@guanlin4924/devflow-pi 0.1.95 → 0.1.97

package/plugins/devflow-core/runtime/hooks/hook_common.py

@@ -711,6 +711,251 @@ def tool_touches_control_store(event: dict[str, Any], root: Path) -> tuple[bool,
     return False, []
 
 
+# MCP authorization and audit data are user-local security state.  This guard
+# is deliberately narrower than DEVFLOW_HOME: only mcp.json and mcp-audit/
+# are protected, and the decision is independent of soft-gate policy.
+def path_is_mcp_protected(raw: str, cwd: Path) -> bool:
+    candidate = Path(_expand_shell_path(str(raw)))
+    if not candidate.is_absolute():
+        candidate = cwd / candidate
+    lexical = Path(os.path.normpath(str(candidate)))
+    resolved = Path(os.path.realpath(str(candidate)))
+    home = devflow_home()
+    config = home / "mcp.json"
+    audit = home / "mcp-audit"
+    for item in (lexical, resolved):
+        if item == config or _under(item, audit):
+            return True
+    return False
+
+
+def _analyze_mcp_command(command: str, cwd: Path, depth: int = 0) -> bool:
+    tokens = _shell_tokens(command)
+    for segment in _segments(tokens):
+        index = 0
+        while index < len(segment) and (ASSIGNMENT_RE.match(segment[index]) or segment[index] in WRAPPER_PROGRAMS):
+            index += 1
+        if index >= len(segment):
+            continue
+        program = os.path.basename(segment[index]).lower()
+        operands = segment[index + 1:]
+        if program in SHELL_PROGRAMS and depth < 3:
+            for pos, operand in enumerate(operands):
+                if operand.startswith("-") and "c" in operand[1:] and pos + 1 < len(operands):
+                    if _analyze_mcp_command(operands[pos + 1], cwd, depth + 1):
+                        return True
+        ignored: set[int] = set()
+        if program in {"echo", "printf"}:
+            ignored.update(range(len(operands)))
+        elif program in {"rg", "grep", "ag", "ack"}:
+            seen_pattern = False
+            pos = 0
+            while pos < len(operands):
+                operand = operands[pos]
+                if operand in {"-e", "--regexp"} and pos + 1 < len(operands):
+                    ignored.add(pos + 1)
+                    pos += 2
+                    continue
+                if operand.startswith("--regexp=") or (not operand.startswith("-") and not seen_pattern):
+                    ignored.add(pos)
+                    seen_pattern = True
+                pos += 1
+        elif program == "git":
+            for pos, operand in enumerate(operands):
+                if operand in {"-m", "--message"} and pos + 1 < len(operands):
+                    ignored.add(pos + 1)
+        previous = ""
+        for pos, operand in enumerate(operands):
+            if previous in REDIRECT_OPERATORS and path_is_mcp_protected(operand, cwd):
+                return True
+            if pos in ignored:
+                previous = operand
+                continue
+            if operand in REDIRECT_OPERATORS or operand.startswith("-"):
+                previous = operand
+                continue
+            if path_is_mcp_protected(operand, cwd):
+                return True
+            previous = operand
+    return False
+
+
+def tool_touches_mcp_config(event: dict[str, Any], root: Path) -> tuple[bool, list[str]]:
+    cwd = Path(str(event.get("cwd") or root)).expanduser()
+    blocked = [raw for raw in _raw_tool_paths(event) if path_is_mcp_protected(raw, cwd)]
+    if blocked:
+        return True, sorted(dict.fromkeys(blocked))
+    command = command_text(event)
+    if command and _analyze_mcp_command(command, cwd):
+        return True, ["<shell command>"]
+    return False, []
+
+
+# Run artifacts are user-local evidence, not agent-readable source.  Keep this
+# guard separate from the control-store guard: it is always on and its only
+# read exception is the Core-produced result.json summary.
+def _run_root(cwd: Path) -> Path:
+    # macOS commonly exposes /var as a symlink to /private/var; use the
+    # canonical cwd so lexical and realpath checks compare in one namespace.
+    return Path(os.path.realpath(str(cwd))) / ".devflow" / "runs"
+
+
+def _run_relative(raw: str, cwd: Path, anchor: Path | None = None) -> tuple[Path, Path, Path]:
+    # The protected root is anchored at the project root, never at the current
+    # shell cwd, so `cd .devflow && cat runs/...` still resolves into it.
+    expanded = _expand_shell_path(raw)
+    cwd_text = str(cwd)
+    expanded = re.sub(r"\$\{PWD\}|\$PWD\b", cwd_text, expanded)
+    candidate = Path(expanded.replace("\\", "/"))
+    if not candidate.is_absolute():
+        candidate = cwd / candidate
+    lexical = Path(os.path.normpath(str(candidate)))
+    resolved = Path(os.path.realpath(str(candidate)))
+    return lexical, resolved, _run_root(anchor or cwd)
+
+
+def _under_run(path: Path, run_root: Path) -> bool:
+    return _under(path, run_root)
+
+
+def path_is_run_artifact(raw: str, cwd: Path, tool: dict[str, Any] | str) -> bool:
+    """Return whether a tool path enters .devflow/runs.
+
+    ``result.json`` is readable only by pure-read tools.  Glob may list the
+    runs directory itself; every other path, including result.json writes and
+    symlink aliases, remains protected.
+    """
+    lexical, resolved, run_root = _run_relative(raw, cwd)
+    paths = (lexical, resolved)
+    tool_event = tool if isinstance(tool, dict) else {"tool_name": tool}
+    pure_read = is_pure_read_tool(tool_event)
+    name = tool_name(tool_event)
+    for item in paths:
+        if not _under_run(item, run_root):
+            continue
+        relative = item.relative_to(run_root).parts
+        if name == "glob" and len(relative) == 0:
+            continue
+        if pure_read and len(relative) == 3 and relative[-1] == "result.json":
+            continue
+        return True
+    return False
+
+
+RUN_FILE_PROGRAMS = {
+    "cat", "cp", "mv", "rm", "tee", "touch", "truncate", "install", "rsync", "scp",
+    "tar", "unzip", "zip", "base64", "xxd", "strings", "od", "hexdump", "file", "stat",
+    "head", "tail", "less", "more", "sed", "awk", "nl", "bat", "rg", "grep", "find", "fd",
+    "ls", "tree", "du", "open", "sha256sum", "shasum", "md5sum", "md5", "cksum", "chmod",
+    "chown", "unlink", "shred", "dd", "gzip", "gunzip", "bzip2", "xz", "python", "python3",
+    "node", "bun", "deno", "ruby", "perl", "php", "lua",
+}
+
+
+def _token_is_run_target(token: str, cwd: Path, anchor: Path | None = None) -> bool:
+    if not token or token in REDIRECT_OPERATORS or token.startswith("-"):
+        return False
+    lexical, resolved, run_root = _run_relative(token, cwd, anchor)
+    return _under_run(lexical, run_root) or _under_run(resolved, run_root)
+
+
+def _analyze_run_command(command: str, cwd: Path, depth: int = 0, anchor: Path | None = None) -> bool:
+    anchor = anchor or cwd
+    tokens = _shell_tokens(command)
+    current_cwd = cwd
+    for segment in _segments(tokens):
+        index = 0
+        while index < len(segment) and (ASSIGNMENT_RE.match(segment[index]) or segment[index] in WRAPPER_PROGRAMS):
+            index += 1
+        if index >= len(segment):
+            continue
+        program = os.path.basename(segment[index]).lower()
+        operands = segment[index + 1:]
+        if program in SHELL_PROGRAMS and depth < 3:
+            for pos, operand in enumerate(operands):
+                if operand.startswith("-") and "c" in operand[1:] and pos + 1 < len(operands):
+                    if _analyze_run_command(operands[pos + 1], current_cwd, depth + 1, anchor):
+                        return True
+        if program == "cd" and operands:
+            if _token_is_run_target(operands[-1], current_cwd, anchor):
+                return True
+            candidate = Path(_expand_shell_path(operands[-1]))
+            current_cwd = candidate if candidate.is_absolute() else current_cwd / candidate
+            current_cwd = Path(os.path.normpath(str(current_cwd)))
+            continue
+        # Any shell redirection is a real filesystem access, even when the
+        # command producing the bytes is otherwise harmless (e.g. echo).
+        previous = ""
+        for operand in operands:
+            if previous in REDIRECT_OPERATORS and _token_is_run_target(operand, current_cwd, anchor):
+                return True
+            previous = operand
+        # Inline interpreters can open arbitrary files.  Reject the source
+        # text conservatively whenever it names the protected tree.
+        if program in {"python", "python3", "node", "bun", "deno", "ruby", "perl", "php"}:
+            for pos, operand in enumerate(operands):
+                if operand in {"-c", "-e", "--eval"} and pos + 1 < len(operands):
+                    if ".devflow/runs" in operands[pos + 1]:
+                        return True
+                if any(operand.startswith(prefix) for prefix in ("--eval=", "-e=")) and ".devflow/runs" in operand.split("=", 1)[1]:
+                    return True
+
+        # Every non-option operand is a potential filesystem target, regardless
+        # of the executable.  Only documented text positions are exempt.
+        ignored: set[int] = set()
+        if program in {"echo", "printf"}:
+            ignored.update(range(len(operands)))
+        elif program in {"rg", "grep", "ag", "ack"}:
+            seen_pattern = False
+            pos = 0
+            while pos < len(operands):
+                operand = operands[pos]
+                if operand in {"-e", "--regexp"} and pos + 1 < len(operands):
+                    ignored.add(pos + 1)
+                    pos += 2
+                    continue
+                if operand.startswith("--regexp="):
+                    ignored.add(pos)
+                elif not operand.startswith("-") and not seen_pattern:
+                    ignored.add(pos)
+                    seen_pattern = True
+                pos += 1
+        elif program == "git":
+            for pos, operand in enumerate(operands):
+                if operand in {"-m", "--message"} and pos + 1 < len(operands):
+                    ignored.add(pos + 1)
+                elif operand.startswith("--message=") or operand.startswith("-m="):
+                    ignored.add(pos)
+
+        for pos, operand in enumerate(operands):
+            if pos in ignored or operand in REDIRECT_OPERATORS:
+                continue
+            target = operand
+            if operand.startswith("--") and "=" in operand:
+                target = operand.split("=", 1)[1]
+            if not target or target.startswith("-"):
+                continue
+            if _token_is_run_target(target, current_cwd, anchor):
+                return True
+    return False
+
+
+def command_touches_run_artifacts(command: str, cwd: Path | None = None) -> bool:
+    """Deny shell access to real run-artifact paths, not textual mentions."""
+    return _analyze_run_command(command, cwd or Path.cwd())
+
+
+def tool_touches_run_artifacts(event: dict[str, Any], root: Path) -> tuple[bool, list[str]]:
+    cwd = Path(str(event.get("cwd") or root)).expanduser()
+    blocked = [raw for raw in _raw_tool_paths(event) if path_is_run_artifact(raw, cwd, event)]
+    if blocked:
+        return True, sorted(dict.fromkeys(blocked))
+    command = command_text(event)
+    if command and command_touches_run_artifacts(command, cwd):
+        return True, ["<shell command>"]
+    return False, []
+
+
 def evidence_observed(event: dict[str, Any], root: Path, artifacts: list[str]) -> list[str]:
     name = tool_name(event)
     if not (any(marker in name for marker in READ_TOOL_MARKERS) or is_command_tool(event)):

package/plugins/devflow-core/runtime/hooks/index_gate.py

@@ -15,8 +15,10 @@ from hook_common import (
     read_event,
     record_prechange_fingerprints,
     required_evidence,
+    tool_touches_mcp_config,
     tool_requests_protected_source,
     tool_touches_control_store,
+    tool_touches_run_artifacts,
 )
 
 
@@ -40,6 +42,13 @@ def main() -> int:
     event = read_event()
     root = project_root(event)
     # Hard protection, evaluated before any soft/strict policy handling.
+    mcp_blocked, mcp_paths = tool_touches_mcp_config(event, root)
+    if mcp_blocked:
+        return deny(
+            "MCP_CONFIG_PROTECTED: $DEVFLOW_HOME/mcp.json and $DEVFLOW_HOME/mcp-audit/ are reserved for "
+            "Devflow MCP authorization and audit records; ordinary agent file and shell access is denied "
+            "regardless of DEVFLOW_SOFT_GATES. Blocked target: " + ", ".join(mcp_paths) + "."
+        )
     control_blocked, control_paths = tool_touches_control_store(event, root)
     if control_blocked:
         return deny(
@@ -49,6 +58,15 @@ def main() -> int:
             "Canonical acceptance-results*.json may be read with the Read/Grep file tools. "
             f"Use devflow_approval(action=\"propose\"|\"list\") for approvals. Blocked target: {', '.join(control_paths)}."
         )
+    run_blocked, run_paths = tool_touches_run_artifacts(event, root)
+    if run_blocked:
+        return deny(
+            "RUN_ARTIFACTS_PROTECTED: .devflow/runs/ contains trace, screenshots, runtime logs and other "
+            "user-local evidence that Agent tools may not read, write or access through bash. Trace and screenshots "
+            "are for the user to inspect locally with Playwright in a terminal; Agent failure analysis must read "
+            "the Core-produced result.json summary instead. Only pure-read access to a feature execution's "
+            "result.json is allowed. Blocked target: " + ", ".join(run_paths) + "."
+        )
     policy = load_policy(root)
     session_id = ensure_session(root, event)
     required = required_evidence(root, policy)

package/plugins/devflow-core/skills/wireframe-render/SKILL.md

@@ -5,4 +5,4 @@ description: Render validated canonical wireframe JSON into deterministic Markdo
 
 # Wireframe Render
 
-Call the workflow-orchestrator wireframe_render.py script only with the current Core-built canonical JSON and the validation metadata. Generate preview Markdown, flow SVG, page SVGs under `wireframes/screens/<screen-id>/<platform>/default.svg`, and the optional static gallery under the wireframe output directory. The `wireframes/screens` directory is a required render output and is covered by the execution contract. The `canonical.meta.json` file is created later by the Core approval path and is not an input to this step. Never read proposal YAML as a substitute, mutate canonical JSON, write approval, or modify workflow state.
+Call the workflow-orchestrator wireframe_render.py script only with the current Core-built canonical JSON and the validation metadata. Generate preview Markdown, flow SVG, one SVG per declared state under `wireframes/screens/<screen-id>/<platform>/<state>.svg` (`default.svg` is always present), and the optional static gallery under the wireframe output directory. The `wireframes/screens` directory is a required render output and is covered by the execution contract. The `canonical.meta.json` file is created later by the Core approval path and is not an input to this step. Never read proposal YAML as a substitute, mutate canonical JSON, write approval, or modify workflow state.

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/acceptance_test_runner.py

@@ -3,6 +3,8 @@
 from __future__ import annotations
 
 import argparse
+import contextlib
+import fcntl
 import hashlib
 import json
 import os
@@ -35,6 +37,8 @@ ALLOWED_BINDING_MODES = {"automated": ("automated", "manual", "blocked"), "manua
 RESULT_ORIGINS = {"command": "project_test_command", "http": "core_http_adapter", playwright_adapter.ADAPTER_KIND: playwright_adapter.RESULT_ORIGIN}
 DEFAULT_RUN_RETENTION_DAYS = 30
 DEFAULT_UNREFERENCED_RUN_TTL_DAYS = 7
+MAX_REPORT_ERRORS = 50
+MAX_REPORT_ERROR_CHARS = 500
 
 
 def utc_now() -> str:
@@ -427,7 +431,36 @@ def run_command_case(root: Path, argv: list[str]) -> tuple[int, str]:
         return 127, f"command could not start: {error}"
 
 
+@contextlib.contextmanager
+def acceptance_run_lock(root: Path, feature: str):
+    """Hold the feature write lock for the complete run, including result writes."""
+    lock_path = root / ".devflow/planning/test-runs" / feature / ".run.lock"
+    lock_path.parent.mkdir(parents=True, exist_ok=True)
+    handle = lock_path.open("a+")
+    try:
+        try:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            yield False
+            return
+        yield True
+    finally:
+        try:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+        finally:
+            handle.close()
+
+
 def run(root: Path, feature: str, write: bool) -> dict[str, Any]:
+    if write:
+        with acceptance_run_lock(root, feature) as acquired:
+            if not acquired:
+                return {"ok": False, "feature": feature, "reason": "acceptance_run_in_progress", "errors": []}
+            return _run_locked(root, feature, write)
+    return _run_locked(root, feature, write)
+
+
+def _run_locked(root: Path, feature: str, write: bool) -> dict[str, Any]:
     validation, suite, bindings = validate(root, feature)
     if not validation["ok"]:
         return validation
@@ -447,7 +480,12 @@ def run(root: Path, feature: str, write: bool) -> dict[str, Any]:
         source = cases[tc_id]
         strategy = source.get("evidence_strategy")
         surface, legacy = derive_surface(source)
-        common = {"tc_id": tc_id, "mode": mode, "execution_surface": surface, "legacy_unclassified": legacy, "tc_sha256": tc_sha256(source)}
+        # Feature-development TCs historically omitted this field; the shared
+        # contract defines that legacy omission as requirement-origin. A
+        # regression suite is frozen only after Core has required it explicitly.
+        oracle_source = source.get("oracle_source") or "requirement"
+        common = {"tc_id": tc_id, "mode": mode, "execution_surface": surface, "legacy_unclassified": legacy,
+                  "oracle_source": oracle_source, "tc_sha256": tc_sha256(source)}
         frozen_mode = source.get("automation_mode")
         if mode != frozen_mode:
             common["downgrade"] = {"from": frozen_mode, "to": mode}
@@ -509,6 +547,8 @@ def run(root: Path, feature: str, write: bool) -> dict[str, Any]:
         passed = sum(1 for item in results if item.get("status") == "passed")
         failed = sum(1 for item in results if item.get("status") == "failed")
         blocked = sum(1 for item in results if item.get("status") == "blocked")
+        oracle_source_counts = {source: sum(1 for item in results if (item.get("oracle_source") or "requirement") == source)
+                                for source in ("requirement", "contract", "invariant", "characterization")}
         write_json(meta_path, {
             "schema_version": 1,
             "feature": feature,
@@ -518,6 +558,7 @@ def run(root: Path, feature: str, write: bool) -> dict[str, Any]:
             "acceptance_tc_legacy_unclassified": sum(1 for item in results if item.get("legacy_unclassified")),
             "acceptance_tc_downgraded": sum(1 for item in results if item.get("downgrade")),
             "acceptance_tc_dsl_unapproved": sum(1 for item in results if item.get("dsl_approval") == "none"),
+            "oracle_source_counts": oracle_source_counts,
             "acceptance_suite_graph_revision": payload["test_suite"].get("graph_revision"),
             "acceptance_results_fingerprint": file_fingerprint(result_path),
             "built_by": "core_acceptance_test_runner",
@@ -527,6 +568,55 @@ def run(root: Path, feature: str, write: bool) -> dict[str, Any]:
             "errors": [] if all_passed else ["one or more frozen TC cases failed or are blocked"]}
 
 
+def _report_error(value: Any) -> dict[str, Any]:
+    text = str(value)
+    # Reports are safe summaries: do not expose project or run locations from gate diagnostics.
+    text = re.sub(r"(?:[A-Za-z]:)?[^\s,;()]+(?:/|\\)[^\s,;()]+", "<path>", text)
+    text = re.sub(r"(?:^|\s)(?:/|~/?|\.\.?/)[^\s,;()]+", " <path>", text)
+    truncated = len(text) > MAX_REPORT_ERROR_CHARS
+    return {"message": text[:MAX_REPORT_ERROR_CHARS], "truncated": True} if truncated else {"message": text, "truncated": False}
+
+
+def _result_summary(entry: dict[str, Any]) -> dict[str, Any]:
+    approval = entry.get("dsl_approval")
+    if isinstance(approval, dict):
+        approval = "approved" if approval.get("status") == "approved" else "none"
+    elif approval not in {"approved", "none"}:
+        approval = None
+    return {key: entry.get(key) for key in (
+        "tc_id", "status", "mode", "adapter_kind", "execution_surface", "oracle_source", "error_code"
+    )} | {"dsl_approval": approval, "legacy_unclassified": bool(entry.get("legacy_unclassified")),
+        "downgrade": entry.get("downgrade")}
+
+
+def report(root: Path, feature: str) -> dict[str, Any]:
+    _, _, result_path = paths(root, feature)
+    if not result_path.is_file():
+        return {"ok": False, "feature": feature, "reason": "acceptance_results_missing"}
+    try:
+        payload = json.loads(result_path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {"ok": False, "feature": feature, "reason": "acceptance_results_missing"}
+    if not isinstance(payload, dict) or not isinstance(payload.get("results"), list):
+        return {"ok": False, "feature": feature, "reason": "acceptance_results_missing"}
+    entries = [entry for entry in payload["results"] if isinstance(entry, dict)]
+    statuses = {status: sum(1 for entry in entries if entry.get("status") == status)
+                for status in ("passed", "failed", "blocked")}
+    oracle_source_counts = {source: sum(1 for entry in entries if (entry.get("oracle_source") or "requirement") == source)
+                            for source in ("requirement", "contract", "invariant", "characterization")}
+    counts = {"passed": statuses["passed"], "failed": statuses["failed"], "blocked": statuses["blocked"],
+              "legacy_unclassified": sum(bool(entry.get("legacy_unclassified")) for entry in entries),
+              "downgraded": sum(bool(entry.get("downgrade")) for entry in entries),
+              "oracle_source": oracle_source_counts}
+    gate = validate_results(root, feature)
+    raw_errors = gate.get("errors", []) if isinstance(gate, dict) else []
+    return {"ok": True, "feature": feature,
+            "gate": {"ok": bool(gate.get("ok")), "reason": gate.get("reason"),
+                     "errors": [_report_error(error) for error in raw_errors[:MAX_REPORT_ERRORS]]},
+            "executed_at": payload.get("executed_at"), "test_suite": payload.get("test_suite"),
+            "counts": counts, "results": [_result_summary(entry) for entry in entries]}
+
+
 def run_evidence_expired(root: Path, feature: str, today: date | None = None) -> bool:
     """True only once release-closeout completed and the post-closeout retention window has elapsed.
 
@@ -610,6 +700,10 @@ def result_entry_errors(root: Path, feature: str, tc_id: str, source: dict[str,
     """Re-verify one recorded result against the CURRENT binding, frozen TC, approvals and evidence files."""
     errors: list[str] = []
     surface, _legacy = derive_surface(source)
+    frozen_oracle_source = source.get("oracle_source") or "requirement"
+    recorded_oracle_source = entry.get("oracle_source")
+    if recorded_oracle_source != frozen_oracle_source:
+        errors.append(f"recorded oracle_source {recorded_oracle_source!r} does not match the frozen TC oracle_source {frozen_oracle_source!r}")
     mode = binding.get("mode")
     if entry.get("mode") != mode:
         errors.append(f"recorded mode {entry.get('mode')!r} does not match the current binding mode {mode!r}")
@@ -764,7 +858,7 @@ def gc_runs(root: Path, feature: str, write: bool, retention_days: int = DEFAULT
 
 def main() -> int:
     parser = argparse.ArgumentParser()
-    parser.add_argument("action", choices=("validate", "validate-human", "run", "validate-results", "gc-runs"))
+    parser.add_argument("action", choices=("validate", "validate-human", "run", "validate-results", "report", "gc-runs"))
     parser.add_argument("--feature", required=True)
     parser.add_argument("--write", action="store_true")
     parser.add_argument("--retention-days", type=int, default=DEFAULT_RUN_RETENTION_DAYS)
@@ -785,6 +879,8 @@ def main() -> int:
         result = run(root, args.feature, args.write) if args.write else {"ok": False, "errors": ["--write is required for run"]}
     elif args.action == "gc-runs":
         result = gc_runs(root, args.feature, args.write, max(args.retention_days, 0), max(args.unreferenced_ttl_days, 0))
+    elif args.action == "report":
+        result = report(root, args.feature)
     else:
         result = validate_results(root, args.feature)
     print(json.dumps(result, ensure_ascii=False, indent=2))

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/acceptance_test_suite.rb

@@ -7,6 +7,7 @@
 require "json"
 require "open3"
 require "optparse"
+require "yaml"
 require_relative "control_io"
 require_relative "requirement_graph"
 
@@ -46,6 +47,10 @@ begin
   lock = DevflowControlIO.acquire_project_lock(root) if command == "freeze"
   graph, path, relative = RequirementGraph.load_graph(root, options[:feature])
   cases = test_nodes(graph)
+  state_path = File.join(root, ".devflow/planning/STATE.md")
+  state_front = File.file?(state_path) ? File.read(state_path).match(/\A---\n(.*?)\n---\n/m)&.[](1) : nil
+  state = state_front ? YAML.safe_load(state_front, permitted_classes: [], aliases: false) : {}
+  regression = state.is_a?(Hash) && state["current_flow"].to_s == "regression-acceptance"
 
   if command == "inspect"
     view = RequirementGraph.view_payload(graph, "tests")
@@ -82,7 +87,7 @@ begin
     else
       matrix = api_test_matrix_check(root, options[:feature], graph)
       result = if matrix["ok"]
-                 RequirementGraph.freeze_test_cases!(root, graph, options[:cp_record], confirm_prerequisites: options[:confirm_prerequisites])
+                 RequirementGraph.freeze_test_cases!(root, graph, options[:cp_record], confirm_prerequisites: options[:confirm_prerequisites], regression: regression)
                else
                  { "ok" => false, "reason" => "api_test_matrix_incomplete", "message" => Array(matrix["errors"]).join("; "), "matrix" => matrix }
                end

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/advance_state.rb

@@ -565,6 +565,11 @@ HARD_FAILURE_REASONS = %w[
   dsl_not_approved
   environment_profile_not_approved
   runtime_integrity_error
+  acceptance_test_suite_freeze_failed
+  acceptance_test_suite_freeze_attestation_invalid
+  acceptance_test_suite_freeze_attestation_failed
+  acceptance_test_suite_candidate_binding_failed
+  acceptance_test_suite_freeze_recovery_failed
 ].freeze
 $devflow_advisories = []
 
@@ -724,7 +729,9 @@ def write_test_suite_freeze_attestation(root, feature, state_revision, candidate
   raise DevflowControlIO::InvalidControlPath, "candidate test suite pin missing from CP-3 binding check" unless candidate_suite.is_a?(Hash)
   raise DevflowControlIO::InvalidControlPath, "frozen test suite pin missing from CP-3 freeze" unless frozen_suite.is_a?(Hash)
   binding_hash = candidate_check["binding_sha256"]
-  raise DevflowControlIO::InvalidControlPath, "test binding hash missing from CP-3 binding check" unless binding_hash.is_a?(String) && !binding_hash.empty?
+  unless candidate_check["regression"] == true || (binding_hash.is_a?(String) && !binding_hash.empty?)
+    raise DevflowControlIO::InvalidControlPath, "test binding hash missing from CP-3 binding check"
+  end
 
   path, relative = test_suite_freeze_attestation_path(root, feature)
   payload = {
@@ -735,9 +742,9 @@ def write_test_suite_freeze_attestation(root, feature, state_revision, candidate
     "state_revision" => state_revision,
     "candidate_test_suite" => candidate_suite,
     "frozen_test_suite" => frozen_suite,
-    "test_binding_sha256" => binding_hash,
     "frozen_case_ids" => Array(freeze_result["frozen_case_ids"]).sort
   }
+  payload["test_binding_sha256"] = binding_hash unless candidate_check["regression"] == true
   DevflowControlIO.atomic_create(path, JSON.pretty_generate(payload) + "\n")
   DevflowControlIO.register_control_artifact(root, {
     "path" => relative, "type" => "test-suite-freeze-attestation", "feature" => feature,
@@ -746,6 +753,26 @@ def write_test_suite_freeze_attestation(root, feature, state_revision, candidate
   payload
 end
 
+def regression_freeze_attestation_check(graph, feature, attestation_path)
+  begin
+    attestation = JSON.parse(File.read(attestation_path))
+  rescue JSON::ParserError, Errno::ENOENT => error
+    return { "ok" => false, "errors" => ["invalid regression freeze attestation: #{error.message}"] }
+  end
+  current_view = graph.dig("views", "tests")
+  cases = Array(graph["nodes"]).select { |node| node.is_a?(Hash) && node["kind"] == "test_case" }
+  errors = []
+  errors << "attestation schema_version is invalid" unless attestation["schema_version"] == 1
+  errors << "attestation origin is invalid" unless attestation["origin"] == "core_acceptance_test_suite_freeze"
+  errors << "attestation feature does not match" unless attestation["feature"] == feature
+  errors << "attestation checkpoint is invalid" unless attestation["checkpoint"] == "CP-3"
+  errors << "attestation frozen suite does not match the graph" unless attestation["frozen_test_suite"] == frozen_test_suite_pin("tests_view" => current_view)
+  frozen_ids = attestation["frozen_case_ids"]
+  expected_ids = cases.map { |node| node["id"] }.sort
+  errors << "attestation does not cover exactly the frozen TC cases" unless frozen_ids.is_a?(Array) && frozen_ids.map(&:to_s).sort == expected_ids
+  { "ok" => errors.empty?, "errors" => errors }
+end
+
 def cp3_freeze_provenance?(graph, state_revision)
   expected = "CP-3: state revision #{state_revision} approved"
   cases = Array(graph["nodes"]).select { |node| node.is_a?(Hash) && node["kind"] == "test_case" }
@@ -754,6 +781,10 @@ def cp3_freeze_provenance?(graph, state_revision)
   end
 end
 
+def regression_workflow?(state, steps)
+  state["current_flow"].to_s == "regression-acceptance" || steps.any? { |step| step["id"] == "regression-test-design" }
+end
+
 # Return from a completed failure branch using its declared return_to contract.
 # The caller must still explicitly confirm the returned checkpoint before any
 # subsequent source-flow step can proceed.
@@ -1111,13 +1142,18 @@ result =
           # inside the checkpoint transition so the user does not have to
           # approve an extra model-issued dialog and a Skill cannot freeze its
           # own candidates early.
-          if result.nil? && state["checkpoint"] == "CP-3" && steps.any? { |step| step["id"] == "acceptance-test-design" }
+          if result.nil? && state["checkpoint"] == "CP-3" && steps.any? { |step| %w[acceptance-test-design regression-test-design].include?(step["id"]) }
             feature = state.fetch("current_feature")
             graph, = RequirementGraph.load_graph(root, feature)
+            regression = regression_workflow?(state, steps)
             attestation_path, = test_suite_freeze_attestation_path(root, feature)
 
             if File.exist?(attestation_path)
-              frozen_check = test_task_binding_check(root, feature, "frozen")
+              frozen_check = if regression
+                regression_freeze_attestation_check(graph, feature, attestation_path)
+              else
+                test_task_binding_check(root, feature, "frozen")
+              end
               unless frozen_check["ok"]
                 result = fail_result("acceptance_test_suite_freeze_attestation_invalid", "test_suite" => frozen_check)
               else
@@ -1128,7 +1164,11 @@ result =
               # attestation is published. Recover only if each TC proves that
               # this exact CP-3 already froze it; never use this path to bless
               # a generic confirmed suite.
-              recovery_check = test_task_binding_check(root, feature, "recovery")
+              recovery_check = if regression
+                { "ok" => true, "regression" => true, "candidate_test_suite" => graph.dig("views", "tests") }
+              else
+                test_task_binding_check(root, feature, "recovery")
+              end
               unless recovery_check["ok"]
                 result = fail_result("acceptance_test_suite_freeze_recovery_failed", "test_suite" => recovery_check)
               else
@@ -1139,7 +1179,11 @@ result =
                 }
                 begin
                   write_test_suite_freeze_attestation(root, feature, current_revision, recovery_check, recovered)
-                  frozen_check = test_task_binding_check(root, feature, "frozen")
+                  frozen_check = if regression
+                    regression_freeze_attestation_check(graph, feature, attestation_path)
+                  else
+                    test_task_binding_check(root, feature, "frozen")
+                  end
                   if frozen_check["ok"]
                     actions << "acceptance_test_suite_freeze_attestation_recovered"
                   else
@@ -1160,7 +1204,11 @@ result =
                 result = fail_result("execution_surface_mismatch", "execution_surface" => surface_check) unless surface_check["ok"]
               end
               if matrix_check["ok"] && surface_check["ok"]
-                candidate_check = test_task_binding_check(root, feature, "candidate")
+                candidate_check = if regression
+                  { "ok" => true, "regression" => true, "candidate_test_suite" => graph.dig("views", "tests") }
+                else
+                  test_task_binding_check(root, feature, "candidate")
+                end
                 unless candidate_check["ok"]
                   result = fail_result("acceptance_test_suite_candidate_binding_failed", "test_suite" => candidate_check)
                 else
@@ -1169,6 +1217,7 @@ result =
                     graph,
                     "CP-3: state revision #{current_revision} approved",
                     confirm_prerequisites: options[:confirm_test_prerequisites] && options[:runtime_confirmed],
+                    regression: regression,
                     persist: false
                   )
                   unless frozen["ok"]
@@ -1313,7 +1362,14 @@ result =
                 pending_freeze.fetch("candidate_check"),
                 pending_freeze.fetch("frozen")
               )
-              frozen_check = test_task_binding_check(root, pending_freeze.fetch("feature"), "frozen")
+              frozen_check = if pending_freeze.dig("candidate_check", "regression") == true
+                regression_freeze_attestation_check(
+                  pending_freeze.fetch("graph"), pending_freeze.fetch("feature"),
+                  test_suite_freeze_attestation_path(root, pending_freeze.fetch("feature")).first
+                )
+              else
+                test_task_binding_check(root, pending_freeze.fetch("feature"), "frozen")
+              end
               unless frozen_check["ok"]
                 result = fail_result("acceptance_test_suite_freeze_attestation_invalid", "test_suite" => frozen_check)
               end