@chenmk/superflow 0.3.0 → 0.5.0

package/assets/skills/superflow-pipeline/references/quality-gate.md

@@ -24,6 +24,7 @@
 | 12  | **Prompt 拆分合理性**              | **如触发拆分条件，已按功能闭环拆分，每份 prompt 边界清晰**                                                                                                                                                  |
 | 13  | **需求/原型字段对账**              | 涉及页面、截图、原型或前端联调时，已建立"页面字段 -> API 字段 -> DTO/VO -> DB -> 测试"映射                                                                                                                  |
 | 14  | **功能点串行门禁**                 | 复杂 PRD、飞书文档、原型图或口头大需求必须具备 `source-ingestion.md`、`feature-gates.md`、`feature-inventory.md`、`ui-contract.md`、`gap-analysis.md`、`spec-freeze-review.md`，且当前功能点状态为 `已冻结` |
+| 14.1 | **源码事实冻结卡** | full workflow 涉及现有行为、DB/表关系、跨仓或真实入口时必须具备 `source-code-audit.md`；覆盖所有写入方、真实入口、current/legacy/unmounted/data-model-only 分类、DB 核查或跳过原因、冲突审计和 owner 边界 |
 
 ### 按需检查项（涉及则必须检查）
 
@@ -65,6 +66,8 @@
 | 47   | **金额精度边界**                   | **涉及金额、费用、优惠、抵扣、退款、分账、支付、发票、余额、电费、服务费、套餐结算、比例分摊、明细分配、对账或财务展示时强制** | Superpowers 技术详设包含 `Money Precision Boundary` 及金额恒等式、权威总额、独立计算项、差额反推项与公式、计算态来源、中间精度、舍入边界、scale/rounding mode、分配/对账规则、禁止提前舍入点和测试证据；存在加法恒等式且总额是真源时，最后一个组成项必须由权威总额减去其余组成项合计得到，禁止所有组成项分别计算和舍入后重建总额；测试必须覆盖半分、尾差或多明细分配场景 |
 | 48   | **外部集成配置与部署合同**         | **涉及第三方平台/工具、SDK、MQ/Kafka、回调、支付渠道、云服务或其他外部集成时强制** | api.md、sdd-quality-gate.md、Superpowers 技术详设和实现 prompt 包含 `外部集成配置与部署合同` / `External Integration Configuration And Deployment Contract`；列出 endpoint、应用/租户/项目 ID、Topic/Tag/Consumer Group、namespace、webhook、ACL/role、开关、超时和凭据引用在本地/测试/生产的来源与创建方式，以及注入方式、运行 owner、创建 owner/时点、就绪证据、回滚、密钥处理和阻塞项；环境相关值不得只硬编码在注解/常量/业务代码；测试自动创建、历史资源或本地启动成功不能证明生产就绪，缺少生产创建证据必须阻塞发布 |
 | 49   | **并发与幂等归属**                 | **涉及并发、批量下发/开通/续费、重复提交/回调/消费或重复外部调用时强制** | sdd-quality-gate.md、Superpowers 技术详设和实现 prompt 包含 `Concurrency And Idempotency Ownership` / `并发与幂等归属`；明确业务幂等键、应用层原子占用 owner、短事务边界、PENDING/SUCCESS/FAILED 状态流转、重试复用原业务编码、外部调用边界和不确定结果对账；唯一索引不作为默认方案，只能在自然唯一、历史数据、NULL/软删除和冲突处理合同明确后作为可选兜底；测试覆盖并发、重复和重试 |
+| 50   | **复杂度减法评审**                 | **完整 workflow 的 docs/design 阶段强制** | `design.md` 与 Superpowers 技术详设包含 `复杂度减法评审`，逐项记录现有能力/复用证据、必要性、最简实现、删除/拒绝项和证据/阻塞；统计新增表、字段、API、Service/组件、缓存、异步/MQ/事件、定时任务和兼容层；能扩展现有模块、由字段推导或用单事务同步闭环时不得另建平行实现；`sdd-quality-gate.md` 必须给出 PASS/BLOCKED 结论，只有 PASS/通过才能离开 docs/design，存在无证据抽象或未决更简方案时阻塞 |
+| 51   | **冻结发布 SQL**                   | **涉及表/字段/索引/约束/初始化数据/历史迁移时强制** | docs 阶段已生成 `release-sql.md`；front matter 含 `database_change: true`、无占位符的精确 `target_sql_path`、`copy_policy: verbatim`、有效 `sql_sha256`；仅有一个完整可执行 SQL 代码块且包含合同要求的前置检查、DDL/DML、迁移和后置验证；design/tasks/quality gate 明确研发 Agent 只能原样复制，发现遗漏退回 docs，禁止 prompt 阶段临场设计 SQL |
 
 ### 文档完整性强制检查（新增，全部项目必做）
 
@@ -74,12 +77,12 @@
 | 27  | **顶层文档同步更新**                           | 新增/修改 embedded change 后，`tasks.md`、`traceability-matrix.md`、`sdd-quality-gate.md`、`tests.md`、`test-report.md` 已同步更新                                                                                                                                                 |
 | 28  | **implementation prompt 文档引用**             | prompt 中"必读文档"列表必须包含 `design.md`、`tests.md`、`review-checklist.md`、`sdd-quality-gate.md`，不能只引用 `api.md` 和 `spec.md`                                                                                                                                            |
 | 29  | **无"待后续生成"占位符**                       | 文档中不存在"待后续生成"、"待补充"、"TODO"等未完成的占位标记                                                                                                                                                                                                                       |
-| 30  | **需求级汇总 SQL 文件**                        | 如涉及数据库变更，已创建需求级汇总 SQL 文件（如 `sql/{version}.sql`），且 tasks.md / tests.md / prompt 中已明确引用该文件路径                                                                                                                                                      |
+| 30  | **需求级冻结发布 SQL**                        | 如涉及数据库变更，已创建 `release-sql.md` 并冻结目标版本路径和 SHA-256；tasks.md / tests.md / prompt 明确只能原样复制，不能让研发 Agent 追加或改写                                                                                                                                                      |
 | 31  | **tasks.md 标注 SQL 依赖**                     | 每个涉及数据库的任务已标注依赖的汇总 SQL 文件路径，不需要 SQL 的任务已写明"本任务不新增 SQL，但开始前仍需核查依赖表结构"                                                                                                                                                           |
 | 32  | **tests.md 包含数据库结构核查用例**            | 测试用例中包含 SHOW CREATE TABLE / SHOW COLUMNS 等数据库结构核查用例                                                                                                                                                                                                               |
 | 33  | **汇总 SQL 格式规范**                          | SQL 脚本采用简单直接格式（ALTER TABLE / INSERT），不使用 INFORMATION_SCHEMA 判断、PREPARE/EXECUTE 等过度兼容脚本，按任务编号或功能块追加注释                                                                                                                                       |
 | 34  | **数据库迁移类任务 prompt 强制顺序（阻塞级）** | 涉及表结构重构、旧数据迁移、状态字段变更、分页筛选依赖新表/新状态时：① prompt/pXX-xxx.md 中必须包含"强制执行顺序"章节；② 章节必须覆盖：核对数据库结构 → 执行表结构改造 → 执行旧数据迁移 → 回填 test-report 证据 → 才允许 Java 编码；③ 任一缺失视为文档交付不完整，阻塞进入开发阶段 |
-| 35  | **版本总 SQL 收口对账（阻塞级）**              | 每个涉及数据库的 P/CR 任务必须提供 `P编号                                                                                                                                                                                                                                          | 表       | 字段/索引/数据 | 源码引用             | 总SQL位置  | 开发库状态 | 测试库状态                                                                              | 处理结论` 对账表；开发库已有但源码依赖且总 SQL 缺失时必须补总 SQL；测试库已有字段不得重复 ADD，类型/注释不一致时生成 MODIFY；无对账表不得标记完成 |
+| 35  | **版本总 SQL 收口对账（阻塞级）**              | 每个涉及数据库的 P/CR 任务必须提供 `P编号                                                                                                                                                                                                                                          | 表       | 字段/索引/数据 | 源码引用             | 总SQL位置  | 开发库状态 | 测试库状态                                                                              | 处理结论` 对账表；开发库已有但冻结 SQL 缺失时必须退回 docs 更新 `release-sql.md`、哈希和 handoff，研发 Agent 不得补写；无对账表不得标记完成 |
 | 41  | **跨仓实体字段对账（阻塞级）**                 | 多仓共享表、复制实体、MyBatis-Plus `@TableName`/`BaseMapper` 时：① 必须提供 `表                                                                                                                                                                                                    | 真源结构 | 消费仓         | 实体/Mapper/SQL 字段 | 实际库字段 | 处理结论   | 验证证据`；② 任一消费仓映射不存在列或查询旧字段时阻塞；③ 不得通过给测试库补废弃字段绕过 |
 | 42  | **真实入口与测试端点分级（阻塞级）**           | 涉及外部系统链路时：① test-report 必须分开记录 `Mock 验证`、`测试端点验证`、`真实入口验证`；② 测试 Controller/绕过鉴权端点只能标记局部通过；③ 无真实入口 payload/响应/trace/DB 时，不得写真实链路通过                                                                              |
 | 44  | **Red-Green 证据占位（阻塞级）**               | test-report.md 必须预置 `RED 失败证据`、`GREEN 通过证据`、`接口自动化证据`、`DB 核查证据`、`日志核查证据`、`未自动化/阻塞用例`；每项绑定 tests.md 用例 ID                                                                                                                          |
@@ -140,7 +143,7 @@
 - 如果 D2（表结构改造 SQL）执行失败 → **阻塞**，修复 SQL 后重新执行，禁止先写 Java 代码
 - 如果 D3（旧数据迁移 SQL）执行失败或数量核对不一致 → **阻塞**，必须解决迁移问题，禁止用业务代码绕过
 - 如果 D4（迁移证据）缺失 → **阻塞**，明确"不允许进入编码阶段"，必须补齐 test-report 证据
-- 如果 D6（版本总 SQL 收口）缺失 → **阻塞**，必须补齐汇总 SQL 和对账表，不能只说开发库已存在
+- 如果 D6（版本总 SQL 收口）缺失 → **阻塞**，退回 docs 补齐冻结 SQL、哈希和对账表，不能只说开发库已存在
 - D5 只有通过后才能开始 Phase 1（读取文档）之后的编码工作
 
 ### P0 基线特有加禁
@@ -270,7 +273,7 @@
 - 批次报告中必须包含"数据库前置门禁"章节，写明检查了哪些表/字段/索引/初始化数据。
 - 报告中必须包含汇总 SQL 文件路径、执行的具体脚本、执行结果、复查确认结果。
 - 如果业务代码绕过字段缺失、空 SET、默认值缺失、初始化数据缺失等问题，应优先判断是否是 SQL 未执行导致。
-- 如果根因是 SQL 未执行，修复方向应是执行/补齐汇总 SQL，而不是继续加业务兼容代码。
+- 如果根因是 SQL 未执行，执行冻结 SQL；如果冻结 SQL 有遗漏，退回 docs，不能由研发 Agent 补写或加业务兼容代码。
 - 没有真实数据库结构核查和 SQL 执行证据时，结论必须写"未通过，缺少数据库前置门禁证据"。
 - 检查本需求下是否只维护了一个汇总 SQL 文件，是否存在各任务各自新建的独立 SQL 文件。
 - SQL 脚本是否采用简单直接格式，不存在过度兼容脚本（INFORMATION_SCHEMA 判断、PREPARE/EXECUTE 等）。
@@ -295,7 +298,7 @@
   - {批次/任务}：{缺失的数据库核查/SQL 执行证据} → 处理方式：{fix}
   - {批次/任务}：{发现代码绕过数据库缺失} → 根因判断：{SQL 未执行/设计变更} → 修复方向：{执行 SQL / 改设计}
 - 版本总 SQL 收口缺口：X 项
-  - {批次/任务}：{源码引用/开发库字段/测试库状态/总 SQL 缺口} → 处理方式：{补总 SQL / MODIFY / 不采纳并说明}
+  - {批次/任务}：{源码引用/开发库字段/测试库状态/冻结 SQL 缺口} → 处理方式：{退回 docs 更新 release-sql / 不采纳并说明}
 - 跨仓数据合同缺口：X 项
   - {表/消费仓}：{实体/Mapper/SQL 引用字段} → 实际库：{缺失/类型不一致/查询条件旧口径} → 处理方式：{修代码 / @TableField(exist=false) / 补最终合同 SQL / 阻塞}
 - 真实入口验收缺口：X 项

package/assets/skills/superflow-pipeline/references/reviewer-checklist.md

@@ -133,6 +133,13 @@
 | 54 | 真实入口日志闭环 | 检查服务日志 | 从入口日志到业务校验、DB 查询、外部调用或异常返回有同一 trace/业务单号串联 |
 | 55 | 泛化失败归因 | 检查外部错误、业务日志和 DB 旁证 | 外部平台泛化失败时未直接写通过；已区分外部阻塞、合同漂移、代码异常 |
 
+## 负向控制与资源清理检查
+
+| # | 检查项 | 检查方法 | 通过标准 |
+|---|---|---|---|
+| 55.1 | 负向输入是否真实到达 | 对照 `tests.md` 的原始载荷、客户端命令与服务端日志/分支 | 畸形 JSON、错误 Content-Type、越权身份或非法字段以真实线协议注入，并证明命中目标解析/校验分支；不能只因状态码相同而通过 |
+| 55.2 | 任务资源身份闭环 | 对照 owner 记录、资源记录、清理代码与失败用例 | 清理逐项比对 nonce、PID、端口、签名等冻结身份；任一不匹配拒绝清理且有证据。复用认证 helper 时只核对完整性、任务参数、一次失败清理和最终零残留 |
+
 ## 金额精度检查
 
 | # | 检查项 | 检查方法 | 通过标准 |

package/assets/skills/superflow-pipeline/references/superpower-technical-design-template.md

@@ -35,6 +35,16 @@ canonical_sources:
 | -------------------- | --------------- | ---------------- | ------------------------- | ------------- | ------ |
 | <R1/S1>              | `<file>:<line>` | <observed fact>  | <implementation approach> | <files>       | <risk> |
 
+## 复杂度减法评审
+
+| 设计项 | 现有能力/复用证据 | 是否必要 | 最简实现 | 删除/拒绝项 | 证据/阻塞 |
+| ------ | ----------------- | -------- | -------- | ----------- | --------- |
+| `<表/API/Service/组件/同步机制>` | `<现有源码/API/表/依赖>` | `保留/删除/阻塞` | `<最小闭环实现>` | `<不新增的平行抽象/缓存/异步/兼容层>` | `<锚点或阻塞>` |
+
+新增项统计：表 0；字段 0；API 0；Service/组件 0；缓存 0；MQ/事件 0；定时任务 0；兼容层 0。按实际设计替换数量，不适用时保留 0。优先扩展
+现有模块；可安全推导的状态不重复持久化；单事务同步可闭环时不引入异步、补偿或
+缓存。每个保留项都要说明更简单方案为何不能满足合同，没有证据则删除。
+
 ## Architecture Boundary And Call Direction
 
 Use this whenever the change crosses repositories, services, SDKs, MQ,

package/assets/skills/superflow-pipeline/scripts/superflow-archive.sh

@@ -131,7 +131,7 @@ GUARD="$SCRIPT_DIR/superflow-guard.sh"
 VALIDATE="$SCRIPT_DIR/superflow-yaml-validate.sh"
 CHANGE_DIR="$(cd "$CHANGE_DIR" && pwd)"
 CHANGE_NAME="$(basename "$CHANGE_DIR")"
-PROJECT_ROOT="$(cd "$CHANGE_DIR/../.." && pwd)"
+PROJECT_ROOT="$(cd "$CHANGE_DIR/../../.." && pwd)"
 ARCHIVE_ROOT="$PROJECT_ROOT/openspec/changes/archive"
 ARCHIVE_NAME="$CHANGE_NAME"
 

package/assets/skills/superflow-pipeline/scripts/superflow-guard.sh

@@ -24,6 +24,7 @@ VALIDATE="$SCRIPT_DIR/superflow-yaml-validate.sh"
 CHANGE_DIR="${1:-}"
 PHASE="${2:-}"
 MODE="${3:-}"
+CHANGE_DIR_INPUT="${CHANGE_DIR%/}"
 
 [[ -n "$CHANGE_DIR" && -n "$PHASE" ]] || {
   usage
@@ -35,6 +36,25 @@ MODE="${3:-}"
 CHANGE_DIR="$(cd "$CHANGE_DIR" && pwd)"
 issues=()
 
+require_canonical_change_layout() {
+  local suffix
+
+  if [[ -L "$CHANGE_DIR_INPUT" ]]; then
+    issues+=("symlinked OpenSpec change directory is forbidden; keep one physical openspec/changes/<change-name> directory")
+  fi
+
+  [[ "$CHANGE_DIR" == */openspec/changes/* ]] || return 0
+  suffix="${CHANGE_DIR#*/openspec/changes/}"
+  case "$suffix" in
+    archive/*|*/embedded-changes/*) return 0 ;;
+  esac
+  if [[ "$suffix" == */* ]]; then
+    issues+=("non-canonical OpenSpec change directory: encode the version in <change-name> and use openspec/changes/<change-name>")
+  fi
+}
+
+require_canonical_change_layout
+
 require_file() {
   local path="$1"
   [[ -f "$CHANGE_DIR/$path" ]] || issues+=("missing file: $path")
@@ -302,20 +322,106 @@ change_has_field_status_risk() {
     "$CHANGE_DIR"/*.md "$CHANGE_DIR"/**/*.md 2>/dev/null
 }
 
-change_has_external_enum_risk() {
+change_has_database_change() {
+  if grep -Eiq '^[[:space:]]*database:[[:space:]]*false([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 1
+  fi
+  if grep -Eiq '^[[:space:]]*database:[[:space:]]*true([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 0
+  fi
   grep -RIEiq \
-    'BEM|payOrigin|payMode|支付来源|支付方式|财务口径|第三方枚举|第三方字段|third[- ]party enum|source system|SDK.*枚举|枚举.*SDK' \
+    'database_change[[:space:]]*:[[:space:]]*true|数据库变更.{0,8}(是|需要|包含)|ALTER[[:space:]]+TABLE|CREATE[[:space:]]+TABLE|ADD[[:space:]]+(COLUMN|INDEX|KEY|CONSTRAINT)|(^|[^不未无])新增.{0,12}(表|字段|索引|约束)|(^|[^不未无])(历史数据|初始化数据).{0,12}(迁移|回填)|schema[ -]migration|database[ -]migration|add.{0,12}(table|column|index|constraint)' \
     "$CHANGE_DIR/proposal.md" \
     "$CHANGE_DIR/api.md" \
     "$CHANGE_DIR/design.md" \
-    "$CHANGE_DIR/tests.md" \
+    "$CHANGE_DIR/tasks.md" \
+    "$CHANGE_DIR/database-contract.md" \
     "$CHANGE_DIR/spec.md" \
     "$CHANGE_DIR"/specs/*/spec.md 2>/dev/null
 }
 
-change_has_external_config_risk() {
+require_frozen_release_sql() {
+  local release_sql="$CHANGE_DIR/release-sql.md"
+  local output
+
+  require_file release-sql.md
+  [[ -f "$release_sql" ]] || return 0
+
+  output="$(mktemp)"
+  if ! python3 - "$release_sql" >"$output" 2>&1 <<'PY'
+import hashlib
+import re
+import sys
+from pathlib import Path
+
+path = Path(sys.argv[1])
+text = path.read_text(encoding="utf-8")
+errors = []
+
+front_match = re.match(r"\A---\n(.*?)\n---(?:\n|\Z)", text, re.S)
+front = front_match.group(1) if front_match else ""
+if not front_match:
+    errors.append("front matter is missing")
+
+def field(name):
+    match = re.search(rf"(?m)^{re.escape(name)}:\s*(.*?)\s*$", front)
+    return match.group(1).strip().strip('"\'') if match else ""
+
+if field("database_change").lower() != "true":
+    errors.append("database_change must be true")
+
+target = field("target_sql_path")
+if not target or not target.lower().endswith(".sql"):
+    errors.append("target_sql_path must be an exact .sql path")
+if re.search(r"[<>{}]|testN|version|待定|pending", target, re.I):
+    errors.append("target_sql_path contains a placeholder")
+
+if field("copy_policy").lower() != "verbatim":
+    errors.append("copy_policy must be verbatim")
+
+declared_hash = field("sql_sha256").lower()
+if not re.fullmatch(r"[0-9a-f]{64}", declared_hash):
+    errors.append("sql_sha256 must be a 64-character lowercase SHA-256")
+
+blocks = re.findall(r"```sql[^\n]*\n(.*?)\n```", text, re.S | re.I)
+if len(blocks) != 1:
+    errors.append("release-sql.md must contain exactly one sql code block")
+else:
+    payload = blocks[0].replace("\r\n", "\n").replace("\r", "\n").rstrip("\n") + "\n"
+    actual_hash = hashlib.sha256(payload.encode("utf-8")).hexdigest()
+    if declared_hash and actual_hash != declared_hash:
+        errors.append(
+            f"sql_sha256 mismatch: declared={declared_hash} actual={actual_hash}"
+        )
+    executable = re.sub(r"/\*.*?\*/|--[^\n]*", "", payload, flags=re.S)
+    if not re.search(
+        r"\b(CREATE|ALTER|DROP|INSERT|UPDATE|DELETE|MERGE|TRUNCATE|CALL)\b",
+        executable,
+        re.I,
+    ):
+        errors.append("sql block has no executable schema/data change statement")
+    if not re.search(r"\b(SELECT|SHOW|CALL)\b", executable, re.I):
+        errors.append("sql block has no executable verification statement")
+
+if errors:
+    print("; ".join(errors))
+    sys.exit(1)
+PY
+  then
+    issues+=("frozen release SQL invalid: $(tr '\n' ' ' < "$output" | sed -E 's/[[:space:]]+/ /g')")
+  fi
+  rm -f "$output"
+
+  require_grep 'release-sql\.md' design.md "frozen release SQL design reference"
+  require_grep 'release-sql\.md' tasks.md "frozen release SQL task reference"
+  require_grep 'release-sql\.md' sdd-quality-gate.md "frozen release SQL quality-gate reference"
+  require_grep '原样复制|verbatim' tasks.md "verbatim SQL copy task"
+  require_grep '原样复制|verbatim' sdd-quality-gate.md "verbatim SQL copy quality gate"
+}
+
+change_has_external_enum_risk() {
   grep -RIEiq \
-    '第三方|外部平台|外部工具|外部集成|third[- ]party|external (platform|tool|integration|system)|SDK|MQ|Kafka|RocketMQ|TDMQ|callback|回调|webhook|支付渠道|payment gateway|cloud service|云服务' \
+    'BEM|payOrigin|payMode|支付来源|支付方式|财务口径|第三方枚举|第三方字段|third[- ]party enum|source system|SDK.*枚举|枚举.*SDK' \
     "$CHANGE_DIR/proposal.md" \
     "$CHANGE_DIR/api.md" \
     "$CHANGE_DIR/design.md" \
@@ -324,7 +430,45 @@ change_has_external_config_risk() {
     "$CHANGE_DIR"/specs/*/spec.md 2>/dev/null
 }
 
+change_contract_docs_without_complexity_budget() {
+  local path
+  for path in proposal.md api.md design.md tests.md spec.md; do
+    [[ -f "$CHANGE_DIR/$path" ]] || continue
+    sed -E '/新增项统计|复杂度预算|New-item counts|Complexity budget/d' \
+      "$CHANGE_DIR/$path"
+  done
+  if [[ -d "$CHANGE_DIR/specs" ]]; then
+    find "$CHANGE_DIR/specs" -path '*/spec.md' -type f \
+      -exec sed -E '/新增项统计|复杂度预算|New-item counts|Complexity budget/d' {} +
+  fi
+}
+
+change_all_docs_without_complexity_budget() {
+  find "$CHANGE_DIR" -maxdepth 2 -name '*.md' -type f \
+    -exec sed -E '/新增项统计|复杂度预算|New-item counts|Complexity budget/d' {} +
+}
+
+change_has_external_config_risk() {
+  if grep -Eiq '^[[:space:]]*external_config:[[:space:]]*false([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 1
+  fi
+  if grep -Eiq '^[[:space:]]*external_config:[[:space:]]*true([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 0
+  fi
+  local content
+  content="$(change_contract_docs_without_complexity_budget)"
+  grep -Eiq \
+    '第三方|外部平台|外部工具|外部集成|third[- ]party|external (platform|tool|integration|system)|SDK|MQ|Kafka|RocketMQ|TDMQ|callback|回调|webhook|支付渠道|payment gateway|cloud service|云服务' \
+    <<< "$content"
+}
+
 change_has_concurrency_idempotency_risk() {
+  if grep -Eiq '^[[:space:]]*concurrency:[[:space:]]*false([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 1
+  fi
+  if grep -Eiq '^[[:space:]]*concurrency:[[:space:]]*true([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 0
+  fi
   grep -RIEiq \
     '并发|批量下发|批量开通|批量续费|重复提交|重复回调|重复消费|重复下发|幂等|竞态|原子占用|concurren|idempoten|race condition|duplicate (request|callback|consumption|delivery)|atomic claim' \
     "$CHANGE_DIR/proposal.md" \
@@ -336,6 +480,12 @@ change_has_concurrency_idempotency_risk() {
 }
 
 change_has_money_precision_risk() {
+  if grep -Eiq '^[[:space:]]*money:[[:space:]]*false([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 1
+  fi
+  if grep -Eiq '^[[:space:]]*money:[[:space:]]*true([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 0
+  fi
   grep -RIEiq \
     '金额|费用|价格|优惠|折扣|抵扣|退款|分账|支付|发票|余额|电费|服务费|套餐结算|比例分摊|明细分配|尾差|精度|舍入|(^|[^[:alnum:]_])(amount|fee|fees|price|discount|deduction|refund|payment|invoice|balance|proration|allocation|reconciliation|rounding)([^[:alnum:]_]|$)|revenue sharing|profit sharing|split payment|serviceFee|chargeFee|totalAmount|actualAmount|payAmount|refundAmount|discountAmount|invoiceAmount|balanceAmount' \
     "$CHANGE_DIR/proposal.md" \
@@ -346,6 +496,53 @@ change_has_money_precision_risk() {
     "$CHANGE_DIR"/specs/*/spec.md 2>/dev/null
 }
 
+change_has_source_fact_risk() {
+  grep -RIEiq \
+    '现有|现行|遗留|数据库|数据表|表关系|Mapper|XML|跨仓|跨服务|真实入口|小程序|H5|existing|current behavior|legacy|database|table relationship|cross[- ](repo|service)|crosses services|real entry|mini[- ]program' \
+    "$CHANGE_DIR/proposal.md" \
+    "$CHANGE_DIR/api.md" \
+    "$CHANGE_DIR/design.md" \
+    "$CHANGE_DIR/tests.md" \
+    "$CHANGE_DIR/spec.md" \
+    "$CHANGE_DIR"/specs/*/spec.md 2>/dev/null
+}
+
+change_has_cardinality_conflict_signal() {
+  grep -RIEiq \
+    'List[<（(]|orderIds|batchInsert|批量插入|一对多|one[- ]to[- ]many|关系表' \
+    "$CHANGE_DIR"/*.md "$CHANGE_DIR"/**/*.md 2>/dev/null
+}
+
+require_source_fact_audit() {
+  require_file source-code-audit.md
+  require_grep '源码事实冻结卡|Source Fact Freeze Card' source-code-audit.md "source fact freeze card"
+  require_grep '业务结论|Business conclusion' source-code-audit.md "source fact business conclusion"
+  require_grep 'understand.*定位|understand.*locator' source-code-audit.md "understand-anything locator evidence"
+  require_grep '数据模型|Data model' source-code-audit.md "source fact data model"
+  require_grep '所有写入方|All writers' source-code-audit.md "all writers inventory"
+  require_grep '真实用户入口|Real user entr' source-code-audit.md "real user entry"
+  require_grep '当前调用方|Current callers' source-code-audit.md "current callers"
+  require_grep '遗留冲突|Legacy conflict' source-code-audit.md "legacy conflict"
+  require_grep 'DB.*(必查|核查|跳过|未执行|reason)|数据库.*(必查|核查|跳过|未执行|原因)|DB (check|required|skip|reason)' source-code-audit.md "DB check or skip reason"
+  require_grep '结论等级|Conclusion level' source-code-audit.md "conclusion level"
+  require_grep 'owner.*(决策|decision)|决策.*owner' source-code-audit.md "owner decision boundary"
+  require_grep 'current|现行入口' source-code-audit.md "current evidence classification"
+  require_grep 'legacy|遗留入口' source-code-audit.md "legacy evidence classification"
+  require_grep 'unmounted|无前端调用' source-code-audit.md "unmounted evidence classification"
+  require_grep 'data-model-only|仅数据模型可表达' source-code-audit.md "data-model-only evidence classification"
+  require_grep 'owner-confirmed|owner 已确认' source-code-audit.md "owner-confirmed evidence classification"
+  require_grep 'blocked|阻塞' source-code-audit.md "blocked evidence classification"
+  require_grep '(证据分类|Evidence classifications).*(current|现行).*(legacy|遗留).*(unmounted|无前端调用).*(data-model-only|仅数据模型可表达).*(owner-confirmed|owner 已确认).*(blocked|阻塞)' source-code-audit.md "complete evidence classification set"
+  require_grep '提问资格门禁|Question Eligibility Gate' source-code-audit.md "question eligibility gate"
+  require_grep '源码检索|Source search' source-code-audit.md "source search evidence"
+  require_grep 'Mapper.*SQL|SQL.*Mapper' source-code-audit.md "Mapper and SQL search evidence"
+  require_grep '前端.*小程序.*H5|Frontend.*mini[- ]program.*H5' source-code-audit.md "frontend mini-program H5 caller search"
+  require_grep 'sibling.*repo|兄弟仓|关联仓' source-code-audit.md "sibling repository search"
+  if change_has_cardinality_conflict_signal; then
+    require_grep '冲突审计|Conflict Audit' source-code-audit.md "cardinality conflict audit"
+  fi
+}
+
 change_has_fx_precision_risk() {
   grep -RIEiq \
     '汇率|换汇|外汇|币种转换|跨币种|兑换率|(^|[^[:alnum:]_])(exchange rate|fx rate|currency conversion|cross.currency|base currency|quote currency)([^[:alnum:]_]|$)' \
@@ -358,13 +555,17 @@ change_has_fx_precision_risk() {
 }
 
 change_has_architecture_boundary_risk() {
-  grep -RIEiq \
+  local content
+  content="$(change_all_docs_without_complexity_budget)"
+  grep -Eiq \
     '跨仓|跨服务|sibling|SDK|MQ|topic|consumer|scheduler|定时|device|设备|callback|回调|third[- ]party|第三方|mini[- ]program|小程序|gateway|网关|adapter|适配|protocol|协议|interconnect|互联互通|调用链|入口|出口' \
-    "$CHANGE_DIR"/*.md "$CHANGE_DIR"/**/*.md 2>/dev/null
+    <<< "$content"
 }
 
-first_prompt_rel() {
-  find "$CHANGE_DIR" -path '*/prompt/*.md' -type f | head -n 1 | sed "s#^$CHANGE_DIR/##"
+prompt_rels() {
+  find "$CHANGE_DIR" -path '*/prompt/*.md' -type f -print \
+    | LC_ALL=C sort \
+    | sed "s#^$CHANGE_DIR/##"
 }
 
 require_any_prompt() {
@@ -374,7 +575,7 @@ require_any_prompt() {
 }
 
 require_prompt_set() {
-  local task_count prompt_count non_index_prompt_count
+  local task_count prompt_count non_index_prompt_count prompt_rel document
   require_file prompt/implementation.md
   task_count="$(grep -E '^[[:space:]]*-[[:space:]]+\[[ xX]\]' "$CHANGE_DIR/tasks.md" 2>/dev/null | wc -l | tr -d ' ')"
   prompt_count="$(find "$CHANGE_DIR/prompt" -maxdepth 1 -type f -name '*.md' 2>/dev/null | wc -l | tr -d ' ')"
@@ -385,9 +586,15 @@ require_prompt_set() {
   if [[ "$prompt_count" -eq 0 ]]; then
     issues+=("missing prompt/*.md files")
   fi
-  if [[ -f "$CHANGE_DIR/tasks.md" ]] && ! grep -Riq 'prompt/.*\.md' "$CHANGE_DIR/tasks.md" "$CHANGE_DIR/traceability-matrix.md" "$CHANGE_DIR/sdd-quality-gate.md" "$CHANGE_DIR/test-report.md" 2>/dev/null; then
-    issues+=("prompt files are not cross-linked from tasks/traceability/quality gate/test-report")
-  fi
+  for document in tasks.md traceability-matrix.md sdd-quality-gate.md test-report.md; do
+    [[ -f "$CHANGE_DIR/$document" ]] || continue
+    while IFS= read -r prompt_rel; do
+      if ! grep -Fq "]($prompt_rel)" "$CHANGE_DIR/$document" \
+        && ! grep -Fq "](./$prompt_rel)" "$CHANGE_DIR/$document"; then
+        issues+=("$document does not link $prompt_rel")
+      fi
+    done < <(prompt_rels)
+  done
 }
 
 require_external_enum_contract() {
@@ -482,6 +689,29 @@ require_money_precision_evidence() {
   fi
 }
 
+require_minimal_design_review() {
+  local path="$1"
+  local label="$2"
+  require_grep '复杂度减法评审|反过度设计评审|Minimal Design Review|Complexity Reduction Review' "$path" "$label"
+  require_grep '复用|reuse|existing capability|existing module' "$path" "$label reuse evidence"
+  require_grep '最简|最小实现|simplest|minimum design|minimal implementation' "$path" "$label simplest implementation"
+  require_grep '删除|拒绝|不新增|移出范围|removed|rejected|do not add|out of scope' "$path" "$label removed or rejected complexity"
+  require_grep '新增项统计|复杂度预算|New-item counts|Complexity budget' "$path" "$label complexity budget"
+  require_grep '表|table' "$path" "$label table count"
+  require_grep '字段|field' "$path" "$label field count"
+  require_grep 'API' "$path" "$label API count"
+  require_grep 'Service|服务|组件|service|component' "$path" "$label service/component count"
+  require_grep '缓存|cache' "$path" "$label cache count"
+  require_grep 'MQ|事件|异步|event|async' "$path" "$label async/event count"
+  require_grep '定时任务|scheduled job|scheduler' "$path" "$label scheduled-job count"
+  require_grep '兼容层|compatibility layer' "$path" "$label compatibility-layer count"
+}
+
+require_minimal_design_pass() {
+  local path="$1"
+  require_grep '(复杂度减法评审|反过度设计评审|Minimal Design Review|Complexity Reduction Review).*(PASS|通过)|(PASS|通过).*(复杂度减法评审|反过度设计评审|Minimal Design Review|Complexity Reduction Review)' "$path" "complexity reduction review PASS verdict"
+}
+
 transition_event=""
 
 if [[ -x "$VALIDATE" && -f "$CHANGE_DIR/.sdd/state.yaml" ]]; then
@@ -511,6 +741,28 @@ case "$PHASE" in
     require_grep 'RED|红绿|GREEN' tests.md "RED/GREEN test contract"
     require_grep 'curl|Postman|Newman|pytest|RestAssured|自动化命令' tests.md "interface automation command"
     require_grep 'handoff_hash|sdd-context|上下文包|防漂移' sdd-quality-gate.md "handoff/context-drift gate"
+    if change_has_database_change; then
+      require_frozen_release_sql
+    fi
+    workflow="$(state_get workflow)"
+    if [[ "$workflow" == "full" ]]; then
+      require_file requirement-review.md
+      require_grep '^review_verdict:[[:space:]]*PASS[[:space:]]*$' requirement-review.md "requirement reverse review PASS verdict"
+      require_grep '^implementation_readiness:[[:space:]]*READY[[:space:]]*$' requirement-review.md "requirement review implementation readiness"
+      require_grep '^open_blockers:[[:space:]]*0[[:space:]]*$' requirement-review.md "requirement reverse review has no open blockers"
+      require_grep '^open_external_contracts:[[:space:]]*0[[:space:]]*$' requirement-review.md "requirement review has no open external contracts"
+      require_grep '^open_source_investigations:[[:space:]]*0[[:space:]]*$' requirement-review.md "requirement review has no open source investigations"
+      require_grep '^open_owner_decisions:[[:space:]]*0[[:space:]]*$' requirement-review.md "requirement review has no open owner decisions"
+      require_grep '闭环矩阵|Closure Matrix' requirement-review.md "requirement review closure matrix"
+      require_grep '评审发现|Review Findings' requirement-review.md "requirement review findings"
+      require_grep '未关闭阻塞项|Open Blockers' requirement-review.md "requirement review open blocker ledger"
+      require_minimal_design_review design.md "complexity reduction review"
+      require_grep '复杂度减法评审|反过度设计评审|Minimal Design Review|Complexity Reduction Review' sdd-quality-gate.md "complexity reduction quality gate"
+      require_minimal_design_pass sdd-quality-gate.md
+      if change_has_source_fact_risk; then
+        require_source_fact_audit
+      fi
+    fi
     if change_has_external_enum_risk; then
       require_external_enum_contract api.md "external enum binding contract"
       require_external_enum_contract sdd-quality-gate.md "external enum binding quality gate"
@@ -544,8 +796,14 @@ case "$PHASE" in
     require_handoff_current
     require_beta_handoff_structure
     require_hash_recorded
+    if change_has_database_change; then
+      require_frozen_release_sql
+    fi
     workflow="$(state_get workflow)"
     if [[ "$workflow" == "full" ]]; then
+      require_minimal_design_review design.md "complexity reduction review"
+      require_grep '复杂度减法评审|反过度设计评审|Minimal Design Review|Complexity Reduction Review' sdd-quality-gate.md "complexity reduction quality gate"
+      require_minimal_design_pass sdd-quality-gate.md
       require_optional_state_path technical_design "technical_design"
       technical_design_rel="$(state_get technical_design)"
       if [[ -n "${technical_design_rel:-}" && "$technical_design_rel" != "null" ]]; then
@@ -569,6 +827,7 @@ case "$PHASE" in
         if change_has_money_precision_risk; then
           require_money_precision_contract "$technical_design_rel" "money precision boundary"
         fi
+        require_minimal_design_review "$technical_design_rel" "technical design minimal design review"
       fi
     fi
     require_grep 'Superpowers Technical Design Handoff|Superpower 技术详设|technical_design|源码级 HOW' design.md "Superpowers technical design handoff"
@@ -582,11 +841,14 @@ case "$PHASE" in
     require_handoff_current
     require_beta_handoff_structure
     require_hash_recorded
+    if change_has_database_change; then
+      require_frozen_release_sql
+    fi
     require_any_prompt
     require_prompt_set
     require_grep 'OpenSpec/SDD|设计事实源|canonical|事实源' design.md "canonical source boundary"
-    prompt_rel="$(first_prompt_rel)"
-    if [[ -n "${prompt_rel:-}" ]]; then
+    while IFS= read -r prompt_rel; do
+      [[ -n "${prompt_rel:-}" ]] || continue
       require_grep 'Superpower 技术详设继承|Superpower 执行策略继承|technical_design|源码级 HOW' "$prompt_rel" "prompt Superpower strategy inheritance"
       technical_design_rel="$(state_get technical_design)"
       if [[ -n "${technical_design_rel:-}" && "$technical_design_rel" != "null" ]]; then
@@ -608,7 +870,11 @@ case "$PHASE" in
         fi
       fi
       require_grep '上下文防漂移|handoff_hash|sdd-context' "$prompt_rel" "prompt context drift inheritance"
-    fi
+      if change_has_database_change; then
+        require_grep 'release-sql\.md' "$prompt_rel" "prompt frozen release SQL reference"
+        require_grep '原样复制|verbatim|sql_sha256' "$prompt_rel" "prompt verbatim SQL copy contract"
+      fi
+    done < <(prompt_rels)
     require_state_value build_mode "build_mode"
     require_state_value isolation "isolation"
     require_state_value tdd_mode "tdd_mode"

package/assets/skills/superflow-pipeline/scripts/superflow-handoff.sh

@@ -244,10 +244,13 @@ sync_state() {
   "$state_sh" set "$CHANGE_DIR" context_compression "$context_compression"
   "$state_sh" set "$CHANGE_DIR" handoff_context .sdd/handoff/sdd-context.json
   "$state_sh" set "$CHANGE_DIR" handoff_hash "$context_hash"
-  technical_design_rel="$(
-    find "$CHANGE_DIR/docs/superpowers/specs" -maxdepth 1 -type f -name '*.md' 2>/dev/null \
-      | sort | head -n 1 | sed "s#^$CHANGE_DIR/##"
-  )"
+  technical_design_rel=""
+  if [[ -d "$CHANGE_DIR/docs/superpowers/specs" ]]; then
+    technical_design_rel="$(
+      find "$CHANGE_DIR/docs/superpowers/specs" -maxdepth 1 -type f -name '*.md' \
+        | sort | head -n 1 | sed "s#^$CHANGE_DIR/##"
+    )"
+  fi
   if [[ -n "$technical_design_rel" ]]; then
     "$state_sh" set "$CHANGE_DIR" technical_design "$technical_design_rel"
   fi