@guanlin4924/devflow-pi 0.1.105 → 0.1.106

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/parallel_recover.rb

@@ -15,6 +15,8 @@ require "optparse"
 require "time"
 require "yaml"
 require_relative "control_io"
+require_relative "artifact_specs"
+require_relative "gate_policy"
 require_relative "parallel_run"
 
 options = {
@@ -54,9 +56,8 @@ def interpolate_path(path, state)
 end
 
 def required_output_specs(step)
-  outputs = Array(step["outputs"]).select { |item| item.is_a?(Hash) && item["required"] == true }
-  outputs << step["meta_output"] if step["meta_output"].is_a?(Hash)
-  outputs
+  ArtifactSpecs.for_step(step).select { |item| item["required"] == true }
+
 end
 
 def actual_content_issues(path, checks)
@@ -143,12 +144,13 @@ def generate_machine_evidence(root, feature, state_revision, branch, expected_pa
   packed_paths = Array(pack["files"]).select { |item| item.is_a?(Hash) && item["required"] == true }.map { |item| item["path"].to_s }.sort
   errors << "machine evidence required outputs mismatch" unless packed_paths == expected_paths.sort
   errors << "machine evidence contains a missing required file" unless Array(pack["files"]).all? { |item| item.is_a?(Hash) && item["exists"] == true && item["sha256"].to_s.match?(/\A[0-9a-f]{64}\z/) }
-  raise ArgumentError, errors.join("; ") unless errors.empty?
+  recovery_check(errors.empty?, errors.join("; "))
 
   output_fingerprint = Digest::SHA256.hexdigest(
     Array(pack["files"]).map { |item| [item["path"].to_s, item["sha256"].to_s] }.sort.to_json,
   )
   {
+    "valid" => errors.empty?,
     "evidence_path" => evidence_path,
     "evidence_sha256" => Digest::SHA256.file(absolute).hexdigest,
     "output_fingerprint" => output_fingerprint,
@@ -213,6 +215,13 @@ rescue JSON::ParserError => error
   { "ok" => false, "reason" => "join_returned_invalid_json", "message" => error.message, "stderr" => stderr.strip, "exit_status" => status.exitstatus }
 end
 
+def recovery_check(condition, message)
+  return if condition
+
+  $recovery_advisories << GatePolicy.advisory({ "code" => "parallel_recovery_check_failed", "message" => message })
+end
+
+$recovery_advisories = []
 root = Dir.pwd
 feature = options[:feature].to_s
 result = nil
@@ -244,7 +253,7 @@ begin
     raise ArgumentError, "parallel run not found" unless run
     recovery = recovery_id(run, options[:expected_state_revision], options[:expected_run_revision])
     branches = Array(run["branches"])
-    already_joined = state["parallel_run_ref"].nil? && run["status"] == "completed" && branches.any? && branches.all? { |branch| branch["status"] == "succeeded" }
+    already_joined = state["parallel_run_ref"].nil? && run["status"] == "completed" && branches.any? && (branches.all? { |branch| branch["status"] == "succeeded" } || run["completion_with_warnings"])
     if already_joined
       append_audit(root, feature, {
         "schema_version" => 1, "origin" => "core.parallel_recovery/v1", "event" => "idempotent_noop",
@@ -264,7 +273,7 @@ begin
       raise ArgumentError, "parallel run is bound to stale STATE revision" unless Integer(run.fetch("bound_state_revision")) == state_revision
       raise ArgumentError, "parallel run has no branches" if branches.empty?
       ineligible = branches.select { |branch| %w[failed aborted].include?(branch["status"].to_s) }
-      raise ArgumentError, "failed/aborted branches require explicit retry: #{ineligible.map { |branch| branch['branch_id'] }.join(', ')}" unless ineligible.empty?
+      recovery_check(ineligible.empty?, "failed/aborted branches were not retried: #{ineligible.map { |branch| branch['branch_id'] }.join(', ')}")
       previous_validation = prior_validation(root, feature, recovery, run)
       unless current_run_revision == options[:expected_run_revision] || previous_validation
         raise ArgumentError, "stale parallel run revision: expected=#{options[:expected_run_revision]}, actual=#{current_run_revision}"
@@ -275,9 +284,10 @@ begin
     registry_source = workflow.dig("artifact_registry", "source").to_s
     raise ArgumentError, "workflow artifact_registry.source is required for recovery" if registry_source.empty?
     registry_path, = DevflowControlIO.resolve_control_path(root, registry_source, :registry)
-    registry = load_yaml_mapping(registry_path, "artifact registry")
-    raise ArgumentError, "artifact registry revision mismatch" unless Integer(registry.fetch("state_revision")) == state_revision
-    raise ArgumentError, "artifact registry feature mismatch" unless registry.dig("registry_scope", "feature").to_s == feature
+    registry = File.file?(registry_path) ? load_yaml_mapping(registry_path, "artifact registry") : {}
+    recovery_check(!registry.empty?, "artifact registry missing")
+    recovery_check(registry["state_revision"] == state_revision, "artifact registry revision mismatch")
+    recovery_check(registry.dig("registry_scope", "feature").to_s == feature, "artifact registry feature mismatch")
     registry_by_path = Array(registry["artifacts"]).each_with_object({}) do |artifact, index|
       raise ArgumentError, "artifact registry entry must be a mapping" unless artifact.is_a?(Hash)
       path = artifact["path"].to_s
@@ -292,7 +302,8 @@ begin
       raise ArgumentError, "parallel branch workflow step is unknown: #{branch['workflow_step']}" unless step
       artifacts = validate_registered_outputs(root, workflow, state, step, registry_by_path)
       invalid = artifacts.reject { |artifact| artifact["valid"] }
-      raise ArgumentError, "branch #{branch['branch_id']} artifact validation failed: #{invalid.to_json}" unless invalid.empty?
+      recovery_check(invalid.empty?, "branch #{branch['branch_id']} artifact validation failed: #{invalid.to_json}")
+      next unless invalid.empty?
       machine = generate_machine_evidence(root, feature, state_revision, branch, artifacts.map { |artifact| artifact["path"] })
       validation_records << {
         "branch_id" => branch["branch_id"], "workflow_step" => branch["workflow_step"],
@@ -310,6 +321,7 @@ begin
 
     validation_records.each do |validated|
       machine = validated.fetch("machine_evidence")
+      next unless machine["valid"]
       updated = ParallelRun.update_branch(
         root: root, feature: feature, branch_id: validated.fetch("branch_id"),
         expected_revision: current_run_revision, status: "succeeded",
@@ -320,9 +332,7 @@ begin
       recovered_branches << validated.fetch("branch_id")
     end
     final_run = ParallelRun.load(root, feature)
-    unless Array(final_run["branches"]).all? { |branch| branch["status"] == "succeeded" }
-      raise ArgumentError, "recovery did not produce an all-succeeded run"
-    end
+    recovery_check(Array(final_run["branches"]).all? { |branch| branch["status"] == "succeeded" }, "recovery did not produce an all-succeeded run; branch statuses preserved")
       append_audit(root, feature, {
         "schema_version" => 1, "origin" => "core.parallel_recovery/v1", "event" => "branches_recovered",
         "recovery_id" => recovery, "reason" => options[:reason], "run_id" => final_run["run_id"],
@@ -382,5 +392,6 @@ rescue StandardError => error
   result = { "ok" => false, "reason" => "parallel_recovery_refused", "message" => error.message, "recovery_id" => recovery }
 end
 
+result["warnings"] = $recovery_advisories + Array(result.dig("details", "advisories")) unless $recovery_advisories.empty?
 puts(options[:json] ? JSON.generate(result) : JSON.pretty_generate(result))
 exit exit_status

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/repair_control_plane.rb

@@ -6,6 +6,8 @@ require "json"
 require "optparse"
 require "yaml"
 require_relative "control_io"
+require_relative "artifact_specs"
+require_relative "gate_policy"
 require_relative "validate_state"
 require_relative "phase_ownership"
 
@@ -30,7 +32,7 @@ end
 def build_registry(root, workflow, state)
   checks = workflow.dig("artifact_registry", "content_checks") || {}
   artifacts = Array(workflow["steps"]).flat_map do |step|
-    Array(step["outputs"]).map do |output|
+    ArtifactSpecs.for_step(step).map do |output|
       path = interpolate_path(output.fetch("path"), state)
       abs, = DevflowControlIO.resolve_control_path(root, path, :artifact)
       exists = File.exist?(abs)
@@ -90,9 +92,7 @@ begin
           output_path, = DevflowControlIO.resolve_control_path(root, path, :artifact)
           path unless File.exist?(output_path)
         end.compact
-        if missing_current_outputs.any?
-          result = { "ok" => false, "classification" => "unsafe", "reason" => "missing_required_output", "missing_outputs" => missing_current_outputs, "plan" => { "state_transition" => "none", "registry_write" => false } }
-        elsif !validation["ok"]
+        if !validation["ok"]
           result = { "ok" => false, "classification" => "unsafe", "reason" => "ambiguous_or_invalid_state", "issues" => validation["errors"], "plan" => { "state_transition" => "none", "registry_write" => false } }
         elsif !options[:confirm] || !options[:write]
           result = { "ok" => false, "classification" => "safe_repairable", "reason" => "confirmation_required", "revision" => state.fetch("revision", 0), "plan" => { "state_transition" => "none", "registry_write" => true, "registry" => candidate } }

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/sync_artifacts.rb

@@ -8,6 +8,8 @@ require "json"
 require "optparse"
 require "yaml"
 require_relative "control_io"
+require_relative "artifact_specs"
+require_relative "gate_policy"
 require_relative "phase_ownership"
 
 options = {
@@ -56,7 +58,7 @@ end
 
 def collect_outputs(workflow)
   Array(workflow["steps"]).flat_map do |step|
-    Array(step["outputs"]).map do |output|
+    ArtifactSpecs.for_step(step).map do |output|
       [step, output]
     end
   end

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/validate_state.rb

@@ -33,8 +33,7 @@ module WorkflowStateValidator
   # Core quality checks are advisory by default. Keep only structural and
   # write-safety failures hard; AI review decides whether business-quality
   # drift, stale metadata, or incomplete generated evidence should pause work.
-  SOFT_GATE_MODE = ENV.fetch("DEVFLOW_SOFT_GATES", "1") != "0"
-  HARD_VALIDATION_CODES = %w[
+    OPERATION_VALIDATION_CODES = %w[
     invalid_control_path
     missing_state_file
     missing_state_front_matter
@@ -44,36 +43,8 @@ module WorkflowStateValidator
     workflow_step_unknown
     phase_ownership_conflict
   ].freeze
-  # Acceptance-execution trust failures are never downgraded by soft gates.
-  ACCEPTANCE_HARD_VALIDATION_CODES = %w[
-    acceptance_results_not_passed
-    execution_surface_mismatch
-    approval_invalid
-    human_result_unapproved
-    dsl_not_approved
-    environment_profile_not_approved
-    runtime_integrity_error
-    acceptance_tests_not_passed
-    acceptance_tests_empty
-    acceptance_test_suite_freeze_failed
-    acceptance_test_suite_freeze_attestation_invalid
-    acceptance_test_suite_freeze_attestation_failed
-    acceptance_test_suite_candidate_binding_failed
-    acceptance_test_suite_freeze_recovery_failed
-  ].freeze
-
-  def self.hard_validation_code?(code)
-    value = code.to_s
-    return true if HARD_VALIDATION_CODES.include?(value)
-    return true if ACCEPTANCE_HARD_VALIDATION_CODES.include?(value)
-    return true if value.start_with?("artifact_registry_", "parallel_", "PARALLEL_")
-    return true if value.start_with?("duplicate_", "unknown_", "missing_tracked_step")
-    return true if value.start_with?("step_in_", "completed_", "terminal_", "non_completed_")
-    return true if value.start_with?("waiting_checkpoint_")
-    return true if value.start_with?("skipped_")
-    return true if %w[missing_required_output output_not_registered].include?(value)
-
-    false
+  def self.operation_validation_code?(code)
+    OPERATION_VALIDATION_CODES.include?(code.to_s)
   end
 
   module_function
@@ -159,14 +130,12 @@ module WorkflowStateValidator
       end
     end
 
-    if SOFT_GATE_MODE
-      issues.each do |entry|
-        next unless entry["severity"] == "error"
-        next if hard_validation_code?(entry["code"])
+    issues.each do |entry|
+      next unless entry["severity"] == "error"
+      next if operation_validation_code?(entry["code"])
 
-        entry["severity"] = "warning"
-        entry["soft_gate"] = true
-      end
+      entry["severity"] = "warning"
+      entry["soft_gate"] = true
     end
     ok = issues.none? { |entry| entry["severity"] == "error" }
     result(ok, state_path, workflow_path, registry_path, issues)

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/wireframe_commit.rb

@@ -107,10 +107,46 @@ def canonical_fingerprint(canonical)
 end
 
 def read_source_fingerprint(root, feature)
-  path = File.join(root, ".devflow/planning", "requirements", feature, "traceability.json")
-  return "" unless File.file?(path)
+  units_path, = DevflowControlIO.resolve_control_path(root, ".devflow/planning/requirements/#{feature}/source_units.yaml", :artifact)
+  # Core source unitization owns this value. Both the baseline template and
+  # graph-generated traceability views legitimately omit the legacy mirror.
+  traceability_path, = DevflowControlIO.resolve_control_path(root, ".devflow/planning/requirements/#{feature}/traceability.json", :artifact)
+  legacy = if File.file?(traceability_path)
+             traceability = JSON.parse(File.read(traceability_path))
+             raise ArgumentError, "traceability.json must be an object" unless traceability.is_a?(Hash)
+             traceability["source_document_fingerprint"].to_s
+           else
+             ""
+           end
+  unless File.exist?(units_path) || File.symlink?(units_path)
+    return legacy unless legacy.strip.empty?
 
-  JSON.parse(File.read(path))["source_document_fingerprint"].to_s
+    raise ArgumentError, "source_units.yaml is missing and traceability.json has no legacy source_document_fingerprint; restore requirement-wayfinder source provenance"
+  end
+
+  units = YAML.safe_load(File.read(units_path), permitted_classes: [], aliases: false)
+  raise ArgumentError, "source_units.yaml must be an object" unless units.is_a?(Hash)
+  fingerprint = units["source_document_fingerprint"].to_s
+  digest = fingerprint.delete_prefix("sha256:")
+  unless digest.match?(/\A[0-9a-f]{64}\z/)
+    raise ArgumentError, "source_units.yaml source_document_fingerprint must be a SHA-256 digest"
+  end
+  source = units["source_document"].to_s
+  if source.empty? || Pathname.new(source).absolute? || source.split(/[\\\/]/).include?("..")
+    raise ArgumentError, "source_units.yaml source_document must be a project-relative path"
+  end
+  root_real = File.realpath(root)
+  source_path = File.realpath(File.join(root_real, source))
+  unless source_path.start_with?(root_real + File::SEPARATOR)
+    raise ArgumentError, "source_units.yaml source_document escapes project root"
+  end
+  unless Digest::SHA256.file(source_path).hexdigest == digest
+    raise ArgumentError, "source_units.yaml source_document_fingerprint is stale; regenerate source units and review the changed requirements"
+  end
+  unless legacy.empty? || legacy.delete_prefix("sha256:") == digest
+    raise ArgumentError, "traceability.json source_document_fingerprint conflicts with source_units.yaml; reconcile requirement provenance"
+  end
+  fingerprint
 end
 
 def verify_business_action_refs(canonical, path)

package/plugins/devflow-core/skills/workflow-orchestrator/templates/feature-development.yaml

@@ -13,13 +13,12 @@ phase_scope:
   failure_branch_enabled: true
   parallel_window_enabled: true
 
-# P2 preset: new work fail-closes at the defined checkpoints. Existing STATE
+# Gate checks are advisory. Existing STATE
 # files without governance_started_revision remain legacy_unattested and are
 # only reported until their next newly-started governed step.
 governance:
   # Chain skill owns orchestration while Core remains an evidence/diagnostic
-  # service. Set to `core` only after the hard-gate migration is complete.
-  hard_gate_mode: chain
+  # service. Core checks only produce diagnostics.
   gate_contract_version: 3
   requirement_graph_gate: enforced
   requirement_coverage_gate: enforced

package/plugins/devflow-core/skills/workflow-orchestrator/templates/regression-acceptance.yaml

@@ -9,7 +9,6 @@ entry:
   initial_step: regression-test-design
 
 governance:
-  hard_gate_mode: core
   gate_contract_version: 3
   requirement_graph_gate: enforced
   enforced_checkpoints:

package/plugins/devflow-core/skills/workflow-pipeline/SKILL.md

@@ -3,11 +3,16 @@ name: workflow-pipeline
 description: Use when running or resuming the full .devflow/planning delivery pipeline from requirements through implementation, frozen acceptance tests, and Devflow release closeout.
 ---
 
+## 默认软门禁策略
+
+工作流硬门禁已移除。下文及各步骤中的产物、索引、合同、审查、质量、恢复和 CP 审批条件均为诊断建议：保留失败证据和缺项，允许继续执行。用户说“下一步”即可推进，无需额外批准弹窗；不得把继续执行记录成人工批准，也不得把失败、未执行的测试改写为通过。真实读写/执行失败、无法解析的状态和并发版本冲突须如实报告。硬门禁及其恢复开关已移除。
+
+
 <objective>
 全链路研发交付入口。解析用户参数，先确保需求主链“入口分诊 → 探索地图 → 领域建模 → 可实现性审查”完成，再检测当前状态，然后委托 workflow-orchestrator 接管后续所有步骤调度。
 pipeline 本身不包含执行规则——所有门禁、CP 协议、失败分支、并行窗口、lessons 注入规则均由 orchestrator 维护。
 
-当前迁移阶段由本 skill 作为链路编排器：按 `next_step.skill` 依次调用各技能、传递上一技能的产物与诊断、再决定下一技能。Core 的 contract/checker/output/review 硬门禁暂不参与阻断；Core 结果只作为事实和风险提示。只有控制面损坏、危险写入或需要人工确认时才停止链路。
+当前迁移阶段由本 skill 作为链路编排器：按 `next_step.skill` 依次调用各技能、传递上一技能的产物与诊断、再决定下一技能。Core 的 contract/checker/output/review 硬门禁暂不参与阻断；Core 结果只作为事实和风险提示。真实操作无法完成时报告原因；CP 默认带警告继续，仅显式恢复确认时等待人工决定。
 </objective>
 
 <process>
@@ -55,10 +60,10 @@ pipeline 本身不包含执行规则——所有门禁、CP 协议、失败分
 
 - **`--track A`**：后端/API 轨道产物模式。可跑 `requirement-triage → requirement-wayfinder → domain-modeling → requirement-feasibility-review → requirement-baseline → api-contract → architecture-feasibility → backend-tech-spec → api-call-guide`，但不能自动进入 `integration-verify / change-plan / execute`。
 - **`--track B`**：前端/UI 轨道产物模式。要求 `api-contract` 与 `architecture-feasibility` 已完成；新需求从需求主链开始，已有共同事实可跑 `ui-spec → feature-breakdown → frontend-tech-spec`，但不能自动进入 `change-plan / execute`。
-- **未设置 track**：完整交付模式。必须完成双轨并通过 `integration-verify` 后才能进入 `change-plan`。
+- **未设置 track**：完整交付模式。完成双轨并执行 `integration-verify` 检查；未通过项作为风险传给 `change-plan`。
 - **`--no-review`**：保留参数位，但当前双轨 workflow 不自动跳过 CP-2。Merge Gate 不能跳过。
 
-双轨制原则：API 契约是分叉前的共同事实，`integration-verify` 是合并前的强门禁。单轨只产出局部轨道文档，不代表完整交付。
+双轨制原则：API 契约是分叉前的共同事实，`integration-verify` 是合并前的软门禁。单轨只产出局部轨道文档，不代表完整交付。
 
 `workflow-generate-mainflow-cases` 不是独立 workflow step，而是 `run-acceptance-tests` 绑定阶段的组成部分：对执行面为 `ui` / `api_flow` 且绑定为 `automated` 的 TC，必须先生成 v1 DSL 并经 `devflow_approval` 批准执行计划，否则该 TC 保持 blocked。人工 TC 结果同样只经 `human_result` 批准计入聚合门禁。
 
@@ -72,7 +77,7 @@ pipeline 本身不包含执行规则——所有门禁、CP 协议、失败分
 2. `workflow-wayfinder` 建立目标、已知事实、边界、迷雾与 ticket；只有活动切片的 L1/L2 迷雾收束后才可完成。
 3. `workflow-domain-modeling` 固化共同语言、所有权、状态和边缘案例。
 4. `requirement-feasibility-review` 以流程证明、代码事实和外部能力检查作为进入基线前的最终门禁。
-5. 仅当审查 meta 的 `baseline_gate = pass` 时，才可进入 `workflow-requirement-baseline`。
+5. 检查审查 meta 的 `baseline_gate`，未通过项保留为诊断并传给 `workflow-requirement-baseline`。
 
 若分诊结论为 `already_done`、`wontfix`、`ready_for_human` 或 `needs_info`，停止主链并报告最小下一步。`workflow-demand-clarify` 不再作为固定主链步骤；需要业务问答时，由 Wayfinder 的 Grilling ticket 调用。
 
@@ -113,7 +118,7 @@ devflow_state(action="inspect")
 
 ## 3. 委托 orchestrator
 
-在当前 `hard_gate_mode: chain` 下，pipeline 继续调用 `workflow-orchestrator` 获取步骤拓扑，但由本链路规则串联实际技能调用，不把 Core gate 的 `block` 结果当作自动停止条件：
+当前pipeline 继续调用 `workflow-orchestrator` 获取步骤拓扑，但由本链路规则串联实际技能调用，不把 Core gate 的 `block` 结果当作自动停止条件：
 
 ```
 /workflow-orchestrator

package/plugins/devflow-core/skills/workflow-pipeline/references/pipeline-flow.md

@@ -41,7 +41,7 @@ workflow-pipeline
   → 完成
 ```
 
-`workflow-generate-mainflow-cases` 不参与独立排序，而是 `run-acceptance-tests` 绑定阶段的组成部分：automated 的 ui / api_flow TC 需要先生成 v1 DSL 并批准执行计划。人工验收结果（经 `human_result` 批准）会与自动执行结果聚合，验收失败是硬门禁。
+`workflow-generate-mainflow-cases` 不参与独立排序，而是 `run-acceptance-tests` 绑定阶段的组成部分：automated 的 ui / api_flow TC 需要先生成 v1 DSL 并批准执行计划。人工验收结果（经 `human_result` 批准）会与自动执行结果聚合，验收失败是软门禁：保留 failed/blocked 结果与风险，默认不阻止流程推进或收口。
 
 ## 双轨与 Checkpoint 规则
 

package/plugins/devflow-core/skills/workflow-project-context/SKILL.md

@@ -3,6 +3,8 @@ name: workflow-project-context
 description: "Use when a project needs database-backed initialization, repository discovery, project facts, code indexing, navigation, or initialization recovery."
 ---
 
+门禁策略：默认软门禁，门禁行为以本段为准。本文及引用材料中的前置检查、审查、质量、完成条件和 CP 确认用于诊断；未满足时记录缺项、风险与后续处理，继续可执行的工作，不自动阻断阶段推进。保留真实的 failed/blocked/未审批状态，不把继续执行写成通过或人工批准。硬门禁及其恢复开关已移除。
+
 # Project Initialization
 
 Initialize project context only. Do not create requirements, approved API contracts, prototypes, roadmaps, commits, tags, repositories, or workflow state.

package/plugins/devflow-design/skills/workflow-api-call-guide/SKILL.md

@@ -3,6 +3,8 @@ name: workflow-api-call-guide
 description: "Use after backend-tech-spec, before integration-verify. Generates a step-by-step API call guide for frontend developers. This is NOT a change list — no code changes, just calling instructions based on the confirmed API contract and backend tech spec."
 ---
 
+门禁策略：默认软门禁，门禁行为以本段为准。本文及引用材料中的前置检查、审查、质量、完成条件和 CP 确认用于诊断；未满足时记录缺项、风险与后续处理，继续可执行的工作，不自动阻断阶段推进。保留真实的 failed/blocked/未审批状态，不把继续执行写成通过或人工批准。硬门禁及其恢复开关已移除。
+
 # API 调用指南
 
 ## 定位

package/plugins/devflow-design/skills/workflow-api-contract/SKILL.md

@@ -3,6 +3,8 @@ name: workflow-api-contract
 description: "Use after requirement-baseline, before dual-track fork. Defines shared API contracts (endpoints, request/response shapes, data models) that both Track A and Track B reference. This is the fork point — contract changes after this step are exception paths."
 ---
 
+门禁策略：默认软门禁，门禁行为以本段为准。本文及引用材料中的前置检查、审查、质量、完成条件和 CP 确认用于诊断；未满足时记录缺项、风险与后续处理，继续可执行的工作，不自动阻断阶段推进。保留真实的 failed/blocked/未审批状态，不把继续执行写成通过或人工批准。硬门禁及其恢复开关已移除。
+
 # API 契约生成器
 
 ## 定位
@@ -27,7 +29,7 @@ description: "Use after requirement-baseline, before dual-track fork. Defines sh
 - `.devflow/planning/features/{功能名}/api-contract.md`
 - `.devflow/planning/features/{功能名}/api-contract.meta.json`
 
-The meta file must also set `traceability_status: "passed"` only after every API design has been written to `traceability.json.designs` and `traceability_check.py --stage design` succeeds; otherwise set `failed` and do not advance.
+The meta file must also set `traceability_status: "passed"` only after every API design has been written to `traceability.json.designs` and `traceability_check.py --stage design` succeeds; otherwise set `failed`, record the traceability gaps, and continue with these advisories in soft mode.
 
 ## 输入
 

package/plugins/devflow-design/skills/workflow-api-supplement/SKILL.md

@@ -3,6 +3,8 @@ name: workflow-api-supplement
 description: "Use when Track B (frontend-tech-spec) discovers API gaps that the shared API contract doesn't cover. This is an EXCEPTION PATH — not a normal pipeline step. Submits API supplement requests for Track A evaluation."
 ---
 
+门禁策略：默认软门禁，门禁行为以本段为准。本文及引用材料中的前置检查、审查、质量、完成条件和 CP 确认用于诊断；未满足时记录缺项、风险与后续处理，继续可执行的工作，不自动阻断阶段推进。保留真实的 failed/blocked/未审批状态，不把继续执行写成通过或人工批准。硬门禁及其恢复开关已移除。
+
 # API 补充需求（异常路径）
 
 ## 定位

package/plugins/devflow-design/skills/workflow-architecture-feasibility/SKILL.md

@@ -3,6 +3,8 @@ name: workflow-architecture-feasibility
 description: "Use after API contract and before frontend/backend technical specifications to compare implementation paths against confirmed workload facts and repository-static context. Use for async or scheduled work, batch operations, external calls, fanout, migrations, workload/SLA constraints, or when a feature may not fit the current framework and integrations."
 ---
 
+门禁策略：默认软门禁，门禁行为以本段为准。本文及引用材料中的前置检查、审查、质量、完成条件和 CP 确认用于诊断；未满足时记录缺项、风险与后续处理，继续可执行的工作，不自动阻断阶段推进。保留真实的 failed/blocked/未审批状态，不把继续执行写成通过或人工批准。硬门禁及其恢复开关已移除。
+
 # 架构可行性与方案比较
 
 生成一份由 Core 派生的架构简报；不把自由 Markdown 当作架构真相，也不把仓库声明当成生产容量。

package/plugins/devflow-design/skills/workflow-backend-tech-spec/SKILL.md

@@ -3,6 +3,8 @@ name: workflow-backend-tech-spec
 description: "Use when a requirement baseline needs a backend technical design, including API, data model, affected modules, integration points, and risks."
 ---
 
+门禁策略：默认软门禁，门禁行为以本段为准。本文及引用材料中的前置检查、审查、质量、完成条件和 CP 确认用于诊断；未满足时记录缺项、风险与后续处理，继续可执行的工作，不自动阻断阶段推进。保留真实的 failed/blocked/未审批状态，不把继续执行写成通过或人工批准。硬门禁及其恢复开关已移除。
+
 ## Legacy Command Metadata
 
 Original slash-command metadata retained only as workflow invocation guidance.
@@ -109,7 +111,7 @@ allowed-tools:
    - 是否对接了外部系统，需要统一的 Client 接口封装？
    - 是否有独立的配置、认证、错误处理逻辑？
    满足任一条件的，应在方案中定义能力接口（Client interface + 参数/结果结构体），参考已有 `pkg/wx_red_pack`、`pkg/wx_pay` 的模式设计。
-10. **执行被影响方探索**：读取 `references/affected-module-exploration.md`，对 baseline 第8.2节"关联历史功能/模块"表格列出的每个受影响模块，按清单逐项读取代码并产出：现状流程图、现有字段/方法表格、集成点列表、复用/扩展/新增决策。探索产出直接填入输出文档的"现有功能说明"（第四章）和"影响范围"（第六章）。**探索产出检查不通过，不得进入 Phase 3。**
+10. **执行被影响方探索**：读取 `references/affected-module-exploration.md`，对 baseline 第8.2节"关联历史功能/模块"表格列出的每个受影响模块，按清单逐项读取代码并产出：现状流程图、现有字段/方法表格、集成点列表、复用/扩展/新增决策。探索产出直接填入输出文档的"现有功能说明"（第四章）和"影响范围"（第六章）。**探索产出检查不通过时记录缺项与影响，可继续 Phase 3。**
 
 **关键：如果发现多个相似功能，必须询问用户使用哪个。**
 如果与 baseline 中的用户拍板结果冲突，停止并要求重新确认，不要自行改判。
@@ -156,7 +158,7 @@ allowed-tools:
 | FP-003 | OrderWorkflow（新建） | 新建独立模块 | 用户确认 |
 ```
 
-**门禁**：每个 FP 必须有 seam 确认记录，否则不得进入 Phase 3。
+**软门禁**：检查每个 FP 的 seam 确认记录，缺项记为待确认并传入 Phase 3。
 
 ### 第三阶段：生成文档
 
@@ -233,14 +235,14 @@ If an older baseline still points to root `features/{功能名}/`, treat that as
 12. **遵循最佳实践标杆** — 新功能的设计（分层、命名、错误处理、参数封装、测试模式）必须与项目内已有标杆功能保持一致，不得引入与项目验证过的成熟模式相悖的新模式。若需偏离，必须在方案中说明理由
 13. **能力抽象** — 新功能中具有独立复用价值的部分（外部集成、通用业务能力），必须抽象为 `pkg/` 级模块，定义清晰的 Client 接口和参数/结果结构体，形成可被后续功能消费的项目能力资产
 
-## 强制审查门禁（MANDATORY — 不可跳过）
+## 审查软门禁
 
 ### 反问审查
 
 - [ ] 每个不确定的接口设计、库表变更、Job 逻辑是否已向用户确认？（禁止猜测，禁止自行决定）
 - [ ] 涉及调用上游 API 的，是否已向用户索要接口文档并确认对接方案？（不可猜测 API 契约，包括 URL、认证、请求/响应结构、错误码）
 - [ ] 涉及的每个能力点（外部集成、业务逻辑、数据访问、工具方法），是否已在项目内完成复用搜索？**若已有封装却被绕过直接重写，方案不合格。**
-- [ ] `references/affected-module-exploration.md` 的探索产出检查是否全部通过？（现状流程图、字段/方法表格、集成点列表、复用/扩展/新增决策）**若不通过，必须先补充代码探索，不得继续写文档。**
+- [ ] `references/affected-module-exploration.md` 的探索产出检查是否全部通过？（现状流程图、字段/方法表格、集成点列表、复用/扩展/新增决策）**若不通过，记录待补充的代码探索与证据缺口，继续可完成的文档部分。**
 - [ ] 若 `.devflow/planning/code-index/` 存在，复用/影响范围/调用链/读写资源判断是否已查询 code-index 并回读源码 evidence？若未使用，是否说明缺失或过期原因？
 - [ ] 是否已找到项目内最佳实践标杆，并确认新功能的分层结构、命名、错误处理、参数封装模式与标杆一致？（若偏离，理由是否已写明？）
 - [ ] 新功能中具有独立复用价值的部分，是否已识别并抽象为 `pkg/` 级能力模块？接口定义、参数/结果结构体是否清晰？

package/plugins/devflow-design/skills/workflow-design-rule-pack/SKILL.md

@@ -3,6 +3,8 @@ name: workflow-design-rule-pack
 description: Use when workflow-ui-spec or workflow-frontend-tech-spec needs a reusable UI/UX design rule package, ui-ux-pro-max recommendations, or project installation of .devflow/context/spec/design across repositories.
 ---
 
+门禁策略：默认软门禁，门禁行为以本段为准。本文及引用材料中的前置检查、审查、质量、完成条件和 CP 确认用于诊断；未满足时记录缺项、风险与后续处理，继续可执行的工作，不自动阻断阶段推进。保留真实的 failed/blocked/未审批状态，不把继续执行写成通过或人工批准。硬门禁及其恢复开关已移除。
+
 # Workflow Design Rule Pack
 
 This skill provides the reusable source for the project design rule package consumed by `workflow-ui-spec` and `workflow-frontend-tech-spec`.

package/plugins/devflow-design/skills/workflow-feature-breakdown/SKILL.md

@@ -3,6 +3,8 @@ name: workflow-feature-breakdown
 description: "Use when a requirement baseline needs a test-readable feature breakdown across style, functionality, logic, pages, components, fields, actions, and dialogs."
 ---
 
+门禁策略：默认软门禁，门禁行为以本段为准。本文及引用材料中的前置检查、审查、质量、完成条件和 CP 确认用于诊断；未满足时记录缺项、风险与后续处理，继续可执行的工作，不自动阻断阶段推进。保留真实的 failed/blocked/未审批状态，不把继续执行写成通过或人工批准。硬门禁及其恢复开关已移除。
+
 ## Legacy Command Metadata
 
 Original slash-command metadata retained only as workflow invocation guidance.

package/plugins/devflow-design/skills/workflow-frontend-tech-spec/SKILL.md

@@ -3,6 +3,8 @@ name: workflow-frontend-tech-spec
 description: "Use when a requirement baseline and UI specification need a frontend technical design covering routes, components, state, APIs, reuse, and risks."
 ---
 
+门禁策略：默认软门禁，门禁行为以本段为准。本文及引用材料中的前置检查、审查、质量、完成条件和 CP 确认用于诊断；未满足时记录缺项、风险与后续处理，继续可执行的工作，不自动阻断阶段推进。保留真实的 failed/blocked/未审批状态，不把继续执行写成通过或人工批准。硬门禁及其恢复开关已移除。
+
 ## Legacy Command Metadata
 
 Original slash-command metadata retained only as workflow invocation guidance.
@@ -89,7 +91,7 @@ allowed-tools:
 8. 查找 UI 组件库、设计系统、样式方案、状态管理和权限控制模式
 9. 识别技术栈插槽：React、Next.js、Vue 或仅 Common Web，并记录未覆盖的框架为待确认/待扩展
 10. 检查三层复用机会：已有页面/组件/交互模式、已有依赖/库、项目设计系统或代码模式；与 baseline 的复用决策保持一致
-11. **执行被影响方探索**：读取 `references/affected-module-exploration.md`，对 baseline 第8.2节"关联历史功能/模块"表格列出的每个受影响的前端页面/组件，按清单逐项读取源码并产出：现有 props/emits/methods/API 调用清单、现有数据流和交互方式、保留/分支/抽离/新增决策。探索产出直接填入输出文档的"影响范围"章节和组件树。**探索产出检查不通过，不得进入 Phase 3。**
+11. **执行被影响方探索**：读取 `references/affected-module-exploration.md`，对 baseline 第8.2节"关联历史功能/模块"表格列出的每个受影响的前端页面/组件，按清单逐项读取源码并产出：现有 props/emits/methods/API 调用清单、现有数据流和交互方式、保留/分支/抽离/新增决策。探索产出直接填入输出文档的"影响范围"章节和组件树。**探索产出检查不通过时记录缺项与影响，可继续 Phase 3。**
 12. 如 `.devflow/context/spec/design/tools/ui-ux-pro-max/scripts/search.py` 存在，可按当前技术栈和 UI 场景补充查询：
     ```bash
     python3 .devflow/context/spec/design/tools/ui-ux-pro-max/scripts/search.py "layout form table accessibility performance" --stack react
@@ -154,7 +156,7 @@ allowed-tools:
 | OrderDetail | 新建 | props: 3 / events: 2 | ✅ 深 | 保持小接口 |
 ```
 
-**门禁**：每个界面/组件必须有 seam 决策记录（复用/扩展/新建），否则不得进入 Phase 3。
+**软门禁**：检查每个界面/组件的 seam 决策记录（复用/扩展/新建），缺项记为待确认并传入 Phase 3。
 
 1. 创建 `.devflow/planning/features/{功能名}/` 目录
 2. 读取 `assets/frontend-spec-template.md` 模板
@@ -192,12 +194,12 @@ If an older baseline still points to root `features/{功能名}/`, treat that as
 11. 与历史相关的判断优先来自 `.devflow/planning/milestones/`、`.devflow/planning/requirements/`、`.devflow/planning/lessons/` 和阶段 `CONTEXT.md`；`features/` 或 `.devflow/context/lessons/` 只作为目标项目存在时的兼容来源
 12. 设计规则优先级为：用户拍板/设计稿事实/需求基线 > 现有代码与项目 token > `.devflow/context/spec/design/tokens/project-tokens.md` > `.devflow/context/spec/design/recommendations/` 与 `ui-ux-pro-max` 推荐。推荐项未经用户确认不得进入实现任务。
 
-## 强制审查门禁（MANDATORY — 不可跳过）
+## 审查软门禁
 
 ### 反问审查
 
 - [ ] 每个不确定的组件选择、路由设计、状态处理是否已向用户确认？（禁止猜测）
-- [ ] `references/affected-module-exploration.md` 的探索产出检查是否全部通过？（现有 props/emits/methods/API 调用清单、保留/分支/抽离/新增决策）**若不通过，必须先补充代码探索，不得继续写文档。**
+- [ ] `references/affected-module-exploration.md` 的探索产出检查是否全部通过？（现有 props/emits/methods/API 调用清单、保留/分支/抽离/新增决策）**若不通过，记录待补充的代码探索与证据缺口，继续可完成的文档部分。**
 - [ ] 若 `.devflow/planning/code-index/` 存在，受影响页面/组件/API/store 的关系定位是否已查询 code-index 并回读源码 evidence？若未使用，是否说明缺失或过期原因？
 - [ ] 方案影响的现有页面/组件是否已描述其**现状**？（先描述现状，再分析影响）
 - [ ] loading/empty/error/permission/disabled/duplicate/responsive 等状态是否均已覆盖或标记待确认？

package/plugins/devflow-design/skills/workflow-integration-verify/SKILL.md

@@ -3,6 +3,8 @@ name: workflow-integration-verify
 description: "Use after both Track A (api-call-guide) and Track B (frontend-tech-spec) complete. Performs Merge Gate verification: cross-check backend API implementation against the API contract and frontend's API calling patterns. Outputs an integration report."
 ---
 
+门禁策略：默认软门禁，门禁行为以本段为准。本文及引用材料中的前置检查、审查、质量、完成条件和 CP 确认用于诊断；未满足时记录缺项、风险与后续处理，继续可执行的工作，不自动阻断阶段推进。保留真实的 failed/blocked/未审批状态，不把继续执行写成通过或人工批准。硬门禁及其恢复开关已移除。
+
 # 联调验证（Merge Gate）
 
 ## 定位
@@ -114,7 +116,7 @@ description: "Use after both Track A (api-call-guide) and Track B (frontend-tech
 1. 将后端、前端、UI、API 契约中的设计项写入 `traceability.json.designs`，每项以 `requirements: ["REQ-…"]` 回指来源。
 2. 所有 API 类型设计必须在 `contract` 中同时写 `request`、`response`、`errors`、`behavior`；禁止只对齐响应字段。
 3. 执行 `python3 <workflow-orchestrator>/scripts/traceability_check.py --file .devflow/planning/requirements/{feature}/traceability.json --stage design`。
-4. 结果不为 passed 时，`merge_gate_status` 必须为 failed，`blocking_issue_count` 必须大于 0，回到对应方案修复；不得进入变更清单。
+4. 结果不为 passed 时，`merge_gate_status` 必须为 failed，`blocking_issue_count` 必须大于 0，建议回到对应方案修复；默认携带未解决项进入变更清单。
 
 ## 产出模板
 

package/plugins/devflow-design/skills/workflow-ui-spec/SKILL.md

@@ -3,6 +3,8 @@ name: workflow-ui-spec
 description: "Use when UI designs, screenshots, Figma exports, Lanhu notes, or manual UI descriptions need a structured UI specification."
 ---
 
+门禁策略：默认软门禁，门禁行为以本段为准。本文及引用材料中的前置检查、审查、质量、完成条件和 CP 确认用于诊断；未满足时记录缺项、风险与后续处理，继续可执行的工作，不自动阻断阶段推进。保留真实的 failed/blocked/未审批状态，不把继续执行写成通过或人工批准。硬门禁及其恢复开关已移除。
+
 ## Legacy Command Metadata
 
 Original slash-command metadata retained only as workflow invocation guidance.
@@ -262,7 +264,7 @@ UI-SPEC 不写代码细节（那是前端技术方案的事），但必须把 UI
 ## 10. 审查结论
 ```
 
-## 强制审查门禁
+## 审查软门禁
 
 ### 设计完整性
 
@@ -299,4 +301,4 @@ UI-SPEC 不写代码细节（那是前端技术方案的事），但必须把 UI
 | 冲突嗅探 | 设计 Token 是否与现有变量命名/值冲突？ |
 | 需求对齐 | 设计稿中的交互是否与需求基线的用户拍板决策一致？ |
 
-**审查结论不通过时，不得进入功能点梳理阶段。**
+**审查结论不通过时，记录问题与影响，携带诊断进入功能点梳理阶段。**

package/plugins/devflow-implementation/agents/implementation-worker.md

@@ -18,14 +18,8 @@ autoloadSkills:
 
 Implement only the assigned plan slice. Do not re-plan the feature, compare alternatives, or explore unrelated modules. Read only the approved files, their immediate dependencies, and the focused tests needed for this slice. Preserve unrelated work and report deviations instead of silently expanding scope.
 
-Before any protected source access, read the project's required code-index evidence
-files in the exact order listed by INDEX_GATE (typically `.devflow/planning/code-index/INDEX.md`
-followed by the ordered files named by the gate). Do not attempt `grep`, `rg`, or source
-reads first: each subagent has its own evidence session and cannot inherit the parent's
-observations. If the gate lists different files, follow that list exactly.
+Read relevant code-index evidence when available; each subagent has its own evidence session. In default soft mode, a missing/stale index or execution contract is an advisory: report the gap and use bounded source reads to continue the assigned work. Missing or contradictory business facts remain explicit uncertainties. Report INDEX_GATE findings and any unavailable or conflicting execution contract, then continue executable work. Run the smallest focused validation once and report its actual result.
 
-If the execution contract is missing, ambiguous, or contradicted by the code, stop before editing and return `STATUS: escalate` with the conflicting evidence. Run the smallest focused validation once; report failures rather than repeatedly trying speculative fixes.
-
-For a task whose frozen `test-bindings.json` marks `test_mode: tdd_required`, use the Core tool in this exact order: `devflow_tdd_evidence(action="prepare")` before changing declared production paths; create/change the test and record `red`; implement; record `green`; then record `regression`. Do not mark the task done if any phase is missing or fails. The tool may write only its own Core-owned TDD evidence record; this exception does not authorize edits to any other Devflow control-plane file.
+For a task whose frozen `test-bindings.json` marks `test_mode: tdd_required`, use the Core tool in this exact order: `devflow_tdd_evidence(action="prepare")` before changing declared production paths; create/change the test and record `red`; implement; record `green`; then record `regression`. If any phase is missing or fails, preserve that result and report the evidence gap; default soft mode permits subsequent work without claiming TDD passed. The tool may write only its own Core-owned TDD evidence record; this exception does not authorize edits to any other Devflow control-plane file.
 
 Return `STATUS`, changed files, validation evidence, and one escalation/blocker if needed. Never edit `.devflow/planning/STATE.md`, `.devflow/planning/artifacts/index.yaml`, workflow definitions, or checkpoint decisions; the parent session owns those through Devflow tools.