@chenmk/superflow 0.5.20 → 0.5.22

package/assets/skills/superflow-verify/SKILL.md

@@ -1,10 +1,16 @@
 ---
 name: superflow-verify
-description: Use when an SDD/OpenSpec change is ready for verification, test-report closure, code review, branch/worktree handling, or retry decisions after implementation.
+description: Use when reviewing code changes or verifying an SDD/OpenSpec implementation, test evidence, branch/worktree handling, or retry decisions.
 ---
 
 # SDD Verify
 
+## 验证信号复核
+
+读取[测试指南](../superflow-pipeline/references/test-guide.md)，核对当前差异、冻结用例及
+实际执行数；区分逻辑、数据库和真实入口结论。先判断历史证据是否失效，再要求实施方
+重跑受影响验证；仅报告格式变更不自动重跑全链路。评审方只读核验原始输出与源码。
+
 Before semantic code review, run `superflow review-coverage --json` (or pass
 `--base <ref>` for a branch review). Use its included/excluded inventory and
 path-specific rules to account for every changed file. Review related Java
@@ -12,16 +18,23 @@ and Mapper XML files together when they share a bundle. Do not treat this
 mechanical inventory as a correctness verdict: findings still need source
 anchors, a fresh reading of the affected call path, and independent judgment.
 
-Use the reported risk tier to choose review depth: low may be reviewed inline;
-medium requires an independent view; high requires focused coverage of the
-named high-impact paths in addition to the ordinary Host review. Every
-reviewer report starts with `DONE`, `DONE_WITH_CONCERNS`, `BLOCKED`, or
-`NEEDS_CONTEXT`. Run `superflow review-coverage --report <file> --json` to
-validate that marker and every `file:line` finding anchor. `BLOCKED` and
-`NEEDS_CONTEXT` require more evidence before triage; `DONE_WITH_CONCERNS`
-requires Host investigation of each concern before deciding. Re-read each
-anchor and attempt to disprove the finding before assigning severity. Keep
-unverifiable claims separate rather than giving them a guessed severity.
+复用检查存在 executionContext 声明时，独立核对当前命令、cwd、已选环境、源码、
+构建和入口；调用环境与冻结要求不同时不能沿用 PASS。未声明旧证据保留原边界，
+不以 JSON 存在或哈希一致代替执行真实性/业务充分性。
+
+
+## 五维与独立评审入口
+
+代码质量评审必须读取[统一 Reviewer 清单](../superflow-pipeline/references/reviewer-checklist.md)，
+按其中的实际影响分档、隔离包、五维覆盖、finding 证伪与合并步骤执行。
+`review-coverage` 的 risk.tier 是路径提示，不能直接决定实际深度；打印提示与实际档位及依据。
+普通代码评审可以直接进入此入口，不要求先创建 SDD 状态；有冻结合同则同时核验符合度。
+主 Agent 持有最终判断，Reviewer 只提供只读独立视角，Runner 不裁决语义风险。
+
+沿现有四状态报告执行 `superflow review-coverage --report <file> --json`，检查标记与锚点。
+它不证明五维充分性；主 Agent 仍须逐项核验原始证据。BLOCKED/NEEDS_CONTEXT 先补证据，
+DONE_WITH_CONCERNS 先调查全部 concern，再决定。原生子代理支持时，中档以上以隔离上下文
+派发；高档按独立风险簇追加专项视角，不固定代理数或模型。无法独立评审时如实记录缺口。
 
 ## 评审回应纪律
 
@@ -55,7 +68,10 @@ revert that simplification. Keep simplification in a separate commit from the
 feature, and stop if it reaches files outside the original change. This is a
 readability pass, not a second code review or a license for unrelated cleanup.
 
-## Entry Check
+## Entry Check (SDD only)
+
+普通代码评审完成上述五维/独立核验后直接返回评审结论；以下阶段状态、
+测试交付、分支和归档步骤仅适用于关联的 SDD/OpenSpec 交付，不为裸 diff 新建状态。
 
 Run:
 

package/assets/skills-en/openspec-apply-change/SKILL.md

@@ -11,6 +11,14 @@ metadata:
 
 Implement tasks from an OpenSpec change.
 
+## Superflow implementation verification entry
+
+Within the Superflow workflow, before the first task read the
+[test guide](../superflow-pipeline/references/test-guide.md) and frozen tests.md/project
+tests. Execute inherited RED/GREEN and required real verification per task; mark
+complete only with evidence. Missing contracts return to superflow-docs; missing
+environments remain blocked. Plain OpenSpec work follows project verification rules.
+
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**

package/assets/skills-en/openspec-archive-change/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: openspec-archive-change
-description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+description: Use when the user wants to archive a completed pure OpenSpec change without .sdd/state.yaml.
 license: MIT
 compatibility: Requires openspec CLI.
 metadata:
@@ -13,6 +13,22 @@ Archive a completed change in the experimental workflow.
 
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
+## SDD Archive Routing (Run First)
+
+Resolve the target change directory; if ambiguous, use the selection step below
+to confirm it, then check that directory for `.sdd/state.yaml`. When it exists,
+immediately load `$superflow-archive` and stop the remaining steps in this skill.
+If verification has not passed or tasks remain incomplete, follow that skill back
+to verification/implementation; do not fall back to this skill to archive.
+SDD changes cannot use the incomplete-task confirmation, `Archive without syncing`,
+or `mv` shortcuts below. `superflow-archive` owns readiness, confirmation, OpenSpec
+merging, and state closeout. Moved SDD directories use that owner's recovery flow
+with the explicit archive path.
+
+Run the pure OpenSpec workflow below only when the target has no `.sdd/state.yaml`.
+This is Agent semantic routing; the command Hook is not an operating-system-level
+interceptor and must not be assumed to block arbitrary `mv` commands.
+
 **Steps**
 
 1. **If no change name provided, prompt for selection**

package/assets/skills-en/superflow-archive/SKILL.md

@@ -40,6 +40,26 @@ do not mark archived until the user confirms final closeout.
    ~/.codex/skills/superflow-pipeline/scripts/superflow-archive.sh <change-dir> --apply
    ```
 
+## Recovery after archive relocation
+
+If OpenSpec moved the directory but annotation/state closeout failed, preserve
+artifacts and raw errors. Identify the exact `openspec/changes/archive/<archive-name>`
+from this archive's output or actual operation record. Never guess a historical
+same-name directory or repeat archive from the missing old path. Use the helper:
+
+```bash
+~/.codex/skills/superflow-pipeline/scripts/superflow-archive.sh <explicit-archived-dir> --dry-run
+# Check summary, original authorization, and remaining work; do not expand permission
+~/.codex/skills/superflow-pipeline/scripts/superflow-archive.sh <explicit-archived-dir> --apply
+```
+
+Moved directories resume only remaining annotations and the original state
+transition, retaining validate/guard. Correct done + archived state returns
+read-only idempotently. Nonstandard tasks keep the existing state-only fallback.
+Check actual state.yaml, technical/design/plan annotations, and output; missing
+or conflicting facts remain blocked. No automatic commit/push/merge, repeated
+OpenSpec merge, or second closeout state machine.
+
 ## Rules
 
 - Do not archive if verification failed or is only partially verified unless

package/assets/skills-en/superflow-design/SKILL.md

@@ -44,6 +44,13 @@ Superpowers own source-level HOW without weakening OpenSpec/SDD contracts.
 
 1. Read `.sdd/handoff/sdd-context.md` plus original `api.md`, `design.md`,
    `tasks.md`, and `tests.md`.
+   Read applicable project rules and use the Host's normal skill discovery for
+   relevant skills referenced by those rules or applicable to the task. Read
+   each complete skill file and its relevant references before designing.
+   Do not scan personal skill directories, record personal absolute paths, or
+   copy user-level rule/skill text into project artifacts. Apply the discovered
+   content when designing; freeze only task-relevant constraints through the
+   existing `mandatoryEngineeringRules` handoff for implementation and review.
 2. For a database change, verify `release-sql.md` before source-level HOW
    design: one complete executable SQL block, exact destination, normalized
    SHA-256, pre/post checks, and explicit verbatim-copy references in
@@ -72,7 +79,13 @@ Superpowers own source-level HOW without weakening OpenSpec/SDD contracts.
    extension points, duplicate DTO/API layers, derivable persistence,
    premature caches, and async compensation without measured need. Record
    retained and removed counts; unresolved simpler alternatives keep the
-   design blocked.
+   design blocked. For data-intensive paths (large or growing collections,
+   batch processing, imports/exports, aggregation, repeated scans, or fan-out),
+   also record current/expected scale and growth boundary, work and primary cost
+   per request/job, alternatives considered, and evidence validating the choice.
+   Match evidence to risk: source/query analysis or representative functional
+   cases may suffice; do not require benchmarks for small tasks. Mark this not
+   applicable with a brief reason when data volume is not material.
 7. For cross-repository, service-to-service, SDK, MQ, scheduler, device,
    callback, third-party, mini-program, gateway, or adapter changes, include
    `Architecture Boundary And Call Direction`. Prove owner module, call

package/assets/skills-en/superflow-docs/SKILL.md

@@ -5,6 +5,13 @@ description: Use when confirmed requirements or OpenSpec artifacts need SDD cont
 
 # SDD Docs
 
+## Test plan entry
+
+Before writing tests.md, read the [test guide](../superflow-pipeline/references/test-guide.md).
+Reuse project tests and environments, map affected behavior to signals, and freeze
+cases, actual backends, mockBoundary, commands, and assertions here. Implementation
+inherits the plan; required database verification is not an implementation-time choice.
+
 For full document delivery, read and apply
 [requirement × real-entry review](../superflow-pipeline/references/document-review-coverage.md).
 Extend the existing three-round receipt with original-source, real-caller,
@@ -16,6 +23,12 @@ created the base OpenSpec artifacts. This skill is an SDD contract-doc wrapper;
 it must not replace the installed OpenSpec skills for core artifact generation
 and must not generate implementation prompts.
 
+For cross-round checks sensitive to commands/directories/invocation environment,
+freeze argv, relative cwd, and selected non-secret keys under the
+[executionContext contract](../superflow-pipeline/references/document-review-coverage.md#declared-execution-context-and-evidence-reuse).
+Historical unbound proof does not automatically satisfy new-context completeness.
+
+
 ## OpenSpec First
 
 For new OpenSpec document generation, invoke `$openspec-propose` first. The

package/assets/skills-en/superflow-implement/SKILL.md

@@ -5,6 +5,19 @@ description: Use when SDD/OpenSpec contract docs and Superpowers technical desig
 
 # SuperFlow Implement
 
+## Verification contract inheritance
+
+Before generating prompts, read the [test guide](../superflow-pipeline/references/test-guide.md).
+Inherit frozen tests.md cases, commands, actual backends, and assertions; require
+implementers to check them before editing, execute them, and record results. Missing
+signals or real-environment obligations return to superflow-docs, not a second plan.
+
+Prompts inherit frozen executionContext only. Execution entries generate actual
+cwd/selected environment hashes for raw-event/receipt checks; Agents do not fill
+expected observations. Missing bindings or changed contexts return to the document
+owner or affected reruns without rewriting historical successful records.
+
+
 ## Role
 
 This phase turns frozen contracts and source-level technical design into safe
@@ -49,6 +62,15 @@ Every implementation prompt must include these sections:
   review checklist, traceability, and technical design.
 - Context drift and state inheritance: clickable handoff link, handoff_hash,
   current phase, and refresh rules.
+- Applicable project rules selected in the frozen handoff and task-relevant
+  skills found through the Host's normal skill discovery. The Host reads the
+  relevant skill content and passes applicable rule statements through the
+  existing `mandatoryEngineeringRules` input. Names alone are insufficient;
+  do not scan personal configuration directories or copy personal rules into
+  project artifacts. Executor and Reviewer receive the same frozen statements.
+- Data-intensive work carries technical-design scale, growth, processing-cost
+  trade-offs, and validation evidence. Keep proportional to risk; simple work
+  does not require a performance benchmark.
 - Superpowers technical design inheritance: source-level HOW, TDD entry points,
   team roles, reviewer/tester checkpoints, risky assumptions, and forbidden
   improvisation.

package/assets/skills-en/superflow-pipeline/SKILL.md

@@ -3,6 +3,12 @@ name: superflow-pipeline
 description: Use when a user asks for the SuperBridge Flow, SDD, OpenSpec, requirements clarification, contract docs, design docs, implementation prompts, verification, archive, or which SuperBridge Flow phase to run.
 ---
 
+## Canonical test guidance entry
+
+Read [test-guide.md](references/test-guide.md) for test documentation, implementation
+preparation, or delivery review. Documents freeze required signals; implementation
+inherits and review verifies. Mock examples cannot override canonical DB contracts.
+
 # SuperBridge Flow Pipeline
 
 When maintaining Superflow CLI itself, first read repository-root

package/assets/skills-en/superflow-pipeline/references/architecture-design-template.md

@@ -18,3 +18,6 @@ Use this when designing a new module or a cross-service change.
 
 Do not justify a design only because code can call another module. Prove that the
 call direction matches ownership and the existing architecture contract.
+
+Freeze signals using [test-guide.md](test-guide.md) and declare isolation using
+[mock-strategy-guide.md](mock-strategy-guide.md); substitute engines cannot close required real DB proof.

package/assets/skills-en/superflow-pipeline/references/batch-prompt-template.md

@@ -1,5 +1,12 @@
 # Batch Prompt Template
 
+Inherit verification only from tests.md and read [test-guide.md](test-guide.md).
+Apply startup, API, DB, and team checklists to frozen applicable cases; give source
+reasons for inapplicability, keeping missing required environments blocked. Reuse
+healthy instances matching the tested build; load new code/configuration before
+verification. Independently inspect raw evidence; implementers rerun invalidated
+or contract-required paths, not every environment merely because roles changed.
+
 ## Header
 
 - Batch: P{n} - {name}

package/assets/skills-en/superflow-pipeline/references/document-review-coverage.md

@@ -176,3 +176,35 @@ boolean differs from number (true cannot prove one affected row), including nest
 arrays/objects. Documents and independent review choose business keys and fields.
 
 Git delivery compares normalized index objects for tracked report dependencies (receipts, raw events, builds, source, schema/contracts). A working-tree-only repair does not prove the commit snapshot. Private untracked evidence is not forced into Git; independent review still determines source/build applicability.
+
+## Declared execution context and evidence reuse
+
+Reuse coverage/receipt v1. When reusing checks sensitive to commands, working
+directories, or invocation environments, the document owner freezes tests.md and
+its case `executionContext={argv:[arguments],cwd:directory relative to change,environmentKeys:[names]}`.
+argv is nonempty and explicit; cwd is relative without drive prefixes or absolute
+paths. Task permissions and source/contracts still define read scope: cwd grants
+no additional access. Implementers cannot redesign this contract.
+
+Supported keys are PATH, PATHEXT, NODE_ENV, NODE_OPTIONS, LANG, LC_ALL, TZ, JAVA_HOME.
+Select only keys affecting this verification command. Passwords, tokens, account
+credentials, and full environments never enter contracts/receipts. Use project
+verification entries with runtime authentication; never put secrets in argv/docs.
+Absent and empty differ: each digest is UTF-8 SHA-256(JSON.stringify(string or null)).
+Receipts and raw events record
+`executionContext={cwd:actual canonical absolute directory,environmentSha256:{selectedName:digest}}`.
+Actual execution entries generate observations, not Agents filling expected values.
+
+Existing lint compares actual command.argv with frozen argv, receipt/event context,
+cwd with the frozen directory relative to the current change, and selected hashes
+with its current invocation environment. Run lint in the tests.md invocation
+context. Unselected environment changes do not invalidate proof; selected keys,
+commands, directories, source, builds, or targets changing prevent old proof from
+closing current complete PASS. This does not prove remote-service startup
+environments: engines, production chains, and sufficiency need independent review.
+
+Historical contracts without the field retain existing source/build/entry checks
+and their conclusions, without claiming this new context verification. Declared
+contracts with missing/malformed/mismatched observations need evidence, not editing
+old observations to expectations. Contract changes return to the document owner
+for renewed review rather than weakening execution checks.

package/assets/skills-en/superflow-pipeline/references/document-templates.md

@@ -63,3 +63,11 @@
 - DB/log evidence
 - Hook output
 - Blocked or skipped cases with reasons
+
+## tests.md: frozen verification signals
+
+Select applicable signals using [test-guide.md](test-guide.md), keeping project level numbers.
+Table: `Change/risk | Case ID | Signal | Actual environment/backend | Command | Assertion | Evidence path | Inapplicability reason/blocker`.
+Database layers inherit only `testLayer` / `mockBoundary` from
+[document-review-coverage.md](document-review-coverage.md). Reuse project scenario
+regression assets for critical business flows and bug reproductions.

package/assets/skills-en/superflow-pipeline/references/implementation-prompt-template.md

@@ -1,5 +1,16 @@
 # Implementation Prompt Template
 
+For code-quality review read [reviewer-checklist.md](reviewer-checklist.md):
+select depth from actual impact, use isolated independent views, and have the
+main Agent verify and merge findings. Templates do not redefine risk or agent counts.
+
+Inherit verification only from tests.md and read [test-guide.md](test-guide.md).
+Apply startup, API, DB, and team checklists to frozen applicable cases; give source
+reasons for inapplicability, keeping missing required environments blocked. Reuse
+healthy instances matching the tested build; load new code/configuration before
+verification. Independently inspect raw evidence; implementers rerun invalidated
+or contract-required paths, not every environment merely because roles changed.
+
 Use this as the prefix for every implementation prompt.
 
 ## Context Drift And State Inheritance
@@ -13,6 +24,28 @@ If requirements, design, API, SQL, test contracts or task content change, rerun
 superflow-handoff.sh --refresh. Task checkbox progress and test-report updates
 do not invalidate the frozen contract hash.
 
+### Project Rules, Host Rules, And Applicable Skills
+
+- Read selected project rule files from the existing handoff/context manifest.
+  The Host uses its normal skill discovery to identify and read task-relevant
+  skills, then freezes the actually applicable rule statements in the existing
+  `mandatoryEngineeringRules` input. Do not pass skill names alone or manually
+  scan personal configuration directories.
+- The Executor and independent Reviewer receive the same frozen rules; both
+  must read applicable project rule files completely. If a source is inaccessible
+  or a required rule was not frozen, report the concrete blocker instead of
+  guessing or weakening it.
+- Pass only constraints relevant to the task. Do not copy personal rules or
+  entire skills into project artifacts.
+
+### Data Scale And Processing Cost
+
+For data-intensive paths only, carry forward the technical design's current and
+expected scale, growth boundary, work and primary cost per request/job, design
+trade-offs, and validation evidence. Scale validation to risk; query/source
+analysis or a representative functional case can suffice for small tasks, with
+no blanket performance benchmark. This adds no burden to non-data-intensive work.
+
 ## Contract Boundary
 
 OpenSpec/SDD is canonical for requirements, API, DB, SQL, tests, and acceptance.

package/assets/skills-en/superflow-pipeline/references/managed-work.md

@@ -32,6 +32,16 @@ direction-changing API, data, concurrency, cross-repository, or owner choice,
 return to clarification/documents instead of letting Runner regexes or Executor
 improvisation replace Host judgment.
 
+Before start, the Host also uses its existing host-native rule/skill discovery
+to read applicable user-level engineering rules and skill bodies plus relevant
+references. Do not scan personal configuration directories. Freeze the rule
+statements relevant to this task through the existing `mandatoryEngineeringRules`
+input so Executor and independent Reviewer receive the same content. Continue to
+pass selected project rule paths and hashes through the context manifest; do not
+pass skill names alone. If required content cannot be read or a required source
+is inaccessible to execution/review, report the missing item and block affected
+work instead of guessing.
+
 When MCP is installed, the current host must prefer the `superflow_managed_*`
 tools for submission, waiting, user guidance, and review submission. MCP is a
 channel to the local state machine rather than a third model. Direct host review

package/assets/skills-en/superflow-pipeline/references/mock-strategy-guide.md

@@ -1,16 +1,46 @@
-# Mock Strategy Guide
+# Mock Strategy and Boundary Guide
 
-Mocks are allowed for isolation, not for claiming real integration.
+## Scope and source of truth
 
-## Labels
+Read for isolation design or substituted-evidence reporting. Select signals with
+[test-guide.md](test-guide.md). Database layers, mockBoundary, and execution
+receipts inherit only
+[document-review-coverage.md](document-review-coverage.md#database-layer-contract).
+This guide describes isolation, not permission to reduce frozen real acceptance.
 
-- Mock verification: dependency replaced or simulated.
-- Test endpoint verification: local helper endpoint or bypass path.
-- Real-entry verification: production-like user, device, callback, job, MQ,
-  client, or third-party entry.
+| Scenario | Isolatable boundary | Proven scope / remaining obligation |
+|---|---|---|
+| Pure logic unit test | Data-access/HTTP/MQ dependencies outside tested logic | Branches, parameters, failure handling; not real SQL or persistence |
+| Required persistence/transaction/CAS | External clients in mockBoundary.allowed | Never mock production Service/Mapper; execute production statements on the actual same-engine DB |
+| External payment/SMS/device | Contract-approved clients, sandboxes, simulated messages | Local handling; real capabilities need separate sandbox/real-entry proof or blockers |
+| MQ/Redis/OSS | Interface boundaries for pure logic | Memory queues, local cache/files cannot close real protocol, locking, persistence, or external-chain requirements |
 
-## Report Rule
+Actual same-engine Docker/Testcontainers databases are not mocks. Reuse when the
+frozen environment permits; never substitute for a required shared environment.
+H2/SQLite cannot replace MySQL dialect, locking, transaction, or persistence
+semantics. Without a DB preserve logic proof and mark required DB cases
+BLOCKED/PARTIAL.
 
-Keep these labels separate in test-report.md. Mock-only evidence cannot close a
-requirement that tests.md marks as L3/L4, real-entry, third-party, DB, or log
-verified.
+## Declaration and reporting
+
+Record actual capability, replacement object, mockBoundary, assumptions, proven
+scope, unverified scope, real verification commands/blockers, and evidence paths
+in existing tests.md / test-report.md. Separate `Mock verification`, `Test endpoint
+verification`, and `Real-entry verification`. Auxiliary logic cases may pass;
+mock-only cannot close required database or real-chain cases of the same entry.
+
+## Example: isolated payment client, actual persistence
+
+When the contract permits isolating PaymentClient, return a fixed success response
+to the **real** business Service and Mapper. On frozen MySQL, assert order-ID
+before/after, amounts, state, and required side effects. This proves handling and
+persistence, not actual gateway charging; verify charging separately or report a
+blocker. A pure Service unit test may mock Mapper but reports logic only, never
+successful database integration.
+
+## Prohibited
+
+- Mocking the tested subject or production Service/Mapper in required DB cases.
+- Replacing business/DB-value assertions with fixed success, counts, HTTP 200, or nonzero affected rows.
+- Mixing substituted and real evidence or counting skipped/unexecuted cases as complete passes.
+- Silently changing frozen backends, weakening assertions under delivery pressure, or leaving mocks in production.

package/assets/skills-en/superflow-pipeline/references/orchestration.md

@@ -1,5 +1,16 @@
 # Workflow Orchestration
 
+For code-quality review read [reviewer-checklist.md](reviewer-checklist.md):
+select depth from actual impact, use isolated independent views, and have the
+main Agent verify and merge findings. Templates do not redefine risk or agent counts.
+
+Inherit verification only from tests.md and read [test-guide.md](test-guide.md).
+Apply startup, API, DB, and team checklists to frozen applicable cases; give source
+reasons for inapplicability, keeping missing required environments blocked. Reuse
+healthy instances matching the tested build; load new code/configuration before
+verification. Independently inspect raw evidence; implementers rerun invalidated
+or contract-required paths, not every environment merely because roles changed.
+
 SuperBridge Flow is a stateful orchestrator, not just a set of installed skills.
 
 ## Ownership

package/assets/skills-en/superflow-pipeline/references/quality-gate.md

@@ -1,5 +1,14 @@
 # Quality Gate Checklist
 
+For code-quality review read [reviewer-checklist.md](reviewer-checklist.md):
+select depth from actual impact, use isolated independent views, and have the
+main Agent verify and merge findings. Templates do not redefine risk or agent counts.
+
+Check frozen signals and applicability using [test-guide.md](test-guide.md).
+Missing required environments remain blocked; inapplicability cannot remove frozen
+gates. Reuse healthy instances matching the tested build; independently inspect
+raw evidence and have implementers rerun invalidated or contract-required paths.
+
 ## Documentation Gate
 
 - Requirements processed feature by feature and frozen.

package/assets/skills-en/superflow-pipeline/references/reviewer-checklist.md

@@ -1,8 +1,137 @@
 # Reviewer Checklist
 
+## Five-axis review and isolated context (canonical entry)
+
+Use for ordinary code review, Quick verification, full SDD, and managed Host
+review. Inputs are current changes, confirmed contracts, applicable path rules,
+and raw evidence. Outputs reuse reviewer reports or existing Host review JSON.
+This checklist owns axes, depth, isolation, and finding verification;
+superflow-verify routes execution. Check requirement/design conformity against
+existing contracts without creating another requirements-review entry. Scripts
+check paths, state markers, and anchors, not review sufficiency. The main Agent /
+Host owns actual risk and the final verdict.
+
+### Axis coverage
+
+| Axis | Focus | Minimum evidence |
+|---|---|---|
+| security | Authentication/authorization, injection, sensitive information, external input | Actual entry, parameter binding, permission call path |
+| performance | Query scope/N+1, scale, CPU/memory/I/O, resource limits | Execution path and scale; benchmarks only when risk warrants |
+| correctness | Boundaries, recovery, state, transactions, concurrency, idempotence | Real call/write path, assertions, failure paths |
+| maintainability | Duplication, naming, complexity, exception handling, test seams | Existing reuse points, source, test boundaries |
+| architecture | Module ownership, call direction, contract compatibility, abstraction | Callers/consumers and ownership evidence |
+
+Record CHECKED / NOT_APPLICABLE / BLOCKED and source/evidence per axis. CHECKED
+means examined, not defect-free. One reviewer may cover all axes; do not require
+five agents. Specialists cover assigned axes; the main Agent merges coverage and
+fills gaps. Unassigned/unread is not inapplicable. Full SDD real acceptance remains.
+
+### Select depth from actual impact
+
+`superflow review-coverage` emits `risk.basis=path-hint` and
+`risk.requiresSemanticAssessment=true`. The main Agent reads changes, actual
+callers, and write/consumer paths, recording hint tier, actual tier, source
+anchors, and adjustment reasons. Names, line counts, and implementer claims do
+not determine risk. Unknown risk gets at least medium investigation; inability
+to judge means NEEDS_CONTEXT.
+
+| Actual impact | Depth |
+|---|---|
+| Small scope with verified absence of contract/write/concurrency/security/cross-module effects | Low, inline allowed; still cover applicable axes |
+| Other changes with known scope | Medium, one isolated independent reviewer |
+| Evidenced public-contract break, migration/data consistency, locks/shared state, security boundary, or cross-module impact | High, independent review plus focused views for named risks; fan out only for independent risk clusters when the Host supports it |
+
+Example: a parameterized SELECT filter with unchanged contract/schema/write path
+and checked consumers can move from Mapper path hint high to actual medium. An
+ordinary file adding atomic claims/shared-state writes moves from path hint low to
+actual high. Confirm against current source rather than applying example labels.
+High does not prescribe agent counts, model names, or providers; use native Host
+configuration. Record user depth overrides without removing required scope,
+contract obligations, or known risks.
+
+### Isolated bundle and dispatch
+
+The main Agent prepares this bundle in a temporary directory and uses native
+subagents without implementation chat history (`fork_turns=none` when supported).
+If unavailable, prepare the same bundle for an independent reviewer and report
+that independent review has not run. Self-review cannot be relabeled independent
+or counted as complete independent coverage.
+
+1. Confirmed goal, scope, exclusions, actual contract paths, review questions;
+   label implementer claims unverified.
+2. Baseline/head or worktree state, exact diff, file inventory, related bundles;
+   diff statistics alone are insufficient.
+3. Applicable path rules, relevant source/caller/consumer paths, necessary
+   environment and raw test evidence paths.
+4. Actual risk assessment, assigned axes/files, this checklist, four-state and
+   anchored report requirements.
+
+Include only necessary text/paths, not entire repositories, personal rule
+folders, credentials, or chat history. Respect task read permissions. Start from
+diff and expand to related callers only for named risks, recording why. Bundle /
+source / contract drift yields NEEDS_CONTEXT rather than reviewing old context
+against current code. Reviewers are read-only: no source edits, application
+management, business DB operations, or nested supervision. New runtime evidence
+returns to the implementer.
+
+### Main Agent verification and merge
+
+Read all reports, coverage, findings, and concerns. Re-read each file:line, callers,
+frozen contracts, and corresponding raw test evidence; attempt to disprove claims
+with actual source. Green tests alone neither accept nor reject a finding.
+Deduplicate by root cause + affected path + business consequence, keeping reviewer
+provenance and full impact. Do not merge solely by line number, wording, or
+severity. Resolve conflicting judgments from evidence, not majority vote.
+
+Record accepted / rejected / needs-evidence with reasons. Unsupported claims remain
+unconfirmed rather than receiving invented severity. Severity follows actual
+impact; separate advice from blocking defects. Do not force generic abstractions
+without another caller or contract requirement. Once every axis and included file
+has coverage, submit all material findings together. Managed work retains existing
+finding IDs / acceptanceContractRefs, protocols, budgets, and state owners.
+Subagent reports do not directly promote pass; format checks do not prove code
+correctness. Rerun only invalidated or contract-required evidence.
+
+### Reviewer report shape
+
+Reuse the four-state report, not another machine protocol. Managed reviews keep
+these records in temporary reports and project the result into existing Host
+review JSON summary/findings/coverage. `--report` checks existing markers and
+anchors only; the main Agent verifies axes, actual impact, and conclusions. Keep
+historical reports without axis records, but do not call them complete under this
+guide.
+
+```markdown
+DONE
+## Impact
+Path hint / actual depth / source evidence / adjustment / diff and contract version
+## Axes
+Axis | CHECKED / NOT_APPLICABLE / BLOCKED | File scope and evidence
+# Fill security / performance / correctness / maintainability / architecture
+## Findings
+- src/example.ts:12: [axis][severity] cause, consequence, proof, repair and acceptance
+# Use None without findings; never a placeholder bullet
+## Concerns
+Unresolved questions and missing proof; required for DONE_WITH_CONCERNS
+```
+
+Existing specialist checks remain path-scoped; inapplicable checks do not invent
+runtime obligations or remove frozen requirements. They detail axes without
+owning risk, dispatch, or final conclusions.
+
+## Data Scale And Processing Cost
+
+- For data-intensive paths, are current/expected data scale and growth
+  boundaries explicit?
+- Is per-request/job work and primary CPU, memory, I/O, or round-trip cost
+  assessed, with alternatives and risk-proportionate validation evidence?
+- If not applicable, is the lack of meaningful data-volume sensitivity
+  explained? Do not block simple work solely because a performance benchmark is
+  absent.
+
 - Does the implementation match api.md, design.md, and tests.md?
 - Are all required files present and cross-linked?
-- Is handoff_hash current and repeated in prompts/report?
+- Is the frozen handoff hash current in its canonical state file? Do not duplicate raw hashes in report bodies.
 - Did Superpowers technical design cover source-level HOW?
 - Were field/status and architecture-boundary risks checked?
 - For monetary changes, were calculation and settlement states separated, were
@@ -32,3 +161,5 @@
 - Are mock-only results clearly labeled?
 - Did workers stay inside allowed file boundaries?
 - Did hooks and guard scripts pass?
+
+Use spaces and explicit closure for report container fences. Tab-delimited list/quote fences currently fail structural verification: normalize report formatting without using an earlier DONE/PASS to bypass it. Preserve tabs in original execution logs; do not rewrite evidence for formatting.