@peterxiaoyang/superspec 0.1.11 → 0.1.12

package/dist/src/cli_args.js

@@ -48,6 +48,13 @@ function isPacketCommand(command) {
         || command === "apply-verify-packet"
         || command === "ledger-render";
 }
+function isHookEventCommand(command) {
+    return command === "hook-check-write"
+        || command === "hook-check-command"
+        || command === "hook-record-test"
+        || command === "hook-record-subagent-start"
+        || command === "hook-record-subagent-stop";
+}
 function requiredValueFlags(command) {
     const flags = ["--change"];
     if (command === "check-artifact")
@@ -67,11 +74,10 @@ function requiredValueFlags(command) {
     if (command === "apply-code-review-packet")
         flags.push("--task-id", "--executor-report-ref");
     if (command === "apply-verify-packet")
-        flags.push("--task-id", "--executor-report-ref", "--task-code-review-report-ref", "--green-test-run-evidence-ref");
+        flags.push("--task-id", "--executor-report-ref", "--task-code-review-report-ref");
     if (command === "ledger-render")
         flags.push("--gate");
-    if (command === "hook-check-write" || command === "hook-check-command" || command === "hook-record-test"
-        || command === "hook-record-subagent-start" || command === "hook-record-subagent-stop")
+    if (isHookEventCommand(command))
         flags.push("--event-ref");
     if (command === "hook-session-begin")
         flags.push("--workflow", "--entrypoint-token");
@@ -97,7 +103,7 @@ function optionalValueFlags(command) {
     if (command === "apply-executor-packet")
         return ["--apply-worker-chain-ref"];
     if (command === "apply-verify-packet")
-        return ["--red-test-run-evidence-ref", "--characterization-test-run-evidence-ref"];
+        return ["--green-test-run-evidence-ref", "--alternative-verification-evidence-ref", "--red-test-run-evidence-ref", "--characterization-test-run-evidence-ref"];
     if (command === "ledger-render")
         return ["--round"];
     if (command === "hook-session-end")
@@ -126,7 +132,7 @@ function requiresFormat(command) {
         || command === "apply-verify-packet";
 }
 function rootUsage() {
-    return `usage: superspec_guard [-h]\n                     {${COMMAND_LIST}}\n                     ...\n`;
+    return `usage: superspec [-h]\n                     {${COMMAND_LIST}}\n                     ...\n`;
 }
 function rootHelp() {
     const commandLines = COMMANDS.map((command) => {
@@ -144,7 +150,7 @@ function commandUsage(command) {
         ...requiredBooleanFlags(command),
         ...optionalBooleanFlags(command),
     ];
-    return `usage: superspec_guard ${command} ${usageFlags.join(" ")}\n`;
+    return `usage: superspec ${command} ${usageFlags.join(" ")}\n`;
 }
 function commandHelp(command) {
     const zh = command_zh(command);
@@ -179,7 +185,7 @@ function missingRequiredFlags(command, args) {
 }
 export function emitArgparsePreamble(argv) {
     if (argv.length === 0) {
-        process.stderr.write(`${rootUsage()}superspec_guard：错误：缺少必填参数：command\n`);
+        process.stderr.write(`${rootUsage()}superspec：错误：缺少必填参数：command\n`);
         return 2;
     }
     const command = argv[0];
@@ -188,7 +194,7 @@ export function emitArgparsePreamble(argv) {
         return 0;
     }
     if (!COMMANDS.includes(command)) {
-        process.stderr.write(`${rootUsage()}superspec_guard：错误：命令无效：'${command}'；可选值：${COMMAND_CHOICES}\n`);
+        process.stderr.write(`${rootUsage()}superspec：错误：命令无效：'${command}'；可选值：${COMMAND_CHOICES}\n`);
         return 2;
     }
     const args = argv.slice(1);
@@ -199,7 +205,11 @@ export function emitArgparsePreamble(argv) {
     if (!isPacketCommand(command)) {
         const missing = missingRequiredFlags(command, args);
         if (missing.length > 0) {
-            process.stderr.write(`${commandUsage(command)}superspec_guard ${command}：错误：缺少必填参数：${missing.join(", ")}\n`);
+            if (isHookEventCommand(command) && missing.length === 1 && missing[0] === "--event-ref") {
+                process.stderr.write(`${commandUsage(command)}superspec ${command}：错误：--event-ref must point to a readable hook event JSON file\n`);
+                return 2;
+            }
+            process.stderr.write(`${commandUsage(command)}superspec ${command}：错误：缺少必填参数：${missing.join(", ")}\n`);
             return 2;
         }
     }
@@ -357,6 +367,7 @@ export function parse_argv(argv) {
         const executorRefs = getValues("--executor-report-ref");
         const codeReviewRefs = getValues("--task-code-review-report-ref");
         const greenRefs = getValues("--green-test-run-evidence-ref");
+        const alternativeRefs = getValues("--alternative-verification-evidence-ref");
         const redRefs = getValues("--red-test-run-evidence-ref");
         const characterizationRefs = getValues("--characterization-test-run-evidence-ref");
         if (!taskId)
@@ -365,11 +376,18 @@ export function parse_argv(argv) {
             throw new GuardError("apply-verify-packet 缺少必填参数 --executor-report-ref");
         if (codeReviewRefs.length === 0)
             throw new GuardError("apply-verify-packet 缺少必填参数 --task-code-review-report-ref");
-        if (greenRefs.length === 0)
-            throw new GuardError("apply-verify-packet 缺少必填参数 --green-test-run-evidence-ref");
-        if (redRefs.length === 0 && characterizationRefs.length === 0) {
+        if (greenRefs.length === 0 && alternativeRefs.length === 0) {
+            throw new GuardError("apply-verify-packet requires --green-test-run-evidence-ref or --alternative-verification-evidence-ref");
+        }
+        if (greenRefs.length > 0 && alternativeRefs.length > 0) {
+            throw new GuardError("apply-verify-packet requires either GREEN refs or alternative verification refs, not both");
+        }
+        if (greenRefs.length > 0 && redRefs.length === 0 && characterizationRefs.length === 0) {
             throw new GuardError("apply-verify-packet requires --red-test-run-evidence-ref or --characterization-test-run-evidence-ref");
         }
+        if (alternativeRefs.length > 0 && (redRefs.length > 0 || characterizationRefs.length > 0)) {
+            throw new GuardError("apply-verify-packet alternative verification branch must not include RED or characterization refs");
+        }
         return {
             command,
             change,
@@ -377,6 +395,7 @@ export function parse_argv(argv) {
             executor_report_refs: executorRefs,
             task_code_review_report_refs: codeReviewRefs,
             green_test_run_evidence_refs: greenRefs,
+            alternative_verification_evidence_refs: alternativeRefs,
             red_test_run_evidence_refs: redRefs,
             characterization_test_run_evidence_refs: characterizationRefs,
             packet_format: parsePacketOutputFormat(selectedPacketFormat, { allowPrompt: true }),
@@ -394,11 +413,10 @@ export function parse_argv(argv) {
             throw new GuardError("--round 必须是大于等于 1 的整数");
         return { command, change, gate, round };
     }
-    if (command === "hook-check-write" || command === "hook-check-command" || command === "hook-record-test"
-        || command === "hook-record-subagent-start" || command === "hook-record-subagent-stop") {
+    if (isHookEventCommand(command)) {
         const eventRef = getValue("--event-ref");
         if (!eventRef)
-            throw new Error("缺少必填参数 --event-ref");
+            throw new GuardError("--event-ref must point to a readable hook event JSON file");
         return { command, change, format, event_ref: eventRef };
     }
     if (command === "hook-session-begin") {

package/dist/src/disclosure.js

@@ -10,7 +10,7 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
 import { isObject, reason, renderList, repr, runtime, safe_within, toPosix, walkFiles } from "./util.js";
-import { normalize_gate } from "./openspec.js";
+import { effective_superseded_ids, normalize_gate } from "./openspec.js";
 // Explicit target map (design §7); later phases extend this table gate by gate.
 // Entries containing "*" are globs enumerated at check time; set equality (P1-6) means a spec
 // file added after the digest makes the digest stale even though every pinned blob still matches.
@@ -462,7 +462,7 @@ export function review_disclosure_reasons(gate, changeRoot, evidences) {
         return [reason("missing_review_digest", `${gate}: the disclosure loop is mandatory on this gate; need round-tagged role review evidence (review_round_id ${gate}-r1, findings[]) plus a main_review_digest`)];
     }
     const out = [];
-    const dead = new Set(valid.filter((ev) => ev.status === "superseded" && ev.supersedes).map((ev) => String(ev.supersedes)));
+    const dead = effective_superseded_ids(valid);
     const byId = new Map();
     for (const ev of valid) {
         if (typeof ev.evidence_id === "string" && ev.evidence_id)

package/dist/src/evidence.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
-import { CLAIM_ADJUDICATION_DECISIONS, EVIDENCE_KINDS, EVIDENCE_STATUSES, FINAL_VERIFICATION_ROLES, HUMAN_CONFIRMATION_GATES, FINAL_TEST_REQUIRED_FIELDS, FINDING_ADJUDICATION_DECISIONS, FORBIDDEN_FIELDS, MAIN_ADJUDICATION_DECISIONS, MAIN_ADJUDICATION_REQUIRED_FIELDS, REQUEST_CHANGES_ROUTES, ROLE_EVIDENCE_FIELDS, REVIEW_GUIDANCE_ROLES, SELF_REVIEW_MARKERS, SOURCE_GUIDANCE_REQUIRED_FIELDS, TASK_REOPEN_INVALIDITY_CLASSES, TASK_REOPEN_REQUIRED_FIELDS, TASK_REOPEN_RESOLVED_REQUIRED_FIELDS, VERIFY_EVIDENCE_REQUIRED_FIELDS, fingerprint_obj, isObject, reason, renderList, repr, pinned_ref_key, runtime, safe_within, sha256_file, toPosix, walkFiles, } from "./util.js";
-import { normalize_gate } from "./openspec.js";
+import { CLAIM_ADJUDICATION_DECISIONS, EVIDENCE_KINDS, EVIDENCE_STATUSES, FINAL_VERIFICATION_ROLES, HUMAN_CONFIRMATION_GATES, FINAL_TEST_REQUIRED_FIELDS, FINDING_ADJUDICATION_DECISIONS, FORBIDDEN_FIELDS, MAIN_ADJUDICATION_DECISIONS, MAIN_ADJUDICATION_REQUIRED_FIELDS, NO_TDD_REASONS, REQUEST_CHANGES_ROUTES, ROLE_EVIDENCE_FIELDS, REVIEW_GUIDANCE_ROLES, SELF_REVIEW_MARKERS, SOURCE_GUIDANCE_REQUIRED_FIELDS, TASK_REOPEN_INVALIDITY_CLASSES, TASK_REOPEN_REQUIRED_FIELDS, TASK_REOPEN_RESOLVED_REQUIRED_FIELDS, VERIFY_EVIDENCE_REQUIRED_FIELDS, confirmation_text_has_pending_wording, fingerprint_obj, isObject, reason, renderList, repr, pinned_ref_key, runtime, safe_within, sha256_file, toPosix, UNCHECKED_CHECKBOX_RE, walkFiles, } from "./util.js";
+import { effective_superseded_ids, normalize_gate } from "./openspec.js";
 import { superspec_dir } from "./paths.js";
 import { findings_schema_reasons, review_digest_schema_reasons, standing_authorization_schema_reasons, user_decision_schema_reasons, } from "./disclosure.js";
 import { pinned_artifact_ref_reasons as shared_pinned_artifact_ref_reasons, worker_test_run_reasons, } from "./apply_worker_chain.js";
@@ -143,6 +143,24 @@ function string_list_field_reasons(ev, field, code, opts = {}) {
     }
     return [];
 }
+const APPLY_WORKER_CHAIN_SURFACES = new Set(["implementation", "runtime_config"]);
+function apply_worker_chain_ref_ids(ev, singleField, listField) {
+    const refs = new Set();
+    const single = ev[singleField];
+    if (isObject(single) && typeof single.evidence_id === "string" && single.evidence_id)
+        refs.add(single.evidence_id);
+    else if (typeof single === "string" && single)
+        refs.add(single);
+    if (Array.isArray(ev[listField])) {
+        for (const item of ev[listField]) {
+            if (isObject(item) && typeof item.evidence_id === "string" && item.evidence_id)
+                refs.add(item.evidence_id);
+            else if (typeof item === "string" && item)
+                refs.add(item);
+        }
+    }
+    return [...refs].sort();
+}
 function fingerprint_field_reasons(ev, field, code) {
     const raw = ev[field];
     if (typeof raw === "string") {
@@ -161,7 +179,37 @@ function pinned_artifact_ref_item_reasons(refItem, field, changeRoot, expected =
     });
 }
 export function role_target_ref_reasons(ev, targetRoot) {
-    return pinned_ref_reasons(ev, "target_refs", targetRoot, "stale_review");
+    const problems = [];
+    const raw = ev.target_refs;
+    if (!Array.isArray(raw)) {
+        problems.push(reason("target_ref_invalid", `${ev._path}: target_refs must be a list of {path, blob_sha}`));
+        return problems;
+    }
+    for (const refItem of raw) {
+        if (!isObject(refItem)) {
+            problems.push(reason("target_ref_invalid", `${ev._path}: target_refs item must be object`));
+            continue;
+        }
+        const rel = refItem.path;
+        const expected = refItem.blob_sha;
+        if (typeof rel !== "string" || !rel || typeof expected !== "string" || !expected) {
+            problems.push(reason("target_ref_invalid", `${ev._path}: target_refs requires path and blob_sha`));
+            continue;
+        }
+        const target = safe_within(targetRoot, rel);
+        if (target === null) {
+            problems.push(reason("evidence_unsafe_ref", `${ev._path}: target_refs escapes allowed root: ${rel}`));
+            continue;
+        }
+        if (!existsSync(target) || !statSync(target).isFile()) {
+            problems.push(reason("stale_review", `${ev._path}: target_refs is not readable: ${rel}`));
+            continue;
+        }
+        const actual = runtime.file_blob_sha(target);
+        if (actual !== expected)
+            problems.push(reason("stale_review", `${ev._path}: target_refs stale for ${rel}`));
+    }
+    return problems;
 }
 export function loaded_ref_reasons(ev, repoRoot) {
     return pinned_ref_reasons(ev, "loaded_refs", repoRoot, "stale_loaded_ref");
@@ -358,6 +406,16 @@ function human_confirmation_reasons(ev) {
         && (typeof ev.tasks_structure_hash !== "string" || !ev.tasks_structure_hash.trim())) {
         problems.push(reason("human_confirmation_invalid", `${ev._path}: ${gate} human_confirmation requires tasks_structure_hash pinning the approved tasks.md structure`));
     }
+    // B3: a pass confirmation must not carry unresolved signals. Strong signal: an unchecked checkbox
+    // "[ ]" pasted into confirmation_text (the agent copied an open question list into the confirmation).
+    // Weak signal: confirmation-pending wording shared with the explore gate (仍需确认 / 待确认 / ...),
+    // scoped to confirmation semantics so legitimate "细节仍需在 propose 细化" prose is not flagged.
+    // Real incident: secondment-hour-unit-support sealed status:"pass" while its confirmation_text said
+    // "还需要评估..." — the gate's presence-check then let propose through with 8 open questions.
+    const ctext = typeof ev.confirmation_text === "string" ? ev.confirmation_text : "";
+    if (UNCHECKED_CHECKBOX_RE.test(ctext) || confirmation_text_has_pending_wording(ctext)) {
+        problems.push(reason("human_confirmation_invalid", `${ev._path}: confirmation_text carries unresolved signals (unchecked checkbox or 「仍需确认/待确认」wording); do not record pass while open items remain`));
+    }
     return problems;
 }
 // FIX-10 (audit C-5/H-4): test_run evidence is archived per run, not as a bare self-report.
@@ -455,7 +513,28 @@ function apply_worker_chain_reasons(ev, changeRoot) {
         problems.push(...fingerprint_field_reasons(ev, "executor_packet_fingerprint", "apply_worker_chain_invalid"));
         problems.push(...fingerprint_field_reasons(ev, "source_implementation_fingerprint", "apply_worker_chain_invalid"));
         problems.push(...string_list_field_reasons(ev, "declared_task_write_scope", "apply_worker_chain_invalid"));
-        problems.push(...string_list_field_reasons(ev, "pre_edit_evidence_refs", "apply_worker_chain_invalid"));
+        const proofKind = String(ev.pre_edit_proof_kind ?? "red_or_characterization");
+        if (proofKind !== "red_or_characterization" && proofKind !== "no_tdd_declared") {
+            problems.push(reason("apply_worker_chain_invalid", `${ev._path}: active apply_worker_chain pre_edit_proof_kind must be red_or_characterization or no_tdd_declared`));
+        }
+        else if (proofKind === "no_tdd_declared") {
+            problems.push(...string_list_field_reasons(ev, "pre_edit_evidence_refs", "apply_worker_chain_invalid", { allowEmpty: true }));
+            if (Array.isArray(ev.pre_edit_evidence_refs) && ev.pre_edit_evidence_refs.length > 0) {
+                problems.push(reason("apply_worker_chain_invalid", `${ev._path}: no_tdd_declared active apply_worker_chain requires empty pre_edit_evidence_refs`));
+            }
+            if (ev.tdd_required !== false) {
+                problems.push(reason("apply_worker_chain_invalid", `${ev._path}: no_tdd_declared active apply_worker_chain requires tdd_required=false`));
+            }
+            if (!APPLY_WORKER_CHAIN_SURFACES.has(String(ev.apply_execution_surface ?? ""))) {
+                problems.push(reason("apply_worker_chain_invalid", `${ev._path}: no_tdd_declared active apply_worker_chain requires apply_execution_surface implementation or runtime_config`));
+            }
+            if (!NO_TDD_REASONS.has(String(ev.no_tdd_reason ?? ""))) {
+                problems.push(reason("apply_worker_chain_invalid", `${ev._path}: no_tdd_declared active apply_worker_chain requires valid no_tdd_reason`));
+            }
+        }
+        else {
+            problems.push(...string_list_field_reasons(ev, "pre_edit_evidence_refs", "apply_worker_chain_invalid"));
+        }
     }
     if (state === "closed") {
         const taskId = typeof ev.task_id === "string" ? ev.task_id : undefined;
@@ -468,8 +547,17 @@ function apply_worker_chain_reasons(ev, changeRoot) {
         problems.push(...refProblems);
         if (refProblems.length > 0)
             problems.push(reason("apply_worker_chain_invalid", `${ev._path}: closed apply_worker_chain report refs must be pinned same-chain worker reports`));
-        if (!isObject(ev.green_test_run_evidence_ref) && typeof ev.green_test_run_evidence_ref !== "string") {
-            problems.push(reason("apply_worker_chain_invalid", `${ev._path}: closed apply_worker_chain requires green_test_run_evidence_ref`));
+        const proofKind = String(ev.completion_proof_kind ?? "green_tests");
+        if (proofKind !== "green_tests" && proofKind !== "alternative_verification") {
+            problems.push(reason("apply_worker_chain_invalid", `${ev._path}: closed apply_worker_chain completion_proof_kind must be green_tests or alternative_verification`));
+        }
+        else if (proofKind === "green_tests") {
+            if (apply_worker_chain_ref_ids(ev, "green_test_run_evidence_ref", "green_test_run_evidence_refs").length === 0) {
+                problems.push(reason("apply_worker_chain_invalid", `${ev._path}: green_tests closed apply_worker_chain requires green_test_run_evidence_ref(s)`));
+            }
+        }
+        else if (apply_worker_chain_ref_ids(ev, "alternative_verification_evidence_ref", "alternative_verification_evidence_refs").length === 0) {
+            problems.push(reason("apply_worker_chain_invalid", `${ev._path}: alternative_verification closed apply_worker_chain requires alternative_verification_evidence_ref(s)`));
         }
         problems.push(...fingerprint_field_reasons(ev, "observed_freshness_fingerprint", "apply_worker_chain_invalid"));
     }
@@ -479,6 +567,9 @@ function apply_worker_chain_reasons(ev, changeRoot) {
         if ("restored_implementation_fingerprint" in ev) {
             problems.push(...fingerprint_field_reasons(ev, "restored_implementation_fingerprint", "apply_worker_chain_invalid"));
         }
+        if ("restored_implementation_fingerprint" in ev && "serial_takeover_baseline_ref" in ev) {
+            problems.push(reason("apply_worker_chain_invalid", `${ev._path}: abandoned apply_worker_chain restored_implementation_fingerprint and serial_takeover_baseline_ref are mutually exclusive`));
+        }
         if (!("restored_implementation_fingerprint" in ev) && !("serial_takeover_baseline_ref" in ev)) {
             problems.push(reason("apply_worker_chain_invalid", `${ev._path}: abandoned apply_worker_chain requires restored_implementation_fingerprint or serial_takeover_baseline_ref`));
         }
@@ -487,7 +578,12 @@ function apply_worker_chain_reasons(ev, changeRoot) {
             problems.push(...baselineProblems);
             if (baselineProblems.length > 0)
                 problems.push(reason("apply_worker_chain_invalid", `${ev._path}: abandoned apply_worker_chain serial_takeover_baseline_ref must be a pinned same-chain status_report`));
-            problems.push(...string_list_field_reasons(ev, "successor_green_evidence_refs", "apply_worker_chain_invalid"));
+            if (typeof ev.takeover_confirmation_evidence_id !== "string" || !ev.takeover_confirmation_evidence_id) {
+                problems.push(reason("apply_worker_chain_invalid", `${ev._path}: abandoned apply_worker_chain serial takeover requires takeover_confirmation_evidence_id`));
+            }
+            if ("successor_green_evidence_refs" in ev) {
+                problems.push(...string_list_field_reasons(ev, "successor_green_evidence_refs", "apply_worker_chain_invalid"));
+            }
         }
     }
     return problems;
@@ -915,7 +1011,7 @@ export function find_pass(evidences, filters = {}) {
     });
 }
 export function superseded_ids(evidences) {
-    return new Set(evidences.filter((ev) => ev.status === "superseded" && ev.supersedes).map((ev) => ev.supersedes));
+    return effective_superseded_ids(evidences);
 }
 // FIX-6 (audit C-2): supersede is a rollback mechanism, so it needs an authorization model.
 // A supersede evidence must point at an existing evidence_id, and a cross-gate supersede

package/dist/src/gates.d.ts

@@ -5,6 +5,7 @@ export declare function superspec_agent_reasons(repoRoot: string): Reason[];
 export declare function openspec_cli_capability_reasons(): Reason[];
 export declare function evidence_schema_guard(change: string, changeRoot: string, repoRoot: string, evidences: JsonMap[]): Reason[];
 export declare function check_init(change: string, status: JsonMap, repoRoot: string, changeRoot: string): Decision;
+export declare function discovery_open_question_count(discoveryPath: string): number;
 export declare function check_superspec_gate(change: string, status: JsonMap, changeRoot: string, evidences: JsonMap[], gateRaw: string): Decision;
 export declare function check_artifact(change: string, status: JsonMap, changeRoot: string, evidences: JsonMap[], artifact: string): Decision;
 export declare function check_task_reopen(change: string, status: JsonMap, changeRoot: string, evidences: JsonMap[], taskId: string): Decision;

package/dist/src/gates.js

@@ -1,16 +1,16 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
-import { ARTIFACT_ENTER_GATE, MAIN_ADJUDICATION_DECISIONS, REQUEST_CHANGES_ROUTES, NO_TDD_REASONS, OPENSPEC_ARTIFACTS, FINAL_VERIFICATION_ROLES, REQUIRED_SUPERSPEC_AGENT_ROLES, REQUIRED_SUPERSPEC_WORKFLOW_SKILLS, REVIEW_GUIDANCE_ROLES, REVIEW_EVIDENCE_REQUIRED_FIELDS, TDD_MODES, VERIFY_EVIDENCE_REQUIRED_FIELDS, allow, block, isObject, reason, renderList, repr, pinned_ref_key, safe_within, sha256_text, runtime, toPosix, } from "./util.js";
-import { all_done, artifact_status_map, get_repo_root, is_done, normalize_gate, openspec_cli_probe } from "./openspec.js";
+import { ARTIFACT_ENTER_GATE, MAIN_ADJUDICATION_DECISIONS, REQUEST_CHANGES_ROUTES, NO_TDD_REASONS, OPENSPEC_ARTIFACTS, FINAL_VERIFICATION_ROLES, REQUIRED_SUPERSPEC_AGENT_ROLES, REQUIRED_SUPERSPEC_WORKFLOW_SKILLS, REVIEW_GUIDANCE_ROLES, REVIEW_EVIDENCE_REQUIRED_FIELDS, TDD_MODES, VERIFY_EVIDENCE_REQUIRED_FIELDS, allow, block, isObject, reason, renderList, repr, pinned_ref_key, safe_within, sha256_text, runtime, toPosix, PENDING_CONFIRMATION_RE, UNCHECKED_CHECKBOX_RE, CHECKED_CHECKBOX_RE, } from "./util.js";
+import { all_done, artifact_status_map, effective_superseded_ids, get_repo_root, is_done, normalize_gate, openspec_cli_probe } from "./openspec.js";
 import { read_agent_toml_name, read_skill_frontmatter_name, sidecar_business_invariants_path, sidecar_discovery_path, sidecar_test_contract_path } from "./paths.js";
 import { hookInitReasons } from "./hooks/health.js";
 import { business_invariant_ids, business_invariant_validation_reasons, automated_hard_business_invariant_ids, evidence_invariant_refs, evidence_invariant_ref_reasons, evidence_test_contract_invariant_reasons, human_confirmation_business_invariant_ids, invariant_matrix_coverage_reasons, post_implementation_business_invariant_ids, red_green_invariant_ids, test_contract_invariant_ids, } from "./invariants.js";
-import { evidence_test_id_reasons, declared_test_evidence_reasons, parse_spec_scenarios, parse_tasks, parse_test_contract_ids, parse_test_contract_records, red_green_test_ids, splitList, tasks_structure_hash, task_alternative_verification, task_test_evidence, task_test_refs, test_contract_covers_scenario, test_contract_invariant_refs_by_test, write_scope_conflict_reasons, } from "./tasks.js";
+import { evidence_test_id_reasons, declared_test_evidence_reasons, parse_spec_scenarios, parse_tasks, parse_test_contract_ids, parse_test_contract_records, red_green_test_ids, splitList, task_apply_execution_surface, task_apply_execution_surface_reasons, tasks_structure_hash, task_alternative_verification, task_test_evidence, task_test_refs, test_contract_covers_scenario, test_contract_invariant_refs_by_test, write_scope_conflict_reasons, } from "./tasks.js";
 import { duplicate_evidence_id_reasons, dangling_evidence_ref_reasons, final_verification_evidences, live_task_reopens, live_task_reopen_resolutions, live_pass, live_user_confirmations, pass_task_reopens, supersede_reasons, unresolved_live_task_reopens, validate_evidence_schema, verify_reference_reasons, } from "./evidence.js";
 import { review_disclosure_reasons } from "./disclosure.js";
 import { archive_manifest_path } from "./archive.js";
-import { fingerprint_matches, } from "./apply_worker_chain.js";
-import { apply_worker_chain_lifecycle_reasons as shared_apply_worker_chain_lifecycle_reasons, apply_worker_chain_lifecycle_state, serial_completion_green, } from "./apply_worker_chain_lifecycle.js";
+import { pre_edit_worker_test_run_reasons, } from "./apply_worker_chain.js";
+import { apply_worker_chain_lifecycle_reasons as shared_apply_worker_chain_lifecycle_reasons, apply_worker_chain_lifecycle_state, } from "./apply_worker_chain_lifecycle.js";
 function action_list(...items) {
     return [...new Set(items.filter((item) => typeof item === "string" && item.length > 0))];
 }
@@ -398,8 +398,15 @@ export function openspec_cli_capability_reasons() {
     return [reason("openspec_native_surface_missing", probe.message)];
 }
 export function evidence_schema_guard(change, changeRoot, repoRoot, evidences) {
+    const effectiveDead = effective_superseded_ids(evidences);
     return [
-        ...evidences.flatMap((ev) => validate_evidence_schema(ev, change, changeRoot, repoRoot)),
+        ...evidences.flatMap((ev) => {
+            const problems = validate_evidence_schema(ev, change, changeRoot, repoRoot);
+            const id = typeof ev.evidence_id === "string" ? ev.evidence_id : "";
+            if (!id || !effectiveDead.has(id) || !ev.agent_role)
+                return problems;
+            return problems.filter((item) => item.code !== "stale_review");
+        }),
         ...duplicate_evidence_id_reasons(evidences),
         ...dangling_evidence_ref_reasons(evidences),
         ...supersede_reasons(evidences),
@@ -450,6 +457,54 @@ function stale_artifact_review_reasons(reviews, changeRoot, artifactRel, code, g
     }
     return reasons;
 }
+// B1: count unresolved open questions inside discovery.md's "待确认问题" section before explore_complete
+// can pass. The section is located by a heading whose text carries confirmation semantics
+// (待确认 / 需要用户确认 / open question / pending confirmation), tolerating inserted words such as
+// 「用户」between 需要 and 确认 (the real secondment-hour-unit-support incident title was
+// 「## 需要用户确认的问题」, which a naive contiguous 「需要确认」 substring would miss).
+//
+// Within a matched section, a list item ("- " / "* " / "+ " / "1. ") counts as open if it carries an
+// unchecked checkbox ("[ ]", literal half-width space — full-width U+3000 is not treated as a box,
+// matching GitHub task-list semantics) OR pending-confirmation wording (PENDING_CONFIRMATION_RE,
+// shared with the B3 confirmation guard). An item is closed (not counted) if it begins with 「已确认」
+// after its list marker or carries a checked box "[x]". Plain prose bullets with neither signal are
+// ignored. When the section is absent the count is 0 (grandfathered: legacy changes with no such
+// section are not retroactively blocked, matching this repo's treatment of legacy evidence).
+const OPEN_QUESTION_SECTION_RE = /(待|需要|需)[^\n]{0,6}确认|待澄清|开放问题|open question|pending confirmation/iu;
+const OPEN_QUESTION_LIST_ITEM_RE = /^\s*(?:[-*+]|\d+\.)\s+(.*)$/u;
+function classify_open_question_line(line) {
+    const m = line.match(OPEN_QUESTION_LIST_ITEM_RE);
+    if (!m)
+        return "none";
+    const body = m[1].trimStart();
+    if (CHECKED_CHECKBOX_RE.test(line))
+        return "closed";
+    if (UNCHECKED_CHECKBOX_RE.test(line))
+        return "open";
+    if (/^已确认/u.test(body))
+        return "closed";
+    if (PENDING_CONFIRMATION_RE.test(line))
+        return "open";
+    return "none";
+}
+export function discovery_open_question_count(discoveryPath) {
+    if (!existsSync(discoveryPath) || !statSync(discoveryPath).isFile())
+        return 0;
+    const text = readFileSync(discoveryPath, "utf8");
+    if (!text.trim())
+        return 0;
+    let inSection = false;
+    let count = 0;
+    for (const line of text.split(/\r?\n/u)) {
+        if (/^#{1,6}\s/u.test(line)) {
+            inSection = OPEN_QUESTION_SECTION_RE.test(line);
+            continue;
+        }
+        if (inSection && classify_open_question_line(line) === "open")
+            count += 1;
+    }
+    return count;
+}
 export function check_superspec_gate(change, status, changeRoot, evidences, gateRaw) {
     const gate = normalize_gate(gateRaw);
     const amap = artifact_status_map(status);
@@ -470,6 +525,13 @@ export function check_superspec_gate(change, status, changeRoot, evidences, gate
         // DISC Phase 1: material findings raised by explore reviews must be disclosed to the user
         // (main_review_digest + user_review_decision) before the gate can pass.
         reasons.push(...review_disclosure_reasons("explore_complete", changeRoot, evidences));
+        // B1: discovery.md must not still carry unresolved open questions. Without this the gate is a
+        // presence-check on human_confirmation and will pass even when discovery lists 「仍需确认」items
+        // (real incident: secondment-hour-unit-support entered propose with 8 open questions).
+        const openQuestionCount = discovery_open_question_count(discovery);
+        if (openQuestionCount > 0) {
+            reasons.push(reason("explore_open_questions_unresolved", `${discovery}: discovery.md 待确认问题段仍有 ${openQuestionCount} 条未勾选/「仍需确认」项，逐条与用户确认并改为已确认后才能进入 propose`));
+        }
     }
     else if (gate === "proposal_reviewed") {
         // DISC Phase 2: proposal review is an internal gate, not an advisory note. It is born inside
@@ -626,6 +688,9 @@ export function check_superspec_gate(change, status, changeRoot, evidences, gate
         if (Object.keys(tasks).length === 0)
             reasons.push(reason("invalid_task_graph", "tasks.md has no structured tasks"));
         reasons.push(...write_scope_conflict_reasons(tasks));
+        for (const [taskId, task] of Object.entries(tasks)) {
+            reasons.push(...task_apply_execution_surface_reasons(taskId, task));
+        }
         // DISC Phase 3: tasks_complete enters the disclosure loop only once round-tagged review
         // evidence appears (design: no mandatory role review on this gate until then).
         reasons.push(...review_disclosure_reasons("tasks_complete", changeRoot, evidences));
@@ -702,6 +767,19 @@ function task_reopen_history(evidences, taskId) {
 function task_reopen_match_key(ev) {
     return `${String(ev.evidence_id ?? "")}\u0000${String(ev.reopen_id ?? "")}\u0000${String(ev.task_id ?? "")}`;
 }
+function worker_pre_edit_test_evidence(changeRoot, evidences, taskId, semanticStatus) {
+    const candidates = task_test_evidence(evidences, taskId, semanticStatus, "task_edit");
+    const valid = [];
+    const invalidReasons = [];
+    for (const ev of candidates) {
+        const problems = pre_edit_worker_test_run_reasons(changeRoot, ev, taskId, "pre_edit_test_run_invalid");
+        if (problems.length === 0)
+            valid.push(ev);
+        else
+            invalidReasons.push(...problems);
+    }
+    return { valid, invalid_reasons: invalidReasons, candidate_count: candidates.length };
+}
 function matching_reopen_resolutions(evidences, reopen) {
     const key = task_reopen_match_key(reopen);
     return live_task_reopen_resolutions(evidences)
@@ -1118,18 +1196,24 @@ export function check_task_edit(change, status, changeRoot, evidences, taskId) {
             reasons.push(reason("invalid_no_tdd_reason", `task ${taskId}: no_tdd_reason=${repr(nr)}`));
     }
     else if (tddMode === "behavior-preserving-refactor") {
-        const characterization = task_test_evidence(evidences, taskId, "expected_success", "task_edit");
-        if (characterization.length === 0)
-            reasons.push(reason("missing_characterization", `task ${taskId} (behavior-preserving-refactor) needs GREEN characterization test first`));
+        const characterizationProof = worker_pre_edit_test_evidence(changeRoot, evidences, taskId, "expected_success");
+        const characterization = characterizationProof.valid;
+        if (characterization.length === 0) {
+            reasons.push(reason(characterizationProof.candidate_count === 0 ? "missing_characterization" : "missing_worker_characterization", `task ${taskId} (behavior-preserving-refactor) needs test-runner characterization evidence before edit`));
+            reasons.push(...characterizationProof.invalid_reasons);
+        }
         reasons.push(...evidence_test_id_reasons(characterization, taskId, declared, contractIds, "characterization"));
         reasons.push(...declared_test_evidence_reasons(characterization, taskId, declared, "characterization"));
         reasons.push(...evidence_invariant_ref_reasons(characterization, taskId, declaredInvariants, validInvariantIds, "characterization"));
         reasons.push(...evidence_test_contract_invariant_reasons(characterization, taskId, test_contract_invariant_refs_by_test(changeRoot), "characterization"));
     }
     else {
-        const red = task_test_evidence(evidences, taskId, "expected_failure", "task_edit");
-        if (red.length === 0)
-            reasons.push(reason("missing_red_evidence", `task ${taskId} requires RED evidence (expected_failure) before edit`));
+        const redProof = worker_pre_edit_test_evidence(changeRoot, evidences, taskId, "expected_failure");
+        const red = redProof.valid;
+        if (red.length === 0) {
+            reasons.push(reason(redProof.candidate_count === 0 ? "missing_red_evidence" : "missing_worker_red_evidence", `task ${taskId} requires test-runner RED evidence before edit`));
+            reasons.push(...redProof.invalid_reasons);
+        }
         reasons.push(...evidence_test_id_reasons(red, taskId, declared, contractIds, "RED"));
         reasons.push(...declared_test_evidence_reasons(red, taskId, declared, "RED"));
         reasons.push(...evidence_invariant_ref_reasons(red, taskId, declaredInvariants, validInvariantIds, "RED"));
@@ -1149,6 +1233,34 @@ export function check_task_edit(change, status, changeRoot, evidences, taskId) {
 export function apply_worker_chain_lifecycle_reasons(repoRoot, changeRoot, evidences, taskId) {
     return shared_apply_worker_chain_lifecycle_reasons(repoRoot, changeRoot, evidences, taskId);
 }
+function apply_worker_chain_ref_ids(ev, singular, plural) {
+    const ids = new Set();
+    if (Array.isArray(ev[plural])) {
+        for (const item of ev[plural]) {
+            if (isObject(item) && typeof item.evidence_id === "string" && item.evidence_id)
+                ids.add(item.evidence_id);
+            else if (typeof item === "string" && item)
+                ids.add(item);
+        }
+    }
+    const single = ev[singular];
+    if (isObject(single) && typeof single.evidence_id === "string" && single.evidence_id)
+        ids.add(single.evidence_id);
+    else if (typeof single === "string" && single)
+        ids.add(single);
+    return [...ids].sort();
+}
+function active_no_tdd_metadata_matches(active, executionSurface, noTddReason) {
+    const preIds = Array.isArray(active?.pre_edit_evidence_refs) ? active.pre_edit_evidence_refs.map(String).filter(Boolean) : [];
+    return isObject(active)
+        && active.pre_edit_proof_kind === "no_tdd_declared"
+        && preIds.length === 0
+        && active.tdd_required === false
+        && active.apply_execution_surface === executionSurface
+        && typeof noTddReason === "string"
+        && active.no_tdd_reason === noTddReason
+        && NO_TDD_REASONS.has(noTddReason);
+}
 export function check_task_complete(change, status, changeRoot, evidences, taskId) {
     const gate = "task_complete";
     const reasons = [];
@@ -1163,6 +1275,7 @@ export function check_task_complete(change, status, changeRoot, evidences, taskI
     const task = parse_tasks(changeRoot)[taskId];
     if (!task)
         return block(change, gate, [reason("unknown_task", `task ${taskId} not found`)], { task_id: taskId });
+    reasons.push(...task_apply_execution_surface_reasons(taskId, task));
     const workerChainState = apply_worker_chain_lifecycle_state(get_repo_root(status), changeRoot, evidences, taskId);
     reasons.push(...workerChainState.completionReasons);
     const reopenHistory = task_reopen_history(evidences, taskId);
@@ -1185,21 +1298,11 @@ export function check_task_complete(change, status, changeRoot, evidences, taskI
         reasons.push(reason("invalid_tdd_mode", `task ${taskId}: tdd_mode=${repr(tddMode)}`));
     if (tddRequired) {
         const allGreen = task_test_evidence(evidences, taskId, "expected_success", "task_complete");
-        const green = workerChainState.validClosedGreenEvidenceIds.size > 0
-            ? allGreen.filter((ev) => (ev.apply_execution_chain === "executor_worker"
-                && workerChainState.validClosedChainIds.has(String(ev.apply_worker_chain_id ?? ""))
-                && workerChainState.validClosedGreenEvidenceIds.has(String(ev.evidence_id ?? ""))))
-            : workerChainState.takeoverBaselines.length > 0
-                ? allGreen.filter((ev) => serial_completion_green(ev) && workerChainState.takeoverBaselines.some((baseline) => (baseline.successorGreenRefs.includes(String(ev.evidence_id ?? ""))
-                    && fingerprint_matches(ev.implementation_fingerprint, baseline.fingerprint))))
-                : allGreen.filter(serial_completion_green);
+        const green = allGreen.filter((ev) => (ev.apply_execution_chain === "executor_worker"
+            && workerChainState.validClosedChainIds.has(String(ev.apply_worker_chain_id ?? ""))
+            && workerChainState.validClosedGreenEvidenceIds.has(String(ev.evidence_id ?? ""))));
         if (green.length === 0)
             reasons.push(reason("missing_green_evidence", `task ${taskId} requires GREEN evidence (expected_success) before completion`));
-        if (workerChainState.validClosedGreenEvidenceIds.size === 0 && workerChainState.takeoverBaselines.length > 0) {
-            if (green.length === 0) {
-                reasons.push(reason("apply_worker_chain_takeover_green_mismatch", `task ${taskId} requires declared successor serial GREEN evidence after takeover baseline with matching implementation fingerprint`));
-            }
-        }
         const declared = new Set(splitList(attrs.test_refs ?? ""));
         const declaredInvariants = new Set(splitList(attrs.invariant_refs ?? ""));
         if (declared.size === 0)
@@ -1235,9 +1338,39 @@ export function check_task_complete(change, status, changeRoot, evidences, taskI
         const nr = attrs.no_tdd_reason;
         if (!NO_TDD_REASONS.has(nr))
             reasons.push(reason("invalid_no_tdd_reason", `task ${taskId}: no_tdd_reason=${repr(nr)}`));
-        const verifications = task_alternative_verification(evidences, taskId);
-        if (verifications.length === 0)
+        const executionSurface = task_apply_execution_surface(task);
+        const directAlternativeAllowed = executionSurface === "docs_generated" || executionSurface === "no_code";
+        const implementationAlternativeRequired = executionSurface === "implementation" || executionSurface === "runtime_config";
+        const allVerifications = task_alternative_verification(evidences, taskId);
+        let validAlternativeEvidenceIds = workerChainState.validClosedAlternativeEvidenceIds;
+        if (implementationAlternativeRequired) {
+            const activeByChain = new Map(live_pass(evidences, { gate: "task_complete", kind: "apply_worker_chain", task_id: taskId })
+                .filter((ev) => ev.chain_state === "active" && typeof ev.apply_worker_chain_id === "string")
+                .map((ev) => [String(ev.apply_worker_chain_id), ev]));
+            const closedAlternativeChains = live_pass(evidences, { gate: "task_complete", kind: "apply_worker_chain", task_id: taskId })
+                .filter((ev) => (ev.chain_state === "closed"
+                && String(ev.completion_proof_kind ?? "green_tests") === "alternative_verification"
+                && workerChainState.validClosedAlternativeChainIds.has(String(ev.apply_worker_chain_id ?? ""))));
+            const matchingClosedAlternativeChains = closedAlternativeChains.filter((ev) => (active_no_tdd_metadata_matches(activeByChain.get(String(ev.apply_worker_chain_id ?? "")), executionSurface, nr)));
+            const metadataMismatchChains = closedAlternativeChains
+                .filter((ev) => !matchingClosedAlternativeChains.includes(ev))
+                .map((ev) => String(ev.apply_worker_chain_id ?? ev.evidence_id ?? ""))
+                .filter(Boolean)
+                .sort();
+            if (metadataMismatchChains.length > 0) {
+                reasons.push(reason("apply_worker_chain_active_invalid", `task ${taskId} closed alternative apply_worker_chain active no-TDD metadata must match task metadata: ${renderList(metadataMismatchChains)}`, metadataMismatchChains));
+            }
+            validAlternativeEvidenceIds = new Set(matchingClosedAlternativeChains.flatMap((ev) => apply_worker_chain_ref_ids(ev, "alternative_verification_evidence_ref", "alternative_verification_evidence_refs")));
+        }
+        const verifications = directAlternativeAllowed
+            ? allVerifications
+            : allVerifications.filter((ev) => validAlternativeEvidenceIds.has(String(ev.evidence_id ?? "")));
+        if (implementationAlternativeRequired && verifications.length === 0) {
+            reasons.push(reason("missing_alternative_verification", `task ${taskId} apply_execution_surface=${executionSurface} requires closed apply_worker_chain alternative_verification proof before completion`));
+        }
+        else if (!implementationAlternativeRequired && verifications.length === 0) {
             reasons.push(reason("missing_alternative_verification", `task ${taskId} has tdd_required:false and needs alternative verification evidence`));
+        }
         if (reopenMode.mode === "reopened") {
             const reopen = reopenMode.reopen;
             const reopenId = String(reopen.reopen_id ?? "");