@peterxiaoyang/superspec 0.1.43 → 0.1.44

package/dist/format.d.ts

@@ -40,7 +40,6 @@ export interface ParsedExecutionRequirement {
 export interface TestContractEntry {
     test_id: string;
     scenario: string;
-    invariant: string;
 }
 export type TestContractParseResult = {
     ok: true;

package/dist/format.js

@@ -320,7 +320,6 @@ export function parseTestContractEntries(content) {
         if (!isMarkdownTableSeparator(lines[i + 1]))
             continue;
         sawMatchingHeader = true;
-        const invariantIdx = normalizedHeader.indexOf("invariant");
         for (let rowIndex = i + 2; rowIndex < lines.length; rowIndex++) {
             const row = splitMarkdownTableRow(lines[rowIndex]);
             if (row.length === 0)
@@ -335,7 +334,6 @@ export function parseTestContractEntries(content) {
             entries.push({
                 test_id: testId,
                 scenario: (row[scenarioIdx] ?? "").trim(),
-                invariant: invariantIdx >= 0 ? (row[invariantIdx] ?? "").trim() : "",
             });
         }
     }
@@ -450,21 +448,13 @@ export function validateUserDecision(d) {
         return { ok: false, message: "决策文件缺少答复内容（answer）" };
     return { ok: true, message: "" };
 }
-// ===== business-invariants.md =====
-//
-// 格式（propose skill 定义）：
-//   # Business Invariants
-//   - INV-001 用户密码必须加密存储
-//
-// 引擎行为：Phase 1-5 只校验文件存在性（轻量）。
-// 内部结构（INV-XXX 编号）是 agent 指引，引擎不逐行解析。
 // ===== test-contract.md =====
 //
 // 格式（propose skill 定义）：
 //   # Test Contract
-//   | test_id | invariant | scenario |
-//   |---|---|---|
-//   | TEST-001 | INV-001 | 注册时密码被加密 |
+//   | test_id | scenario |
+//   |---|---|
+//   | TEST-001 | 注册时密码被加密 |
 //
 // 引擎行为：Phase 1-5 只校验文件存在性（轻量）。
 // 表格结构是 agent 指引，引擎不逐行解析。

package/dist/git_state.js

@@ -3,7 +3,7 @@ import { existsSync, lstatSync, readdirSync, readlinkSync, statSync } from "node
 import { extname, join } from "node:path";
 import { sha256File, sha256Text } from "./store.js";
 const PROCESS_DOC_RE = /^(?:openspec\/changes\/[^/]+\/)?(?:proposal|design|tasks)\.md$/;
-const PROCESS_ARTIFACT_RE = /^(?:openspec\/changes\/[^/]+\/)?\.superspec\/artifacts\/(?:discovery|business-invariants|test-contract)\.md$/;
+const PROCESS_ARTIFACT_RE = /^(?:openspec\/changes\/[^/]+\/)?\.superspec\/artifacts\/(?:discovery|test-contract)\.md$/;
 const CODE_EXTENSIONS = new Set([
     ".c", ".cc", ".cpp", ".cs", ".css", ".go", ".h", ".hpp", ".html", ".java", ".js", ".jsx",
     ".json", ".kt", ".mjs", ".mts", ".php", ".py", ".rb", ".rs", ".scss", ".sh", ".sql",

package/dist/phase_confirmation.js

@@ -1,5 +1,7 @@
 import { currentGitHead, dirtyCodeFiles } from "./git_state.js";
-import { reviewEvidenceDigest } from "./review.js";
+import { historicalProposeReadyRoles, reviewEvidenceDigest, reviewGateRoleResolution } from "./review.js";
+import { EXPLORE_DISCOVERY_REVIEW_GATE, PROPOSE_FINAL_REVIEW_GATE } from "./review_job_gates.js";
+import { changeRoot as openspecChangeRoot } from "./openspec.js";
 import { findLatestEvent, sha256Text } from "./store.js";
 export const PHASE_CONFIRMATION_SCOPE_PREFIX = "phase_confirmation:";
 function latestTransition(events, predicate) {
@@ -63,7 +65,12 @@ function boundaryForState(state) {
         default: return null;
     }
 }
-function materialDigest(projectRoot, events, snapshot) {
+function ordinaryReviewRolesForBoundary(events, boundary, gate, risk) {
+    return boundary === "propose_to_apply"
+        ? historicalProposeReadyRoles(events)
+        : gate.requiredRolesForRisk(risk);
+}
+function materialDigest(projectRoot, events, snapshot, boundary, risk) {
     const head = currentGitHead(projectRoot);
     const dirty = dirtyCodeFiles(projectRoot);
     const acceptedJobs = snapshot.accepted_jobs
@@ -77,10 +84,31 @@ function materialDigest(projectRoot, events, snapshot) {
         .sort((a, b) => a.job_id.localeCompare(b.job_id));
     const documents = Object.entries(snapshot.document_digests)
         .sort(([left], [right]) => left.localeCompare(right));
+    const ordinaryReviewGate = boundary === "explore_to_propose"
+        ? EXPLORE_DISCOVERY_REVIEW_GATE
+        : boundary === "propose_to_apply"
+            ? PROPOSE_FINAL_REVIEW_GATE
+            : null;
+    const currentChangeRoot = openspecChangeRoot(projectRoot, snapshot.change_id);
+    const overriddenReviewJobs = ordinaryReviewGate
+        ? ordinaryReviewRolesForBoundary(events, boundary, ordinaryReviewGate, risk)
+            .map(role => reviewGateRoleResolution(events, currentChangeRoot, ordinaryReviewGate, role))
+            .filter(resolution => resolution.kind === "overridden")
+            .map(resolution => ({
+            job_id: resolution.override.job_id,
+            role: resolution.override.role,
+            gate_id: resolution.override.gate_id,
+            packet_digest: resolution.override.packet_digest,
+            decision_event_id: resolution.override.decision_event_id,
+            decision_event_digest: resolution.override.decision_event_digest,
+        }))
+            .sort((left, right) => `${left.gate_id}\u0000${left.role}\u0000${left.job_id}`.localeCompare(`${right.gate_id}\u0000${right.role}\u0000${right.job_id}`))
+        : [];
     return sha256Text(JSON.stringify({
         documents,
         tasks_structure_digest: snapshot.tasks_structure_digest,
         accepted_jobs: acceptedJobs,
+        ...(overriddenReviewJobs.length > 0 ? { overridden_review_jobs: overriddenReviewJobs } : {}),
         review_evidence_digest: reviewEvidenceDigest(events),
         code_state: {
             head: head.head,
@@ -126,7 +154,7 @@ function buildActions(change, boundary, scope, question, specs, risk) {
         reason: spec.reason,
         ...(spec.reasonPrompt ? { reason_prompt: spec.reasonPrompt } : {}),
         record_argv: phaseRecordArgv(change),
-        record_input: { scope, question, answer: spec.label },
+        record_input: { scope, question, answer: spec.label, review_risk: risk },
         resume: spec.resume.kind === "next"
             ? { kind: "next", argv: nextArgv(change, risk) }
             : spec.resume.kind === "continue_current_phase"
@@ -147,7 +175,7 @@ export function phaseConfirmationForBoundary(projectRoot, events, snapshot, boun
         return null;
     const epoch = spec.epoch(events);
     const epochEventId = epoch?.event_id ?? `legacy-${spec.state}`;
-    const digest = materialDigest(projectRoot, events, snapshot);
+    const digest = materialDigest(projectRoot, events, snapshot, boundary, risk);
     const scope = `${spec.scopePrefix}:${epochEventId}:${digest}`;
     const actions = buildActions(snapshot.change_id, boundary, scope, spec.question, spec.actions, risk);
     return {

package/dist/phase_plan.d.ts

@@ -64,6 +64,7 @@ export type TransitionDecisionPlan = {
     kind: "blocked";
     jobs: Job[];
     reason: string;
+    details?: Record<string, unknown>;
 } | {
     kind: "create_gate_jobs";
     gate: ReviewGateRule;
@@ -86,7 +87,6 @@ export declare function proposalDocsBaseline(changeRoot: string): Record<string,
 export declare function latestAcceptedProposalBaseline(events: Event[]): Record<string, string> | null;
 export declare function latestReopenProposeBaseline(events: Event[]): Record<string, string> | null;
 export declare function proposalDocsChangedSinceBaseline(changeRoot: string, baseline: Record<string, string>): boolean;
-export declare function historicalProposeReadyRoles(events: Event[]): JobRole[];
 export declare function pendingTaskIds(changeRoot: string): string[];
 export declare function applyRequirementModeForCurrentRound(events: Event[]): boolean;
 export declare function pendingTaskStatusForApply(changeRoot: string, events: Event[]): ApplyPendingTaskStatus;

package/dist/phase_plan.js

@@ -4,7 +4,7 @@ import { EXPLORE_DISCOVERY_REVIEW_GATE, PROPOSE_FINAL_REVIEW_GATE } from "./revi
 import { collectProposeOpenQuestions, countDiscoveryOpenQuestions, parseTasksMd, pendingTasksInContent, validateDiscovery, validateExecutionRequirements, } from "./format.js";
 import { currentGitHead } from "./git_state.js";
 import { docRef, sha256File } from "./store.js";
-import { isReviewReadyVerifier, isFreshReviewVerifier, readReviewPolicyFromEvents, reviewEvidenceDigest, } from "./review.js";
+import { isReviewReadyVerifier, isFreshReviewVerifier, historicalProposeReadyRoles, readReviewPolicyFromEvents, reviewGateRoleResolution, reviewRejectionOverrideScope, reviewEvidenceDigest, } from "./review.js";
 import { CODE_REVIEW_DECISION_ANSWER_LABELS, CODE_REVIEW_REPAIR_SCOPE_PREFIX, codeReviewDecisionScope, codeReviewJobStaleReason, collectCodeReviewGateFacts, currentCodeReviewWorkingPaths, latestCodeReviewFailedStatus, requiresFinalVerifierForCurrentReview, scanCodeChangesForReview, } from "./code_review.js";
 import { isPhaseAdvanceAuthorized, latestAcceptedPhaseDecision, phaseConfirmationCommitPayload, phaseConfirmationForBoundary, phaseConfirmationMissingMessage, } from "./phase_confirmation.js";
 import { taskEvidenceReadiness } from "./task_evidence.js";
@@ -22,16 +22,49 @@ function phaseConfirmationStep(context, boundary, reason) {
         reason,
     };
 }
-function reviewGatePlan(snapshot, gate, requiredRoles) {
+function reviewGatePlan(snapshot, events, changeRoot, gate, requiredRoles) {
     const missingRoles = [];
     for (const role of requiredRoles) {
         const openForRole = snapshot.open_jobs.find(job => gate.isJobForGate(job) && job.role === role);
         if (openForRole) {
             return { kind: "blocked", reason: `状态未推进；已有待完成工作项 ${role}（${openForRole.job_id}）`, jobs: [openForRole] };
         }
-        const acceptedForRole = snapshot.accepted_jobs.find(job => gate.isJobForGate(job) && job.role === role);
-        if (!acceptedForRole)
-            missingRoles.push({ role, reason: `需求 ${role} 无已接受的工作项` });
+        const resolution = reviewGateRoleResolution(events, changeRoot, gate, role);
+        if (resolution.kind === "accepted" || resolution.kind === "overridden")
+            continue;
+        if (resolution.kind === "rejected_pending") {
+            const terminal = resolution.terminal;
+            const overrideScope = reviewRejectionOverrideScope(terminal.job.job_id);
+            return {
+                kind: "blocked",
+                jobs: [],
+                reason: `状态未推进；${role} 审查工作项 ${terminal.job.job_id} 已拒绝。请修改绑定材料、在整份报告没有有效 blocker 时登记整体裁决，或在涉及业务决定时询问用户`,
+                details: {
+                    review_rejection: {
+                        job_id: terminal.job.job_id,
+                        role,
+                        gate_id: gate.gate_id,
+                        packet_digest: terminal.job.packet_digest,
+                        result_kind: terminal.result_kind,
+                        reason: terminal.reason ?? "报告结论为 fail，工作项未通过",
+                        override_scope: overrideScope,
+                        allowed_actions: ["modify_materials", "record_override", "ask_user"],
+                        record_input: {
+                            scope: overrideScope,
+                            answer: "do_not_block",
+                            reason: "<说明整份报告为何没有有效 blocker>",
+                            decision_source: "main_process",
+                        },
+                    },
+                },
+            };
+        }
+        const reason = resolution.kind === "stale"
+            ? `需求 ${role} 的最新审查工作项已过期：${resolution.stale_reason}`
+            : resolution.kind === "rejected_invalid"
+                ? `需求 ${role} 的最新审查报告无效，不能通过整体裁决绕过`
+                : `需求 ${role} 无已接受的工作项`;
+        missingRoles.push({ role, reason });
     }
     if (missingRoles.length > 0) {
         return {
@@ -68,7 +101,7 @@ function missingBaseArtifact(changeRoot, risk) {
     if (risk === "minimal")
         return null;
     const artifactsDir = join(changeRoot, ".superspec", "artifacts");
-    for (const doc of ["discovery.md", "business-invariants.md", "test-contract.md"]) {
+    for (const doc of ["discovery.md", "test-contract.md"]) {
         if (!existsSync(join(artifactsDir, doc)))
             return `基础职责缺失：${doc} 不存在（risk=${risk} 需要）`;
     }
@@ -123,20 +156,6 @@ export function proposalDocsChangedSinceBaseline(changeRoot, baseline) {
     const current = proposalDocsBaseline(changeRoot);
     return Object.entries(baseline).some(([path, digest]) => current[path] !== digest);
 }
-export function historicalProposeReadyRoles(events) {
-    const roles = new Set();
-    for (const ev of events) {
-        if (ev.event_type !== "transition_commit")
-            continue;
-        const newJobs = ev.payload.new_jobs ?? [];
-        for (const job of newJobs) {
-            if (PROPOSE_FINAL_REVIEW_GATE.isJobForGate(job) &&
-                (job.role === "critic" || job.role === "architect" || job.role === "test-engineer"))
-                roles.add(job.role);
-        }
-    }
-    return [...roles];
-}
 export function pendingTaskIds(changeRoot) {
     const tasksContent = readFileSync(join(changeRoot, "tasks.md"), "utf8");
     return pendingTasksInContent(tasksContent).map(task => task.taskId);
@@ -286,7 +305,7 @@ export function planNextStep(context) {
                 return { kind: "ask_user", state: "explore", ask, reason: `有 ${openQs} 个未确认问题` };
             }
             const requiredRoles = EXPLORE_DISCOVERY_REVIEW_GATE.requiredRolesForRisk(mode.risk);
-            if (!reviewGatePlan(snapshot, EXPLORE_DISCOVERY_REVIEW_GATE, requiredRoles)) {
+            if (!reviewGatePlan(snapshot, events, changeRoot, EXPLORE_DISCOVERY_REVIEW_GATE, requiredRoles)) {
                 const confirmation = phaseConfirmationStep(context, "explore_to_propose", "探索完成，等待用户确认进入计划阶段");
                 if (confirmation)
                     return confirmation;
@@ -613,10 +632,10 @@ function planExploreTransition(context) {
     if (!discoveryCheck.ok)
         return { kind: "skip", message: discoveryCheck.message };
     const requiredRoles = EXPLORE_DISCOVERY_REVIEW_GATE.requiredRolesForRisk(mode.risk);
-    const gatePlan = reviewGatePlan(snapshot, EXPLORE_DISCOVERY_REVIEW_GATE, requiredRoles);
+    const gatePlan = reviewGatePlan(snapshot, events, changeRoot, EXPLORE_DISCOVERY_REVIEW_GATE, requiredRoles);
     if (gatePlan)
         return gatePlan;
-    const confirmation = phaseConfirmationForBoundary(projectRoot, events, snapshot, "explore_to_propose");
+    const confirmation = phaseConfirmationForBoundary(projectRoot, events, snapshot, "explore_to_propose", mode.risk);
     const decision = confirmation ? latestAcceptedPhaseDecision(events, confirmation) : null;
     if (!confirmation || decision?.decision !== "advance") {
         return { kind: "skip", message: confirmation ? phaseConfirmationMissingMessage(confirmation) : "无法建立 Explore 阶段确认范围" };
@@ -649,10 +668,15 @@ function planProposeReadyTransition(context) {
     if (missingArtifact)
         return { kind: "skip", message: missingArtifact };
     const requiredRoles = PROPOSE_FINAL_REVIEW_GATE.requiredRolesForRisk(risk);
-    const gatePlan = reviewGatePlan(snapshot, PROPOSE_FINAL_REVIEW_GATE, requiredRoles);
+    const gatePlan = reviewGatePlan(snapshot, context.events, changeRoot, PROPOSE_FINAL_REVIEW_GATE, requiredRoles);
     if (gatePlan)
         return gatePlan;
-    return { kind: "advance", fromState: "propose", toState: "propose_ready", reason: `risk=${risk}，所有需求已满足` };
+    return {
+        kind: "advance",
+        fromState: "propose",
+        toState: "propose_ready",
+        reason: `risk=${risk}，所有需求已满足`,
+    };
 }
 function planStartApplyTransition(context, enforceConfirmation = true) {
     const { changeRoot, events, projectRoot, snapshot } = context;
@@ -665,7 +689,7 @@ function planStartApplyTransition(context, enforceConfirmation = true) {
     }
     const reviewedRoles = historicalProposeReadyRoles(events);
     if (reviewedRoles.length > 0) {
-        const gatePlan = reviewGatePlan(snapshot, PROPOSE_FINAL_REVIEW_GATE, reviewedRoles);
+        const gatePlan = reviewGatePlan(snapshot, events, changeRoot, PROPOSE_FINAL_REVIEW_GATE, reviewedRoles);
         if (gatePlan) {
             return {
                 ...gatePlan,

package/dist/record.js

@@ -8,7 +8,7 @@ import { isPhaseConfirmationScope, phaseActionForAnswer, phaseConfirmationForCur
 import { CODE_REVIEW_DECISION_ANSWER_LABELS, CODE_REVIEW_DECISION_SCOPE_PREFIX, codeReviewDecisionAnswerLabel, normalizeCodeReviewDecisionAnswer, } from "./code_review.js";
 import { invalidReasonForSubmittedReport } from "./job_validity.js";
 import { jobSubmitArgv } from "./job_action.js";
-import { REVIEW_DOC_PATHS } from "./review.js";
+import { REVIEW_DOC_PATHS, REVIEW_REJECTION_OVERRIDE_SCOPE_PREFIX, REVIEW_REJECTION_OVERRIDE_ANSWER, parseReviewRejectionOverrideScope, reviewGateRoleResolution, reviewRejectionOverrideScope, } from "./review.js";
 import { EXPLORE_DISCOVERY_REVIEW_GATE, PROPOSE_FINAL_REVIEW_GATE } from "./review_job_gates.js";
 import { RecordInputDecodingError, readRecordInputFile } from "./record_input.js";
 const REVIEW_REPORT_REQUIRED_FIELDS = ["role", "verdict", "findings"];
@@ -90,14 +90,14 @@ function reviewScopeInstruction(job, reviewTargets, readOnlyRefs) {
     }
     const targets = reviewTargets.length > 0 ? `本 gate 可提出修改建议的审查目标为 ${reviewTargets.join(", ")}。` : "";
     const refs = readOnlyRefs.length > 0
-        ? `只读上游引用为 ${readOnlyRefs.join(", ")}；只允许读取和核对一致性，不得要求在当前阶段修改、追加、删除、重排或格式化这些文件，不得把修改只读引用列为本阶段 required fix。只读引用自身的缺失、错误或矛盾可在 risks 或 open_questions 中上报给主流程，但不得单独作为本 gate 的 fail。只有能定位到审查目标的不一致，才能作为 fail 并指向该审查目标的修复。`
+        ? `只读上游引用为 ${readOnlyRefs.join(", ")}；只允许读取和核对一致性，不得要求在当前阶段修改、追加、删除、重排或格式化这些文件。只读引用中与本次目标或绑定上游事实无直接因果关系的历史质量问题不得作为本 gate 的 fail。如果本次审查目标或 boundFiles 中绑定的上游事实直接造成变更包跨文档不一致，并且会影响明确验收或实施落地，可以 fail；finding 必须锚定为当前变更包未完成一致性闭环，required outcome 只要求消除矛盾，不得指定必须修改哪份文档或采用哪种技术方案。`
         : "";
     return targets + refs;
 }
 function reviewCoverageInstruction(job) {
     if (!requiresReviewScope(job))
         return "";
-    return `审查顺序固定为：先建立覆盖索引，按文件和标题/行段完整浏览全部 boundFiles 至文件末尾；长文档必须分段读取，不能在发现第一个 blocker 时停止覆盖。完整读取只用于核对本次 change 的目标、直接修改及跨文档一致性，不等于允许重新审计全部历史设计。若 proposal.md 存在“需求变化”，以其中记录的受影响能力、直接修改章节和保持不变范围作为本轮增量审查的权威锚点；本轮新 finding 必须由该需求变化、为接入变化所做的直接修改，或这些修改造成的跨文档矛盾引起，并说明因果链。此前已通过且被明确记录为保持不变的设计不得重新打开为 blocker；不要凭通用风险类别猜测变化范围。注意事项和故障类别是条件式检查项，不是必须穷举的清单。Recommendation 只能描述需要补足的结果、契约或证据，不得把未经 proposal、design 或用户决定选定的新基础设施写成 required fix。报告中的 review_scope.checked_paths 必须列出全部已浏览的 boundFiles；它只是覆盖回执，不能代替语义审查，也不扩大可报告问题的范围。`;
+    return `审查顺序固定为：先建立覆盖索引，按文件和标题/行段完整浏览全部 boundFiles 至文件末尾；长文档必须分段读取，不能在发现第一个 blocker 时停止覆盖。read_only_refs 按本次问题需要读取，用于核对目标与上下游一致性，不要求机械全文遍历或写入 checked_paths。完整读取只用于核对本次 change 的目标、直接修改及跨文档一致性，不等于允许重新审计全部历史设计。若 proposal.md 存在“需求变化”，以其中记录的受影响能力、直接修改章节和保持不变范围作为本轮增量审查的权威锚点；本轮新 finding 必须由该需求变化、为接入变化所做的直接修改，或这些修改造成的跨文档矛盾引起，并说明因果链。此前已通过且被明确记录为保持不变的设计不得重新打开为 blocker；不要凭通用风险类别猜测变化范围。注意事项和故障类别是条件式检查项，不是必须穷举的清单。Recommendation 只能描述需要补足的结果、契约或证据，不得把未经 proposal、design 或用户决定选定的新基础设施写成 required fix。报告中的 review_scope.checked_paths 必须列出全部已浏览的 boundFiles；它只是覆盖回执，不能代替语义审查，也不扩大可报告问题的范围。`;
 }
 function migrationEvidenceInstruction(job) {
     const isProposeReview = PROPOSE_FINAL_REVIEW_GATE.isJobForGate(job);
@@ -321,6 +321,21 @@ function findJob(events, jobId) {
     }
     return null;
 }
+function ordinaryReviewGateForJob(job) {
+    return [EXPLORE_DISCOVERY_REVIEW_GATE, PROPOSE_FINAL_REVIEW_GATE]
+        .find(gate => gate.isJobForGate(job)) ?? null;
+}
+function invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, decision, reason, message) {
+    appendEvent(projectRoot, change, makeEvent(change, "user_decision_recorded", {
+        accepted: false,
+        scope: decision.scope,
+        answer: decision.answer,
+        ...(decision.decision_source !== undefined ? { decision_source: decision.decision_source } : {}),
+        reason,
+        input_digest: inputDigest,
+    }));
+    return { event_type: "user_decision_recorded", accepted: false, message };
+}
 /** 检查 job 是否已终态 */
 function jobTerminalState(events, jobId) {
     for (const ev of events) {
@@ -610,6 +625,7 @@ function recordUserDecisionLoaded(projectRoot, change, events, content, inputDig
     }
     let phaseConfirmation = null;
     let phaseAction = null;
+    let phaseReviewRisk = null;
     if (isPhaseConfirmationScope(decision.scope)) {
         const existingAccepted = existing &&
             existing.payload.accepted !== false;
@@ -623,7 +639,14 @@ function recordUserDecisionLoaded(projectRoot, change, events, content, inputDig
         });
         const changeRoot = openspecChangeRoot(projectRoot, change);
         const snapshot = rebuildSnapshot(projectRoot, change, changeRoot);
-        const current = phaseConfirmationForCurrentState(projectRoot, events, snapshot);
+        const decisionRisk = decision.review_risk === undefined
+            ? "strict"
+            : decision.review_risk === "minimal" || decision.review_risk === "normal" || decision.review_risk === "strict"
+                ? decision.review_risk
+                : null;
+        const current = decisionRisk
+            ? phaseConfirmationForCurrentState(projectRoot, events, snapshot, decisionRisk)
+            : null;
         if (existingAccepted &&
             current?.scope === decision.scope &&
             latestAcceptedForScope?.event_id === existing.event_id) {
@@ -634,15 +657,17 @@ function recordUserDecisionLoaded(projectRoot, change, events, content, inputDig
             };
         }
         const action = current ? phaseActionForAnswer(current, decision.answer) : null;
-        const rejectionReason = !current
-            ? "phase_confirmation_not_pending"
-            : decision.scope !== current.scope
-                ? "stale_phase_confirmation_scope"
-                : !action
-                    ? "invalid_phase_confirmation_answer"
-                    : action.reason === "required" && !nonEmptyString(decision.reason)
-                        ? "missing_phase_confirmation_reason"
-                        : null;
+        const rejectionReason = !decisionRisk
+            ? "invalid_phase_confirmation_risk"
+            : !current
+                ? "phase_confirmation_not_pending"
+                : decision.scope !== current.scope
+                    ? "stale_phase_confirmation_scope"
+                    : !action
+                        ? "invalid_phase_confirmation_answer"
+                        : action.reason === "required" && !nonEmptyString(decision.reason)
+                            ? "missing_phase_confirmation_reason"
+                            : null;
         if (rejectionReason) {
             if (existing &&
                 existing.payload.accepted === false &&
@@ -662,13 +687,16 @@ function recordUserDecisionLoaded(projectRoot, change, events, content, inputDig
             }));
             const message = rejectionReason === "invalid_phase_confirmation_answer" && current
                 ? `阶段确认答复必须精确为：${current.ask.allowed_answers.join("、")}`
-                : rejectionReason === "missing_phase_confirmation_reason" && action
-                    ? action.reason_prompt ?? "当前选择必须写明原因"
-                    : "阶段确认已失效或当前没有待确认的阶段边界，请重新执行 next";
+                : rejectionReason === "invalid_phase_confirmation_risk"
+                    ? "阶段确认 review_risk 必须是 minimal、normal 或 strict"
+                    : rejectionReason === "missing_phase_confirmation_reason" && action
+                        ? action.reason_prompt ?? "当前选择必须写明原因"
+                        : "阶段确认已失效或当前没有待确认的阶段边界，请重新执行 next";
             return { event_type: "user_decision_recorded", accepted: false, message };
         }
         phaseConfirmation = current;
         phaseAction = action;
+        phaseReviewRisk = decisionRisk;
     }
     if (existing && !phaseAction) {
         const accepted = existing.payload.accepted !== false;
@@ -678,6 +706,59 @@ function recordUserDecisionLoaded(projectRoot, change, events, content, inputDig
             message: accepted ? "幂等返回：同一用户决策已登记" : "幂等返回：同一无效用户决策已登记",
         };
     }
+    let reviewRejectionOverride = null;
+    let reviewRejectionDecisionSource = null;
+    if (decision.scope.startsWith(REVIEW_REJECTION_OVERRIDE_SCOPE_PREFIX)) {
+        const jobId = parseReviewRejectionOverrideScope(decision.scope);
+        if (!jobId) {
+            return invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, { scope: decision.scope, answer: decision.answer, decision_source: decision.decision_source }, "invalid_review_rejection_override_scope", "审查拒绝裁决 scope 必须包含有效 job ID");
+        }
+        if (decision.scope !== reviewRejectionOverrideScope(jobId)) {
+            return invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, { scope: decision.scope, answer: decision.answer, decision_source: decision.decision_source }, "invalid_review_rejection_override_scope", `审查拒绝裁决 scope 必须精确为 ${reviewRejectionOverrideScope(jobId)}`);
+        }
+        if (decision.answer !== REVIEW_REJECTION_OVERRIDE_ANSWER) {
+            return invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, { scope: decision.scope, answer: decision.answer, decision_source: decision.decision_source }, "invalid_review_rejection_override_answer", `审查拒绝裁决 answer 必须是 ${REVIEW_REJECTION_OVERRIDE_ANSWER}`);
+        }
+        if (decision.decision_source !== "main_process" && decision.decision_source !== "user") {
+            return invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, { scope: decision.scope, answer: decision.answer, decision_source: decision.decision_source }, "invalid_review_rejection_override_source", "审查拒绝裁决 decision_source 必须是 main_process 或 user");
+        }
+        if (!nonEmptyString(decision.reason)) {
+            return invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, { scope: decision.scope, answer: decision.answer, decision_source: decision.decision_source }, "missing_review_rejection_override_reason", "审查拒绝裁决必须写明原因");
+        }
+        const job = findJob(events, jobId);
+        const gate = job ? ordinaryReviewGateForJob(job) : null;
+        if (!job || !gate || !isOrdinaryReviewer(job.role)) {
+            return invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, { scope: decision.scope, answer: decision.answer, decision_source: decision.decision_source }, "review_rejection_override_job_not_found", "审查拒绝裁决必须指向当前 Explore / Propose gate 的普通 Reviewer job");
+        }
+        const changeRoot = openspecChangeRoot(projectRoot, change);
+        const snapshot = rebuildSnapshot(projectRoot, change, changeRoot);
+        const gateIsCurrent = gate.gate_id === EXPLORE_DISCOVERY_REVIEW_GATE.gate_id
+            ? snapshot.state === "explore"
+            : snapshot.state === "propose" || snapshot.state === "propose_ready";
+        if (!gateIsCurrent) {
+            return invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, { scope: decision.scope, answer: decision.answer, decision_source: decision.decision_source }, "review_rejection_override_gate_not_current", "审查拒绝裁决只能在对应 Explore / Propose gate 仍为当前阶段时登记");
+        }
+        const resolution = reviewGateRoleResolution(events, changeRoot, gate, job.role);
+        if (resolution.kind === "none" || resolution.terminal.job.job_id !== job.job_id) {
+            return invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, { scope: decision.scope, answer: decision.answer, decision_source: decision.decision_source }, "review_rejection_override_not_latest_terminal", "审查拒绝裁决只能指向当前 gate cycle 中该角色最新的 terminal job");
+        }
+        if (resolution.kind === "stale") {
+            return invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, { scope: decision.scope, answer: decision.answer, decision_source: decision.decision_source }, "stale_review_rejection_override_job", `审查拒绝裁决指向的 job 已过期：${resolution.stale_reason}`);
+        }
+        if (resolution.kind === "accepted") {
+            return invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, { scope: decision.scope, answer: decision.answer, decision_source: decision.decision_source }, "review_rejection_override_job_not_rejected", "审查拒绝裁决只能指向 rejected job");
+        }
+        if (resolution.kind === "rejected_invalid") {
+            return invalidReviewRejectionOverrideResult(projectRoot, change, inputDigest, { scope: decision.scope, answer: decision.answer, decision_source: decision.decision_source }, "review_rejection_override_not_review_failed", "只有 result_kind=review_failed 的拒绝报告可以裁决；无效报告必须修正后重新提交");
+        }
+        reviewRejectionOverride = {
+            job_id: job.job_id,
+            role: job.role,
+            gate_id: gate.gate_id,
+            packet_digest: job.packet_digest,
+        };
+        reviewRejectionDecisionSource = decision.decision_source;
+    }
     if (decision.scope.startsWith(CODE_REVIEW_DECISION_SCOPE_PREFIX)) {
         const normalizedAnswer = normalizeCodeReviewDecisionAnswer(decision.answer);
         if (!normalizedAnswer) {
@@ -721,10 +802,13 @@ function recordUserDecisionLoaded(projectRoot, change, events, content, inputDig
             ? phaseAction.label
             : normalizedAnswer ? codeReviewDecisionAnswerLabel(normalizedAnswer) : decision.answer,
         ...(typeof decision.reason === "string" ? { reason: decision.reason.trim() } : {}),
+        ...(reviewRejectionDecisionSource ? { decision_source: reviewRejectionDecisionSource } : {}),
+        ...(reviewRejectionOverride ? { review_rejection_override: reviewRejectionOverride } : {}),
         ...(phaseAction ? {
             phase_confirmation: {
                 boundary: phaseAction.boundary,
                 decision: phaseAction.decision,
+                review_risk: phaseReviewRisk ?? "strict",
             },
         } : {}),
     };

package/dist/review.d.ts

@@ -1,5 +1,5 @@
 import { type ReviewGateRule } from "./review_job_gates.ts";
-import type { Event, Job, JobRole, Ref, ReviewPreviousRejection } from "./types.ts";
+import type { CodeReviewResultKind, Event, Job, JobRole, Ref, ReviewPreviousRejection } from "./types.ts";
 export type ReviewRisk = "minimal" | "normal" | "strict";
 export interface ReviewPolicy {
     review_risk: ReviewRisk;
@@ -9,7 +9,54 @@ export declare const REVIEW_DOC_PATHS: string[];
 export declare function assertCommitPayloadExtension(payload: Record<string, unknown>): void;
 export declare function reviewPolicyForRisk(risk: ReviewRisk): ReviewPolicy;
 export declare function readReviewPolicyFromEvents(events: Event[]): ReviewPolicy | null;
+export declare const REVIEW_REJECTION_OVERRIDE_SCOPE_PREFIX = "review_rejection_override:";
+export declare const REVIEW_REJECTION_OVERRIDE_ANSWER = "do_not_block";
+export type ReviewRejectionDecisionSource = "main_process" | "user";
+export interface ReviewRejectionOverrideAudit {
+    job_id: string;
+    role: JobRole;
+    gate_id: ReviewGateRule["gate_id"];
+    packet_digest: string;
+    decision_source: ReviewRejectionDecisionSource;
+    reason: string;
+    decision_event_id: string;
+    decision_event_digest: string;
+}
+export declare function reviewRejectionOverrideScope(jobId: string): string;
+export declare function parseReviewRejectionOverrideScope(scope: string): string | null;
+export interface ReviewTerminalResult {
+    job: Job;
+    event: Event;
+    state: "accepted" | "rejected";
+    result_kind?: CodeReviewResultKind;
+    reason?: string;
+    findings?: unknown[];
+}
+export declare function latestReviewTerminalForGateRole(events: Event[], gate: ReviewGateRule, role: JobRole): ReviewTerminalResult | null;
+export declare function effectiveReviewRejectionOverride(events: Event[], gate: ReviewGateRule, terminal: ReviewTerminalResult): ReviewRejectionOverrideAudit | null;
+export type ReviewGateRoleResolution = {
+    kind: "none";
+} | {
+    kind: "stale";
+    terminal: ReviewTerminalResult;
+    stale_reason: string;
+} | {
+    kind: "accepted";
+    terminal: ReviewTerminalResult;
+} | {
+    kind: "rejected_invalid";
+    terminal: ReviewTerminalResult;
+} | {
+    kind: "rejected_pending";
+    terminal: ReviewTerminalResult;
+} | {
+    kind: "overridden";
+    terminal: ReviewTerminalResult;
+    override: ReviewRejectionOverrideAudit;
+};
+export declare function reviewGateRoleResolution(events: Event[], changeRoot: string, gate: ReviewGateRule, role: JobRole): ReviewGateRoleResolution;
 export declare function latestReviewHistoryForGateRole(events: Event[], gate: ReviewGateRule, role: JobRole): ReviewPreviousRejection | null;
+export declare function historicalProposeReadyRoles(events: Event[]): JobRole[];
 export declare function isReviewReadyVerifier(job: Job): boolean;
 export declare function reviewBoundFiles(changeRoot: string): Ref[];
 export declare function reviewEvidenceDigest(events: Event[]): string;

package/dist/review.js

@@ -2,7 +2,7 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { docRef, sha256File, sha256Text } from "./store.js";
-import { EXPLORE_DISCOVERY_REVIEW_GATE_ID, PROPOSE_FINAL_REVIEW_GATE_ID, REVIEW_FINAL_VERIFIER_GATE, } from "./review_job_gates.js";
+import { EXPLORE_DISCOVERY_REVIEW_GATE_ID, PROPOSE_FINAL_REVIEW_GATE, PROPOSE_FINAL_REVIEW_GATE_ID, REVIEW_FINAL_VERIFIER_GATE, } from "./review_job_gates.js";
 import { computeCodeStateCheck, effectiveCoverageExemptionRefsFromEvents } from "./code_review.js";
 export const REVIEW_DOC_PATHS = [
     "proposal.md",
@@ -10,7 +10,6 @@ export const REVIEW_DOC_PATHS = [
     "design.md",
     "specs/",
     ".superspec/artifacts/discovery.md",
-    ".superspec/artifacts/business-invariants.md",
     ".superspec/artifacts/test-contract.md",
 ];
 const CORE_COMMIT_FIELDS = new Set([
@@ -59,6 +58,17 @@ function reviewResultKind(value) {
         ? value
         : null;
 }
+export const REVIEW_REJECTION_OVERRIDE_SCOPE_PREFIX = "review_rejection_override:";
+export const REVIEW_REJECTION_OVERRIDE_ANSWER = "do_not_block";
+export function reviewRejectionOverrideScope(jobId) {
+    return `${REVIEW_REJECTION_OVERRIDE_SCOPE_PREFIX}${jobId}`;
+}
+export function parseReviewRejectionOverrideScope(scope) {
+    if (!scope.startsWith(REVIEW_REJECTION_OVERRIDE_SCOPE_PREFIX))
+        return null;
+    const jobId = scope.slice(REVIEW_REJECTION_OVERRIDE_SCOPE_PREFIX.length).trim();
+    return jobId === "" ? null : jobId;
+}
 function reviewCycleState(gate) {
     if (gate.gate_id === EXPLORE_DISCOVERY_REVIEW_GATE_ID)
         return "explore";
@@ -109,6 +119,7 @@ function reviewTerminalResultsForGateRole(events, gate, role) {
         const findings = Array.isArray(payload.findings) ? payload.findings : undefined;
         results.push({
             job,
+            event,
             state: event.event_type === "job_accepted" ? "accepted" : "rejected",
             ...(event.event_type === "job_rejected"
                 ? { result_kind: reviewResultKind(payload.result_kind) ?? (findings ? "review_failed" : "invalid_report") }
@@ -119,6 +130,69 @@ function reviewTerminalResultsForGateRole(events, gate, role) {
     }
     return results;
 }
+export function latestReviewTerminalForGateRole(events, gate, role) {
+    return reviewTerminalResultsForGateRole(events, gate, role).at(-1) ?? null;
+}
+function validReviewRejectionOverridePayload(event, terminal, gate) {
+    if (event.event_type !== "user_decision_recorded")
+        return null;
+    const payload = event.payload;
+    if (payload.accepted !== true ||
+        payload.scope !== reviewRejectionOverrideScope(terminal.job.job_id) ||
+        payload.answer !== REVIEW_REJECTION_OVERRIDE_ANSWER ||
+        (payload.decision_source !== "main_process" && payload.decision_source !== "user") ||
+        typeof payload.reason !== "string" || payload.reason.trim() === "" ||
+        !payload.review_rejection_override ||
+        typeof payload.review_rejection_override !== "object" ||
+        Array.isArray(payload.review_rejection_override))
+        return null;
+    const audit = payload.review_rejection_override;
+    if (audit.job_id !== terminal.job.job_id ||
+        audit.role !== terminal.job.role ||
+        audit.gate_id !== gate.gate_id ||
+        audit.packet_digest !== terminal.job.packet_digest)
+        return null;
+    return {
+        job_id: terminal.job.job_id,
+        role: terminal.job.role,
+        gate_id: gate.gate_id,
+        packet_digest: terminal.job.packet_digest,
+        decision_source: payload.decision_source,
+        reason: payload.reason.trim(),
+        decision_event_id: event.event_id,
+        decision_event_digest: event.event_digest,
+    };
+}
+export function effectiveReviewRejectionOverride(events, gate, terminal) {
+    const cycleStartIndex = currentReviewGateCycleStart(events, gate);
+    if (cycleStartIndex == null)
+        return null;
+    const terminalIndex = events.findIndex(event => event.event_id === terminal.event.event_id);
+    if (terminalIndex < cycleStartIndex)
+        return null;
+    for (let i = events.length - 1; i > terminalIndex; i--) {
+        const audit = validReviewRejectionOverridePayload(events[i], terminal, gate);
+        if (audit)
+            return audit;
+    }
+    return null;
+}
+export function reviewGateRoleResolution(events, changeRoot, gate, role) {
+    const terminal = latestReviewTerminalForGateRole(events, gate, role);
+    if (!terminal)
+        return { kind: "none" };
+    const staleReason = boundFilesStaleReason(terminal.job, changeRoot);
+    if (staleReason)
+        return { kind: "stale", terminal, stale_reason: staleReason };
+    if (terminal.state === "accepted")
+        return { kind: "accepted", terminal };
+    if (terminal.result_kind !== "review_failed")
+        return { kind: "rejected_invalid", terminal };
+    const override = effectiveReviewRejectionOverride(events, gate, terminal);
+    return override
+        ? { kind: "overridden", terminal, override }
+        : { kind: "rejected_pending", terminal };
+}
 export function latestReviewHistoryForGateRole(events, gate, role) {
     const terminalResults = reviewTerminalResultsForGateRole(events, gate, role);
     const latest = terminalResults.at(-1);
@@ -156,6 +230,20 @@ export function latestReviewHistoryForGateRole(events, gate, role) {
         job_id: latest.job.job_id,
     };
 }
+export function historicalProposeReadyRoles(events) {
+    const roles = new Set();
+    for (const event of events) {
+        if (event.event_type !== "transition_commit")
+            continue;
+        const jobs = event.payload.new_jobs ?? [];
+        for (const job of jobs) {
+            if (PROPOSE_FINAL_REVIEW_GATE.isJobForGate(job) &&
+                (job.role === "critic" || job.role === "architect" || job.role === "test-engineer"))
+                roles.add(job.role);
+        }
+    }
+    return [...roles];
+}
 export function isReviewReadyVerifier(job) {
     return job.role === "verifier" && REVIEW_FINAL_VERIFIER_GATE.isJobForGate(job);
 }

package/dist/review_job_gates.d.ts

@@ -15,6 +15,11 @@ export declare const EXPLORE_DISCOVERY_REVIEW_GATE_ID: "explore.discovery_review
 export declare const PROPOSE_FINAL_REVIEW_GATE_ID: "propose.final_review";
 export declare const REVIEW_CODE_REVIEW_GATE_ID: "review.code_review";
 export declare const REVIEW_FINAL_VERIFIER_GATE_ID: "review.final_verifier";
+export declare function reviewScopeForGateRole(gate: ReviewGateRule, role: JobRole): {
+    reviewTargets: string[];
+    readOnlyRefs: string[];
+    boundPaths: string[];
+};
 export declare const EXPLORE_DISCOVERY_REVIEW_GATE: ReviewGateRule;
 export declare const PROPOSE_FINAL_REVIEW_GATE: ReviewGateRule;
 export declare const REVIEW_CODE_REVIEW_GATE: ReviewGateRule;

package/dist/review_job_gates.js

@@ -19,6 +19,58 @@ export const EXPLORE_DISCOVERY_REVIEW_GATE_ID = "explore.discovery_review";
 export const PROPOSE_FINAL_REVIEW_GATE_ID = "propose.final_review";
 export const REVIEW_CODE_REVIEW_GATE_ID = "review.code_review";
 export const REVIEW_FINAL_VERIFIER_GATE_ID = "review.final_verifier";
+function defaultReviewScope(gate) {
+    return {
+        reviewTargets: [...gate.reviewTargets],
+        readOnlyRefs: [...gate.readOnlyRefs],
+        boundPaths: [...new Set([...gate.reviewTargets, ...gate.readOnlyRefs])],
+    };
+}
+export function reviewScopeForGateRole(gate, role) {
+    if (gate.gate_id !== PROPOSE_FINAL_REVIEW_GATE_ID)
+        return defaultReviewScope(gate);
+    if (role === "critic") {
+        const reviewTargets = ["proposal.md", "specs/", "tasks.md"];
+        const readOnlyRefs = [
+            "design.md",
+            ".superspec/artifacts/test-contract.md",
+            ".superspec/artifacts/discovery.md",
+        ];
+        return {
+            reviewTargets,
+            readOnlyRefs,
+            boundPaths: [...reviewTargets, ".superspec/artifacts/discovery.md"],
+        };
+    }
+    if (role === "architect") {
+        const reviewTargets = ["design.md"];
+        return {
+            reviewTargets,
+            readOnlyRefs: [
+                "proposal.md",
+                "specs/",
+                "tasks.md",
+                ".superspec/artifacts/discovery.md",
+                ".superspec/artifacts/test-contract.md",
+            ],
+            boundPaths: [...reviewTargets],
+        };
+    }
+    if (role === "test-engineer") {
+        const reviewTargets = [".superspec/artifacts/test-contract.md", "tasks.md"];
+        return {
+            reviewTargets,
+            readOnlyRefs: [
+                "proposal.md",
+                "specs/",
+                "design.md",
+                ".superspec/artifacts/discovery.md",
+            ],
+            boundPaths: [...reviewTargets],
+        };
+    }
+    return defaultReviewScope(gate);
+}
 const EXPLORE_DISCOVERY_REVIEW_ROLES = ["critic"];
 const PROPOSAL_REVIEW_ROLES = ["critic", "architect", "test-engineer"];
 const PROPOSAL_REVIEW_ROLE_SET = new Set(PROPOSAL_REVIEW_ROLES);
@@ -46,7 +98,6 @@ export const PROPOSE_FINAL_REVIEW_GATE = makeReviewGateRule({
         "tasks.md",
         "design.md",
         "specs/",
-        ".superspec/artifacts/business-invariants.md",
         ".superspec/artifacts/test-contract.md",
     ],
     readOnlyRefs: [".superspec/artifacts/discovery.md"],

package/dist/sync.js

@@ -7,7 +7,6 @@ import { invalidReasonForSnapshot } from "./job_validity.js";
 const TRACKED_DOCS = [
     "proposal.md", "design.md", "tasks.md", "specs/",
     ".superspec/artifacts/discovery.md",
-    ".superspec/artifacts/business-invariants.md",
     ".superspec/artifacts/test-contract.md",
 ];
 /** 从 events.jsonl 推导：当前状态、jobs、attempts、pending decisions */

package/dist/transition.js

@@ -5,7 +5,7 @@ import { ensureChangeLayout, readEvents, appendEvent, makeEvent, writeSnapshot,
 import { rebuildSnapshot } from "./sync.js";
 import { requiredJobActions } from "./job_action.js";
 import { assertCommitPayloadExtension, isFreshReviewVerifier, isReviewReadyVerifier, latestReviewHistoryForGateRole, readReviewPolicyFromEvents, reviewBoundFiles, reviewEvidenceDigest, reviewPolicyForRisk, REVIEW_DOC_PATHS, } from "./review.js";
-import { REVIEW_CODE_REVIEW_GATE_ID, REVIEW_FINAL_VERIFIER_GATE_ID, } from "./review_job_gates.js";
+import { REVIEW_CODE_REVIEW_GATE_ID, REVIEW_FINAL_VERIFIER_GATE_ID, reviewScopeForGateRole, } from "./review_job_gates.js";
 import { codeReviewBoundFiles, codeReviewDecisionScope, codeReviewJobStaleReason, codeReviewPacketContext, codeReviewPacketDigest, collectCodeReviewGateFacts, computeCodeStateCheck, currentCodeReviewWorkingPaths, dismissedCodeReviewSummary, latestCodeReviewDecision, latestCodeReviewFailedStatus, missingCoverageExemptionTestIds, requiresFinalVerifierForCurrentReview, scanCodeChangesForReview, } from "./code_review.js";
 import { taskEvidenceReadiness } from "./task_evidence.js";
 import { adoptedContractForTask, findTaskInLines, isReviewFixTaskId, parseTasksMd, parseTestContractEntries, } from "./format.js";
@@ -18,8 +18,9 @@ let jobSeq = 0;
 function newJobId(change, role) { return `JOB-${change.slice(0, 8)}-${role.slice(0, 4)}-${Date.now()}-${++jobSeq}`; }
 function createReviewJobsForGate(state, gate, roles, changeRoot, change, reason, events) {
     const newJobs = roles.map(role => {
-        const boundPaths = [...new Set([...gate.reviewTargets, ...gate.readOnlyRefs])];
-        // 所有审查目标和只读引用都绑定时点指纹：单文件缺失使用 sha256:missing，目录缺失使用稳定空指纹。
+        const scope = reviewScopeForGateRole(gate, role);
+        // 角色职责目标和显式 freshness 路径绑定时点指纹：单文件缺失使用 sha256:missing，目录缺失使用稳定空指纹。
+        const boundPaths = [...new Set(scope.boundPaths)];
         const boundFiles = boundPaths
             .map(p => docRef(changeRoot, p));
         const previousRejection = latestReviewHistoryForGateRole(events, gate, role);
@@ -29,14 +30,14 @@ function createReviewJobsForGate(state, gate, roles, changeRoot, change, reason,
             state: "requested",
             gate_id: gate.gate_id,
             boundFiles,
-            ...(gate.reviewTargets.length > 0 ? { review_targets: [...gate.reviewTargets] } : {}),
-            ...(gate.readOnlyRefs.length > 0 ? { read_only_refs: [...gate.readOnlyRefs] } : {}),
+            ...(scope.reviewTargets.length > 0 ? { review_targets: [...scope.reviewTargets] } : {}),
+            ...(scope.readOnlyRefs.length > 0 ? { read_only_refs: [...scope.readOnlyRefs] } : {}),
             packet_digest: sha256Text(JSON.stringify({
                 role,
                 gate_id: gate.gate_id,
                 boundFiles,
-                review_targets: gate.reviewTargets,
-                read_only_refs: gate.readOnlyRefs,
+                review_targets: scope.reviewTargets,
+                read_only_refs: scope.readOnlyRefs,
                 created_from_transition: gate.created_from_transition,
                 ...(previousRejection ? { previous_rejection: previousRejection } : {}),
             })),
@@ -440,7 +441,7 @@ function transitionPlanToDecision(snapshot, changeRoot, change, plan, events) {
         case "skip":
             return { skip: true, message: plan.message };
         case "blocked":
-            return { blocked: true, reason: plan.reason, jobs: plan.jobs };
+            return { blocked: true, reason: plan.reason, jobs: plan.jobs, ...(plan.details ? { details: plan.details } : {}) };
         case "create_gate_jobs":
             return createReviewJobsForGate(snapshot.state, plan.gate, plan.roles, changeRoot, change, plan.reason, events);
         case "advance":
@@ -483,7 +484,7 @@ export function commitTransition(projectRoot, change, changeRoot, opts) {
                 from_state: snapshot.state,
                 to_state: snapshot.state,
                 created_jobs: [],
-                required_jobs: requiredJobActions(change, decision.jobs),
+                ...(decision.jobs.length > 0 ? { required_jobs: requiredJobActions(change, decision.jobs) } : {}),
                 message: decision.reason,
                 events_written: 0,
                 ...(decision.details ? { details: decision.details } : {}),

package/dist/types.d.ts

@@ -244,6 +244,7 @@ export interface AskUserAction {
         question: string;
         answer: string;
         reason?: string;
+        review_risk?: "minimal" | "normal" | "strict";
     };
     resume: AskUserActionResume;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peterxiaoyang/superspec",
-  "version": "0.1.43",
+  "version": "0.1.44",
   "description": "SuperSpec 流程引擎 — transition engine with lightweight fact-sync",
   "type": "module",
   "engines": {

package/templates/workflow/agents/executor.toml

@@ -9,5 +9,5 @@ Task binding: load `.codex/prompts/executor.md` first, then read the current tas
 
 Boundary: mutating but bounded. Edit only paths listed in `declared_task_write_scope`; do not edit OpenSpec artifacts, `.superspec/**`, task checkboxes, evidence, review reports, or archives. Stop and report blockers when scope or context is insufficient.
 
-Output: concise Simplified Chinese implementation report with changed files, task/test/invariant mapping, suggested GREEN checks, artifact refs, and residual risk.
+Output: concise Simplified Chinese implementation report with changed files, task/test mapping, suggested GREEN checks, artifact refs, and residual risk.
 """

package/templates/workflow/agents/test-runner.toml

@@ -9,5 +9,5 @@ Task binding: load `.codex/prompts/test-runner.md` first, then read the current
 
 Boundary: read-only by default. Do not edit production code, OpenSpec artifacts, `.superspec/**`, task checkboxes, evidence, review reports, or archives. Run only the allowed command from current task instructions and report blockers for missing command, unsafe side effects, or incomplete raw transcript refs.
 
-Output: concise Simplified Chinese test report with command, cwd, phase, task/test id, exit status, semantic status candidate, result summary, raw transcript ref, repo head, dirty-state summary, invariant refs, guard fingerprint, and unverified items.
+Output: concise Simplified Chinese test report with command, cwd, phase, task/test id, exit status, semantic status candidate, result summary, raw transcript ref, repo head, dirty-state summary, guard fingerprint, and unverified items.
 """

package/templates/workflow/prompts/critic.md

@@ -68,7 +68,6 @@ argument-hint: "本次反方审查说明"
 - discovery 含链路五要素时，有证据确认会被本次 change 改变的下游消费者或视图差异未进入 Impact 且无排除理由；或 Impact 引用的 `CHAIN-xxx` 所代表的用户可观察行为没有测试场景映射且无不覆盖理由。仅被检查但行为不变的消费者不进入 Impact 或测试。design 仅引用 CHAIN 解释路线不重复产生测试映射；design 暴露的新消费者、视图差异或可观察行为影响必须先进入 Impact。对账不要求每条 CHAIN 单独进入 Impact；同一链路已由 IDC 覆盖且互相引用时不重复报错。
 - proposal、design、specs 与已确认的 CHAIN / IDC 结论显式矛盾，且没有声明为待确认或本次有意变更。
 - `specs/` 增量与 proposal 能力变化不对应：声明的能力缺规范增量、specs 引入未声明能力，或规范正文写成实现路线 / 过程描述。绑定为目录时须逐个打开 Markdown 规范；无法读取时必须失败。
-- `business-invariants.md` 条目不可证伪，或本次行为变化触及的核心规则缺少对应不变量。
 - `tasks.md` 无法定位到 design 的实现方案或边界约束，任务过粗，或多个独立行为混在同一 RED/GREEN 闭环。
 - task ID 重复 / 不稳定，标题混入 task ID，缩进 checkbox 或普通说明承载实际工作，task 中写入 RED/GREEN 命令、断言或预期输出。
 - tasks 顺序与依赖矛盾：被依赖 task 出现在依赖它的 task 之后；标题分组和行内依赖说明不改变全文顶格 checkbox 执行顺序。

package/templates/workflow/prompts/test-engineer.md

@@ -19,8 +19,8 @@ argument-hint: "本次测试审查说明"
 
 ## 审查边界与停止条件
 
-- 只有测试缺口来自本次 change 的明确验收、specs、业务不变量、已采纳 design 或有直接证据的回归风险，并且会使主要行为无法证明时，才使用 `verdict:"fail"`；不满足时省略或列为非阻塞观察。
-- 测试义务只来源于 specs、明确 acceptance、业务不变量、已采纳 design，以及本次修改直接造成且有证据的回归风险。Reviewer recommendation、未采纳架构、长期可能性和通用故障注入场景不能自动成为 TEST 来源。
+- 只有测试缺口来自本次 change 的明确验收、specs、已采纳 design 或有直接证据的回归风险，并且会使主要行为无法证明时，才使用 `verdict:"fail"`；不满足时省略或列为非阻塞观察。
+- 测试义务只来源于 specs、明确 acceptance、已采纳 design，以及本次修改直接造成且有证据的回归风险。Reviewer recommendation、未采纳架构、长期可能性和通用故障注入场景不能自动成为 TEST 来源。
 - 复用现有基础设施或通用机制时，可以引用既有测试，只补本次接入正确性的最小测试；除非需求明确提升对应质量等级，或直接证据证明本次接入破坏既有契约，不重新验证该机制的一般故障恢复、一致性或可用性能力。
 - 如果当前接入无法满足用户已确认的强制需求、规格约束或明确验收结果，应报告缺失的可验证行为，不得要求采用任何未被采纳的具体基础设施或架构方案，也不得自行新增或升级强制测试要求。
 - recommendation 只能描述需要证明的行为、边界或证据，不把测试偏好和新的基础设施方案写成 required fix；推荐方案不是 finding 成立的证据。

package/templates/workflow/prompts/test-runner.md

@@ -19,7 +19,7 @@ argument-hint: "本次测试说明"
 
 ## 本次任务说明
 
-先读取主流程提供的本次测试说明。以本次任务说明中的 `task_id`、`test_id`、`phase`、`expected_semantic_status`、`allowed_test_command`、`guard_fingerprint`、`required_invariant_refs`、报告策略和停止条件为准。
+先读取主流程提供的本次测试说明。以本次任务说明中的 `task_id`、`test_id`、`phase`、`expected_semantic_status`、`allowed_test_command`、`guard_fingerprint`、报告策略和停止条件为准。
 
 `phase:"green"` 且 `worker_chain_context:"executor_worker"` 时，必须确认本次任务说明已绑定 `apply_worker_chain_id` 和 `task_code_review_report_pinned_refs`。不要把测试报告直接写成正式 evidence。
 

package/templates/workflow/skills/superspec-apply/SKILL.md

@@ -30,7 +30,7 @@ metadata:
 1. **计划核对**：执行 `task-start` 前，确认当前 task 是 `tasks.md` 顶格任务。task 带 `执行依据:` 块时，以它为主要执行上下文；没有执行依据的历史 task 对应 `design.md` 的实现方向和 `proposal.md` 的 `## Impact` 受影响原因。缺少映射、需要新增能力/验收/影响范围时先停止，交回 propose，不写 RED。
 2. **任务开始**：执行 next 下发的 task-start 命令。
 3. **读取执行依据快照**：task-start 的返回结果包含本次任务尝试 ID（`attempt_id`，登记测试时要用）和执行依据快照（五字段在启动时刻的定格版本）。返回结果带快照时，实现和验收以它为准；返回结果标明是历史任务（`legacy_contract`）时，即使 `tasks.md` 里有执行依据文本也不采纳为引擎契约，按原有方式回读 `proposal.md`、`design.md` 和 `test-contract.md`，test-run 走历史规则。
-4. **RED**：执行依据声明了测试时，测试必须对应其中的 `TEST-xxx`（登记其他 TEST 会被拒绝）；没有执行依据的历史 task 确认测试意图能对应 `test-contract.md` 的 `test_id` 或 `business-invariants.md`，缺少对应关系时先停止，交回 propose。运行后确认失败，并用 `superspec record test-run --change "<change>" --input -` 登记。
+4. **RED**：执行依据声明了测试时，测试必须对应其中的 `TEST-xxx`（登记其他 TEST 会被拒绝）；没有执行依据的历史 task 确认测试意图能对应 `test-contract.md` 的 `test_id`，缺少对应关系时先停止，交回 propose。运行后确认失败，并用 `superspec record test-run --change "<change>" --input -` 登记。
 5. **实现**：根据任务写代码，保持范围小。`design.md` 不锁死字段名、函数名、SQL 或局部写法。
 6. **GREEN**：运行测试确认通过，并登记 test-run。执行依据声明多个测试时，每个声明 TEST 都要有 GREEN；普通 `tdd_required:true` task 还要求至少一个 TEST 形成同 TEST 先 RED 后 GREEN，其余可以只有 GREEN 作为回归覆盖。
 7. **完成 task**：执行 next 下发的 task-complete 命令。实现中发现改动明显超出 `执行依据:` 的 `边界`、`设计` 或 task 描述暗示的影响范围、但仍服务于当前 task 时，在该命令后追加 `--input -` 登记范围扩大说明（见「范围扩大说明」一节）；范围扩大改变了用户可见能力、验收标准或规范时，不要用范围扩大说明掩盖，停止实现交回 propose。

package/templates/workflow/skills/superspec-explore/SKILL.md

@@ -25,6 +25,8 @@ metadata:
 
 执行推进类命令前，对照 critic 的 Discovery 审查阻塞条件快速自检（非穷尽）：锚点可核验、链路表完整且状态为枚举值、完成判定可判定、未知去向明确、已勾选问题有行内结论。自检不替代审查工作项，只为减少驳回往返。
 
+Discovery 审查报告是待验证的独立意见，不会自动扩大本次 change。审查未通过时，主流程先根据用户目标、当前 discovery 的直接证据和明确完成判定，独立判断整份报告是否有资格阻塞：只要存在一个属于本次 change、有直接证据且影响范围判断或阶段完成条件的问题，就补充 discovery 并重新审查；不要为了让报告“全部正确”而处理其余越界建议。只有整份报告提出的问题均不具备阻塞条件时，才可将本次审查结论标记为不阻塞，并按工作流提供的方式留痕。该判断只适用于当前材料；discovery 变化后必须重新审查，不做部分问题裁决或永久豁免。问题是否成立取决于业务范围、完成判定或风险接受时，先询问用户；可由现有材料直接判定的越界、无证据或非阻断建议由主流程说明判断理由。
+
 ## 探索分工
 
 主会话负责理解需求、提出探查问题、汇总 discovery、判断哪些未知必须问用户；默认必须启动 `explore` subagent 做只读深扫，避免只按用户表述或局部代码自行判断影响范围。仅纯文档、明显 typo、单文件机械小修、明确无代码影响可跳过 subagent，跳过时在 discovery 说明原因。

package/templates/workflow/skills/superspec-propose/SKILL.md

@@ -8,7 +8,7 @@ metadata:
 
 # SuperSpec Propose
 
-你是计划阶段。职责：把探索结论转化为可执行的计划——写 proposal.md / specs / design.md / tasks.md + business-invariants.md + test-contract.md。
+你是计划阶段。职责：把探索结论转化为可执行的计划——写 proposal.md / specs / design.md / tasks.md + test-contract.md。
 
 ## 驱动方式
 
@@ -23,7 +23,7 @@ metadata:
 
 什么问题需要用户确认，判定标准见「待用户确认」一节；就绪或审查后向用户只概括任务可验证性、关键风险/证据覆盖和下一步。
 
-执行 propose-ready 前，对照 critic / architect / test-engineer 的阻塞条件快速自检（非穷尽）：Impact 与 CHAIN/IDC 对账、specs 增量与 proposal 能力变化互相对应、design 的功能点与实现方案能推出 tasks、DEC 已有行内结论并回写、task 粒度单一行为且顺序可执行、每个普通 TDD task 有完整可定位的 `执行依据:`（声明的 TEST 都存在于 test-contract，`边界`/`原因` 具体到该 task 而非套话）、不变量可证伪且覆盖核心行为变化、test-contract 覆盖 Impact 引用的 CHAIN、test-contract 中未绑定任何 task 的 TEST 有明确取舍（绑定到 task 或留待用户豁免决策）。自检不替代审查工作项，只为减少驳回往返。
+执行 propose-ready 前，对照 critic / architect / test-engineer 的阻塞条件快速自检（非穷尽）：Impact 与 CHAIN/IDC 对账、specs 增量与 proposal 能力变化互相对应、design 的功能点与实现方案能推出 tasks、DEC 已有行内结论并回写、task 粒度单一行为且顺序可执行、每个普通 TDD task 有完整可定位的 `执行依据:`（声明的 TEST 都存在于 test-contract，`边界`/`原因` 具体到该 task 而非套话）、specs 中的核心业务规则可验证、test-contract 覆盖 Impact 引用的 CHAIN、test-contract 中未绑定任何 task 的 TEST 有明确取舍（绑定到 task 或留待用户豁免决策）。自检不替代审查工作项，只为减少驳回往返。
 
 人类可读正文默认使用简体中文；OpenSpec 结构标题、规范关键字、命令、路径、JSON 字段、代码标识符保留原文。OpenSpec 生成文档语言不符合预期时，先检查 `openspec/config.yaml` 的官方 `context` 设置；不要在变更文档里添加自定义 `language` 字段。
 
@@ -178,33 +178,19 @@ metadata:
 - 多个行为变化、入口或运行时模块不能形成同一个 RED/GREEN 闭环时拆开；需要“顺便”改多个不相邻模块的 task 在 propose 阶段就拆分或补充任务，不留到 apply 阶段扩大范围
 - 任务按可执行顺序排列：引擎忽略标题、按全文顶格 checkbox 行的先后顺序逐个驱动执行，被依赖的任务必须排在依赖它的任务之前，跨组同样如此（顺序与分组冲突时调整任务归组或拆组）；跨组依赖可在任务行内注明依赖的 task id 作为提示，但注明不改变执行顺序
 
-### business-invariants.md
-格式：
-
-```markdown
-# Business Invariants
-
-- INV-001 用户密码必须加密存储
-- INV-002 订单金额不能为负数
-```
-
-规则：
-- 不变量是本次改动必须保持或新确立的业务规则，必须可违反、可验证——存在能让它失败的具体操作和可观察结果；「系统应稳定」「代码应可维护」这类不可证伪的陈述不算
-- 覆盖本次行为变化触及的核心规则即可，不堆砌与本次改动无关的通用约束
-
 ### test-contract.md
 格式：
 
 ```markdown
 # Test Contract
 
-| test_id | invariant | scenario |
-|---|---|---|
-| TEST-001 | INV-001 | 注册时提交明文密码，落库字段为加密值且不含明文 |
-| TEST-002 | INV-002 | 已登录用户提交金额为 -1 的订单，下单被拒绝并返回校验错误 |
+| test_id | scenario |
+|---|---|
+| TEST-001 | 注册时提交明文密码，落库字段为加密值且不含明文 |
+| TEST-002 | 已登录用户提交金额为 -1 的订单，下单被拒绝并返回校验错误 |
 ```
 
-scenario 写到能推导断言的程度：给定什么条件、发生什么动作、观察到什么结果；不写测试命令和断言代码。「验证功能正常」这类无法推导断言的写法不合格。
+核心业务规则写入对应 `specs/` requirement 和 scenario。test-contract 的 scenario 写到能推导断言的程度：给定什么条件、发生什么动作、观察到什么结果；不写测试命令和断言代码。「验证功能正常」这类无法推导断言的写法不合格。
 
 如果 discovery 含 `## 输入数据来源核查` 的 IDC 项，在测试表后增加 `## 输入数据覆盖验证`：
 
@@ -231,10 +217,12 @@ discovery 含 `## 链路五要素` 时，`proposal.md` `## Impact` 中引用的
 
 答案来自用户时，先登记再勾选；答案来自需求文档、代码证据等外部事实核对时，行内写明证据来源，不伪造用户决策。用户回答含糊、与候选项不匹配或引出新问题时，不视为已确认；复述理解并获得明确答复后再登记。把结论反映到 proposal/design/test-contract 相关内容，勾选行内注明结论要点；确认项作废或重复时改为 `[x]` 并注明理由，不要删除确认项。局部实现细节、命名、普通文件组织和不影响需求/验收/风险的技术微调不要升级为用户确认。
 
-进入 propose 后出现新的业务规则、产品口径、验收标准、示例规范或需求源更新时，不要静默覆盖原计划；默认先在 `proposal.md` 记录 `## 需求变化`，说明变化来源、变化内容、受影响能力、直接修改的文档章节、确认保持不变的范围和处理方式（更新当前 change / 新建后续 change / 暂不处理）。该段是后续增量审查判断“本轮变化”的权威锚点；不得把未受影响的历史设计重新列为本轮待审范围。只有影响技术路线、测试契约或业务不变量时，才同步更新 `design.md`、`test-contract.md` 或 `business-invariants.md`。
+进入 propose 后出现新的业务规则、产品口径、验收标准、示例规范或需求源更新时，不要静默覆盖原计划；默认先在 `proposal.md` 记录 `## 需求变化`，说明变化来源、变化内容、受影响能力、直接修改的文档章节、确认保持不变的范围和处理方式（更新当前 change / 新建后续 change / 暂不处理）。该段是后续增量审查判断“本轮变化”的权威锚点；不得把未受影响的历史设计重新列为本轮待审范围。只有影响规格、技术路线或测试契约时，才同步更新 `specs/`、`design.md` 或 `test-contract.md`。
 
 审查报告是待验证的独立意见，不会自动创造新需求。主流程处理 finding 时先分离 underlying problem 与 recommendation：根据本次 change 的目标、直接证据和明确验收独立判断问题是否成立；问题成立时选择满足既有需求的最小修复。Recommendation 只是非绑定建议，不是验收标准；与用户决定、已确认复用路线或 `## 非目标` 冲突的具体方案不实施，也不得仅为通过审查增加未经确认的基础设施、兼容、额外任务、故障场景或测试义务。若 reviewer 指出的事实证据证明现有方案无法满足用户已确认的强制需求、规格约束或明确验收结果，补足对应结果、契约或证据，而不是默认采用 reviewer 指定的架构；Reviewer 不得自行新增或升级强制要求。
 
+普通计划审查未通过后，主流程拥有整份报告的最终阻塞准入判断权，但不得篡改原报告或把审查意见直接升级为需求。只要报告中存在一个有直接证据、属于本次 change 且影响明确验收或落地的问题，就修改对应材料并重新审查；不要为了让报告“全部正确”而处理其余越界建议。只有整份报告提出的问题均不具备上述阻塞条件时，才可将本次审查结论标记为不阻塞，并按工作流提供的方式留痕。该判断只适用于当前材料；材料变化后必须重新审查，不做部分问题裁决或永久豁免。问题是否成立取决于需求范围、验收口径、风险接受或技术路线时，先询问用户；可由当前材料直接判定的越界、无证据或非阻断建议由主流程说明判断理由。
+
 ## 完成条件
 
 tasks.md 作为计划文档就绪（不是复选框全完成）+ 基础职责文档齐全 → next 返回 propose-ready 命令。
@@ -246,4 +234,4 @@ tasks.md 作为计划文档就绪（不是复选框全完成）+ 基础职责文
 - tdd_required 标注真实
 - 不跳过 transition
 - 不跳过完整审查路径下的审核工作项
-- 审查通过后、推进前不做非必要的文档编辑；绑定审查的内容（proposal/design/tasks/specs/discovery/business-invariants/test-contract）变更会作废已通过的审查并触发重审。
+- 审查通过后、推进前不做非必要的文档编辑；计划材料变更会按当前审查模式和角色职责触发必要的复审。