@seanyao/roll 4.702.4 → 4.703.2

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 ## Unreleased
 
+## v4.703.2 — 2026-07-03
+
+### 稳定性（backlog 清仓批次 · 2026-07-03）
+- 每个工作周期结束后会自动清理这一轮留下的构建缓存、临时文件和环境残留，下一轮从干净环境起跑，"本机绿 CI 红"这类脏环境问题少一大类（US-LOOP-088）`[loop-engine]`
+- 新增八项故障注入演练：主仓被污染、验收报告损坏、证据悬空、认证挂掉、元仓脏、并发抢卡、冤枉卡平反、builder 挂死——每项都有可重复夹具证明系统按新契约自愈或明确暂停（US-QA-016 矩阵部分）`[qa-testing]`
+
+### 智能
+- 自动选卡前，默认 agent 会先对候选卡做一次语义排序（哪张更解堵、更紧急），排序只是建议——Hold/依赖/毒丸这些铁律照旧；评估结果带缓存，backlog 没变就不花钱（IDEA-069）`[loop-engine]`
+
+### 物理截图（roll ↔ Roll Capture.app 全链路打通）
+- `physical.screenshot` 正式成为 Roll 管理的工具：协议契约与 Roll Capture.app 的实现逐字段对齐（US-PHYSICAL-001, US-PHYSICAL-002）`[capture-tool]`
+- `roll doctor --tools` 和 `roll setup` 能检测 Roll Capture.app 装没装、有没有录屏权限、收件箱可不可写，并诚实说明权限测的是当前终端宿主（US-PHYSICAL-003）`[capture-tool]`
+- 需要物理截图证据的卡，`roll attest` 会自动请 Roll Capture.app 拍图、把 PNG 收进证据目录并在报告里展示完整拍摄状态链（US-PHYSICAL-004）`[capture-tool]`
+
+### 内部工程
+- 五千多行的循环执行器巨石文件拆成二十多个职责模块（行为零变化，有行数防回归测试守着），后续修 bug 不再牵一发动全身（REFACTOR-060）`[loop-engine]`
+
+## v4.703.1 — 2026-07-03
+
+### 稳定性（北极星冲刺 · 2026-07-03 第一性诊断产物）
+- Builder 干活期间再也碰不了共享主仓：写入会被系统直接拒绝；万一主仓已经脏了，脏东西会被自动收进 `rescue/leaked-*` 隔离分支（附一条还原命令），loop 接着干活，不再连环熔断趴窝（US-LOOP-089）`[loop-engine]`
+- 失败记账分清了"环境的锅"和"卡片的锅"：环境故障（认证挂了、主仓脏了、网断了）不再算到无辜卡头上把它们打入冷宫；新命令 `roll loop pardon-skip-list` 可以平反之前被冤枉的卡（US-LOOP-090）`[loop-engine]`
+- 交付证据和代码从此绑在一起走：验收报告坏了就不发布，证据文件缺了就不合并，Done 只能由"真合并+证据齐全"翻牌；`roll attest audit` 一键体检所有已完成卡的证据链（US-EVID-019）`[acceptance-evidence]`
+
+### 可见性
+- 新命令 `roll north`：北极星面板一眼看到 loop 稳不稳——自主运行了多久、交付率多少、每张产品卡背了几张修复卡、有没有记错账，每项带 14 天趋势图和达标灯；`roll status` 顶部也加了一行速览（US-OBS-046, US-OBS-047）`[loop-observability]`
+- loop 日报不再自相矛盾：修掉了"0 个周期却列出 10 条上月交付"的错报，数据对不上时日报会明确标注"数据降级"而不是装正常（FIX-1202）`[loop-observability]`
+- `roll design` 的实时进展现在只显示这次运行的真实动作，不再把技能说明、其它示例项目的模板、重复的 diff 和底层命令刷屏；完整原始输出仍然保存在 transcript 里（FIX-1076）`[cli-visual]`
+
+### 易用性
+- `roll init` 在识别到产品需求文档且 backlog 为空时，会直接问你「现在就开始设计吗？」，答 y 就接着跑 `roll design`，不用再手动复制那条命令；加 `--yes` 或 `--then design` 可在自动化里一步到位（US-INIT-010）`[init-onboard]`
+
 ## v4.702.4 — 2026-07-02
 
 ### 可见性

package/README.md

@@ -208,6 +208,7 @@ with `roll loop resume` when ready.
 | `roll init` | Diagnose this directory and route setup/onboarding |
 | `roll loop <on\|off\|go\|watch\|runs\|cycles\|cycle\|alert\|…>` | Run, observe, and maintain the autonomous executor |
 | `roll next` | Continue init/onboard with one best next command |
+| `roll north [--json] [--no-color]` | North-star terminal panel for autonomy, delivery rate, fix tax, and attribution errors |
 | `roll release [--dry-run\|--showcase]` | Release planning/flow plus golden-path showcase support |
 | `roll setup [-f\|--force] [--reselect]` / `roll setup skills\|offboard` | Install/sync conventions or remove Roll-owned project artifacts |
 | `roll status [ci\|pulse] [--json]` | Project health, CI state, and delivery pulse |
@@ -233,12 +234,42 @@ and the Execution Cast report block expose selected/returned/accepted role outco
 The archive rebuild is an on-demand archive and repair renderer for static HTML pages;
 it is not the active delivery truth surface.
 
+- `roll status` starts with a compact North Star line. Read it as the same four
+  `roll north` metrics in one row: autonomous runtime, delivery rate, fix tax,
+  and attribution errors. A dot shows each metric's current state.
+- `roll north` expands those readings into a 14-day panel. Targets are
+  autonomous runtime >=72h, delivery rate >=60%, fix tax <1x, and attribution
+  errors =0. The anti-gaming rules are part of the metric: an effective
+  autonomous day needs at least 6 non-idle attempts, backlog-empty days pause
+  the autonomy clock instead of counting against it, fix tax divides FIX work
+  by US delivery only, and `unknown` attribution is not guessed. `null` means no
+  usable data yet; the panel prints the reason.
 - A backlog row is a claim; merge evidence on `main` and recorded acceptance
   evidence are truth. A premature `✅ Done` claim is shown as drift.
+- Failures are attributed as `env`, `harness`, `card`, or `unknown`. Repeated
+  non-card root causes pause dispatch by root cause and write a diagnostic
+  snapshot with a playbook. When you see dispatch paused, read the snapshot,
+  repair the environment or Roll component named there, then resume. If a card
+  was parked because old env/harness failures polluted skip accounting, use
+  `roll loop pardon-skip-list [--dry-run] [--include-unknown]` to rebuild the
+  skip list from runs and events.
+- Builder cycles keep the main checkout physically read-only while the Builder
+  runs. Dirty or ahead changes that leak into the main checkout are quarantined
+  onto `rescue/leaked-*` refs with a manifest under `.roll/loop/quarantine/`.
+  The manifest names the files and includes the restore command to claim the
+  rescued work.
 - Cycle history is read through the TerminalOutcome vocabulary, not legacy
   free-form summary text.
 - Missing facts render as `?`. A visible `0` means a known zero, not unknown.
 
+Evidence gates are strict for merge. `attest render` failure, dangling
+`ac-map.json` paths, `claimed` AC statuses, and a non-exempt visual card with no
+captured screenshot can block merge. PR bodies carry a `Roll-Evidence` trailer
+so reviewers can jump to the story evidence. Run `roll attest audit [--json]`
+to find dangling evidence references and `evidence_debt` rows. See
+[Acceptance evidence](guide/en/acceptance-evidence.md) and
+[Loop failure handling](guide/en/loop.md#failure-attribution-and-pauses).
+
 `roll supervisor live` is the shipped CLI-first multi-role board. It prints a
 one-frame snapshot for scripts and quick inspection; `roll supervisor live --watch`
 keeps the same board open and redraws it in-place from the same event-backed view