@chenmk/superflow 0.3.0 → 0.5.0

package/assets/skills-en/superflow-pipeline/references/quality-gate.md

@@ -9,10 +9,28 @@
 - Handoff files exist and hash is current.
 - design.md records OpenSpec/SDD as WHAT and Superpowers as HOW.
 - sdd-quality-gate.md records guard command and result.
+- design.md and sdd-quality-gate.md include a Minimal Design Review with reuse
+  evidence, necessity, simplest implementation, removed/rejected complexity,
+  counts of new tables/fields/APIs/services/caches/async flows/jobs/compatibility
+  layers, and a PASS/BLOCKED verdict. Only PASS may leave docs/design.
+- Full existing-system, DB/table, cross-repository, or real-entry changes have
+  `source-code-audit.md` with a Source Fact Freeze Card, all writers and real
+  callers, current/legacy/unmounted/data-model-only/owner-confirmed/blocked
+  classifications, DB check or skip reason, conflict audit, and owner boundary.
+- Database changes have `release-sql.md` with `database_change: true`, an exact
+  placeholder-free `target_sql_path`, `copy_policy: verbatim`, a valid
+  `sql_sha256`, and exactly one complete executable SQL block with required
+  prechecks, DDL/DML, migration, and post-verification. Design, tasks, and the
+  quality gate state that implementation agents may only copy it verbatim;
+  omissions return to docs.
 
 ## Design Gate
 
 - Technical design exists for full workflow.
+- Technical design repeats the Minimal Design Review at source level. It extends
+  existing modules first and rejects speculative abstractions, parallel APIs or
+  models, derivable persistence, premature caches, and async compensation when
+  a direct synchronous design satisfies the contract.
 - Field/status reverse impact matrix exists when risky fields or states change.
 - Architecture boundary and call-direction matrix exists for cross-service or
   external flows.
@@ -43,6 +61,8 @@
   sum(other components)` instead of calculating and rounding every component
   independently.
 - SQL risk review exists for DB changes.
+- Source-level design does not author or defer release SQL; it consumes the
+  already frozen `release-sql.md` contract.
 - No fallback or guesswork is allowed without explicit owner approval.
 
 ## Implementation Gate

package/assets/skills-en/superflow-pipeline/references/reviewer-checklist.md

@@ -22,6 +22,13 @@
   rounding explicit, without early rate rounding or synthesized inverses?
 - Are SQL changes reviewed and tied to total version SQL when needed?
 - Are RED/GREEN evidence and real-entry evidence present?
+- For L3/L4 negative controls, does the raw malformed or forbidden payload reach
+  the intended parser/validation branch, rather than merely returning the same
+  status code?
+- For task-owned resource cleanup, are every frozen identity field (nonce, PID,
+  port, signature, etc.) compared and mismatch refusal proven? An unchanged
+  certified helper needs integrity, task parameters, one failure cleanup, and
+  final zero residue only.
 - Are mock-only results clearly labeled?
 - Did workers stay inside allowed file boundaries?
 - Did hooks and guard scripts pass?

package/assets/skills-en/superflow-pipeline/references/superpower-technical-design-template.md

@@ -35,6 +35,17 @@ canonical_sources:
 |---|---|---|---|---|---|
 | <R1/S1> | `<file>:<line>` | <observed fact> | <implementation approach> | <files> | <risk> |
 
+## Minimal Design Review
+
+| Design item | Existing capability/reuse evidence | Necessary? | Simplest implementation | Removed/rejected complexity | Evidence/blocker |
+| ----------- | ---------------------------------- | ---------- | ----------------------- | --------------------------- | ---------------- |
+| `<table/API/service/component/sync>` | `<existing source/API/table/dependency>` | `keep/remove/blocked` | `<minimum implementation>` | `<no parallel abstraction/cache/async/compat layer>` | `<anchor or blocker>` |
+
+New-item counts: tables 0; fields 0; APIs 0; services/components 0; caches 0; MQ/events 0; scheduled jobs 0; compatibility layers 0. Replace each count with the actual design total. Extend existing modules first. Do not persist values
+that can be derived safely, and do not add async compensation or caching when a
+single synchronous transaction closes the contract. Every retained item must
+explain why a simpler option fails; remove it when there is no evidence.
+
 ## Architecture Boundary And Call Direction
 
 Use this whenever the change crosses repositories, services, SDKs, MQ,

package/assets/skills-en/superflow-pipeline/scripts/superflow-archive.sh

@@ -131,7 +131,7 @@ GUARD="$SCRIPT_DIR/superflow-guard.sh"
 VALIDATE="$SCRIPT_DIR/superflow-yaml-validate.sh"
 CHANGE_DIR="$(cd "$CHANGE_DIR" && pwd)"
 CHANGE_NAME="$(basename "$CHANGE_DIR")"
-PROJECT_ROOT="$(cd "$CHANGE_DIR/../.." && pwd)"
+PROJECT_ROOT="$(cd "$CHANGE_DIR/../../.." && pwd)"
 ARCHIVE_ROOT="$PROJECT_ROOT/openspec/changes/archive"
 ARCHIVE_NAME="$CHANGE_NAME"
 

package/assets/skills-en/superflow-pipeline/scripts/superflow-guard.sh

@@ -24,6 +24,7 @@ VALIDATE="$SCRIPT_DIR/superflow-yaml-validate.sh"
 CHANGE_DIR="${1:-}"
 PHASE="${2:-}"
 MODE="${3:-}"
+CHANGE_DIR_INPUT="${CHANGE_DIR%/}"
 
 [[ -n "$CHANGE_DIR" && -n "$PHASE" ]] || {
   usage
@@ -35,6 +36,25 @@ MODE="${3:-}"
 CHANGE_DIR="$(cd "$CHANGE_DIR" && pwd)"
 issues=()
 
+require_canonical_change_layout() {
+  local suffix
+
+  if [[ -L "$CHANGE_DIR_INPUT" ]]; then
+    issues+=("symlinked OpenSpec change directory is forbidden; keep one physical openspec/changes/<change-name> directory")
+  fi
+
+  [[ "$CHANGE_DIR" == */openspec/changes/* ]] || return 0
+  suffix="${CHANGE_DIR#*/openspec/changes/}"
+  case "$suffix" in
+    archive/*|*/embedded-changes/*) return 0 ;;
+  esac
+  if [[ "$suffix" == */* ]]; then
+    issues+=("non-canonical OpenSpec change directory: encode the version in <change-name> and use openspec/changes/<change-name>")
+  fi
+}
+
+require_canonical_change_layout
+
 require_file() {
   local path="$1"
   [[ -f "$CHANGE_DIR/$path" ]] || issues+=("missing file: $path")
@@ -302,18 +322,141 @@ change_has_field_status_risk() {
     "$CHANGE_DIR"/*.md "$CHANGE_DIR"/**/*.md 2>/dev/null
 }
 
-change_has_external_config_risk() {
+change_has_database_change() {
+  if grep -Eiq '^[[:space:]]*database:[[:space:]]*false([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 1
+  fi
+  if grep -Eiq '^[[:space:]]*database:[[:space:]]*true([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 0
+  fi
   grep -RIEiq \
-    'third[- ]party|external (platform|tool|integration|system)|SDK|MQ|Kafka|RocketMQ|TDMQ|callback|webhook|payment gateway|cloud service' \
+    'database_change[[:space:]]*:[[:space:]]*true|database[ -]change.{0,12}(required|true|yes)|ALTER[[:space:]]+TABLE|CREATE[[:space:]]+TABLE|ADD[[:space:]]+(COLUMN|INDEX|KEY|CONSTRAINT)|schema[ -]migration|database[ -]migration|historical data.{0,12}(migration|backfill)|seed data.{0,12}(migration|backfill)|add.{0,12}(table|column|index|constraint)' \
     "$CHANGE_DIR/proposal.md" \
     "$CHANGE_DIR/api.md" \
     "$CHANGE_DIR/design.md" \
-    "$CHANGE_DIR/tests.md" \
+    "$CHANGE_DIR/tasks.md" \
+    "$CHANGE_DIR/database-contract.md" \
     "$CHANGE_DIR/spec.md" \
     "$CHANGE_DIR"/specs/*/spec.md 2>/dev/null
 }
 
+require_frozen_release_sql() {
+  local release_sql="$CHANGE_DIR/release-sql.md"
+  local output
+
+  require_file release-sql.md
+  [[ -f "$release_sql" ]] || return 0
+
+  output="$(mktemp)"
+  if ! python3 - "$release_sql" >"$output" 2>&1 <<'PY'
+import hashlib
+import re
+import sys
+from pathlib import Path
+
+path = Path(sys.argv[1])
+text = path.read_text(encoding="utf-8")
+errors = []
+
+front_match = re.match(r"\A---\n(.*?)\n---(?:\n|\Z)", text, re.S)
+front = front_match.group(1) if front_match else ""
+if not front_match:
+    errors.append("front matter is missing")
+
+def field(name):
+    match = re.search(rf"(?m)^{re.escape(name)}:\s*(.*?)\s*$", front)
+    return match.group(1).strip().strip('"\'') if match else ""
+
+if field("database_change").lower() != "true":
+    errors.append("database_change must be true")
+
+target = field("target_sql_path")
+if not target or not target.lower().endswith(".sql"):
+    errors.append("target_sql_path must be an exact .sql path")
+if re.search(r"[<>{}]|testN|version|pending|TBD", target, re.I):
+    errors.append("target_sql_path contains a placeholder")
+
+if field("copy_policy").lower() != "verbatim":
+    errors.append("copy_policy must be verbatim")
+
+declared_hash = field("sql_sha256").lower()
+if not re.fullmatch(r"[0-9a-f]{64}", declared_hash):
+    errors.append("sql_sha256 must be a 64-character lowercase SHA-256")
+
+blocks = re.findall(r"```sql[^\n]*\n(.*?)\n```", text, re.S | re.I)
+if len(blocks) != 1:
+    errors.append("release-sql.md must contain exactly one sql code block")
+else:
+    payload = blocks[0].replace("\r\n", "\n").replace("\r", "\n").rstrip("\n") + "\n"
+    actual_hash = hashlib.sha256(payload.encode("utf-8")).hexdigest()
+    if declared_hash and actual_hash != declared_hash:
+        errors.append(
+            f"sql_sha256 mismatch: declared={declared_hash} actual={actual_hash}"
+        )
+    executable = re.sub(r"/\*.*?\*/|--[^\n]*", "", payload, flags=re.S)
+    if not re.search(
+        r"\b(CREATE|ALTER|DROP|INSERT|UPDATE|DELETE|MERGE|TRUNCATE|CALL)\b",
+        executable,
+        re.I,
+    ):
+        errors.append("sql block has no executable schema/data change statement")
+    if not re.search(r"\b(SELECT|SHOW|CALL)\b", executable, re.I):
+        errors.append("sql block has no executable verification statement")
+
+if errors:
+    print("; ".join(errors))
+    sys.exit(1)
+PY
+  then
+    issues+=("frozen release SQL invalid: $(tr '\n' ' ' < "$output" | sed -E 's/[[:space:]]+/ /g')")
+  fi
+  rm -f "$output"
+
+  require_grep 'release-sql\.md' design.md "frozen release SQL design reference"
+  require_grep 'release-sql\.md' tasks.md "frozen release SQL task reference"
+  require_grep 'release-sql\.md' sdd-quality-gate.md "frozen release SQL quality-gate reference"
+  require_grep 'verbatim' tasks.md "verbatim SQL copy task"
+  require_grep 'verbatim' sdd-quality-gate.md "verbatim SQL copy quality gate"
+}
+
+change_contract_docs_without_complexity_budget() {
+  local path
+  for path in proposal.md api.md design.md tests.md spec.md; do
+    [[ -f "$CHANGE_DIR/$path" ]] || continue
+    sed -E '/New-item counts|Complexity budget/d' "$CHANGE_DIR/$path"
+  done
+  if [[ -d "$CHANGE_DIR/specs" ]]; then
+    find "$CHANGE_DIR/specs" -path '*/spec.md' -type f \
+      -exec sed -E '/New-item counts|Complexity budget/d' {} +
+  fi
+}
+
+change_all_docs_without_complexity_budget() {
+  find "$CHANGE_DIR" -maxdepth 2 -name '*.md' -type f \
+    -exec sed -E '/New-item counts|Complexity budget/d' {} +
+}
+
+change_has_external_config_risk() {
+  if grep -Eiq '^[[:space:]]*external_config:[[:space:]]*false([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 1
+  fi
+  if grep -Eiq '^[[:space:]]*external_config:[[:space:]]*true([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 0
+  fi
+  local content
+  content="$(change_contract_docs_without_complexity_budget)"
+  grep -Eiq \
+    'third[- ]party|external (platform|tool|integration|system)|SDK|MQ|Kafka|RocketMQ|TDMQ|callback|webhook|payment gateway|cloud service' \
+    <<< "$content"
+}
+
 change_has_concurrency_idempotency_risk() {
+  if grep -Eiq '^[[:space:]]*concurrency:[[:space:]]*false([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 1
+  fi
+  if grep -Eiq '^[[:space:]]*concurrency:[[:space:]]*true([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 0
+  fi
   grep -RIEiq \
     'concurren|idempoten|race condition|duplicate (request|callback|consumption|delivery)|atomic claim|batch (issue|activate|renew)' \
     "$CHANGE_DIR/proposal.md" \
@@ -325,6 +468,12 @@ change_has_concurrency_idempotency_risk() {
 }
 
 change_has_money_precision_risk() {
+  if grep -Eiq '^[[:space:]]*money:[[:space:]]*false([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 1
+  fi
+  if grep -Eiq '^[[:space:]]*money:[[:space:]]*true([[:space:]]*#.*)?$' "$CHANGE_DIR/.openspec.yaml" 2>/dev/null; then
+    return 0
+  fi
   grep -RIEiq \
     '(^|[^[:alnum:]_])(amount|fee|fees|price|discount|deduction|refund|payment|invoice|balance|proration|allocation|reconciliation|residual|precision|rounding)([^[:alnum:]_]|$)|revenue sharing|profit sharing|split payment|electricity fee|service fee|package settlement|serviceFee|chargeFee|totalAmount|actualAmount|payAmount|refundAmount|discountAmount|invoiceAmount|balanceAmount' \
     "$CHANGE_DIR/proposal.md" \
@@ -335,6 +484,53 @@ change_has_money_precision_risk() {
     "$CHANGE_DIR"/specs/*/spec.md 2>/dev/null
 }
 
+change_has_source_fact_risk() {
+  grep -RIEiq \
+    'existing|current behavior|legacy|database|table relationship|Mapper|XML|cross[- ](repo|service)|crosses services|real entry|mini[- ]program|H5' \
+    "$CHANGE_DIR/proposal.md" \
+    "$CHANGE_DIR/api.md" \
+    "$CHANGE_DIR/design.md" \
+    "$CHANGE_DIR/tests.md" \
+    "$CHANGE_DIR/spec.md" \
+    "$CHANGE_DIR"/specs/*/spec.md 2>/dev/null
+}
+
+change_has_cardinality_conflict_signal() {
+  grep -RIEiq \
+    'List[<(]|orderIds|batchInsert|one[- ]to[- ]many|relation table' \
+    "$CHANGE_DIR"/*.md "$CHANGE_DIR"/**/*.md 2>/dev/null
+}
+
+require_source_fact_audit() {
+  require_file source-code-audit.md
+  require_grep 'Source Fact Freeze Card' source-code-audit.md "source fact freeze card"
+  require_grep 'Business conclusion' source-code-audit.md "source fact business conclusion"
+  require_grep 'understand.*locator' source-code-audit.md "understand-anything locator evidence"
+  require_grep 'Data model' source-code-audit.md "source fact data model"
+  require_grep 'All writers' source-code-audit.md "all writers inventory"
+  require_grep 'Real user entr' source-code-audit.md "real user entry"
+  require_grep 'Current callers' source-code-audit.md "current callers"
+  require_grep 'Legacy conflict' source-code-audit.md "legacy conflict"
+  require_grep 'DB (check|required|skip|reason)' source-code-audit.md "DB check or skip reason"
+  require_grep 'Conclusion level' source-code-audit.md "conclusion level"
+  require_grep 'owner.*decision' source-code-audit.md "owner decision boundary"
+  require_grep 'current' source-code-audit.md "current evidence classification"
+  require_grep 'legacy' source-code-audit.md "legacy evidence classification"
+  require_grep 'unmounted' source-code-audit.md "unmounted evidence classification"
+  require_grep 'data-model-only' source-code-audit.md "data-model-only evidence classification"
+  require_grep 'owner-confirmed' source-code-audit.md "owner-confirmed evidence classification"
+  require_grep 'blocked' source-code-audit.md "blocked evidence classification"
+  require_grep 'Evidence classifications.*current.*legacy.*unmounted.*data-model-only.*owner-confirmed.*blocked' source-code-audit.md "complete evidence classification set"
+  require_grep 'Question Eligibility Gate' source-code-audit.md "question eligibility gate"
+  require_grep 'Source search' source-code-audit.md "source search evidence"
+  require_grep 'Mapper.*SQL|SQL.*Mapper' source-code-audit.md "Mapper and SQL search evidence"
+  require_grep 'Frontend.*mini[- ]program.*H5' source-code-audit.md "frontend mini-program H5 caller search"
+  require_grep 'sibling.*repo' source-code-audit.md "sibling repository search"
+  if change_has_cardinality_conflict_signal; then
+    require_grep 'Conflict Audit' source-code-audit.md "cardinality conflict audit"
+  fi
+}
+
 change_has_fx_precision_risk() {
   grep -RIEiq \
     '(^|[^[:alnum:]_])(exchange rate|fx rate|currency conversion|cross.currency|base currency|quote currency)([^[:alnum:]_]|$)' \
@@ -347,13 +543,17 @@ change_has_fx_precision_risk() {
 }
 
 change_has_architecture_boundary_risk() {
-  grep -RIEiq \
+  local content
+  content="$(change_all_docs_without_complexity_budget)"
+  grep -Eiq \
     'cross-repo|cross-service|sibling|SDK|MQ|topic|consumer|scheduler|scheduled|device|callback|third[- ]party|mini[- ]program|gateway|adapter|protocol|interconnect|call chain|entry|exit' \
-    "$CHANGE_DIR"/*.md "$CHANGE_DIR"/**/*.md 2>/dev/null
+    <<< "$content"
 }
 
-first_prompt_rel() {
-  find "$CHANGE_DIR" -path '*/prompt/*.md' -type f | head -n 1 | sed "s#^$CHANGE_DIR/##"
+prompt_rels() {
+  find "$CHANGE_DIR" -path '*/prompt/*.md' -type f -print \
+    | LC_ALL=C sort \
+    | sed "s#^$CHANGE_DIR/##"
 }
 
 require_any_prompt() {
@@ -363,7 +563,7 @@ require_any_prompt() {
 }
 
 require_prompt_set() {
-  local task_count prompt_count non_index_prompt_count
+  local task_count prompt_count non_index_prompt_count prompt_rel document
   require_file prompt/implementation.md
   task_count="$(grep -E '^[[:space:]]*-[[:space:]]+\[[ xX]\]' "$CHANGE_DIR/tasks.md" 2>/dev/null | wc -l | tr -d ' ')"
   prompt_count="$(find "$CHANGE_DIR/prompt" -maxdepth 1 -type f -name '*.md' 2>/dev/null | wc -l | tr -d ' ')"
@@ -374,9 +574,15 @@ require_prompt_set() {
   if [[ "$prompt_count" -eq 0 ]]; then
     issues+=("missing prompt/*.md files")
   fi
-  if [[ -f "$CHANGE_DIR/tasks.md" ]] && ! grep -Riq 'prompt/.*\.md' "$CHANGE_DIR/tasks.md" "$CHANGE_DIR/traceability-matrix.md" "$CHANGE_DIR/sdd-quality-gate.md" "$CHANGE_DIR/test-report.md" 2>/dev/null; then
-    issues+=("prompt files are not cross-linked from tasks/traceability/quality gate/test-report")
-  fi
+  for document in tasks.md traceability-matrix.md sdd-quality-gate.md test-report.md; do
+    [[ -f "$CHANGE_DIR/$document" ]] || continue
+    while IFS= read -r prompt_rel; do
+      if ! grep -Fq "]($prompt_rel)" "$CHANGE_DIR/$document" \
+        && ! grep -Fq "](./$prompt_rel)" "$CHANGE_DIR/$document"; then
+        issues+=("$document does not link $prompt_rel")
+      fi
+    done < <(prompt_rels)
+  done
 }
 
 require_money_precision_contract() {
@@ -460,6 +666,29 @@ require_money_precision_evidence() {
   fi
 }
 
+require_minimal_design_review() {
+  local path="$1"
+  local label="$2"
+  require_grep 'Minimal Design Review|Complexity Reduction Review' "$path" "$label"
+  require_grep 'reuse|existing capability|existing module' "$path" "$label reuse evidence"
+  require_grep 'simplest|minimum design|minimal implementation' "$path" "$label simplest implementation"
+  require_grep 'removed|rejected|do not add|out of scope' "$path" "$label removed or rejected complexity"
+  require_grep 'New-item counts|Complexity budget' "$path" "$label complexity budget"
+  require_grep 'table' "$path" "$label table count"
+  require_grep 'field' "$path" "$label field count"
+  require_grep 'API' "$path" "$label API count"
+  require_grep 'service|component' "$path" "$label service/component count"
+  require_grep 'cache' "$path" "$label cache count"
+  require_grep 'MQ|event|async' "$path" "$label async/event count"
+  require_grep 'scheduled job|scheduler' "$path" "$label scheduled-job count"
+  require_grep 'compatibility layer' "$path" "$label compatibility-layer count"
+}
+
+require_minimal_design_pass() {
+  local path="$1"
+  require_grep '(Minimal Design Review|Complexity Reduction Review).*PASS|PASS.*(Minimal Design Review|Complexity Reduction Review)' "$path" "complexity reduction review PASS verdict"
+}
+
 transition_event=""
 
 if [[ -x "$VALIDATE" && -f "$CHANGE_DIR/.sdd/state.yaml" ]]; then
@@ -489,6 +718,28 @@ case "$PHASE" in
     require_grep 'RED|red-green|GREEN' tests.md "RED/GREEN test contract"
     require_grep 'curl|Postman|Newman|pytest|RestAssured|automation command' tests.md "interface automation command"
     require_grep 'handoff_hash|sdd-context|context package|anti-drift' sdd-quality-gate.md "handoff/context-drift gate"
+    if change_has_database_change; then
+      require_frozen_release_sql
+    fi
+    workflow="$(state_get workflow)"
+    if [[ "$workflow" == "full" ]]; then
+      require_file requirement-review.md
+      require_grep '^review_verdict:[[:space:]]*PASS[[:space:]]*$' requirement-review.md "requirement reverse review PASS verdict"
+      require_grep '^implementation_readiness:[[:space:]]*READY[[:space:]]*$' requirement-review.md "requirement review implementation readiness"
+      require_grep '^open_blockers:[[:space:]]*0[[:space:]]*$' requirement-review.md "requirement reverse review has no open blockers"
+      require_grep '^open_external_contracts:[[:space:]]*0[[:space:]]*$' requirement-review.md "requirement review has no open external contracts"
+      require_grep '^open_source_investigations:[[:space:]]*0[[:space:]]*$' requirement-review.md "requirement review has no open source investigations"
+      require_grep '^open_owner_decisions:[[:space:]]*0[[:space:]]*$' requirement-review.md "requirement review has no open owner decisions"
+      require_grep 'Closure Matrix' requirement-review.md "requirement review closure matrix"
+      require_grep 'Review Findings' requirement-review.md "requirement review findings"
+      require_grep 'Open Blockers' requirement-review.md "requirement review open blocker ledger"
+      require_minimal_design_review design.md "complexity reduction review"
+      require_grep 'Minimal Design Review|Complexity Reduction Review' sdd-quality-gate.md "complexity reduction quality gate"
+      require_minimal_design_pass sdd-quality-gate.md
+      if change_has_source_fact_risk; then
+        require_source_fact_audit
+      fi
+    fi
     if change_has_money_precision_risk; then
       require_grep 'Money Precision Boundary' sdd-quality-gate.md "money precision quality gate"
     fi
@@ -518,8 +769,14 @@ case "$PHASE" in
     require_handoff_current
     require_beta_handoff_structure
     require_hash_recorded
+    if change_has_database_change; then
+      require_frozen_release_sql
+    fi
     workflow="$(state_get workflow)"
     if [[ "$workflow" == "full" ]]; then
+      require_minimal_design_review design.md "complexity reduction review"
+      require_grep 'Minimal Design Review|Complexity Reduction Review' sdd-quality-gate.md "complexity reduction quality gate"
+      require_minimal_design_pass sdd-quality-gate.md
       require_optional_state_path technical_design "technical_design"
       technical_design_rel="$(state_get technical_design)"
       if [[ -n "${technical_design_rel:-}" && "$technical_design_rel" != "null" ]]; then
@@ -540,6 +797,7 @@ case "$PHASE" in
         if change_has_money_precision_risk; then
           require_money_precision_contract "$technical_design_rel" "money precision boundary"
         fi
+        require_minimal_design_review "$technical_design_rel" "technical design minimal design review"
       fi
     fi
     require_grep 'Superpowers Technical Design Handoff|Superpowers Technical Design|technical_design|source-level HOW' design.md "Superpowers technical design handoff"
@@ -553,11 +811,14 @@ case "$PHASE" in
     require_handoff_current
     require_beta_handoff_structure
     require_hash_recorded
+    if change_has_database_change; then
+      require_frozen_release_sql
+    fi
     require_any_prompt
     require_prompt_set
     require_grep 'OpenSpec/SDD|canonical design source|canonical|source of truth' design.md "canonical source boundary"
-    prompt_rel="$(first_prompt_rel)"
-    if [[ -n "${prompt_rel:-}" ]]; then
+    while IFS= read -r prompt_rel; do
+      [[ -n "${prompt_rel:-}" ]] || continue
       require_grep 'Superpowers Technical Design inheritance|Superpowers execution strategy inheritance|technical_design|source-level HOW' "$prompt_rel" "prompt Superpower strategy inheritance"
       technical_design_rel="$(state_get technical_design)"
       if [[ -n "${technical_design_rel:-}" && "$technical_design_rel" != "null" ]]; then
@@ -576,7 +837,11 @@ case "$PHASE" in
         fi
       fi
       require_grep 'context anti-drift|handoff_hash|sdd-context' "$prompt_rel" "prompt context drift inheritance"
-    fi
+      if change_has_database_change; then
+        require_grep 'release-sql\.md' "$prompt_rel" "prompt frozen release SQL reference"
+        require_grep 'verbatim|sql_sha256' "$prompt_rel" "prompt verbatim SQL copy contract"
+      fi
+    done < <(prompt_rels)
     require_state_value build_mode "build_mode"
     require_state_value isolation "isolation"
     require_state_value tdd_mode "tdd_mode"

package/assets/skills-en/superflow-pipeline/scripts/superflow-handoff.sh

@@ -244,10 +244,13 @@ sync_state() {
   "$state_sh" set "$CHANGE_DIR" context_compression "$context_compression"
   "$state_sh" set "$CHANGE_DIR" handoff_context .sdd/handoff/sdd-context.json
   "$state_sh" set "$CHANGE_DIR" handoff_hash "$context_hash"
-  technical_design_rel="$(
-    find "$CHANGE_DIR/docs/superpowers/specs" -maxdepth 1 -type f -name '*.md' 2>/dev/null \
-      | sort | head -n 1 | sed "s#^$CHANGE_DIR/##"
-  )"
+  technical_design_rel=""
+  if [[ -d "$CHANGE_DIR/docs/superpowers/specs" ]]; then
+    technical_design_rel="$(
+      find "$CHANGE_DIR/docs/superpowers/specs" -maxdepth 1 -type f -name '*.md' \
+        | sort | head -n 1 | sed "s#^$CHANGE_DIR/##"
+    )"
+  fi
   if [[ -n "$technical_design_rel" ]]; then
     "$state_sh" set "$CHANGE_DIR" technical_design "$technical_design_rel"
   fi

package/assets/skills-en/superflow-requirement-review/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: superflow-requirement-review
+description: Perform source-backed reverse review of clarified requirements and OpenSpec/SDD drafts to find closure gaps, factual conflicts, missing scenarios, over-design, under-design, API/UI/DB/test drift, and unverifiable contracts, then drive remediation and re-review. Use for requirement review, reverse review, challenge the design, find omissions, testability review, or pre-design/pre-implementation review.
+---
+
+# Superflow Requirement Review
+
+Independently challenge the current OpenSpec change with source-backed evidence. This is not
+an advisory side path: blocking findings must repair canonical documents and pass re-review
+before the docs phase can close.
+
+## Boundaries
+
+- Use after complex requirements are clarified and reviewable drafts exist.
+- Do not replace owner clarification or source/Mapper/DB/real-caller verification.
+- Keep all output inside the current `openspec/changes/<change>/`.
+- Do not stop at a findings list; repair canonical documents and re-review.
+- Do not add speculative tables, APIs, services, caches, states, or compatibility layers.
+
+## Required Inputs
+
+Read the applicable source index, feature gates, proposal, API, specs, design, source audit,
+database contract, frozen release SQL, tasks, tests, traceability, quality gate, test report,
+current source, Mapper/XML, real frontend/mini-program/H5 callers, sibling repositories, and
+read-only database evidence when needed. Missing evidence is a finding, not permission to guess.
+
+## Workflow
+
+1. Record the change, phase, bounded feature, sources, handoff hash, and confirmed/pending
+   decisions. Review one frozen feature at a time.
+2. Establish evidence through platform impact discovery, source, Mapper/SQL, real callers, and
+   read-only DB checks. Treat graph output only as a locator. Classify evidence as `current`,
+   `legacy`, `unmounted`, `data-model-only`, `owner-confirmed`, or `blocked`.
+   Classify every unresolved item by resolution ownership:
+   - `SOURCE_INVESTIGATION`: source, dependency, configuration, logs, or read-only DB can resolve
+     it. Continue investigating; do not ask the user or exit review.
+   - `OWNER_DECISION`: multiple valid product choices remain. Return to clarification and ask one
+     decision at a time.
+   - `EXTERNAL_CONTRACT`: third-party/cross-service request, response, signing, idempotency,
+     enum, callback, or responsibility contract. If it changes API, SQL, state, security, or test
+     assertions, it blocks PASS until evidence freezes it; merely documenting `Blocked` is not
+     closure.
+   - `EXECUTION_EVIDENCE`: implementation contract is frozen and only deployment, migration,
+     real-call, or runtime evidence remains. It may block delivery, not requirement review.
+3. Reverse-check six dimensions:
+   - business closure: input, trigger, precondition, processing, output, failure, recovery, repeat;
+   - source facts: real entry, all writers/readers/filters, legacy behavior, cross-repo consumers;
+   - contract consistency: PRD/UI/API/DTO/DB/status/SQL/tests/tasks;
+   - failure boundaries: authorization, concurrency, idempotency, timeout, uncertainty, ordering;
+   - minimal design: reuse, duplicate fields, parallel APIs, speculative abstractions;
+   - deliverability: task, RED/GREEN, real entry, DB/log evidence, acceptance result.
+4. For database-backed changes, invoke `superflow-table-impact-analysis`, or record an equivalent
+   downgrade when unavailable.
+5. Create or update `requirement-review.md` with baseline, closure matrix, findings, minimal-design
+   review, remediation evidence, and final verdict. Its front matter must record the exact
+   machine-readable result. PASS requires `review_verdict: PASS`,
+   `implementation_readiness: READY`, `open_blockers: 0`, `open_external_contracts: 0`,
+   `open_source_investigations: 0`, and `open_owner_decisions: 0`; otherwise use BLOCKED and real
+   counts. Include an `Open Blockers` table with category, affected implementation contract,
+   resolution owner, next evidence/question, and status.
+
+Use finding levels:
+
+- `BLOCKER`: incorrect requirement fact, API/DB/status/security/entry/acceptance contract.
+- `IMPORTANT`: likely omission, rework, or untestable behavior that docs must correct.
+- `SUGGESTION`: non-blocking improvement for owner judgment.
+
+Each finding records ID, level, dimension, location, issue, evidence, impact, minimal correction,
+and status.
+
+## Remediation And Re-review
+
+For every confirmed `BLOCKER/IMPORTANT` finding:
+
+1. Repair the canonical source document, not only the review report.
+2. Synchronize affected API, design, spec, SQL, tasks, tests, traceability, and quality gates.
+3. Record `finding -> repaired file -> test/evidence` closure.
+4. Return to `superflow-clarify` if remediation changes an owner-confirmed contract.
+
+Re-review from the original sources and code evidence. Pass only when all blocking/important
+findings are closed, contract drift is explained, minimal-design review passes, source
+investigations are exhausted, owner decisions are recorded, and implementation-affecting
+external contracts are evidenced and frozen. Only execution evidence that cannot change the
+implementation contract may remain blocked in tests or release readiness.
+
+After remediation, refresh handoff, run the docs guard and strict OpenSpec validation, and record
+the report path and verdict in `sdd-quality-gate.md` and `test-report.md`.
+
+## Prohibitions
+
+- Do not review product text without source and real-entry evidence.
+- Do not infer current behavior from a permissive data model.
+- Do not accept non-null values, HTTP 200, or compilation as semantic correctness.
+- Do not invent fallbacks, defaults, states, or compatibility layers to close findings.
+- Do not store findings in another workflow namespace.
+- Do not pass docs/design with unresolved blocking findings.
+- Do not close an implementation-affecting external contract because it is documented, assigned
+  to an owner, or deferred to integration.
+- Do not combine `review_verdict: PASS` with `implementation_readiness: BLOCKED`.

package/assets/skills-en/superflow-requirement-review/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Superflow Requirement Review"
+  short_description: "Reverse-review requirements and close source-backed findings"
+  default_prompt: "Use $superflow-requirement-review to reverse-review the current OpenSpec requirement and close all findings."