+  readiness. Missing production provisioning evidence blocks document freeze.
 - For third-party, SDK, BEM/parking, payment/refund, financial display,
   source/origin, status sync, or external dictionary/enum fields, `api.md` and
   `sdd-quality-gate.md` must include `外部枚举绑定确认` / `External Enum
@@ -101,6 +112,17 @@ Binding` with:
   chain, no-fallback/no-guessing boundary, and pre-coding agent self-check. If
   any gate is missing from `design.md`, `tests.md`, or quality gate, stop and
   complete the docs first.
+- For full workflow changes, `design.md` must include `复杂度减法评审` before
+  docs freeze. Inventory every proposed table, field, API, Service/component,
+  cache, async/MQ/event flow, scheduled job, compatibility layer, and new
+  abstraction. For each item, record existing reuse evidence, necessity, the
+  simplest implementation, removed/rejected complexity, and blockers.
+  Prefer extending current modules and synchronous transactions. Do not retain
+  a new layer merely for future flexibility; without evidence, remove it.
+- `sdd-quality-gate.md` must record the complexity review verdict as
+  `PASS` or `BLOCKED`; only `PASS` may leave docs/design. Missing reuse evidence, unexplained parallel APIs/models,
+  redundant persisted fields, speculative cache/async/compensation, or an
+  unresolved simpler option blocks docs completion.
 - `design.md` stays the OpenSpec/SDD design contract: requirement mapping,
   API/DB/field semantics, source facts, real-entry call chain, no-fallback
   boundary, risks, and acceptance hooks. It must not try to own all source-level
@@ -249,6 +271,11 @@ Use references only as needed:
   the relationship judgment as `确定/部分确定/不确定` when a bug fix hinges on
   existing data or call-chain behavior.
 - `design.md` must reference the frozen `api.md` fields and errors.
+- `design.md` must include `复杂度减法评审` with:
+  `设计项 | 现有能力/复用证据 | 是否必要 | 最简实现 | 删除/拒绝项 | 证据/阻塞`.
+  It must also count new tables, fields, APIs, services/components, caches,
+  async flows, jobs, and compatibility layers. A zero count is valid and
+  preferable when existing capabilities close the contract.
 - `design.md` must include a "字段语义合同" table for every risky field:
   `字段 | 来源表/DTO/事件 | 真实语义 | 目标字段 | 目标语义 | 是否可等价 |
 证据锚点 | 禁止用法 | 不确定项/owner`.

package/assets/skills/superflow-pipeline/SKILL.md

@@ -7,10 +7,49 @@ description: SDD 总入口和路由技能。Use when the user says sdd, SDD 流
 
 This is the lightweight SDD router. Do not load the whole SDD process when a smaller phase skill is enough.
 
+## 托管任务与双 Agent 闭环
+
+当用户说“用 Superflow 托管完成”并给出 implementation prompt、change 目录或一个简单
+任务时，直接使用内建托管模式。不要要求用户说出 `superflow-pipeline`、角色参数或底层
+CLI 命令：
+
+```bash
+superflow pipeline "<implementation-prompt 路径、change 目录或简单任务>" --managed --project "<项目根目录>" \
+  --supervisor codex --executor claude --language zh
+```
+
+当前入口是 Claude 时交换两个角色。命令默认由独立后台服务执行，同时监听本地任务账本
+直到终态，再由当前 Agent 读取报告并在同一会话汇总。监听中断不影响后台任务。执行前
+必须阅读 `references/managed-work.md`，不得直接手工递归启动 peer CLI。
+
+硬规则：
+
+- 每个任务固定监督会话和执行会话，后续轮次按明确 session ID 恢复。
+- 任务合同、事件账本、检查结果和证据文件是事实源，不依赖聊天上下文。
+- 正式检查最多 5 轮、执行最多 7 次、Agent 总调用最多 12 次。
+- 每次启动和恢复都校验冻结合同与硬上限；工程任务只有一类验证证据时不得进入检查。
+- 输入是 change 目录时必须从 `.sdd/state.yaml` 解析 `implementation_prompt`；输入是
+  `tasks.md` 时必须阻塞。执行前冻结 Prompt 快照和 SHA-256，两个 Agent 使用同一快照。
+- 监督角色只读，执行角色禁止修改 `.superflow/tasks` 和自动 Git 提交/推送/发布。
+- 最终通过后状态必须停在 `awaiting_git_approval`，当前主 Agent 汇总并获得用户批准后
+  才能提交 Git。
+- 使用 `superflow status <project-root>` 查看状态；不得通过模型轮询询问进度。
+- 运行产物完整性必须通过 `superflow-managed-work-check.mjs`。
+- 只有完整性脚本先通过，状态机才能记录唯一的交付就绪事件。
+- 托管命令返回终态后，当前 Agent 必须读取任务报告并向用户汇总；不能只报告任务编号。
+- 语言必须冻结进任务合同；执行 Prompt、恢复轮次、进度账本、任务报告、通知和错误提示
+  必须继承合同语言，不能在中途切换。
+
 ## Choose The Right SDD Skill
 
 - Use `$openspec-explore` when the user is still thinking through a requirement,
   wants to compare options, or needs codebase investigation before a change.
+- Route to `$superflow-clarify` in embedded deep-clarification mode when the
+  user explicitly asks for rigorous questioning, or when a bounded feature has
+  unresolved owner decisions, mutually exclusive approaches, unclear source of
+  truth, unclear acceptance behavior, or cross-system responsibility. This is
+  a mode inside the normal clarify phase, not a separate command the user must
+  remember.
 - Use `$superflow-clarify` only when product inputs are complex and must be frozen one
   feature at a time before creating OpenSpec artifacts.
 - Long PRDs, Lark/Feishu exports, screenshot-heavy requirements, and mixed
@@ -49,8 +88,44 @@ This is the lightweight SDD router. Do not load the whole SDD process when a sma
   SQL change, status field, Mapper/XML query, or cross-repo shared table affects
   database-backed behavior.
 
+## Embedded Deep Clarification
+
+When the router selects embedded deep clarification, follow these rules inside
+`$superflow-clarify`:
+
+- Do not activate it for a clear, bounded hotfix or tweak whose intended behavior
+  and acceptance result are already evidenced. Do not turn routine work into an
+  interview.
+- Explore facts that can be established from the requirement, repository,
+  configuration, tests, logs, or available tools before asking the user. Ask only
+  for a decision the user or owner must make.
+- Ask exactly one decision question at a time. State the recommended option and
+  its important consequence, then wait for the answer before the next question.
+- After each answer, update `.sdd/handoff/brainstorm-summary.md` with
+  `confirmed`, `candidate`, `pending`, and `rejected` entries. Do not rely on
+  chat memory for a resolved decision.
+- Do not create or change proposal, spec, design, tasks, tests, or implementation
+  artifacts until all decisions that affect the current feature are confirmed or
+  explicitly marked blocked.
+- Exit deep clarification once only repository-verifiable facts remain and the
+  user confirms the current feature understanding. Continue through the existing
+  clarify workflow without invoking an external skill dependency.
+
 ## Non-Negotiable Rules
 
+### OpenSpec change 目录唯一性（阻塞级）
+
+- Superflow 必须遵守 OpenSpec CLI 的单层目录规范：
+  `openspec/changes/<change-name>/`。
+- 版本号属于 change name，不属于中间目录。`v1.1.1` 必须编码为
+  `v1-1-1-<feature-slug>`，不得生成 `changes/v1.1.1/<feature-slug>/`。
+- 同一 change 只能保留一个实体目录；禁止生成兼容软链接、目录副本或第二套
+  canonical 文档。
+- 生成文档前必须先执行 `openspec new change <change-name>`，后续 status、
+  instructions、validate、Superflow state/handoff/guard 全部复用该实体目录。
+- 发现嵌套版本目录或软链接 change 时，停止文档生成并迁移为唯一的扁平实体目录，
+  再运行 `openspec validate <change-name> --strict`。
+
 ### 上下文防漂移与状态门禁（阻塞级）
 
 SDD 的核心价值是可追溯事实链、接口验证、hook 质量监控、任务 prompt

package/assets/skills/superflow-pipeline/references/api-design-template.md

@@ -439,6 +439,14 @@ D. 复用某个已有接口的数据权限规则，请指定参考接口
 | --- | -------- | -------- | -------- | ---------------------------------- | ------------- | ----------------------- | -------------------------------- | -------------------------- |
 | 1   | XX SDK   | Java SDK | 1.2.3    | 页面表单提交 -> DTO -> SDK Request | appId: 应用ID | {"code":0,"data":{...}} | {"code":500,"message":"timeout"} | 记录阻塞证据，标记外部阻塞 |
 
+### 外部集成配置与部署合同
+
+涉及第三方平台/工具、SDK、MQ/Kafka、回调、支付渠道或云服务时必须填写。
+
+| 外部依赖/资源 | 配置项/资源名 | 本地来源/创建方式 | 测试来源/创建方式 | 生产来源/创建方式 | 注入/创建方式 | 运行 owner | 创建 owner/时点 | 就绪证据 | 回滚方式 | 密钥处理 | 阻塞项 |
+| ------------- | ------------- | ----------------- | ----------------- | ----------------- | ------------- | ---------- | --------------- | -------- | -------- | -------- | ------ |
+| TDMQ          | Consumer Group | 自动/手工/IaC    | 已存在/自动创建   | 运维发版前预创建  | 配置/Secret/IaC/控制台 | ydt-energy | 运维/发版前 | 控制台/API/消息轨迹 | 禁用消费/版本回滚 | 仅记录 Secret 引用 | 无/Blocked |
+
 ### 外部枚举绑定确认
 
 涉及第三方、SDK、BEM/停车系统、支付/退款、财务展示、来源字段、状态同步、
@@ -452,6 +460,9 @@ D. 复用某个已有接口的数据权限规则，请指定参考接口
 ### 外部依赖红线
 
 - SDK 参数来源必须写明，不得凭字段名猜测含义。
+- 环境相关 endpoint、资源名、标识、凭据、ACL 和运行开关不得只硬编码在注解、常量或业务代码中。
+- 测试环境自动创建、历史资源已存在或应用本地启动成功，不得作为生产资源已就绪的证据。
+- Topic、Consumer Group、namespace、webhook、应用/租户 ID 等服务端资源必须明确生产创建 owner、创建时点、就绪检查和回滚方式；缺失时阻塞发布。
 - SDK 版本变更必须记录原因和影响范围。
 - 真实环境可用时，不得仅用 mock 代替。必须在 tests.md 记录真实请求/响应。
 - 外部服务不可用时，只能标记为"外部阻塞"或"Mock 验证"，不得宣称真实链路通过。

package/assets/skills/superflow-pipeline/references/batch-prompt-template.md

@@ -181,6 +181,33 @@ Superpowers 技术详设复制 `外部枚举绑定确认` / `External Enum Bindi
 禁止用请求成功、值非空或字段存在替代外部枚举业务语义确认。未确认的外部枚举、
 支付来源、财务展示含义或兜底映射，必须停止并报告 `Blocked`。
 
+## 外部集成配置与部署合同（强制）
+
+如果本批涉及第三方平台/工具、SDK、MQ/Kafka、回调、支付渠道或云服务，必须从
+api.md / sdd-quality-gate.md / Superpowers 技术详设复制
+`外部集成配置与部署合同` / `External Integration Configuration And Deployment Contract`。
+
+| 外部依赖/资源 | 配置项/资源名 | 本地来源/创建方式 | 测试来源/创建方式 | 生产来源/创建方式 | 注入/创建方式 | 运行 owner | 创建 owner/时点 | 就绪证据 | 回滚 | 密钥处理 | 阻塞项 |
+| ------------- | ------------- | ----------------- | ----------------- | ----------------- | ------------- | ---------- | --------------- | -------- | ---- | -------- | ------ |
+| \_\_\_\_ | \_\_\_\_ | \_\_\_\_ | \_\_\_\_ | \_\_\_\_ | 配置/Secret/IaC/控制台 | \_\_\_\_ | \_\_\_\_ | \_\_\_\_ | \_\_\_\_ | 仅引用 | 无/Blocked |
+
+环境相关配置和服务端资源不得只硬编码在注解、常量或业务代码中。测试自动创建或
+历史资源存在不能证明生产就绪；缺少生产创建与验证证据时必须停止并报告 `Blocked`。
+
+## 并发与幂等归属（强制）
+
+如果本批涉及并发、批量下发/开通/续费、重复提交/回调/消费或重复外部调用，必须从
+sdd-quality-gate.md / Superpowers 技术详设复制 `Concurrency And Idempotency Ownership`。
+
+| 场景 | 业务幂等键 | 原子占用 owner | 应用层原子占用 | 短事务边界 | 状态流转 | 重试复用编码 | 外部调用边界 | 不确定结果处理 | 唯一索引角色 | 测试证据 |
+| ---- | ---------- | -------------- | ---------------- | ---------- | -------- | ------------ | ------------ | -------------- | ------------ | -------- |
+| ____ | ____ | ____ | 锁定 owner 后写 PENDING | 独立提交 | PENDING/SUCCESS/FAILED | 复用原业务单号 | 提交后调用 | 阻止重复并对账 | 非默认/可选兜底 | 并发/重复/重试 |
+
+默认采用应用层原子占用：稳定业务幂等键、短事务占用并落 `PENDING`、提交并释放锁后
+再调用外部系统。禁止“先查再插”、单进程锁、随机单号和外部调用期间持有长事务。
+唯一索引不是默认方案，只有自然唯一、历史清理、NULL/软删除和冲突合同明确后才可
+作为数据库兜底。结果不确定时必须阻止重复调用并进入可追踪对账。
+
 ## 金额精度边界继承（强制）
 
 如果本批涉及金额、费用、优惠、抵扣、退款、分账、支付、发票、余额、电费、

package/assets/skills/superflow-pipeline/references/document-templates.md

@@ -43,6 +43,14 @@
 | Requirement | 修改文件 | 修改方法 | 变更类型 |
 |---|---|---|---|
 
+## 复杂度减法评审
+| 设计项 | 现有能力/复用证据 | 是否必要 | 最简实现 | 删除/拒绝项 | 证据/阻塞 |
+|---|---|---|---|---|---|
+| <表/API/Service/组件/同步机制> | <源码、接口、表或依赖锚点> | <保留/删除/阻塞> | <能够闭环的最小方案> | <不新增的抽象、字段、缓存、异步、兼容层> | <证据或待确认项> |
+
+新增项统计：表 0；字段 0；API 0；Service/组件 0；缓存 0；MQ/事件 0；定时任务 0；兼容层 0。按实际设计替换数量，不适用时保留 0。
+能够复用、推导或同步完成的能力不得另建平行实现；没有证据证明需要时默认删除。
+
 ## Detailed Design
 详细设计
 

package/assets/skills/superflow-pipeline/references/implementation-prompt-template.md

@@ -148,7 +148,35 @@ Superpowers 技术详设复制 `外部枚举绑定确认` / `External Enum Bindi
 禁止用请求成功、值非空或字段存在替代外部枚举业务语义确认。未确认的外部枚举、
 支付来源、财务展示含义或兜底映射，必须停止并报告 `Blocked`。
 
-### 1.2 金额精度边界继承
+### 1.2 外部集成配置与部署合同
+
+如果本批涉及第三方平台/工具、SDK、MQ/Kafka、回调、支付渠道或云服务，必须从
+api.md / sdd-quality-gate.md / Superpowers 技术详设复制 `外部集成配置与部署合同`：
+
+| 外部依赖/资源 | 配置项/资源名 | 本地来源/创建方式 | 测试来源/创建方式 | 生产来源/创建方式 | 注入/创建方式 | 运行 owner | 创建 owner/时点 | 就绪证据 | 回滚 | 密钥处理 | 阻塞项 |
+| ------------- | ------------- | ----------------- | ----------------- | ----------------- | ------------- | ---------- | --------------- | -------- | ---- | -------- | ------ |
+| \_\_\_\_ | \_\_\_\_ | \_\_\_\_ | \_\_\_\_ | \_\_\_\_ | 配置/Secret/IaC/控制台 | \_\_\_\_ | \_\_\_\_ | \_\_\_\_ | \_\_\_\_ | 仅引用 | 无/Blocked |
+
+环境相关配置和服务端资源不得只硬编码在注解、常量或业务代码中。测试自动创建、
+测试历史资源存在或应用本地启动成功，不能证明生产已就绪；缺少生产创建 owner、
+创建时点、就绪证据或回滚方式时，必须停止并报告 `Blocked`。
+
+### 1.2.1 并发与幂等归属
+
+如果本批涉及并发、批量下发/开通/续费、重复提交/回调/消费或重复外部调用，必须
+从 sdd-quality-gate.md / Superpowers 技术详设复制 `Concurrency And Idempotency
+Ownership` / `并发与幂等归属`：
+
+| 场景 | 业务幂等键 | 原子占用 owner | 应用层原子占用 | 短事务边界 | 状态流转 | 重试复用编码 | 外部调用边界 | 不确定结果处理 | 唯一索引角色 | 测试证据 |
+| ---- | ---------- | -------------- | ---------------- | ---------- | -------- | ------------ | ------------ | -------------- | ------------ | -------- |
+| ____ | ____ | ____ | 锁定 owner 后写 PENDING | 独立提交 | PENDING/SUCCESS/FAILED | 复用原业务单号 | 提交后调用 | 阻止重复并对账 | 非默认/可选兜底 | 并发/重复/重试 |
+
+默认使用应用层原子占用和稳定业务幂等键，在短事务内持久化 `PENDING` 后提交，释放
+数据库锁再调用外部系统；重试复用原业务编码，结果不确定时阻止重复并进入对账。
+禁止“先查再插”、单进程锁、随机单号或跨外部调用的长事务。唯一索引不是默认方案，
+只有自然唯一、历史数据清理、NULL/软删除和冲突处理合同明确后才可作为可选兜底。
+
+### 1.3 金额精度边界继承
 
 如果本批涉及金额、费用、优惠、抵扣、退款、分账、支付、发票、余额、电费、
 服务费、套餐结算、比例分摊、明细分配、对账或财务展示，必须从 Superpowers

package/assets/skills/superflow-pipeline/references/managed-work.md

@@ -0,0 +1,58 @@
+# 托管任务执行规则
+
+## 入口
+
+托管任务属于 `superflow-pipeline` 内建能力。用户只需说“用 Superflow 托管完成”并给出
+implementation prompt、change 目录或简单任务，不需要知道内部 Skill 名和 CLI 参数。
+简单任务生成最小合同；SDD 任务冻结 Superflow 已生成的 implementation prompt，不以
+`tasks.md` 代替执行 Prompt。
+
+## 角色
+
+- 当前主 Agent：提交任务、查看结果、向用户汇总并申请 Git 批准。
+- 监督 Agent：固定会话、只读检查、生成结构化问题和整改要求。
+- 执行 Agent：固定会话、唯一写入者、实现并完成验证。
+- 后台服务：状态、预算、队列、会话恢复和证据的唯一写入者。
+
+## 必须通过 CLI
+
+不要由聊天中的 Agent 手工启动另一 CLI。调用：
+
+```bash
+superflow pipeline "<implementation-prompt|change-dir|task>" --managed --project "<root>" \
+  --supervisor <codex|claude> --executor <claude|codex> --language <zh|en>
+```
+
+查看：
+
+```bash
+superflow status <root>
+```
+
+托管命令默认启动独立后台服务并监听本地事件账本，直到任务进入交付、阻塞或预算耗尽等
+终态。监听进程退出不影响后台任务。命令返回后，当前 Agent 读取任务报告并在原会话汇总。
+
+## 硬门槛
+
+- 5/7/12 调用上限由状态机先占用后调用，Prompt 无权上调。
+- 语言写入冻结合同；执行 Prompt、账本、报告、通知、错误和恢复轮次始终使用同一语言。
+- 每次启动和恢复都重新校验冻结合同哈希、不可覆盖权限及 5/7/12 硬上限；磁盘文件被
+  改写时按失败关闭，不能继续调用 Agent。
+- change 目录必须通过 `.sdd/state.yaml` 的 `implementation_prompt` 定位执行入口；
+  `tasks.md` 仅作清单。Prompt 原文复制为托管快照并冻结 SHA-256，执行和评审使用同一份。
+- 两个 session ID 必须落盘，禁止 `--last` / `--continue` 猜测。
+- `.superflow/tasks/<task-id>/runs/<run-id>/progress.jsonl` 是追加式事实账本。
+- 执行角色禁止修改托管目录、Git 提交/推送、发布、生产写入、跳过沙箱。
+- 监督角色禁止修改目标文件。
+- Agent 非零退出、非法 JSON、缺 session ID、工作区在检查期间变化都不能判通过。
+- 工程和 SDD 任务至少提供构建、测试、启动/真实调用中的两类成功命令证据；只编译或
+  只跑单元测试不能进入正式检查。
+- 最终通过前运行 `superflow-managed-work-check.mjs <root> <task-id>`。
+- 完整性脚本必须先通过，后台才允许写入唯一的 `run.delivery_ready` 事件；脚本失败时
+  转入等待人工处理，不得留下“已可交付”的假证据。
+- 通过后只进入等待 Git 批准，不能自动提交。
+
+## 恢复
+
+后台异常后读取任务合同、事件账本、运行状态、最近检查结果和两个 session ID。恢复原
+会话并从最后确认动作继续。监督会话丢失可在完整接管后显式重建；执行会话丢失默认暂停。

package/assets/skills/superflow-pipeline/references/quality-gate.md

@@ -63,6 +63,9 @@
 | 45   | **SDD 状态机字段**                 | **所有进入实现的任务强制**                                                              | `.sdd/state.yaml` 包含 workflow、phase、handoff_hash、build_mode、isolation、tdd_mode、review_mode、verify_mode、implementation_prompt、verification_report、archived；`superflow-state.sh status/next/recover` 输出一致                                                                                                   |
 | 46   | **外部枚举绑定确认**               | **涉及第三方、SDK、BEM/停车、支付退款、财务展示、来源字段、状态同步或外部字典时强制**   | api.md、sdd-quality-gate.md 和 Superpowers 技术详设包含 `外部枚举绑定确认` / `External Enum Binding`，列出 `业务字段                                                                                                                                                                                                       | 本系统真源字段/枚举 | 外部系统字段       | 外部枚举/字典值      | 展示文案/业务语义/财务语义 | 取值来源     | owner/确认时间                                                                                                | 不确定项/阻塞处理                                                                                                        | 测试证据`；不得用请求成功、值非空或字段存在替代业务语义确认；未确认时必须阻塞 |
 | 47   | **金额精度边界**                   | **涉及金额、费用、优惠、抵扣、退款、分账、支付、发票、余额、电费、服务费、套餐结算、比例分摊、明细分配、对账或财务展示时强制** | Superpowers 技术详设包含 `Money Precision Boundary` 及金额恒等式、权威总额、独立计算项、差额反推项与公式、计算态来源、中间精度、舍入边界、scale/rounding mode、分配/对账规则、禁止提前舍入点和测试证据；存在加法恒等式且总额是真源时，最后一个组成项必须由权威总额减去其余组成项合计得到，禁止所有组成项分别计算和舍入后重建总额；测试必须覆盖半分、尾差或多明细分配场景 |
+| 48   | **外部集成配置与部署合同**         | **涉及第三方平台/工具、SDK、MQ/Kafka、回调、支付渠道、云服务或其他外部集成时强制** | api.md、sdd-quality-gate.md、Superpowers 技术详设和实现 prompt 包含 `外部集成配置与部署合同` / `External Integration Configuration And Deployment Contract`；列出 endpoint、应用/租户/项目 ID、Topic/Tag/Consumer Group、namespace、webhook、ACL/role、开关、超时和凭据引用在本地/测试/生产的来源与创建方式，以及注入方式、运行 owner、创建 owner/时点、就绪证据、回滚、密钥处理和阻塞项；环境相关值不得只硬编码在注解/常量/业务代码；测试自动创建、历史资源或本地启动成功不能证明生产就绪，缺少生产创建证据必须阻塞发布 |
+| 49   | **并发与幂等归属**                 | **涉及并发、批量下发/开通/续费、重复提交/回调/消费或重复外部调用时强制** | sdd-quality-gate.md、Superpowers 技术详设和实现 prompt 包含 `Concurrency And Idempotency Ownership` / `并发与幂等归属`；明确业务幂等键、应用层原子占用 owner、短事务边界、PENDING/SUCCESS/FAILED 状态流转、重试复用原业务编码、外部调用边界和不确定结果对账；唯一索引不作为默认方案，只能在自然唯一、历史数据、NULL/软删除和冲突处理合同明确后作为可选兜底；测试覆盖并发、重复和重试 |
+| 50   | **复杂度减法评审**                 | **完整 workflow 的 docs/design 阶段强制** | `design.md` 与 Superpowers 技术详设包含 `复杂度减法评审`，逐项记录现有能力/复用证据、必要性、最简实现、删除/拒绝项和证据/阻塞；统计新增表、字段、API、Service/组件、缓存、异步/MQ/事件、定时任务和兼容层；能扩展现有模块、由字段推导或用单事务同步闭环时不得另建平行实现；`sdd-quality-gate.md` 必须给出 PASS/BLOCKED 结论，只有 PASS/通过才能离开 docs/design，存在无证据抽象或未决更简方案时阻塞 |
 
 ### 文档完整性强制检查（新增，全部项目必做）
 

package/assets/skills/superflow-pipeline/references/superpower-technical-design-template.md

@@ -35,6 +35,16 @@ canonical_sources:
 | -------------------- | --------------- | ---------------- | ------------------------- | ------------- | ------ |
 | <R1/S1>              | `<file>:<line>` | <observed fact>  | <implementation approach> | <files>       | <risk> |
 
+## 复杂度减法评审
+
+| 设计项 | 现有能力/复用证据 | 是否必要 | 最简实现 | 删除/拒绝项 | 证据/阻塞 |
+| ------ | ----------------- | -------- | -------- | ----------- | --------- |
+| `<表/API/Service/组件/同步机制>` | `<现有源码/API/表/依赖>` | `保留/删除/阻塞` | `<最小闭环实现>` | `<不新增的平行抽象/缓存/异步/兼容层>` | `<锚点或阻塞>` |
+
+新增项统计：表 0；字段 0；API 0；Service/组件 0；缓存 0；MQ/事件 0；定时任务 0；兼容层 0。按实际设计替换数量，不适用时保留 0。优先扩展
+现有模块；可安全推导的状态不重复持久化；单事务同步可闭环时不引入异步、补偿或
+缓存。每个保留项都要说明更简单方案为何不能满足合同，没有证据则删除。
+
 ## Architecture Boundary And Call Direction
 
 Use this whenever the change crosses repositories, services, SDKs, MQ,
@@ -60,6 +70,47 @@ orchestrator unless the OpenSpec/SDD contract explicitly says that module owns
 the new entry point and records the owner approval. If the correct owner is
 unclear, mark the design blocked.
 
+## External Integration Configuration And Deployment Contract
+
+Use this whenever the change integrates with a third-party platform/tool, SDK,
+MQ/Kafka, callback, payment gateway, cloud service, or other external system.
+
+| External dependency/resource | Config/resource item | Local source/provisioning | Test source/provisioning | Production source/provisioning | Injection/creation method | Runtime owner | Provisioning owner/time | Readiness evidence | Rollback | Secret handling | Blocker |
+| ---------------------------- | -------------------- | ------------------------- | ------------------------ | ------------------------------ | ------------------------- | ------------- | ----------------------- | ------------------ | -------- | --------------- | ------- |
+| `<TDMQ>` | `<Consumer Group>` | `<auto/manual/IaC>` | `<existing resource>` | `<pre-created by ops>` | `<config/secret/IaC/console>` | `<service>` | `<owner + before deploy>` | `<console/API/trace>` | `<disable/rollback>` | `<secret reference only>` | `<none/blocker>` |
+
+Required checks:
+
+```bash
+rg -ni "https?://|endpoint|base.?url|app.?id|tenant|project.?id|topic|tag|consumer.?group|namespace|webhook|acl|role|secret|token|password|timeout" <source-and-config-paths>
+rg -ni "@.*Listener|new.*Client|builder\(|System\.getenv|ConfigurationProperties|Value\(" <source-and-config-paths>
+```
+
+Do not hard-code environment-dependent endpoints, resource names, identifiers,
+credentials, ACLs, or operational switches in annotations, constants, or
+business code. Stable protocol constants may remain code constants only when
+the design proves they are not environment-specific and no server-side
+resource must be provisioned. Test auto-creation, a successful local startup,
+or an already-existing test resource is not evidence that production is
+ready. Every server-side resource must have an explicit production owner,
+creation timing, readiness check, and rollback path. Missing production
+provisioning evidence is a blocker.
+
+## Concurrency And Idempotency Ownership
+
+批量开通、批量续费、并发请求、重复回调、重复消费或重复外部下发时必须填写。
+
+| 场景 | 业务幂等键 | 原子占用 owner/资源 | 应用层原子占用操作 | 短事务边界 | 状态流转 | 重试复用编码 | 外部调用边界 | 结果不确定处理 | 唯一索引角色 | 测试证据 |
+| ---- | ---------- | ------------------- | ------------------ | ---------- | -------- | ------------ | ------------ | -------------- | ------------ | -------- |
+| `<批量下发>` | `<套餐+车辆+周期>` | `<周期记录>` | `<锁定 owner 后写 PENDING>` | `<独立事务提交占用>` | `PENDING/SUCCESS/FAILED` | `<复用原业务单号>` | `<提交后调用>` | `<阻止重复并进入对账>` | `<非默认；必要时兜底>` | `<并发/重复/重试用例>` |
+
+应用层原子占用是默认方案：先用稳定业务幂等键在短事务内锁定明确的 owner 资源，
+写入 `PENDING` 并提交，再释放数据库锁后执行外部调用。外部调用成功或失败后更新
+状态；重试必须复用原业务单号。结果不确定时必须阻止重复下发并保留人工对账入口。
+禁止用“先查再插”、单进程锁或随机单号冒充跨实例幂等，也禁止在外部调用期间持有
+长事务或数据库锁。唯一索引不是默认方案；仅当自然唯一语义、历史数据清理、NULL/
+软删除行为和冲突处理合同都已明确时，才可作为数据库兜底。
+
 ## Field And Status Reverse Impact
 
 Use this whenever changing field values, enum/status values, derived fields,

package/assets/skills/superflow-pipeline/references/test-execution-template.md

@@ -166,6 +166,16 @@ HTTP 200、字段非空、mock-only、DB-only、`BUILD SUCCESS`、`Tests are ski
 ## 9. 结论
 
 [是否达到交付标准，是否可以进入下一阶段]
+
+验证结果: PASS / FAIL / BLOCKED / PARTIALLY_VERIFIED
+归档就绪: PASS / BLOCKED
+
+`verify_mode: full` 时必须填写：
+
+- 测试环境：
+- 分支/commit/构建号或镜像：
+- Base URL：
+- 验证时间：
 ```
 
 ## 任务完成 Checklist（全部满足才能标记完成）

package/assets/skills/superflow-pipeline/scripts/superflow-archive.sh

@@ -131,7 +131,7 @@ GUARD="$SCRIPT_DIR/superflow-guard.sh"
 VALIDATE="$SCRIPT_DIR/superflow-yaml-validate.sh"
 CHANGE_DIR="$(cd "$CHANGE_DIR" && pwd)"
 CHANGE_NAME="$(basename "$CHANGE_DIR")"
-PROJECT_ROOT="$(cd "$CHANGE_DIR/../.." && pwd)"
+PROJECT_ROOT="$(cd "$CHANGE_DIR/../../.." && pwd)"
 ARCHIVE_ROOT="$PROJECT_ROOT/openspec/changes/archive"
 ARCHIVE_NAME="$CHANGE_NAME"