@gordon.gan/specflow 1.3.3-beta → 1.4.1

package/README.md

@@ -72,6 +72,8 @@ explore（可选）→ propose → refine → apply → review → test → veri
 │       ↓                                                                 │
 │  refine           ≥2 轮精化：挑战假设 / 新方案 / 探边界 / 质疑 scope     │
 │       ↓                                                                 │
+│  approval [可选]  AI 7 维闭环检查 + 设计质量 + 可实施性 → approval.md 供审批 │
+│       ↓                                                                 │
 │  apply            Phase A 重写 tasks.md → Phase B 逐任务 TDD 执行         │
 │                   （可选 /specflow:apply --yes：少打断，成功后串行验收）   │
 │       ↓                                                                 │
@@ -124,7 +126,7 @@ npm install -g @gordon.gan/specflow
 npm install -g github:Gordon-Gan-Jiang/specflow
 
 # 验证
-specflow --version   # 以 npm / package.json 为准（当前 1.3.3-beta）
+specflow --version   # 以 npm / package.json 为准（当前 1.4.1）
 specflow --help
 ```
 
@@ -257,13 +259,14 @@ specflow init
 
 ## IDE 工作流命令
 
-共 **10 个**技能，命名因 IDE 而异：
+共 **11 个**技能，命名因 IDE 而异：
 
 | 阶段 | Claude Code | Cursor | Codex |
 |------|-------------|--------|-------|
 | 探索（可选） | `/specflow:explore` | `specflow:explore` | `$specflow-explore` |
 | 规划 | `/specflow:propose` | `specflow:propose` | `$specflow-propose` |
 | 精化 | `/specflow:refine` | `specflow:refine` | `$specflow-refine` |
+| 审批（可选） | `/specflow:approval` | `specflow:approval` | `$specflow-approval` |
 | 构建 | `/specflow:apply` | `specflow:apply` | `$specflow-apply` |
 | 审查 | `/specflow:review` | `specflow:review` | `$specflow-review` |
 | 测试 | `/specflow:test` | `specflow:test` | `$specflow-test` |
@@ -279,6 +282,7 @@ specflow init
 | **explore** | 读代码、比方案、定边界；产出 `explore.md`，confirmed 后 handoff 到 propose |
 | **propose** | 一次产出 proposal、delta specs、design、tasks（第一轮深度思考，非占位骨架）；叙述语言跟 `artifacts.language` |
 | **refine** | 内部多轮循环（≥2 轮，AI 判断收敛）；可更新任意 artifact |
+| **approval** | refine 后可选：AI 对四件套做 7 维闭环性检查（含代码落地性、基线对照）+ 设计质量评估 + 可实施性评估，生成 `approval.md` 供人工审批；不改 phase，不阻塞 apply |
 | **apply** | Phase A 重写 tasks.md；Phase B 按语言路由 ECC 审查 + TDD 逐任务执行；可选 `--yes` |
 | **review** | 代码审查，对照 specs 检查回归 |
 | **test** | 单元 + 集成 + E2E + 回归测试 |

package/dist/integrations/shared/capability-evidence.js

@@ -7,6 +7,11 @@ const MARKER_RULES = [
     { id: 'sub.propose.first_iteration', skill: 'propose', includes: ['first-iteration deep-analysis pass'] },
     { id: 'sub.refine.multi_round', skill: 'refine', includes: ['auto-multi-round loop', '## LOOP (Stages 2-4)'] },
     { id: 'sub.refine.challenge_scope', skill: 'refine', includes: ['Challenge Behaviors #3 and #4', 'question scope'] },
+    { id: 'sub.approval.closed_loop', skill: 'approval', includes: ['Closed-Loop Verification', 'Pass 1'] },
+    { id: 'sub.approval.implementability', skill: 'approval', includes: ['Implementability Assessment', 'Completeness'] },
+    { id: 'sub.approval.no_phase_change', skill: 'approval', includes: ['does NOT advance phase', 'phase stays `refined`'] },
+    { id: 'sub.approval.code_grounding', skill: 'approval', includes: ['Code Grounding', 'Pass 6'] },
+    { id: 'sub.approval.design_quality', skill: 'approval', includes: ['Design Quality Assessment', 'Over-Engineering'] },
     { id: 'sub.apply.phase_a', skill: 'apply', includes: ['## Phase A: Task Rewrite'] },
     { id: 'sub.apply.phase_b', skill: 'apply', includes: ['## Phase B: Subagent TDD Execution'] },
     { id: 'sub.apply.gap_detection', skill: 'apply', includes: ['Gap Detection'] },
@@ -19,8 +24,39 @@ const MARKER_RULES = [
     { id: 'failure.explore.proposal_exists_redirect', skill: 'explore', includes: ['explore is too late', 'refine'] },
     { id: 'failure.propose.explore_draft_gate', skill: 'propose', includes: ['Status: draft', 'REFUSE to proceed'] },
     { id: 'failure.apply.phase_gate', skill: 'apply', includes: ['HARD GATE (prerequisite)', 'phase is not `refined`, REFUSE'] },
+    { id: 'failure.approval.phase_gate', skill: 'approval', includes: ['phase must be `refined`', 'REFUSE to proceed'] },
     { id: 'failure.verify.explicit_skip_marker', skill: 'verify', includes: ['Pass 2: skipped (no baseline'] },
 ];
+/**
+ * Checks whether a marker phrase appears in `content` as an independent token.
+ *
+ * Uses explicit character-class boundaries (not regex `\b`) so phrases that
+ * contain punctuation (e.g. "## LOOP (Stages 2-4)", "Pass 2: skipped (no
+ * baseline") are matched reliably, while a longer word that merely *contains*
+ * the phrase (e.g. "Code GroundingXX" vs "Code Grounding") is NOT treated as
+ * a match. This prevents capability evidence from false-positive on accidental
+ * substrings.
+ */
+function containsIndependentPhrase(content, phrase) {
+    if (phrase.length === 0) {
+        return false;
+    }
+    const boundary = /[A-Za-z0-9_]/;
+    const escaped = phrase.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const re = new RegExp(escaped, 'g');
+    let match;
+    while ((match = re.exec(content)) !== null) {
+        const before = match.index > 0 ? content[match.index - 1] : '';
+        const afterIndex = match.index + phrase.length;
+        const after = afterIndex < content.length ? content[afterIndex] : '';
+        const beforeBoundary = before !== '' && boundary.test(before);
+        const afterBoundary = after !== '' && boundary.test(after);
+        if (!beforeBoundary && !afterBoundary) {
+            return true;
+        }
+    }
+    return false;
+}
 export function deriveCapabilityIds(supportedCommandIds, skillContentsByCommand) {
     const capabilityIds = new Set();
     for (const commandId of supportedCommandIds) {
@@ -28,7 +64,7 @@ export function deriveCapabilityIds(supportedCommandIds, skillContentsByCommand)
     }
     for (const rule of MARKER_RULES) {
         const content = skillContentsByCommand[rule.skill] ?? '';
-        const ok = rule.includes.every((needle) => content.includes(needle));
+        const ok = rule.includes.every((needle) => containsIndependentPhrase(content, needle));
         if (ok) {
             capabilityIds.add(rule.id);
         }

package/dist/integrations/shared/command-catalog.js

@@ -2,6 +2,7 @@ export const COMMAND_CATALOG = [
     { id: 'explore', description: 'Think-before-propose exploration when requirements are fuzzy' },
     { id: 'propose', description: 'Create proposal and spec artifacts for a change' },
     { id: 'refine', description: 'Refine and iterate on spec artifacts' },
+    { id: 'approval', description: 'Post-refine technical approval document with AI closed-loop check' },
     { id: 'apply', description: 'Implement tasks from a change spec' },
     { id: 'review', description: 'Review code changes against spec' },
     { id: 'test', description: 'Run tests and verify coverage' },

package/dist/integrations/shared/parity-manifest.js

@@ -13,6 +13,11 @@ export const CAPABILITY_MANIFEST = [
     { id: 'sub.propose.first_iteration', commandId: 'propose', level: 'sub-capability', required: true },
     { id: 'sub.refine.multi_round', commandId: 'refine', level: 'sub-capability', required: true },
     { id: 'sub.refine.challenge_scope', commandId: 'refine', level: 'sub-capability', required: true },
+    { id: 'sub.approval.closed_loop', commandId: 'approval', level: 'sub-capability', required: true },
+    { id: 'sub.approval.implementability', commandId: 'approval', level: 'sub-capability', required: true },
+    { id: 'sub.approval.no_phase_change', commandId: 'approval', level: 'sub-capability', required: true },
+    { id: 'sub.approval.code_grounding', commandId: 'approval', level: 'sub-capability', required: true },
+    { id: 'sub.approval.design_quality', commandId: 'approval', level: 'sub-capability', required: true },
     { id: 'sub.apply.phase_a', commandId: 'apply', level: 'sub-capability', required: true },
     { id: 'sub.apply.phase_b', commandId: 'apply', level: 'sub-capability', required: true },
     { id: 'sub.apply.gap_detection', commandId: 'apply', level: 'sub-capability', required: true },
@@ -25,6 +30,7 @@ export const CAPABILITY_MANIFEST = [
     { id: 'failure.explore.proposal_exists_redirect', commandId: 'explore', level: 'failure-path', required: true },
     { id: 'failure.propose.explore_draft_gate', commandId: 'propose', level: 'failure-path', required: true },
     { id: 'failure.apply.phase_gate', commandId: 'apply', level: 'failure-path', required: true },
+    { id: 'failure.approval.phase_gate', commandId: 'approval', level: 'failure-path', required: true },
     { id: 'failure.verify.explicit_skip_marker', commandId: 'verify', level: 'failure-path', required: true },
 ];
 export const IDE_ASSET_MANIFEST = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gordon.gan/specflow",
-  "version": "1.3.3-beta",
+  "version": "1.4.1",
   "type": "module",
   "description": "SpecFlow — unified spec-driven development: OpenSpec planning + Superpowers execution in one CLI and cross-IDE workflow",
   "keywords": [

package/prompts/approval/database-guidance.md

@@ -0,0 +1,79 @@
+# Approval · Database Guidance Router
+
+> Used by `/specflow:approval` when generating §4.4 (数据结构 / 数据模型).  
+> **本地技能**: `skills/database/`（本仓库长期维护）。  
+> **禁止**依赖远程 skill 仓库（禁止 `npx skills add` / clone / 运行时 fetch）。  
+> **Not** an MCP tool — on hit, `Read` local matched skill files; on miss, LLM-only §4.4.
+
+---
+
+## 1. Detect project database stack
+
+Scan the **project under review** (change's repo root), not SpecFlow itself. Collect signals
+(non-recursive first; optional one-level into `docker-compose*.yml` / `migrations/`).
+
+| Signal | Suggested stack |
+|--------|-----------------|
+| `go.mod` / deps: `go-sql-driver/mysql`, `gorm.io` + mysql DSN, `ENGINE=InnoDB` in `*.sql` | `mysql` |
+| `package.json`: `mysql2`, `mysql`, `@prisma/client` + datasource mysql, drizzle mysql | `mysql` |
+| `pyproject` / requirements: `PyMySQL`, `mysqlclient`, `aiomysql` | `mysql` |
+| `go.mod`: `jackc/pgx`, `lib/pq`; `package.json`: `pg`, `postgres`; Prisma/drizzle postgres | `postgresql` |
+| `docker-compose`: image `postgres` / `mysql` / `mariadb` / `redis` / `elasticsearch` | matching image |
+| SQL files with `ENGINE=InnoDB` / `CHARSET=utf8mb4` | `mysql` |
+| SQL with `JSONB`, `SERIAL`, `gen_random_uuid()` | `postgresql` |
+| Oracle JDBC / `oracledb` / `go-ora` | `oracle` |
+| `ioredis` / `redis` client / `go-redis` | `redis` (cache/KV — usually **not** §4.4 relational DDL) |
+| `@elastic/elasticsearch` / OpenSearch client | `elasticsearch` (search — usually not relational DDL) |
+
+**Multi-hit**: pick primary OLTP store for §4.4 (prefer `mysql` / `postgresql` / `oracle` over
+`redis` / `elasticsearch`). Mention secondary stores in §4.7/架构 if relevant.
+
+**Announce** after detection:
+
+```text
+DB stack for approval: <mysql|postgresql|oracle|redis|elasticsearch|none>
+Guidance: skills/database/<stack>/SKILL.md | LLM-fallback
+```
+
+---
+
+## 2. On hit — load **local** guidance (Read, do not invent, do not fetch)
+
+Base: `skills/database/<stack>/`（相对 SpecFlow 仓库根；离线可读）
+
+| Stack | Must Read | Also Read when §4.4 needs it |
+|-------|-----------|------------------------------|
+| `mysql` | `SKILL.md` | `references/05-sql-ddl-types.md`, `references/06-index-optimization.md`; JSON → `references/04-functions-json.md` |
+| `postgresql` | `SKILL.md` | `references/06-index-types.md`; JSONB → `references/04-functions-jsonb.md` |
+| `oracle` | `SKILL.md` | `references/09-sql-syntax.md`, `references/10-features.md` |
+| `redis` | `SKILL.md` | Only if change is cache/key design — **not** a substitute for relational DDL |
+| `elasticsearch` | `SKILL.md` | Only if change is index/mapping — **not** a substitute for relational DDL |
+
+Apply guidance to §4.4 output:
+
+1. Prefer engine/charset/collation idioms from the local skill (MySQL: InnoDB + utf8mb4…).
+2. Prefer type/index gotchas from the skill (e.g. DECIMAL for money, no FLOAT amounts).
+3. Keep SpecFlow hard rules (ER, full CREATE TABLE, 本迭代用法, G3/G4) — skill **supplements**, does not replace.
+
+Cite in §4.4 总则, e.g. `DB 技能: skills/database/mysql (本地)`.
+
+---
+
+## 3. On miss — LLM fallback
+
+If `DB stack = none` (no durable store signals, or only unknown/custom DB):
+
+1. **Do not** force-load mysql/postgresql skills.
+2. Generate §4.4 with SpecFlow rules only (`generate.md` §4.4 + Quality Gates G3/G4).
+3. If design/tasks claim a DB but signals are absent → `WARNING` in §8:
+   `design 声称落库但未检测到 DB 栈信号 — 已用 LLM 通用 DDL;建议 refine 标明引擎`.
+4. Pure CLI/config changes → keep `不涉及数据库变更(...)`.
+
+---
+
+## 4. Why not remote skills / MCP tools?
+
+- **Remote**: approval must work offline and must not drift with upstream installs; maintain
+  `skills/database/` in this repo.
+- **MCP tools**: these packs are markdown guidance, not APIs; routing chooses which local
+  files to `Read`.