@guanlin4924/devflow-pi 0.1.18 → 0.1.20

package/plugins/devflow-core/skills/workflow-orchestrator/templates/feature-development.yaml

@@ -32,6 +32,7 @@ governance:
     api-contract:
       - requirement-graph-check
       - contract-coverage-check
+      - api-test-schema-check
       - change-impact-check
     architecture-feasibility:
       - requirement-graph-check
@@ -41,13 +42,34 @@ governance:
       - slice-independence-check
       - contract-coverage-check
       - change-impact-check
+    acceptance-test-design:
+      - requirement-graph-check
+      - contract-coverage-check
+      - acceptance-coverage-check
+      - api-test-matrix-check
+      - test-coverage-check
+      - test-obligation-check
+      - change-impact-check
     change-plan:
       - requirement-graph-check
       - slice-independence-check
       - contract-coverage-check
+      - api-test-matrix-check
+      - test-coverage-check
+      - test-obligation-check
+      - test-task-binding-check
+      - change-impact-check
+    execute:
+      - tdd-evidence-check
+      - change-impact-check
+    run-acceptance-tests:
+      - api-test-matrix-check
+      - test-coverage-check
+      - acceptance-test-results-check
       - change-impact-check
     verify:
       - acceptance-coverage-check
+      - acceptance-test-results-check
       - change-impact-check
 
 artifact_registry:
@@ -250,7 +272,7 @@ checkpoints:
       - approve
       - needs_fix
     skip_policy: never
-    resume_behavior: "user confirms, then continue with change-plan"
+    resume_behavior: "user confirms, then derive the independent acceptance test suite before change-plan"
   CP-3:
     name: Change plan confirmation
     gate_after: change-plan
@@ -263,13 +285,21 @@ checkpoints:
       - traceability_status
       - uncovered_requirement_count
       - orphan_task_count
+      - test_case_count
+      - test_coverage_status
+      - candidate_test_suite_graph_revision
+      - candidate_test_suite_fingerprint
     summary_fields:
       - task_count
       - ddl_count
       - migration_steps
       - verification_steps
+      - test_case_count
+      - automated_test_case_count
+      - manual_test_case_count
+      - blocked_test_case_count
       - risks
-    prompt: "确认变更清单中的 DDL、代码任务、上线步骤和验收标准可执行；每项 REQ 都有任务、每项任务都有 REQ 来源，并允许进入代码执行。"
+    prompt: "确认变更清单、冻结的 TC 验收测试集和 TDD/专项测试义务均可执行；每项 REQ 都有任务、每项 TC 都有实现责任，并允许进入代码执行。"
     confirm_options:
       - approve
       - needs_fix
@@ -678,25 +708,73 @@ steps:
     label: Change plan
     skill: workflow-change-plan
     depends_on:
-      - integration-verify
+      - acceptance-test-design
     inputs:
       - ".planning/features/{feature}/api-contract.md"
       - ".planning/features/{feature}/integration-report.md"
       - ".planning/features/{feature}/前端技术方案.md"
       - ".planning/features/{feature}/后端技术方案.md"
       - ".planning/features/{feature}/功能点梳理.md"
+      - ".planning/features/{feature}/验收测试设计.md"
+      - ".planning/requirements/{feature}/tests.json"
     outputs:
       - path: ".planning/features/{feature}/变更清单.md"
         type: change-plan
         required: true
+      - path: ".planning/features/{feature}/test-bindings.json"
+        type: test-task-bindings
+        required: true
     meta_output:
       path: ".planning/features/{feature}/变更清单.meta.json"
       fields:
         traceability_status: { type: string, required: true }
         uncovered_requirement_count: { type: integer, required: true }
         orphan_task_count: { type: integer, required: true }
+        test_case_count: { type: integer, required: true }
+        test_coverage_status: { type: string, required: true }
+        candidate_test_suite_graph_revision: { type: integer, required: true }
+        candidate_test_suite_fingerprint: { type: string, required: true }
     checkpoint: CP-3
 
+  - id: acceptance-test-design
+    order: 59
+    label: Acceptance test design
+    skill: workflow-acceptance-test-design
+    depends_on:
+      - integration-verify
+    inputs:
+      - ".planning/requirements/{feature}/governance.json"
+      - ".planning/requirements/{feature}/tests.json"
+      - ".planning/features/{feature}/integration-report.md"
+      - ".planning/features/{feature}/api-contract.md"
+      - ".planning/features/{feature}/UI-SPEC.md"
+      - ".planning/features/{feature}/前端技术方案.md"
+      - ".planning/features/{feature}/后端技术方案.md"
+      - ".planning/toolchain.md"
+    outputs:
+      - path: ".planning/features/{feature}/验收测试设计.md"
+        type: acceptance-test-design
+        required: true
+      - path: ".planning/requirements/{feature}/tests.json"
+        type: acceptance-test-suite
+        required: true
+      - path: ".planning/requirements/{feature}/api-test-matrix.json"
+        type: api-test-matrix
+        required: true
+      - path: ".planning/features/{feature}/完整API验收测试用例.md"
+        type: api-test-cases-view
+        required: true
+    meta_output:
+      path: ".planning/features/{feature}/验收测试设计.meta.json"
+      fields:
+        test_case_count: { type: integer, required: true }
+        automated_test_case_count: { type: integer, required: true }
+        manual_test_case_count: { type: integer, required: true }
+        blocked_test_case_count: { type: integer, required: true }
+        test_coverage_status: { type: string, required: true }
+        candidate_test_suite_graph_revision: { type: integer, required: true }
+        candidate_test_suite_fingerprint: { type: string, required: true }
+
   - id: phase-structure
     order: 70
     label: Phase structure
@@ -705,6 +783,7 @@ steps:
       - change-plan
     inputs:
       - ".planning/features/{feature}/变更清单.md"
+      - ".planning/features/{feature}/test-bindings.json"
     outputs:
       - path: ".planning/ROADMAP.md"
         type: roadmap
@@ -788,7 +867,7 @@ steps:
       - ".planning/features/{feature}/后端技术方案.md"
       - ".planning/features/{feature}/变更清单.md"
       - ".planning/features/{feature}/PROGRESS.md"
-      - ".planning/phases/{phase}/SUMMARY.md"
+      - ".planning/requirements/{feature}/tests.json"
     outputs:
       - path: ".planning/generated-cases/{feature}/source-map.md"
         type: mainflow-source-map
@@ -809,6 +888,25 @@ steps:
         type: mainflow-cases-summary
         required: true
 
+  - id: run-acceptance-tests
+    order: 88
+    label: Run frozen acceptance tests
+    skill: workflow-run-acceptance-tests
+    depends_on:
+      - code-review
+    inputs:
+      - ".planning/requirements/{feature}/tests.json"
+      - ".planning/code-index/index.sqlite"
+      - ".planning/code-index/relations.jsonl"
+      - ".planning/phases/{phase}/REVIEW.md"
+    outputs:
+      - path: ".planning/features/{feature}/acceptance-test-bindings.json"
+        type: acceptance-test-bindings
+        required: true
+      - path: ".planning/test-runs/{feature}/acceptance-results.json"
+        type: acceptance-test-results
+        required: true
+
   - id: verify
     order: 90
     label: Verify
@@ -816,12 +914,14 @@ steps:
     depends_on:
       - code-review
       - generate-mainflow-cases
+      - run-acceptance-tests
     inputs:
       - ".planning/features/{feature}/PROGRESS.md"
       - ".planning/phases/{phase}/SUMMARY.md"
       - ".planning/phases/{phase}/MAINFLOW-CASES.md"
       - ".planning/generated-cases/{feature}/validation-report.md"
       - ".planning/generated-cases/{feature}/case-import-payloads.json"
+      - ".planning/test-runs/{feature}/acceptance-results.json"
     outputs:
       - path: ".planning/phases/{phase}/01-UAT.md"
         type: uat-report
@@ -837,6 +937,11 @@ steps:
         uat_skipped: { type: integer, required: true }
         gate_passed: { type: integer, required: true }
         gate_total: { type: integer, required: true }
+        acceptance_tc_passed: { type: integer, required: true }
+        acceptance_tc_failed: { type: integer, required: true }
+        acceptance_tc_blocked: { type: integer, required: true }
+        acceptance_suite_graph_revision: { type: integer, required: true }
+        acceptance_results_fingerprint: { type: string, required: true }
         known_issues: { type: array, required: true }
     checkpoint: CP-4
 

package/plugins/devflow-core/skills/workflow-orchestrator/templates/uat-remediation.yaml

@@ -40,6 +40,7 @@ state_contract:
       - diagnose
       - execute-fix
       - code-index-refresh
+      - run-acceptance-tests
       - reverify
       - lesson
 
@@ -76,6 +77,7 @@ steps:
       - ".planning/phases/{phase}/01-VERIFICATION.md"
       - ".planning/phases/{phase}/SUMMARY.md"
       - ".planning/features/{feature}/PROGRESS.md"
+      - ".planning/test-runs/{feature}/acceptance-results.json"
       - ".planning/artifacts/index.yaml"
     outputs:
       - path: ".planning/phases/{phase}/REMEDIATION.md"
@@ -120,10 +122,11 @@ steps:
     label: Reverify
     skill: workflow-verify-work
     depends_on:
-      - code-index-refresh
+      - run-acceptance-tests
     inputs:
       - ".planning/phases/{phase}/REMEDIATION-SUMMARY.md"
       - ".planning/features/{feature}/PROGRESS.md"
+      - ".planning/test-runs/{feature}/acceptance-results.json"
     outputs:
       - path: ".planning/phases/{phase}/01-UAT.md"
         type: uat-report
@@ -133,6 +136,23 @@ steps:
         required: true
     checkpoint: CP-4
 
+  - id: run-acceptance-tests
+    order: 28
+    label: Re-run frozen acceptance tests
+    skill: workflow-run-acceptance-tests
+    depends_on:
+      - code-index-refresh
+    inputs:
+      - ".planning/requirements/{feature}/tests.json"
+      - ".planning/features/{feature}/acceptance-test-bindings.json"
+      - ".planning/test-runs/{feature}/acceptance-results.json"
+      - ".planning/code-index/index.sqlite"
+      - ".planning/code-index/AUDIT.md"
+    outputs:
+      - path: ".planning/test-runs/{feature}/acceptance-results.json"
+        type: acceptance-test-results
+        required: true
+
   - id: lesson
     order: 40
     label: Record lesson if needed

package/plugins/devflow-design/skills/workflow-api-contract/SKILL.md

@@ -47,6 +47,44 @@ The meta file must also set `traceability_status: "passed"` only after every API
 5. **切片对齐** — 若 baseline 包含 `SL-*`，先读取 `skill://workflow-pipeline/references/slice-safety-guide.md`，只为当前执行切片定义 API。后置切片接口不得提前进入契约。
 6. **既有接口优先查事实索引** — 当 `.planning/code-index/` 存在时，先用 Symbol/Relation 定位候选接口、调用方和处理器，再读取源码证据；缺失或过期时再按 navigation 和 `rg` 兜底。
 
+## 可测试 API 契约（强制）
+
+每个 `api` 图谱节点除现有 `request/response/errors` 摘要外，必须提交 `test_schema`。它是字段边界、pairwise 组合和错误码用例的机器事实源；只有 Markdown 中的“string (max 100)”不够，不能作为可冻结测试的输入。
+
+在本步骤通过 `devflow_requirement_graph(action="propose")` 提交 `kind: "api"` 候选，并把 `requirement_refs`、`behavior_ref` 与本文档中的契约摘要、`test_schema` 一并写入；按项目图谱约定连接相关 REQ/BEH。**不要**调用 `confirm`：用户批准 `CP-API` 时，Core 会原子地确认完整 API 候选。没有图谱 API 节点的 no-op 契约仍正常通过。
+
+`test_schema` 使用受控键名（避免与图谱保留键冲突）：
+
+```json
+{
+  "schema_version": 1,
+  "method": "POST",
+  "path": "/api/v1/orders",
+  "preconditions": ["专用测试租户和测试身份已准备"],
+  "valid_request": { "body": { "email": "buyer@example.com", "quantity": 1 } },
+  "success": { "http_status": 201 },
+  "fields": [{
+    "field_key": "email", "location": "body", "pointer": "/email",
+    "type": "string", "required": true, "nullable": false,
+    "constraints": { "min_length": 5, "max_length": 64, "format": "email" },
+    "coverage": {
+      "pattern": { "state": "not_applicable", "reason": "email format 是唯一语法约束" },
+      "enum": { "state": "not_applicable", "reason": "自由输入，不是枚举" }
+    }
+  }],
+  "errors": [{
+    "error_key": "invalid-email", "code": "INVALID_EMAIL", "http_status": 422,
+    "covers": ["email:missing", "email:null", "email:wrong_type", "email:below_min_length", "email:above_max_length", "email:invalid_format"]
+  }]
+}
+```
+
+- 每个字段必须声明其类型相关边界；确实没有的约束只能写 `coverage.<边界>.state: not_applicable` 并给出理由，不能静默跳过。
+- `valid_request` 是完整有效基准请求，所有字段通过 `location + pointer` 指向其中的值；`fields` 用 `field_key`，错误目录用 `error_key`，HTTP 状态统一用 `http_status`。
+- 有最小/最大约束时，生成器会把恰好最小、恰好最大纳入有效等价类和 pairwise，再生成刚越界反例；字段同时有长度/范围与 `format`、`pattern` 或 `enum` 时，必须在 `examples` 提供对应的 `at_*`、`below_*` / `above_*` 隔离值。生成器不会用一个同时破坏格式和长度的假数据去冒充“只验证最大长度”。
+- `errors[].covers` 把每个负向分区精确映射到一个错误码；非字段错误使用 `scenario: { preconditions, request_mutations }`。每个错误目录项二选一，不能既没有覆盖分区也没有可重放场景。
+- 设计时不自行编造约束、最大长度或错误码。缺少这些业务事实时必须回流为待决问题，后续验收测试不会冻结。
+
 ## 产出模板
 
 ```

package/plugins/devflow-implementation/agents/implementation-worker.md

@@ -9,6 +9,7 @@ tools:
   - bash
   - edit
   - write
+  - devflow_tdd_evidence
 model: "@task"
 thinkingLevel: medium
 autoloadSkills:
@@ -19,4 +20,6 @@ Implement only the assigned plan slice. Do not re-plan the feature, compare alte
 
 If the execution contract is missing, ambiguous, or contradicted by the code, stop before editing and return `STATUS: escalate` with the conflicting evidence. Run the smallest focused validation once; report failures rather than repeatedly trying speculative fixes.
 
+For a task whose frozen `test-bindings.json` marks `test_mode: tdd_required`, use the Core tool in this exact order: `devflow_tdd_evidence(action="prepare")` before changing declared production paths; create/change the test and record `red`; implement; record `green`; then record `regression`. Do not mark the task done if any phase is missing or fails. The tool may write only its own Core-owned TDD evidence record; this exception does not authorize edits to any other Devflow control-plane file.
+
 Return `STATUS`, changed files, validation evidence, and one escalation/blocker if needed. Never edit `.planning/STATE.md`, `.planning/artifacts/index.yaml`, workflow definitions, or checkpoint decisions; the parent session owns those through Devflow tools.

package/plugins/devflow-implementation/skills/workflow-change-plan/SKILL.md

@@ -59,6 +59,7 @@ description: "Use after workflow-integration-verify has passed or produced an ap
 6. 读取 baseline.md 的审查结论和风险标记
 7. 若输入包含 `SL-*` 切片计划，读取 `skill://workflow-pipeline/references/slice-safety-guide.md`，只生成当前执行切片的任务。后置切片只能写入风险/后续范围，不得生成实现任务。
 8. 读取 `.planning/requirements/{feature}/traceability.json`；它是任务覆盖判断的唯一 REQ 清单，不能仅凭技术方案标题推断覆盖。
+9. 读取候选态的 `.planning/requirements/{feature}/tests.json`。它定义本次验收意图；不得从实现摘要或预期代码结构补造测试范围。该测试意图会与变更清单一起在 CP-3 冻结。
 
 ### 第二阶段：扫描项目上下文
 
@@ -71,6 +72,8 @@ description: "Use after workflow-integration-verify has passed or produced an ap
 
 输出到 `.planning/features/{feature}/变更清单.md`。
 
+同时输出 `.planning/features/{feature}/test-bindings.json`。这是受控的任务—验收用例绑定。生成时它必须使用 `schema_version: 2` 与 `candidate_test_suite: { graph_revision, fingerprint }`，并通过 `test_task_binding_check.py --feature {feature} --stage candidate --json`。每个代码任务必须关联一个或多个候选 `TC-*`，并指定 `tdd_required`、`contract_first`、`integration_only` 或 `manual_justified` 测试模式；非 TDD 模式必须说明原因。`tdd_required` 还必须给出同一测试目标的 RED/GREEN 命令、RED 的预期失败标记、回归命令和生产代码路径。CP-3 会在同一次确认中核验候选绑定、冻结 TC 并写入 Core attestation；之后执行阶段以 `--stage frozen` 校验。所有 Core 实际执行的命令必须是无 shell 的 argv，且 runner 已在初始化生成的 `.planning/toolchain.md` 中被发现；不能用 `python -c`、`node -e` 或任意脚本解释器绕过。
+
 同时输出 `.planning/features/{feature}/变更清单.meta.json`。只有 `traceability_check.py --stage change-plan` 成功时才允许写入 `traceability_status: "passed"`；`uncovered_requirement_count` 和 `orphan_task_count` 必须为 0。
 
 ## 输出结构
@@ -118,6 +121,10 @@ description: "Use after workflow-integration-verify has passed or produced an ap
 - **相关经验教训**：lesson ID 或"无"
 - **执行前门禁**：编码前必须确认的事项（无则写"无"）
 - **测试策略**：单元/集成/人工测试策略简述
+- **测试模式**：`tdd_required` / `contract_first` / `integration_only` / `manual_justified`
+- **保障的验收用例**：冻结的 `TC-*`；不得凭实现结果新增或删除
+- **实现测试**：`UT-*` / `IT-*` 或测试文件与精确命令
+- **TDD 证据**：当模式为 `tdd_required`，填写 RED/GREEN/REGRESSION 命令、RED 预期失败标记和生产代码路径；其他模式填写不能 TDD 的理由
 - **审查要求**：变更清单一致性、规范审查、兼容性检查
 - **变更内容**：（具体描述改什么，精确到类名/方法名/字段名，禁止 TBD/TODO）
 - **完成标准**：（每条必须使用 `- [ ]` checkbox 格式，可被 code_review 门禁自动验证）

package/plugins/devflow-implementation/skills/workflow-change-plan/references/output-template.md

@@ -18,6 +18,8 @@
 >
 > 完成标准在执行阶段由 `code_review` 门禁自动逐条验证。每条标准必须描述**可通过静态代码分析验证的具体条件**（精确到类名/方法名/字段名/返回值/文件行），不得使用"确保功能正确"、"用户体验良好"等模糊描述。标准模糊的条目将被标记为 `⚠️ UNVERIFIABLE`，无法通过自动化验证。
 
+> **验收测试绑定：** 除 Markdown 外，必须生成 schema v2 的 `test-bindings.json`。它将每个任务绑定到候选 `TC-*`，并以 `candidate_test_suite: { graph_revision, fingerprint }` 固定候选测试意图；它必须通过 `test_task_binding_check.py --stage candidate`。CP-3 在同一次用户确认中验证该绑定、冻结 TC，并写入 Core-owned `test-suite-freeze.json`；之后才可按 `--stage frozen` 进入执行。所有 `tdd_required` 任务必须声明相同测试目标的 RED/GREEN 命令、RED 失败标记、回归命令与生产代码路径。
+
 ---
 
 ```markdown

package/plugins/devflow-implementation/skills/workflow-execute-phase/SKILL.md

@@ -128,7 +128,7 @@ The worker must not treat existing code as more authoritative than explicit proj
 When the change list includes task-level `适用规范`, `相关经验教训`, `执行前门禁`, `测试策略`, or `审查要求`, those fields are mandatory execution inputs.
 When the change list includes `需求来源` or `CR-*` decision references, the worker must keep implementation inside those confirmed decisions and mention any deviation before editing.
 
-If a code task lacks a task-level test strategy, planned command, execution command placeholder, or skip-automation classification, the worker must stop before editing and report the task as blocked for change-list backfill. Do not invent a silent testing scope during implementation.
+If a code task lacks a task-level test strategy, planned command, execution command placeholder, skip-automation classification, or frozen `TC-*` binding, the worker must stop before editing and report the task as blocked for change-list backfill. Do not invent a silent testing scope during implementation.
 </rule_activation_gate>
 
 <execution_discipline>
@@ -137,7 +137,7 @@ Preserve these generalized workflow rules from the project rule package when app
 1. Do not skip required workflow steps or verification because a change looks small unless the user explicitly approved simplification.
 2. Before editing, activate the relevant rules, lessons, toolchain, tests, generated artifacts, and compatibility gates for the task.
 3. Execute in dependency order derived from the change list and project architecture; do not hardcode outbound-call's Go layer order for non-Go projects.
-4. Tests can be written before code (TDD) or incrementally within the same task, but task-level tests must not be deferred to a final standalone test wave.
+4. For every `tdd_required` task, call `devflow_tdd_evidence(action="prepare")` before changing its declared production paths; then record `red`, implement, record `green`, and record `regression`. A missing or failed stage means the task is blocked, not complete. Other modes must retain their declared non-TDD reason and still execute their implementation tests.
 5. Before marking a code task complete, add/update the required task-level tests unless the change list contains an acceptable or reviewed skip classification.
 6. Refine planning-level test commands into execution-level commands that are precise enough to rerun the changed tests, then run them and record the result.
 7. **Verification Iron Law** — Before marking ANY task complete, pass the verification gate:
@@ -256,7 +256,7 @@ Preserve these generalized workflow rules from the project rule package when app
 - 所需文件路径和变更类型（新增/修改/删除）
 - 参考实现位置
 - 适用规范编号
-- 测试策略、规划级命令、执行级命令占位或跳过自动化测试分级
+- 测试策略、冻结的 `TC-*` 绑定、测试模式、规划级命令、执行级命令占位或跳过自动化测试分级
 - 完成验证命令和执行结果记录要求
 
 执行者仅凭任务描述 + 当前代码文件即可完成，无需回看整个变更清单或技术方案。

package/plugins/devflow-quality/skills/workflow-acceptance-test-design/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: workflow-acceptance-test-design
+description: "Use after integration verification and before change planning to derive a frozen, requirement-baseline-driven acceptance test suite (TC-*) for API, page, permission, boundary, resilience, migration, and performance verification."
+---
+
+# 验收测试设计
+
+在代码执行前，基于已确认的需求、契约和架构约束提出独立的 `TC-*` 验收测试候选。测试意图必须独立于实现：禁止读取 `SUMMARY.md`、实现源码、git diff 或 agent 交付自述来决定测试范围。
+
+## 输入
+
+按顺序读取：
+
+1. `devflow_requirement_graph(action="inspect")` 的已确认 `REQ/BR/BC/AC` 节点与当前 revision；
+2. `.planning/features/{feature}/integration-report.md`、API 契约、UI 方案、前后端技术方案；
+3. 当前图谱中的 `RISK/WSH/WLC/DECISION` 节点；
+4. `.planning/toolchain.md`、`.planning/execution-contract.md` 和项目测试能力。
+
+若需求、契约或架构事实不足以写出可观察 oracle，记录缺口并回流到上游；不得用实现猜测补全。
+
+## 生成规则
+
+先调用 `devflow_api_test_matrix(action="compile", feature="...")`（无 API 时也会写 no-op 测试资产），检查 `.planning/features/{feature}/完整API验收测试用例.md` 中的契约缺口；存在 `API-*` 时通过后调用 `devflow_api_test_matrix(action="import", feature="...")`。Core 会一次性生成并导入全部 API `TC-*`：
+
+- 每个字段的缺失、`null`、错误类型、最小/最大（长度、数值、数组项）、超长、非法格式/模式、非法枚举；
+- 仅由有效等价类构成的 pairwise 组合（负向值一项一测，避免错误码歧义）；
+- 错误目录中的每一个异常码场景。
+
+不得手写、删减或改写这些带 `generated_case_key` 的 API TC。缺少字段约束、错误码映射或可重放错误场景时，编译器会留下缺口并阻止本步骤/CP-3；不能以“接口已测主流程”替代。页面、权限、迁移、韧性和性能 TC 仍按下列规则单独提出。
+
+每个候选通过 `devflow_requirement_graph(action="propose")` 写入 `test_case`，并用 `verified_by` edge 从所有引用的 `REQ/BR/BC/AC` 指向 TC。候选必须包含：
+
+```json
+{
+  "acceptance_refs": ["AC-0001"],
+  "requirement_refs": ["REQ-0001", "BR-0001"],
+  "test_type": "api|page|permission|boundary|resilience|migration|performance",
+  "target": "外部可观察的 API、页面或运行边界",
+  "preconditions": ["身份、数据和环境前置条件"],
+  "steps": ["测试操作"],
+  "oracle": "可观察的预期结果",
+  "automation_mode": "automated|manual|blocked"
+}
+```
+
+- `manual` 额外写 `manual_reason` 和 `owner`；`blocked` 额外写 `blocked_by` 和 `owner`。
+- 当 TC 承接结构性专项义务时，额外带对应引用并建立同样的 `verified_by` edge：`api_refs`（API→`api`）、`workload_refs`（WSH/WLC→`performance` 或 `migration`）、`risk_refs`（架构 RISK→`resilience`）。跨数据域的 REQ 必须有 `permission` TC，BC 必须有 `boundary` TC。
+- 页面/API 的具体 selector、endpoint URL、测试数据和 runner 命令属于后续执行绑定，不得改变本步骤的步骤或 oracle。
+- 高风险边界、权限、迁移、外部依赖和工作负载事实必须产生相应 TC；`test-obligation-check` 是机器判定，不接受“无架构影响”的模型自述。环境未准备好只能标记 blocked，不得省略。
+
+## 输出
+
+写 `.planning/features/{feature}/验收测试设计.md` 作为派生视图，包含：TC 覆盖矩阵、自动/人工/阻塞数量、每项专项义务的 TC/环境前提和当前图谱 revision。写对应 `.meta.json`，其 revision/fingerprint 必须来自 Core 的 `tests.json` 视图。
+
+API 完整测试资产由 Core 额外写入：
+
+- `.planning/requirements/{feature}/api-test-matrix.json`：机器可读的请求、预期和派生义务；
+- `.planning/features/{feature}/完整API验收测试用例.md`：可审查的人类视图；
+- `.planning/features/{feature}/api-acceptance-bindings.template.json`：导入后的 TC 与 HTTP 执行绑定模板。
+
+运行 `devflow_requirement_graph(action="validate")` 和 machine evidence。通过后交给 `workflow-change-plan` 绑定实现任务。
+
+TC 会在 CP-3 用户批准时由 Core 一次性冻结；Skill 只能用 `devflow_acceptance_tests(feature="...")` 查看状态，不得自行确认 TC，也不得在冻结后修改其意图。

package/plugins/devflow-quality/skills/workflow-acceptance-test-design/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Acceptance Test Design"
+  short_description: "Design independent requirement-driven TC cases before coding"
+  default_prompt: "Use $workflow-acceptance-test-design to derive frozen acceptance tests from the confirmed baseline."

package/plugins/devflow-quality/skills/workflow-generate-mainflow-cases/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: workflow-generate-mainflow-cases
-description: "Use after workflow-execute-phase when code is implemented and the OMP development agent must generate importable positive API/UI mainflow automation cases from planning artifacts, project specifications, navigation files, and actual code."
+description: "Use after workflow-execute-phase to bind frozen API/page TC acceptance intent to importable positive mainflow automation cases."
 ---
 
 # 主流程自动化用例生成
@@ -13,6 +13,8 @@ description: "Use after workflow-execute-phase when code is implemented and the
 - MUST derive code roots from `.planning/navigation` and `.context/spec`.
 - MUST use `.planning/code-index/` for fine-grained entrypoint, route, component, API, call, import, and data-flow evidence when present.
 - MUST only generate `api-mainflow` and `ui-mainflow` cases.
+- MUST read the frozen `.planning/requirements/{feature}/tests.json` before selecting case scope. Only frozen positive `TC-*` with `test_type: api` or `page` may produce mainflow cases. Core-generated API TC carrying `execution.expect.error_code` is a negative/exception case and is excluded here; it is executed by `run-acceptance-tests`.
+- MUST NOT read `SUMMARY.md`, delivery self-reports, or diffs to decide what to test. Current code is allowed only to bind an already frozen TC to an entrypoint, selector, request, or runner adapter.
 - MUST run `scripts/compile_dsl.py` before final output.
 - MUST run `scripts/validate_case_payloads.py` before reporting success.
 - MUST block if codebase discovery fails.
@@ -60,7 +62,7 @@ Read these references before generating cases:
 
    Stop if it exits non-zero.
 
-3. Read planning inputs when present:
+3. Read the frozen TC suite first. Record the source `TC-*` for every selected mainflow case; a missing or stale source TC is a blocker. Then read planning inputs when present:
    - `.planning/requirements/baseline.md`
    - `.planning/features/{feature}/功能点梳理.md`
    - `.planning/features/{feature}/UI-SPEC.md`
@@ -68,7 +70,6 @@ Read these references before generating cases:
    - `.planning/features/{feature}/后端技术方案.md`
    - `.planning/features/{feature}/变更清单.md`
    - `.planning/features/{feature}/PROGRESS.md`
-   - `.planning/phases/{phase}/SUMMARY.md`
 
 4. Read discovery output, then read each discovered codebase's navigation and spec files. Select scan targets by codebase type:
    - Backend: router/controller, service/usecase, schema/dto/request/response, model/entity, API entry.
@@ -79,8 +80,8 @@ Read these references before generating cases:
    - Frontend/UI: route/page/component symbols, `routes_to`, `imports`, `calls` into API clients, store/hook relations.
    Read `evidence_path:evidence_line` before using an edge in case selection.
 6. Inspect actual code paths that are both relevant to `{feature}` and reachable from navigation/spec/code-index. Do not scan excluded historical modules.
-7. Write `source-map.md` with planning evidence, code-index evidence when used, source evidence, and selected source files for each candidate case.
-8. Write `mainflow-analysis.md` with included API/UI positive mainflows, excluded non-mainflows, assumptions, and traceability to source evidence.
+7. Write `source-map.md` with the frozen TC ID, planning evidence, code-index evidence when used, source evidence, and selected source files for each candidate case.
+8. Write `mainflow-analysis.md` with included API/UI positive mainflows, excluded non-mainflows, assumptions, and traceability to frozen TC plus source evidence.
 9. Write `case-descriptions.json` using the simplified format in `references/intermediate-format.md`. **Do NOT write raw DSL** — use locator strings like `"text:编辑"`, `"placeholder:请输入名称"`, `"css:.el-dialog__footer .el-button--primary"`.
 10. Compile descriptions into strict DSL:
 
@@ -111,7 +112,7 @@ Read these references before generating cases:
 
 AI is responsible for semantic judgment only:
 
-- Determine feature scope from `.planning`.
+- Determine API/page test scope from frozen `TC-*`, not from implementation delivery prose.
 - Confirm implemented behavior from actual code.
 - Identify positive API mainflows.
 - Identify positive UI mainflows.

package/plugins/devflow-quality/skills/workflow-generate-mainflow-cases/references/intermediate-format.md

@@ -30,6 +30,7 @@ AI 产出的简化用例描述格式。locator 用 `"type:value"` 字符串，
 
 ```json
 {
+  "tc_id": "TC-0001",
   "project_id": 6,
   "name": "Case name",
   "description": "Positive mainflow purpose",
@@ -40,6 +41,8 @@ AI 产出的简化用例描述格式。locator 用 `"type:value"` 字符串，
 }
 ```
 
+当当前功能已经存在冻结 `tests.json` 时，`tc_id` 必填，且必须引用一个正向 `test_type` 为 `api` 或 `page` 的冻结 TC。带 `generated_case_key` 且 `execution.expect.error_code` 的 API TC 是异常/边界用例，不得伪装成主流程；源码只能补充所选 TC 的入口和选择器。
+
 ## Auth (optional)
 
 Only include if the case needs API login + token injection.

package/plugins/devflow-quality/skills/workflow-generate-mainflow-cases/scripts/compile_dsl.py

@@ -531,14 +531,25 @@ def compile_case(case_desc: dict[str, Any]) -> dict[str, Any]:
     }
 
 
-def compile_all(payload: dict[str, Any]) -> dict[str, Any]:
+def compile_all(payload: dict[str, Any], frozen_mainflow_tc_ids: set[str] | None = None) -> dict[str, Any]:
     """Compile all cases in the payload."""
     metadata = dict(payload.get("metadata") or {})
-    cases = [compile_case(c) for c in payload.get("cases", [])]
+    descriptions = list(payload.get("cases", []))
+    tc_ids: list[str] = []
+    if frozen_mainflow_tc_ids is not None:
+        for index, description in enumerate(descriptions):
+            tc_id = description.get("tc_id") if isinstance(description, dict) else None
+            if not isinstance(tc_id, str) or tc_id not in frozen_mainflow_tc_ids:
+                raise ValueError(f"cases[{index}].tc_id must reference a frozen api/page TC that is positive")
+            tc_ids.append(tc_id)
+        if len(tc_ids) != len(set(tc_ids)):
+            raise ValueError("each frozen positive api/page TC may generate at most one mainflow case")
+    cases = [compile_case(c) for c in descriptions]
 
     return {
         "metadata": {
             **metadata,
+            **({"frozen_tc_ids": tc_ids} if frozen_mainflow_tc_ids is not None else {}),
             "compiled_at": datetime.now(timezone.utc).isoformat(),
             "compiled_by": "compile_dsl.py (hard-constraint layer)",
         },
@@ -546,6 +557,41 @@ def compile_all(payload: dict[str, Any]) -> dict[str, Any]:
     }
 
 
+def frozen_mainflow_tc_ids_from_cwd(cwd: Path) -> set[str] | None:
+    """Return the frozen API/page suite for new workflows, else preserve legacy compilation."""
+    state_path = cwd / ".planning" / "STATE.md"
+    if not state_path.is_file():
+        return None
+    match = re.search(r"^current_feature:\s*['\"]?([^'\"\n]+)", state_path.read_text(encoding="utf-8"), re.MULTILINE)
+    if not match:
+        return None
+    suite_path = cwd / ".planning" / "requirements" / match.group(1).strip() / "tests.json"
+    if not suite_path.is_file():
+        return None
+    suite = json.loads(suite_path.read_text(encoding="utf-8"))
+    if suite.get("frozen") is not True:
+        raise ValueError("current TC suite exists but is not frozen and fresh")
+    eligible = {
+        node.get("id")
+        for node in suite.get("nodes", [])
+        if isinstance(node, dict)
+        and node.get("kind") == "test_case"
+        and node.get("status") == "confirmed"
+        and isinstance(node.get("data"), dict)
+        and node["data"].get("test_type") in {"api", "page"}
+        # A generated API TC with an error-code oracle is a negative/exception
+        # test. It belongs to run-acceptance-tests, never to the positive
+        # mainflow importer even though its broad test_type is "api".
+        and not (
+            isinstance(node["data"].get("generated_case_key"), str)
+            and isinstance(node["data"].get("execution"), dict)
+            and isinstance(node["data"]["execution"].get("expect"), dict)
+            and "error_code" in node["data"]["execution"]["expect"]
+        )
+    }
+    return {value for value in eligible if isinstance(value, str)}
+
+
 # ---------------------------------------------------------------------------
 # CLI
 # ---------------------------------------------------------------------------
@@ -568,7 +614,7 @@ def main() -> int:
         raw = {"metadata": {}, "cases": raw}
 
     try:
-        result = compile_all(raw)
+        result = compile_all(raw, frozen_mainflow_tc_ids_from_cwd(Path.cwd()))
     except ValueError as exc:
         print(f"COMPILE ERROR: {exc}", file=__import__("sys").stderr)
         return 1