@guanlin4924/devflow-pi 0.1.101 → 0.1.103

package/README.md

@@ -11,7 +11,7 @@ Devflow Pi 是一个面向项目研发交付的独立 OMP 产品入口，内置
 安装与启动：
 
 ```bash
-npm install -g @guanlin4924/devflow-pi@0.1.101
+npm install -g @guanlin4924/devflow-pi@0.1.103
 cd /path/to/your-project
 devflow-pi init
 devflow-pi doctor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guanlin4924/devflow-pi",
-  "version": "0.1.101",
+  "version": "0.1.103",
   "type": "module",
   "description": "Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。",
   "license": "UNLICENSED",

package/plugins/devflow-core/skills/wireframe-proposal/SKILL.md

@@ -5,6 +5,8 @@ description: Generate or revise a low-fidelity wireframe proposal from controlle
 
 # Wireframe Proposal
 
+Run only when Core reports `wireframe-proposal` as the current step. A no-UI decision is evaluated and recorded by Core after CP-1; do not infer it from requirement prose, edit workflow state, or self-skip this step.
+
 Read the controlled requirement baseline and the wireframe schema/registry. Produce exactly two candidate files:
 
 - .devflow/planning/features/{feature}/proposal.yaml

package/plugins/devflow-core/skills/wireframe-render/SKILL.md

@@ -5,4 +5,6 @@ description: Render validated canonical wireframe JSON into deterministic Markdo
 
 # Wireframe Render
 
+Run only when Core reports `wireframe-render` as the current step. A no-UI decision is evaluated and recorded by Core after CP-1; do not infer it from requirement prose, edit workflow state, or self-skip this step.
+
 Call the workflow-orchestrator wireframe_render.py script only with the current Core-built canonical JSON and the validation metadata. Generate preview Markdown, flow SVG, one SVG per declared state under `wireframes/screens/<screen-id>/<platform>/<state>.svg` (`default.svg` is always present), and the optional static gallery under the wireframe output directory. The `wireframes/screens` directory is a required render output and is covered by the execution contract. The `canonical.meta.json` file is created later by the Core approval path and is not an input to this step. Never read proposal YAML as a substitute, mutate canonical JSON, write approval, or modify workflow state.

package/plugins/devflow-core/skills/wireframe-review/SKILL.md

@@ -5,4 +5,6 @@ description: Present validated wireframe previews and unresolved questions for e
 
 # Wireframe Review
 
+Run only when Core reports `wireframe-review` as the current step. A no-UI decision is evaluated and recorded by Core after CP-1; do not infer it from requirement prose, edit workflow state, or self-skip this step.
+
 Show the current canonical-derived previews, renderer metadata, validation verdict, and unresolved question IDs. If the verdict is await_user, ask the user to answer the listed blocking questions. If the user approves, return control to the Core checkpoint path. Never write approval, pass runtime confirmation, confirm a checkpoint, or alter canonical/state yourself.

package/plugins/devflow-core/skills/wireframe-validate/SKILL.md

@@ -5,6 +5,8 @@ description: Run deterministic validation for a wireframe proposal and build can
 
 # Wireframe Validate
 
+Run only when Core reports `wireframe-validate` as the current step. A no-UI decision is evaluated and recorded by Core after CP-1; do not infer it from requirement prose, edit workflow state, or self-skip this step.
+
 Run the bundled validator through Core's `devflow_skill_script` tool:
 
 ```text

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/advance_state.rb

@@ -206,15 +206,18 @@ def build_artifact_registry(root, workflow, state)
                      end
 
   completed = Array(state["completed_steps"])
+  skipped = state["skipped_steps"].is_a?(Hash) ? state["skipped_steps"] : {}
   current_step = state["current_step"]
   content_checks = workflow.dig("artifact_registry", "content_checks") || {}
-  preservable_statuses = %w[approved completed passed pending_rerun stale failed]
+  preservable_statuses = %w[approved completed passed skipped pending_rerun stale failed]
 
   artifacts = collect_outputs(workflow).map do |step, output|
     path = interpolate_path(output.fetch("path"), state)
     existing = existing_by_path[path] || {}
     generated_status =
-      if completed.include?(step.fetch("id"))
+      if skipped.key?(step.fetch("id"))
+        "skipped"
+      elsif completed.include?(step.fetch("id"))
         step["checkpoint"] ? "approved" : "completed"
       elsif step.fetch("id") == current_step && state["status"] == "waiting_checkpoint"
         "generated"
@@ -222,7 +225,8 @@ def build_artifact_registry(root, workflow, state)
         "planned"
       end
 
-    validity = content_validity(root, path, content_checks)
+    skip_record = skipped[step.fetch("id")]
+    validity = skip_record ? { "valid" => true, "issues" => [] } : content_validity(root, path, content_checks)
     artifact_path, = DevflowControlIO.resolve_control_path(root, path, :artifact)
     file_exists = File.exist?(artifact_path)
     status = if preservable_statuses.include?(existing["status"])
@@ -242,7 +246,8 @@ def build_artifact_registry(root, workflow, state)
       "downstream_steps" => Array(existing["downstream_steps"]),
       "exists" => file_exists,
       "content_valid" => validity["valid"],
-      "content_issues" => validity["issues"].empty? ? nil : validity["issues"]
+      "content_issues" => validity["issues"].empty? ? nil : validity["issues"],
+      "skip_reason" => skip_record && skip_record["reason"]
     }.reject { |_, value| value.nil? || value == [] }
   end
 
@@ -429,6 +434,60 @@ def next_pending_step_id(state, pending_ids, step_by_id, completed_ids)
   end
 end
 
+def conditional_skip_policies(workflow, checkpoint_id)
+  policies = workflow.dig("governance", "conditional_step_skips")
+  return [] unless policies.is_a?(Hash)
+
+  policies.each_with_object([]) do |(policy_id, policy), matches|
+    next unless policy.is_a?(Hash) && policy["trigger_checkpoint"].to_s == checkpoint_id.to_s
+
+    matches << [policy_id.to_s, policy]
+  end
+end
+
+# Conditional skips are Core-owned transitions. The baseline skill can only
+# submit the typed metadata fact; it cannot edit STATE or omit workflow steps.
+def apply_conditional_step_skips!(root, state, workflow, checkpoint_id, next_revision)
+  applied = []
+  conditional_skip_policies(workflow, checkpoint_id).each do |policy_id, policy|
+    source_path = interpolate_path(policy.fetch("source_path"), state)
+    source_abs, = DevflowControlIO.resolve_control_path(root, source_path, :artifact)
+    next unless File.file?(source_abs)
+
+    source = JSON.parse(File.read(source_abs))
+    source_field = policy.fetch("source_field").to_s
+    next unless source.key?(source_field) && source[source_field] == policy["equals"]
+
+    step_ids = Array(policy.fetch("steps")).map(&:to_s)
+    completed = Array(state["completed_steps"]).map(&:to_s)
+    pending = Array(state["pending_steps"]).map(&:to_s)
+    conflicts = step_ids.reject { |step_id| pending.include?(step_id) && !completed.include?(step_id) }
+    unless conflicts.empty?
+      raise ArgumentError, "conditional skip #{policy_id} requires every target step to be pending: #{conflicts.join(', ')}"
+    end
+
+    evidence = {
+      "status" => "skipped",
+      "policy" => policy_id,
+      "reason" => policy.fetch("reason").to_s,
+      "source" => source_path,
+      "source_field" => source_field,
+      "source_value" => source[source_field],
+      "source_sha256" => Digest::SHA256.file(source_abs).hexdigest,
+      "recorded_at_revision" => next_revision
+    }
+    state["skipped_steps"] = {} unless state["skipped_steps"].is_a?(Hash)
+    step_ids.each { |step_id| state["skipped_steps"][step_id] = evidence.dup }
+    checkpoint = policy.fetch("checkpoint").to_s
+    state["skipped_checkpoints"] = {} unless state["skipped_checkpoints"].is_a?(Hash)
+    state["skipped_checkpoints"][checkpoint] = evidence.merge("steps" => step_ids)
+    state["completed_steps"] = (completed + step_ids).uniq
+    state["pending_steps"] = pending - step_ids
+    applied << { "policy" => policy_id, "steps" => step_ids, "checkpoint" => checkpoint, "reason" => evidence["reason"] }
+  end
+  applied
+end
+
 def track_boundary?(state, pending_ids)
   track = active_track(state)
   return false unless track
@@ -555,6 +614,7 @@ HARD_FAILURE_REASONS = %w[
   parallel_machine_evidence_failed
   parallel_join_failed
   parallel_branch_transition_failed
+  conditional_step_skip_failed
   cross_track_consistency_failed
   business_cross_model_check_failed
   gate_boundary_rejected
@@ -1238,30 +1298,41 @@ result =
             end
           end
           if result.nil?
-          pending = Array(state["pending_steps"])
-          completed = Array(state["completed_steps"])
-          next_id = next_pending_step_id(state, pending, step_by_id, completed)
-          if next_id.nil? && track_boundary?(state, pending)
-            state["checkpoint_decision"] = "approved"
-            state["status"] = "blocked"
-            state["block_reason"] = "track_scope_complete"
-            state.delete("checkpoint")
-            state.delete("checkpoint_label")
-            changed = true
-            actions << "checkpoint_confirmed_track_complete"
-            action_description = "Checkpoint confirmed. Active track output scope is complete."
-            next_intent_requested = true
-          else
-            state["checkpoint_decision"] = "approved"
-            state["current_step"] = next_id || pending.first
-            state["status"] = "in_progress"
-            state.delete("checkpoint")
-            state.delete("checkpoint_label")
-            changed = true
-            actions << "checkpoint_confirmed"
-            action_description = "Checkpoint confirmed. Advanced to next step."
-            next_intent_requested = true
+            begin
+              applied_skips = apply_conditional_step_skips!(root, state, workflow, state["checkpoint"], current_revision + 1)
+              unless applied_skips.empty?
+                actions << "conditional_steps_skipped"
+                actions.concat(applied_skips.flat_map { |entry| entry["steps"].map { |step_id| "step_skipped:#{step_id}" } })
+              end
+            rescue JSON::ParserError, KeyError, ArgumentError, DevflowControlIO::InvalidControlPath => error
+              result = fail_result("conditional_step_skip_failed", "message" => error.message, "checkpoint" => state["checkpoint"])
+            end
           end
+          if result.nil?
+            pending = Array(state["pending_steps"])
+            completed = Array(state["completed_steps"])
+            next_id = next_pending_step_id(state, pending, step_by_id, completed)
+            if next_id.nil? && track_boundary?(state, pending)
+              state["checkpoint_decision"] = "approved"
+              state["status"] = "blocked"
+              state["block_reason"] = "track_scope_complete"
+              state.delete("checkpoint")
+              state.delete("checkpoint_label")
+              changed = true
+              actions << "checkpoint_confirmed_track_complete"
+              action_description = "Checkpoint confirmed. Active track output scope is complete."
+              next_intent_requested = true
+            else
+              state["checkpoint_decision"] = "approved"
+              state["current_step"] = next_id || pending.first
+              state["status"] = "in_progress"
+              state.delete("checkpoint")
+              state.delete("checkpoint_label")
+              changed = true
+              actions << "checkpoint_confirmed"
+              action_description = "Checkpoint confirmed. Advanced to next step."
+              next_intent_requested = true
+            end
           end
         end
       end

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/checkpoint_meta.rb

@@ -4,8 +4,20 @@
 require "json"
 
 module CheckpointMeta
+  LEGACY_APPROVAL_OUTPUTS = {
+    "CP-WIREFRAME" => [".devflow/planning/features/{feature}/canonical.meta.json"]
+  }.freeze
+
   module_function
 
+  def approval_output?(checkpoint, path)
+    return false unless checkpoint.is_a?(Hash)
+
+    declared = Array(checkpoint["approval_outputs"]).map(&:to_s)
+    legacy = LEGACY_APPROVAL_OUTPUTS.fetch(checkpoint["id"].to_s, [])
+    (declared + legacy).include?(path.to_s)
+  end
+
   def validate(root:, state:, checkpoint:)
     return [] unless checkpoint.is_a?(Hash)
 

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/gate_runtime.rb

@@ -35,7 +35,9 @@ module GateRuntime
     # During the chain-skill migration Core is diagnostic-only. It still
     # validates the contract shape above, but never blocks a transition on
     # graph, artifact, output, checker, review, or topology observations.
-    if contract.fetch("hard_gate_mode", "core").to_s == "chain"
+    # Checkpoint confirmation remains fail-closed because approval-path outputs
+    # do not exist until the user approves the waiting checkpoint.
+    if contract.fetch("hard_gate_mode", "core").to_s == "chain" && transition_kind.to_s != "confirm_checkpoint"
       return GateResult.allow(**base.merge(evidence: base.fetch(:evidence).merge("core_hard_gate_mode" => "chain", "core_hard_gate_bypassed" => true)))
     end
     return GateResult.block(**base, code: "REVISION_CONFLICT", message: "current revision does not match expected revision", recovery: { "kind" => "reinspect", "expected_revision" => expected_revision }) unless expected_revision.nil? || current_revision.to_i == expected_revision.to_i
@@ -79,9 +81,12 @@ module GateRuntime
           return GateResult.block(**base, code: "REQUIRED_OUTPUT_MISSING", message: "required step output is missing", details: { "missing" => missing_outputs }) unless missing_outputs.empty?
           checkpoint = contract.dig("topology", "checkpoint")
           if checkpoint.is_a?(Hash) && checkpoint["producing_step"].to_s == step_id.to_s
-            meta_errors = CheckpointMeta.validate(root: root, state: workflow_state, checkpoint: checkpoint)
-            unless meta_errors.empty?
-              return GateResult.block(**base, code: "CHECKPOINT_META_INVALID", message: "checkpoint meta output is missing or invalid", details: { "checkpoint" => checkpoint["id"], "errors" => meta_errors })
+            meta_path = checkpoint["required_meta_output"]
+            unless CheckpointMeta.approval_output?(checkpoint, meta_path)
+              meta_errors = CheckpointMeta.validate(root: root, state: workflow_state, checkpoint: checkpoint)
+              unless meta_errors.empty?
+                return GateResult.block(**base, code: "CHECKPOINT_META_INVALID", message: "checkpoint meta output is missing or invalid", details: { "checkpoint" => checkpoint["id"], "errors" => meta_errors })
+              end
             end
           end
           invalid_outputs = validate_declared_inputs(contract.dig("outputs", "required_inputs"), root, workflow_state, purpose: :completion)
@@ -111,12 +116,16 @@ module GateRuntime
       checkpoint = contract.dig("topology", "checkpoint")
       checkpoint_matches = checkpoint.is_a?(Hash) && checkpoint["id"].to_s == checkpoint_id
       unless workflow_state["status"].to_s == "waiting_checkpoint" && checkpoint_matches && checkpoint_authorized
-      return GateResult.block(**base, code: "CHECKPOINT_NOT_AUTHORIZED", message: "checkpoint confirmation is not authorized by the runtime", details: { "checkpoint" => checkpoint_id })
+        return GateResult.block(**base, code: "CHECKPOINT_NOT_AUTHORIZED", message: "checkpoint confirmation is not authorized by the runtime", details: { "checkpoint" => checkpoint_id })
       end
       unless workflow_state["completed_steps"].to_a.include?(checkpoint["producing_step"].to_s)
         return GateResult.block(**base, code: "CHECKPOINT_PRODUCER_INCOMPLETE", message: "checkpoint producing step is not completed", details: { "checkpoint" => checkpoint_id })
       end
       if root
+        missing_outputs = required_paths(checkpoint["required_outputs"], root, workflow_state)
+        unless missing_outputs.empty?
+          return GateResult.block(**base, code: "CHECKPOINT_OUTPUT_MISSING", message: "checkpoint required output is missing", details: { "checkpoint" => checkpoint_id, "missing" => missing_outputs })
+        end
         meta_errors = CheckpointMeta.validate(root: root, state: workflow_state, checkpoint: checkpoint)
         unless meta_errors.empty?
           return GateResult.block(**base, code: "CHECKPOINT_META_INVALID", message: "checkpoint meta output is missing or invalid", details: { "checkpoint" => checkpoint_id, "errors" => meta_errors })

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/inspect_state.rb

@@ -141,13 +141,16 @@ end
 # authority for that distinction.
 def workflow_steps_payload(steps, state, result)
   completed_ids = Array(state["completed_steps"])
+  skipped_ids = state["skipped_steps"].is_a?(Hash) ? state["skipped_steps"].keys : []
   pending_ids = Array(state["pending_steps"])
   current_id = state["current_step"]
   action = result[:action] || result["action"]
 
   Array(steps).map do |step|
     id = step["id"]
-    status = if completed_ids.include?(id)
+    status = if skipped_ids.include?(id)
+               "skipped"
+             elsif completed_ids.include?(id)
                "completed"
              elsif id == current_id && action == "await_user_confirmation"
                "waiting_review"

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/machine_evidence.rb

@@ -85,7 +85,7 @@ def independent_evidence(root, feature, step, state, workflow, graph, files, che
 
   {
     "collector" => "core.machine_evidence/v1",
-    "state" => { "revision" => state["revision"], "step" => step },
+    "state" => { "revision" => state["revision"], "step" => step, "skipped_steps" => state["skipped_steps"] },
     "parallel_binding" => binding,
     "input_fingerprints" => inputs.select { |item| item["exists"] }.map { |item| item["sha256"] },
     "output_fingerprints" => files.select { |item| item["exists"] }.map { |item| item["sha256"] },

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/repair_control_plane.rb

@@ -42,9 +42,18 @@ def build_registry(root, workflow, state)
         issues << "missing_required_header(#{checks["required_header"].inspect})" unless head.include?(checks["required_header"])
       end
       completed = Array(state["completed_steps"]).include?(step.fetch("id"))
-      status = completed ? (step["checkpoint"] ? "approved" : "completed") : "planned"
+      skip_record = state["skipped_steps"].is_a?(Hash) && state["skipped_steps"][step.fetch("id")]
+      status = if skip_record
+                 "skipped"
+               elsif completed
+                 step["checkpoint"] ? "approved" : "completed"
+               else
+                 "planned"
+               end
+      issues = [] if skip_record
       entry = { "path" => path, "type" => output["type"], "workflow_step" => step.fetch("id"), "produced_by" => step["skill"] || step["action"], "status" => status, "exists" => exists, "content_valid" => issues.empty? }
       entry["checkpoint"] = step["checkpoint"] if step["checkpoint"]
+      entry["skip_reason"] = skip_record["reason"] if skip_record
       entry["content_issues"] = issues unless issues.empty?
       entry
     end

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/review_preflight.py

@@ -14,6 +14,14 @@ def sha256(path: Path) -> str:
     return hashlib.sha256(path.read_bytes()).hexdigest()
 
 
+def input_present(path):
+    """A declared input without a trailing "/" may still be a rendered
+    directory (e.g. wireframes/screens); accept it when it holds a file."""
+    if path.is_file():
+        return True
+    return path.is_dir() and any(child.is_file() for child in path.rglob("*"))
+
+
 def within(root: Path, relative: str) -> Path:
     if not isinstance(relative, str) or not relative or Path(relative).is_absolute() or "\x00" in relative:
         raise ValueError("invalid relative path")
@@ -166,7 +174,7 @@ def preflight(root: Path, feature: str, step: str, contract_path: str,
                 elif path.exists() or stage != "entry":
                     issues.append({"code": "MISSING_INPUT_FACT", "index": index, "path": relative})
             elif producer == "existing":
-                if not path.is_file():
+                if not input_present(path):
                     issues.append({"code": "MISSING_INPUT_FACT", "index": index, "path": relative})
                 elif obligation.get("sha256") is not None and obligation.get("sha256") != sha256(path):
                     issues.append({"code": "STALE_INPUT_FACT", "index": index, "path": relative})

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/startup_preflight.py

@@ -123,7 +123,7 @@ def startup_preflight(root: Path, feature: str, step: str,
                 collection = relative.endswith("/")
                 try:
                     target = review_preflight.within(root, rendered)
-                    exists = target.is_dir() if collection else target.is_file()
+                    exists = target.is_dir() if collection else review_preflight.input_present(target)
                 except ValueError:
                     exists = False
                 # Same rule as gate_runtime.rb: a collection input may be absent at entry.

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/validate_state.rb

@@ -27,7 +27,7 @@ module WorkflowStateValidator
     pending_steps
   ].freeze
 
-  TERMINAL_ARTIFACT_STATUSES = %w[approved completed passed].freeze
+  TERMINAL_ARTIFACT_STATUSES = %w[approved completed passed skipped].freeze
   NON_TERMINAL_ARTIFACT_STATUSES = %w[planned generated pending_rerun stale failed].freeze
   TERMINAL_WORKFLOW_STATUSES = %w[completed failed cancelled].freeze
   # Core quality checks are advisory by default. Keep only structural and
@@ -70,6 +70,7 @@ module WorkflowStateValidator
     return true if value.start_with?("duplicate_", "unknown_", "missing_tracked_step")
     return true if value.start_with?("step_in_", "completed_", "terminal_", "non_completed_")
     return true if value.start_with?("waiting_checkpoint_")
+    return true if value.start_with?("skipped_")
     return true if %w[missing_required_output output_not_registered].include?(value)
 
     false
@@ -127,6 +128,7 @@ module WorkflowStateValidator
     tracked_ids = completed_ids + pending_ids
 
     validate_step_tracking(issues, state, step_ids, completed_ids, pending_ids, tracked_ids)
+    validate_skipped_transitions(issues, root, state, workflow, step_by_id, completed_ids, pending_ids)
     if state["parallel_run_ref"]
       validate_parallel_run(issues, root, state, workflow, step_by_id)
     else
@@ -335,6 +337,91 @@ unless %w[prepared claimed consumed superseded failed].include?(status)
     end
   end
 
+  def validate_skipped_transitions(issues, root, state, workflow, step_by_id, completed_ids, pending_ids)
+    skipped_steps = state["skipped_steps"]
+    skipped_checkpoints = state["skipped_checkpoints"]
+    if skipped_steps && !skipped_steps.is_a?(Hash)
+      issues << issue("error", "skipped_steps_invalid", "STATE.skipped_steps must be a mapping")
+      return
+    end
+    if skipped_checkpoints && !skipped_checkpoints.is_a?(Hash)
+      issues << issue("error", "skipped_checkpoints_invalid", "STATE.skipped_checkpoints must be a mapping")
+      return
+    end
+    return if skipped_steps.nil? && skipped_checkpoints.nil?
+
+    policies = workflow.dig("governance", "conditional_step_skips")
+    policies = {} unless policies.is_a?(Hash)
+    (skipped_steps || {}).each do |step_id, record|
+      unless record.is_a?(Hash)
+        issues << issue("error", "skipped_step_record_invalid", "Skipped step record must be a mapping", step: step_id)
+        next
+      end
+      policy_id = record["policy"].to_s
+      policy = policies[policy_id]
+      unless policy.is_a?(Hash) && Array(policy["steps"]).map(&:to_s).include?(step_id.to_s)
+        issues << issue("error", "skipped_step_policy_invalid", "Skipped step is not authorized by the workflow policy", step: step_id, policy: policy_id)
+        next
+      end
+      issues << issue("error", "skipped_step_unknown", "Skipped step is not defined in the workflow", step: step_id) unless step_by_id.key?(step_id.to_s)
+      issues << issue("error", "skipped_step_not_completed", "Skipped step must be tracked as completed", step: step_id) unless completed_ids.include?(step_id)
+      issues << issue("error", "skipped_step_still_pending", "Skipped step cannot remain pending", step: step_id) if pending_ids.include?(step_id)
+      issues << issue("error", "skipped_step_status_invalid", "Skipped step record status must be skipped", step: step_id) unless record["status"] == "skipped"
+      issues << issue("error", "skipped_step_reason_invalid", "Skipped step reason does not match its policy", step: step_id) unless record["reason"].to_s == policy["reason"].to_s
+      recorded_revision = record["recorded_at_revision"]
+      unless recorded_revision.is_a?(Integer) && recorded_revision.positive? && recorded_revision <= state.fetch("revision", 0).to_i
+        issues << issue("error", "skipped_step_revision_invalid", "Skipped step decision revision is invalid", step: step_id, recorded_at_revision: recorded_revision)
+      end
+      validate_skip_source(issues, root, state, step_id, record, policy)
+    end
+
+    (skipped_checkpoints || {}).each do |checkpoint_id, record|
+      unless record.is_a?(Hash)
+        issues << issue("error", "skipped_checkpoint_record_invalid", "Skipped checkpoint record must be a mapping", checkpoint: checkpoint_id)
+        next
+      end
+      policy = policies[record["policy"].to_s]
+      unless policy.is_a?(Hash) && policy["checkpoint"].to_s == checkpoint_id.to_s
+        issues << issue("error", "skipped_checkpoint_policy_invalid", "Skipped checkpoint is not authorized by the workflow policy", checkpoint: checkpoint_id)
+        next
+      end
+      expected_steps = Array(policy["steps"]).map(&:to_s)
+      unless Array(record["steps"]).map(&:to_s) == expected_steps && expected_steps.all? { |step_id| skipped_steps.is_a?(Hash) && skipped_steps.key?(step_id) }
+        issues << issue("error", "skipped_checkpoint_steps_invalid", "Skipped checkpoint must reference every policy step", checkpoint: checkpoint_id)
+      end
+    end
+
+    applied_policies = (skipped_steps || {}).values.each_with_object([]) do |record, matches|
+      policy = record.is_a?(Hash) && policies[record["policy"].to_s]
+      matches << policy if policy
+    end
+    applied_policies.uniq.each do |policy|
+      checkpoint_id = policy["checkpoint"].to_s
+      unless skipped_checkpoints.is_a?(Hash) && skipped_checkpoints.key?(checkpoint_id)
+        issues << issue("error", "skipped_checkpoint_missing", "Conditional step skip must record its skipped checkpoint", checkpoint: checkpoint_id)
+      end
+    end
+  end
+
+  def validate_skip_source(issues, root, state, step_id, record, policy)
+    expected_path = interpolate_path(policy.fetch("source_path"), state)
+    unless record["source"].to_s == expected_path && record["source_field"].to_s == policy["source_field"].to_s && record["source_value"] == policy["equals"]
+      issues << issue("error", "skipped_step_source_binding_invalid", "Skipped step source binding does not match its policy", step: step_id)
+      return
+    end
+    source_abs, = DevflowControlIO.resolve_control_path(root, expected_path, :artifact)
+    source = JSON.parse(File.read(source_abs))
+    source_field = policy.fetch("source_field").to_s
+    unless source.key?(source_field) && source[source_field] == policy["equals"]
+      issues << issue("error", "skipped_step_source_value_invalid", "Skip source no longer authorizes the skipped step", step: step_id, path: expected_path)
+    end
+    unless record["source_sha256"].to_s == Digest::SHA256.file(source_abs).hexdigest
+      issues << issue("error", "skipped_step_source_fingerprint_invalid", "Skip source fingerprint does not match the recorded decision", step: step_id, path: expected_path)
+    end
+  rescue KeyError, JSON::ParserError, Errno::ENOENT, DevflowControlIO::InvalidControlPath => error
+    issues << issue("error", "skipped_step_source_invalid", "Skip source cannot be verified", step: step_id, message: error.message)
+  end
+
   def validate_parallel_run(issues, root, state, workflow, step_by_id)
     feature = state["current_feature"].to_s
     run = ParallelRun.load(root, feature)
@@ -447,7 +534,10 @@ unless %w[prepared claimed consumed superseded failed].include?(status)
   end
 
   def validate_completed_outputs(issues, root, state, step_by_id, completed_ids, artifact_by_path, strict_artifact_status, workflow)
+    skipped_ids = state["skipped_steps"].is_a?(Hash) ? state["skipped_steps"].keys : []
     completed_ids.each do |step_id|
+      next if skipped_ids.include?(step_id)
+
       step = step_by_id[step_id]
       next unless step
 
@@ -472,8 +562,14 @@ unless %w[prepared claimed consumed superseded failed].include?(status)
     validate_step_outputs(issues, root, state, step, artifact_by_path, strict_artifact_status, true)
     checkpoint_id = state["checkpoint"] || step["checkpoint"]
     checkpoint = workflow.fetch("checkpoints", {})[checkpoint_id]
-    CheckpointMeta.validate(root: root, state: state, checkpoint: checkpoint).each do |entry|
-      issues << issue("error", entry.fetch("code"), entry.fetch("message"), step: step["id"], checkpoint: checkpoint_id, **entry.reject { |key, _| %w[code message].include?(key) })
+    checkpoint = checkpoint.merge("id" => checkpoint_id) if checkpoint.is_a?(Hash)
+    meta_path = checkpoint.is_a?(Hash) && checkpoint["required_meta_output"]
+    unless CheckpointMeta.approval_output?(checkpoint, meta_path)
+      CheckpointMeta.validate(root: root, state: state, checkpoint: checkpoint).each do |entry|
+        details = { step: step["id"], checkpoint: checkpoint_id }
+                  .merge(entry.reject { |key, _| %w[code message].include?(key) })
+        issues << issue("error", entry.fetch("code"), entry.fetch("message"), details)
+      end
     end
   end
 

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/workflow_gate_contract.rb

@@ -60,6 +60,14 @@ module WorkflowGateContract
       end
       errors << error("CHECKPOINT_PRODUCER_MISMATCH", "gate_after must equal producing_step", checkpoint: id) if checkpoint["gate_after"].to_s != checkpoint["producing_step"].to_s
       errors << error("CHECKPOINT_OUTPUTS_INVALID", "required_outputs must be an array", checkpoint: id) unless checkpoint["required_outputs"].is_a?(Array)
+      if checkpoint.key?("approval_outputs")
+        approval_outputs = checkpoint["approval_outputs"]
+        errors << error("CHECKPOINT_APPROVAL_OUTPUTS_INVALID", "approval_outputs must be an array", checkpoint: id) unless approval_outputs.is_a?(Array)
+        if approval_outputs.is_a?(Array) && checkpoint["required_outputs"].is_a?(Array)
+          undeclared = approval_outputs.map(&:to_s) - checkpoint["required_outputs"].map(&:to_s)
+          errors << error("CHECKPOINT_APPROVAL_OUTPUT_UNDECLARED", "approval_outputs must also be required_outputs", checkpoint: id, outputs: undeclared) unless undeclared.empty?
+        end
+      end
       errors << error("CHECKPOINT_META_FIELDS_INVALID", "required_meta_fields must be an array", checkpoint: id) unless checkpoint["required_meta_fields"].is_a?(Array)
       errors << error("CHECKPOINT_OPTIONS_INVALID", "confirm_options must include approve and needs_fix", checkpoint: id) unless Array(checkpoint["confirm_options"]).sort == %w[approve needs_fix]
     end
@@ -68,6 +76,41 @@ module WorkflowGateContract
       errors << error("CHECKPOINT_REF_NOT_FOUND", "enforced checkpoint is not defined", checkpoint: id) unless checkpoints.key?(id)
     end
 
+    conditional_skips = workflow.dig("governance", "conditional_step_skips")
+    if conditional_skips && !conditional_skips.is_a?(Hash)
+      errors << error("CONDITIONAL_STEP_SKIPS_SCHEMA_INVALID", "conditional_step_skips must be a mapping")
+    end
+    (conditional_skips.is_a?(Hash) ? conditional_skips : {}).each do |policy_id, policy|
+      unless policy.is_a?(Hash)
+        errors << error("CONDITIONAL_STEP_SKIP_POLICY_INVALID", "conditional step skip policy must be a mapping", policy: policy_id)
+        next
+      end
+      %w[trigger_checkpoint source_path source_field equals reason steps checkpoint].each do |field|
+        errors << error("CONDITIONAL_STEP_SKIP_FIELD_MISSING", "conditional step skip field is required", policy: policy_id, field: field) unless policy.key?(field)
+      end
+      errors << error("CONDITIONAL_STEP_SKIP_TRIGGER_UNKNOWN", "conditional step skip trigger checkpoint is not defined", policy: policy_id, checkpoint: policy["trigger_checkpoint"]) unless checkpoints.key?(policy["trigger_checkpoint"])
+      skipped_checkpoint = checkpoints[policy["checkpoint"]]
+      if skipped_checkpoint.nil?
+        errors << error("CONDITIONAL_STEP_SKIP_CHECKPOINT_UNKNOWN", "conditional step skip checkpoint is not defined", policy: policy_id, checkpoint: policy["checkpoint"])
+      elsif skipped_checkpoint["skip_policy"].to_s != policy_id.to_s
+        errors << error("CONDITIONAL_STEP_SKIP_CHECKPOINT_MISMATCH", "skipped checkpoint must declare the same skip policy", policy: policy_id, checkpoint: policy["checkpoint"])
+      end
+      unless policy["equals"] == true || policy["equals"] == false
+        errors << error("CONDITIONAL_STEP_SKIP_VALUE_INVALID", "conditional step skip equals value must be boolean", policy: policy_id)
+      end
+      unless policy["steps"].is_a?(Array) && policy["steps"].any?
+        errors << error("CONDITIONAL_STEP_SKIP_STEPS_INVALID", "conditional step skip steps must be a non-empty array", policy: policy_id)
+      end
+      Array(policy["steps"]).each do |step_id|
+        step = step_by_id[step_id.to_s]
+        if step.nil?
+          errors << error("CONDITIONAL_STEP_SKIP_STEP_UNKNOWN", "conditional step skip references an unknown step", policy: policy_id, step: step_id)
+        elsif step["skip_policy"].to_s != policy_id.to_s
+          errors << error("CONDITIONAL_STEP_SKIP_STEP_MISMATCH", "skipped step must declare the same skip policy", policy: policy_id, step: step_id)
+        end
+      end
+    end
+
     step_checkers = workflow.dig("governance", "step_checkers")
     if step_checkers.is_a?(Hash)
       step_checkers.each do |step_id, checker_ids|

package/plugins/devflow-core/skills/workflow-orchestrator/templates/feature-development.yaml

@@ -29,6 +29,19 @@ governance:
     - CP-2
     - CP-3
     - CP-4
+  conditional_step_skips:
+    no_ui_change:
+      trigger_checkpoint: CP-1
+      source_path: ".devflow/planning/requirements/baseline.meta.json"
+      source_field: ui_change_required
+      equals: false
+      reason: no_ui_change
+      steps:
+        - wireframe-proposal
+        - wireframe-validate
+        - wireframe-render
+        - wireframe-review
+      checkpoint: CP-WIREFRAME
   step_checkers:
     requirement-baseline:
       - requirement-graph-check
@@ -234,6 +247,10 @@ checkpoints:
       - ".devflow/planning/features/{feature}/wireframes/preview.md"
       - ".devflow/planning/features/{feature}/wireframes/flow.svg"
       - ".devflow/planning/features/{feature}/wireframes/screens"
+    # Core writes this only after the user approves the waiting checkpoint.
+    # Entry validation defers it; checkpoint confirmation still requires it.
+    approval_outputs:
+      - ".devflow/planning/features/{feature}/canonical.meta.json"
     required_meta_output: ".devflow/planning/features/{feature}/canonical.meta.json"
     required_meta_fields:
       - prototype_fingerprint
@@ -247,7 +264,7 @@ checkpoints:
     confirm_options:
       - approve
       - needs_fix
-    skip_policy: never
+    skip_policy: no_ui_change
     resume_behavior: "user confirms, then continue with api-contract"
   CP-API:
     name: API contract confirmation
@@ -520,6 +537,7 @@ steps:
         risks: { type: array, required: false }
         key_decisions: { type: array, max: 5, required: false }
         traceability_status: { type: string, required: true }
+        ui_change_required: { type: boolean, required: false }
     checkpoint: CP-1
 
   - id: wireframe-proposal
@@ -527,6 +545,7 @@ steps:
     label: Wireframe proposal
     skill: wireframe-proposal
     engine_evidence_gate: enforced
+    skip_policy: no_ui_change
     depends_on:
       - requirement-baseline
     inputs:
@@ -548,6 +567,7 @@ steps:
     label: Validate wireframe proposal
     skill: wireframe-validate
     engine_evidence_gate: enforced
+    skip_policy: no_ui_change
     depends_on:
       - wireframe-proposal
     inputs:
@@ -572,6 +592,7 @@ steps:
     label: Render wireframe previews
     skill: wireframe-render
     engine_evidence_gate: enforced
+    skip_policy: no_ui_change
     depends_on:
       - wireframe-validate
     inputs:
@@ -593,6 +614,7 @@ steps:
     label: Wireframe review
     skill: wireframe-review
     engine_evidence_gate: enforced
+    skip_policy: no_ui_change
     depends_on:
       - wireframe-render
     inputs:

package/plugins/devflow-requirements/skills/workflow-requirement-baseline/SKILL.md

@@ -106,7 +106,7 @@ When triage found partial overlap or prior rejection, preserve it as source mate
 Always create or update:
 
 - `.devflow/planning/requirements/baseline.md` — unified requirement baseline
-- `.devflow/planning/requirements/baseline.meta.json` — structured metadata. Schema defined in `feature-development.yaml` under `steps[requirement-baseline].meta_output.fields`: `review_status`, `fp_count`, `br_count`, `bc_count`, `blocking_pending_count`, `critical_image_missing_count`, `challenge_pending_count`, `code_reality_missing_count`, `current_feature`, `depends_on_count`, plus optional `pending_items`, `risks`, and `key_decisions`.
+- `.devflow/planning/requirements/baseline.meta.json` — structured metadata. Schema defined in `feature-development.yaml` under `steps[requirement-baseline].meta_output.fields`: `review_status`, `fp_count`, `br_count`, `bc_count`, `blocking_pending_count`, `critical_image_missing_count`, `challenge_pending_count`, `code_reality_missing_count`, `current_feature`, `depends_on_count`, plus optional `pending_items`, `risks`, `key_decisions`, and `ui_change_required`.
 - `.devflow/planning/requirements/{feature}/traceability.json` — copy the orchestrator `templates/traceability.json` schema and create one atomic `REQ-*` record for every confirmed in-scope requirement. Every record must define `input`、`output`、`behavior`、`orchestration`、`failure`、`verification`; use `N/A` only with a reason when a dimension truly does not apply.
 
 Before the CP-1 result is reported, run:
@@ -666,6 +666,8 @@ Write `.devflow/planning/requirements/baseline.meta.json` with the fields requir
 - `challenge_pending_count`: unanswered CR decisions affecting scope, semantics, ownership, compatibility, implementation cost, or downstream contracts
 - `code_reality_missing_count`: required code reality comparisons that were not completed
 
+Also write `ui_change_required` as a JSON boolean. Set it to `false` only when the confirmed baseline explicitly states that the feature adds or changes no page, interaction, displayed/input field, or UI permission behavior. Set it to `true` for any UI impact or ambiguity. This field is a candidate fact only: never edit `STATE.md`, skip a step, or bypass a checkpoint. Core evaluates the field after CP-1 is approved and records any controlled skip.
+
 Completion gate: baseline and baseline.meta.json are written and contain no unresolved template placeholders. If updating an existing baseline, ALL prior feature points are still present.
 
 ## Phase 7 — Final Review Gate (MANDATORY — do not skip)

package/src/constants.ts

@@ -1,5 +1,5 @@
 export const PRODUCT_NAME = "Devflow Pi";
-export const PRODUCT_VERSION = "0.1.101";
+export const PRODUCT_VERSION = "0.1.103";
 export const PROJECT_SCHEMA_VERSION = 1;
 export const OMP_RUNTIME_VERSION = "17.2.7";