@namewta/speculo 0.8.8 → 0.8.10

package/template/workflows/ops/E-execute-and-stabilize/E-execute-and-stabilize.md

@@ -0,0 +1,75 @@
+---
+id: ops/execute-and-stabilize
+type: workflow-entry
+workflow: ops
+name: 执行、诊断并稳定部署
+description: 以不可覆盖 attempt 执行批准计划或只读验证，在失败时诊断并路由重新规划或回滚，最终用稳定性证据完成 change。
+keywords: [执行, attempt, 调试, 诊断, 回滚, 验证, 稳定性]
+---
+
+# 执行、诊断并稳定部署
+
+> 激活本 Work 后，先读取 `<Path>{roots.workflows}/ops/README.md</Path>`，再执行本入口。
+
+E 是正常部署、批准回滚、attempt 诊断、验证和 completed 转换的唯一 owner。它不补写计划或批准，也不把命令退出零当作部署完成。
+
+## 模式
+
+- `deploy`：执行当前批准计划；
+- `remediation`：执行失败 attempt 触发并重新批准的修订计划；
+- `rollback`：执行当前计划已批准的恢复批次或 automatic trigger；
+- `verification-only`：global inventory-only change 的定向只读重读，不伪造部署 run。
+
+## 流程
+
+### 1. 恢复与预检
+
+读取所有既有 attempts、当前 status、request、inventory、deployment model、target profile、plan/approval、`<Path>{roots.workflows}/ops/common/rules/execution-loop.md</Path>` 与 `<Path>{roots.workflows}/ops/common/rules/target-profile-and-release-gates.md</Path>`。除 verification-only 外必须通过 `--stage pre-execute`，重建 plan/profile 摘要、source、target、路径包含、整体控制面身份、权限、容量、端口、Gate、数据保护、preview 和 rollback material。
+
+在第一条 mutation 前重采集 identity assertions 并按 exact/ordered-list/set/digest 比较。任何 profile/identity/构件漂移、新 mutation、新权限或计划外写入都会零 mutation 停止，令 approval invalidated 并返回 I/P。发现同一 target/deployment root 正被另一 change 执行时阻塞。
+
+旧 plan v2 与 attempt v1 只读，不得追加 journal、补写字段或作为新 pre-execute/pre-close 证据。需要继续或关闭此类 change 时，保留旧工件，由 I/P 在需要 mutation 时生成 plan v3；无新增 mutation 时创建绑定当前 target profile 的 verification-only attempt v2。只有该 v2 attempt 的 verification state 与 HANDOFF 通过，change 才能重新进入 pre-close/pre-archive。
+
+### 2. 创建 Attempt
+
+分配最小未占用 ATTEMPT-NNN，创建 `execution/attempts/{attempt-id}/`，从 `<Path>{roots.workflows}/ops/E-execute-and-stabilize/attempt-summary-template.md</Path>` 初始化 summary，并写符合 attempt v2 schema 的 `attempt.json`。创建 append-only `journal.jsonl`，每一行独立符合 `<Path>{roots.workflows}/ops/common/schemas/journal-event.schema.json</Path>`；先持久化 attempt-start，再设置 phase=executing/latest_attempt_id。
+
+每个 required Gate 通过后才能开始其约束的 batch。每个 operation 先写 intent/precondition，再执行 apply，随后写 exit、脱敏摘要、postcondition 和 evidence。Gate failed/blocked 后立即停止新 operation，后续 Gate 只记 skipped；不得提升活动指针或删除候选。恢复会话时先核对连续 journal sequence 和真实 postcondition；无法证明幂等则停止。
+
+### 3. 失败诊断与循环
+
+operation、postcondition 或验证失败时立即停止后续 batch，使用 `<Path>{roots.workflows}/ops/E-execute-and-stabilize/diagnosis-template.md</Path>` 写 `diagnosis.md`：记录错误 signature、现场、假设、证据、确认/排除根因、已尝试动作和建议修复。
+
+只读、scope 内、不会写 cache/产生业务负载的诊断可继续并写 journal。任何修复 mutation、命令、write set、权限或事故半径变化都把 phase 设为 diagnosing，返回 `<Path>{roots.workflows}/ops/P-plan-and-approve/P-plan-and-approve.md</Path>` 创建新计划并批量批准。不得临场修改旧计划。
+
+### 4. 回滚
+
+仅当 rollback 已在当前批准 batch 内，或 operation rollback mode=automatic 且触发条件确定命中时执行。使用 `<Path>{roots.workflows}/ops/E-execute-and-stabilize/rollback-template.md</Path>` 记录 checkpoint、反向依赖顺序、数据/流量影响和恢复后状态；数据恢复仍需计划中的独立授权。未批准恢复动作返回 P，不以紧急为由扩大权限。
+
+### 5. 验证与完成
+
+所有 mutation attempt 完成后设置 phase=stabilizing，从 `<Path>{roots.workflows}/ops/E-execute-and-stabilize/verification-state-template.json</Path>` 生成 `verification-state.json` v1，并按 `<Path>{roots.workflows}/ops/common/schemas/verification-state.schema.json</Path>` 校验。它穷尽 identity results、required Gates、目标端构件摘要、服务状态/restart/runtime digest、逐 probe 预期 HTTP/业务码/认证要求、收敛组、稳定窗口、数据保护、恢复兼容、previous release、rollback material、保留候选和风险。verification-only 还证明 snapshot scope、target identity、关键关联、容量和零 mutation。
+
+使用 `<Path>{roots.workflows}/ops/E-execute-and-stabilize/verification-template.md</Path>` 投影 `verification.md`，并从 `<Path>{roots.workflows}/ops/E-execute-and-stabilize/handoff-template.md</Path>` 生成无密钥 `HANDOFF.md`；Markdown 不得成为结构化状态的替代事实源。production data mutation 的 protection 必须 verified，任何 waiver 都失败；local waiver 必须与 plan 的精确授权和完整 preflight 一致。
+
+全部 required Gate/verification 通过且 HANDOFF 无密钥时，将 attempt 标记 succeeded，按实际结果设置 outcome=succeeded 或 rolled_back；用户明确终止、证明没有未受控 mutation并接受残余风险时可 abandoned。随后原子设置 change_status=completed、phase=ready_to_archive、completed_at，清空 blockers/current_work，运行 `--stage pre-close` 并返回 A。
+
+## 完成标准
+
+- 每次执行、诊断、回滚或只读验证都有独立 attempt，旧 attempt 未覆盖；
+- 新 attempt 为 v2，journal 每行符合 journal-event v1，verification state/HANDOFF 与 attempt locator 一致；
+- 每个 mutation 有有效批次批准、前后条件和脱敏 evidence；
+- Gate 失败后未推进后续 operation，production 数据保护不存在 waiver；
+- 失败后停止，新增修复动作通过 P 重新规划而非临场执行；
+- 最终验证覆盖所有 required 条件和稳定窗口；
+- 未知或失败状态没有 completed；
+- completed change 通过 pre-close validator并路由 A。
+
+## 子文件引用
+
+- Attempt 摘要：`<Path>{roots.workflows}/ops/E-execute-and-stabilize/attempt-summary-template.md</Path>`
+- 失败诊断：`<Path>{roots.workflows}/ops/E-execute-and-stabilize/diagnosis-template.md</Path>`
+- 验证矩阵：`<Path>{roots.workflows}/ops/E-execute-and-stabilize/verification-template.md</Path>`
+- 回滚记录：`<Path>{roots.workflows}/ops/E-execute-and-stabilize/rollback-template.md</Path>`
+- 结构化验证与交接：`<Path>{roots.workflows}/ops/E-execute-and-stabilize/verification-state-template.json</Path>`、`<Path>{roots.workflows}/ops/E-execute-and-stabilize/handoff-template.md</Path>`
+- Attempt、journal 与验证 schema：`<Path>{roots.workflows}/ops/common/schemas/attempt.schema.json</Path>`、`<Path>{roots.workflows}/ops/common/schemas/journal-event.schema.json</Path>`、`<Path>{roots.workflows}/ops/common/schemas/verification-state.schema.json</Path>`

package/template/workflows/ops/E-execute-and-stabilize/attempt-summary-template.md

@@ -0,0 +1,44 @@
+# Ops Attempt Summary
+
+| Field | Value |
+| --- | --- |
+| Scope / project | {scope} / {project_id} |
+| Change / attempt | {change} / {attempt_id} |
+| Kind | deploy / remediation / rollback / verification-only |
+| Triggered by | {triggered_by} |
+| Plan / digest | {plan_path} / {plan_digest} |
+| Approval | {approval_path} |
+| Target profile / digest | {target_profile_path} / {target_profile_digest} |
+| Verification state | {verification_state_path} |
+| Handoff | {handoff_path} |
+| Started / ended | {started_at} / pending |
+| Result | running |
+
+## Preflight
+
+记录 profile/plan/approval 摘要、控制面 identity 重采集、protected targets、deployment root、数据保护和恢复资产；不得回显 secret。
+
+## Gate Results
+
+| Sequence | Gate | Status | Required verification | Evidence |
+| --- | --- | --- | --- | --- |
+
+## Batch and Operation Results
+
+## Actual Mutations
+
+所有事实事件逐行写入 append-only `journal.jsonl`，每行使用 journal-event v1；本摘要不替代 typed journal。
+
+## Diagnostics Performed
+
+## Failed and Not-run Operations
+
+## Redactions
+
+## Deviations and Residual Risk
+
+## Data Protection and Recovery Assets
+
+## Verification or Next Route
+
+terminal attempt 引用 `verification-state.json`；成功、回滚或 completed abandoned 还必须引用无密钥 `HANDOFF.md`。

package/template/workflows/ops/E-execute-and-stabilize/diagnosis-template.md

@@ -0,0 +1,24 @@
+# Attempt Diagnosis
+
+## Failure Signature
+
+提供稳定、脱敏、可检索的错误特征，不复制 secret 或无界原始日志。
+
+## Target State and Evidence
+
+## Hypotheses
+
+| Hypothesis | Evidence for | Evidence against | Verdict |
+| --- | --- | --- | --- |
+
+## Confirmed or Suspected Root Cause
+
+明确 confidence 和仍缺失的证据。
+
+## Actions Already Tried
+
+## Proposed Remediation or Rollback
+
+## Plan Delta Required
+
+列出新增或改变的 mutation、command、write set、privilege、external target、验证和恢复；无变化时明确 `none`。

package/template/workflows/ops/E-execute-and-stabilize/handoff-template.md

@@ -0,0 +1,32 @@
+# Ops Deployment Handoff
+
+| Field | Value |
+| --- | --- |
+| Scope / project | {scope} / {project_id} |
+| Change / attempt | {change} / {attempt_id} |
+| Mode / environment | {operation_mode} / {environment_class} |
+| Plan / approval | {plan_path} / {approval_path} |
+| Verification state | {verification_state_path} |
+| Verdict | passed / failed / blocked |
+
+## Target and Control-plane Identity
+
+只列非敏感 identity assertion、匹配结果与 evidence locator。
+
+## Source and Immutable Artifacts
+
+## Gate Results
+
+## Services and Runtime Convergence
+
+## Semantic Probes and Stability Windows
+
+## Data Protection
+
+## Recovery and Previous Release
+
+## Retained Candidates and Rollback Assets
+
+## Remaining Risks and Operator Follow-up
+
+不得包含密码、token、私钥、cookie、完整连接串或 secret 值。凭据仅记录 provider/受控 locator、版本和 presence 状态。

package/template/workflows/ops/E-execute-and-stabilize/rollback-template.md

@@ -0,0 +1,26 @@
+# Attempt Rollback
+
+| Field | Value |
+| --- | --- |
+| Change / attempt | {change} / {attempt_id} |
+| Failed attempt | {triggered_by} |
+| Plan / approval | {plan_path} / {approval_path} |
+| Restore checkpoint | {checkpoint} |
+| Started / ended | {started_at} / pending |
+
+## Trigger and Authorization
+
+## Pre-rollback Target State
+
+## Restore Operations
+
+| Operation | Expected restore | Actual | Result | Evidence |
+| --- | --- | --- | --- | --- |
+
+## Data and Traffic Effects
+
+## Post-rollback Target State
+
+## Failed or Manual Recovery Items
+
+## Residual Risks and Verification

package/template/workflows/ops/E-execute-and-stabilize/verification-state-template.json

@@ -0,0 +1,30 @@
+{
+  "schema_version": 1,
+  "artifact": "ops-verification-state",
+  "scope": "project",
+  "project_id": "{project_id}",
+  "change": "{change}",
+  "attempt_id": "{attempt_id}",
+  "captured_at": "{captured_at}",
+  "target_profile_path": "deployment/target-profile.json",
+  "target_profile_digest": "{target_profile_digest}",
+  "identity_results": [],
+  "gates": [],
+  "artifacts": [],
+  "services": [],
+  "probes": [],
+  "convergence": [],
+  "data_protection": [],
+  "recovery": {
+    "strategy": "not-applicable",
+    "previous_release_ref": null,
+    "rollback_operation_refs": [],
+    "material_refs": [],
+    "compatibility_verified": false,
+    "data_restore_authorized": null,
+    "evidence": []
+  },
+  "retained_artifacts": [],
+  "risks": [],
+  "verdict": "blocked"
+}

package/template/workflows/ops/E-execute-and-stabilize/verification-template.md

@@ -0,0 +1,55 @@
+# Attempt Verification
+
+| Field | Value |
+| --- | --- |
+| Change / attempt | {change} / {attempt_id} |
+| Target | {target} |
+| Target profile / digest | {target_profile_path} / {target_profile_digest} |
+| Verification state | {verification_state_path} |
+| Started / ended | {started_at} / pending |
+| Outcome | pending |
+
+## Target Re-read
+
+## Identity Assertion Results
+
+| Assertion | Comparison | Expected | Actual | Matched | Evidence |
+| --- | --- | --- | --- | --- | --- |
+
+## Gate Results
+
+| Sequence | Gate | Status | Evidence |
+| --- | --- | --- | --- |
+
+## Verification Matrix
+
+| Check | Required | Method/environment | Expected | Actual | Result | Evidence |
+| --- | --- | --- | --- | --- | --- | --- |
+
+## Immutable Artifacts and Target-side Digests
+
+## Health, Ports and Dependencies
+
+## Smoke and Business Signals
+
+每个 probe 使用自身允许的 HTTP 状态、业务码与认证要求；记录瞬时失败和连续成功数。
+
+## Restart and Persistence
+
+## Resource and Stability Window
+
+## Multi-instance Convergence
+
+## Data and Migration
+
+记录每个 protection id 的 backup/waiver/not-required/failed、evidence digest、readability 和 restore 验证。production 不允许 waiver；local waiver 必须与 plan 的精确授权一致。
+
+## Recovery, Previous Release and Retained Assets
+
+## Logs, Monitoring and Alerts
+
+## Deviations and Residual Risks
+
+## Completion Decision
+
+本文件是 `verification-state.json` v1 的无密钥 Markdown 投影。结构化 state 缺失、摘要不匹配、required Gate/verification 未通过或 HANDOFF 含 secret 时不得 completed。

package/template/workflows/ops/I-intake-and-assess/I-intake-and-assess.md

@@ -0,0 +1,66 @@
+---
+id: ops/intake-and-assess
+type: workflow-entry
+workflow: ops
+name: 摄入并评估运维目标
+description: 初始化 Ops，识别全局或项目 scope，创建或恢复 change，并用系统盘点、项目分析和目标身份形成可规划部署档案。
+keywords: [摄入, change, 项目识别, 系统盘点, 部署分析, target profile]
+---
+
+# 摄入并评估运维目标
+
+> 激活本 Work 后，先读取 `<Path>{roots.workflows}/ops/README.md</Path>`，再执行本入口。
+
+I 是初始化、scope/project/change 选择、部署模型和 target profile 的唯一 owner。它回答“当前工作属于哪里、目标现在是什么、项目需要怎样部署、现场身份与授权边界是什么、是否已经可以规划”，不构建、安装、启动服务或修改目标。
+
+## 流程
+
+### 1. 初始化与确定 Scope
+
+读取 `<Path>{roots.workflows}/ops/common/rules/project-and-change-scope.md</Path>`。缺少状态时以 schema v2 seed 原子创建 `status.json`，并创建不存在的全局 `changes/`、`archive/`、`context/`、`adr/`、`runbooks/` 和 `projects/`；已有内容只验证，不覆盖或猜测迁移。
+
+系统基线、Docker/宿主机通用配置或跨项目文档使用 `scope=global`。指定项目的部署、修复、扩容、升级和回滚使用 `scope=project`。项目 scope 必须解析或创建 `<Path>{roots.state}/ops/projects/{project_id}/project.json</Path>`，对照 `<Path>{roots.workflows}/ops/common/schemas/project.schema.json</Path>` 验证稳定 id、显示名、aliases 和无凭据 identity。
+
+### 2. 创建或恢复 Change
+
+在 scope 根选择用户指定 change、唯一 active change 或新 change；多个候选一次性消歧。新 change 使用 `YYYY-MM-DD-<topic>[-NN]`：project scope 从 `<Path>{roots.workflows}/ops/I-intake-and-assess/change-status-template.json</Path>` 创建 `.status.json`，global scope 从 `<Path>{roots.workflows}/ops/I-intake-and-assess/global-change-status-template.json</Path>` 创建；随后用 `<Path>{roots.workflows}/ops/I-intake-and-assess/request-template.md</Path>` 初始化 request、LOG、CONTEXT 和 ADR。
+
+先原子写 change，再将 `{scope, project_id, change}` 加入全局 active。归档历史只读；继续历史时创建 follow-up，并记录 `derived_from` 的完整 scope locator。项目 change 根必须是 `<Path>{roots.state}/ops/projects/{project_id}/changes/{change}/</Path>`，不得使用全局 flat change 目录。
+
+### 3. 盘点目标系统
+
+读取 `<Path>{roots.workflows}/ops/common/rules/path-and-scope-contract.md</Path>` 和 `<Path>{roots.workflows}/ops/common/rules/evidence-and-redaction.md</Path>`，按 `<Path>{roots.workflows}/ops/I-intake-and-assess/collector-catalog.md</Path>` 运行适用 L0/L1 collectors。L2 只针对用户一次批准的根列表。
+
+把不可覆盖快照写入 change `inventory/snapshots/{snapshot-id}.json`，并从 `<Path>{roots.workflows}/ops/I-intake-and-assess/system-report-template.md</Path>` 更新 `inventory/system-report.md`。瞬时 Docker/进程/端口状态只留在 change；稳定系统事实在 A 阶段才可提升为全局 context。
+
+### 4. 分析项目部署与目标身份
+
+global inventory-only 请求跳过 deployment model，但仍为 verification-only 目标生成非 mutation target profile；global 配置变更则以 `project=null` 建立系统配置 deployment model。project scope 读取真实项目指令和 `<Path>{roots.workflows}/ops/I-intake-and-assess/project-detection.md</Path>`，穷尽实际 manifest、lockfile、容器、CI/CD、配置、服务、集群、数据、健康和恢复线索；结构化格式使用 parser。
+
+读取 `<Path>{roots.workflows}/ops/common/rules/target-profile-and-release-gates.md</Path>`，从 `<Path>{roots.workflows}/ops/I-intake-and-assess/target-profile-template.json</Path>` 生成 `deployment/target-profile.json` v1，并按 `<Path>{roots.workflows}/ops/common/schemas/target-profile.schema.json</Path>` 验证。profile 选择 `audit | takeover | fresh | release | upgrade | rollback`，记录 environment class、唯一 deployment root、existing state、不可拆分 identity assertions、owned/protected/unknown targets、差异分类和 secret provider/locator 元数据。
+
+只要存在持久目录、控制面资源、数据、路由或服务，就使用 takeover；现场为 present 或 unknown 时不得选择 fresh。fresh 只在目标为空、归属明确且 protected/unknown targets 为空时 Ready。mutation 模式必须有整体 identity confirmation；ownership-conflict、unknown difference、未确认身份或不明 deployment root 都使 profile blocked。
+
+会联网、执行项目代码、写 cache 或下载依赖的动态 probe 只登记，不在 I 执行。写入 `deployment/deployment-model.json`、`deployment/target-profile.json` 和 `deployment/deployment-dossier.md`，分别对照 schema 与 `<Path>{roots.workflows}/ops/I-intake-and-assess/deployment-dossier-template.md</Path>`。配置和 secret requirement 只记录 key、scope、provider/受控 source ref、version/presence，不保存值。
+
+### 5. 验证与路由
+
+运行 validator 并重读工件。全局 inventory-only 在快照完整且 audit profile 有效时将 phase 设为 assessment，路由 `<Path>{roots.workflows}/ops/E-execute-and-stabilize/E-execute-and-stabilize.md</Path>` 的 verification-only 分支。项目部署或全局 mutation 只有 deployment model 与 target profile 都 Ready 才进入 `<Path>{roots.workflows}/ops/P-plan-and-approve/P-plan-and-approve.md</Path>`；blocking unknown 保持 blocked，并一次列出 owner 和所需决定。
+
+## 完成标准
+
+- scope/project/change tuple 唯一且与实际目录、全局索引一致；
+- 项目身份不会因目录同名误合并，也不包含凭据；
+- target profile v1 固定 operation mode、environment、deployment root、控制面身份、ownership 与差异分类；
+- present/unknown 现场没有被误判为 fresh，mutation profile 已显式确认整体身份；
+- 适用 collector 全部得到 observed/partial/unavailable/denied/failed 结论；
+- 项目评估穷尽实际部署入口且未把推断伪装为观测；
+- 未发生构建、安装、目标写入或外部 mutation；
+- validator 通过并返回唯一下一路由。
+
+## 子文件引用
+
+- 状态与请求模板：`<Path>{roots.workflows}/ops/I-intake-and-assess/change-status-template.json</Path>`、`<Path>{roots.workflows}/ops/I-intake-and-assess/global-change-status-template.json</Path>`、`<Path>{roots.workflows}/ops/I-intake-and-assess/request-template.md</Path>`
+- 盘点分支：`<Path>{roots.workflows}/ops/I-intake-and-assess/collector-catalog.md</Path>`、`<Path>{roots.workflows}/ops/I-intake-and-assess/system-report-template.md</Path>`
+- 项目分支：`<Path>{roots.workflows}/ops/I-intake-and-assess/project-detection.md</Path>`、`<Path>{roots.workflows}/ops/I-intake-and-assess/deployment-dossier-template.md</Path>`
+- Target profile：`<Path>{roots.workflows}/ops/I-intake-and-assess/target-profile-template.json</Path>`、`<Path>{roots.workflows}/ops/common/schemas/target-profile.schema.json</Path>`

package/template/workflows/ops/I-intake-and-assess/change-status-template.json

@@ -0,0 +1,26 @@
+{
+  "schema_version": 2,
+  "artifact": "ops-change-status",
+  "scope": "project",
+  "project_id": "{project_id}",
+  "change": "{change}",
+  "change_status": "active",
+  "phase": "intake",
+  "current_work": null,
+  "works_run": [],
+  "created_at": "{created_at}",
+  "updated_at": "{updated_at}",
+  "completed_at": null,
+  "archived_at": null,
+  "archive_path": null,
+  "source_revision": null,
+  "target_fingerprint": null,
+  "plan_path": null,
+  "plan_digest": null,
+  "approval_path": null,
+  "approval_status": "not_requested",
+  "approved_batches": [],
+  "latest_attempt_id": null,
+  "outcome": "pending",
+  "blockers": []
+}

package/template/workflows/ops/I-intake-and-assess/collector-catalog.md

@@ -0,0 +1,28 @@
+# 系统盘点 Collector 目录
+
+只选择当前目标适用且已存在的工具。以下命令族是发现候选，不是强制执行清单；运行前检查帮助、版本、权限和输出敏感性。
+
+## L0
+
+| Category | Unix/Linux candidates | macOS candidates | Required result |
+| --- | --- | --- | --- |
+| Host | `uname`, `/etc/os-release`, `hostname`, `uptime` | `uname`, `sw_vers`, `hostname`, `uptime` | OS、架构、稳定目标标识、时间 |
+| Capacity | `nproc`, `free`, `df`, `df -i`, `mount`, `lsblk` | `sysctl`, `vm_stat`, `df`, `mount`, `diskutil` | CPU、内存、挂载点、容量和 inode |
+| Runtimes | 查询已安装 Java/Go/Node/Python/Docker/包管理器版本 | 同左 | executable、版本、来源；不安装 |
+
+## L1
+
+| Category | Candidates | Required result |
+| --- | --- | --- |
+| Services | `systemctl list-units/show`；macOS `launchctl` | 名称、状态、unit/plist、ExecStart、WorkingDirectory |
+| Processes | `ps`、受限 `/proc/<pid>`、`lsof` 或 osquery | PID 仅作瞬时证据；关联 executable、cwd、user |
+| Network | `ss`、`lsof -i`、`netstat` | listener、address、port、process；不扫描外部网络 |
+| Docker | `docker info/ps/compose ls/system df` 和必要 inspect | context、daemon、container/image/volume/network、compose 与 bind path |
+| Kubernetes | current-context 和 scoped `get` | context、namespace、workload、service、ingress；不切换 context |
+| Project locations | 从 service cwd、compose labels、bind mounts 和明确 roots 反查 | 只报告证据支持的路径 |
+
+Docker inspect、Compose config、进程环境和 Kubernetes Secret 可能泄露敏感值。默认不读取进程完整环境或 Secret data，保存前按 evidence-and-redaction 处理。
+
+## L2
+
+只对批准根执行受限深度的容量、权限、文件类型、最大文件或 inode 热点分析。记录根、排除项、超时和实际边界；不得跟随符号链接越界或读取文件正文来判断占用。

package/template/workflows/ops/I-intake-and-assess/deployment-dossier-template.md

@@ -0,0 +1,62 @@
+# Deployment Dossier
+
+| Field | Value |
+| --- | --- |
+| Project / change | {project_id} / {change} |
+| Source root | {source_root} |
+| Source revision | {source_revision} |
+| Target snapshot | {snapshot_path} |
+| Target profile / digest | deployment/target-profile.json / {target_profile_digest} |
+| Operation mode | audit / takeover / fresh / release / upgrade / rollback |
+| Environment class | local / shared-nonprod / production |
+| Existing state | absent / present / unknown |
+| Identity confirmed | true / false |
+| Deployment root | {deployment_root} |
+| Existing project SOP | {runbook_paths} |
+| Readiness | blocked / ready |
+
+## Requested Outcome and Constraints
+
+## Component and Runtime Map
+
+## Build, Artifact, Start and Restart
+
+## Middleware and External Dependencies
+
+## Configuration Matrix
+
+仅记录 key、scope、required、secret 和 source reference。
+
+## Ports, Exposure and Health
+
+## Data, Volumes, Migration and Backup
+
+## Deployment Options and Tradeoffs
+
+## Selected Method and Target Fit
+
+## Target and Control-plane Identity
+
+逐项列出 provider、key、comparison、非敏感 expected 与 evidence。Compose project、有序 files、env file、services、labels/image identity 和 bind host 不得折叠成单一目录名判断。
+
+## Ownership and Difference Classification
+
+列出 owned/protected/unknown targets；每项差异只能是 expected、safe-reconcile、requires-backup、ownership-conflict 或 unknown。
+
+## Immutable Artifacts, Staging and Activation
+
+## Required Gates and Stability Expectations
+
+## Security and Required Privileges
+
+## Secret Requirements
+
+只记录 key、provider/受控 source reference、version 和 presence requirement，不保存值。
+
+## Prior SOP, Known Failures and Applicable ADRs
+
+## Unknowns and Dynamic Probes
+
+## Planning Preconditions
+
+## Evidence Sources

package/template/workflows/ops/I-intake-and-assess/global-change-status-template.json

@@ -0,0 +1,26 @@
+{
+  "schema_version": 2,
+  "artifact": "ops-change-status",
+  "scope": "global",
+  "project_id": null,
+  "change": "{change}",
+  "change_status": "active",
+  "phase": "intake",
+  "current_work": null,
+  "works_run": [],
+  "created_at": "{created_at}",
+  "updated_at": "{updated_at}",
+  "completed_at": null,
+  "archived_at": null,
+  "archive_path": null,
+  "source_revision": null,
+  "target_fingerprint": null,
+  "plan_path": null,
+  "plan_digest": null,
+  "approval_path": null,
+  "approval_status": "not_requested",
+  "approved_batches": [],
+  "latest_attempt_id": null,
+  "outcome": "pending",
+  "blockers": []
+}

package/template/workflows/ops/I-intake-and-assess/project-detection.md

@@ -0,0 +1,38 @@
+# 项目部署探测
+
+按实际存在内容选择，不按语言预设结论。
+
+## 身份与边界
+
+- 读取项目 Agent 指令、仓库根、worktree/dirty 状态、子模块和多仓库关系；
+- VCS remote 必须移除 userinfo、token 和 query 后才能作为 identity；
+- monorepo 使用仓库 identity 加组件相对路径，不能把两个组件误作同一部署单元；
+- 目录名只能作为 project id 候选，不能单独证明项目身份。
+
+## 通用入口
+
+- README、部署/运维文档、Makefile、Taskfile、脚本和 CI/CD；
+- Dockerfile、Compose、`.dockerignore`、entrypoint 和 healthcheck；
+- Kubernetes、Kustomize、Helm、Terraform、Ansible、systemd/launchd；
+- 配置 schema、`.env.example`、示例 YAML/TOML/JSON、secret provider 引用；
+- migration、seed、backup/restore、volume 和数据保留说明。
+
+## Runtime 线索
+
+| Ecosystem | Static sources | Questions to resolve |
+| --- | --- | --- |
+| Java/JVM | `pom.xml`、Gradle、wrapper、toolchains、application config | JDK、artifact、profile、JVM flags、中间件、migration |
+| Go | `go.mod`、workspace、build tags、main、embed | Go version、CGO、OS/arch、binary flags |
+| Node | `package.json`、lockfile、workspace、runtime version | package manager、build/start、Node、process manager |
+| Python | `pyproject.toml`、lockfiles、WSGI/ASGI | interpreter、environment、workers、native dependencies |
+| Container | Dockerfile stages、Compose、healthcheck、mounts | args、runtime env、ports、volumes、networks、platform |
+
+XML、JSON、YAML 和 TOML 使用可用结构化 parser。读取配置时只提取 key 和结构；示例值不自动视为生产值，真实值不复制到 change。
+
+## 证据等级
+
+- manifest 明确声明：declared；
+- lockfile/runtime file 固定：declared with stronger pin；
+- 文档无配置支持：unverified；
+- 目标命令验证：observed；
+- 模型推断：inferred，写依据与置信度。

package/template/workflows/ops/I-intake-and-assess/request-template.md

@@ -0,0 +1,44 @@
+# Ops Request
+
+| Field | Value | Source |
+| --- | --- | --- |
+| Scope | global / project | user and discovery |
+| Project id | none / `{project_id}` | project registry |
+| Change | `{change}` | assigned |
+| Topic | unresolved | user request |
+| Requested outcome | unresolved | user |
+| Source project | none / unresolved | user/project discovery |
+| Target environment | unresolved | user |
+| Target systems | unresolved | user/current context |
+| Environment class | local / shared-nonprod / production / unresolved | user |
+| Deployment root | unresolved | user/plan |
+| Maintenance window | unresolved | user |
+| Derived from | none | status/archive |
+
+## In Scope
+
+- unresolved
+
+## Out of Scope
+
+- unresolved
+
+## User Constraints
+
+- unresolved
+
+## Success, Stop and Recovery
+
+- Success: unresolved
+- Failure/stop conditions: unresolved
+- Recovery expectation: unresolved
+
+## Known Inputs
+
+- Source revision: unresolved
+- Existing inventory snapshot: none
+- Existing project SOP: none
+
+## Open Decisions
+
+- unresolved

package/template/workflows/ops/I-intake-and-assess/system-report-template.md

@@ -0,0 +1,34 @@
+# System Survey
+
+| Field | Value |
+| --- | --- |
+| Scope / project | {scope} / {project_id} |
+| Change | {change} |
+| Snapshot | {snapshot_path} |
+| Captured at | {captured_at} |
+| Target fingerprint | {target_fingerprint} |
+| Levels | {levels} |
+
+## Target and Host
+
+## Capacity and Paths
+
+## Runtimes and Development Tools
+
+## Services, Processes and Working Directories
+
+## Ports and Network Bindings
+
+## Docker and Compose
+
+## Kubernetes or Other Control Planes
+
+## Project Locations
+
+## Observation Gaps
+
+## Redactions and Sensitivity
+
+## Freshness
+
+说明规划或执行前必须重采集的事实，以及本快照不能证明的内容。

package/template/workflows/ops/I-intake-and-assess/target-profile-template.json

@@ -0,0 +1,24 @@
+{
+  "schema_version": 1,
+  "artifact": "ops-target-profile",
+  "scope": "project",
+  "project_id": "{project_id}",
+  "change": "{change}",
+  "created_at": "{created_at}",
+  "operation_mode": "takeover",
+  "environment_class": "shared-nonprod",
+  "deployment_root": "{absolute_deployment_root}",
+  "existing_state": "present",
+  "identity_confirmed": false,
+  "identity_confirmation_evidence": null,
+  "identity_assertions": [],
+  "ownership": {
+    "owned_targets": [],
+    "protected_targets": [],
+    "unknown_targets": []
+  },
+  "differences": [],
+  "secret_requirements": [],
+  "readiness": "blocked",
+  "blockers": ["target identity has not been confirmed"]
+}