@seanyao/roll 4.714.2 → 4.717.2

package/CHANGELOG.md

@@ -2,6 +2,100 @@
 
 ## Unreleased
 
+## v4.717.2 — 2026-07-17
+
+### 稳定性
+- 已有合并记录的交付在旧 PR 查询缺席时不再被误判为未知
+
+## v4.717.1 — 2026-07-17
+
+### 新功能
+- `roll agent disable/enable` 一键把不靠谱的 agent 撤出或放回派工池 (US-AGENT-050) `[loop]`
+  <!-- evidence: .roll/features/agent-scope/US-AGENT-050/latest/US-AGENT-050-report.html -->
+- loop 能进 git submodule 交付：建造、评审、发布全落在子模块自己的分支
+- 子模块项目基本零配置：卡该落哪个子模块、走哪条分支都能自动推断
+- 纯本地项目不开 PR 也能完成交付，诚实记为已交付
+
+### 自动化流水线
+- 只是在标题提了一嘴卡号的文档 PR，不再被误算成那张卡的交付 (FIX-1270) `[loop]`
+  <!-- evidence: .roll/features/delivery-reconciler/FIX-1270/latest/FIX-1270-report.html -->
+- 交付记账收紧：零提交、跳过验收、验收项没通过的一律拿不到"已交付"
+- 中止的 cycle 不再被无关主干历史冒领成交付，对账只认真实开出的 PR
+- 还有改动没提交时不许发布，已提交的部分不再掩护可能丢失的尾巴
+- 已合并却被卡住的卡可经监督恢复救回一次，漏翻的完成状态也会自动补上
+
+### 可见性
+- Kimi builder 干活时你能实时看到它在做什么，不再长时间无声像卡死
+
+### 稳定性
+- macOS 锁屏不再白烧 cycle：需物理截图的卡挂起等解锁，等待不算失败 (FIX-1268) `[loop]`
+- 浏览器操作结束后 MCP 进程真正清干净，清不掉会大声报错 (FIX-1271) `[loop]`
+  <!-- evidence: .roll/features/browser-automation/FIX-1271/latest/FIX-1271-report.html -->
+- 主 checkout 看门狗不再误杀 builder：只认开工后新造成的泄漏，死因如实标注
+- cycle 善后收紧：被杀干净放手、交接残留不误报、恢复不立即再拦、重试不丢上下文
+- 子模块项目的 cycle 不再卡在准备阶段，真实提交也不再被误判零产出
+
+## v4.716.1 — 2026-07-16
+
+### 外部行为验证(新能力:真实 smoke 不会被模拟冒充)
+- 验收报告新增醒目的"外部行为验证"横幅与表格:像"真实 `npm i -g github:...`、发布后 CLI 启动、线上 OAuth 回调"这类本地证明不了的 AC,现在必须声明 `external-smoke`(隔离环境跑真实命令)或 `owner-attested`(人工签字带批准引用)。只有真实 smoke 通过或有效 owner 认证才是绿色;`verified-in-simulation`(仅 `npm pack` 之类模拟)和 `UNVERIFIED — external smoke not run` 一律非绿,只要有一个外部 AC 不达标横幅就转红——交付不能夸大自己的外部行为 (US-ATTEST-017) `[core+cli]`
+  <!-- evidence: packages/core/test/fixtures/outward-verification/report.html -->
+- 外部 smoke 在隔离的临时 `HOME`/`PREFIX`/工作目录里运行,只执行 spec 里显式声明的命令模板;产物记录 exit code、版本和脱敏摘要,凭据从不落盘。任何真实发布或账号操作永不自动执行,没有声明的授权就不会跑;用 `ROLL_SMOKE_ENV=release`(或 `ci`/`nightly`)指向对应环境,环境不匹配报 `unverified` 而非静默跳过 (US-ATTEST-015/016/017) `[docs]`
+
+### 调度器故障自愈(新能力:launchd 挂了 loop 不再瘫痪)
+- macOS launchd 调度器起不来时,loop 现在有一条 owner 确认的进程级后备通道:`roll loop on` 检测到 launchd bootstrap 失败会如实报告,并给出启动 fallback 的明确指引;fallback 用租约+心跳保证同一时刻只有一个 runner 在跑,启动/停止/异常退出五种路径都会干净收尾,不留孤儿进程 (US-LOOP-107) `[loop]`
+- `roll loop status/on/off` 现在直接呈现 launchd 的失败状态并控制 fallback 调度器的开关——不需要 owner 自己去翻 launchctl (US-LOOP-108) `[cli]`
+- launchd 故障→fallback 接管→launchd 恢复的完整恢复路径已实测验证并写入文档,含用 `launchctl list` 找到当前活跃 loop label 的排查姿势 (US-LOOP-109) `[docs]`
+  <!-- evidence: .roll/features/loop-engine/US-LOOP-109/latest/US-LOOP-109-report.html -->
+
+### 浏览器操作(新能力:托管 Chrome DevTools)
+- Roll 现在能自己开一个隔离的 Chrome 去访问页面、做检查、收集诊断——用的是临时浏览器档案,碰不到你本人的登录态和 cookie,跑完即删。支持导航、DOM 断言、控制台/网络摘要和诊断截图,失败(超时/崩溃)会如实报告,绝不冒充测试通过 (US-BROW-001/002/004) `[cli]`
+- `roll browser setup --dry-run` 先看会装什么、`--confirm` 才真写配置;`roll browser doctor` 分三条通道(托管/交互/截图)报告就绪度,缺什么、怎么补,一目了然 (US-BROW-003) `[cli]`
+- 需要在你已登录的 Chrome 上做一次验证?`roll browser interactive` 走全新的"租约"流程:必须你本人在终端逐次批准(显示要访问哪个站、做什么、多久过期),一次 15 分钟、仅限本机连接,后台任务借不走;到期/取消/进程挂掉都只断开调试连接、绝不关你的浏览器,也读不走 cookie 和密码 (US-BROW-008) `[cli]`
+- 浏览器操作全程记账:并发加锁、租约心跳、诊断信息自动脱敏,谁在什么时候对哪个站做了什么都有据可查 (US-BROW-005) `[loop]`
+- 浏览器产出的证据分类明确:DevTools 截图只算诊断参考,正式视觉验收仍然只认 Roll Capture 的物理截图,两者不会混淆 (US-BROW-006) `[loop]`
+- `roll supervisor next`、`roll doctor --tools` 和故事档案页现在显示浏览器三通道的就绪状态(含租约剩余时间和不可用原因);档案页新增浏览器操作时间线。查不到的事实诚实显示 unknown,绝不把"没记录"当"通过" (US-BROW-009/013) `[cli]`
+- 性能诊断和设备仿真作为可选档位加入托管通道:`roll browser run --perf-profile` 收集页面性能摘要,`--profile "Pixel 7"` 等按设备档仿真,均为诊断用途 (US-BROW-012/014) `[cli]`
+- 更新浏览器操作文档，正式发布交互式 owner-Chrome 通道：需预先开启本地 loopback 远程调试、前台 TTY 单次 owner 批准、15 分钟租约到期/取消、owner-run manual-attest；并明确说明不支持后台调度器、远程端点、cookie 导出和自动启动 Chrome (US-BROW-011) `[docs]`
+- `roll browser update --check` 报告当前 DevTools 传输包版本与可用候选版本（只读，不下载、不安装、不改配置）；`roll browser update --apply --confirm` 经显式确认后执行原子更新，更新前运行冒烟检查，失败则保留原版本 (US-BROW-010) `[cli]`
+- 托管与可选浏览器能力的使用文档齐备(setup/doctor/run/性能/设备仿真) (US-BROW-007/015) `[docs]`
+- 托管通道现在为每次运行启动一个固定版本的 `chrome-devtools-mcp` stdio 会话:完成 MCP initialize/tools-list、校验最小工具清单后才允许执行浏览器动作,任何初始化失败/清单不匹配/进程崩溃都会 fail-loud;生产默认依赖已切到 MCP,原始 WebSocket/CDP 传输不再出现在 CLI/运行时 wiring 中 (US-BROW-016) `[core+infra]`
+- 浏览器动作是一个封闭词表(导航/快照/控制台/网络/截图/点击/填表/按键),每个动作只能映射到清单里批准的那一个 MCP 工具——调用方没有任何办法自己点名工具或下发任意浏览器指令,词表之外一律拒绝并如实报因 (US-BROW-017) `[core]`
+- `roll browser run` 的托管诊断现在真正走上面这条带政策闸的 MCP 通道跑(不再是绕开闸的直连):`--story`/`--url` 必填并记入 ledger 备审计,策略禁用则运行前即拒绝,`--fixture` 降级为明确标注仅测试的假目标接缝 (US-BROW-018) `[core+cli]`
+- 新增 `roll browser doctor --probe`:起一个真实的 chrome-devtools-mcp 进程做活体探测(initialize + tools/list + 清单校验),用临时档案、跑完即清,只有探测通过才把受管通道标为 ready;`roll browser update --apply` 也加了同样的探测闸,探测失败中止更新保留原版本。这个真探针立刻抓出两个假测试掩盖的 bug——通信分帧用错了方言(真服务器是一行一条 JSON,不是 Content-Length 头),以及清单里要求了一个真服务器根本没有的工具;两处都已修正,探针现在对真服务器全绿 (US-BROW-019) `[cli+infra]`
+  <!-- evidence: .roll/features/browser-automation/US-BROW-019/latest/US-BROW-019-report.html -->
+- 新增真实浏览器回归闸:`pnpm test:browser-live`(设 `ROLL_BROWSER_LIVE=1` 启用)起一个本地 HTTP 目标 + 真 chrome-devtools-mcp + 真临时 Chrome,把导航/快照/控制台/网络/截图/重定向拒绝/超时清理等 12 个场景全跑一遍,只有真进程真验证才算 verified——fixture 报告永远不能通过这道闸,环境不具备时大声报 unavailable 而不是静默跳过;CI 配了专门的 Chrome-capable lane 每晚跑 (US-BROW-020) `[cli+infra]`
+  <!-- evidence: .roll/features/browser-automation/US-BROW-020/latest/US-BROW-020-report.html -->
+- 这道闸首跑就抓出四个假测试互相掩护的真 bug 并全部修复:policy 文件的 managed 通道配置从来没被真正读进去(缩进/snake_case/数组全解析错,写了 enabled: true 也永远 lane_disabled)、真服务器的截图字节被丢弃、真服务器的散文体回复(不是 JSON)不被理解、快照/点击的参数名不符 (US-BROW-020) `[cli+infra]`
+- 浏览器操作文档与命令帮助全面对齐真实 MCP 通道:说清固定版本 sidecar 的生命周期、静态检查与 `doctor --probe` 活体探测的区别、policy 开闸姿势、live gate 前置条件与全部失败排查路径;删除一切把 fixture 当真实运行的表述,附真实运行与被拒两份逐字 transcript(2026-07-16 实录),并加锁测试防止文档再漂移 (US-BROW-021) `[docs]`
+- 交互通道(owner Chrome)的租约与操作现在真的写进台账:谁批准的租约、到期/取消、执行了什么动作都有记录,`roll browser doctor` 和档案页里的 interactive 一栏不再永远显示 unknown (US-BROW-022) `[loop]`
+- 截图证据的"物理 vs 诊断"裁决现在真正生效:Roll Capture 的物理截图经 CaptureBridge 落盘并进验收链路,DevTools 截图只算诊断参考——想拿 DevTools 截图冒充视觉验收会被分类器拦下 (US-BROW-023) `[loop]`
+### 稳定性
+- 无验收清单的卡不再被误拦导致无法 publish；缺少验收证据时循环会把工作明确挂起待人复评，不再静默丢弃 (FIX-1256) `[loop]`
+  <!-- evidence: .roll/features/loop-engine/FIX-1256/latest/FIX-1256-report.html -->
+- cursor 不再被派去 builder 任务，避免工作泄漏到共享主 checkout 导致 cycle 被隔离 (FIX-1257) `[loop]`
+  <!-- evidence: .roll/features/loop-engine/FIX-1257/spec.md -->
+- Supervisor 手动合并闸（`repair-evidence` / manual-merge diagnostics）现在与 reconcile 路径一样，同时识别 GitHub CheckRun 的 `conclusion` 和 StatusContext 的 `state`（如 Vercel）。以前只看 `conclusion`，带 StatusContext 的全绿 PR 会被判成 CI unknown，手动合并闸卡死；现在两类检查共用 `reduceStatusCheckRollup`，全绿可合并、含红可拒绝 (FIX-1252) `[loop]`
+- `roll story new --help` 不再把用户导向已退役的裸 `roll index` 命令，也不再声称会刷新不存在的 dossier；帮助文案与真实命令面对齐（仅刷新 `.roll/index.json` 缓存，且 `--no-index` 只是延后该缓存），并新增回归断言锁住这个一致态 (FIX-1251) `[cli]`
+  <!-- evidence: .roll/features/cli-simplification/FIX-1251/latest/FIX-1251-report.html -->
+- 验收/评审报告不再把终端文本输出硬塞进 `<img>` 渲染成破图:真图片照旧显示图片,文本产物内联成可读文本块,按实际产物类型渲染 (FIX-1250) `[loop]`
+- 连续跑多张卡的 `roll loop go` 不再"跑完一张就无故暂停":旧事件里秒/毫秒混用的时间戳会让历史暂停信号被误认成刚发生的,现已统一换算后再比较——这是 6 月下旬以来多卡连跑瘫痪的总根因 (FIX-1255) `[loop]`
+- `roll loop go` 的启动横幅现在显示真正生效的范围(而不是本次命令行解析的范围);沿用上个 goal 的范围时会明确标注来源,新增 `--all` 一键回到全量 (FIX-1253) `[cli]`
+- 上一个 goal 完成后再次 `roll loop go` 不再报"goal is already complete"死锁:完成的 goal 自动归档到 `goal-archive/`,新 goal 直接开跑,有事件可追溯 (FIX-1254) `[loop]`
+- 合并对账不再被 force-push 淘汰的旧提交的失败 CI 记录误导:只看 PR 当前提交的检查结果,绿就是绿,修复后重推的 PR 能正常自动合并 (FIX-1258) `[loop]`
+- `roll browser doctor` interactive 通道不再把 9222 端口任意进程当 Chrome ready，现在会经 /json/version 验真 (FIX-1264) `[loop]`
+  <!-- evidence: .roll/features/loop-engine/FIX-1264/latest/FIX-1264-report.html -->
+- `roll north` 自主运行时长现在按 14 天窗口累计合格每日时长，不再把最近一段未中断时长误当成总值 (FIX-1265) `[loop]`
+  <!-- evidence: .roll/features/loop-observability/FIX-1265/latest/FIX-1265-report.html -->
+- 账本和 `roll loop cycles` 里 reasonix 跑的活不再显示错的 model:usage 数据缺 model 字段时回填本 cycle 实际派出的那个,不再被解析器硬编码的旧默认值覆盖;历史错账已一并修正 (FIX-1259) `[loop]`
+- "CI 绿 + 独立 evaluator 认可"的挂起 PR 现在自动补验收件→转正→合并,不再等人手工跑三条命令;证据存疑的仍留在挂起通道并发告警,绝不静默转正 (FIX-1260) `[loop]`
+- cycle 失败不再一律坍缩成看不懂的 `unknown_failure`:验收命令被白名单拒绝、约定界面没被截到、验收证据无法合并三类失败现在给出确定性归因和修复指引;熔断器也不再把已修好的卡的历史失败信号反复算进当前窗口——守夜期间一夜误停 5+ 次的总根因 (FIX-1261) `[loop]`
+- 五处"配置该管的事源码写死"清扫:评审报告不再回填假 model、evaluator 名单不再伪造 reasonix 身份、dashboard 不再硬编码 owner 的机器路径、死配置旋钮移除、supervisor 身份改为配置驱动 (FIX-1262) `[loop]`
+- 浏览器真相采集器现在吃统一注入的时钟(消除 collectedAt 竞态),physical_terminal 声明写错类型会大声报错而不是被静默当成"没有" (FIX-1263) `[loop]`
+- 提交主题里光写一个卡号不再算交付证据:判定一张卡"已交付"必须有 PR、CI run 或账本记录的实锤关联,防止误把提法当交付 (FIX-1266) `[loop]`
+- builder 硬轮换上线:任意连续两个 cycle 不会派同一个 builder(评估 harness 对不同 agent 的归一化能力);轮换把候选池排空时会大声报错而不是静默复用,可用 `loop_safety.builder_no_consecutive_repeat` 配置开关 (FIX-1267) `[loop]`
+  <!-- evidence: .roll/features/loop-engine/FIX-1267/latest/FIX-1267-report.html -->
+
 ## v4.714.2 — 2026-07-14
 
 ### 稳定性

package/README.md

@@ -125,7 +125,9 @@ profiles, evidence, Evaluator, and release gates:
   release gates. `roll loop pause` / `roll loop off` return control to guided
   operation; `roll loop off --all` is the machine-wide emergency stop for every
   local `com.roll.*` LaunchAgent; `roll loop resume` / `roll loop on` switch
-  back explicitly.
+  back explicitly. If macOS launchd bootstrap fails, `roll loop on` exits
+  unarmed and offers `roll loop fallback start --confirm` as an owner-confirmed,
+  non-persistent fallback; repair launchd first when possible.
 - **Attest and evidence are story-scoped**. A Story is accepted through its own Acceptance Review Page (`latest/<id>-review.html`), AC map, and screenshots/test artifacts. `latest/<id>-report.html` remains a legacy alias for one release cycle.
 
 Agent bindings are declared in two files: `~/.roll/agents.yaml` for Machine Scope
@@ -283,6 +285,15 @@ to find dangling evidence references and `evidence_debt` rows. See
 [Acceptance evidence](guide/en/acceptance-evidence.md) and
 [Loop failure handling](guide/en/loop.md#failure-attribution-and-pauses).
 
+Behavior Roll cannot prove locally — a real `npm i -g github:...`, a published
+CLI's first run, a live OAuth callback — must declare an `external-smoke` or
+`owner-attested` verification path. The attest report shows an **Outward
+verification** banner: only a real smoke pass (or valid owner attestation) is
+green; `verified-in-simulation` (e.g. `npm pack`) and `UNVERIFIED — external
+smoke not run` are never green, so acceptance cannot overstate outward behavior.
+No real publish or account action ever runs without a declared authority. See
+[Outward behavior verification](guide/en/acceptance-evidence.md#outward-behavior-verification).
+
 `roll supervisor live` is the shipped CLI-first multi-role board. It prints a
 one-frame snapshot for scripts and quick inspection; `roll supervisor live --watch`
 keeps the same board open and redraws it in-place from the same event-backed view
@@ -310,7 +321,7 @@ Published as a single npm package `@seanyao/roll`: `dist/` (the CLI bundled to o
 | | |
 |---|---|
 | **Start here** | [Getting started](guide/en/getting-started.md) · [Overview & architecture](guide/en/overview.md) · [Engineering methodology](guide/en/methodology.md) |
-| **Daily driving** | [The loop (autonomous executor)](guide/en/loop.md) · [Tools & policy](guide/en/tools.md) · [Configuration](guide/en/configuration.md) · [Pricing & cost](guide/en/pricing.md) · [FAQ](guide/en/faq.md) |
+| **Daily driving** | [The loop (autonomous executor)](guide/en/loop.md) · [Tools & policy](guide/en/tools.md) · [Browser operations (managed + interactive lanes; optional diagnostics are opt-in only)](guide/en/browser-operations.md) · [Configuration](guide/en/configuration.md) · [Pricing & cost](guide/en/pricing.md) · [FAQ](guide/en/faq.md) |
 | **Quality machinery** | [Acceptance evidence (`roll attest`)](guide/en/acceptance-evidence.md) · [Evidence lifecycle](guide/en/acceptance-evidence.md#lifecycle-in-three-stages) · [Consistency & release gate](guide/en/consistency.md) · [Cross-agent pairing](guide/en/pairing.md) · [Peer review](guide/en/peer.md) · [Test isolation](guide/en/test-isolation.md) |
 | **Under the hood** | [Architecture: layers · domain · invariants](docs/architecture.md) · [Verification system](docs/verification.md) · [Manifesto](docs/manifesto.md) |
 

package/dist/postinstall.mjs

@@ -131,7 +131,34 @@ var TRUTH_FIELD_REGISTRY = [
   { field: "scope", surface: "event:release:waiver", anchor: "release_waiver", writer: "(retired US-REL-007 \u2014 historical release:waiver events only; no writer remains)", kind: "authoritative" },
   { field: "expiresSec", surface: "event:release:waiver", anchor: "release_waiver", writer: "(retired US-REL-007 \u2014 historical release:waiver events only; no writer remains)", kind: "authoritative" },
   { field: "operator", surface: "event:release:waiver", anchor: "release_waiver", writer: "(retired US-REL-007 \u2014 historical release:waiver events only; no writer remains)", kind: "authoritative" },
-  { field: "ts", surface: "event:release:waiver", anchor: "release_waiver", writer: "(retired US-REL-007 \u2014 historical release:waiver events only; no writer remains)", kind: "authoritative" }
+  { field: "ts", surface: "event:release:waiver", anchor: "release_waiver", writer: "(retired US-REL-007 \u2014 historical release:waiver events only; no writer remains)", kind: "authoritative" },
+  // ── Browser Operations (US-BROW-001) ───────────────────────────────────
+  { field: "runId", surface: "browser", anchor: "browser_run", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "idempotencyKey", surface: "browser", anchor: "browser_run", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "storyId", surface: "browser", anchor: "browser_run", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "cycleId", surface: "browser", anchor: "browser_run", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "caller", surface: "browser", anchor: "browser_run", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "lane", surface: "browser", anchor: "browser_run", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "requestedOrigin", surface: "browser", anchor: "browser_run", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "policyFingerprint", surface: "browser", anchor: "browser_run", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "holderTokenHash", surface: "browser", anchor: "browser_run", writer: "BrowserOperationLedger / BrowserLeaseLock", kind: "authoritative" },
+  { field: "state", surface: "browser", anchor: "browser_run", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "result", surface: "browser", anchor: "browser_run", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "leaseId", surface: "browser", anchor: "browser_lease", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "origin", surface: "browser", anchor: "browser_lease", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "expiresAt", surface: "browser", anchor: "browser_lease", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "ownerApproval", surface: "browser", anchor: "browser_lease", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "holderPid", surface: "browser", anchor: "browser_lease", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "holderProcessIdentity", surface: "browser", anchor: "browser_lease", writer: "BrowserLeaseLock", kind: "authoritative" },
+  { field: "heartbeatAt", surface: "browser", anchor: "browser_lease", writer: "BrowserLeaseLock", kind: "authoritative" },
+  { field: "endpointHash", surface: "browser", anchor: "browser_lease", writer: "BrowserOperationService", kind: "authoritative" },
+  { field: "artifactId", surface: "browser", anchor: "browser_diagnostic", writer: "BrowserOperationService via DevToolsAdapter", kind: "authoritative" },
+  { field: "digest", surface: "browser", anchor: "browser_diagnostic", writer: "BrowserOperationService via DevToolsAdapter", kind: "authoritative" },
+  { field: "bytes", surface: "browser", anchor: "browser_diagnostic", writer: "BrowserOperationLedger", kind: "authoritative" },
+  { field: "untrusted", surface: "browser", anchor: "browser_diagnostic", writer: "BrowserOperationLedger", kind: "authoritative" },
+  { field: "diagnosticOnly", surface: "browser", anchor: "browser_diagnostic", writer: "BrowserOperationLedger", kind: "authoritative" },
+  { field: "failure", surface: "browser", anchor: "browser_diagnostic", writer: "BrowserOperationLedger", kind: "authoritative" },
+  { field: "captureRequestId", surface: "browser", anchor: "browser_capture_link", writer: "CaptureBridge", kind: "authoritative" }
 ];
 
 // packages/spec/dist/types/story.js