@seanyao/roll 4.702.4 → 4.706.1

package/CHANGELOG.md

@@ -2,6 +2,81 @@
 
 ## Unreleased
 
+## v4.706.1 — 2026-07-06
+
+### 稳定性(48 小时长跑冲刺:9 个真实故障全部根治)
+- 修掉一类让循环静默停摆数小时的身份错认:建造残留会让后续周期认错自己在哪,现在开工前自动检查并纠正,漂移时大声报警而不是带病硬跑(FIX-1209)`[loop-engine]`
+- 一轮周期产生的坏配置收工时立刻清掉、写入当场被拦,不再留下"机器带病运转"的时间窗(FIX-1210)`[loop-engine]`
+- owner 把卡标成"进行中"抢占后循环真的会让路,不再人机同做一张卡产出两份重复实现;死掉周期留下的卡仍会被正常回收(FIX-1211)`[loop-engine]`
+- 一次发布失败留下的内部标记不再永久挡路,待办卡不会因此被晾几个小时没人领;实战复发的残余路径也已堵上(FIX-1212、FIX-1215)`[loop-engine]`
+- agent 供应商抽风、一个字没输出就超时的情况不再算到卡头上把无辜卡打入冷宫,失败统计不再被污染(FIX-1213)`[loop-engine]`
+- GitHub 偶尔抽风时建 PR 会自动重试,不再一击不中就把整轮成功建造全部作废(FIX-1214)`[loop-engine]`
+- 长寿 PR 分支掉进 CI 事件黑洞（push/sync 事件 GitHub 不投递、零 check-run、合并永远被保护规则卡死）时，pr-loop 自动检测并通过 workflow_dispatch 定向拉起 CI，同时以 ALERT 记录静默场景（FIX-1217）`[loop-engine]`
+- `roll release --yes` 不再在 bump/changelog 提交步被自己的 60 秒测试新鲜度闸拦下：提交前自动重写 `.roll/last-test-pass` 证明并校验树匹配，一键发版全程无需人工垫步；测试后改文件的恶意场景仍会被拒绝（FIX-1207）`[release-management]`
+
+- 发版自动生成的记录性提交(changelog、建卡)不再被当成卡的正式交付,已完成卡的状态不会发版后莫名漂移,卡也不会没做就被标完成(FIX-1206、FIX-1208)`[release-management]`
+- 主仓被弄脏拦下发布时会列出到底哪些文件脏(含暂存区的),不再"说脏又不说哪脏"(FIX-1218)`[loop-engine]`
+
+### 验收与观测
+- 发版前的验收检查能认出现行格式的验收标准清单,不再因"看不见清单"全部豁免放行——验收闸从装饰变回真闸,豁免会留痕(FIX-1216)`[loop-engine]`
+- 协调交付时的判断、验证结论和救场动作会记成日志,终端里能回看,不再只活在聊天窗口(US-OBS-048)`[loop-observability]`
+
+### 物理截图与隐私
+- 截图证据默认只拍被测应用的窗口(测终端拍终端、测网页拍浏览器),不再默认全屏,屏幕上的聊天邮件等隐私不会夹带进证据;全屏须显式声明,找不到窗口的回落会留明确记录(US-PHYSICAL-006)`[capture-tool]`
+- 物理截图拍完先过隐私闸：`roll attest` 在把 PNG 收进证据前校验像素尺寸与声明目标一致——窗口目标误拍成全屏、或未声明的全屏拍摄会被拒绝并记录原因，避免误把敏感桌面内容落库；通过校验的证据附带拍摄目标、请求来源、拍摄时间、是否声明全屏等元数据（US-PHYSICAL-007）`[capture-tool]`
+- 截图证据不再误提交到公开仓库：入库前自动校验 remote 可见性，public/不可判定仓一律拒绝并告警，私有仓正常放行；owner 可显式豁免（US-PHYSICAL-008）`[capture-tool]`
+
+### 护栏
+- 赦免名单（`loop pardon-skip-list`）收编进 `roll doctor pardon` 诊断子命令，旧命令保留为过渡别名（REFACTOR-073）`[loop-engine]`
+
+### 内部工程(护栏审计签字批次落地)
+- 依据护栏大盘点的裁定,十一项整并一次落地:删净退役死代码、重复实现合一(git 环境处理、评审派发、验收清单自愈)、失败归因全系统统一词表与单一判定(外部故障分类、纠错归因、重复失败熔断、失败类别与根因键铺满全部终态记录、终态词表 17 收敛 15)、全局安装陈旧度进 roll doctor 读数、视觉证据校验前移为建卡软提醒(REFACTOR-062、REFACTOR-063、REFACTOR-065、REFACTOR-066、REFACTOR-067、REFACTOR-068、REFACTOR-069、REFACTOR-070、REFACTOR-071、REFACTOR-072、REFACTOR-076)`[loop-engine]`
+
+
+## v4.704.2 — 2026-07-04
+
+### 易用性
+- 安装 roll 时顺手装好 Roll Capture:`npm i -g` 的 postinstall 会自动从 GitHub Release 下载 Roll Capture.app 装到 ~/Applications(macOS;CI/无网/sudo 场景优雅跳过,失败给手动指引绝不让安装失败);`roll setup` 可随时修复重装(US-PHYSICAL-005)`[capture-tool]`
+
+## v4.704.1 — 2026-07-04
+
+### 稳定性（今晚 roll-capture 实战暴露的三个自愈缺口）
+- 构建过程中产生的文件不再留在工作区等人：验收证据随交付进 PR 分支、审计流水自动入库、agent 会话目录自动忽略，bootstrap 检查只拦真正来路不明的文件（FIX-1203）`[loop-engine]`
+- PR 卡在"缺证据"时 pr-loop 会自己修：找到/生成本地证据、附进 PR 分支、重新校验后合并，修不了才发一条告警，不再每五分钟留字条等人（FIX-1204）`[loop-engine]`
+- 选卡不再重做已经在等合并的卡：能从 PR 正文的证据锚点认出自家在途 PR，等合并的卡会显示"awaiting merge of PR #N"并跳过（FIX-1205）`[loop-engine]`
+
+## v4.703.2 — 2026-07-03
+
+### 稳定性（backlog 清仓批次 · 2026-07-03）
+- 每个工作周期结束后会自动清理这一轮留下的构建缓存、临时文件和环境残留，下一轮从干净环境起跑，"本机绿 CI 红"这类脏环境问题少一大类（US-LOOP-088）`[loop-engine]`
+- 新增八项故障注入演练：主仓被污染、验收报告损坏、证据悬空、认证挂掉、元仓脏、并发抢卡、冤枉卡平反、builder 挂死——每项都有可重复夹具证明系统按新契约自愈或明确暂停（US-QA-016 矩阵部分）`[qa-testing]`
+
+### 智能
+- 自动选卡前，默认 agent 会先对候选卡做一次语义排序（哪张更解堵、更紧急），排序只是建议——Hold/依赖/毒丸这些铁律照旧；评估结果带缓存，backlog 没变就不花钱（IDEA-069）`[loop-engine]`
+
+### 物理截图（roll ↔ Roll Capture.app 全链路打通）
+- `physical.screenshot` 正式成为 Roll 管理的工具：协议契约与 Roll Capture.app 的实现逐字段对齐（US-PHYSICAL-001, US-PHYSICAL-002）`[capture-tool]`
+- `roll doctor --tools` 和 `roll setup` 能检测 Roll Capture.app 装没装、有没有录屏权限、收件箱可不可写，并诚实说明权限测的是当前终端宿主（US-PHYSICAL-003）`[capture-tool]`
+- 需要物理截图证据的卡，`roll attest` 会自动请 Roll Capture.app 拍图、把 PNG 收进证据目录并在报告里展示完整拍摄状态链（US-PHYSICAL-004）`[capture-tool]`
+
+### 内部工程
+- 五千多行的循环执行器巨石文件拆成二十多个职责模块（行为零变化，有行数防回归测试守着），后续修 bug 不再牵一发动全身（REFACTOR-060）`[loop-engine]`
+
+## v4.703.1 — 2026-07-03
+
+### 稳定性（北极星冲刺 · 2026-07-03 第一性诊断产物）
+- Builder 干活期间再也碰不了共享主仓：写入会被系统直接拒绝；万一主仓已经脏了，脏东西会被自动收进 `rescue/leaked-*` 隔离分支（附一条还原命令），loop 接着干活，不再连环熔断趴窝（US-LOOP-089）`[loop-engine]`
+- 失败记账分清了"环境的锅"和"卡片的锅"：环境故障（认证挂了、主仓脏了、网断了）不再算到无辜卡头上把它们打入冷宫；新命令 `roll loop pardon-skip-list` 可以平反之前被冤枉的卡（US-LOOP-090）`[loop-engine]`
+- 交付证据和代码从此绑在一起走：验收报告坏了就不发布，证据文件缺了就不合并，Done 只能由"真合并+证据齐全"翻牌；`roll attest audit` 一键体检所有已完成卡的证据链（US-EVID-019）`[acceptance-evidence]`
+
+### 可见性
+- 新命令 `roll north`：北极星面板一眼看到 loop 稳不稳——自主运行了多久、交付率多少、每张产品卡背了几张修复卡、有没有记错账，每项带 14 天趋势图和达标灯；`roll status` 顶部也加了一行速览（US-OBS-046, US-OBS-047）`[loop-observability]`
+- loop 日报不再自相矛盾：修掉了"0 个周期却列出 10 条上月交付"的错报，数据对不上时日报会明确标注"数据降级"而不是装正常（FIX-1202）`[loop-observability]`
+- `roll design` 的实时进展现在只显示这次运行的真实动作，不再把技能说明、其它示例项目的模板、重复的 diff 和底层命令刷屏；完整原始输出仍然保存在 transcript 里（FIX-1076）`[cli-visual]`
+
+### 易用性
+- `roll init` 在识别到产品需求文档且 backlog 为空时，会直接问你「现在就开始设计吗？」，答 y 就接着跑 `roll design`，不用再手动复制那条命令；加 `--yes` 或 `--then design` 可在自动化里一步到位（US-INIT-010）`[init-onboard]`
+
 ## v4.702.4 — 2026-07-02
 
 ### 可见性

package/README.md

@@ -27,6 +27,17 @@ npm install -g @seanyao/roll
 ```
 
 Requirements: Node.js ≥ 22. Roll is a self-contained TypeScript CLI — no runtime engine beyond node.
+On macOS, npm installation also tries to install `Roll Capture.app` from the
+latest `seanyao/roll-capture` GitHub Release into `~/Applications` so physical
+screenshots can run. If the release is private, the installer first tries
+anonymous GitHub access, then retries with `GITHUB_TOKEN`/`GH_TOKEN` or
+`gh auth token` when available; credentials are used only in request headers.
+GitHub requests respect `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` when Node exposes
+the matching fetch dispatcher. CI, headless sessions, non-macOS hosts,
+sudo/root shells, offline downloads, or `ROLL_SKIP_CAPTURE_INSTALL=1` skip this
+step without failing install; when skipped under sudo/root, re-run `roll setup`
+as a regular user so the app installs into that user's `~/Applications`.
+`roll setup` and `roll doctor tools` report the same readiness and repair path.
 
 ## Use
 
@@ -208,8 +219,9 @@ with `roll loop resume` when ready.
 | `roll init` | Diagnose this directory and route setup/onboarding |
 | `roll loop <on\|off\|go\|watch\|runs\|cycles\|cycle\|alert\|…>` | Run, observe, and maintain the autonomous executor |
 | `roll next` | Continue init/onboard with one best next command |
+| `roll north [--json] [--no-color]` | North-star terminal panel for autonomy, delivery rate, fix tax, and attribution errors |
 | `roll release [--dry-run\|--showcase]` | Release planning/flow plus golden-path showcase support |
-| `roll setup [-f\|--force] [--reselect]` / `roll setup skills\|offboard` | Install/sync conventions or remove Roll-owned project artifacts |
+| `roll setup [-f\|--force] [--reselect] [--no-capture-install]` / `roll setup skills\|offboard` | Install/sync conventions, repair Roll Capture.app readiness, or remove Roll-owned project artifacts |
 | `roll status [ci\|pulse] [--json]` | Project health, CI state, and delivery pulse |
 | `roll test [--where] [--reset]` | Run tests through the isolation adapter |
 | `roll update` | Upgrade the global Roll install and re-sync conventions |
@@ -233,12 +245,42 @@ and the Execution Cast report block expose selected/returned/accepted role outco
 The archive rebuild is an on-demand archive and repair renderer for static HTML pages;
 it is not the active delivery truth surface.
 
+- `roll status` starts with a compact North Star line. Read it as the same four
+  `roll north` metrics in one row: autonomous runtime, delivery rate, fix tax,
+  and attribution errors. A dot shows each metric's current state.
+- `roll north` expands those readings into a 14-day panel. Targets are
+  autonomous runtime >=72h, delivery rate >=60%, fix tax <1x, and attribution
+  errors =0. The anti-gaming rules are part of the metric: an effective
+  autonomous day needs at least 6 non-idle attempts, backlog-empty days pause
+  the autonomy clock instead of counting against it, fix tax divides FIX work
+  by US delivery only, and `unknown` attribution is not guessed. `null` means no
+  usable data yet; the panel prints the reason.
 - A backlog row is a claim; merge evidence on `main` and recorded acceptance
   evidence are truth. A premature `✅ Done` claim is shown as drift.
+- Failures are attributed as `env`, `harness`, `card`, or `unknown`. Repeated
+  non-card root causes pause dispatch by root cause and write a diagnostic
+  snapshot with a playbook. When you see dispatch paused, read the snapshot,
+  repair the environment or Roll component named there, then resume. If a card
+  was parked because old env/harness failures polluted skip accounting, use
+  `roll loop pardon-skip-list [--dry-run] [--include-unknown]` to rebuild the
+  skip list from runs and events.
+- Builder cycles keep the main checkout physically read-only while the Builder
+  runs. Dirty or ahead changes that leak into the main checkout are quarantined
+  onto `rescue/leaked-*` refs with a manifest under `.roll/loop/quarantine/`.
+  The manifest names the files and includes the restore command to claim the
+  rescued work.
 - Cycle history is read through the TerminalOutcome vocabulary, not legacy
   free-form summary text.
 - Missing facts render as `?`. A visible `0` means a known zero, not unknown.
 
+Evidence gates are strict for merge. `attest render` failure, dangling
+`ac-map.json` paths, `claimed` AC statuses, and a non-exempt visual card with no
+captured screenshot can block merge. PR bodies carry a `Roll-Evidence` trailer
+so reviewers can jump to the story evidence. Run `roll attest audit [--json]`
+to find dangling evidence references and `evidence_debt` rows. See
+[Acceptance evidence](guide/en/acceptance-evidence.md) and
+[Loop failure handling](guide/en/loop.md#failure-attribution-and-pauses).
+
 `roll supervisor live` is the shipped CLI-first multi-role board. It prints a
 one-frame snapshot for scripts and quick inspection; `roll supervisor live --watch`
 keeps the same board open and redraws it in-place from the same event-backed view