@mstar-harness/dsh 3.8.3 → 3.9.0

package/harness-skills/mstar-iteration/references/phase-4-5-pr-delivery.md

@@ -23,8 +23,8 @@
 ### 5.0 Phase boundary
 
 - Phase 5 在 PR head（`spec_integration_branch`）上 push 修复；**禁止**另开替代分支
-- **Checkout / worktree（HARD）**：Phase 5 是 PR 级 **hotfix** loop，**不是** Phase 2 plan 实现。修复直接在 **control worktree**（已检出 `spec_integration_branch` 的 checkout）上编辑、commit、再按 §5.1a push。**禁止**为 Phase 5 另开 feature / fix worktree；**禁止**把 Phase 2「control 禁止产品编辑 / 须 feature worktree」套用到 Phase 5。另开 worktree 浪费时间、磁盘与计算，与 Phase 5 快速收敛 CI/review 的目标相悖。
-- 产品代码修复 → PM **dispatch** dev/ops（`mstar-dispatch-gates`）；Assignment **`Worktree path`** / cwd = control（snapshot `control_worktree_path` 或当前已在集成分支上的 checkout）；PM 线程不代写实现
+- **Checkout / worktree（HARD）**：Phase 5 是 PR 级 **hotfix** loop，**不是** Phase 2 plan 实现。产品修复在 **fix feature worktree**（从 `spec_integration_branch` 出的 fix 分支）上编辑、commit；review 后在 **integration worktree**（snapshot `integration_worktree_path`）merge 回 `spec_integration_branch`，再按 §5.1a push。**禁止**在 integration worktree 或主 checkout（control root）上直接编辑产品代码——三域表（`mstar-branch-worktree`）规定 product source → feature worktree only；merge 一次一个 holder。
+- 产品代码修复 → PM **dispatch** dev/ops（`mstar-dispatch-gates`）；Assignment **`Worktree path`** / cwd = 绝对 fix feature worktree 路径；merge 回 integration 由 PM 在 **integration worktree** 执行；PM 线程不代写实现
 - 禁止为「让 CI 变绿」而改 workflow，除非用户明确授权
 - **Push cadence** → **§5.1a**（本地可提前修；**禁止**在 CI / AI review 波次未结束时 push）
 
@@ -72,14 +72,15 @@ History rewrite / force-with-lease / 改写后证据失效规则 SSOT → `mstar
 
 When both babysit/`*-babysit` and greploop apply: **babysit/`*-babysit` first**（CI + reviews），then optional greploop for Greptile score. Discovery paths → `mstar-iteration` §5 (iteration command layer).
 
-### 5.2 Phase 5 exit checklist（迭代交付完成）
+### 5.2 Phase 5 exit checklist（merge-ready → enter Phase 6）
 
-打印 **`## Phase 5 exit checklist`**；全 `[x]` 后方可宣称 **迭代交付完成**：
+打印 **`## Phase 5 exit checklist`**；前 5 项全 `[x]` = **merge-ready**（第 6 项为 transition marker，merged 后才可勾），此后唯一出口是 **Phase 6**（PR merged 后执行 `references/phase-6-post-merge-close.md` §6.1–§6.4）——本 checklist **不是**「迭代交付完成」：
 
 - [ ] PR mergeable（无 blocking merge conflicts）
 - [ ] All **required** CI checks green on latest head
 - [ ] All review threads **resolved**（或用户书面 waive 特定 thread）
 - [ ] §5.1 review comment + resolve 已覆盖本轮所有 addressed feedback
 - [ ] Host todo `phase-5-pr-merge-ready` 可勾选
+- [ ] PR **merge** 完成后进入 **Phase 6**：追加 todo `phase-6-post-merge-close`，执行 post-merge close（`references/phase-6-post-merge-close.md` §6.1–§6.4）
 
-PR **merge** 本身可仍由用户手动执行，除非 Assignment 明确授权 auto-merge。
+PR **merge** 本身可仍由用户手动执行，除非 Assignment 明确授权 auto-merge。Merge 完成（手动或授权 auto-merge）即进入 **Phase 6** —— merge 不是生命周期终点。

package/harness-skills/mstar-iteration/references/phase-6-post-merge-close.md

@@ -0,0 +1,71 @@
+# Phase 6: post-merge close（terminal snapshot → unregister → reconcile → cleanup handoff）
+
+> Loaded by `mstar-iteration` SKILL.md when entering Phase 6. **Read `mstar-harness-core` first.** 进入前置：§5.2 exit checklist 全 `[x]` **且 PR 已 merge**（verified merged）。mergeable ≠ merged；引擎无法探测远端 PR 状态 —— merged 与否由 PM 核实后再调用，close verb **不**充当 merge 验证器。
+
+## Entry
+
+1. 打印 **`## Phase 6: post-merge close`**
+2. 追加 host todo `phase-6-post-merge-close`（session todos SSOT → `references/command-shared-invariants.md`）
+3. 可恢复：Phase 6 允许在后续会话补跑；对已 terminal 的 lifecycle 幂等（fully closed retry 不改任何文件、不重写 `ended_at`）
+
+Ordered pipeline（HARD —— 顺序固定，禁止跳步/倒置）：
+
+**§6.1 terminal snapshot write → §6.2 unregister → §6.3 projection reconciliation → §6.4 cleanup handoff。**
+
+## §6.1 Terminal snapshot write（先写终态）
+
+```text
+mstar status workflow-close --workflow <id> [--harness <path>] [--ended-at <date>]
+```
+
+- 引擎 `closeWorkflow`：在 snapshot 写锁内**重读最新快照** → identity/shape 校验 → 已 valid terminal 则 no-op；否则要求全部 plan 行 `Done` 且**无任何** `execution_lease` / `integration_merge_lease` → 写 `completed` + `ended_at`
+- fail-loud：dangling lease / 非 `Done` 行 / snapshot 缺失或身份不符 → exit 1，**snapshot 字节不变**（无部分写）
+- **禁止**为通过 close 释放 lease —— lease release 是独立的 owner 动作，close 从不释放（甚至 caller 自己的）
+- `--ended-at` 省略时由 CLI 提供当天时间戳；引擎不接受自身时钟读数
+
+## §6.2 Unregister（removal-at-terminal）
+
+同一命令内、**仅在 §6.1 成功后**执行：从根 `{HARNESS_DIR}/status.json` 注销该 lifecycle（`unregisterWorkflow`，幂等）。
+
+- 顺序固定：**snapshot 先 terminal，再注销根条目**；禁止反向
+- unregister 失败 = exit 1 + **partial close** 显式报告；**禁止**回滚到 running —— 重试重读 terminal snapshot 后**只补 unregister**（不改 `ended_at`）
+- fully closed retry：两个文件都不再改动，输出 already-closed 通知
+
+## §6.3 Projection reconciliation（snapshot 权威）
+
+把本地状态面对齐到 terminal snapshot（snapshot 行权威，投影跟随）：
+
+1. `{PLAN_DIR}` plan 文件
+2. compass `## Plans` + `{ITERATION_DIR}/README.md` 索引
+3. project roadmap / register
+
+- **禁止**伪造 `Done` 行、**禁止**为对齐而 close open residual —— 真实 remaining finding 阻塞 zero-residual 交付，而不是被静默关闭；reconciliation **不发明** Done/closed
+- **禁止**把新 tracked 产品/文档 commit 夹带进 Phase 6 —— 新发现的产品修复另开授权 workflow
+
+## §6.4 Cleanup handoff（最后一步；显式、不自动）
+
+物理清理（integration worktree / 本地分支 / 远端分支删除）是 §6.1–§6.3 之后的**显式独立步骤**——即 **timing lane 2**：valid terminal close + PR verified merged 之后才清理 integration 面。Phase 6 只固定顺序与守卫，不在本 phase 内实现删除：
+
+- cleanup **永不自动**、永不绕过 ownership / merge-evidence 守卫 —— 契约本体（ownership、合并证据、refusals、apply 顺序）唯一 home → **`mstar-branch-worktree`**「Worktree / branch cleanup」；本节只放 call site，不复制规则
+- `mstar worktree cleanup --workflow <id> [--harness <path>] [--apply] [--remote] [--worktree <path>]` —— dry-run 默认，逐候选打印 `verdict | kind | ref | reason`；先 dry-run 核对受保护行全部 `keep`/`refuse`，再 `--apply`
+- **lease 释放是手工 owner 动作、cleanup 范围外**：§6.1 close 已拒绝 dangling lease，但 cleanup 仍**从不**替 owner 释放——残留 lease 的候选只会得到 `cleanup.refuse.active-lease`；先手工释放，再重跑 dry-run/apply
+- squash-merged 分支（tip 非 base 祖先）→ STOP → residual；禁止 `git branch -D`
+
+Phase-6 gate 只查**本地 state**（valid terminal shape + 无 dangling lease + root 条目已注销），**不**验证远端 merged 证据，**不**检查物理清理是否完成。
+
+> **Engine check (when available):** run `mstar iteration gate --phase 6 --workflow <id>` (or `import { evaluatePostMergeClose } from "@mstar-harness/engine"` in a host hook) to gate the local post-merge close state（valid terminal shape + 无 dangling lease + root 条目已注销；稳定码 `PHASE6_*`；invalid/unreadable root 不是条目已注销的证明）. On `fail` -> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.
+
+## Standalone plans & abandonment
+
+- `type: plan` 独立 lifecycle 在其 PR merge 后用**同一** completed-close 命令关闭（无第二 verb、无 `--outcome` / `--force`）
+- abandoned lifecycle **不得**静默跑 completed close：已 terminal（`failed` / `stopped`）的 snapshot 保持原状态，CLI 如实报告实际 status；completed close 只属于 verified-merged 完成
+
+## Evidence
+
+Phase 6 完成 = `jq -r '.status, .ended_at'` `{HARNESS_DIR}/workflows/<id>/snapshot.json` → `completed` + 日期；根 `{HARNESS_DIR}/status.json` 不含该 id 且 `mstar status validate <root status.json>` exit 0；无 dangling lease；投影一致；host todo `phase-6-post-merge-close` 可勾掉。Phase-6 post-merge close gate（`mstar iteration gate --phase 6 --workflow <id>`，只查本地 close state）exit 0。
+
+## References
+
+- Route / transition-gate SSOT → `mstar-iteration` SKILL.md「Phase route map」+「Phase transition gates」
+- 终态字段 / lease 语义 / `unregisterWorkflow` → `mstar-artifacts/references/status-and-residuals.md`
+- cleanup ownership / guard 契约本体（两条时序车道）→ `mstar-branch-worktree`「Worktree / branch cleanup」

package/harness-skills/mstar-review-qc/SKILL.md

@@ -16,6 +16,7 @@ description: "Morning Star QC orchestration — **SDD mandatory plan QC tri-revi
 - Plan QC seats are **reviewers**: assigned changed **diff / logic / risk** lenses and directly affected interfaces — same family as PR review, not a parallel QA test lane.
 - **Do not** instruct QC in Assignment to “run the suite / build / lint to confirm” on shared tri cwd; that causes peer `Blocked` and collapses L3 into L4.
 - Runtime proof stays with scoped **implementer evidence** and **`QA gate`** (targeted unit evidence only). `full tri-review` describes seats, not full-repository review. Scope SSOT → **`mstar-harness-core`** § 定向执行与验证边界; QC never broadens exploration or repeats unchanged L2 evidence.
+- Retained `sdd evidence` bundles are review **inputs, not something QC executes**: QC reviews the code and the declared coverage rationale; it never runs `sdd evidence capture`, never repeats the recorded child, and a record's integrity/outcome is not acceptance — coverage stays `review-required` (command semantics → **`mstar-sdd`** `references/file-handoffs.md` § Verification evidence).
 
 ## 分派时机（与 plan / batch 对齐）
 

package/harness-skills/mstar-roles/references/project-manager/dispatch-and-assignment.md

@@ -79,7 +79,7 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 **Delegation**: forbidden | allowed (...)
 **Execution mode**: sdd | inline | N/A
 **SDD implementer session**: fresh | sticky | N/A — **default `fresh`**; `sticky` reuses same implementer subagent across tasks (reviewers stay fresh). See `mstar-sdd/references/sticky-implementer-session.md`
-**SDD dir**: absolute `<control_worktree_path>/{HARNESS_DIR}/sdd/<plan-id>/` when L1 lease gate active | `{HARNESS_DIR}/sdd/<plan-id>/` when waived / single checkout | N/A
+**SDD dir**: absolute `<main-repo-root>/{HARNESS_DIR}/sdd/<plan-id>/` (control harness root) when L1 lease gate active | `{HARNESS_DIR}/sdd/<plan-id>/` when waived / single checkout | N/A
 **SDD context file**: absolute `<SDD dir>/context.json` when `Execution mode: sdd` | N/A — destination contract consumed by `mstar sdd exec --context` / `--context` producers (`mstar-sdd/references/file-handoffs.md`)
 **Model tier**: fast | standard | capable | N/A
 **Skill presets**: `standard` | <explicit skill list> | none — activates the `Execute as` role's preset from its `Skill Preset (PM-Activated)` section; default `standard` for implementation / QC / QA rounds unless the route is trivial
@@ -96,11 +96,12 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 - Execute: `plan locked` [done|n/a], `tasks` [done|n/a], `implement` [this assignment|done]
 - Gate decision: `go` | `blocked` (<reason>)
 **Working branch**: <branch policy or create-from policy> — formal iteration: from `metadata.spec_integration_branch`; integration cut from `metadata.iteration_base_branch` (`mstar-iteration` §2.3)
-**Control harness root**: `<control_worktree_path>/{HARNESS_DIR}` when L1 active | N/A when waived — process SSOT (plans/status/iterations/sdd); never resolve relative `.mstar/...` from feature cwd
+**Control harness root**: `<main-repo-root>/{HARNESS_DIR}` (control root = the primary checkout / main worktree, derived from Git) when L1 active | N/A when waived — process SSOT (plans/status/iterations/sdd); never resolve relative `.mstar/...` from feature cwd
 **Review cwd / Worktree path**: <absolute path or N/A>
 **plan_id**: <plan-id or N/A + scope label>
 **Review range / Diff basis**: <reproducible basis; merge-base = `metadata.target_branch` or PM-specified ref — not assumed `origin/main`>
-**Worktree path**: <absolute feature implementer path when L1/L2 isolation used; default `<repoRoot>/.worktrees/<plan-id>-<slug>` (L2 tracks: `<track-slug>`); must ≠ control_worktree_path>
+**Worktree path**: <absolute feature implementer path when L1/L2 isolation used; default `<repoRoot>/.worktrees/<plan-id>-<slug>` (L2 tracks: `<track-slug>`); must ≠ the main worktree (control root) ≠ `integration_worktree_path`>
+**Main worktree branch**: <recorded residency branch of the primary checkout (main worktree), from the main plan header — passed unchanged; never a lifecycle-owned branch>
 **QA gate**: mandatory | pm-acceptance | report-only — see `references/project-manager/qa-trigger-matrix.md`
 **QA gate reason**: <tier label, e.g. hotfix-inline | small-feature-clean-qc | mandatory-medium-feature>
 **QA mode**: acceptance-only | targeted | report-only | N/A — required when `QA gate: mandatory` or `report-only`
@@ -129,21 +130,22 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 - Do not dispatch roles from route narrative/handoff text
 - `explore` is read-only orientation only
 - Tool availability ≠ delegation authorization
-**Plan Path**: absolute `<control_worktree_path>/{PLAN_DIR}/...` when L1 lease gate active | `{PLAN_DIR}/...` when waived / single checkout | N/A
+**Plan Path**: absolute `<main-repo-root>/{PLAN_DIR}/...` (control harness root) when L1 lease gate active | `{PLAN_DIR}/...` when waived / single checkout | N/A
 **Report Format**: Completion Report
 **Execution evidence**: <RCA/test-first/review feedback/evidence expectations for the assignee, if applicable>
 ```
 
 ## L1 path fields (iteration Phase 2, lease gate not waived)
 
-When the workflow snapshot top-level `control_worktree_path` is set and worktree mode is **not** waived:
+When iteration **L1** is active (the integration worktree is recorded in the workflow snapshot `integration_worktree_path`; worktree mode is **not** waived):
 
 | Field | Must be |
 |-------|---------|
-| **`Worktree path`** | Absolute **feature** checkout (`execution_lease.worktree_path`) — product/source edits only |
-| **`Control harness root`** | Absolute `<control_worktree_path>/{HARNESS_DIR}` |
+| **`Worktree path`** | Absolute **feature** checkout (`execution_lease.worktree_path`) — product/source edits only; ≠ the main worktree (control root) ≠ `integration_worktree_path` |
+| **`Main worktree branch`** | The recorded residency branch from the main plan header, passed unchanged — the main worktree's attached branch must equal it (never a lifecycle-owned branch; never invented at check time) |
+| **`Control harness root`** | Absolute `<main-repo-root>/{HARNESS_DIR}` — the control root is the primary checkout (main worktree), derived from Git (`readMainWorktree`) |
 | **`Plan Path`** | Absolute under control harness (not relative from feature cwd) |
-| **`SDD dir`** | Absolute under control harness; run `mstar sdd workspace <plan-id>` with `MSTAR_CONTROL_ROOT=<control_worktree_path>` when cwd is the feature tree |
+| **`SDD dir`** | Absolute under control harness; run `mstar sdd workspace <plan-id>` with `MSTAR_CONTROL_ROOT=<main-repo-root>` (the derived main worktree root, verified before the fail-closed guard) when cwd is the feature tree |
 | **`SDD context file`** | Absolute `<SDD dir>/context.json` — the bound destination contract (`controlHarnessRoot`/`featureCwd`/`workingBranch`/`planFile`/`sddDir`, all absolute) |
 
 Every implementer/reviewer handoff cites these absolute destinations; native hosted subagents observe pwd/branch first and write only to the declared destinations (`mstar-sdd` prompt templates). CLI-launchable children start via `mstar sdd exec --context <context.json> -- <argv>`. State the boundary, never overclaim: the context/launcher binds starting cwd and validated destinations — it does NOT block a later deliberate `chdir`, absolute-path write, or host-native edit tool (`apply_patch`).

package/harness-skills/mstar-roles/references/project-manager.md

@@ -132,11 +132,12 @@ If any item below matches, fix the dispatch/plan state or mark `Blocked`—do **
 - **NEVER** perform specialist document edits in the PM thread when host invoke is required — that is `dispatch incomplete` (`mstar-dispatch-gates`, `mstar-iteration/references/phase-1-prepare.md` §1.6).
 - **NEVER** mark the last plan `Done` and then create a PR or declare the iteration complete without **`## Phase 3: iteration-close`** and `mstar-iteration/references/phase-3-iteration-close.md` §3.1–§3.5 checklists.
 - **NEVER** treat final plan closure prose as iteration-close — compound, roadmap `delivered`, and compass `status: completed` require Phase 3.
+- **NEVER** declare the iteration delivered at §5.5 exit or PR merge — delivery completes only after Phase 6 post-merge close finishes (`mstar status workflow-close --workflow <id>` terminal snapshot + root unregister + projections reconcile; `mstar-iteration/references/phase-6-post-merge-close.md` §6.1–§6.4).
 - **NEVER** steal or overwrite an active `execution_lease` or `integration_merge_lease` (no TTL, age, or inactivity authority); override only on explicit current-turn user instruction + audit snapshot plan `notes` / `notes.jsonl` (`mstar-engine-legacy` `references/lease-protocol.md` — “Lease prohibitions”; field semantics → `mstar-artifacts/references/status-and-residuals.md` — “Iteration execution leases”).
 - **NEVER** writable-dispatch for a plan without a **verified** `execution_lease` for that plan (resume only when same `holder` passes verify-held-lease against Assignment `Worktree path` / `Working branch`).
 - **NEVER** writable-dispatch when a plan is `InProgress` but has **no** `execution_lease` — complete orphan recovery first (`mstar-engine-legacy` `references/lease-protocol.md` — “Orphan recovery”; engine-present: `mstar lease verify --workflow <id>` + iteration checklist).
-- **NEVER** run or dispatch **parallel** integration merges into `spec_integration_branch` — merge is **serial** via the snapshot top-level `integration_merge_lease` from the control worktree (`mstar-iteration` §2.6 · `mstar-branch-worktree` L1).
-- **NEVER** cross-plan writable implement without distinct per-plan verified `execution_lease` + feature worktree; `Plan parallelism: serial` forces serial **scheduling** only — it does **not** waive control worktree or lease gates (`mstar-iteration/references/phase-2-worktree-lease.md` §2.0 #5).
+- **NEVER** run or dispatch **parallel** integration merges into `spec_integration_branch` — merge is **serial** via the snapshot top-level `integration_merge_lease` from the integration worktree (`mstar-iteration` §2.6 · `mstar-branch-worktree` L1).
+- **NEVER** cross-plan writable implement without distinct per-plan verified `execution_lease` + feature worktree; `Plan parallelism: serial` forces serial **scheduling** only — it does **not** waive the worktree or lease gates (`mstar-iteration/references/phase-2-worktree-lease.md` §2.0 #5).
 - **NEVER** dispatch **cross-plan parallel** writable implement when same-host exclusive write lock is **not** available on the coordination snapshot path (`workflows/<id>/snapshot.json`; cross-host / no shared flock) — default **`Plan parallelism: serial`** or **Blocked** if Assignment still claims parallel; exception only on current-turn user `Cross-host lease race: accepted` (or equivalent) + audit `plans[].notes` — **including when `Worktree mode: waived`** (`mstar-engine-legacy` `references/lease-protocol.md` — full protocol; `mstar-iteration` `references/phase-2-worktree-lease.md` — execution checklist).
 - **NEVER** set `Worktree mode: waived` because default-gitignored `plans/` are missing under a feature worktree — keep feature worktrees; put absolute control **`Plan Path`** / **`SDD dir`** / **`Control harness root`** on Assignments (`mstar-branch-worktree` 「Harness path SSOT under default gitignore」). No flock → serial scheduling only, not worktree waiver.
 

package/harness-skills/mstar-roles/references/prompt-engineer.md

@@ -35,7 +35,7 @@ If any item below matches, **stop** and return `Blocked` to `project-manager` in
 When creating a new skill, making a major skill rewrite, changing frontmatter `description`, or changing behavior-shaping skill text:
 
 1. MUST read `mstar-skill-authoring` before editing.
-2. MUST follow the repository **`skill-creator`** requirement when the change is a new skill or major rewrite (`AGENTS.md` → Skill-Creator Requirement).
+2. MUST follow the repository **`skill-creator`** requirement when the change is a new skill or major rewrite (`AGENTS.md` → Skills and host consistency).
 3. MUST include validation evidence for behavior-shaping changes, or explicitly state why only manual/search validation is practical.
 
 ## Prompt Change Minimal Checklist

package/harness-skills/mstar-roles/references/qa-engineer/acceptance-gate.md

@@ -32,6 +32,21 @@ When **`QA mode: acceptance-only`**:
 2. If **L1** (or prior QA/CI) already provides reproducible relevant evidence → **verify mapping** to plan Acceptance Criteria; do not re-execute covered checks. Non-executable docs/policy may supply `scoped-check` evidence (`mstar-sdd/references/file-handoffs.md`), not a fabricated test log.
 3. Document in Completion Report **Validation**: which ACs are covered by reused evidence vs newly executed checks.
 
+### Captured evidence mapping (`sdd evidence`)
+
+Retained `sdd evidence` bundles are consumed read-only: QA integrity-checks and maps the evidence — it never repeats the captured child command (exact command shapes and exit meanings → `mstar-sdd/references/file-handoffs.md` § Verification evidence). Map every AC with all columns:
+
+| AC | run/manual reference | original input identity | integrity | outcome | target applicability and reason | coverage judgment | targeted gap |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+
+- **Run/manual reference**: `{SDD_DIR}/evidence/<run-uuid>/` with the record and raw `stdout.log`/`stderr.log` paths — or the manual report/CI citation with provenance.
+- **Original input identity**: the recorded run's Git HEAD plus declared-input digest from `record.json` — the basis any target comparison reuses.
+- **Coverage judgment** is reviewer reasoning: the assessment always reports `review-required`, supplies no pass/fail counts and no automatic coverage inference; skips and behavior coverage need raw-log/code review when material.
+- Evaluate candidate assumptions, never inherit them: a `reviewed` declaration, an empty environment allowlist, or a lockfile-only dependency rationale is the caller's assumption, not automatic completeness — name the unverified scope as the targeted gap when material.
+- Reuse outcomes: tested bytes equal after a later commit → reuse, no rerun; docs-only change → reuse; a changed shared runtime/config/fixture/dependency input → name the affected gap instead of rerunning everything; failed/incomplete or unknown-scope proof stays uncertain; no assessed target → `not-assessed`.
+- A pre-fix failing run keeps outcome `failed` and is never relabeled a pre-feature baseline; the fix needs its own passing evidence for the affected AC.
+- Manual historical evidence is unverified/manual — cite it with provenance and reviewer reasoning; NEVER convert it into a v1 runner record.
+
 ## Fill only the affected gap
 
 Scope authority → `mstar-harness-core` § 定向执行与验证边界. All QA modes remain unit-only; a mode, risk level or absent evidence does not grant wider execution.

package/harness-skills/mstar-roles/references/qa-engineer.md

@@ -27,7 +27,7 @@ If any item below matches, **stop** and return `Blocked` to `project-manager` in
 
 ## Core QA Gate Duties
 
-Before sign-off: validate phase-gate prerequisites, Assignment metadata alignment, and reproducible evidence for any **new** checks. Mode/mapping rules → **`references/qa-engineer/acceptance-gate.md`**.
+Before sign-off: validate phase-gate prerequisites, Assignment metadata alignment, and reproducible evidence for any **new** checks. Mode/mapping rules → **`references/qa-engineer/acceptance-gate.md`**. Retained `sdd evidence` bundles are integrity-checked and mapped read-only (captured-evidence mapping columns → **`references/qa-engineer/acceptance-gate.md`** § Captured evidence mapping); QA never repeats a captured child command, and manual historical evidence is never converted into a v1 runner record.
 
 ## Branch & Review Context Gate
 
@@ -50,6 +50,8 @@ When Assignment provides a report path, write report-only output under `{SDD_DIR
 ## Recommended owners
 ```
 
+The acceptance AC mapping uses the evidence columns defined in **`references/qa-engineer/acceptance-gate.md`** § Captured evidence mapping (`AC | run/manual reference | original input identity | integrity | outcome | target applicability and reason | coverage judgment | targeted gap`).
+
 ## Skill Preset (PM-Activated)
 
 External topic skills below are **presets activated by PM**, not unconditional role dependencies — the L4 acceptance identity and NEVER rules above stand alone, and role-owned `references/qa-engineer/acceptance-gate.md` is always part of this role (never preset-gated; role-owned obligations hold under every preset including `none`). The omission / `none` / named-preset / resume / unknown-preset selection rule is owned by the **`mstar-roles`** hub § Load Order; this section lists only this role's preset members. When active, load in order:

package/harness-skills/mstar-sdd/SKILL.md

@@ -47,7 +47,7 @@ Dispatch independent ready tasks concurrently after L2 worktree isolation. Keep
 ## Per-task loop (PM only · Workflow)
 
 1. Record `BASE_SHA` (never use `HEAD~1` later)
-2. `mstar sdd workspace <plan-id>` → `SDD_DIR`（iteration L1 从 feature cwd 调用时：`MSTAR_CONTROL_ROOT=<control_worktree_path>` 或 `mstar sdd workspace <plan-id> <control_worktree_path>`；probe 以 v2 根 `status.json`（`workflows[]`）或 workflow snapshot 存在为准，linked worktree 缺文件会 fail closed）
+2. `mstar sdd workspace <plan-id>` → `SDD_DIR`（iteration L1 从 feature cwd 调用时：`MSTAR_CONTROL_ROOT=<main-repo-root>`（= **Git 派生的主 worktree 根**；先完成派生验证，fail-closed 守卫在其后）或 `mstar sdd workspace <plan-id> <main-repo-root>`；显式值必须与派生主根 canonicalize 一致，integration/外来检出被拒而非静默重定向；probe 以 v2 根 `status.json`（`workflows[]`）或 workflow snapshot 存在为准，linked worktree 缺文件会 fail closed）
 3. `mstar sdd task-brief <plan> N` → brief file
 4. Dispatch implementer:
     - **`SDD implementer session: fresh`** (default) — new subagent; templates: `references/implementer-prompt.md`
@@ -135,6 +135,8 @@ The SDD helpers are engine-backed commands under **`mstar sdd`**（引擎 CLI；
 | `mstar sdd task-brief` | `PLAN_FILE TASK_N [OUTFILE]` |
 | `mstar sdd review-package` | `BASE HEAD [OUTFILE]` |
 
+Developer check evidence: `mstar sdd evidence capture|verify` — capture runs an already-authorized argv once and retains raw evidence; verify is read-only. Command shapes, exit meanings and role boundaries → **`references/file-handoffs.md`** § Verification evidence. `mstar sdd exec` stays PM-only.
+
 ## References
 
 - `references/file-handoffs.md` — paths and fix-loop evidence

package/harness-skills/mstar-sdd/references/file-handoffs.md

@@ -10,8 +10,8 @@ PM runs context-dependent `mstar sdd workspace`, `task-brief`, and `review-packa
 
 1. `export SDD_DIR=$(mstar sdd workspace <plan-id>)`
    - Iteration L1 (implementer cwd = feature worktree):
-     `export MSTAR_CONTROL_ROOT=<control_worktree_path>`
-     or `mstar sdd workspace <plan-id> <control_worktree_path>`
+     `export MSTAR_CONTROL_ROOT=<main-repo-root>` — the **derived main worktree** root, verified by Git probing before the fail-closed guard
+     or `mstar sdd workspace <plan-id> <main-repo-root>`
      so `{SDD_DIR}` lands on the control harness (default-gitignored plans/status/sdd). Do not create a second SDD tree under the feature checkout.
 2. PM writes `$SDD_DIR/context.json` for the current helper operation — parallel hosted handoffs pin these values in their Assignment instead of consulting mutable plan context:
 
@@ -26,7 +26,7 @@ PM runs context-dependent `mstar sdd workspace`, `task-brief`, and `review-packa
    }
    ```
 
-   All paths absolute; `planFile`/`sddDir` must resolve inside the control harness; `featureCwd` must be the assigned feature worktree on `workingBranch`. The declared control root is authoritative — never re-inferred from the feature cwd.
+   All paths absolute; `planFile`/`sddDir` must resolve inside the control harness; `featureCwd` must be the assigned feature worktree on `workingBranch`. The declared control root is authoritative — never re-inferred from the feature cwd, and it must canonicalize to the Git-derived main worktree root (an integration/foreign checkout is refused, not redirected).
 3. `mstar sdd task-brief <plan-file> <N> --context "$SDD_DIR/context.json"` — bound producer: validates the artifact destination **before** mkdir/write and prints the absolute brief path (`{SDD_DIR}/task-N-brief.md`).
 4. Record `BASE_SHA` (`BASE_SHA=$(git -C "$FEATURE_CWD" rev-parse HEAD)` before dispatch). For dependent tasks, first satisfy `mstar-sdd` § Ready-task scheduling: PM serially integrates reviewed prerequisite commits and records their ancestry in this base. Include those commit/base IDs and the check result in the handoff; review approval alone is insufficient.
 5. Dispatch implementer with:
@@ -69,6 +69,24 @@ For appended fixes, begin each new block with `## Verification round: <concrete
 
 Replace every placeholder with actual evidence. Unknown or duplicate modes within the active round, missing/empty/placeholder fields, and bare `Tests: N/A` fail; do not copy the template as a report. `assertSddTddTriple` / `mstar lint <task-report>` validate structure only. PM/QC check the actual changed range, applicability and evidence honesty; the checker cannot establish that commands ran or intercept arbitrary shell execution. For policy changes, record the before/after expectation and triggering scenario alongside the concrete check; no broad model-eval matrix is implied.
 
+### Captured check evidence (`sdd evidence`)
+
+An already-authorized check can run **once** and leave version-bound raw evidence in canonical SDD for read-only review: reviewers inspect the retained bundle instead of repeating the child command. Division of labor: **PM publishes the fixed, immutable task capture request** (task-specific JSON naming context, coverage declaration, declared inputs and selected environment keys); the **developer captures** the already-authorized check with it; QC/QA only inspect and verify — they never repeat the recorded child. The capture request is a separate immutable artifact, never the rotating `context.json`; no hosted leaf resolves it as a checkout selector. Capture authorizes nothing by itself: it neither dispatches agents nor grants test/full-suite/E2E permission.
+
+Exact public command shapes (angle-bracket terms are required CLI values):
+
+```text
+mstar sdd evidence capture --request <absolute-task-request.json> -- <executable> [args...]
+mstar sdd evidence verify --sdd-dir <absolute-dir> --plan <id> --task <id> --run <uuid> [--target <absolute-target.json>]
+```
+
+- Capture runs the child once (literal argv, no shell), POSIX linux/darwin only (unsupported hosts refuse before spawn), and retains `{SDD_DIR}/evidence/<run-uuid>/` with fixed `record.json`, `stdout.log`, `stderr.log`; every retry is a fresh run UUID. Capture exits: child exit code preserved; missing executable 127; timeout 124; signal 128+n (parent SIGINT 130 / SIGTERM 143); gate/IO refusal 1; usage 2. Cite the raw log paths as evidence links — not paraphrased output.
+- `verify` is read-only and portable: it never runs the recorded child, discovery or version probes, writes no assessment artifact, and emits exactly one JSON assessment. Without `--target`, exit 0 means complete **integrity only** — a retained failed run still verifies with outcome `failed` (stderr: `integrity only; outcome=<value>; acceptance not assessed`). With `--target`, exit 0 means reuse **candidate** (stderr adds `reuse candidate; coverage review required`); every non-candidate exits 1; usage 2.
+- Four outputs stay separate everywhere — **integrity** (bundle complete/unaltered), **outcome** (recorded process result), **target applicability** (`not-assessed`/`candidate`/`changed`/`uncertain`), **coverage judgment** (always `review-required` in v1). No exit code or record field decides acceptance: there is no parser promise, no pass/fail counts and no automatic coverage inference (`counts` stays null in v1) — a reviewer judges coverage.
+- Reuse semantics (first match): tested bytes equal after a later commit or a docs-only change stay reuse candidates; a changed shared runtime/config/fixture/dependency input names the affected gap (`changed`); failed/incomplete proof, unknown input scope or a different repository stays `uncertain` — a pre-fix failure is retained as `failed` and never relabeled a pre-feature baseline; without a target the result is `not-assessed`, never candidate. An empty environment allowlist or a lockfile-only dependency declaration is the caller's reviewed assumption, not automatic completeness.
+- Non-executable documentation/policy never manufactures capture evidence — it uses `Verification mode: scoped-check` above. Historical manual evidence stays manual/unverified: cite it with provenance and reviewer reasoning; NEVER retrofit it into a v1 runner record.
+- The old `mstar sdd exec` entry is unchanged and stays PM-only serialized launch (§ Bound child launch); hosted leaves never use it for their assigned checks.
+
 ## After implementer DONE
 
 PM sets `FEATURE_CWD` from the completed task's immutable Assignment `Worktree path`, verifies its assigned branch, and restores context to that same checkout/branch. Generate the task-specific review package serially from this path; do not use the PM shell cwd for task endpoints. Leaves keep their dispatched inputs unchanged.

package/harness-skills/mstar-sdd/references/implementer-continuation-prompt.md

@@ -46,7 +46,7 @@ Dispatch:
     ## Your job
 
     1. Implement exactly what this brief specifies (prior tasks are done)
-    2. Run only assigned affected unit tests or applicable scoped-check evidence; use file-handoffs.md § Verification evidence and retain unaffected prior evidence
+    2. Run only assigned affected unit tests or applicable scoped-check evidence; use file-handoffs.md § Verification evidence and retain unaffected prior evidence. When this task's Assignment names a PM-fixed capture request, capture the authorized check once with `mstar sdd evidence capture --request <absolute-task-request.json> -- <executable> [args...]` and cite the retained run's record/raw logs
     3. Commit on Working branch
     4. Write report file with actual evidence; return short summary only
 

package/harness-skills/mstar-sdd/references/implementer-prompt.md

@@ -50,7 +50,7 @@ Dispatch:
     ## Your job
 
     1. Implement exactly what the brief specifies
-    2. Run only the assigned affected unit tests; for non-executable docs/policy, use real scoped-check evidence per file-handoffs.md § Verification evidence
+    2. Run only the assigned affected unit tests; for non-executable docs/policy, use real scoped-check evidence per file-handoffs.md § Verification evidence. When the Assignment names a PM-fixed capture request, capture the authorized check once with `mstar sdd evidence capture --request <absolute-task-request.json> -- <executable> [args...]` and cite the retained run's record/raw logs (same section) instead of ad-hoc reruns
     3. Commit on Working branch
     4. Self-review only the task diff and directly affected contracts
     5. Write report file; return short summary only

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mstar-harness/dsh",
-  "version": "3.8.3",
+  "version": "3.9.0",
   "description": "Morning Star harness dsh (DeepSeek Harness) cordis function plugin — in-process engine gates (status/dispatch/lease) with hard refusal channels.",
   "keywords": [
     "dsh",