@namewta/speculo 1.0.17 → 1.0.19

package/template/workflows/ops/common/tools/opslib/workspace.mjs

@@ -0,0 +1,107 @@
+/** Explicit controller/server/project routing and bounded workspace paths. */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, relative as pathRelative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { digest, exact, identifier, noSymlinks, OpsError, readJson } from "./core.mjs";
+
+export const WORKS = Object.freeze({
+  controller: "I-initialize", access: "S-server-connect", server: "H-host-manage",
+  project: "D-project-deploy", inventory: "V-inventory-view",
+});
+const WORKFLOW = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
+export const MAX_JSON_BYTES = 16 * 1024 * 1024;
+
+export function statePath(value) {
+  if (typeof value !== "string" || !isAbsolute(value) || value.includes("\0") || value.split(/[\\/]/).includes("..")) {
+    throw new OpsError("--state must be an explicit absolute path without traversal; never inferred from cwd");
+  }
+  const state = resolve(value);
+  const rel = pathRelative(WORKFLOW, state);
+  if (dirname(state) === state || rel === "" || (rel !== ".." && !rel.startsWith(".." + sep) && !isAbsolute(rel))) {
+    throw new OpsError("state must be a dedicated runtime directory outside static workflow assets");
+  }
+  noSymlinks(state, { allowMissing: false });
+  if (!statSync(state).isDirectory()) throw new OpsError("state is not a directory");
+  return state;
+}
+
+export function readBoundedJson(path) {
+  noSymlinks(path, { allowMissing: false });
+  const st = statSync(path);
+  if (!st.isFile() || st.size > MAX_JSON_BYTES) throw new OpsError("JSON file is not regular or exceeds 16 MiB");
+  return readJson(path);
+}
+
+export function readRegistry(state) {
+  statePath(state);
+  const value = readBoundedJson(join(state, "status.json"));
+  if (value.schema_version !== 3 || value.workflow !== "ops" || !Number.isSafeInteger(value.revision) || value.revision < 0) {
+    throw new OpsError("workspace requires OPS status schema v3; legacy state must be imported, not overwritten");
+  }
+  if (!value.controller || !value.controller.controller_id) throw new OpsError("initialize the controller first");
+  identifier(value.controller.controller_id, "controller_id");
+  if (typeof value.controller.state_root !== "string" || resolve(value.controller.state_root) !== resolve(state)) throw new OpsError("controller state_root mismatch; do not silently adopt another workspace");
+  for (const key of ["hosts", "projects", "deployments", "bindings", "allocations", "releases"]) {
+    if (!value[key] || typeof value[key] !== "object" || Array.isArray(value[key])) throw new OpsError(`invalid registry map: ${key}`);
+    if (Object.keys(value[key]).length > 10000) throw new OpsError(`registry map exceeds workspace bound: ${key}`);
+    for (const id of Object.keys(value[key])) identifier(id, key);
+  }
+  for (const [id, h] of Object.entries(value.hosts)) {
+    if (!h || h.host_id !== id || !["local", "ssh"].includes(h.transport)) throw new OpsError(`invalid host record: ${id}`);
+  }
+  for (const [id, p] of Object.entries(value.projects)) {
+    if (!p || p.project_id !== id) throw new OpsError(`invalid project record: ${id}`);
+  }
+  for (const [id, d] of Object.entries(value.deployments)) {
+    if (!d || d.deployment_id !== id || !Object.hasOwn(value.hosts, d.host_id) || !Object.hasOwn(value.projects, d.project_id)) {
+      throw new OpsError(`orphan or invalid deployment: ${id}`);
+    }
+  }
+  return value;
+}
+
+export function ids(value, label) {
+  if (!Array.isArray(value) || new Set(value).size !== value.length) throw new OpsError(`${label} must be an array of distinct IDs`);
+  return value.map((id) => identifier(id, label));
+}
+
+export function route(registry, context) {
+  exact(context, new Set(["scope", "server_ids", "project_ids"]), new Set(["scope", "server_ids", "project_ids"]), "context");
+  if (!Object.hasOwn(WORKS, context.scope)) throw new OpsError("scope must be controller, access, server, project or inventory");
+  const servers = ids(context.server_ids, "server_ids");
+  const projects = ids(context.project_ids, "project_ids");
+  if (context.scope === "controller" && (servers.length || projects.length)) throw new OpsError("controller scope cannot target a server or project; use S/H/D");
+  if (["access", "server"].includes(context.scope) && (servers.length !== 1 || projects.length)) throw new OpsError("S/H require exactly one explicit server and no project");
+  if (context.scope === "project" && (!servers.length || projects.length !== 1)) throw new OpsError("D requires explicit server(s) and exactly one project; no last-used/cwd fallback");
+  for (const id of servers) if (context.scope !== "access" && !Object.hasOwn(registry.hosts, id)) throw new OpsError(`unknown server: ${id}; enroll via S first`);
+  for (const id of projects) if (!Object.hasOwn(registry.projects, id)) throw new OpsError(`unknown project: ${id}; explicitly register the project first`);
+  return { scope: context.scope, work: WORKS[context.scope], controller_id: registry.controller.controller_id,
+    server_ids: servers, project_ids: projects, host_ids: servers, registration_required: servers.filter((id) => !Object.hasOwn(registry.hosts, id)), note: "server maps to Host.host_id; controller is never an implicit local server" };
+}
+
+export function catalogUnlocked(state) {
+  noSymlinks(join(state, ".locks", "catalog"));
+  if (existsSync(join(state, ".locks", "catalog"))) throw new OpsError("catalog lock held; inspect the owner before generating a new snapshot");
+}
+
+export function fileDigest(path) {
+  noSymlinks(path, { allowMissing: false });
+  if (!statSync(path).isFile() || statSync(path).size > MAX_JSON_BYTES) throw new OpsError("file exceeds snapshot bound");
+  return digest(readFileSync(path));
+}
+
+/** Pin identity and transport, not changeable host_services annotations. */
+export function targetDigest(host) {
+  if (!host) throw new OpsError("missing target host");
+  const { host_id, root, identity, platform, transport, connection } = host;
+  const known_hosts_digest = transport === "ssh" ? fileDigest(connection.known_hosts) : null;
+  return digest({ host_id, root, identity, platform, transport, connection, known_hosts_digest });
+}
+
+export function containedPath(root, path) {
+  if (typeof path !== "string" || !isAbsolute(path) || path.split(/[\\/]/).includes("..")) throw new OpsError("expected an absolute contained artifact path");
+  const rel = pathRelative(resolve(root), resolve(path));
+  if (!rel || rel === ".." || rel.startsWith(".." + sep) || isAbsolute(rel)) throw new OpsError("artifact path outside workspace");
+  noSymlinks(path, { allowMissing: false });
+  return resolve(path);
+}

package/template/workflows/ops/common/tools/opslib/workspace_cli.mjs

@@ -0,0 +1,80 @@
+/** Additive workspace commands. Legacy CLI semantics remain owned by cli.mjs. */
+import { isAbsolute } from "node:path";
+import { OpsError } from "./core.mjs";
+import { readBoundedJson, readRegistry, route, statePath } from "./workspace.mjs";
+import { checkServer } from "./server_checks.mjs";
+import { generateFleet } from "./fleet.mjs";
+import { authorizeTask, prepareTask, runTask } from "./tasks.mjs";
+
+export const COMMANDS = Object.freeze(["workspace-help", "route", "server-check", "fleet", "task-plan", "task-authorize", "task-run"]);
+const options = {
+  route: ["scope", "server", "project"],
+  "server-check": ["server", "profile", "min-free-mib", "min-memory-mib"],
+  fleet: ["stale-hours"], "task-plan": ["file"],
+  "task-authorize": ["task", "digest", "by", "statement", "ack-destructive"], "task-run": ["task"], "workspace-help": [],
+};
+export function workspaceCommand(argv) {
+  const rest = [...argv];
+  for (let i = rest.length - 1; i >= 0; i--) if (rest[i] === "--state") rest.splice(i, 2);
+  return COMMANDS.includes(rest[0]) ? rest[0] : null;
+}
+export function parseWorkspaceArgs(argv) {
+  const command = workspaceCommand(argv);
+  if (!command) throw new OpsError("unknown workspace command");
+  const args = [...argv], out = { command };
+  args.splice(args.indexOf(command), 1);
+  const allowed = new Set(["state", ...options[command]]);
+  while (args.length) {
+    const flag = args.shift();
+    if (!flag.startsWith("--") || !allowed.has(flag.slice(2))) throw new OpsError(`unknown ${command} argument: ${flag}`);
+    const key = flag.slice(2);
+    if (Object.hasOwn(out, key)) throw new OpsError(`duplicate argument: ${flag}`);
+    const value = args.shift();
+    if (!value || value.startsWith("--")) throw new OpsError(`${flag} needs a value`);
+    out[key] = value;
+  }
+  if (command !== "workspace-help" && !out.state) throw new OpsError("--state is required and must be absolute");
+  return out;
+}
+const required = (args, key) => { if (!args[key]) throw new OpsError(`--${key} is required`); return args[key]; };
+const list = (v) => v ? v.split(",") : [];
+function integer(value, fallback) {
+  if (value === undefined) return fallback;
+  if (!/^[1-9][0-9]*$/.test(value) || !Number.isSafeInteger(Number(value))) throw new OpsError("threshold must be a positive integer");
+  return Number(value);
+}
+export async function main(argv = process.argv.slice(2)) {
+  try {
+    const args = parseWorkspaceArgs(argv);
+    if (args.command === "workspace-help") {
+      process.stdout.write(JSON.stringify({ commands: options, usage: "node ops.mjs --state ABSOLUTE_STATE COMMAND [options]",
+        workflow: "I controller; S server access; H server baseline; D project deployment; V local inventory",
+        task: "task-plan -> record existing explicit user authorization once via task-authorize -> task-run; no per-step reconfirmation; no automatic retry",
+        legacy: "All other commands retain the original plan/approve/apply contracts" }, null, 2) + "\n");
+      return 0;
+    }
+    const state = statePath(args.state);
+    // Keep the existing complete schema/semantic validator authoritative in the installed runtime.
+    const { load } = await import("./model.mjs");
+    load(state);
+    let result;
+    switch (args.command) {
+      case "route": result = route(readRegistry(state), { scope: required(args, "scope"), server_ids: list(args.server), project_ids: list(args.project) }); break;
+      case "server-check": result = await checkServer(state, required(args, "server"), { profile: args.profile ?? "base",
+        minFreeMiB: integer(args["min-free-mib"], 1024), minMemoryMiB: integer(args["min-memory-mib"], 256) }); break;
+      case "fleet": result = generateFleet(state, { staleHours: integer(args["stale-hours"], 24) }); break;
+      case "task-plan": {
+        const file = required(args, "file");
+        if (!isAbsolute(file)) throw new OpsError("--file must be an absolute task request path");
+        result = await prepareTask(state, readBoundedJson(file)); break;
+      }
+      case "task-authorize": result = authorizeTask(state, required(args, "task"), required(args, "digest"), required(args, "by"), required(args, "statement"), args["ack-destructive"] ?? null); break;
+      case "task-run": result = await runTask(state, required(args, "task")); break;
+    }
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    return ["blocked", "failed", "partial", "unknown", "stale", "docs_pending", "interrupted"].includes(result.status) ? 2 : 0;
+  } catch (error) {
+    process.stderr.write(JSON.stringify({ status: "blocked", error: error.message || String(error) }) + "\n");
+    return 2;
+  }
+}

package/template/workflows/ops/common/tools/validate-ops.mjs

@@ -5,10 +5,10 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 import { validateStatus } from "./opslib/model.mjs";
+import { WORKS } from "./opslib/workspace.mjs";
 
 const tools = dirname(fileURLToPath(import.meta.url));
 const root = resolve(tools, "../..");
-const expected = ["D-project-deploy", "H-host-manage", "I-initialize"];
 const args = process.argv.slice(2);
 
 try {
@@ -16,12 +16,17 @@ try {
     const works = readdirSync(root, { withFileTypes: true })
       .filter((x) => x.isDirectory() && !["common", "_state", "__pycache__"].includes(x.name))
       .map((x) => x.name).sort();
-    if (JSON.stringify(works) !== JSON.stringify(expected)) throw new Error("OPS must expose exactly three work directories");
+    const expected = Object.values(WORKS).sort();
+    if (JSON.stringify(works) !== JSON.stringify(expected)) throw new Error("OPS Work directories differ from explicit scope router");
+    const manifest = JSON.parse(readFileSync(join(root, "manifest.json"), "utf8"));
+    const stages = manifest.stages.map((s) => s.id).sort();
+    if (new Set(stages).size !== stages.length || JSON.stringify(stages) !== JSON.stringify(works.map((w) => w.slice(2)).sort())) throw new Error("manifest stages differ from Work entries");
+    for (const stage of manifest.stages) for (const id of stage.after) if (!stages.includes(id)) throw new Error("unknown manifest prerequisite " + id);
     for (const id of works) {
       const text = readFileSync(join(root, id, id + ".md"), "utf8");
-      if (!text.includes("type: workflow-entry") || !text.includes("读取范围")) throw new Error("invalid work " + id);
+      if (!text.includes("type: workflow-entry") || !text.includes("读取范围") || !text.includes("id: ops/" + id.slice(2))) throw new Error("invalid work " + id);
     }
-    for (const file of ["INDEX.md", "README.md", "manifest.json", "runtime-contract.json", "common/USAGE.md", "common/CAPABILITIES.md", "common/tools/opslib/execution.mjs"]) {
+    for (const file of ["INDEX.md", "README.md", "manifest.json", "runtime-contract.json", "common/USAGE.md", "common/WORKSPACE-USAGE.md", "common/CAPABILITIES.md", "common/templates/FLEET.html", "common/schemas/fleet-view.schema.json", "common/schemas/task-request.schema.json", "common/schemas/server-check.schema.json", "common/tools/opslib/execution.mjs", "common/tools/opslib/tasks.mjs", "common/tools/opslib/fleet.mjs"]) {
       if (!existsSync(join(root, file))) throw new Error("missing " + file);
     }
     for (const name of readdirSync(join(root, "common/schemas")).filter((x) => x.endsWith(".json"))) {
@@ -30,10 +35,8 @@ try {
     JSON.parse(readFileSync(join(root, "common/toolchains/volta-linux.json"), "utf8"));
     validateStatus(JSON.parse(readFileSync(join(root, "_state/status.json"), "utf8")));
     console.log("resource schema valid");
-    console.log(JSON.stringify({
-      valid: true, version: "2.2.0", workers: works, schema_version: 3,
-      scope: "static and empty-resource-schema check; not live target acceptance",
-    }, null, 2));
+    console.log(JSON.stringify({ valid: true, version: manifest.version, workers: works, schema_version: 3,
+      scope: "static and empty-resource-schema check; not live target acceptance" }, null, 2));
   } else if (args.length === 2 && ["--state-root", "--state"].includes(args[0])) {
     const p = spawnSync(process.execPath, [join(tools, "ops.mjs"), "--state", resolve(args[1]), "validate"], { encoding: "utf8", timeout: 30000 });
     if (p.status !== 0) throw new Error(p.stdout + p.stderr);

package/template/workflows/ops/manifest.json

@@ -22,31 +22,50 @@
       "risk": "local-reversible",
       "context_budget": 16000
     },
+    {
+      "id": "server-connect",
+      "after": [
+        "initialize"
+      ],
+      "inputs": [
+        "server",
+        "verified-host-key",
+        "key-or-agent"
+      ],
+      "outputs": [
+        "server-registration",
+        "inventory",
+        "server-checks"
+      ],
+      "risk": "production-critical",
+      "context_budget": 20000
+    },
     {
       "id": "host-manage",
       "after": [],
       "inputs": [
-        "host",
+        "server",
         "spec",
-        "approval"
+        "task-authorization-or-plan-approval"
       ],
       "outputs": [
         "host-run",
         "verification",
-        "dual-documents"
+        "dual-documents",
+        "server-checks"
       ],
       "risk": "production-critical",
-      "context_budget": 22000
+      "context_budget": 24000
     },
     {
       "id": "project-deploy",
       "after": [],
       "inputs": [
         "project",
-        "hosts",
+        "explicit-servers",
         "bindings",
         "spec",
-        "approval"
+        "task-authorization-or-plan-approval"
       ],
       "outputs": [
         "release",
@@ -54,7 +73,24 @@
         "dual-documents"
       ],
       "risk": "production-critical",
-      "context_budget": 28000
+      "context_budget": 30000
+    },
+    {
+      "id": "inventory-view",
+      "after": [],
+      "inputs": [
+        "resource-state",
+        "server-checks",
+        "task-summaries"
+      ],
+      "outputs": [
+        "fleet-markdown",
+        "fleet-json",
+        "fleet-html",
+        "view-receipt"
+      ],
+      "risk": "local-reversible",
+      "context_budget": 16000
     }
   ]
 }

package/template/workflows/person/M-mao-zedong-cognitive-os/M-mao-zedong-cognitive-os.md

@@ -9,67 +9,25 @@ keywords: [毛泽东, 毛选, 矛盾分析, 战略, 组织, 咨询]
 
 # 毛泽东 · 认知操作系统
 
-本入口把"分析问题—制定战略—组织行动"组织为渐进披露的咨询流程。产物写入当前 `person/changes/<change>/`。
+以特定方法论开展“分析问题—制定战略—组织行动”咨询，产物只写当前 person change。激活时读取 `<Path>{roots.workflows}/person/INDEX.md</Path>` 与 `<Path>{roots.workflows}/person/common/rules/activation-and-memory.md</Path>`；Person 没有 README，不加载其他 phase 或整套书籍。
 
-## 读取范围
+## 按阶段推进
 
-1. 先读取 `<Path>{roots.workflows}/person/INDEX.md</Path>` 与当前 Work 的状态入口；Person 使用整文件 INDEX，不加载不存在的 README。
-2. 再读取 `<Path>{roots.workflows}/person/common/rules/activation-and-memory.md</Path>`，按当前分支、状态和关键词定位最小相关工件。
-3. 只在本 Work 明确要求恢复、冲突、执行安全或归档证据时扩展为全量读取；缺少匹配证据或 owner/gateway 时停止受影响分支。
+下表有序且硬依赖：上一阶段产物完成、验证后才进入下一阶段。每个阶段只读取自己的入口，角色、声音、模型和引用纪律由该入口及其参考单点维护。
 
-引用检索固定为：先读取当前 phase 的 framework index，再读取 `references/research/15-quote-bank.md` 定位篇目编号，最后只回读匹配的 `books/src/NNN-*.md`；不扫描整套书籍，无匹配证据时停止引用或结论。
+| 阶段 | 进入时读取 | 产物与可判定完成门 |
+|---|---|---|
+| 1 激活与问诊 | `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/activate.md</Path>` | `<Path>{roots.state}/person/changes/{change}/problem-statement.md</Path>`：首次激活声明；开口三问中至少追问两题且用户回应；问题类型和主框架确定；六段填实 |
+| 2 诊断分析 | `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/diagnose.md</Path>` | `<Path>{roots.state}/person/changes/{change}/analysis.md</Path>`：至少两个 Module A 模型；必过 A1，二手信息过 A3，多方利益过 A6；每个结论含条件/局限，主要矛盾有论证 |
+| 3 战略制定 | `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/strategize.md</Path>` | `<Path>{roots.state}/person/changes/{change}/strategy.md</Path>`：沿定性→定向→站位→时间→投放→运用展开主框架；必要辅助框架；至少两阶段及明确关键战役 |
+| 4 组织行动 | `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/mobilize.md</Path>` | `<Path>{roots.state}/person/changes/{change}/action-plan.md</Path>`：行动、责任人、期限、完成条件、失败处置与反馈机制明确 |
+| 5 综合交付 | `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/deliver.md</Path>` | `<Path>{roots.state}/person/changes/{change}/consultation-output.md</Path>`：按交付模板整合四阶段，教员第一人称、五拍论证、收尾四动作、反模式检查与内在张力标注；全部原文引用有篇目出处 |
 
+每项产物回读后必须无残留 `[TODO:]`；缺少用户回应、阶段证据或原文出处时保留当前阶段，不用后续产物掩盖缺口。
 
-## 流程
+## 引用检索
 
-### 1. 激活与问诊
-
-委托给 `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/activate.md</Path>`。输出首次激活声明，通过开口三问摸清用户处境，判定问题类型并匹配主框架。
-
-产物：`<Path>{roots.state}/person/changes/{change}/problem-statement.md</Path>`
-
-**完成标准**：首次激活声明已输出，至少已追问 2 个开口问题且用户已回应，问题类型与主框架已匹配，problem-statement.md 六段均已填写无残留 `[TODO:]`。
-
-### 2. 诊断分析
-
-依赖步骤 1 的 problem-statement.md。委托给 `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/diagnose.md</Path>`。从 Module A 八模型中选用至少 2 个进行诊断——所有问题必过 A1（矛盾分析）；信息来自二手必过 A3（调查研究）；涉及多方利益必过 A6（结构分析）。
-
-产物：`<Path>{roots.state}/person/changes/{change}/analysis.md</Path>`
-
-**完成标准**：已应用至少 2 个 Module A 模型，每个模型结论带条件与局限，主要矛盾已明确写出且带论证，analysis.md 无残留 `[TODO:]`。
-
-### 3. 战略制定
-
-依赖步骤 2 的 analysis.md。委托给 `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/strategize.md</Path>`。沿元框架流水线（定性→定向→站位→时间→投放→运用）展开主框架，必要时补充辅助框架。
-
-产物：`<Path>{roots.state}/person/changes/{change}/strategy.md</Path>`
-
-**完成标准**：主框架已选定并充分展开，阶段划分清晰（至少分两步），有明确的关键战役判断，strategy.md 无残留 `[TODO:]`。
-
-### 4. 组织行动
-
-依赖步骤 3 的 strategy.md。委托给 `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/mobilize.md</Path>`。将战略转化为具体行动方案——谁来干、干什么、什么时候干完、干到什么程度算好、干砸了怎么办。
-
-产物：`<Path>{roots.state}/person/changes/{change}/action-plan.md</Path>`
-
-**完成标准**：行动、责任与反馈机制已明确，action-plan.md 无残留 `[TODO:]`。
-
-### 5. 综合交付
-
-依赖前四步全部产物。委托给 `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/deliver.md</Path>`。按模板 `../_templates/mao-consultation-output-template.md` 整合为连贯的教员第一人称咨询输出——五拍论证节奏、收尾四动作、引用纪律、反模式检查和内在张力标注。
-
-产物：`<Path>{roots.state}/person/changes/{change}/consultation-output.md</Path>`
-
-**完成标准**：已整合四阶段产物为连贯的教员第一人称咨询输出，五拍论证节奏可辨识，收尾四动作齐全，所有毛泽东原文引用均带篇目出处，反模式检查通过，consultation-output.md 无残留 `[TODO:]`。
-
-## 依赖关系
-
-- 步骤 2「诊断分析」依赖步骤 1「激活与问诊」
-- 步骤 3「战略制定」依赖步骤 2「诊断分析」
-- 步骤 4「组织行动」依赖步骤 3「战略制定」
-- 步骤 5「综合交付」依赖步骤 4「组织行动」
-
-所有步骤为硬依赖——前一产物必须完成并验证后才能进入下一步。
+需要引用时，先读当前 phase 的 framework index，再在 `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/references/research/15-quote-bank.md</Path>` 定位篇目编号，最后仅回读匹配的原文。目录映射查询 `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/books/README.md</Path>`；无匹配证据则停止该引用或依赖结论，不扫描整套书籍。
 
 ## 状态追踪
 
@@ -82,16 +40,3 @@ keywords: [毛泽东, 毛选, 矛盾分析, 战略, 组织, 咨询]
 - **`methods_applied`**（数组）—— 组织阶段已应用的 Module C 方法列表
 - **`quotes_cited`**（数组）—— 已引用的毛泽东原话及出处
 - **`consultation_status`**（字符串）—— 当前阶段：`activating` → `diagnosing` → `strategizing` → `mobilizing` → `delivering` → `completed`
-
-## 渐进披露
-
-角色、声音、模型和引用规则继续由各 phase 文件及其相对引用拥有；未进入 phase 时不加载对应材料。
-
-| 文件 | 触发条件 |
-|------|----------|
-| `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/activate.md</Path>` | 步骤 1「激活与问诊」进入时 |
-| `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/diagnose.md</Path>` | 步骤 2「诊断分析」进入时 |
-| `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/strategize.md</Path>` | 步骤 3「战略制定」进入时 |
-| `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/mobilize.md</Path>` | 步骤 4「组织行动」进入时 |
-| `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/deliver.md</Path>` | 步骤 5「综合交付」进入时 |
-| `<Path>{roots.workflows}/person/M-mao-zedong-cognitive-os/books/README.md</Path>` | 需要查原文时——引语库 `references/research/15-quote-bank.md` 映射篇目编号到 books 目录 |

package/template/workflows/person/S-steelman-deliberation/S-steelman-deliberation.md

@@ -9,39 +9,13 @@ keywords: [双向钢人, steelman, 决策, 反谄媚, 关键变量, 明确判断
 
 # 双向钢人论证
 
-本 work 的主导词是**钢人化**。它不负责替用户把既有立场说得更顺耳，也不以“正反都说一点”制造表面平衡；它负责在结论形成前，把用户真正要解决的问题、支持当前倾向的最强可信论证、反对当前倾向的最强可信论证和决定结论的变量同时推进到可检验状态，再只关闭一个最高价值的不确定性，最后承担判断责任。
+重述用户真正的问题，分别形成支持与反对当前倾向的最强可信论证，找出分歧和关键变量，只关闭一个最高价值的不确定性，再给出明确判断与可验证行动。不以虚假平衡、迎合立场或通用建议替代判断。
 
-核心动作保持为：
+激活时读取 `<Path>{roots.workflows}/person/INDEX.md</Path>` 与 `<Path>{roots.workflows}/person/common/rules/activation-and-memory.md</Path>`；Person 不使用不存在的 README。
 
-1. 用最完整、最有力的方式，重述用户真正想解决的问题；
-2. 使用钢人论证法，分别给出支持当前想法与反对它的最强论证；
-3. 找出双方真正的分歧，以及最可能改变结论的关键变量；
-4. 只问用户一个最关键的问题；等用户回答后，再给出明确判断、理由和下一步行动。
+## 输入与权威
 
-## 读取范围
-
-1. 先读取 `<Path>{roots.workflows}/person/INDEX.md</Path>` 与当前 Work 的状态入口；Person 使用整文件 INDEX，不加载不存在的 README。
-2. 再读取 `<Path>{roots.workflows}/person/common/rules/activation-and-memory.md</Path>`，按当前分支、状态和关键词定位最小相关工件。
-3. 只在本 Work 明确要求恢复、冲突、执行安全或归档证据时扩展为全量读取；缺少匹配证据或 owner/gateway 时停止受影响分支。
-
-
-## 输入、权威与边界
-
-### 必需输入
-
-- 一个需要选择、判断、取舍、排序或制定策略的具体问题。
-
-缺失可识别问题，或输入只是无需权衡的事实查询时，返回 `blocked-input`，说明缺少什么，不制造虚假争论。
-
-### 可选输入
-
-- 用户当前倾向、候选方案与反对意见；
-- 时间窗口、预算、资源、风险和不可逆约束；
-- 已知事实、项目材料、证据或外部来源；
-- 用户已经明确的目标、价值排序和成功标准；
-- 调用方显式提供的 `{change}`。
-
-不存在的可选输入静默跳过；已经明确的信息不得重复询问。
+必需一个需要选择、判断、排序或策略的具体问题；缺失或只是无需权衡的事实查询时返回 `blocked-input`，不制造争论。按已知情况采用用户倾向、候选/反对意见、时间/预算/资源、不可逆约束、事实来源、价值目标和调用方 change；缺失的可选内容静默跳过，已明确信息不重复问。
 
 ### 权威顺序
 
@@ -64,7 +38,9 @@ keywords: [双向钢人, steelman, 决策, 反谄媚, 关键变量, 明确判断
 
 它不修改其他 person work 的产物或 active 条目，不把运行时状态写回 `{roots.workflows}/person/_state/`，也不提交、推送、发布、部署或执行不可逆操作。
 
-## 流程
+## 按持久化阶段执行
+
+新建、恢复或状态写入前读取 `<Path>{roots.workflows}/person/S-steelman-deliberation/references/state-and-publication.md</Path>`，遵守 v1 字段、候选校验、原子替换顺序和未知字段保留；不得覆盖其他 Work。
 
 ### 1. 解析 roots，选择或恢复 change
 
@@ -94,23 +70,9 @@ keywords: [双向钢人, steelman, 决策, 反谄媚, 关键变量, 明确判断
 
 ### 3. 回答前的双向钢人化
 
-仅在没有有效 dossier 时读取 `<Path>{roots.workflows}/person/S-steelman-deliberation/deliberate.md</Path>`，按其顺序完成真实问题重述、证据分层、双向钢人、分歧与关键变量识别，并形成唯一关键问题。
-
-若问题依赖会变化的公开事实、专业事实、冲突材料、代码/测试/配置，或属于医疗、法律、财务、安全等高风险领域，再读取 `<Path>{roots.workflows}/person/S-steelman-deliberation/evidence-gate.md</Path>`；可发现的事实先探索，不拿来问用户。
-
-使用 `<Path>{roots.workflows}/person/S-steelman-deliberation/_templates/steelman-dossier-template.md</Path>` 在 change 目录下的唯一临时子目录中写入候选 dossier 与候选 `.status.json`，重读后运行：
+仅在无有效 dossier 时读取 `<Path>{roots.workflows}/person/S-steelman-deliberation/deliberate.md</Path>`，完整重述问题、分层证据、正反钢人、分歧与关键变量，形成唯一关键问题。变化事实、专业事实、冲突材料、代码或高风险领域还须读 `<Path>{roots.workflows}/person/S-steelman-deliberation/evidence-gate.md</Path>`；可发现的事实先探索，不拿来问用户。
 
-```bash
-node <Path>{roots.workflows}/person/S-steelman-deliberation/tools/validate-steelman-change.mjs</Path> \
-  --phase awaiting-answer \
-  --change-dir <Path>{roots.state}/person/changes/{change}</Path> \
-  --dossier-file <Path>{roots.state}/person/changes/{change}/.steelman-stage/steelman-dossier.md</Path> \
-  --status-file <Path>{roots.state}/person/changes/{change}/.steelman-stage/.status.json</Path>
-```
-
-临时目录名在并发时追加唯一后缀。校验通过后，先原子替换正式 dossier，再原子替换 change `.status.json`；workflow active 只在步骤 4 确认需要等待用户时更新。校验失败时删除临时目录并保持正式工件和旧状态不变。
-
-**完成标准**：dossier 是回答前的冻结快照；正反最强可信论证、真正分歧、关键变量和唯一问题均存在；没有最终判断或行动建议；校验退出码为 0。
+按状态与发布合同的“回答前”分支创建、校验并发布 dossier；其中没有最终判断或行动建议，退出码必须为 0。该 dossier 随后冻结。
 
 ### 4. 只关闭一个最高价值的不确定性
 
@@ -132,73 +94,9 @@ node <Path>{roots.workflows}/person/S-steelman-deliberation/tools/validate-steel
 
 ### 5. 明确裁决并形成行动
 
-关键问题得到有效回答后，将回答原文写入 change `.status.json`，设置 `phase: judging`，再读取 `<Path>{roots.workflows}/person/S-steelman-deliberation/judge.md</Path>`。必须基于冻结 dossier 和用户回答裁决，不重做一份迎合回答的新钢人分析。
-
-使用 `<Path>{roots.workflows}/person/S-steelman-deliberation/_templates/decision-template.md</Path>` 在唯一临时目录中写入候选 decision 与候选完成态 `.status.json`，随后运行：
+得到有效回答后原样保存，设置 `phase: judging`，再读取 `<Path>{roots.workflows}/person/S-steelman-deliberation/judge.md</Path>`。以冻结 dossier 和真实回答裁决，不重做迎合回答的新分析。
 
-```bash
-node <Path>{roots.workflows}/person/S-steelman-deliberation/tools/validate-steelman-change.mjs</Path> \
-  --phase completed \
-  --change-dir <Path>{roots.state}/person/changes/{change}</Path> \
-  --decision-file <Path>{roots.state}/person/changes/{change}/.steelman-stage/decision.md</Path> \
-  --status-file <Path>{roots.state}/person/changes/{change}/.steelman-stage/.status.json</Path>
-```
-
-校验通过后才原子替换正式 decision 和 change 状态，并只从 workflow `status.json.active` 删除匹配当前 `change` 且属于本 work 的条目。校验失败时删除临时目录、返回 `validation-failed`，保留可恢复的 `judging` 状态。
-
-**完成标准**：decision 给出明确判断、决定性理由、对最强反方的回应、具体行动、反转条件及置信度；状态与工件一致；校验退出码为 0。
-
-## 状态合同
-
-### Workflow 状态
-
-`<Path>{roots.state}/person/status.json</Path>` 保持 `schema_version: 1`，本 work 只管理 `active` 数组中的如下条目：
-
-```json
-{
-  "change": "2026-08-18-steelman-company-anniversary",
-  "work_id": "person/steelman-deliberation",
-  "phase": "awaiting-answer",
-  "updated_at": "2026-08-18T00:00:00.000Z"
-}
-```
-
-读取—合并—写入时保留未知顶层字段、未知 entry 字段和其他 work 的全部条目。写临时文件、重读 JSON、再原子替换。
-
-### Change 状态
-
-`<Path>{roots.state}/person/changes/{change}/.status.json</Path>` 至少包含：
-
-```json
-{
-  "schema_version": 1,
-  "artifact": "person-work-status",
-  "workflow": "person",
-  "change": "2026-08-18-steelman-company-anniversary",
-  "work_id": "person/steelman-deliberation",
-  "status": "active",
-  "phase": "awaiting-answer",
-  "key_question": "[唯一关键问题]",
-  "key_question_asked": true,
-  "question_disposition": "asked",
-  "answer_received": false,
-  "user_answer": null,
-  "created_at": "2026-08-18T00:00:00.000Z",
-  "updated_at": "2026-08-18T00:00:00.000Z",
-  "completed_at": null,
-  "blockers": []
-}
-```
-
-允许转换：
-
-```text
-intake → deliberating → awaiting-answer → judging → completed
-任一活动阶段 → blocked
-awaiting-answer → reframe-required
-```
-
-`question_disposition` 只能是 `asked | already-answered`；前者要求 `key_question_asked: true`，后者要求 `key_question_asked: false`。工件先验证，change 状态后更新，workflow active 最后更新。状态只是工件的索引，不替代工件本身。
+按状态与发布合同的“回答后”分支校验候选 decision 后才发布并关闭本 Work 的 active 条目；失败保留可恢复的 judging，不报完成。decision 必须包含明确判断、决定性理由、最强反方回应、具体行动、反转条件与置信度，且能追溯到关键变量和回答。
 
 ## 返回合同
 
@@ -213,13 +111,3 @@ awaiting-answer → reframe-required
 - 下一路由：等待回答时返回 `<Path>{roots.workflows}/person/S-steelman-deliberation/S-steelman-deliberation.md</Path>` 并携带同一 change；问题已重构时创建新 change；否则明确完成。
 
 只有 `completed` 才能声明已经形成最终判断。`awaiting-user-answer` 的下一路由始终是带着同一 change 回到本入口。
-
-## 全局完成标准
-
-- 用户真正要解决的问题与表层问法已区分；
-- 当前倾向和最强反方都经过可信、可识别的钢人化；
-- 没有编造证据、虚假平衡或因用户立场降低证据标准；
-- 只关闭了一个最高价值的不确定性，且没有重复追问已知信息；
-- 回答前 dossier 保持冻结，回答后 decision 可追溯到关键变量和用户回答；
-- 最终答案不是任何人都能套用的通用建议，而是明确判断与可验证行动；
-- owned 工件、change 状态与 workflow active 一致，验证证据已返回。