@guanlin4924/devflow-pi 0.1.86 → 0.1.89

package/README.md

@@ -117,6 +117,10 @@ Devflow 会在输入框上方显示“当前 Feature 交付链路”：它基于
 
 正常使用不需要记忆底层命令：在 Devflow 工作流中按步骤继续即可。需要排查时，可用 `devflow_acceptance_tests` 查看冻结套件，或由工作流调用 `devflow_tdd_evidence` 与 `devflow_run_acceptance_tests` 生成 Core-owned 证据；不要手写“已测试”来替代结果文件。
 
+### Core 软门禁模式
+
+默认情况下，Core 生成的测试绑定、追溯、merge gate、产物有效性和图谱新鲜度问题会记录为 advisory，交给 AI 审查决定继续、修改或阻塞；只有控制面损坏、越权路径、并发冲突等安全问题仍会硬阻断。需要临时恢复旧的严格门禁时，启动前设置 `DEVFLOW_SOFT_GATES=0`。
+
 ## 更新
 
 升级 npm 发行版：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guanlin4924/devflow-pi",
-  "version": "0.1.86",
+  "version": "0.1.89",
   "type": "module",
   "description": "Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。",
   "license": "UNLICENSED",

package/plugins/devflow-core/extensions/devflow-core.ts

@@ -1,4 +1,4 @@
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { appendFile, mkdir, rename, writeFile } from "node:fs/promises";
 import path from "node:path";
@@ -183,6 +183,7 @@ const READ_ONLY_TOOLS = new Set([
   "devflow_usage_stats",
   "usage_stats",
   "devflow_project_context",
+  "devflow_review_preflight",
 ]);
 const REQUIREMENT_DRAFT_TOOLS = new Set([...READ_ONLY_TOOLS, "ask"]);
 // A Todo update changes only the client-visible task list, never the project
@@ -526,7 +527,7 @@ const CONTROL_PATHS = [
   ".planning/artifacts/index.yaml",
 ];
 
-const CONTROL_PREFIXES = [".planning/workflows/", ".planning/contracts/", ".planning/evidence/"];
+const CONTROL_PREFIXES = [".planning/workflows/", ".planning/contracts/", ".planning/evidence/", ".planning/review-runs/"];
 
 const REQUIRED_EXTENSION_TOOLS = [
   "devflow_doctor",
@@ -570,6 +571,7 @@ const REQUIRED_SKILLS = [
   "workflow-execute-phase",
   "workflow-feature-breakdown",
   "workflow-frontend-tech-spec",
+  "workflow-gen-test-guide",
   "workflow-generate-mainflow-cases",
   "workflow-integration-verify",
   "workflow-orchestrator",
@@ -621,6 +623,7 @@ const REQUIRED_SCRIPTS = [
   "workflow-orchestrator/scripts/tdd_evidence.py",
   "workflow-orchestrator/scripts/acceptance_test_runner.py",
   "workflow-orchestrator/scripts/machine_evidence.rb",
+  "workflow-orchestrator/scripts/review_preflight.py",
   "workflow-orchestrator/scripts/cross_track_consistency_check.rb",
   "workflow-orchestrator/scripts/execution_contract.rb",
   "workflow-code-index/scripts/code_index.py",
@@ -699,6 +702,7 @@ function assertRuntimeProjectBoundary(cwd: string): void {
     ".planning/.devflow.lock",
     ".planning/workflows",
     ".planning/artifacts",
+    ".planning/review-runs",
   ]) {
     const target = path.join(resolvedCwd, relative);
     try {
@@ -746,7 +750,9 @@ function isCoreOwnedGovernancePath(filePath: string): boolean {
   // same ownership extends to its views, machine evidence, and audit records.
   return isCanonicalRequirementGraphPath(filePath)
     || /^\.planning\/evidence\/[^/\\\x00-\x1F\x7F]+\/[^/\\]+\.machine\.json$/u.test(filePath)
-    || /^\.planning\/contracts\/[^/\\\x00-\x1F\x7F]+\/(?:EC-[A-Fa-f0-9]+\.json|control-events\.jsonl)$/u.test(filePath);
+    || /^\.planning\/contracts\/[^/\\\x00-\x1F\x7F]+\/(?:EC-[A-Fa-f0-9]+\.json|control-events\.jsonl)$/u.test(filePath)
+    || filePath.startsWith(".planning/review-runs/")
+    || /^\.planning\/phases\/[^/\\\x00-\x1F\x7F]+\/REVIEW\.md$/u.test(filePath);
 }
 
 function planningFeatureFromPath(filePath: string): string | null {
@@ -892,6 +898,17 @@ function parseJsonResult(result: ProcessResult): Record<string, unknown> | null
   }
 }
 
+export function canonicalReviewJson(value: unknown): string {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number" && Number.isFinite(value)) return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalReviewJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    const record = value as Record<string, unknown>;
+    return `{${Object.keys(record).sort().map(key => `${JSON.stringify(key)}:${canonicalReviewJson(record[key])}`).join(",")}}`;
+  }
+  throw new Error("Review JSON contains a non-JSON value");
+}
+
 /** Ruby control-plane scripts report expected validation failures as JSON with
  * `ok: false` and intentionally keep a zero process exit code. Never mistake
  * that structured failure for a successful state mutation. */
@@ -917,6 +934,7 @@ function compactStep(value: unknown): Record<string, unknown> | null {
             required: record.required,
             exists: record.exists,
             artifact_status: record.artifact_status,
+            content_valid: record.content_valid,
           };
         })
       : undefined,
@@ -943,6 +961,10 @@ function isReviewableWorkflowSnapshot(snapshot: Record<string, unknown>): boolea
   if (!step || typeof step !== "object") return false;
   const stepRecord = step as Record<string, unknown>;
   if (typeof stepRecord.id !== "string" || !stepRecord.id) return false;
+  // Core-generated quality findings are advisory by default. Re-arm the AI
+  // review even when an output is stale or its generated validity metadata is
+  // incomplete; only the control-plane shape itself remains a hard boundary.
+  if (process.env.DEVFLOW_SOFT_GATES !== "0" && snapshot.action === "await_user_confirmation") return true;
   const outputs = Array.isArray(stepRecord.outputs) ? stepRecord.outputs : [];
   const requiredOutputs = outputs.filter(output => {
     if (!output || typeof output !== "object") return false;
@@ -951,7 +973,13 @@ function isReviewableWorkflowSnapshot(snapshot: Record<string, unknown>): boolea
   return requiredOutputs.length > 0 && requiredOutputs.every(output => {
     if (!output || typeof output !== "object") return false;
     const record = output as Record<string, unknown>;
-    return record.exists === true && !["failed", "blocked"].includes(String(record.artifact_status ?? ""));
+    // Older/current inspect_state payloads may omit content_valid even when
+    // Core has already validated and registered the artifact. Treat an
+    // explicit false as invalid, but use exists + artifact_status as the
+    // durable fallback when the field is absent.
+    return record.exists === true
+      && record.content_valid !== false
+      && !["failed", "blocked", "planned"].includes(String(record.artifact_status ?? ""));
   });
 }
 
@@ -992,6 +1020,16 @@ export function workflowResumeDisposition(snapshot: Record<string, unknown>): Wo
 
 function workflowDirective(snapshot: Record<string, unknown>, source: "start" | "approval", requirementDraft?: string): string {
   const selectedStep = selectedWorkflowStep(snapshot);
+  const reviewInstructions = selectedStep?.id === "code-review"
+    ? [
+      "派发审查 task 前先调用 devflow_review_preflight，使用当前 Core 冻结契约和审查者 devflow-code-reviewer；只有 ready 才派发，human_confirmation 与 core_contract_conflict 均停止并上报。ready 只是可执行性预检，不是审查通过。",
+      "本步骤由主 Agent 使用 task 显式指定 devflow-code-reviewer 执行独立只读审查；主 Agent 不得代替审查者给出 clean 结论。",
+      "任务包只能引用已确认的 Core 需求/契约、固定版本源码和测试证据；主 Agent 的摘要不是验收事实。审查者须独立回读事实与源码，返回发现、证据、未决人工问题和改进建议。",
+      "若需第二或第三轮审查，任务包必须携带前轮 chain_id，审查者须在 JSON 中原样返回；每轮限一个独立审查 task，最多三轮。P0/P1 影响和触发条件必须引用预先冻结的 Core 测试用例事实，缺失则转人工确认。",
+      "审查 task 返回严格 JSON 后，主 Agent 调用 devflow_review_submit({}) 提交该 task 的原始结果；不得重写观察项或自报 clean。随后将 Core 返回的裁决、证据链、开放 finding 和下一步动作完整交给用户。",
+      "审查报告及 task 返回文本不构成 Core 门禁通过；证据不足或审查服务返回 awaiting_human_confirmation 时必须保留阻断并报告给主 Agent。",
+    ]
+    : [];
   const envelope = {
     source,
     action: snapshot.action,
@@ -1021,6 +1059,7 @@ function workflowDirective(snapshot: Record<string, unknown>, source: "start" |
     "Devflow 已通过启动预检。读取 skill://workflow-pipeline，并只执行当前项目的一个工作流步骤。",
     "先调用 devflow_state(action=\"inspect\") 重新确认 revision，再调用 devflow_contract(action=\"status\")；若没有匹配当前 feature/current_step 的 fresh contract，立即调用 devflow_contract(action=\"activate\", feature=<current_feature>, step=<current_step>)，激活成功后才能执行或写入。",
     "只按 inspector 返回的当前 step 加载所需 Skill：step.skill 是精确 ID，必须读取 skill://<step.skill>，不得自行添加 workflow- 前缀或改写名称；本回合严禁读取或写入 xd://devflow_transition，严禁调用 devflow_transition，严禁执行 Skill 中的 complete-step/confirm-checkpoint，不得推进下一步骤；状态写回和会话切换由 Runtime 在用户确认后独占处理。",
+    ...reviewInstructions,
     ...(parallelInstructions.length > 0 ? parallelInstructions : [
       "完成本步骤的真实产物后，报告证据、未决项和验证结果并停止。请用户审查后明确回复“批准执行”才可推进；回复修改意见或“拒绝执行”则不得推进。",
     ]),
@@ -1135,11 +1174,11 @@ export function isShellControlMutation(toolName: string, input: unknown): boolea
   const looksLikeWrite = /(?:^|[;&|]\s*)(?:rm|mv|cp|install|truncate)\b|(?:^|\s)(?:tee|sed\s+-i|perl\s+-i)\b|(?:^|[\s;&|])(?:1)?>{1,2}(?![>=&])\s*\S/.test(
     command,
   );
-  return invokesWriter || (namesControlPath && looksLikeWrite);
+  return invokesWriter || (namesControlPath && (looksLikeWrite || shellMutationPaths(command, ".").mutating));
 }
 
 function shellMutationPaths(command: string, cwd: string): { mutating: boolean; paths: string[] } {
-  const mutating = /(?:\bsed\s+-i\b|\bperl\s+-i\b|\b(?:cp|mv|rm|install|truncate|tee)\b|(?:^|\s)>{1,2}\s*\S|\b(?:python3?|node|ruby)\b[^\n]*(?:writeFile|write_text|open\([^\n]*['\"]w|unlink|rename)\b)/i.test(command);
+  const mutating = /(?:\bsed\s+-i\b|\bperl\s+-i\b|\b(?:cp|mv|rm|install|truncate|tee)\b|(?:^|\s)>{1,2}(?![>=&])\s*\S|\b(?:python3?|node|ruby)\b[^\n]*(?:writeFile|write_text|open\([^\n]*['\"]w|unlink|rename)\b)/i.test(command);
   if (!mutating) return { mutating: false, paths: [] };
   const candidates = command.match(/(?:^|\s|>)([A-Za-z0-9_./~-]+)(?=\s|$|2?>)/g) ?? [];
   const paths = candidates
@@ -1164,6 +1203,7 @@ const CONTRACT_READ_TOOLS = new Set([
   "devflow_acceptance_tests",
   "devflow_doctor",
   "devflow_state",
+  "devflow_review_preflight",
   "devflow_usage_stats",
   "usage_stats",
 ]);
@@ -1207,6 +1247,7 @@ function stepScopedMutationOwner(toolName: string, input: unknown): string | nul
     const step = input && typeof input === "object" ? (input as Record<string, unknown>).step : undefined;
     return typeof step === "string" && step ? step : null;
   }
+  if (normalized === "devflow_review_submit" || normalized === "devflow_review_render") return "code-review";
   // New mutating Devflow tools must declare a step above or be explicitly
   // classified read/control-only; they never inherit a broad devflow_* bypass.
   return null;
@@ -1362,6 +1403,10 @@ export default function devflowCore(pi: ExtensionAPI) {
   let controlState: SessionControlState = initialControlState();
   let activeContract: ActiveExecutionContract | undefined;
   let contractAgentCalls = 0;
+  const reviewBindingKey = randomBytes(32).toString("hex");
+  const pendingReviewTasks = new Map<string, { feature: string; contractId: string }>();
+  const completedReviewTasks = new Map<string, { feature: string; contractId: string; report: Record<string, unknown> }>();
+  let latestReviewTaskCallId: string | undefined;
   let projectRoot: string | undefined;
 
   async function appendEngineEvidence(cwd: string | undefined, event: string, extra: Record<string, unknown> = {}) {
@@ -2773,10 +2818,36 @@ export default function devflowCore(pi: ExtensionAPI) {
       ) {
           return { block: true, reason: `Active contract ${activeContract.contractId} only allows agents: ${activeContract.allowedAgents.join(", ")}` };
       }
-      if (activeContract && controlState.phase === "executing" && contractAgentCalls >= activeContract.toolBudget) {
+      if (activeContract && controlState.phase === "executing" && contractAgentCalls + requested.names.length > activeContract.toolBudget) {
         return { block: true, reason: `Active contract ${activeContract.contractId} exhausted its fixed agent budget (${activeContract.toolBudget}).` };
       }
-      if (activeContract && controlState.phase === "executing") contractAgentCalls += 1;
+      if (activeContract && controlState.phase === "executing" && activeContract.step === "code-review" && requested.names.length !== 1) {
+        return { block: true, reason: "Code review requires exactly one independent reviewer task." };
+      }
+      if (activeContract && controlState.phase === "executing" && activeContract.step === "code-review") {
+        const preflight = await runProcess([
+          "python3", path.join(resolveKitRoot(ctx.cwd), "workflow-orchestrator/scripts/review_preflight.py"),
+          "--root", ctx.cwd,
+          "--feature", activeContract.feature,
+          "--step", activeContract.step,
+          "--contract", `.planning/contracts/${activeContract.feature}/${activeContract.contractId}.json`,
+          "--obligations", "[]",
+          "--review-agent", "devflow-code-reviewer",
+          "--stage", "entry",
+        ], ctx.cwd);
+        let result: Record<string, unknown> | null = null;
+        try {
+          result = JSON.parse(preflight.stdout) as Record<string, unknown>;
+        } catch {
+          // An unparseable Core preflight result cannot authorize a reviewer task.
+        }
+        if (!preflight.ok || result?.status !== "ready") {
+          return { block: true, reason: `Code review task preflight did not pass: ${preflight.stdout || preflight.stderr || "unavailable"}` };
+        }
+        if (!toolCallId) return { block: true, reason: "Code review task needs a runtime tool-call identity." };
+        pendingReviewTasks.set(toolCallId, { feature: activeContract.feature, contractId: activeContract.contractId });
+      }
+      if (activeContract && controlState.phase === "executing") contractAgentCalls += requested.names.length;
     } else if (
       controlState.phase === "planning" &&
       toolName !== "devflow_contract" &&
@@ -2924,6 +2995,30 @@ export default function devflowCore(pi: ExtensionAPI) {
   });
 
   pi.on("tool_result", async (event, ctx) => {
+    if (event.toolName === "task") {
+      const binding = pendingReviewTasks.get(event.toolCallId);
+      if (binding) {
+        pendingReviewTasks.delete(event.toolCallId);
+        const details = event.details && typeof event.details === "object" ? event.details as Record<string, unknown> : {};
+        const results = Array.isArray(details.results) ? details.results : [];
+        const child = results.length === 1 && results[0] && typeof results[0] === "object"
+          ? results[0] as Record<string, unknown> : null;
+        if (!event.isError && child?.agent === "devflow-code-reviewer" && child.exitCode === 0 && child.truncated === false && typeof child.output === "string") {
+          try {
+            const report = JSON.parse(child.output) as unknown;
+            if (report && typeof report === "object" && !Array.isArray(report)
+              && !("core_review_binding" in report)
+              && (report as Record<string, unknown>).target && typeof (report as Record<string, unknown>).target === "object"
+              && ((report as Record<string, unknown>).target as Record<string, unknown>).feature === binding.feature) {
+              completedReviewTasks.set(event.toolCallId, { ...binding, report: report as Record<string, unknown> });
+              latestReviewTaskCallId = event.toolCallId;
+            }
+          } catch {
+            // A prose or malformed child response is not an attested review.
+          }
+        }
+      }
+    }
     const taskContext = parallelTaskContexts.get(event.toolCallId);
     if (parallelRunActive && event.toolName === "task") {
       if (taskResultHasSuccessfulDispatch(event.details)) {
@@ -3669,7 +3764,7 @@ export default function devflowCore(pi: ExtensionAPI) {
     parameters: z.object({
       feature: z.string().min(1),
       phase: z.string().min(1).optional(),
-      flow: z.string().min(1).default("feature-development"),
+      flow: z.enum(["feature-development", "acceptance-remediation"]).default("feature-development"),
       force: z.boolean().default(false),
     }),
     approval: "write",
@@ -3824,6 +3919,101 @@ export default function devflowCore(pi: ExtensionAPI) {
     },
   });
 
+  pi.registerTool({
+    name: "devflow_review_preflight",
+    label: "Devflow Review Preflight",
+    description: "Read-only Core preflight for current step facts, contract revisions, production obligations, and reviewer task reachability. Ready is not gate approval.",
+    parameters: z.object({
+      feature: z.string().min(1),
+      step: z.string().min(1),
+      contract: z.string().min(1),
+      obligations: z.array(z.record(z.string(), z.unknown())).default([]),
+      reviewAgent: z.string().optional(),
+      stage: z.enum(["entry", "completion"]).default("entry"),
+    }),
+    approval: "read",
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+      assertRuntimeProjectBoundary(ctx.cwd);
+      return renderResult(await runProcess([
+        "python3", path.join(resolveKitRoot(ctx.cwd), "workflow-orchestrator/scripts/review_preflight.py"),
+        "--root", ctx.cwd,
+        "--feature", params.feature,
+        "--step", params.step,
+        "--contract", params.contract,
+        "--obligations", JSON.stringify(params.obligations),
+        "--stage", params.stage,
+        ...(params.reviewAgent ? ["--review-agent", params.reviewAgent] : []),
+      ], ctx.cwd));
+    },
+  });
+
+  pi.registerTool({
+    name: "devflow_review_submit",
+    label: "Devflow Bound Review Submission",
+    description: "Submit the exact JSON returned by the completed independent reviewer task to Core. Caller text cannot replace the child report.",
+    parameters: z.object({ taskCallId: z.string().optional() }),
+    approval: "write",
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+      assertRuntimeProjectBoundary(ctx.cwd);
+      const taskCallId = params.taskCallId || latestReviewTaskCallId;
+      const captured = taskCallId ? completedReviewTasks.get(taskCallId) : undefined;
+      if (!taskCallId || !captured || activeContract?.step !== "code-review"
+        || activeContract.feature !== captured.feature || activeContract.contractId !== captured.contractId) {
+        return renderResult({ ok: false, exitCode: 2, stdout: "", stderr: "No completed reviewer task is bound to the active code-review contract." });
+      }
+      const reportSha256 = createHash("sha256").update(canonicalReviewJson(captured.report), "utf8").digest("hex");
+      const identity = {
+        agent: "devflow-code-reviewer",
+        feature: captured.feature,
+        contract_id: captured.contractId,
+        task_call_id: taskCallId,
+        report_sha256: reportSha256,
+      };
+      const signature = createHmac("sha256", reviewBindingKey).update(canonicalReviewJson(identity), "utf8").digest("hex");
+      const request = { ...captured.report, core_review_binding: { ...identity, signature } };
+      const result = await runProcess(
+        ["python3", path.join(resolveKitRoot(ctx.cwd), "workflow-orchestrator/scripts/review_run.py"), ctx.cwd],
+        ctx.cwd,
+        { DEVFLOW_REVIEW_BINDING_KEY: reviewBindingKey },
+        JSON.stringify(request),
+      );
+      const submitted = parseJsonResult(result);
+      if (!result.ok || !submitted) return renderResult(result, { taskCallId, feature: captured.feature, contractId: captured.contractId });
+      completedReviewTasks.delete(taskCallId);
+      if (!["clean", "findings", "terminated_p0"].includes(String(submitted.status))) {
+        return renderResult(result, { taskCallId, feature: captured.feature, contractId: captured.contractId });
+      }
+      const script = path.join(resolveKitRoot(ctx.cwd), "workflow-orchestrator/scripts/review_run.py");
+      const rendered = await runProcess(["python3", script, ctx.cwd, "--render", captured.feature, captured.contractId], ctx.cwd);
+      const renderPayload = parseJsonResult(rendered);
+      if (!rendered.ok || renderPayload?.status !== "rendered") {
+        return renderResult({ ok: false, exitCode: 1, stdout: JSON.stringify({ review_result: submitted, render: renderPayload }), stderr: rendered.stderr || "Core review report rendering failed; call devflow_review_render to retry." }, { taskCallId });
+      }
+      const gated = await runProcess(["python3", script, ctx.cwd, "--gate", captured.feature, captured.contractId], ctx.cwd);
+      const gatePayload = parseJsonResult(gated);
+      if (!gated.ok || !gatePayload) return renderResult(gated, { taskCallId, review_result: submitted });
+      return renderResult({ ok: true, exitCode: 0, stdout: JSON.stringify({ review_result: submitted, gate: gatePayload }), stderr: "" }, { taskCallId, feature: captured.feature, contractId: captured.contractId });
+    },
+  });
+
+  pi.registerTool({
+    name: "devflow_review_render",
+    label: "Devflow Core Review Report",
+    description: "Regenerate the code-review Markdown view from the latest Core-bound review round; it does not change the verdict.",
+    parameters: z.object({}),
+    approval: "write",
+    async execute(_id, _params, _signal, _onUpdate, ctx) {
+      assertRuntimeProjectBoundary(ctx.cwd);
+      if (activeContract?.step !== "code-review") {
+        return renderResult({ ok: false, exitCode: 2, stdout: "", stderr: "A current code-review contract is required." });
+      }
+      return renderResult(await runProcess([
+        "python3", path.join(resolveKitRoot(ctx.cwd), "workflow-orchestrator/scripts/review_run.py"),
+        ctx.cwd, "--render", activeContract.feature, activeContract.contractId,
+      ], ctx.cwd));
+    },
+  });
+
   pi.registerTool({
     name: "devflow_review_run",
     label: "Devflow Fact-Bound Review",

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/acceptance_test_runner.py

@@ -393,6 +393,21 @@ def run(root: Path, feature: str, write: bool) -> dict[str, Any]:
                "execution_binding_fingerprint": file_fingerprint(execution_bindings_path), "results": results, "passed": all_passed, "history": history[-20:]}
     if write:
         write_json(result_path, payload)
+        meta_path = result_path.with_name("acceptance-results.meta.json")
+        passed = sum(1 for item in results if item.get("status") == "passed")
+        failed = sum(1 for item in results if item.get("status") == "failed")
+        blocked = sum(1 for item in results if item.get("status") == "blocked")
+        write_json(meta_path, {
+            "schema_version": 1,
+            "feature": feature,
+            "acceptance_tc_passed": passed,
+            "acceptance_tc_failed": failed,
+            "acceptance_tc_blocked": blocked,
+            "acceptance_suite_graph_revision": payload["test_suite"].get("graph_revision"),
+            "acceptance_results_fingerprint": file_fingerprint(result_path),
+            "built_by": "core_acceptance_test_runner",
+            "built_at": payload["executed_at"],
+        })
     return {"ok": all_passed, "feature": feature, "path": str(result_path.relative_to(root)), "results": results,
             "errors": [] if all_passed else ["one or more frozen TC cases failed or are blocked"]}
 

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/advance_state.rb

@@ -108,7 +108,7 @@ def transition_gate_contract(workflow, step)
     "topology" => {
       "allowed_tracks" => allowed_tracks,
       "allowed_predecessors" => Array(step["depends_on"]),
-      "allowed_intervening_predecessors" => immediate_prior ? [immediate_prior["id"]] : [],
+    "allowed_intervening_predecessors" => ((immediate_prior ? [immediate_prior["id"]] : []) + Array(step["allowed_intervening_predecessors"])).uniq,
       "allowed_reentry" => reentries,
       "checkpoint" => checkpoint && checkpoint.merge("id" => checkpoint_id)
     },
@@ -529,8 +529,40 @@ def repair_legacy_parallel_join_predecessor!(state, workflow)
   predecessor
 end
 
+# Business-quality checkers are advisory by default.  The runtime still keeps
+# a small safety floor for malformed control-plane state and unsafe writes, but
+# Core-generated test/traceability/merge findings no longer strand the serial
+# workflow before the AI review can decide what to do.
+SOFT_GATE_MODE = ENV.fetch("DEVFLOW_SOFT_GATES", "1") != "0"
+HARD_FAILURE_REASONS = %w[
+  missing_state_file
+  missing_state_front_matter
+  stale_revision
+  invalid_control_path
+  unknown_step
+  gate_target_step_unknown
+  gate_current_step_mismatch
+  parallel_transition_requires_write
+  feature_not_active
+  cancel_reason_required
+  session_rollover_in_progress
+  failure_branch_incomplete
+  parallel_machine_evidence_failed
+  parallel_join_failed
+  parallel_branch_transition_failed
+  cross_track_consistency_failed
+  business_cross_model_check_failed
+  gate_boundary_rejected
+].freeze
+$devflow_advisories = []
+
 def fail_result(reason, details = {})
-  { "ok" => false, "reason" => reason, "details" => details }
+  failure = { "ok" => false, "reason" => reason, "details" => details }
+  if SOFT_GATE_MODE && !HARD_FAILURE_REASONS.include?(reason.to_s)
+    $devflow_advisories << failure
+    return nil
+  end
+  failure
 end
 
 # CP-3 has to validate a *candidate* task/TC binding before it freezes the
@@ -791,6 +823,19 @@ result =
       # GateRuntime is a read-only boundary check.  It runs while the project
       # lock is held and before any candidate state mutation; the existing
       # validator and advance_state CAS remain the final write guard.
+      if result.nil? && gate_contract_enabled?(workflow) &&
+         !%w[prepared claimed].include?(state.dig("rollover", "status")) &&
+         (options[:complete_step] || options[:confirm_checkpoint] || options[:enter_failure_branch] || options[:exit_failure_branch] || options[:parallel_action])
+        topology_errors = WorkflowGateContract.validate(workflow)
+        unless topology_errors.empty?
+          result = fail_result("gate_boundary_rejected", "gate" => {
+            "verdict" => "deny",
+            "reason" => "workflow_gate_contract_invalid",
+            "errors" => topology_errors,
+          })
+        end
+      end
+
       if result.nil? && gate_contract_enabled?(workflow) &&
          !%w[prepared claimed].include?(state.dig("rollover", "status")) &&
          (options[:complete_step] || options[:confirm_checkpoint] || options[:enter_failure_branch] || options[:exit_failure_branch] || options[:parallel_action])
@@ -1187,7 +1232,7 @@ result =
           phase_owner_override: prospective_owner
         )
 
-        if changed && !validation["ok"]
+        if changed && !validation["ok"] && !SOFT_GATE_MODE
           result = fail_result("state_validation_failed", "validation" => validation)
         elsif changed && options[:write]
           ownership = PhaseOwnership.claim(
@@ -1249,6 +1294,7 @@ result =
           "actions" => actions,
           "state_path" => state_path,
           "next_intent_written" => next_intent_written,
+          "advisories" => $devflow_advisories,
           "state_validation" => validation,
           "state" => state
         }

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/checker_adapter.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+# The single execution boundary for Core checkers.  Registry membership alone
+# is not evidence that a checker can run; every non graph-backed checker must
+# have an adapter here.
+require "json"
+require "open3"
+require_relative "checker_registry"
+
+module CheckerAdapter
+  module_function
+
+  def execute(root:, feature:, step:, id:, graph_results:)
+    CheckerRegistry.validate_executable!([id])
+    if CheckerRegistry::GRAPH_BACKED.include?(id.to_s)
+      issues = graph_results.fetch(id.to_s, ["checker produced no graph result: #{id}"])
+      return result(id, issues.empty?, issues)
+    end
+
+    command = command_for(root, feature, step, id)
+    return result(id, false, ["no adapter command for #{id}"]) unless command
+
+    stdout, stderr, status = Open3.capture3(*command, chdir: root)
+    payload = JSON.parse(stdout)
+    passed = status.success? && payload.is_a?(Hash) && (payload["ok"] == true || payload["valid"] == true)
+    issues = if passed
+               []
+             elsif payload.is_a?(Hash) && payload["errors"].is_a?(Array)
+               payload["errors"].map { |item| item.is_a?(String) ? item : JSON.generate(item) }
+             else
+               [stderr.strip.empty? ? "#{id} failed" : stderr.strip]
+             end
+    result(id, passed, issues)
+  rescue JSON::ParserError => error
+    result(id, false, ["#{id} returned invalid JSON: #{error.message}"])
+  rescue StandardError => error
+    result(id, false, ["#{id} adapter failed: #{error.message}"])
+  end
+
+  def result(id, passed, issues)
+    { "id" => id, "origin" => "core_fixed_checker", "exit_code" => passed ? 0 : 1,
+      "passed" => passed, "issues" => passed ? [] : Array(issues),
+      "counters" => { "issue_count" => passed ? 0 : Array(issues).length } }
+  end
+
+  def command_for(root, feature, step, id)
+    scripts = File.expand_path(__dir__)
+    case id.to_s
+    when "test-task-binding-check"
+      stage = step.to_s == "change-plan" ? "candidate" : "frozen"
+      ["python3", File.join(scripts, "test_task_binding_check.py"), "--feature", feature, "--stage", stage, "--json"]
+    when "tdd-evidence-check"
+      ["python3", File.join(scripts, "tdd_evidence.py"), "validate", "--feature", feature, "--json"]
+    when "acceptance-test-results-check"
+      ["python3", File.join(scripts, "acceptance_test_runner.py"), "validate-results", "--feature", feature, "--json"]
+    when "api-test-matrix-check"
+      ["python3", File.join(scripts, "api_test_matrix.py"), "validate", "--feature", feature, "--json"]
+    when "api-test-schema-check"
+      ["python3", File.join(scripts, "api_test_matrix.py"), "check", "--feature", feature, "--json"]
+    when "cross-track-consistency-check"
+      ["ruby", File.join(scripts, "cross_track_consistency_check.rb"), "--feature", feature, "--json"]
+    when "business-cross-model-check"
+      business = ".planning/business-model/#{feature}/canonical.json"
+      return nil unless File.file?(File.join(root, business))
+      command = ["python3", File.join(scripts, "business_cross_model_check.py"), "--business-canonical", business]
+      wireframe = ".planning/features/#{feature}/canonical.json"
+      claims = ".planning/features/#{feature}/business-claims.yaml"
+      traceability = ".planning/requirements/#{feature}/traceability.json"
+      command += ["--wireframe", wireframe] if File.file?(File.join(root, wireframe))
+      command += ["--claims", claims] if File.file?(File.join(root, claims))
+      command += ["--traceability", traceability] if File.file?(File.join(root, traceability))
+      command + ["--json"]
+    when "business-claim-reference-check"
+      claims = ".planning/features/#{feature}/business-claims.yaml"
+      business = ".planning/business-model/#{feature}/canonical.json"
+      return nil unless File.file?(File.join(root, claims)) && File.file?(File.join(root, business))
+      command = ["python3", File.join(scripts, "business_claim_validate.py"), "--claims", claims, "--business-canonical", business]
+      traceability = ".planning/requirements/#{feature}/traceability.json"
+      command += ["--traceability", traceability] if File.file?(File.join(root, traceability))
+      command
+    end
+  end
+end

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/checker_registry.rb

@@ -11,6 +11,15 @@ module CheckerRegistry
     business-cross-model-check business-invalidation-check
   ].freeze
   EMBEDDED = %w[requirement-coverage-check source-authority-check traceability-check].freeze
+  GRAPH_BACKED = %w[
+    requirement-graph-check slice-independence-check contract-coverage-check
+    change-impact-check acceptance-coverage-check test-coverage-check test-obligation-check
+  ].freeze
+  ADAPTERS = %w[
+    api-test-schema-check api-test-matrix-check acceptance-test-results-check
+    test-task-binding-check tdd-evidence-check cross-track-consistency-check
+    business-cross-model-check business-claim-reference-check
+  ].freeze
 
   module_function
 
@@ -24,6 +33,16 @@ module CheckerRegistry
     nil
   end
 
+  def executable?(id)
+    GRAPH_BACKED.include?(id.to_s) || ADAPTERS.include?(id.to_s)
+  end
+
+  def validate_executable!(ids)
+    unsupported = Array(ids).map(&:to_s).reject { |id| executable?(id) }
+    raise ArgumentError, "checker has no Core execution adapter: #{unsupported.join(', ')}" unless unsupported.empty?
+    true
+  end
+
   def validate!(ids)
     unknown = Array(ids).map(&:to_s).reject { |id| known?(id) }
     raise ArgumentError, "unknown checker id(s): #{unknown.join(", ")}" unless unknown.empty?

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/checkpoint_meta.rb

@@ -0,0 +1,46 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "json"
+
+module CheckpointMeta
+  module_function
+
+  def validate(root:, state:, checkpoint:)
+    return [] unless checkpoint.is_a?(Hash)
+
+    raw_path = checkpoint["required_meta_output"]
+    # Legacy/custom checkpoints may not declare checkpoint metadata. Only
+    # enforce the contract when a metadata path is explicitly declared.
+    return [] if raw_path.to_s.empty?
+
+    relative = raw_path.to_s
+                   .gsub("{feature}", state.fetch("current_feature", "").to_s)
+                   .gsub("{phase}", state.fetch("current_phase", "").to_s)
+    absolute = File.expand_path(relative, root)
+    unless File.file?(absolute)
+      return [{ "code" => "missing_checkpoint_meta_output", "message" => "checkpoint meta output is missing", "path" => relative }]
+    end
+
+    data = JSON.parse(File.read(absolute))
+    errors = []
+    unless data.is_a?(Hash)
+      errors << { "code" => "invalid_checkpoint_meta_shape", "message" => "checkpoint meta output must be a JSON object", "path" => relative }
+      return errors
+    end
+
+    Array(checkpoint["required_meta_fields"]).each do |field|
+      next if data.key?(field.to_s) && !data[field.to_s].nil?
+
+      errors << {
+        "code" => "missing_checkpoint_meta_field",
+        "message" => "checkpoint meta output is missing a required field",
+        "path" => relative,
+        "field" => field
+      }
+    end
+    errors
+  rescue JSON::ParserError => error
+    [{ "code" => "invalid_checkpoint_meta_json", "message" => error.message, "path" => relative }]
+  end
+end