@michaelxwb/code-flow 0.6.0 → 0.6.2

package/src/core/code-flow/scripts/cf_spec_verify.py

@@ -11,12 +11,23 @@ import hashlib
 import json
 from pathlib import Path
 import subprocess
+from threading import Lock
+import time
+from concurrent.futures import ThreadPoolExecutor
 from typing import Mapping, Optional, Sequence
 
 from cf_checks import run_regex_verifier
 from cf_spec_metadata import SpecMetadata, SpecRule, SpecVerifier
 
 
+_RESULT_CACHE: dict[str, dict[str, object]] = {}
+_RESULT_CACHE_ROOT: Optional[str] = None
+_RESULT_CACHE_DIRTY = False
+_RESULT_CACHE_LOCK = Lock()
+_MAX_RESULT_CACHE_ENTRIES = 2048
+_PURE_VERIFIER_TYPES = frozenset(("document", "regex", "ast"))
+
+
 @dataclass(frozen=True)
 class VerificationScope:
     root: str
@@ -43,6 +54,94 @@ class VerificationResult:
     passed: bool
 
 
+def _cache_file(root: str) -> Path:
+    return Path(root) / ".code-flow" / ".verifier-cache.json"
+
+
+def _cache_key(metadata: SpecMetadata, rule: SpecRule, verifier: SpecVerifier, scope: VerificationScope, confirmation: Optional[Mapping[str, object]]) -> str:
+    payload = {
+        "spec": metadata.hashes.file_sha256,
+        "rule": rule.text_sha256,
+        "verifier": {"type": verifier.type, "config": verifier.config},
+        "files": scope.files,
+        "diff": scope.diff_sha256,
+        "confirmation": confirmation or {},
+    }
+    return hashlib.sha256(json.dumps(payload, ensure_ascii=False, sort_keys=True, default=str).encode()).hexdigest()
+
+
+def _load_result_cache(root: str) -> None:
+    global _RESULT_CACHE_ROOT, _RESULT_CACHE, _RESULT_CACHE_DIRTY
+    if _RESULT_CACHE_ROOT == root:
+        return
+    _RESULT_CACHE_ROOT = root
+    _RESULT_CACHE = {}
+    _RESULT_CACHE_DIRTY = False
+    path = _cache_file(root)
+    try:
+        loaded = json.loads(path.read_text(encoding="utf-8"))
+        if isinstance(loaded, dict):
+            _RESULT_CACHE.update({str(key): value for key, value in loaded.items() if isinstance(value, dict)})
+    except (OSError, ValueError):
+        pass
+
+
+def _cached_evidence(key: str) -> Optional[VerificationEvidence]:
+    item = _RESULT_CACHE.get(key)
+    if not isinstance(item, dict) or item.get("status") != "verified":
+        return None
+    try:
+        return VerificationEvidence(**item)
+    except (TypeError, ValueError):
+        return None
+
+
+def _save_result_cache(key: str, evidence: VerificationEvidence) -> None:
+    global _RESULT_CACHE_DIRTY
+    with _RESULT_CACHE_LOCK:
+        _RESULT_CACHE[key] = evidence.__dict__
+        _RESULT_CACHE_DIRTY = True
+        while len(_RESULT_CACHE) > _MAX_RESULT_CACHE_ENTRIES:
+            _RESULT_CACHE.pop(next(iter(_RESULT_CACHE)))
+
+
+def _flush_result_cache(root: str) -> None:
+    global _RESULT_CACHE_DIRTY
+    with _RESULT_CACHE_LOCK:
+        if not _RESULT_CACHE_DIRTY:
+            return
+        path = _cache_file(root)
+        try:
+            path.parent.mkdir(parents=True, exist_ok=True)
+            temporary = path.with_suffix(".json.tmp")
+            temporary.write_text(
+                json.dumps(_RESULT_CACHE, ensure_ascii=False, sort_keys=True, default=str), encoding="utf-8"
+            )
+            temporary.replace(path)
+            _RESULT_CACHE_DIRTY = False
+        except OSError:
+            pass
+
+
+def _cached_or_run(
+    metadata: SpecMetadata,
+    rule: SpecRule,
+    verifier: SpecVerifier,
+    scope: VerificationScope,
+    confirmation: Optional[Mapping[str, object]],
+) -> VerificationEvidence:
+    cacheable = verifier.type in _PURE_VERIFIER_TYPES
+    key = _cache_key(metadata, rule, verifier, scope, confirmation) if cacheable else ""
+    if cacheable:
+        cached = _cached_evidence(key)
+        if cached is not None:
+            return cached
+    current = _evidence(metadata, rule, verifier, scope, confirmation)
+    if cacheable and current.status == "verified":
+        _save_result_cache(key, current)
+    return current
+
+
 @dataclass(frozen=True)
 class _Outcome:
     passed: bool
@@ -160,13 +259,15 @@ def _argv(config: Mapping[str, object]) -> Optional[list[str]]:
     return list(value)
 
 
-def _command(config: Mapping[str, object], scope: VerificationScope) -> _Outcome:
+def _command(config: Mapping[str, object], scope: VerificationScope, timeout_cap: Optional[float] = None) -> _Outcome:
     argv = _argv(config)
     if argv is None:
         return _Outcome(False, "invalid_verifier_config", None, {"required": ["argv"]})
     cwd = _config_string(config, "cwd") or "."
     timeout_value = config.get("timeout", 30)
     timeout = float(timeout_value) if isinstance(timeout_value, (int, float)) else 30.0
+    if timeout_cap is not None:
+        timeout = min(timeout, timeout_cap)
     allowed_value = config.get("allowed_exit_codes", [0])
     allowed = tuple(item for item in allowed_value if isinstance(item, int)) if isinstance(allowed_value, list) else (0,)
     try:
@@ -209,6 +310,7 @@ def _run(
     metadata: SpecMetadata,
     scope: VerificationScope,
     confirmation: Optional[Mapping[str, object]],
+    timeout_cap: Optional[float] = None,
 ) -> _Outcome:
     if verifier.type == "document":
         return _document(verifier.config, scope)
@@ -217,7 +319,7 @@ def _run(
     if verifier.type == "ast":
         return _ast(verifier.config, scope)
     if verifier.type in ("command", "test"):
-        return _command(verifier.config, scope)
+        return _command(verifier.config, scope, timeout_cap)
     if verifier.type == "manual":
         return _manual(verifier.config, confirmation)
     return _Outcome(False, "verifier_type_unimplemented", None, {"type": verifier.type})
@@ -229,8 +331,9 @@ def _evidence(
     verifier: SpecVerifier,
     scope: VerificationScope,
     confirmation: Optional[Mapping[str, object]],
+    timeout_cap: Optional[float] = None,
 ) -> VerificationEvidence:
-    outcome = _run(verifier, metadata, scope, confirmation)
+    outcome = _run(verifier, metadata, scope, confirmation, timeout_cap)
     status = "verified" if outcome.passed else "unverified"
     diff_hash = None if verifier.type == "document" else scope.diff_sha256
     return VerificationEvidence(
@@ -246,22 +349,61 @@ def _evidence(
     )
 
 
+def _skipped_evidence(metadata: SpecMetadata, rule: SpecRule, scope: VerificationScope) -> VerificationEvidence:
+    details = {"skipped": True}
+    return VerificationEvidence(
+        f"{metadata.id}#{rule.ref}",
+        datetime.now(timezone.utc).isoformat(),
+        "unverified",
+        rule.text_sha256,
+        None,
+        scope.diff_sha256,
+        _result_hash("unverified", "skipped_in_cheap_gate", details),
+        "skipped_in_cheap_gate",
+        details,
+    )
+
+
+def _budget_evidence(metadata: SpecMetadata, rule: SpecRule, scope: VerificationScope, budget: float) -> VerificationEvidence:
+    details = {"budget": budget}
+    return VerificationEvidence(
+        f"{metadata.id}#{rule.ref}",
+        datetime.now(timezone.utc).isoformat(),
+        "unverified",
+        rule.text_sha256,
+        None,
+        scope.diff_sha256,
+        _result_hash("unverified", "verifier_budget_exhausted", details),
+        "verifier_budget_exhausted",
+        details,
+    )
+
+
 def run_all_verifiers(
     metadata: SpecMetadata,
     scope: VerificationScope,
     confirmations: Optional[Mapping[str, Mapping[str, object]]] = None,
+    skip_command: bool = False,
+    timeout_budget: Optional[float] = None,
 ) -> VerificationResult:
     verifier_by_rule = {item.rule: item for item in metadata.verifiers}
     confirmation_by_rule = confirmations or {}
-    evidence: list[VerificationEvidence] = []
+    _load_result_cache(scope.root)
+    evidence_by_ref: dict[str, VerificationEvidence] = {}
+    parallel: list[tuple[SpecRule, SpecVerifier, Optional[Mapping[str, object]]]] = []
+    started = time.monotonic()
     for rule in metadata.rules:
         if rule.enforcement != "required":
             continue
+        if timeout_budget is not None:
+            remaining = timeout_budget - (time.monotonic() - started)
+            if remaining <= 0:
+                evidence_by_ref[rule.ref] = _budget_evidence(metadata, rule, scope, timeout_budget)
+                continue
         verifier = verifier_by_rule.get(rule.ref)
         if verifier is None:
             details = {"rule": rule.ref}
-            evidence.append(
-                VerificationEvidence(
+            evidence_by_ref[rule.ref] = VerificationEvidence(
                     f"{metadata.id}#{rule.ref}",
                     datetime.now(timezone.utc).isoformat(),
                     "unverified",
@@ -272,10 +414,25 @@ def run_all_verifiers(
                     "verifier_missing",
                     details,
                 )
-            )
             continue
-        evidence.append(_evidence(metadata, rule, verifier, scope, confirmation_by_rule.get(rule.ref)))
-    result = tuple(evidence)
+        if skip_command and verifier.type in ("command", "test"):
+            evidence_by_ref[rule.ref] = _skipped_evidence(metadata, rule, scope)
+            continue
+        confirmation = confirmation_by_rule.get(rule.ref)
+        if timeout_budget is None and verifier.type in ("document", "regex", "ast"):
+            parallel.append((rule, verifier, confirmation))
+            continue
+        cap = None if timeout_budget is None else max(0.1, timeout_budget - (time.monotonic() - started))
+        evidence_by_ref[rule.ref] = _cached_or_run(metadata, rule, verifier, scope, confirmation) if cap is None else _evidence(metadata, rule, verifier, scope, confirmation, cap)
+    if parallel:
+        with ThreadPoolExecutor(max_workers=min(8, len(parallel))) as pool:
+            futures = {
+                rule.ref: pool.submit(_cached_or_run, metadata, rule, verifier, scope, confirmation)
+                for rule, verifier, confirmation in parallel
+            }
+            evidence_by_ref.update({ref: future.result() for ref, future in futures.items()})
+    result = tuple(evidence_by_ref[rule.ref] for rule in metadata.rules if rule.ref in evidence_by_ref)
+    _flush_result_cache(scope.root)
     return VerificationResult(result, bool(result) and all(item.status == "verified" for item in result))
 
 

package/src/core/code-flow/scripts/cf_stop_hook.py

@@ -25,11 +25,14 @@ from cf_core import (
     ensure_utf8_io,
     load_config,
     normalize_path,
+    resolve_enforcement,
     resolve_quality_loop,
     resolve_session_id,
+    timing_log,
 )
 
 TOTAL_BUDGET_SECONDS = 30.0
+GATE_BUDGET_SECONDS = 25.0
 _BRACE_RE = re.compile(r"\{([^{}]+)\}")
 _TASK_SECTION_RE = re.compile(
     r"(?ms)^## (TASK-\d+):.*?(?=^## TASK-\d+:|\Z)"
@@ -246,6 +249,12 @@ def main() -> None:
             return  # 已因本 hook 续跑过一轮，避免循环
         project_root = os.getcwd()
         sid = resolve_session_id(data)
+        config = load_config(project_root)
+        if not config:
+            return
+        enforcement = resolve_enforcement(config)
+        if enforcement == "inject":
+            return  # 轻量模式：只注入不门禁，停止会话不受限
         marker = os.path.join(project_root, ".code-flow", ".active-task.json")
         has_active = os.path.exists(marker)
         files = []
@@ -253,19 +262,25 @@ def main() -> None:
             try:
                 active = load_active_task(project_root)
                 task_dir = os.path.join(project_root, active.task_dir)
-                done = run_done_gate(project_root, task_dir)
+                done = run_done_gate(project_root, task_dir, budget=GATE_BUDGET_SECONDS)
             except (OSError, ValueError) as exc:
-                payload = {"decision": "block", "reason": f"SPEC_WORKFLOW_BLOCKED: active task is invalid: {exc}"}
-                sys.stdout.write(json.dumps(payload, ensure_ascii=False))
-                return
-            if done.decision != "pass":
-                payload = {"decision": "block", "reason": "当前 TASK required Spec verifier/Evidence 未通过；修复或重新对齐后再 Done。"}
-                sys.stdout.write(json.dumps(payload, ensure_ascii=False))
-                return
-            files = list(done.files)
-        config = load_config(project_root)
-        if not config:
-            return
+                if enforcement == "required":
+                    payload = {"decision": "block", "reason": f"SPEC_WORKFLOW_BLOCKED: active task is invalid: {exc}"}
+                    sys.stdout.write(json.dumps(payload, ensure_ascii=False))
+                    return
+                cf_log.append_event(project_root, "stop_check", {"gate": "invalid_active_nonfatal", "error": str(exc)}, sid)
+                files = []
+            else:
+                if done.decision != "pass":
+                    reason = done.message or "当前 TASK required Spec verifier/Evidence 未通过；修复或重新对齐后再 Done。"
+                    if any(item.get("error_code") == "verifier_budget_exhausted" for item in done.evidence):
+                        reason += "（验证预算不足，部分 verifier 未运行，请拆分 TASK 或减少验证命令）"
+                    if enforcement == "required":
+                        payload = {"decision": "block", "reason": reason}
+                        sys.stdout.write(json.dumps(payload, ensure_ascii=False))
+                        return
+                    cf_log.append_event(project_root, "stop_check", {"gate": "blocked_nonfatal", "reason": reason}, sid)
+                files = list(done.files)
         if not resolve_quality_loop(config)["stop_check"]:
             return
         if not has_active:
@@ -280,6 +295,13 @@ def main() -> None:
         failures = acceptance_failures + failures
         if not failures:
             return  # 全过或无 validation.yml 且无验收缺口时静默
+        if enforcement == "warn":
+            cf_log.append_event(
+                project_root, "stop_check",
+                {"failures": [item["name"] for item in failures], "nonfatal": True},
+                sid,
+            )
+            return
         payload = {"decision": "block", "reason": _reason_text(failures, truncated)}
         sys.stdout.write(json.dumps(payload, ensure_ascii=False))
     except Exception as exc:
@@ -289,3 +311,4 @@ def main() -> None:
 
 if __name__ == "__main__":
     main()
+    timing_log("cf_stop_hook")

package/src/core/code-flow/scripts/cf_sync.py

@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""cf-sync: one-command canonical → deploy sync for dual-copy artifacts.
+
+Pairs (canonical source → deployed live copy), each with an explicit include
+prefix list — project-owned trees (specs/, tasks/) and deploy-only files
+(config.toml, CLAUDE.md, opencode.json) are never touched:
+
+  src/core/code-flow         → .code-flow        (scripts/, config.yml, .version, validation.yml, .gitignore)
+  src/adapters/claude        → .claude           (commands/, settings.local.json)
+  src/adapters/codex         → .codex            (hooks.json)
+  src/adapters/codex/skills  → .agents/skills    (everything)
+  src/adapters/costrict      → .costrict         (commands/, settings.local.json)
+  src/adapters/opencode      → .opencode         (commands/, plugins/)
+
+`check` (default) reports drift; `sync` copies canonical → deploy. Deploy-only
+files are never deleted (use --prune to remove files whose source side no
+longer contains them within the include prefixes).
+"""
+
+import argparse
+import filecmp
+import os
+from pathlib import Path
+import shutil
+import sys
+from typing import IO, Optional, Sequence
+
+
+PAIRS = (
+    ("src/core/code-flow", ".code-flow", ("scripts/", ".version", ".gitignore")),
+    ("src/adapters/claude", ".claude", ("commands/",)),
+    ("src/adapters/codex", ".codex", ("hooks.json",)),
+    ("src/adapters/codex/skills", ".agents/skills", ("*",)),
+    ("src/adapters/costrict", ".costrict", ("commands/",)),
+    ("src/adapters/opencode", ".opencode", ("commands/", "plugins/")),
+)
+
+_IGNORED_DIRS = {"__pycache__", ".git", "node_modules", "dist", "build"}
+
+
+def _included(relative: str, prefixes: Sequence[str]) -> bool:
+    return any(prefix == "*" or relative.startswith(prefix) for prefix in prefixes)
+
+
+def _walk(source: Path) -> list[str]:
+    files = []
+    for current, dirs, names in os.walk(source):
+        dirs[:] = sorted(item for item in dirs if item not in _IGNORED_DIRS)
+        base = Path(current)
+        for name in names:
+            files.append(str((base / name).relative_to(source)))
+    return sorted(files)
+
+
+def _relative(relative: str) -> str:
+    return relative.replace("\\", "/")
+
+
+def _pair_diffs(root: Path, source_rel: str, deploy_rel: str, prefixes: Sequence[str]) -> tuple[list[str], list[str], list[str]]:
+    """Return (differ, missing_in_deploy, deploy_only_within_prefixes)."""
+    source = root / source_rel
+    deploy = root / deploy_rel
+    differ: list[str] = []
+    missing: list[str] = []
+    for relative in _walk(source):
+        if not _included(_relative(relative), prefixes):
+            continue
+        source_file = source / relative
+        deploy_file = deploy / relative
+        if not deploy_file.exists():
+            missing.append(relative)
+        elif not filecmp.cmp(source_file, deploy_file, shallow=False):
+            differ.append(relative)
+    deploy_only: list[str] = []
+    if deploy.is_dir():
+        deploy_relative = set(_walk(deploy))
+        source_relative = {_relative(item) for item in _walk(source) if _included(_relative(item), prefixes)}
+        deploy_only = sorted(item for item in deploy_relative if item not in source_relative and _included(item, prefixes))
+    return differ, missing, deploy_only
+
+
+def _report(stdout: IO[str], root: Path, verbose: bool) -> int:
+    drift = 0
+    for source_rel, deploy_rel, prefixes in PAIRS:
+        differ, missing, deploy_only = _pair_diffs(root, source_rel, deploy_rel, prefixes)
+        status = "OK " if not (differ or missing) else "DRIFT"
+        stdout.write(f"{status} {source_rel} -> {deploy_rel}\n")
+        for relative in differ:
+            stdout.write(f"  diff  {deploy_rel}/{relative}\n")
+            drift += 1
+        for relative in missing:
+            stdout.write(f"  miss  {deploy_rel}/{relative}\n")
+            drift += 1
+        if verbose and deploy_only:
+            stdout.write(f"  only-in-deploy ({len(deploy_only)}):\n")
+            for relative in deploy_only[:10]:
+                stdout.write(f"    {deploy_rel}/{relative}\n")
+    return drift
+
+
+def _sync(root: Path, stdout: IO[str]) -> int:
+    copied = 0
+    for source_rel, deploy_rel, prefixes in PAIRS:
+        source = root / source_rel
+        deploy = root / deploy_rel
+        for relative in _walk(source):
+            if not _included(_relative(relative), prefixes):
+                continue
+            source_file = source / relative
+            deploy_file = deploy / relative
+            if deploy_file.exists() and filecmp.cmp(source_file, deploy_file, shallow=False):
+                continue
+            deploy_file.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(source_file, deploy_file)
+            stdout.write(f"sync  {deploy_rel}/{relative}\n")
+            copied += 1
+    return copied
+
+
+def main(argv: Optional[Sequence[str]] = None, stdout: IO[str] = sys.stdout) -> int:
+    parser = argparse.ArgumentParser(prog="cf_sync.py")
+    parser.add_argument("action", choices=("check", "sync"), nargs="?", default="check")
+    parser.add_argument("--root", default=".")
+    parser.add_argument("--verbose", action="store_true")
+    args = parser.parse_args(argv)
+    root = Path(args.root).resolve()
+    if args.action == "check":
+        drift = _report(stdout, root, args.verbose)
+        if drift:
+            stdout.write(f"{drift} file(s) drifted; run `cf_sync.py sync` to deploy.\n")
+            return 1
+        stdout.write("all pairs in sync.\n")
+        return 0
+    copied = _sync(root, stdout)
+    stdout.write(f"{copied} file(s) deployed.\n")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/src/core/code-flow/scripts/cf_task_runtime.py

@@ -6,7 +6,8 @@ from __future__ import annotations
 from dataclasses import dataclass, replace
 import hashlib
 from pathlib import Path
-from typing import Mapping
+import time
+from typing import Mapping, Optional
 
 from cf_spec_context import (
     BindingInput,
@@ -19,12 +20,15 @@ from cf_spec_context import (
     load_active_task,
     load_context,
     pause_active_task,
+    resync_active_hash,
     save_context,
 )
 from cf_spec_gate import validate_stage
 from cf_spec_metadata import load_spec_metadata
 from cf_spec_resolver import resolve_candidates, SpecCandidate
+from cf_spec_session import context_sha256
 from cf_spec_verify import VerificationEvidence, VerificationScope, run_all_verifiers
+from cf_core import phase_timing
 
 
 @dataclass(frozen=True)
@@ -40,12 +44,31 @@ class DoneResult:
     decision: str
     files: tuple[str, ...]
     evidence: tuple[Mapping[str, object], ...]
+    message: str = ""
 
 
 def _context_path(task_dir: str) -> str:
     return str(Path(task_dir) / "spec-context.yml")
 
 
+def _manual_manifest_issue(task_dir: str) -> str:
+    path = Path(task_dir) / ".acceptance-manifest.json"
+    if not path.is_file():
+        return ""
+    try:
+        import json
+
+        data = json.loads(path.read_text(encoding="utf-8"))
+        pending = [
+            item.get("id", "unknown")
+            for item in data.get("scenarios", [])
+            if isinstance(item, dict) and item.get("kind") == "manual" and item.get("status") != "verified"
+        ]
+        return f"manual 场景未完成: {', '.join(pending)}" if pending else ""
+    except (OSError, ValueError, TypeError):
+        return "acceptance manifest invalid"
+
+
 def _required_candidate(candidate: SpecCandidate) -> bool:
     metadata = candidate.metadata
     return metadata.enforcement == "required" and any(
@@ -71,6 +94,9 @@ def evaluate_scope(root: str, task_dir: str) -> ScopeResult:
         for candidate in new
     )
     save_context(_context_path(task_dir), bind_specs(context, selections))
+    # The toolchain expanded the context itself; re-sync the marker so this
+    # automatic change does not surface as active_context_drift with no recovery.
+    resync_active_hash(root, task_dir, context_sha256(load_context(_context_path(task_dir))))
     required = tuple(candidate.spec_id for candidate in new if _required_candidate(candidate))
     if required:
         pause_active_task(root)
@@ -107,8 +133,20 @@ def _update_rule(rule: RuleBinding, evidence: Mapping[str, object]) -> RuleBindi
         return rule
     statuses = dict(rule.stage_status)
     current = statuses["code"]
+    if current.status in ("not_applicable", "waived"):
+        return rule
     status = "verified" if evidence.get("status") == "verified" else "unverified"
-    statuses["code"] = replace(current, status=status, evidence=(*current.evidence, evidence))
+    if evidence.get("error_code") == "skipped_in_cheap_gate":
+        signature = (evidence.get("verifier_ref"), evidence.get("result_sha256"), None)
+    else:
+        signature = (evidence.get("verifier_ref"), evidence.get("result_sha256"), evidence.get("diff_sha256"))
+    if any(
+        (item.get("verifier_ref"), item.get("result_sha256"), item.get("diff_sha256")) == signature
+        for item in current.evidence
+    ):
+        statuses["code"] = replace(current, status=status)
+    else:
+        statuses["code"] = replace(current, status=status, evidence=(*current.evidence, evidence))
     return replace(rule, stage_status=statuses)
 
 
@@ -125,18 +163,68 @@ def _apply_evidence(context: SpecContext, evidence: tuple[Mapping[str, object],
     return replace(context, bindings=tuple(bindings))
 
 
-def run_done_gate(root: str, task_dir: str) -> DoneResult:
+def _rule_manual_confirmation(rule: RuleBinding) -> Optional[Mapping[str, object]]:
+    status = rule.stage_status.get("code")
+    if status is None or status.decision is None or status.decision.kind != "manual_verification":
+        return None
+    decision = status.decision
+    return {
+        "reason": decision.reason,
+        "confirmed_by": decision.confirmed_by,
+        "confirmed_at": decision.confirmed_at,
+        "source": decision.source,
+    }
+
+
+def run_done_gate(root: str, task_dir: str, cheap: bool = False, budget: Optional[float] = None, include_e2e: bool = False) -> DoneResult:
+    started = time.monotonic()
+    phase_started = time.monotonic()
     scope_result = evaluate_scope(root, task_dir)
+    phase_timing("done.evaluate_scope", phase_started)
     if scope_result.decision == "pause":
-        return DoneResult("block", scope_result.files, ())
+        return DoneResult("block", scope_result.files, (), scope_result.message)
+    manual_issue = _manual_manifest_issue(task_dir)
+    if manual_issue:
+        return DoneResult("block", scope_result.files, (), manual_issue)
+    manifest_path = Path(task_dir) / ".acceptance-manifest.json"
+    if manifest_path.is_file():
+        try:
+            import json
+            manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+            has_commands = any(
+                isinstance(item, dict) and isinstance(item.get("command"), list)
+                for item in manifest.get("scenarios", [])
+            )
+        except (OSError, ValueError, TypeError):
+            return DoneResult("block", scope_result.files, (), "acceptance manifest invalid")
+        if has_commands:
+            from cf_acceptance_runner import run_manifest
+
+            scenario_result = run_manifest(str(manifest_path), root, write_evidence=True, include_e2e=include_e2e)
+            if scenario_result["decision"] == "block":
+                return DoneResult("block", scope_result.files, (), "acceptance scenario failed")
+    phase_started = time.monotonic()
     context = load_context(_context_path(task_dir))
     diff_hash = _diff_hash(root, scope_result.files)
+    phase_timing("done.load_context_and_diff", phase_started)
     all_evidence: list[Mapping[str, object]] = []
     for binding in context.bindings:
+        phase_started = time.monotonic()
         metadata = load_spec_metadata(str(Path(root) / ".code-flow/specs" / binding.path))
-        result = run_all_verifiers(metadata, VerificationScope(root, scope_result.files, diff_hash))
+        confirmations: dict[str, Mapping[str, object]] = {}
+        for rule in binding.rules:
+            confirmation = _rule_manual_confirmation(rule)
+            if confirmation is not None:
+                confirmations[rule.ref] = confirmation
+        remaining = None if budget is None else budget - (time.monotonic() - started)
+        result = run_all_verifiers(
+            metadata, VerificationScope(root, scope_result.files, diff_hash), confirmations, cheap, remaining
+        )
+        phase_timing(f"done.verify.{binding.spec_id}", phase_started)
         all_evidence.extend(_evidence_data(item) for item in result.evidence)
     updated = _apply_evidence(context, tuple(all_evidence))
-    save_context(_context_path(task_dir), updated)
-    gate = validate_stage(updated, "code")
+    if updated != context:
+        save_context(_context_path(task_dir), updated)
+    gate = validate_stage(updated, "code", diff_sha256=diff_hash)
+    phase_timing("done.total", started)
     return DoneResult(gate.decision, scope_result.files, tuple(all_evidence))