@siming-org/cli 0.8.0 → 0.8.2

package/dist/index.js

@@ -675,15 +675,764 @@ import { readFileSync as readFileSync5 } from "fs";
 import {
   ARTIFACT_TYPES
 } from "@siming-org/core";
+
+// src/client/checks/types.ts
+var NA_PHRASES = ["\u4E0D\u9002\u7528", "N/A", "not applicable", "n-a"];
+var MIN_AI_CHECK_ITEM_LENGTH = 15;
+var VAGUE_AI_CHECK_BLACKLIST = ["\u5DF2\u5B8C\u6210", "\u901A\u8FC7", "\u5B8C\u6210", "done", "ok", "pass"];
+
+// src/client/checks/git-checks.ts
+function naIfRepoUnavailable(ctx) {
+  if (ctx.vcsLoadError !== void 0) {
+    return { type: "", status: "fail", detail: `\u9879\u76EE vcs \u914D\u7F6E\u8BFB\u53D6\u5931\u8D25\uFF1A${ctx.vcsLoadError}\u2014\u2014\u65E0\u6CD5\u786E\u8BA4\u95E8\u7981\u542F\u7528\u72B6\u6001\uFF08\u62D2\u9759\u9ED8\u964D\u7EA7\uFF09\u3002\u4FEE\u590D\uFF1A\u786E\u8BA4 server \u53EF\u8FBE\u4E0E\u9879\u76EE\u914D\u7F6E\u540E\u91CD\u8DD1 task check` };
+  }
+  if (ctx.vcs.enabled === false) {
+    return na("\u9879\u76EE vcs.enabled=false\uFF08\u58F0\u660E\u65E0\u5206\u652F\u6A21\u578B\uFF09\uFF0Cgit \u7C7B\u68C0\u67E5\u8C41\u514D");
+  }
+  if (ctx.repoPath === null) {
+    return na(`\u4ED3\u5E93\u4E0D\u53EF\u7528\uFF1A${ctx.repoProbeDetail}`);
+  }
+  return null;
+}
+function na(reason) {
+  return { type: "", status: "not_applicable", detail: reason };
+}
+function fail2(ctx, type, rootCause, fix) {
+  return { type, status: "fail", detail: `${rootCause}\u3002\u4FEE\u590D\uFF1A${fix}\uFF08\u5F53\u524D nodeId=${ctx.nodeId}\uFF09` };
+}
+async function currentBranch(ctx) {
+  const r = await ctx.runGit(["rev-parse", "--abbrev-ref", "HEAD"], ctx.repoPath);
+  return r.ok ? r.stdout.trim() : null;
+}
+async function checkBranchExists(ctx) {
+  const type = "git-branch-exists";
+  const guard = naIfRepoUnavailable(ctx);
+  if (guard) return { ...guard, type };
+  const branch = await currentBranch(ctx);
+  if (branch === null) {
+    return fail2(ctx, type, "\u65E0\u6CD5\u8BFB\u53D6\u5F53\u524D\u5206\u652F\uFF08git rev-parse --abbrev-ref HEAD \u5931\u8D25\uFF09", "\u786E\u8BA4\u5728\u4EFB\u52A1\u5206\u652F\u4E0A\u6267\u884C\uFF0C\u6216\u68C0\u67E5\u4ED3\u5E93\u72B6\u6001");
+  }
+  if (branch === "HEAD") {
+    return fail2(ctx, type, "\u5904\u4E8E detached HEAD \u72B6\u6001\uFF08\u672A\u68C0\u51FA\u4EFB\u4F55\u5206\u652F\uFF09", `git checkout \u4EFB\u52A1\u5206\u652F\uFF08\u987B\u5339\u914D ${ctx.branchPattern} \u524D\u7F00\uFF09`);
+  }
+  if (!branch.startsWith(ctx.branchPattern)) {
+    return fail2(ctx, type, `\u5F53\u524D\u5206\u652F\u300C${branch}\u300D\u4E0D\u5339\u914D\u4EFB\u52A1\u5206\u652F\u89C4\u5219\u300C${ctx.branchPattern} \u524D\u7F00\u300D`, `\u5207\u5230\u4EFB\u52A1\u5206\u652F\uFF08feature/Txxxxxxxx...\uFF09\u540E\u518D\u63A8\u8FDB`);
+  }
+  return { type, status: "pass", detail: `\u5F53\u524D\u5206\u652F ${branch}` };
+}
+async function baseMergedIntoHead(ctx, base) {
+  const f = await ctx.runGit(["fetch", "origin", base], ctx.repoPath);
+  if (!f.ok) return null;
+  const r = await ctx.runGit(["merge-base", "--is-ancestor", `origin/${base}`, "HEAD"], ctx.repoPath);
+  return r.ok;
+}
+async function checkBaseMerged(ctx) {
+  const type = "git-base-merged";
+  const guard = naIfRepoUnavailable(ctx);
+  if (guard) return { ...guard, type };
+  const waived = findWaivedDecision(ctx, "ALIGN");
+  if (waived !== null) {
+    return { type, status: "not_applicable", detail: `ALIGN \u8BB0\u5F55\u542B merge-waived \u8C41\u514D\uFF08decision ${waived}\uFF0C\u7528\u6237\u660E\u793A\u4E0D\u9700\u5408\u5E76\uFF09` };
+  }
+  if (ctx.baseBranch === null) {
+    return fail2(ctx, type, "\u57FA\u7840\u5206\u652F\u672A\u77E5\uFF08ALIGN \u8BB0\u5F55\u672A\u5199 baseBranch \u4E14\u9879\u76EE\u672A\u914D\u7F6E vcs.baseBranch\uFF09", "record-set \u5199 ALIGN.baseBranch\uFF0C\u6216 siming project update --vcs-base-branch <\u5206\u652F>");
+  }
+  const merged = await baseMergedIntoHead(ctx, ctx.baseBranch);
+  if (merged === null) {
+    return fail2(ctx, type, `git fetch origin ${ctx.baseBranch} \u5931\u8D25\u2014\u2014\u65E0\u6CD5\u4EE5\u8FDC\u7A0B\u6700\u65B0\u5F15\u7528\u5224\u5B9A\uFF08\u62D2\u6309\u9648\u65E7 ref \u8BEF\u5224\uFF09`, "\u68C0\u67E5\u7F51\u7EDC/\u8FDC\u7A0B\u53EF\u8FBE\u540E\u91CD\u8BD5\uFF1B\u786E\u8BA4\u5206\u652F\u5B58\u5728\u4E8E origin");
+  }
+  if (!merged) {
+    return fail2(ctx, type, `origin/${ctx.baseBranch} \u5C1A\u672A\u5408\u5165\u5F53\u524D\u5206\u652F`, `\u6309 ALIGN \u8282\u70B9\u8981\u6C42\u5408\u5E76\u57FA\u7840\u5206\u652F\u8FDC\u7A0B\u6700\u65B0\u4EE3\u7801\uFF08merge ${ctx.baseBranch} \u2192 \u5F53\u524D\u5206\u652F\uFF09\u540E\u91CD\u8BD5`);
+  }
+  return { type, status: "pass", detail: `origin/${ctx.baseBranch} \u5DF2\u5408\u5165 HEAD` };
+}
+function findWaivedDecision(ctx, nodeId) {
+  const record = ctx.nodeRecords[nodeId];
+  const hit = record?.decisions.find((d) => d.topic === "merge-waived" && d.decision.trim() !== "");
+  return hit ? hit.id : null;
+}
+async function checkWorktreeClean(ctx) {
+  const type = "git-worktree-clean";
+  const guard = naIfRepoUnavailable(ctx);
+  if (guard) return { ...guard, type };
+  const r = await ctx.runGit(["status", "--porcelain"], ctx.repoPath);
+  if (!r.ok) {
+    return fail2(ctx, type, `git status \u5931\u8D25\uFF1A${firstLine(r.stderr)}`, "\u68C0\u67E5\u4ED3\u5E93\u53EF\u7528\u6027");
+  }
+  if (r.stdout.trim() !== "") {
+    const count = r.stdout.trim().split("\n").length;
+    const sample = r.stdout.trim().split("\n").slice(0, 3).join("; ");
+    return fail2(ctx, type, `\u5DE5\u4F5C\u6811\u4E0D\u5E72\u51C0\uFF08${count} \u5904\u672A\u63D0\u4EA4\u53D8\u66F4\uFF1A${sample}\uFF09`, "\u5B8C\u6210\u672C\u8282\u70B9\u6210\u679C\u63D0\u4EA4\uFF08\u6216\u5199 .gitignore / \u8C41\u514D\u7559\u75D5\uFF09\u540E\u518D\u63A8\u8FDB");
+  }
+  return { type, status: "pass", detail: "\u5DE5\u4F5C\u6811\u5E72\u51C0" };
+}
+async function checkArchiveMerged(ctx) {
+  const type = "git-archive-merged";
+  const guard = naIfRepoUnavailable(ctx);
+  if (guard) return { ...guard, type };
+  if (ctx.vcs.archiveToBase === false) {
+    return { type, status: "not_applicable", detail: "\u9879\u76EE vcs.archiveToBase=false\uFF08\u58F0\u660E\u65E0\u5F52\u6863\u5408\u5E76\u6D41\u7A0B\uFF09" };
+  }
+  const hasSuccessor = (ctx.edges ?? []).some((e) => e.from === ctx.nodeId);
+  if (hasSuccessor) {
+    return {
+      type,
+      status: "not_applicable",
+      detail: "\u975E\u7EC8\u6001\u5F62\u6001\uFF08\u5B58\u5728\u540E\u7EE7\u8282\u70B9\uFF09\uFF1A\u4EE3\u7801\u5F52\u6863\u7531\u5BA1\u6279\u901A\u8FC7\u540E\u7684\u5F52\u6863\u5F85\u529E\u627F\u8F7D\uFF0Cadvance \u65F6\u5F52\u6863\u5C1A\u672A\u53D1\u751F"
+    };
+  }
+  if (ctx.baseBranch === null) {
+    return fail2(ctx, type, "\u57FA\u7840\u5206\u652F\u672A\u77E5\uFF08ACCEPT \u524D\u7F6E\uFF1AALIGN \u5E94\u5DF2\u843D\u76D8 baseBranch\uFF09", "record-set \u5199 ALIGN.baseBranch\uFF0C\u6216 siming project update --vcs-base-branch <\u5206\u652F>");
+  }
+  const base = ctx.baseBranch;
+  const count = await ctx.runGit(["rev-list", "--count", `${base}..HEAD`], ctx.repoPath);
+  if (count.ok && count.stdout.trim() === "0") {
+    return { type, status: "not_applicable", detail: `\u4EFB\u52A1\u5206\u652F\u76F8\u5BF9 ${base} \u96F6\u63D0\u4EA4\uFF08\u65E0\u4EE3\u7801\u6539\u52A8\uFF0C\u65E0\u9700\u5408\u5E76\uFF09` };
+  }
+  const fetch2 = await ctx.runGit(["fetch", "origin", base], ctx.repoPath);
+  if (!fetch2.ok) {
+    return fail2(ctx, type, `git fetch origin ${base} \u5931\u8D25\u2014\u2014\u672C\u5730\u4E0E\u8FDC\u7A0B\u4E00\u81F4\u6027\u65E0\u4ECE\u5224\u5B9A\uFF08\u62D2\u6309\u9648\u65E7 ref \u8BEF\u5224\uFF09`, "\u68C0\u67E5\u7F51\u7EDC/\u8FDC\u7A0B\u53EF\u8FBE\u540E\u91CD\u8BD5");
+  }
+  const ancestor = await ctx.runGit(["merge-base", "--is-ancestor", "HEAD", base], ctx.repoPath);
+  if (!ancestor.ok) {
+    return fail2(ctx, type, `\u57FA\u7840\u5206\u652F ${base} \u5C1A\u672A\u5305\u542B\u4EFB\u52A1\u5206\u652F HEAD\uFF08\u672A\u5408\u5E76\uFF09`, `git checkout ${base} && git merge --no-ff <\u4EFB\u52A1\u5206\u652F> && git push`);
+  }
+  const merges = await ctx.runGit(["log", "--merges", "-1", "--format=%P", base], ctx.repoPath);
+  const parents = merges.ok ? merges.stdout.trim().split(/\s+/) : [];
+  if (parents.length !== 2) {
+    return fail2(ctx, type, `\u672A\u68C0\u6D4B\u5230 --no-ff \u5408\u5E76\u63D0\u4EA4\uFF08\u6700\u8FD1\u4E00\u6B21\u5408\u5E76 parents=${parents.length}\uFF09`, "\u5408\u5E76\u5FC5\u987B\u4F7F\u7528 --no-ff\uFF08\u4FDD\u7559\u5408\u5E76\u8BB0\u5F55\uFF09\uFF1Agit merge --no-ff <\u4EFB\u52A1\u5206\u652F>");
+  }
+  const localBase = await ctx.runGit(["rev-parse", base], ctx.repoPath);
+  const remoteBase = await ctx.runGit(["rev-parse", `origin/${base}`], ctx.repoPath);
+  if (!localBase.ok || !remoteBase.ok || localBase.stdout.trim() !== remoteBase.stdout.trim()) {
+    return fail2(ctx, type, `\u672C\u5730 ${base} \u4E0E origin/${base} \u4E0D\u4E00\u81F4\uFF08\u5408\u5E76\u7ED3\u679C\u672A\u63A8\u9001\u6216\u672A\u62C9\u53D6\uFF09`, `git push origin ${base}\uFF08\u6216\u5148 pull \u5BF9\u9F50\uFF09`);
+  }
+  return { type, status: "pass", detail: `\u4EFB\u52A1\u5206\u652F\u5DF2 --no-ff \u5408\u5165 ${base} \u4E14\u5DF2\u4E0E\u8FDC\u7A0B\u4E00\u81F4` };
+}
+async function checkStayOnBase(ctx) {
+  const type = "git-stay-on-base";
+  const guard = naIfRepoUnavailable(ctx);
+  if (guard) return { ...guard, type };
+  if (ctx.vcs.worktreeMode === true) {
+    return { type, status: "not_applicable", detail: "worktreeMode=true\uFF08worktree \u5E76\u884C\u5F00\u53D1\uFF0C\u4E0D\u8981\u6C42\u505C\u7559\u57FA\u7840\u5206\u652F\uFF09" };
+  }
+  if (ctx.vcs.archiveToBase === false) {
+    return { type, status: "not_applicable", detail: "\u9879\u76EE vcs.archiveToBase=false\uFF08\u65E0\u5F52\u6863\u6D41\u7A0B\uFF0C\u7EC8\u6001\u505C\u7559\u4EFB\u52A1\u5206\u652F\uFF09" };
+  }
+  if (ctx.baseBranch === null) {
+    return fail2(ctx, type, "\u57FA\u7840\u5206\u652F\u672A\u77E5\uFF08ARCHIVE \u524D\u7F6E\uFF1AALIGN \u5E94\u5DF2\u843D\u76D8 baseBranch\uFF09", "record-set \u5199 ALIGN.baseBranch\uFF0C\u6216 siming project update --vcs-base-branch <\u5206\u652F>");
+  }
+  const branch = await currentBranch(ctx);
+  if (branch === null) {
+    return fail2(ctx, type, "\u65E0\u6CD5\u8BFB\u53D6\u5F53\u524D\u5206\u652F", "\u786E\u8BA4\u4ED3\u5E93\u72B6\u6001");
+  }
+  if (branch !== ctx.baseBranch) {
+    return fail2(ctx, type, `\u5F52\u6863\u540E\u5E94\u505C\u7559\u57FA\u7840\u5206\u652F\uFF1A\u5F53\u524D\u5728\u300C${branch}\u300D\uFF0C\u671F\u671B\u300C${ctx.baseBranch}\u300D`, `git checkout ${ctx.baseBranch}\uFF08\u7981\u6B62\u7ACB\u5373\u5F00\u59CB\u4E0B\u4E00\u4EFB\u52A1\u5206\u652F\uFF09`);
+  }
+  return { type, status: "pass", detail: `\u5F53\u524D\u505C\u7559\u5728\u57FA\u7840\u5206\u652F ${branch}` };
+}
+function firstLine(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+
+// src/client/checks/record-checks.ts
+function decisionByTopic(record, topic) {
+  const hit = record?.decisions.find((d) => d.topic === topic && d.decision.trim() !== "");
+  return hit ?? null;
+}
+async function checkTestReport(ctx) {
+  const type = "record-test-report";
+  const report = ctx.record?.testReport;
+  if (!report) {
+    return fail3(type, "\u672C\u8282\u70B9\u8BB0\u5F55\u672A\u5199 testReport\uFF08\u7ED3\u6784\u5316\u5B57\u6BB5\u7F3A\u5931\uFF09", "record-set \u5199 testReport {command,passed,failed,skipped}\uFF08\u771F\u5B9E\u6267\u884C\u7684\u6D4B\u8BD5\u547D\u4EE4\u4E0E\u7ED3\u679C\u8BA1\u6570\uFF09");
+  }
+  if (report.failed > 0) {
+    return fail3(type, `\u6D4B\u8BD5\u5B58\u5728\u5931\u8D25\uFF1Afailed=${report.failed}\uFF08${report.command}\uFF09`, "\u4FEE\u590D\u5931\u8D25\u7528\u4F8B\u6216\u7ECF\u7528\u6237\u6388\u6743\u540E\u8D70\u8C41\u514D\u901A\u9053\uFF0C\u7981\u6B62\u5E26\u5931\u8D25\u63A8\u8FDB");
+  }
+  if (report.skipped > 0) {
+    const waiver = decisionByTopic(ctx.record, "skip-authorized");
+    if (waiver === null) {
+      return fail3(type, `\u8DF3\u8FC7\u7528\u4F8B ${report.skipped} \u4E2A\u4F46\u65E0\u7528\u6237\u6388\u6743\u7559\u75D5\uFF08${report.command}\uFF09`, "\u7ECF\u7528\u6237\u660E\u793A\u6388\u6743\u540E record-decision-add \u5199 topic=skip-authorized\uFF0C\u6216\u6E05\u96F6 skipped");
+    }
+    return { type, status: "pass", detail: `\u6D4B\u8BD5\u901A\u8FC7\uFF08skipped=${report.skipped}\uFF0Cskip-authorized \u8C41\u514D decision ${waiver.id}\uFF09` };
+  }
+  return { type, status: "pass", detail: `\u6D4B\u8BD5\u5168\u7EFF\uFF1Apassed=${report.passed}\uFF08${report.command}\uFF09` };
+}
+async function checkNoFakeGreen(ctx) {
+  const type = "record-no-fake-green";
+  const waiver = decisionByTopic(ctx.record, "test-adjust-approved");
+  if (waiver !== null) {
+    return { type, status: "pass", detail: `\u6D4B\u8BD5\u8C03\u6574\u6301\u6279\u51C6\u7559\u75D5\uFF08decision ${waiver.id}\uFF09` };
+  }
+  const guard = naIfRepoUnavailable(ctx);
+  if (guard) return { ...guard, type };
+  if (ctx.baseBranch === null) {
+    return fail3(type, "\u57FA\u7840\u5206\u652F\u672A\u77E5\uFF08ALIGN.baseBranch \u672A\u843D\u76D8\u4E14\u9879\u76EE\u672A\u914D\u7F6E\uFF09", "record-set \u5199 ALIGN.baseBranch\uFF0C\u6216 siming project update --vcs-base-branch <\u5206\u652F>");
+  }
+  const diff = await ctx.runGit(
+    ["diff", `${ctx.baseBranch}...HEAD`, "--", "**/*.test.ts", "**/*.spec.ts", "**/tests/**"],
+    ctx.repoPath
+  );
+  if (!diff.ok) {
+    return fail3(type, `\u6D4B\u8BD5\u6587\u4EF6 diff \u5931\u8D25\uFF1A${firstLine2(diff.stderr)}`, "\u68C0\u67E5\u4ED3\u5E93\u4E0E\u57FA\u7840\u5206\u652F\u53EF\u7528\u6027");
+  }
+  const violations = scanTestDiff(diff.stdout);
+  if (violations.length > 0) {
+    return fail3(type, `\u6D4B\u8BD5\u5B8C\u6574\u6027\u8FDD\u89C4\uFF1A${violations.join("\uFF1B")}`, "\u8FD8\u539F\u6D4B\u8BD5\u6539\u52A8\uFF1B\u786E\u5C5E\u5408\u6CD5\u8C03\u6574\u987B\u7ECF\u7528\u6237\u6279\u51C6\u540E record-decision-add \u5199 topic=test-adjust-approved");
+  }
+  return { type, status: "pass", detail: "\u6D4B\u8BD5\u6587\u4EF6\u65E0 skip/only \u65B0\u589E\u4E0E\u6574\u5220\uFF08\u653E\u5BBD\u65AD\u8A00\u5F62\u6001\u4E0D\u5728\u673A\u5668\u68C0\u6D4B\u9762\uFF0C\u4F9D\u8D56 test-adjust-approved \u7559\u75D5\u628A\u5173\uFF09" };
+}
+function scanTestDiff(patch) {
+  const violations = [];
+  let currentFile = "";
+  let deleting = false;
+  for (const line of patch.split("\n")) {
+    if (line.startsWith("diff --git ")) {
+      currentFile = line;
+      deleting = false;
+      continue;
+    }
+    if (line.startsWith("deleted file mode")) {
+      const m = currentFile.match(/^diff --git a\/(.+) b\//);
+      if (m) violations.push({ reason: `\u6D4B\u8BD5\u6587\u4EF6\u6574\u5220\uFF1A${m[1]}` });
+      deleting = true;
+      continue;
+    }
+    if (deleting) continue;
+    if (line.startsWith("+") && !line.startsWith("+++")) {
+      if (line.includes(".skip(") || line.includes(".only(")) {
+        violations.push({ reason: `\u65B0\u589E\u8DF3\u8FC7/\u805A\u7126\u6807\u8BB0\uFF1A${line.slice(1).trim().slice(0, 80)}` });
+      }
+    }
+  }
+  return violations.map((v) => v.reason);
+}
+async function checkBaseReMerged(ctx) {
+  const type = "record-base-re-merged";
+  const guard = naIfRepoUnavailable(ctx);
+  if (guard) return { ...guard, type };
+  const waived = findWaivedDecision(ctx, "INTEGRATE");
+  if (waived !== null) {
+    return { type, status: "not_applicable", detail: `INTEGRATE \u8BB0\u5F55\u542B merge-waived \u8C41\u514D\uFF08decision ${waived}\uFF09` };
+  }
+  if (ctx.baseBranch === null) {
+    return fail3(type, "\u57FA\u7840\u5206\u652F\u672A\u77E5\uFF08ALIGN.baseBranch \u672A\u843D\u76D8\u4E14\u9879\u76EE\u672A\u914D\u7F6E\uFF09", "record-set \u5199 ALIGN.baseBranch\uFF0C\u6216 siming project update --vcs-base-branch <\u5206\u652F>");
+  }
+  const fetch2 = await ctx.runGit(["fetch", "origin", ctx.baseBranch], ctx.repoPath);
+  if (!fetch2.ok) {
+    return fail3(type, `git fetch origin ${ctx.baseBranch} \u5931\u8D25\u2014\u2014\u65E0\u6CD5\u4EE5\u8FDC\u7A0B\u6700\u65B0\u5F15\u7528\u5224\u5B9A\uFF08\u62D2\u6309\u9648\u65E7 ref \u8BEF\u5224\uFF09`, "\u68C0\u67E5\u7F51\u7EDC/\u8FDC\u7A0B\u53EF\u8FBE\u540E\u91CD\u8BD5");
+  }
+  const r = await ctx.runGit(["merge-base", "--is-ancestor", `origin/${ctx.baseBranch}`, "HEAD"], ctx.repoPath);
+  if (!r.ok) {
+    return fail3(type, `origin/${ctx.baseBranch} \u589E\u91CF\u672A\u518D\u5408\u5165\u5F53\u524D\u5206\u652F\uFF08\u96C6\u6210\u524D\u57FA\u7840\u5206\u652F\u6709\u65B0\u63D0\u4EA4\uFF09`, `merge ${ctx.baseBranch} \u2192 \u5F53\u524D\u5206\u652F\uFF08\u6D88\u89E3\u6F02\u79FB\uFF09\u540E\u518D\u63A8\u8FDB`);
+  }
+  return { type, status: "pass", detail: `origin/${ctx.baseBranch} \u5DF2\u518D\u5408\u5165 HEAD` };
+}
+async function checkFixReviewPass(ctx) {
+  const type = "record-fix-review-pass";
+  const fixes = ctx.record?.fixesApplied ?? 0;
+  if (fixes > 0) {
+    const verdict = ctx.record?.review?.verdict;
+    if (verdict !== "pass") {
+      return fail3(type, `\u58F0\u660E\u4FEE\u590D ${fixes} \u5904\u4F46\u8BC4\u5BA1\u7ED3\u8BBA\u975E pass\uFF08verdict=${verdict ?? "\u672A\u5199"}\uFF09`, "\u4FEE\u590D\u540E\u91CD\u4EA4 code-reviewer \u8BC4\u5BA1\u81F3 PASS\uFF08record-review-set\uFF09\uFF0C\u6216\u5C06 fixesApplied \u5982\u5B9E\u5F52\u96F6");
+    }
+    return { type, status: "pass", detail: `\u4FEE\u590D ${fixes} \u5904\u4E14\u8BC4\u5BA1 PASS` };
+  }
+  return { type, status: "pass", detail: "\u65E0\u4FEE\u590D\uFF08fixesApplied=0\uFF09" };
+}
+async function checkVerifiedCommit(ctx) {
+  const type = "record-verified-commit";
+  const sha = ctx.record?.verifiedCommit;
+  if (!sha) {
+    return fail3(type, "\u672C\u8282\u70B9\u8BB0\u5F55\u672A\u5199 verifiedCommit\uFF08\u96C6\u6210\u9A8C\u8BC1\u7248\u672C\u7F3A\u5931\uFF09", "record-set \u5199 verifiedCommit <sha>\uFF08\u7ECF\u9A8C\u8BC1\u7684 HEAD \u63D0\u4EA4\u53F7\uFF09");
+  }
+  const guard = naIfRepoUnavailable(ctx);
+  if (guard) return { ...guard, type };
+  const r = await ctx.runGit(["cat-file", "-e", sha], ctx.repoPath);
+  if (!r.ok) {
+    return fail3(type, `verifiedCommit\u300C${sha}\u300D\u5728\u4ED3\u5E93\u4E2D\u4E0D\u5B58\u5728\uFF08cat-file \u5931\u8D25\uFF09`, "record-set \u4FEE\u6B63 verifiedCommit \u4E3A\u771F\u5B9E\u5B58\u5728\u7684\u63D0\u4EA4\u53F7");
+  }
+  return { type, status: "pass", detail: `\u9A8C\u8BC1\u7248\u672C ${sha} \u5B58\u5728` };
+}
+async function checkPrevNodesDone(ctx) {
+  const type = "record-prev-nodes-done";
+  const predecessors = collectPredecessors(ctx.edges ?? [], ctx.nodeId);
+  const pending = ctx.nodes.filter(
+    (n) => predecessors.has(n.nodeId) && n.status !== "skipped" && n.status !== "completed"
+  );
+  if (pending.length > 0) {
+    const summary = pending.map((n) => `${n.nodeId}:${n.status}`).join(", ");
+    return fail3(type, `\u5B58\u5728\u672A\u5B8C\u6210\u524D\u5E8F\u8282\u70B9\uFF08${summary}\uFF09`, "\u6309 DAG \u987A\u5E8F\u5B8C\u6210\u524D\u7F6E\u8282\u70B9\uFF08\u6216\u660E\u786E\u8DF3\u8FC7\u8DEF\u5F84\uFF09\u540E\u518D\u63A8\u8FDB\u9A8C\u6536");
+  }
+  if (predecessors.size === 0) {
+    return { type, status: "pass", detail: "\u65E0\u6709\u5411\u8FB9\u53EF\u5224\u5B9A\u524D\u5E8F\uFF08\u95ED\u5305\u4E3A\u7A7A\uFF09\u2014\u2014\u89C6\u4E3A\u901A\u8FC7" };
+  }
+  return { type, status: "pass", detail: "\u524D\u5E8F\u8282\u70B9\u5168\u90E8\u5B8C\u6210\u6216\u5DF2\u8DF3\u8FC7" };
+}
+function collectPredecessors(edges, nodeId) {
+  const incoming = /* @__PURE__ */ new Map();
+  for (const e of edges) {
+    const list = incoming.get(e.to) ?? [];
+    list.push(e.from);
+    incoming.set(e.to, list);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const queue = [...incoming.get(nodeId) ?? []];
+  while (queue.length > 0) {
+    const cur = queue.pop();
+    if (seen.has(cur)) continue;
+    seen.add(cur);
+    for (const prev of incoming.get(cur) ?? []) queue.push(prev);
+  }
+  return seen;
+}
+async function checkVersionConsistent(ctx) {
+  const type = "record-version-consistent";
+  const sha = ctx.nodeRecords["INTEGRATE"]?.verifiedCommit;
+  if (!sha) {
+    return fail3(type, "INTEGRATE \u8BB0\u5F55\u7F3A verifiedCommit\uFF08\u7248\u672C\u4E00\u81F4\u6027\u65E0\u4ECE\u5224\u5B9A\uFF09", "\u56DE\u8865 INTEGRATE record-set verifiedCommit \u540E\u91CD\u8BD5");
+  }
+  const guard = naIfRepoUnavailable(ctx);
+  if (guard) return { ...guard, type };
+  if (ctx.baseBranch === null) {
+    return fail3(type, "\u57FA\u7840\u5206\u652F\u672A\u77E5\uFF08ALIGN.baseBranch \u672A\u843D\u76D8\u4E14\u9879\u76EE\u672A\u914D\u7F6E\uFF09", "record-set \u5199 ALIGN.baseBranch\uFF0C\u6216 siming project update --vcs-base-branch <\u5206\u652F>");
+  }
+  const r = await ctx.runGit(["diff", "--name-only", `${sha}..${ctx.baseBranch}`], ctx.repoPath);
+  if (!r.ok) {
+    return fail3(type, `\u7248\u672C diff \u5931\u8D25\uFF1A${firstLine2(r.stderr)}`, "\u68C0\u67E5 verifiedCommit \u4E0E\u57FA\u7840\u5206\u652F\u53EF\u7528\u6027");
+  }
+  const exempt = (path) => ctx.docPaths.some((p) => {
+    if (p.endsWith("/")) return path.startsWith(p);
+    if (p.startsWith("*")) return path.endsWith(p.slice(1));
+    return path === p;
+  });
+  const leaked = r.stdout.split("\n").map((l) => l.trim()).filter((l) => l !== "" && !exempt(l));
+  if (leaked.length > 0) {
+    return fail3(
+      type,
+      `verifiedCommit \u4E0E ${ctx.baseBranch} \u5B58\u5728\u975E\u6587\u6863\u5DEE\u5F02\uFF08${leaked.slice(0, 5).join(", ")}${leaked.length > 5 ? ` \u7B49 ${leaked.length} \u4E2A` : ""}\uFF09`,
+      "\u4EE3\u7801\u6539\u52A8\u987B\u5408\u5E76\u8FDB\u57FA\u7840\u5206\u652F\uFF08\u542B\u5E76\u884C\u4EFB\u52A1 base \u524D\u8FDB\u573A\u666F\uFF1A\u91CD\u8D70\u5408\u5E76\u6216\u7ECF\u7528\u6237\u660E\u793A\u540E force \u63A8\u8FDB\u5E76\u7559\u75D5\uFF09"
+    );
+  }
+  return { type, status: "pass", detail: `verifiedCommit ${sha} \u4E0E ${ctx.baseBranch} \u4E00\u81F4\uFF08\u6587\u6863\u8DEF\u5F84\u8C41\u514D ${ctx.docPaths.join(" ")}\uFF09` };
+}
+async function checkDeferredIssues(ctx) {
+  const type = "record-deferred-issues";
+  const ids = ctx.record?.deferredIssues ?? [];
+  if (ids.length === 0) {
+    return { type, status: "pass", detail: "\u65E0\u5EF6\u671F\u573A\u666F" };
+  }
+  const loaded = await ctx.loadIssueIds();
+  if (!loaded.ok) {
+    return fail3(type, `\u5173\u8054\u95EE\u9898\u53CD\u67E5\u5931\u8D25\uFF1A${loaded.error}`, "\u68C0\u67E5 server \u53EF\u7528\u6027\u540E\u91CD\u8BD5");
+  }
+  const missing = ids.filter((id) => !loaded.ids.has(id));
+  if (missing.length > 0) {
+    return fail3(type, `\u5EF6\u671F\u95EE\u9898\u672A\u843D\u6C60\uFF1A${missing.join(", ")}`, "siming issue create \u5C06\u5EF6\u671F\u573A\u666F\u5F55\u5165\u95EE\u9898\u6C60\u540E\uFF0Crecord-set \u4FEE\u6B63 deferredIssues");
+  }
+  return { type, status: "pass", detail: `\u5EF6\u671F\u95EE\u9898 ${ids.length} \u4E2A\u5747\u5DF2\u843D\u6C60` };
+}
+async function checkEvidenceFiles(ctx) {
+  const type = "record-evidence-files";
+  const files = ctx.record?.evidenceFiles ?? [];
+  if (files.length === 0) {
+    return fail3(type, "\u672C\u8282\u70B9\u8BB0\u5F55\u672A\u5199 evidenceFiles\uFF08\u89C6\u89C9\u9A8C\u6536\u8BC1\u636E\u7F3A\u5931\uFF09", "record-set \u5199 evidenceFiles\uFF08\u622A\u56FE/\u5F55\u5C4F\u76F8\u5BF9\u8DEF\u5F84\u6E05\u5355\uFF09");
+  }
+  if (ctx.repoPath === null) {
+    return { type, status: "not_applicable", detail: `\u4ED3\u5E93\u4E0D\u53EF\u7528\uFF1A${ctx.repoProbeDetail}` };
+  }
+  const missing = [];
+  for (const rel of files) {
+    if (!ctx.fileExists(`${ctx.repoPath}/${rel}`)) missing.push(rel);
+  }
+  if (missing.length > 0) {
+    return fail3(type, `\u8BC1\u636E\u6587\u4EF6\u4E0D\u5B58\u5728\uFF1A${missing.join(", ")}`, "\u8865\u9F50\u8BC1\u636E\u6587\u4EF6\u6216 record-set \u4FEE\u6B63 evidenceFiles \u8DEF\u5F84");
+  }
+  return { type, status: "pass", detail: `\u8BC1\u636E\u6587\u4EF6 ${files.length} \u4E2A\u5747\u5B58\u5728` };
+}
+async function checkFinalConverged(ctx) {
+  const type = "record-final-converged";
+  const record = ctx.nodeRecords["ARCHIVE"] ?? ctx.record;
+  const confirmations = record?.confirmations ?? [];
+  const summary = record?.summary ?? "";
+  if (confirmations.length === 0 || summary.trim() === "") {
+    const missing = [
+      ...confirmations.length === 0 ? ["confirmations\uFF08\u7528\u6237\u786E\u8BA4\u7559\u75D5\uFF09"] : [],
+      ...summary.trim() === "" ? ["summary\uFF08\u5F52\u6863\u6458\u8981\uFF09"] : []
+    ];
+    return fail3(type, `\u5F52\u6863\u8BB0\u5F55\u4E0D\u5B8C\u6574\uFF1A\u7F3A ${missing.join(" \u4E0E ")}`, "record-summary-set \u5199\u6458\u8981 + record-confirm-add \u5199\u7528\u6237\u786E\u8BA4\u539F\u6587\u540E\u518D\u63A8\u8FDB");
+  }
+  return { type, status: "pass", detail: "\u5F52\u6863\u6458\u8981\u4E0E\u7528\u6237\u786E\u8BA4\u9F50\u5907" };
+}
+function fail3(type, rootCause, fix) {
+  return { type, status: "fail", detail: `${rootCause}\u3002\u4FEE\u590D\uFF1A${fix}` };
+}
+function firstLine2(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+
+// src/client/checks/registry.ts
+var CHECK_REGISTRY = {
+  "git-branch-exists": { run: checkBranchExists },
+  "git-base-merged": { run: checkBaseMerged },
+  "git-base-recorded": { run: checkBaseRecorded },
+  "git-worktree-clean": { run: checkWorktreeClean },
+  "git-archive-merged": { run: checkArchiveMerged },
+  "git-stay-on-base": { run: checkStayOnBase },
+  "record-test-report": { run: checkTestReport },
+  "record-no-fake-green": { run: checkNoFakeGreen },
+  "record-base-re-merged": { run: checkBaseReMerged },
+  "record-fix-review-pass": { run: checkFixReviewPass },
+  "record-verified-commit": { run: checkVerifiedCommit },
+  "record-prev-nodes-done": { run: checkPrevNodesDone },
+  "record-version-consistent": { run: checkVersionConsistent },
+  "record-deferred-issues": { run: checkDeferredIssues },
+  "record-evidence-files": { run: checkEvidenceFiles },
+  "record-final-converged": { run: checkFinalConverged }
+};
+async function checkBaseRecorded(ctx) {
+  const type = "git-base-recorded";
+  const alignRecord = ctx.nodeRecords["ALIGN"];
+  if (alignRecord?.baseBranch !== void 0 && alignRecord.baseBranch !== "") {
+    return { type, status: "pass", detail: `\u57FA\u7840\u5206\u652F\u5DF2\u843D\u76D8\uFF1A${alignRecord.baseBranch}` };
+  }
+  return {
+    type,
+    status: "fail",
+    detail: "ALIGN \u8BB0\u5F55\u672A\u5199 baseBranch\uFF08\u540E\u7EED\u5408\u5E76/\u5F52\u6863\u7C7B\u68C0\u67E5\u7684\u57FA\u7840\uFF09\u3002\u4FEE\u590D\uFF1Asiming task record set --node ALIGN --base-branch <\u5206\u652F\u540D>"
+  };
+}
+function auditAiChecks(aiChecks, record) {
+  const results = [];
+  for (const check of aiChecks) {
+    const confirmed = (record?.checks ?? []).some((c) => c.refId === check.id && c.passed === true);
+    if (confirmed) {
+      results.push({ id: check.id, item: check.item, status: "pass", detail: "\u5B8C\u6210\u5224\u5B9A\u9879\u5DF2\u81EA\u68C0\u901A\u8FC7\uFF08refId \u5173\u8054\uFF09" });
+      continue;
+    }
+    const rejected = (record?.checks ?? []).some((c) => c.refId === check.id && c.passed === false);
+    if (rejected) {
+      results.push({
+        id: check.id,
+        item: check.item,
+        status: "fail",
+        detail: `\u7559\u75D5\u7ED3\u8BBA\u672A\u901A\u8FC7\uFF08check ${check.id} passed=false\uFF09\u3002\u4FEE\u590D\uFF1A\u91CD\u505A\u540E\u7FFB\u7EFF\uFF08record-check-patch --check ${check.id} --passed\uFF09\u6216\u5982\u5B9E\u8865\u5199\u4E0D\u9002\u7528`
+      });
+      continue;
+    }
+    const lowered = check.item.toLowerCase();
+    if (NA_PHRASES.some((p) => lowered.includes(p.toLowerCase()))) {
+      results.push({ id: check.id, item: check.item, status: "not_applicable", detail: "item \u58F0\u660E\u4E0D\u9002\u7528\uFF08N/A \u8BCD\u8868\u547D\u4E2D\uFF09" });
+      continue;
+    }
+    if (check.item.length < MIN_AI_CHECK_ITEM_LENGTH) {
+      results.push({
+        id: check.id,
+        item: check.item,
+        status: "fail",
+        detail: `item \u8FC7\u77ED\uFF08${check.item.length} < ${MIN_AI_CHECK_ITEM_LENGTH} \u5B57\u7B26\uFF0C\u6700\u5C0F\u5F62\u6001\u8981\u6C42\u53EF\u6838\u5BF9\u7684\u5177\u4F53\u4E8B\u5B9E\uFF09`
+      });
+      continue;
+    }
+    if (VAGUE_AI_CHECK_BLACKLIST.some((w) => lowered.includes(w))) {
+      results.push({ id: check.id, item: check.item, status: "fail", detail: `item \u4E3A\u6A21\u7CCA\u5B8C\u6210\u8BED\uFF08\u547D\u4E2D\u9ED1\u540D\u5355\u300C${VAGUE_AI_CHECK_BLACKLIST.join("/")}\u300D\uFF09\uFF0C\u987B\u6539\u5199\u4E3A\u53EF\u6838\u5BF9\u7684\u5177\u4F53\u4E8B\u5B9E` });
+      continue;
+    }
+    results.push({
+      id: check.id,
+      item: check.item,
+      status: "fail",
+      // T202609230001：source 枚举仅 'self'|'tool'（本版工具不写 source，D4）——审计只认 refId 关联
+      detail: "\u5B8C\u6210\u5224\u5B9A\u9879\u672A\u81EA\u68C0\uFF08checks \u65E0 refId \u5173\u8054\u4E14\u672A\u58F0\u660E\u4E0D\u9002\u7528\uFF09\u3002\u4FEE\u590D\uFF1Arecord-check-add \u5E26 refId=" + check.id + " passed=true \u9010\u9879\u81EA\u68C0"
+    });
+  }
+  return results;
+}
+
+// src/client/checks/param-resolver.ts
+import { DEFAULT_VCS_DOC_PATHS } from "@siming-org/core";
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var defaultGitRunner = async (args, cwd) => {
+  try {
+    const { stdout, stderr } = await execFileAsync("git", args, { cwd, timeout: 1e4 });
+    return { ok: true, stdout, stderr };
+  } catch (err2) {
+    const e = err2;
+    return { ok: false, stdout: e.stdout ?? "", stderr: e.stderr ?? e.message ?? String(err2) };
+  }
+};
+async function resolveCheckContextWithRunner(base, vcs, cwd, runGit) {
+  const probe = vcs.repoPath !== void 0 ? await probeRepo(vcs.repoPath, runGit) : await probeRepo(cwd, runGit);
+  const alignRecord = base.nodeRecords["ALIGN"];
+  const baseBranch = (alignRecord?.baseBranch !== void 0 && alignRecord.baseBranch !== "" ? alignRecord.baseBranch : void 0) ?? vcs.baseBranch ?? null;
+  return {
+    ...base,
+    repoPath: probe.repoPath,
+    repoProbeDetail: probe.detail,
+    baseBranch,
+    branchPattern: vcs.branchPattern ?? "feature/",
+    docPaths: vcs.docPaths ?? [...DEFAULT_VCS_DOC_PATHS]
+  };
+}
+async function probeRepo(candidate, runGit) {
+  const r = await runGit(["rev-parse", "--show-toplevel"], candidate);
+  if (!r.ok) {
+    return {
+      repoPath: null,
+      detail: `\u4ED3\u5E93\u63A2\u6D4B\u5931\u8D25\uFF1ArepoPath \u5019\u9009\u300C${candidate}\u300D\uFF08git rev-parse --show-toplevel \u5931\u8D25\uFF1A${firstLine3(r.stderr)}\uFF09`
+    };
+  }
+  return { repoPath: firstLine3(r.stdout), detail: "" };
+}
+function firstLine3(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+
+// src/client/checks/runner.ts
+import { existsSync as existsSync5 } from "fs";
+function gateHasFailure(report) {
+  return report.toolOutcomes.some((o) => o.status === "fail") || report.aiOutcomes.some((o) => o.status === "fail");
+}
+async function runNodeGate(client, taskId) {
+  const ctxRes = await client.getJson(`/api/tasks/${encodeURIComponent(taskId)}/context?view=basic`);
+  if (!ctxRes.success) return ctxRes;
+  const context = ctxRes.data;
+  const node = context.currentNode;
+  if (node === null) {
+    return ok2({ empty: true, nodeId: context.task.currentNode, toolOutcomes: [], aiOutcomes: [] });
+  }
+  const toolChecks = node.toolChecks ?? [];
+  const aiChecks = node.aiChecks ?? [];
+  if (toolChecks.length === 0 && aiChecks.length === 0) {
+    return ok2({ empty: true, nodeId: node.nodeId, toolOutcomes: [], aiOutcomes: [] });
+  }
+  let vcs = {};
+  let vcsLoadError;
+  const projectRes = await client.getJson(
+    `/api/projects/${encodeURIComponent(context.task.projectId)}`
+  );
+  if (projectRes.success && projectRes.data.vcs !== void 0) {
+    vcs = projectRes.data.vcs;
+  } else if (!projectRes.success) {
+    vcsLoadError = projectRes.error.message;
+  }
+  const nodes = context.nodes.map((n) => ({
+    nodeId: n.nodeId,
+    label: n.label,
+    status: n.status
+  }));
+  const checkCtx = await resolveCheckContextWithRunner(
+    {
+      taskId,
+      nodeId: node.nodeId,
+      record: context.nodeRecords[node.nodeId],
+      nodeRecords: context.nodeRecords,
+      nodes,
+      edges: context.edges ?? [],
+      vcs,
+      ...vcsLoadError !== void 0 ? { vcsLoadError } : {},
+      runGit: defaultGitRunner,
+      loadIssueIds: async () => {
+        const r = await client.getJson(
+          `/api/tasks/${encodeURIComponent(taskId)}/issues`
+        );
+        if (!r.success) return { ok: false, error: r.error.message };
+        const ids = new Set(r.data.items.map((i) => i.issueId ?? i.id ?? ""));
+        ids.delete("");
+        return { ok: true, ids };
+      },
+      fileExists: (p) => existsSync5(p)
+    },
+    vcs,
+    process.cwd(),
+    defaultGitRunner
+  );
+  const toolOutcomes = [];
+  for (const toolCheck of toolChecks) {
+    const def = CHECK_REGISTRY[toolCheck.type];
+    if (def === void 0) {
+      toolOutcomes.push({
+        type: toolCheck.type,
+        status: "fail",
+        detail: "\u672A\u77E5\u68C0\u67E5\u7C7B\u578B\uFF08\u5F53\u524D CLI \u7248\u672C\u4E0D\u542B\u8BE5\u68C0\u67E5\u5B9E\u73B0\uFF09\u3002\u4FEE\u590D\uFF1A\u5347\u7EA7 siming CLI \u540E\u91CD\u8BD5"
+      });
+      continue;
+    }
+    toolOutcomes.push(await def.run(checkCtx));
+  }
+  const aiOutcomes = auditAiChecks(aiChecks, context.nodeRecords[node.nodeId]);
+  return ok2({ empty: false, nodeId: node.nodeId, toolOutcomes, aiOutcomes });
+}
+function buildCheckReportPayload(report, mode, note) {
+  const results = [
+    ...report.toolOutcomes.map((o) => ({ type: o.type, status: o.status, detail: o.detail })),
+    ...report.aiOutcomes.map((o) => ({ type: `ai:${o.id}`, status: o.status, detail: o.detail }))
+  ];
+  return { nodeId: report.nodeId, mode, results, ...note !== void 0 ? { note } : {} };
+}
+function buildGateFailMessage(report, reportWritten = true) {
+  const fails = [
+    ...report.toolOutcomes.filter((o) => o.status === "fail").map((o) => `[${o.type}] ${o.detail}`),
+    ...report.aiOutcomes.filter((o) => o.status === "fail").map((o) => `[ai:${o.id}] ${o.detail}`)
+  ];
+  const passed = report.toolOutcomes.filter((o) => o.status !== "fail").length + report.aiOutcomes.filter((o) => o.status !== "fail").length;
+  return {
+    message: `\u8282\u70B9\u95E8\u7981\u672A\u901A\u8FC7\uFF08${fails.length} \u9879 fail\uFF0C${passed} \u9879\u901A\u8FC7/\u4E0D\u9002\u7528\uFF09\uFF0Cadvance \u5DF2\u62E6\u622A\uFF1A
+${fails.map((f, i) => `${i + 1}. ${f}`).join("\n")}`,
+    hint: reportWritten ? "\u9010\u9879\u5B8C\u6210\u4FEE\u590D\u6216\u7528\u6237\u660E\u793A\u8C41\u514D\uFF08\u7ECF record-decision-add \u7559\u75D5\uFF09\u540E\u91CD\u65B0\u63A8\u8FDB\uFF1B\u95E8\u7981\u7ED3\u679C\u5DF2\u5199\u5165\u4EFB\u52A1 history\uFF08checks_rejected\uFF09" : "\u9010\u9879\u5B8C\u6210\u4FEE\u590D\u6216\u7528\u6237\u660E\u793A\u8C41\u514D\uFF08\u7ECF record-decision-add \u7559\u75D5\uFF09\u540E\u91CD\u65B0\u63A8\u8FDB\u3002\u6CE8\u610F\uFF1A\u672C\u6B21\u95E8\u7981\u7ED3\u679C\u7559\u75D5\u5931\u8D25\uFF0Chistory \u7F3A\u5931\u8BE5\u6B21\u8BB0\u5F55\uFF08\u4FEE\u590D\u540E\u91CD\u63A8\u65F6\u4F1A\u91CD\u65B0\u7559\u75D5\uFF09"
+  };
+}
+function naCategory(detail) {
+  return detail.split(/[（(：:,，;；]/)[0]?.trim().slice(0, 16) ?? "";
+}
+function buildPassNote(report) {
+  const mark = (status, key, detail) => {
+    if (status === "pass") return `${key}\u2713`;
+    if (status === "not_applicable") return `${key}=N(${naCategory(detail)})`;
+    return `${key}\u2717`;
+  };
+  const marks = [
+    ...report.toolOutcomes.map((o) => mark(o.status, o.type, o.detail)),
+    ...report.aiOutcomes.map((o) => mark(o.status, o.id, o.detail))
+  ].join(" ");
+  const line = `[checks] ${marks}`;
+  if (line.length <= 600) return line;
+  const toolPass = report.toolOutcomes.filter((o) => o.status === "pass").length;
+  const toolNa = report.toolOutcomes.filter((o) => o.status === "not_applicable").length;
+  const parts = [`\u5DE5\u5177\u68C0\u67E5 ${toolPass} \u9879\u901A\u8FC7${toolNa > 0 ? `\uFF0C${toolNa} \u9879 N/A` : ""}`];
+  if (report.aiOutcomes.length > 0) {
+    const aiPass = report.aiOutcomes.filter((o) => o.status === "pass").length;
+    const aiNa = report.aiOutcomes.filter((o) => o.status === "not_applicable").length;
+    parts.push(`\u5B8C\u6210\u5224\u5B9A\u5BA1\u8BA1 ${aiPass} \u9879\u901A\u8FC7${aiNa > 0 ? `\uFF0C${aiNa} \u9879 N/A` : ""}`);
+  }
+  return `[checks] ${parts.join("\uFF1B")}\uFF08\u9010\u9879\u660E\u7EC6\u89C1 history check-report\uFF09`;
+}
+function buildForceComment(forceReason, report, maxLen) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  const skipped = [
+    ...report.toolOutcomes.filter((o) => o.status === "fail").map((o) => `${o.type}:${o.status}:${o.detail}`),
+    ...report.aiOutcomes.filter((o) => o.status === "fail").map((o) => `ai:${o.id}:${o.status}:${o.detail}`)
+  ];
+  const full = [
+    "[FORCE advance] \u7528\u6237\u6307\u4EE4\u539F\u6587\uFF1A" + forceReason,
+    `\u88AB\u8DF3\u8FC7\u9879\u53CA\u5F53\u65F6\u72B6\u6001\uFF1A${skipped.length > 0 ? skipped.join("\uFF1B") : "\u65E0 fail \u9879"}`,
+    `\u6267\u884C\u65F6\u70B9\uFF1A${ts} \u8282\u70B9 ${report.nodeId}`
+  ].join("\n");
+  if (maxLen === void 0 || full.length <= maxLen) return full;
+  const types = [
+    ...report.toolOutcomes.filter((o) => o.status === "fail").map((o) => o.type),
+    ...report.aiOutcomes.filter((o) => o.status === "fail").map((o) => `ai:${o.id}`)
+  ];
+  const head = "[FORCE advance] \u7528\u6237\u6307\u4EE4\u539F\u6587\uFF1A" + forceReason;
+  const time = `\u6267\u884C\u65F6\u70B9\uFF1A${ts} \u8282\u70B9 ${report.nodeId}`;
+  const tail = "\uFF08\u660E\u7EC6\u8D85\u957F\u622A\u65AD\uFF0C\u9010\u9879\u89C1 history check-report\uFF09";
+  let list = types.join(",");
+  let compact = [head, `\u88AB\u8DF3\u8FC7 ${types.length} \u9879\uFF1A${list}${tail}`, time].join("\n");
+  while (compact.length > maxLen && list.length > 0) {
+    list = list.slice(0, Math.max(0, list.length - 40));
+    compact = [head, `\u88AB\u8DF3\u8FC7 ${types.length} \u9879\uFF1A${list}\u2026${tail}`, time].join("\n");
+  }
+  if (compact.length > maxLen) {
+    compact = [head, `\u88AB\u8DF3\u8FC7 ${types.length} \u9879${tail}`, time].join("\n");
+  }
+  if (compact.length > maxLen) {
+    const headCut = Math.max(1, maxLen - time.length - 2);
+    compact = `${head.slice(0, headCut)}\u2026
+${time}`;
+  }
+  return compact.length <= maxLen ? compact : compact.slice(0, maxLen);
+}
+
+// src/client/handlers/task.ts
 async function handleCreateTask(client, input) {
   return client.postJson("/api/tasks", input);
 }
 async function handleAdvance(client, taskId, note, summary, finalize) {
-  return client.postJson(`/api/tasks/${taskId}/advance`, {
-    ...note !== void 0 ? { note } : {},
+  return advanceInner(client, taskId, note, summary, finalize, {});
+}
+async function handleAdvanceWithGate(client, taskId, gate, note, summary, finalize) {
+  return advanceInner(client, taskId, note, summary, finalize, gate);
+}
+async function advanceInner(client, taskId, note, summary, finalize, gate) {
+  const gateReport = await runNodeGate(client, taskId);
+  if (!gateReport.success) return gateReport;
+  const report = gateReport.data;
+  const useForce = gate.force === true;
+  let effectiveNote = note;
+  if (!report.empty) {
+    if (gateHasFailure(report)) {
+      const rejectPayload = buildCheckReportPayload(
+        report,
+        useForce ? "force" : "reject",
+        // force 留痕必须携带用户指令原文（验收 12）——note 走 force comment 模板（≤500，H3 截断保护）
+        useForce && gate.forceReason !== void 0 ? buildForceComment(gate.forceReason, report, 500) : void 0
+      );
+      const reportRes = await postCheckReport(client, taskId, rejectPayload);
+      const auditNote = reportRes.success ? "" : `
+\uFF08\u8B66\u793A\uFF1Acheck-report \u7559\u75D5\u5931\u8D25\uFF1A${reportRes.error.message}\uFF09`;
+      if (!useForce) {
+        const { message, hint } = buildGateFailMessage(report, reportRes.success);
+        return fail({ message: `${message}${auditNote}`, hint, httpStatus: 0 });
+      }
+      if (!reportRes.success) {
+        const w = `\uFF08\u8B66\u793A\uFF1Acheck-report \u7559\u75D5\u5931\u8D25\uFF1A${reportRes.error.message}\u2014\u2014\u672C\u6B21\u5F3A\u5236\u63A8\u8FDB\u5728 history \u65E0 checks_rejected \u8BB0\u5F55\uFF09`;
+        effectiveNote = effectiveNote !== void 0 ? `${effectiveNote}
+${w}` : w;
+      }
+    } else if (useForce) {
+      const reportRes = await postCheckReport(
+        client,
+        taskId,
+        buildCheckReportPayload(report, "force", buildForceComment(gate.forceReason ?? "", report, 500))
+      );
+      if (!reportRes.success) {
+        const w = `\uFF08\u8B66\u793A\uFF1Acheck-report \u7559\u75D5\u5931\u8D25\uFF1A${reportRes.error.message}\u2014\u2014\u672C\u6B21\u5F3A\u5236\u63A8\u8FDB\u5728 history \u65E0 checks_rejected \u8BB0\u5F55\uFF09`;
+        effectiveNote = effectiveNote !== void 0 ? `${effectiveNote}
+${w}` : w;
+      }
+    } else {
+      const passNote = buildPassNote(report);
+      effectiveNote = note !== void 0 ? `${note}
+${passNote}` : passNote;
+    }
+  } else if (useForce && gate.forceReason !== void 0) {
+    effectiveNote = note !== void 0 ? `${note}
+[FORCE advance] ${gate.forceReason}` : `[FORCE advance] ${gate.forceReason}`;
+  }
+  const response = await client.postJson(`/api/tasks/${taskId}/advance`, {
+    ...effectiveNote !== void 0 ? { note: effectiveNote } : {},
     ...summary !== void 0 ? { summary } : {},
     ...finalize ? { finalize: true } : {}
   });
+  if (!response.success) return response;
+  if (useForce && response.data.status === "paused") {
+    const comment = buildForceComment(gate.forceReason ?? "", report, 2e3);
+    const approved = await handleApprove(client, taskId, "approved", comment);
+    if (!approved.success) {
+      return fail({
+        message: `force advance \u5DF2\u5230\u6682\u505C\u70B9\uFF0C\u81EA\u52A8\u5BA1\u6279\u5931\u8D25\uFF1A${approved.error.message}`,
+        hint: "\u4EFB\u52A1\u505C\u7559\u5728\u6682\u505C\u70B9\uFF1B\u8BF7\u4EBA\u5DE5\u5BA1\u6279\uFF08siming task approve\uFF09",
+        httpStatus: 0
+      });
+    }
+    if (approved.data.status === "rejected") {
+      return fail({
+        message: `force advance \u5BA1\u6279\u88AB\u9A73\u56DE\uFF1A${approved.data.guidance}`,
+        hint: "\u4EFB\u52A1\u4FDD\u6301\u6682\u505C\uFF1B\u68C0\u67E5\u6682\u505C\u70B9\u5BA1\u6279\u7EA6\u675F",
+        httpStatus: 0
+      });
+    }
+    return ok2(approved.data);
+  }
+  return response;
+}
+async function postCheckReport(client, taskId, payload) {
+  return client.postJson(`/api/tasks/${taskId}/check-report`, payload);
+}
+async function handleTaskCheck(client, taskId) {
+  return runNodeGate(client, taskId);
 }
 async function handleApprove(client, taskId, decision, comment) {
   return client.postJson(`/api/tasks/${taskId}/approve`, {
@@ -735,14 +1484,35 @@ function handleDocAcceptanceAdd(client, taskId, text) {
 function handleDocNonGoalAdd(client, taskId, text) {
   return client.postJson(`/api/tasks/${taskId}/doc/non-goal`, { text });
 }
-function handleRecordSummarySet(client, taskId, nodeId, summary) {
-  return client.patchJson(`/api/tasks/${taskId}/records/${nodeId}/summary`, { summary });
+function handleRecordSummarySet(client, taskId, nodeId, fields) {
+  return client.patchJson(
+    `/api/tasks/${taskId}/records/${nodeId}/summary`,
+    {
+      ...fields.summary !== void 0 ? { summary: fields.summary } : {},
+      ...fields.baseBranch !== void 0 ? { baseBranch: fields.baseBranch } : {},
+      ...fields.verifiedCommit !== void 0 ? { verifiedCommit: fields.verifiedCommit } : {},
+      ...fields.fixesApplied !== void 0 ? { fixesApplied: fields.fixesApplied } : {},
+      ...fields.testReport !== void 0 ? { testReport: fields.testReport } : {},
+      ...fields.deferredIssues !== void 0 ? { deferredIssues: fields.deferredIssues } : {},
+      ...fields.evidenceFiles !== void 0 ? { evidenceFiles: fields.evidenceFiles } : {}
+    }
+  );
 }
-function handleRecordCheckAdd(client, taskId, nodeId, item, passed) {
-  return client.postJson(`/api/tasks/${taskId}/records/${nodeId}/checks`, { item, passed });
+function handleRecordCheckAdd(client, taskId, nodeId, item, passed, options) {
+  return client.postJson(`/api/tasks/${taskId}/records/${nodeId}/checks`, {
+    item,
+    passed,
+    ...options?.refId !== void 0 ? { refId: options.refId } : {},
+    ...options?.source !== void 0 ? { source: options.source } : {}
+  });
 }
-function handleRecordCheckPatch(client, taskId, nodeId, checkId, passed) {
-  return client.patchJson(`/api/tasks/${taskId}/records/${nodeId}/checks/${checkId}`, { passed });
+function handleRecordCheckPatch(client, taskId, nodeId, checkId, patch) {
+  return client.patchJson(`/api/tasks/${taskId}/records/${nodeId}/checks/${checkId}`, {
+    ...patch.passed !== void 0 ? { passed: patch.passed } : {},
+    ...patch.item !== void 0 ? { item: patch.item } : {},
+    ...patch.refId !== void 0 ? { refId: patch.refId } : {},
+    ...patch.source !== void 0 ? { source: patch.source } : {}
+  });
 }
 var ARTIFACT_CONTENT_LIMIT = 2e5;
 function handleRecordArtifactAdd(client, taskId, nodeId, type, path, note, content) {
@@ -1114,7 +1884,7 @@ async function handleUpgradeApply(client, templateId, decisions) {
 
 // src/client/handlers/auth.ts
 import {
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   readFileSync as readFileSync7,
   writeFileSync as writeFileSync4,
   renameSync as renameSync3,
@@ -1206,7 +1976,7 @@ function writeWorkspaceLayer(token, kind, opts) {
   const devJsonPath = join5(dir, ".siming", "dev.json");
   let config = {};
   let hadIsolationKeys = false;
-  if (existsSync5(devJsonPath)) {
+  if (existsSync6(devJsonPath)) {
     try {
       config = JSON.parse(readFileSync7(devJsonPath, "utf-8"));
       hadIsolationKeys = "serverPort" in config || "dbPrefix" in config;
@@ -1439,6 +2209,8 @@ var taskArgs = {
     "context",
     "node",
     "advance",
+    // 门禁只读预检（T202609230001：advance 前自查节点门禁，零写入）
+    "check",
     "approve",
     "pause",
     "resume",
@@ -1481,10 +2253,13 @@ var taskArgs = {
   view: hostNeutralEnum(z3.enum(["prompt", "skills", "basic", "full"])).optional(),
   nodeId: z3.string().optional(),
   // advance / record-set（note 写 history；summary 写 nodeRecords，两位独立）；
-  // finalize 为 advance 收尾确认（终节点终态化必需，中间节点无副作用——T202609130009）
+  // finalize 为 advance 收尾确认（终节点终态化必需，中间节点无副作用——T202609130009）；
+  // force/forceReason 成对（T202609230001：门禁强制推进，仅凭用户明示指令，AI 禁自决）
   note: z3.string().optional(),
   summary: z3.string().optional(),
   finalize: z3.boolean().optional(),
+  force: z3.boolean().optional(),
+  forceReason: z3.string().optional(),
   // approve
   decision: hostNeutralEnum(z3.enum(["approved", "rejected"])).optional(),
   comment: z3.string().optional(),
@@ -1496,6 +2271,21 @@ var taskArgs = {
   item: z3.string().optional(),
   checkId: z3.string().optional(),
   passed: z3.boolean().optional(),
+  // T202609230001 F1：结构化记录字段（record-set）+ 检查条目留痕锚（check-add/patch）
+  baseBranch: z3.string().optional(),
+  verifiedCommit: z3.string().optional(),
+  fixesApplied: z3.number().int().nonnegative().optional(),
+  testReport: z3.object({
+    command: z3.string(),
+    passed: z3.number().int().nonnegative(),
+    failed: z3.number().int().nonnegative(),
+    // 与 core TestReportSchema 对齐：skipped 必填（缺省语义由调用方显式补 0，禁 optional 漂移）
+    skipped: z3.number().int().nonnegative()
+  }).optional(),
+  deferredIssues: z3.array(z3.string()).optional(),
+  evidenceFiles: z3.array(z3.string()).optional(),
+  refId: z3.string().optional(),
+  source: hostNeutralEnum(z3.enum(["self", "tool"])).optional(),
   artifactType: hostNeutralEnum(z3.enum(ARTIFACT_TYPES2)).optional(),
   path: z3.string().optional(),
   file: z3.string().optional(),
@@ -1512,7 +2302,14 @@ var taskArgs = {
   trackNote: z3.string().optional(),
   text: z3.string().optional(),
   // 批量形态（T202609010002）：与对应单条参数二选一；元素字段级校验归 server 分区步（部分失败保留成功条目）
-  checkItems: z3.array(z3.object({ item: z3.string(), passed: z3.boolean().optional() })).optional(),
+  checkItems: z3.array(
+    z3.object({
+      item: z3.string(),
+      passed: z3.boolean().optional(),
+      refId: z3.string().optional(),
+      source: hostNeutralEnum(z3.enum(["self", "tool"])).optional()
+    })
+  ).optional(),
   artifactEntries: z3.array(
     z3.object({
       artifactType: z3.enum(ARTIFACT_TYPES2),
@@ -1650,7 +2447,8 @@ var TASK_FIELD_SPECS = {
   query: { required: [], optional: ["taskId", "status", "track", "projectId", "page", "limit"] },
   context: { required: ["taskId"], optional: ["view"] },
   node: { required: ["taskId", "view"], optional: ["nodeId"] },
-  advance: { required: ["taskId"], optional: ["note", "summary", "finalize"] },
+  advance: { required: ["taskId"], optional: ["note", "summary", "finalize", "force", "forceReason"] },
+  check: { required: ["taskId"], optional: [] },
   approve: { required: ["taskId", "decision"], optional: ["comment"] },
   pause: { required: ["taskId"], optional: ["reason"] },
   resume: { required: ["taskId"], optional: ["resumeNote"] },
@@ -1658,9 +2456,12 @@ var TASK_FIELD_SPECS = {
   reopen: { required: ["taskId", "reason"], optional: [] },
   history: { required: ["taskId"], optional: [] },
   instance: { required: ["taskId"], optional: [] },
-  "record-set": { required: ["taskId", "node", "summary"], optional: [] },
-  "record-check-add": { required: ["taskId", "node"], optional: ["item", "passed", "checkItems"] },
-  "record-check-patch": { required: ["taskId", "node", "checkId"], optional: ["passed"] },
+  "record-set": {
+    required: ["taskId", "node"],
+    optional: ["summary", "baseBranch", "verifiedCommit", "fixesApplied", "testReport", "deferredIssues", "evidenceFiles"]
+  },
+  "record-check-add": { required: ["taskId", "node"], optional: ["item", "passed", "checkItems", "refId", "source"] },
+  "record-check-patch": { required: ["taskId", "node", "checkId"], optional: ["passed", "item", "refId", "source"] },
   "record-artifact-add": {
     required: ["taskId", "node"],
     optional: ["artifactType", "path", "file", "content", "note", "artifactEntries"]
@@ -1688,7 +2489,7 @@ function createMcpServer() {
   const client = createClient(void 0, "mcp");
   server.tool(
     "siming_task",
-    "task \u8D44\u6E90\u57DF\u805A\u5408\u5DE5\u5177\uFF08\u4EFB\u52A1\u5168\u64CD\u4F5C\u7ECF\u672C\u5DE5\u5177 + action \u53C2\u6570\uFF09\u3002action \u5FC5\u586B\uFF1B\u8C03\u7528\u65B9\u5E94\u5728 fieldMask \u4E2D\u5217\u51FA\u672C\u6B21\u771F\u5B9E\u63D0\u4F9B\u7684\u53EF\u9009\u5B57\u6BB5\uFF0Cmask \u5916\u7531\u5BBF\u4E3B\u81EA\u52A8\u586B\u5145\u7684\u7A7A\u4E32\u3001\u7A7A\u6570\u7EC4\u3001false\u30010 \u5747\u5FFD\u7565\uFF0Cmask \u5185\u7A7A\u6570\u7EC4/false \u8868\u793A\u663E\u5F0F\u6E05\u7A7A\u6216\u5173\u95ED\uFF1B\u5404 action \u56FA\u5B9A\u5FC5\u586B\u5B57\u6BB5\u65E0\u9700\u5199\u5165 mask\u3002\u5176\u4F59\u53C2\u6570\u5168\u53EF\u9009\u3001\u6309 action \u8FD0\u884C\u65F6\u6821\u9A8C\u5FC5\u586B\uFF08\u7F3A\u5931\u8FD4\u56DE\u5931\u8D25\u4E09\u8981\u7D20\uFF1A\u5BF9\u8C61+\u6839\u56E0+\u4FEE\u590D\u6307\u5F15\uFF09\u3002projectId \u4E3A key|id \u53CC\u5F62\u6001\uFF0C\u901A\u9053\u5C42\u81EA\u52A8\u5F52\u4E00\u4E3A 24-hex id\uFF1B\u663E\u5F0F\u6307\u5B9A\u89E3\u6790\u5931\u8D25\u62A5\u9519\u4E0D\u515C\u5E95\uFF1B\u7F3A\u7701\u8BED\u4E49\u6309 action\uFF1Acreate \u843D\u9ED8\u8BA4\u9879\u76EE\u94FE\uFF08\u5DE5\u4F5C\u533A defaultProject \u5931\u6548\u62A5\u9519\uFF0C\u65E0\u914D\u7F6E\u4E0D\u4F20\u7531 server \u6309\u6A21\u677F\u5F52\u5C5E\u515C\u5E95\uFF09\uFF0Cquery \u4E0D\u8FC7\u6EE4\uFF08\u5168\u5C40\u67E5\u8BE2\uFF09\u3002\u5199\u64CD\u4F5C\uFF08create/doc-*/record-*/archnote-add/pause/resume/cancel\uFF09\u54CD\u5E94\u4E3A\u8F7B\u91CF\u56DE\u6267\uFF1A{taskId, updated(\u89E6\u53CA\u5B57\u6BB5\u8DEF\u5F84), entry(\u65B0\u6761\u76EE id+kind\uFF0C\u4F9B\u540E\u7EED patch \u5B9A\u4F4D), echo(\u5199\u5165\u5185\u5BB9\u56DE\u663E), updatedAt, task(\u4EFB\u52A1\u8FDB\u5EA6\u6458\u8981 progress: {completed,total})}\u2014\u2014\u4E0D\u8FD4\u56DE\u5B8C\u6574\u4EFB\u52A1\u5B9E\u4F53\u3002action \u6E05\u5355\uFF08\u62EC\u53F7\u5185\u4E3A\u8BE5 action \u5FC5\u586B\u53C2\u6570\uFF09\uFF1Acreate(templateId,taskTitle,track\uFF1B\u53EF\u9009 type=feature|bugfix|ui-tweak|research\u3001skipNodes\u3001projectId\uFF1BtemplateId \u652F\u6301 code|id \u53CC\u5F62\u6001\u2014\u2014code \u4E3A\u6A21\u677F\u4E1A\u52A1\u6807\u8BC6\uFF08\u9879\u76EE\u5185\u552F\u4E00\u3001kebab-case \u5FC5\u542B\u8FDE\u5B57\u7B26\uFF0C\u5982 full-workflow\uFF09\uFF0C\u63A8\u8350\u5F15\u7528\u5F62\u6001\uFF0C\u5BFB\u5740\u987B\u914D projectId \u6307\u5B9A\u9879\u76EE\u57DF\uFF1B24-hex \u6570\u636E\u5E93 id \u76F4\u67E5\u517C\u5BB9\uFF1Bcode \u5F62\u6001\u4E0D\u5B58\u5728\u65F6\u9519\u8BEF\u542B candidates \u76F8\u8FD1\u5019\u9009\u6E05\u5355\uFF08id/code/name \u22645 \u6761\uFF09\uFF1B\u54CD\u5E94 {task, firstNode}\u2014\u2014firstNode \u5373\u9996\u8282\u70B9\u5B8C\u6574\u8D44\u6599\u5305\uFF0C\u514D\u8C03 context)\uFF1Bquery(taskId \u8FD4\u56DE\u5355\u4EFB\u52A1\u8BE6\u60C5\uFF0C\u7F3A\u7701\u8FD4\u56DE\u5217\u8868\uFF0C\u53EF\u9009 status/track/projectId/page/limit)\uFF1Bcontext(taskId\uFF1B\u53EF\u9009 view=basic|full\u2014\u2014basic \u7F3A\u7701\u4E0D\u643A\u5E26 artifact \u5168\u6587\u5FEB\u7167\uFF0Cfull \u65AD\u70B9\u7EED\u8DD1\u9700\u5386\u53F2\u4EA7\u7269\u5168\u6587\u65F6\u7528\u3002\u26A0 \u514D\u91CD\u8BFB\uFF1Aadvance/approve \u6D41\u8F6C\u54CD\u5E94\u5DF2\u542B\u4E0B\u4E00\u8282\u70B9\u5B8C\u6574\u8D44\u6599\u5305\uFF0C\u540C\u4F1A\u8BDD\u5185\u6D41\u8F6C\u540E\u76F4\u63A5\u5F00\u5DE5\u3001\u65E0\u9700\u518D\u8C03 context\uFF1B\u4EC5\u65B0\u4F1A\u8BDD/\u65AD\u70B9\u7EED\u8DD1\u8C03\u7528)\uFF1Bnode(taskId,view=prompt|skills\uFF1BnodeId \u7F3A\u7701\u7528\u5F53\u524D\u8282\u70B9\uFF1B\u26A0 view \u503C\u968F action \u4E0D\u540C\uFF1Anode\u2192prompt|skills\uFF0Ccontext\u2192basic|full\uFF0C\u9519\u914D\u62A5\u9519)\uFF1Badvance(taskId\uFF1Bnote \u5199 history\u3001summary \u5199 nodeRecords\uFF0C\u4E24\u4F4D\u72EC\u7ACB\uFF1B\u54CD\u5E94\u5DF2\u542B\u4E0B\u4E00\u8282\u70B9\u8D44\u6599\u5305\uFF0C\u540C\u4F1A\u8BDD\u514D\u91CD\u8BFB context)\uFF1Bapprove(taskId,decision=approved|rejected\uFF1B\u53EF\u9009 comment\uFF1B\u54CD\u5E94\u5DF2\u542B\u4E0B\u4E00\u8282\u70B9\u8D44\u6599\u5305\uFF0C\u540C\u4F1A\u8BDD\u514D\u91CD\u8BFB context)\uFF1Bpause(taskId\uFF1B\u53EF\u9009 reason)\uFF1Bresume(taskId\uFF1B\u53EF\u9009 resumeNote)\uFF1Bcancel(taskId\uFF1B\u53EF\u9009 reason 1-500 \u5B57\u7B26\uFF1B\u26A0 \u7EC8\u6001\u4E0D\u53EF\u9006\u2014\u2014active/paused \u53EF\u53D6\u6D88\uFF0Ccompleted/cancelled \u62D2\u7EDD\u5E76\u8FD4\u56DE TASK_TERMINATED\uFF1B\u53D6\u6D88\u540E\u7ECF\u672C\u5DE5\u5177\u7684\u6D41\u8F6C\u4E0E\u8BB0\u5F55\u5199\u64CD\u4F5C\u88AB\u62D2)\uFF1Bhistory(taskId)\uFF1Binstance(taskId\u2014\u2014\u67E5\u770B\u4EFB\u52A1 DAG \u5B9E\u4F8B\u5FEB\u7167\uFF1A\u521B\u5EFA\u4EFB\u52A1\u65F6\u51BB\u7ED3\u7684\u6A21\u677F\u5B9E\u4F8B\uFF0C\u6A21\u677F\u540E\u7EED\u53D8\u66F4\u4E0D\u56DE\u6EAF)\u3002\u8BB0\u5F55\u5199\u5165\uFF1Arecord-set(taskId,node,summary)\uFF1Brecord-check-add(taskId,node,item\uFF1B\u53EF\u9009 passed \u7F3A\u7701 true\uFF1B\u56DE\u6267 entry.id \u4F9B record-check-patch \u5B9A\u4F4D)\uFF1Brecord-check-patch(taskId,node,checkId\uFF1B\u53EF\u9009 passed)\uFF1Brecord-artifact-add(taskId,node,artifactType=prd|tech|code|test|doc|other\uFF1Bpath \u7EAF\u5F15\u7528 / file \u8BFB\u672C\u673A\u6587\u4EF6 / content \u76F4\u4F20\u5168\u6587\u2014\u2014file \u4E0E content\u3001file \u4E0E path \u4E92\u65A5\uFF0Ccontent \u53EF\u4E0E path \u6210\u5BF9\u6216\u5355\u72EC\uFF0C\u5355\u72EC\u65F6\u767B\u8BB0\u503C\u5408\u6210 mcp-inline/<type>\uFF1B\u53EF\u9009 note)\uFF1Brecord-confirm(taskId,node,quote\u2014\u2014\u6682\u505C\u70B9\u7528\u6237\u786E\u8BA4\u539F\u6587\u9010\u5B57)\uFF1Brecord-decision-add(taskId,node,topic,decisionText)\uFF1Brecord-review-set(taskId,node,verdict=pass|fail,rounds,critical)\u3002\u9700\u6C42\u6587\u6863\uFF1Adoc-set(taskId\uFF1Bwhat/why/trackNote \u81F3\u5C11\u4F20\u4E00)\uFF1Bdoc-acceptance-add(taskId,text)\uFF1Bdoc-non-goal-add(taskId,text)\u3002\u7D20\u6750\uFF1Aarchnote-add(taskId,text)\u3002\u6279\u91CF\u5F62\u6001\uFF08\u63A8\u8350\uFF0C\u516D\u7C7B\u540C\u6784\uFF09\uFF1Arecord-check-add \u4F20 checkItems=[{item,passed?}]\u3001record-artifact-add \u4F20 artifactEntries=[{artifactType,path?/file?/content?,note?}]\u3001record-decision-add \u4F20 decisionEntries=[{topic,decisionText}]\u3001doc-acceptance-add/doc-non-goal-add/archnote-add \u4F20 textItems=[string]\u2014\u2014\u6279\u91CF\u53C2\u6570\u4E0E\u5355\u6761\u53C2\u6570\u4E8C\u9009\u4E00\uFF0C\u4E00\u6B21\u8C03\u7528\u5199\u591A\u6761\uFF08\u4E0A\u9650 50 \u6761/\u6279\uFF0Cartifact \u5168\u6587\u5FEB\u7167\u603B\u91CF \u22642M \u5B57\u7B26/\u6279\uFF09\uFF1B\u90E8\u5206\u5931\u8D25\u4FDD\u7559\u6210\u529F\u6761\u76EE\u5E76\u9010\u6761\u62A5\u544A\uFF08failures[].index=\u539F\u59CB\u63D0\u4EA4\u5E8F\uFF0C\u53EA\u91CD\u8BD5\u5931\u8D25\u9879\uFF09\uFF0Capplied=0 \u6574\u4F53\u62A5\u5931\u8D25\u3002",
+    "task \u8D44\u6E90\u57DF\u805A\u5408\u5DE5\u5177\uFF08\u4EFB\u52A1\u5168\u64CD\u4F5C\u7ECF\u672C\u5DE5\u5177 + action \u53C2\u6570\uFF09\u3002action \u5FC5\u586B\uFF1B\u8C03\u7528\u65B9\u5E94\u5728 fieldMask \u4E2D\u5217\u51FA\u672C\u6B21\u771F\u5B9E\u63D0\u4F9B\u7684\u53EF\u9009\u5B57\u6BB5\uFF0Cmask \u5916\u7531\u5BBF\u4E3B\u81EA\u52A8\u586B\u5145\u7684\u7A7A\u4E32\u3001\u7A7A\u6570\u7EC4\u3001false\u30010 \u5747\u5FFD\u7565\uFF0Cmask \u5185\u7A7A\u6570\u7EC4/false \u8868\u793A\u663E\u5F0F\u6E05\u7A7A\u6216\u5173\u95ED\uFF1B\u5404 action \u56FA\u5B9A\u5FC5\u586B\u5B57\u6BB5\u65E0\u9700\u5199\u5165 mask\u3002\u5176\u4F59\u53C2\u6570\u5168\u53EF\u9009\u3001\u6309 action \u8FD0\u884C\u65F6\u6821\u9A8C\u5FC5\u586B\uFF08\u7F3A\u5931\u8FD4\u56DE\u5931\u8D25\u4E09\u8981\u7D20\uFF1A\u5BF9\u8C61+\u6839\u56E0+\u4FEE\u590D\u6307\u5F15\uFF09\u3002projectId \u4E3A key|id \u53CC\u5F62\u6001\uFF0C\u901A\u9053\u5C42\u81EA\u52A8\u5F52\u4E00\u4E3A 24-hex id\uFF1B\u663E\u5F0F\u6307\u5B9A\u89E3\u6790\u5931\u8D25\u62A5\u9519\u4E0D\u515C\u5E95\uFF1B\u7F3A\u7701\u8BED\u4E49\u6309 action\uFF1Acreate \u843D\u9ED8\u8BA4\u9879\u76EE\u94FE\uFF08\u5DE5\u4F5C\u533A defaultProject \u5931\u6548\u62A5\u9519\uFF0C\u65E0\u914D\u7F6E\u4E0D\u4F20\u7531 server \u6309\u6A21\u677F\u5F52\u5C5E\u515C\u5E95\uFF09\uFF0Cquery \u4E0D\u8FC7\u6EE4\uFF08\u5168\u5C40\u67E5\u8BE2\uFF09\u3002\u5199\u64CD\u4F5C\uFF08create/doc-*/record-*/archnote-add/pause/resume/cancel\uFF09\u54CD\u5E94\u4E3A\u8F7B\u91CF\u56DE\u6267\uFF1A{taskId, updated(\u89E6\u53CA\u5B57\u6BB5\u8DEF\u5F84), entry(\u65B0\u6761\u76EE id+kind\uFF0C\u4F9B\u540E\u7EED patch \u5B9A\u4F4D), echo(\u5199\u5165\u5185\u5BB9\u56DE\u663E), updatedAt, task(\u4EFB\u52A1\u8FDB\u5EA6\u6458\u8981 progress: {completed,total})}\u2014\u2014\u4E0D\u8FD4\u56DE\u5B8C\u6574\u4EFB\u52A1\u5B9E\u4F53\u3002action \u6E05\u5355\uFF08\u62EC\u53F7\u5185\u4E3A\u8BE5 action \u5FC5\u586B\u53C2\u6570\uFF09\uFF1Acreate(templateId,taskTitle,track\uFF1B\u53EF\u9009 type=feature|bugfix|ui-tweak|research\u3001skipNodes\u3001projectId\uFF1BtemplateId \u652F\u6301 code|id \u53CC\u5F62\u6001\u2014\u2014code \u4E3A\u6A21\u677F\u4E1A\u52A1\u6807\u8BC6\uFF08\u9879\u76EE\u5185\u552F\u4E00\u3001kebab-case \u5FC5\u542B\u8FDE\u5B57\u7B26\uFF0C\u5982 full-workflow\uFF09\uFF0C\u63A8\u8350\u5F15\u7528\u5F62\u6001\uFF0C\u5BFB\u5740\u987B\u914D projectId \u6307\u5B9A\u9879\u76EE\u57DF\uFF1B24-hex \u6570\u636E\u5E93 id \u76F4\u67E5\u517C\u5BB9\uFF1Bcode \u5F62\u6001\u4E0D\u5B58\u5728\u65F6\u9519\u8BEF\u542B candidates \u76F8\u8FD1\u5019\u9009\u6E05\u5355\uFF08id/code/name \u22645 \u6761\uFF09\uFF1B\u54CD\u5E94 {task, firstNode}\u2014\u2014firstNode \u5373\u9996\u8282\u70B9\u5B8C\u6574\u8D44\u6599\u5305\uFF0C\u514D\u8C03 context)\uFF1Bquery(taskId \u8FD4\u56DE\u5355\u4EFB\u52A1\u8BE6\u60C5\uFF0C\u7F3A\u7701\u8FD4\u56DE\u5217\u8868\uFF0C\u53EF\u9009 status/track/projectId/page/limit)\uFF1Bcontext(taskId\uFF1B\u53EF\u9009 view=basic|full\u2014\u2014basic \u7F3A\u7701\u4E0D\u643A\u5E26 artifact \u5168\u6587\u5FEB\u7167\uFF0Cfull \u65AD\u70B9\u7EED\u8DD1\u9700\u5386\u53F2\u4EA7\u7269\u5168\u6587\u65F6\u7528\u3002\u26A0 \u514D\u91CD\u8BFB\uFF1Aadvance/approve \u6D41\u8F6C\u54CD\u5E94\u5DF2\u542B\u4E0B\u4E00\u8282\u70B9\u5B8C\u6574\u8D44\u6599\u5305\uFF0C\u540C\u4F1A\u8BDD\u5185\u6D41\u8F6C\u540E\u76F4\u63A5\u5F00\u5DE5\u3001\u65E0\u9700\u518D\u8C03 context\uFF1B\u4EC5\u65B0\u4F1A\u8BDD/\u65AD\u70B9\u7EED\u8DD1\u8C03\u7528)\uFF1Bnode(taskId,view=prompt|skills\uFF1BnodeId \u7F3A\u7701\u7528\u5F53\u524D\u8282\u70B9\uFF1B\u26A0 view \u503C\u968F action \u4E0D\u540C\uFF1Anode\u2192prompt|skills\uFF0Ccontext\u2192basic|full\uFF0C\u9519\u914D\u62A5\u9519)\uFF1Badvance(taskId\uFF1Bnote \u5199 history\u3001summary \u5199 nodeRecords\uFF0C\u4E24\u4F4D\u72EC\u7ACB\uFF1B\u54CD\u5E94\u5DF2\u542B\u4E0B\u4E00\u8282\u70B9\u8D44\u6599\u5305\uFF0C\u540C\u4F1A\u8BDD\u514D\u91CD\u8BFB context\u3002\u26A0 T202609230001 \u8282\u70B9\u95E8\u7981\uFF1A\u914D\u7F6E\u4E86 toolChecks/aiChecks \u7684\u8282\u70B9\u63A8\u8FDB\u524D\u81EA\u52A8\u6267\u884C\u68C0\u67E5\u2014\u2014fail \u4F1A\u88AB\u6253\u56DE\u5E76\u8FD4\u56DE\u9010\u9879\u4FEE\u590D\u6307\u5F15\uFF08\u7ED3\u679C\u5DF2\u5199 history checks_rejected\uFF09\uFF0C\u6309\u6307\u5F15\u4FEE\u590D\u6216\u83B7\u7528\u6237\u8C41\u514D\u7559\u75D5\u540E\u91CD\u63A8\uFF1B\u975E\u4EBA\u5DE5\u5BA1\u6279\u8282\u70B9\u7981\u6B62\u56E0\u95E8\u7981\u4E2D\u65AD\u4EFB\u52A1\uFF08\u6253\u56DE\u4FE1\u606F\u5373\u7EE7\u7EED\u4F9D\u636E\uFF09\u3002force+forceReason \u6210\u5BF9\u63D0\u4F9B\u65F6\u53EF\u8D8A\u8FC7 fail \u5F3A\u5236\u63A8\u8FDB\u2014\u2014\u4EC5\u51ED\u7528\u6237\u660E\u793A\u6307\u4EE4\uFF0CAI \u7981\u6B62\u81EA\u51B3\uFF0C\u7406\u7531\u539F\u6587\u843D history \u5BA1\u8BA1)\uFF1Bcheck(taskId\uFF1B\u95E8\u7981\u53EA\u8BFB\u9884\u68C0\u2014\u2014\u9010\u9879\u62A5\u544A\u4E0D\u5199\u4EFB\u4F55\u72B6\u6001\uFF0Cadvance \u524D\u81EA\u67E5\u7528)\uFF1Bapprove(taskId,decision=approved|rejected\uFF1B\u53EF\u9009 comment\uFF1B\u54CD\u5E94\u5DF2\u542B\u4E0B\u4E00\u8282\u70B9\u8D44\u6599\u5305\uFF0C\u540C\u4F1A\u8BDD\u514D\u91CD\u8BFB context)\uFF1Bpause(taskId\uFF1B\u53EF\u9009 reason)\uFF1Bresume(taskId\uFF1B\u53EF\u9009 resumeNote)\uFF1Bcancel(taskId\uFF1B\u53EF\u9009 reason 1-500 \u5B57\u7B26\uFF1B\u26A0 \u7EC8\u6001\u4E0D\u53EF\u9006\u2014\u2014active/paused \u53EF\u53D6\u6D88\uFF0Ccompleted/cancelled \u62D2\u7EDD\u5E76\u8FD4\u56DE TASK_TERMINATED\uFF1B\u53D6\u6D88\u540E\u7ECF\u672C\u5DE5\u5177\u7684\u6D41\u8F6C\u4E0E\u8BB0\u5F55\u5199\u64CD\u4F5C\u88AB\u62D2)\uFF1Bhistory(taskId)\uFF1Binstance(taskId\u2014\u2014\u67E5\u770B\u4EFB\u52A1 DAG \u5B9E\u4F8B\u5FEB\u7167\uFF1A\u521B\u5EFA\u4EFB\u52A1\u65F6\u51BB\u7ED3\u7684\u6A21\u677F\u5B9E\u4F8B\uFF0C\u6A21\u677F\u540E\u7EED\u53D8\u66F4\u4E0D\u56DE\u6EAF)\u3002\u8BB0\u5F55\u5199\u5165\uFF1Arecord-set(taskId,node\uFF1Bsummary \u4E0E\u516D\u4E2A\u7ED3\u6784\u5316\u5B57\u6BB5\uFF08baseBranch/verifiedCommit/fixesApplied/testReport/deferredIssues/evidenceFiles\uFF09\u81F3\u5C11\u5176\u4E00\u2014\u2014\u7ED3\u6784\u5316\u5B57\u6BB5\u6309\u8282\u70B9 prompt\u300C\u7ED3\u6784\u5316\u5B57\u6BB5\u5199\u5165\u8981\u6C42\u300D\u9010\u5B57\u6BB5\u843D\u5E93\uFF0CPATCH \u8BED\u4E49=\u4EC5\u66F4\u65B0\u63D0\u4F9B\u5B57\u6BB5)\uFF1Brecord-check-add(taskId,node,item\uFF1B\u53EF\u9009 passed \u7F3A\u7701 true\u3001refId=aiChecks \u81EA\u68C0\u7559\u75D5\u951A\uFF08\u5BA1\u8BA1\u8BA4 refId===aiCheck.id \u4E14 passed=true\uFF0C\u7F3A\u7559\u75D5\u7684\u5B8C\u6210\u5224\u5B9A\u5BA1\u8BA1 fail\uFF09\u3001source=self|tool \u672C\u7248\u5DE5\u5177\u7F3A\u7701\u4E0D\u5199\uFF1B\u6279\u91CF checkItems \u5143\u7D20\u540C\u6784\uFF1B\u56DE\u6267 entry.id \u4F9B record-check-patch \u5B9A\u4F4D)\uFF1Brecord-check-patch(taskId,node,checkId\uFF1B\u53EF\u9009 passed/item/refId/source\uFF0C\u4EC5\u66F4\u65B0\u63D0\u4F9B\u5B57\u6BB5)\uFF1Brecord-artifact-add(taskId,node,artifactType=prd|tech|code|test|doc|other\uFF1Bpath \u7EAF\u5F15\u7528 / file \u8BFB\u672C\u673A\u6587\u4EF6 / content \u76F4\u4F20\u5168\u6587\u2014\u2014file \u4E0E content\u3001file \u4E0E path \u4E92\u65A5\uFF0Ccontent \u53EF\u4E0E path \u6210\u5BF9\u6216\u5355\u72EC\uFF0C\u5355\u72EC\u65F6\u767B\u8BB0\u503C\u5408\u6210 mcp-inline/<type>\uFF1B\u53EF\u9009 note)\uFF1Brecord-confirm(taskId,node,quote\u2014\u2014\u6682\u505C\u70B9\u7528\u6237\u786E\u8BA4\u539F\u6587\u9010\u5B57)\uFF1Brecord-decision-add(taskId,node,topic,decisionText)\uFF1Brecord-review-set(taskId,node,verdict=pass|fail,rounds,critical)\u3002\u9700\u6C42\u6587\u6863\uFF1Adoc-set(taskId\uFF1Bwhat/why/trackNote \u81F3\u5C11\u4F20\u4E00)\uFF1Bdoc-acceptance-add(taskId,text)\uFF1Bdoc-non-goal-add(taskId,text)\u3002\u7D20\u6750\uFF1Aarchnote-add(taskId,text)\u3002\u6279\u91CF\u5F62\u6001\uFF08\u63A8\u8350\uFF0C\u516D\u7C7B\u540C\u6784\uFF09\uFF1Arecord-check-add \u4F20 checkItems=[{item,passed?}]\u3001record-artifact-add \u4F20 artifactEntries=[{artifactType,path?/file?/content?,note?}]\u3001record-decision-add \u4F20 decisionEntries=[{topic,decisionText}]\u3001doc-acceptance-add/doc-non-goal-add/archnote-add \u4F20 textItems=[string]\u2014\u2014\u6279\u91CF\u53C2\u6570\u4E0E\u5355\u6761\u53C2\u6570\u4E8C\u9009\u4E00\uFF0C\u4E00\u6B21\u8C03\u7528\u5199\u591A\u6761\uFF08\u4E0A\u9650 50 \u6761/\u6279\uFF0Cartifact \u5168\u6587\u5FEB\u7167\u603B\u91CF \u22642M \u5B57\u7B26/\u6279\uFF09\uFF1B\u90E8\u5206\u5931\u8D25\u4FDD\u7559\u6210\u529F\u6761\u76EE\u5E76\u9010\u6761\u62A5\u544A\uFF08failures[].index=\u539F\u59CB\u63D0\u4EA4\u5E8F\uFF0C\u53EA\u91CD\u8BD5\u5931\u8D25\u9879\uFF09\uFF0Capplied=0 \u6574\u4F53\u62A5\u5931\u8D25\u3002",
     taskArgs,
     async (rawArgs) => {
       const masked = applyFieldMask(rawArgs, TASK_FIELD_SPECS);
@@ -1776,7 +2577,19 @@ function createMcpServer() {
         case "advance": {
           const { taskId } = args;
           if (taskId === void 0) return requireError("advance", ["taskId"], args);
-          return mcpContent(await handleAdvance(client, taskId, args.note, args.summary, args.finalize === true));
+          if (args.force === true !== (args.forceReason !== void 0)) {
+            return localError("force \u4E0E forceReason \u5FC5\u987B\u6210\u5BF9\u63D0\u4F9B", '\u5F3A\u5236\u63A8\u8FDB\u4EC5\u51ED\u7528\u6237\u660E\u793A\u6307\u4EE4\uFF1A{"force":true,"forceReason":"<\u7528\u6237\u539F\u8BDD>"}');
+          }
+          const gate = {
+            ...args.force === true ? { force: true } : {},
+            ...args.forceReason !== void 0 ? { forceReason: args.forceReason } : {}
+          };
+          return mcpContent(await handleAdvanceWithGate(client, taskId, gate, args.note, args.summary, args.finalize === true));
+        }
+        case "check": {
+          const { taskId } = args;
+          if (taskId === void 0) return requireError("check", ["taskId"], args);
+          return mcpContent(await handleTaskCheck(client, taskId));
         }
         case "approve": {
           const { taskId, decision } = args;
@@ -1818,11 +2631,26 @@ function createMcpServer() {
           return mcpContent(await handleGetInstance(client, taskId));
         }
         case "record-set": {
-          const { taskId, node, summary } = args;
-          if (taskId === void 0 || node === void 0 || summary === void 0) {
-            return requireError("record-set", ["taskId", "node", "summary"], args);
+          const { taskId, node } = args;
+          if (taskId === void 0 || node === void 0) {
+            return requireError("record-set", ["taskId", "node"], args);
           }
-          return mcpContent(await handleRecordSummarySet(client, taskId, node, summary));
+          const fields = {
+            ...args.summary !== void 0 ? { summary: args.summary } : {},
+            ...args.baseBranch !== void 0 ? { baseBranch: args.baseBranch } : {},
+            ...args.verifiedCommit !== void 0 ? { verifiedCommit: args.verifiedCommit } : {},
+            ...args.fixesApplied !== void 0 ? { fixesApplied: args.fixesApplied } : {},
+            ...args.testReport !== void 0 ? { testReport: args.testReport } : {},
+            ...args.deferredIssues !== void 0 ? { deferredIssues: args.deferredIssues } : {},
+            ...args.evidenceFiles !== void 0 ? { evidenceFiles: args.evidenceFiles } : {}
+          };
+          if (Object.keys(fields).length === 0) {
+            return localError(
+              "record-set \u9700\u8981\u81F3\u5C11\u4E00\u4E2A\u5B57\u6BB5\uFF08summary \u6216\u7ED3\u6784\u5316\u5B57\u6BB5\uFF09",
+              "\u7ED3\u6784\u5316\u5B57\u6BB5\u6309\u8282\u70B9 prompt\u300C\u7ED3\u6784\u5316\u5B57\u6BB5\u5199\u5165\u8981\u6C42\u300D\u9010\u5B57\u6BB5\u843D\u5E93\uFF1AbaseBranch/verifiedCommit/fixesApplied/testReport/deferredIssues/evidenceFiles"
+            );
+          }
+          return mcpContent(await handleRecordSummarySet(client, taskId, node, fields));
         }
         case "record-check-add": {
           const { taskId, node } = args;
@@ -1842,7 +2670,13 @@ function createMcpServer() {
           if (taskId === void 0 || node === void 0 || item === void 0) {
             return requireError("record-check-add", ["taskId", "node", "item"], args);
           }
-          return mcpContent(await handleRecordCheckAdd(client, taskId, node, item, args.passed ?? true));
+          return mcpContent(
+            await handleRecordCheckAdd(client, taskId, node, item, args.passed ?? true, {
+              // refId=aiChecks 自检留痕锚（审计认 refId===check.id 且 passed）；source 本版工具缺省不写
+              ...args.refId !== void 0 ? { refId: args.refId } : {},
+              ...args.source !== void 0 ? { source: args.source } : {}
+            })
+          );
         }
         case "record-check-patch": {
           const { taskId, node, checkId } = args;
@@ -1850,7 +2684,13 @@ function createMcpServer() {
             return requireError("record-check-patch", ["taskId", "node", "checkId"], args);
           }
           return mcpContent(
-            await handleRecordCheckPatch(client, taskId, node, checkId, args.passed ?? true)
+            await handleRecordCheckPatch(client, taskId, node, checkId, {
+              // H2：passed 仅显式透传——缺省不默认 true（防未通过留痕被静默翻绿绕过自检门禁）
+              ...args.passed !== void 0 ? { passed: args.passed } : {},
+              ...args.item !== void 0 ? { item: args.item } : {},
+              ...args.refId !== void 0 ? { refId: args.refId } : {},
+              ...args.source !== void 0 ? { source: args.source } : {}
+            })
           );
         }
         case "record-artifact-add": {
@@ -2438,9 +3278,29 @@ function createTaskCommand() {
     }
     renderResult("json", result);
   });
-  task.command("advance <taskId>").description("Advance a task to the next node (record contents already written via `task record/doc`; this is the light finish). At the final node the advance is rejected unless --finalize is passed (completion confirmation)").option("--url <url>", "server base URL").option("--format <fmt>", "output format", "json").option("--note <text>", "advance note recorded in history").option("--summary <text>", "finishing summary written to nodeRecords.<node>.summary (equivalent to a final `record set --summary`)").option("--finalize", "completion confirmation: finalize the task at its final node (required there; ignored mid-flow)").action(async (taskId, opts) => {
+  task.command("advance <taskId>").description("Advance a task to the next node (record contents already written via `task record/doc`; this is the light finish). At the final node the advance is rejected unless --finalize is passed (completion confirmation). Node gate checks run before the request; failures block the advance").option("--url <url>", "server base URL").option("--format <fmt>", "output format", "json").option("--note <text>", "advance note recorded in history").option("--summary <text>", "finishing summary written to nodeRecords.<node>.summary (equivalent to a final `record set --summary`)").option("--finalize", "completion confirmation: finalize the task at its final node (required there; ignored mid-flow)").option("--force", "bypass gate failures (user instruction; requires --force-reason, audit trail written to history)").option("--force-reason <text>", "verbatim user instruction justifying --force (audit trail)").action(async (taskId, opts) => {
+    if (opts.force === true !== (opts.forceReason !== void 0)) {
+      renderResult(opts.format, fail({
+        message: "--force \u4E0E --force-reason \u5FC5\u987B\u6210\u5BF9\u63D0\u4F9B",
+        hint: '\u7528\u6CD5\uFF1Asiming task advance <taskId> --force --force-reason "<\u7528\u6237\u660E\u793A\u539F\u6587>"\uFF1B\u7559\u75D5\u5C06\u5199\u5165\u4EFB\u52A1 history',
+        httpStatus: 0
+      }));
+      return;
+    }
     const client = createClient(opts.url);
-    const result = await handleAdvance(client, taskId, opts.note, opts.summary, opts.finalize === true);
+    const result = opts.force === true ? await handleAdvanceWithGate(
+      client,
+      taskId,
+      opts.forceReason === void 0 ? { force: true } : { force: true, forceReason: opts.forceReason },
+      opts.note,
+      opts.summary,
+      opts.finalize === true
+    ) : await handleAdvance(client, taskId, opts.note, opts.summary, opts.finalize === true);
+    renderResult(opts.format, result);
+  });
+  task.command("check <taskId>").description("Read-only gate check: run current node tool/ai checks and print the result matrix (no writes, no history, no advance)").option("--url <url>", "server base URL").option("--format <fmt>", "output format", "json").action(async (taskId, opts) => {
+    const client = createClient(opts.url);
+    const result = await handleTaskCheck(client, taskId);
     renderResult(opts.format, result);
   });
   task.command("approve <taskId>").description("Approve or reject a task paused at a human_approval pause point").option("--url <url>", "server base URL").option("--format <fmt>", "output format", "json").requiredOption("--decision <d>", "decision: approved|rejected").option("--comment <text>", "decision comment recorded in history").action(async (taskId, opts) => {
@@ -2575,17 +3435,60 @@ function createTaskCommand() {
     renderResult(opts.format, result, { fields: result.success ? nodeFields(result.data) : [] });
   });
   const record = task.command("record").description("Node execution records \u2014 summary/checks/artifacts/confirmations/decisions/review (draft-writable, small-step append)");
-  withCommonOpts(record.command("set <taskId>"), "fancy").description("Set node summary (draft during execution; advance --summary is the finishing equivalent)").requiredOption("--node <nid>", "node id (see `task context`)").requiredOption("--summary <text>", "node summary text").action(async (taskId, opts) => {
-    const client = createClient(opts.url);
-    const result = await handleRecordSummarySet(client, taskId, opts.node, opts.summary);
-    if (result.success) {
-      renderResult(opts.format, result, { successMessage: `${taskId} \u8282\u70B9 ${opts.node} summary \u5DF2\u5199\u5165` });
-    } else {
-      renderResult(opts.format, result);
+  withCommonOpts(record.command("set <taskId>"), "fancy").description("Set node record fields \u2014 --summary and/or structured fields (T202609230001: baseBranch/testReport/... ; at least one required)").requiredOption("--node <nid>", "node id (see `task context`)").option("--summary <text>", "node summary text").option("--base-branch <branch>", "align \u57FA\u7840\u5206\u652F\uFF08test-integrate \u7B49\u8282\u70B9\u7ED3\u6784\u5316\u5199\u5165\uFF09").option("--verified-commit <sha>", "\u9A8C\u8BC1\u901A\u8FC7\u5BF9\u5E94\u7684\u63D0\u4EA4\u53F7\uFF08verifiedCommit\uFF09").option("--fixes-applied <n>", "fixesApplied \u4FEE\u590D\u6B21\u6570\uFF08\u975E\u8D1F\u6574\u6570\uFF1BB4 \u6761\u4EF6\u95E8\u7981\uFF1A>0 \u987B\u8BC4\u5BA1 verdict=pass\uFF09").option("--test-report <json>", `testReport JSON\uFF1A'{"command":"pnpm test","passed":10,"failed":0,"skipped":0}'`).option("--deferred-issues <list>", "\u5EF6\u540E\u95EE\u9898 id \u5217\u8868\uFF08\u9017\u53F7\u5206\u9694\uFF09").option("--evidence-files <list>", "\u8BC1\u636E\u6587\u4EF6\u8DEF\u5F84\u5217\u8868\uFF08\u9017\u53F7\u5206\u9694\uFF09").action(
+    async (taskId, opts) => {
+      const client = createClient(opts.url);
+      let fixesApplied;
+      let testReport;
+      if (opts.fixesApplied !== void 0) {
+        const n = Number(opts.fixesApplied);
+        if (!Number.isInteger(n) || n < 0) {
+          renderResult(opts.format, fail({ message: `--fixes-applied \u987B\u4E3A\u975E\u8D1F\u6574\u6570\uFF08\u6536\u5230 ${opts.fixesApplied}\uFF09`, httpStatus: 0 }));
+          return;
+        }
+        fixesApplied = n;
+      }
+      if (opts.testReport !== void 0) {
+        try {
+          testReport = JSON.parse(opts.testReport);
+        } catch {
+          renderResult(opts.format, fail({ message: `--test-report JSON \u89E3\u6790\u5931\u8D25: ${opts.testReport}`, httpStatus: 0 }));
+          return;
+        }
+      }
+      const splitList = (raw) => raw === void 0 ? void 0 : raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+      const deferredIssues = splitList(opts.deferredIssues);
+      const evidenceFiles = splitList(opts.evidenceFiles);
+      const fields = {
+        ...opts.summary !== void 0 ? { summary: opts.summary } : {},
+        ...opts.baseBranch !== void 0 ? { baseBranch: opts.baseBranch } : {},
+        ...opts.verifiedCommit !== void 0 ? { verifiedCommit: opts.verifiedCommit } : {},
+        ...fixesApplied !== void 0 ? { fixesApplied } : {},
+        ...testReport !== void 0 ? { testReport } : {},
+        ...deferredIssues !== void 0 ? { deferredIssues } : {},
+        ...evidenceFiles !== void 0 ? { evidenceFiles } : {}
+      };
+      if (Object.keys(fields).length === 0) {
+        renderResult(
+          opts.format,
+          fail({
+            message: "\u9700\u8981\u81F3\u5C11\u4E00\u4E2A\u5B57\u6BB5\uFF1A--summary \u6216\u7ED3\u6784\u5316\u5B57\u6BB5\uFF08--base-branch/--verified-commit/--fixes-applied/--test-report/--deferred-issues/--evidence-files\uFF09",
+            httpStatus: 0,
+            hint: "\u7ED3\u6784\u5316\u5B57\u6BB5\u6309\u8282\u70B9 prompt\u300C\u7ED3\u6784\u5316\u5B57\u6BB5\u5199\u5165\u8981\u6C42\u300D\u9010\u5B57\u6BB5\u843D\u5E93\uFF08summary PATCH \u8BED\u4E49=\u4EC5\u66F4\u65B0\u63D0\u4F9B\u5B57\u6BB5\uFF09"
+          })
+        );
+        return;
+      }
+      const result = await handleRecordSummarySet(client, taskId, opts.node, fields);
+      if (result.success) {
+        renderResult(opts.format, result, { successMessage: `${taskId} \u8282\u70B9 ${opts.node} record \u5DF2\u5199\u5165\uFF08${Object.keys(fields).join("/")}\uFF09` });
+      } else {
+        renderResult(opts.format, result);
+      }
     }
-  });
+  );
   const check = record.command("check").description("Completion-check items (server-generated short ids)");
-  withCommonOpts(check.command("add <taskId>"), "fancy").description("Append completion-check item(s) \u2014 single --item (legacy form) / repeat --item or --entry JSON for batch (T202609010002)").requiredOption("--node <nid>", "node id").option("--item <text>", "check item text; repeatable \xD72+ = batch (single occurrence without --entry = single form; mixed with --entry, --item group comes first in submit order)", collectArgs, []).option("--entry <json>", 'batch element {"item":"...","passed":true} (repeatable; passed per-item, default true)', collectArgs, []).option("--failed", "record as not passed (single form only; mutually exclusive with batch params)").action(async (taskId, opts) => {
+  withCommonOpts(check.command("add <taskId>"), "fancy").description("Append completion-check item(s) \u2014 single --item (legacy form) / repeat --item or --entry JSON for batch (T202609010002)").requiredOption("--node <nid>", "node id").option("--item <text>", "check item text; repeatable \xD72+ = batch (single occurrence without --entry = single form; mixed with --entry, --item group comes first in submit order)", collectArgs, []).option("--entry <json>", 'batch element {"item":"...","passed":true,"refId":"ai-check-id","source":"tool"} (repeatable; passed per-item default true; refId=aiChecks \u81EA\u68C0\u7559\u75D5\u951A)', collectArgs, []).option("--failed", "record as not passed (single form only; mutually exclusive with batch params)").option("--ref-id <id>", "aiCheck id \u7559\u75D5\u951A\uFF08\u5355\u6761\u5F62\u6001\uFF1B\u5BA1\u8BA1\u8BA4 refId===aiCheck.id \u4E14 passed\uFF09").option("--source <src>", "\u6761\u76EE\u6765\u6E90\u6807\u8BB0\uFF08self|tool\uFF1B\u672C\u7248\u5DE5\u5177\u7F3A\u7701\u4E0D\u5199\uFF0Cself \u4E3A AI \u81EA\u62A5\u7F3A\u7701\uFF09").action(async (taskId, opts) => {
     const client = createClient(opts.url);
     const items = opts.item ?? [];
     const rawEntries = opts.entry ?? [];
@@ -2607,7 +3510,14 @@ function createTaskCommand() {
       return;
     }
     if (!batchMode) {
-      const result2 = await handleRecordCheckAdd(client, taskId, opts.node, items[0], !opts.failed);
+      if (opts.source !== void 0 && opts.source !== "self" && opts.source !== "tool") {
+        renderResult(opts.format, fail({ message: `--source \u4EC5\u652F\u6301 self|tool\uFF08\u6536\u5230 ${opts.source}\uFF09`, httpStatus: 0 }));
+        return;
+      }
+      const result2 = await handleRecordCheckAdd(client, taskId, opts.node, items[0], !opts.failed, {
+        ...opts.refId !== void 0 ? { refId: opts.refId } : {},
+        ...opts.source !== void 0 ? { source: opts.source } : {}
+      });
       if (result2.success) {
         renderResult(opts.format, result2, { successMessage: `${taskId} \u8282\u70B9 ${opts.node} check \u5DF2\u6DFB\u52A0\uFF08\u65B0\u6761\u76EE id ${result2.data.entry?.id ?? "?"}\uFF09` });
       } else {
@@ -2631,12 +3541,25 @@ function createTaskCommand() {
           localFailures.push({ index: submitIndex, message: "passed \u987B\u4E3A\u5E03\u5C14" });
           return;
         }
+        if (j.refId !== void 0 && typeof j.refId !== "string") {
+          localFailures.push({ index: submitIndex, message: "refId \u987B\u4E3A\u5B57\u7B26\u4E32\uFF08aiCheck id\uFF09" });
+          return;
+        }
+        if (j.source !== void 0 && j.source !== "self" && j.source !== "tool") {
+          localFailures.push({ index: submitIndex, message: "source \u4EC5\u652F\u6301 self|tool" });
+          return;
+        }
         entryPairs.push({
-          entry: { item: j.item, ...typeof j.passed === "boolean" ? { passed: j.passed } : {} },
+          entry: {
+            item: j.item,
+            ...typeof j.passed === "boolean" ? { passed: j.passed } : {},
+            ...typeof j.refId === "string" ? { refId: j.refId } : {},
+            ...j.source === "self" || j.source === "tool" ? { source: j.source } : {}
+          },
           rawIndex: i
         });
       } catch {
-        localFailures.push({ index: submitIndex, message: `--entry JSON \u89E3\u6790\u5931\u8D25: ${raw}`, hint: '\u5143\u7D20\u5F62\u5982 {"item":"...","passed":true}' });
+        localFailures.push({ index: submitIndex, message: `--entry JSON \u89E3\u6790\u5931\u8D25: ${raw}`, hint: '\u5143\u7D20\u5F62\u5982 {"item":"...","passed":true,"refId":"..."}' });
       }
     });
     const submitted = [...itemElements, ...entryPairs.map((p) => p.entry)];
@@ -2653,7 +3576,7 @@ function createTaskCommand() {
   });
   withCommonOpts(check.command("patch <taskId>"), "fancy").description("Flip one check item pass/fail state by check id").requiredOption("--node <nid>", "node id").requiredOption("--check <cid>", "check entry id (from check add output / task context)").option("--failed", "flip to not passed (default: passed)").action(async (taskId, opts) => {
     const client = createClient(opts.url);
-    const result = await handleRecordCheckPatch(client, taskId, opts.node, opts.check, !opts.failed);
+    const result = await handleRecordCheckPatch(client, taskId, opts.node, opts.check, { passed: !opts.failed });
     if (result.success) {
       renderResult(opts.format, result, { successMessage: `${taskId} \u8282\u70B9 ${opts.node} check ${opts.check} \u2192 ${opts.failed ? "failed" : "passed"}` });
     } else {
@@ -2973,7 +3896,7 @@ import { Command as Command3 } from "commander";
 import { SKILL_MAIN_DOC, SkillScopeSchema } from "@siming-org/core";
 
 // src/client/scaffold-templates.ts
-import { existsSync as existsSync6, readdirSync, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync7, readdirSync, readFileSync as readFileSync11 } from "fs";
 import { dirname as dirname3, join as join6 } from "path";
 import { fileURLToPath } from "url";
 var SCAFFOLD_DIR = join6("templates", "project-skills");
@@ -2982,7 +3905,7 @@ function resolveCliPackageRoot() {
   let dir = dirname3(fileURLToPath(import.meta.url));
   for (let depth = 0; depth < 10; depth += 1) {
     const pkgFile = join6(dir, "package.json");
-    if (existsSync6(pkgFile)) {
+    if (existsSync7(pkgFile)) {
       try {
         const pkg = JSON.parse(readFileSync11(pkgFile, "utf-8"));
         if (pkg.name === "@siming-org/cli") return ok2(dir);
@@ -4295,6 +5218,7 @@ import { Command as Command6 } from "commander";
 import { SkillScopeSchema as SkillScopeSchema2 } from "@siming-org/core";
 
 // src/client/handlers/node.ts
+import { assertUniqueAiCheckIds } from "@siming-org/core";
 async function handleListNodePresets(client, query = {}) {
   const qs = new URLSearchParams();
   if (query.projectId) qs.set("projectId", query.projectId);
@@ -4426,6 +5350,8 @@ ${failures.join("\n")}`,
     prompt: preset.prompt,
     skills: [...preset.skills],
     agents: [...preset.agents ?? []],
+    ...preset.toolChecks !== void 0 ? { toolChecks: preset.toolChecks.map((c) => c.params ? { ...c, params: { ...c.params } } : { ...c }) } : {},
+    ...preset.aiChecks !== void 0 ? { aiChecks: preset.aiChecks.map((c) => ({ ...c })) } : {},
     sourcePreset: {
       code: preset.code,
       version: preset.version,
@@ -4433,6 +5359,18 @@ ${failures.join("\n")}`,
       agents: [...preset.agents ?? []]
     }
   }));
+  try {
+    assertUniqueAiCheckIds(nodes);
+  } catch (err2) {
+    return {
+      success: false,
+      error: {
+        message: `\u7EC4\u5408 "${compositionName}" aiCheck id \u51B2\u7A81\uFF1A${err2 instanceof Error ? err2.message : String(err2)}`,
+        httpStatus: 0,
+        hint: "\u4FEE\u6B63\u8282\u70B9\u9884\u8BBE\u7684 aiChecks id \u6216\u7EC4\u5408\u5185\u6539 nodeId \u540E\u91CD\u8BD5"
+      }
+    };
+  }
   const nodeIds = new Set(nodes.map((n) => n.id));
   const danglingEdges = composition.edges.filter((e) => !nodeIds.has(e.from) || !nodeIds.has(e.to)).map((e) => `${e.from}\u2192${e.to}`);
   if (danglingEdges.length > 0) {
@@ -4553,7 +5491,7 @@ function createNodeCommand() {
     };
     renderResult("json", await handleCreateNodePreset(client, input));
   });
-  node.command("update <code>").description("Update a node preset (partial; content change requires version bump \u2014 422 NODE_PRESET_VERSION_REQUIRED)").option("--url <url>", "server base URL").option("--label <text>", "new label").option("--node-id <id>", "new default node id").option("--phase <phase>", "new phase").option("--track <track>", "new track").option("--prompt <text>", "new prompt body").option("--prompt-file <path>", "read prompt from file (overrides --prompt)").option("--skill <name>", "replace bound skills list (repeatable; omit = untouched)", collectArgs).option("--clear-skills", "clear bound skills list").option("--agent <name>", "replace callable agents list (repeatable; omit = untouched)", collectArgs).option("--clear-agents", "clear callable agents list").option("--description <text>", "new description").option("--new-version <v>", "new version (required when content fields change)").action(async (code, opts) => {
+  node.command("update <code>").description("Update a node preset (partial; content change requires version bump \u2014 422 NODE_PRESET_VERSION_REQUIRED)").option("--url <url>", "server base URL").option("--label <text>", "new label").option("--node-id <id>", "new default node id").option("--phase <phase>", "new phase").option("--track <track>", "new track").option("--prompt <text>", "new prompt body").option("--prompt-file <path>", "read prompt from file (overrides --prompt)").option("--skill <name>", "replace bound skills list (repeatable; omit = untouched)", collectArgs).option("--clear-skills", "clear bound skills list").option("--agent <name>", "replace callable agents list (repeatable; omit = untouched)", collectArgs).option("--clear-agents", "clear callable agents list").option("--description <text>", "new description").option("--checks-file <path>", 'checks \u76F4\u66F4\u901A\u9053\uFF08T202609230001 \u8BBE\u8BA1 :300\uFF09\uFF1AJSON \u6587\u4EF6 {"toolChecks":[],"aiChecks":[]} \u6574\u4F53\u66FF\u6362 checks \u9762\uFF08\u7F3A\u952E=\u6E05\u7A7A\uFF09\uFF1B\u5185\u5BB9\u53D8\u66F4\u540C\u6279 --new-version').option("--new-version <v>", "new version (required when content fields change)").action(async (code, opts) => {
     const client = createClient(opts.url);
     let prompt;
     if (opts.promptFile !== void 0) {
@@ -4569,6 +5507,30 @@ function createNodeCommand() {
     } else if (opts.prompt !== void 0) {
       prompt = opts.prompt;
     }
+    let checks;
+    if (opts.checksFile !== void 0) {
+      let parsed;
+      try {
+        parsed = JSON.parse(readFileSync13(opts.checksFile, "utf-8"));
+      } catch (e) {
+        renderResult("json", fail({
+          message: `checks \u6587\u4EF6\u8BFB\u53D6/\u89E3\u6790\u5931\u8D25: ${opts.checksFile}\uFF08${e instanceof Error ? e.message : String(e)}\uFF09`,
+          httpStatus: 0
+        }));
+        return;
+      }
+      const obj = parsed;
+      const badTool = obj.toolChecks !== void 0 && (!Array.isArray(obj.toolChecks) || obj.toolChecks.some((t) => typeof t?.type !== "string"));
+      const badAi = obj.aiChecks !== void 0 && (!Array.isArray(obj.aiChecks) || obj.aiChecks.some((a) => typeof a?.id !== "string" || typeof a?.item !== "string"));
+      if (badTool || badAi) {
+        renderResult("json", fail({
+          message: '--checks-file \u987B\u4E3A {"toolChecks":[{"type":"..."}],"aiChecks":[{"id":"...","item":"..."}]}\uFF08\u7F3A\u952E=\u6E05\u7A7A\u8BE5\u6570\u7EC4\uFF09',
+          httpStatus: 0
+        }));
+        return;
+      }
+      checks = { toolChecks: obj.toolChecks ?? [], aiChecks: obj.aiChecks ?? [] };
+    }
     if (opts.skill !== void 0 && opts.clearSkills) {
       renderResult("json", fail({ message: "--skill \u4E0E --clear-skills \u4E92\u65A5", httpStatus: 0 }));
       return;
@@ -4586,10 +5548,11 @@ function createNodeCommand() {
       ...opts.skill !== void 0 ? { skills: opts.skill } : opts.clearSkills ? { skills: [] } : {},
       ...opts.agent !== void 0 ? { agents: opts.agent } : opts.clearAgents ? { agents: [] } : {},
       ...opts.description !== void 0 ? { description: opts.description } : {},
+      ...checks !== void 0 ? { toolChecks: checks.toolChecks, aiChecks: checks.aiChecks } : {},
       ...opts.newVersion !== void 0 ? { version: opts.newVersion } : {}
     };
     if (Object.keys(patch).length === 0) {
-      renderResult("json", fail({ message: "\u672A\u643A\u5E26\u4EFB\u4F55\u5F85\u66F4\u65B0\u5B57\u6BB5", httpStatus: 0, hint: "\u53EF\u66F4\u65B0\uFF1Alabel/node-id/phase/track/prompt/skill/clear-skills/agent/clear-agents/description/new-version" }));
+      renderResult("json", fail({ message: "\u672A\u643A\u5E26\u4EFB\u4F55\u5F85\u66F4\u65B0\u5B57\u6BB5", httpStatus: 0, hint: "\u53EF\u66F4\u65B0\uFF1Alabel/node-id/phase/track/prompt/skill/clear-skills/agent/clear-agents/description/checks-file/new-version" }));
       return;
     }
     renderResult("json", await handleUpdateNodePreset(client, code, patch));
@@ -4653,11 +5616,11 @@ function nodeFields2(n) {
 }
 
 // src/commands/flow/command.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 import { mkdtempSync, rmSync as rmSync2 } from "fs";
 import { tmpdir } from "os";
 import { join as join7 } from "path";
-import { promisify } from "util";
+import { promisify as promisify2 } from "util";
 import { createInterface } from "readline/promises";
 import { Command as Command7 } from "commander";
 import {
@@ -4674,7 +5637,7 @@ import {
   SKILL_MAIN_DOC as SKILL_MAIN_DOC2,
   createReferencesSchema as createReferencesSchema2
 } from "@siming-org/core";
-var FLOW_MANIFEST_FORMAT_VERSION = "1.1";
+var FLOW_MANIFEST_FORMAT_VERSION = "1.2";
 var uniqueStrings = (values, ctx, label) => {
   const seen = /* @__PURE__ */ new Set();
   for (let index = 0; index < values.length; index += 1) {
@@ -4693,6 +5656,14 @@ var manifestCapabilityRefSchema = z6.object({
 var capabilityRefsSchema = z6.array(manifestCapabilityRefSchema).superRefine((refs, ctx) => {
   uniqueStrings(refs.map((ref) => ref.name), ctx, "\u80FD\u529B\u540D\u79F0");
 });
+var manifestToolCheckSchema = z6.object({
+  type: z6.string().min(1).max(50).regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "kebab-case only"),
+  params: z6.record(z6.string(), z6.union([z6.string(), z6.number(), z6.boolean()])).optional()
+});
+var manifestAiCheckSchema = z6.object({
+  id: z6.string().min(2).max(30).regex(/^[a-z0-9-]+$/),
+  item: z6.string().min(1).max(200)
+});
 var nodePresetPayloadBaseSchema = z6.object({
   code: z6.string().regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "kebab-case only"),
   label: z6.string().min(1),
@@ -4702,7 +5673,9 @@ var nodePresetPayloadBaseSchema = z6.object({
   prompt: z6.string().min(1),
   skills: capabilityRefsSchema,
   description: z6.string(),
-  version: z6.string().min(1)
+  version: z6.string().min(1),
+  toolChecks: z6.array(manifestToolCheckSchema).max(20).optional(),
+  aiChecks: z6.array(manifestAiCheckSchema).max(20).optional()
 }).strict();
 var nodePresetPayloadSchema = nodePresetPayloadBaseSchema.extend({ agents: capabilityRefsSchema }).strict();
 var referenceDocsSchema = (mainDoc) => createReferencesSchema2(mainDoc);
@@ -4976,7 +5949,7 @@ function compareSemverStrings(a, b) {
 }
 
 // src/commands/flow/command.ts
-var execFileAsync = promisify(execFile);
+var execFileAsync2 = promisify2(execFile2);
 function createFlowCommand() {
   const flow = new Command7("flow").description("Node library management \u2014 install npm-distributed node packages & compose templates");
   withCommonOpts(flow.command("list"), "table").description("List installed node libraries (registry entries written by `flow install`)").action(async (opts) => {
@@ -5102,7 +6075,7 @@ async function fetchManifest(pkgSpec, registry) {
     }
   };
   try {
-    const { stdout } = await execFileAsync(
+    const { stdout } = await execFileAsync2(
       "npm",
       [
         "pack",
@@ -5123,7 +6096,7 @@ async function fetchManifest(pkgSpec, registry) {
         hint: "\u786E\u8BA4 npm \u7248\u672C\u652F\u6301 --json \u8F93\u51FA"
       });
     }
-    const { stdout: manifestText } = await execFileAsync(
+    const { stdout: manifestText } = await execFileAsync2(
       "tar",
       ["-xOf", join7(dir, filename), "package/siming-nodes.json"],
       { maxBuffer: MANIFEST_LIMITS.maxChars * 2 + 64 * 1024 }
@@ -5533,6 +6506,8 @@ function diffNode(payload, entity, packageName) {
   if (entity.version !== payload.version) diffs.push("version");
   if ((entity.description ?? "") !== payload.description) diffs.push("description");
   if (entity.source?.package !== packageName) diffs.push("source");
+  if (JSON.stringify(entity.toolChecks ?? []) !== JSON.stringify(payload.toolChecks ?? [])) diffs.push("toolChecks");
+  if (JSON.stringify(entity.aiChecks ?? []) !== JSON.stringify(payload.aiChecks ?? [])) diffs.push("aiChecks");
   return diffs;
 }
 function sameOrdered(left, right) {
@@ -5584,6 +6559,9 @@ function snapshotNode(entity) {
     prompt: entity.prompt,
     skills: [...entity.skills].sort(),
     agents: [...entity.agents ?? []].sort(),
+    // T202609230001：门禁声明入快照（plan→apply 窗口期门禁被改应触发 FLOW_INSTALL_STALE 而非静默覆盖）
+    toolChecks: entity.toolChecks ?? [],
+    aiChecks: entity.aiChecks ?? [],
     scope: entity.scope,
     projectId: entity.projectId ?? null,
     description: entity.description ?? null,
@@ -5813,6 +6791,9 @@ async function writeAsset(client, manifest, plan, item) {
       description: payload.description,
       version: payload.version,
       source: { package: manifest.name },
+      // T202609230001：门禁声明随安装写入（缺此两行 = 安装成功但门禁静默丢失）
+      ...payload.toolChecks !== void 0 ? { toolChecks: payload.toolChecks } : {},
+      ...payload.aiChecks !== void 0 ? { aiChecks: payload.aiChecks } : {},
       ...item.targetProjectId !== void 0 ? { projectId: item.targetProjectId } : {}
     };
     return handleCreateNodePreset(client, input);
@@ -5827,7 +6808,12 @@ async function writeAsset(client, manifest, plan, item) {
     agents: payload.agents.map((ref) => ref.name),
     description: payload.description,
     version: payload.version,
-    source: { package: manifest.name }
+    source: { package: manifest.name },
+    // T202609230001：门禁声明随升级写入。显式归一空数组——「包未声明=清除」必须以 [] 落到线上
+    // （裸 undefined 经 JSON.stringify 丢键，server 保留旧值 → 写后回读不一致 → FLOW_INSTALL_STALE；
+    //   与 diffNode/模板升级的「缺省=空」归一语义一致）
+    toolChecks: payload.toolChecks ?? [],
+    aiChecks: payload.aiChecks ?? []
   };
   return handleUpdateNodePreset(client, payload.code, patch);
 }
@@ -5983,11 +6969,57 @@ function createProjectCommand() {
     const result = await handleGetProject(client, id);
     renderResult(opts.format, result, { fields: result.success ? projectFields(result.data) : [] });
   });
-  project.command("update <id>").description("Update a project (name/description)").option("--url <url>", "server base URL").option("--name <name>", "new name").option("--description <text>", "new description").action(async (id, opts) => {
+  project.command("update <id>").description("Update a project (name/description/status/vcs gate config). vcs is replaced as a whole: any --vcs-* flag replaces the entire vcs object with only the provided fields").option("--url <url>", "server base URL").option("--name <name>", "new name").option("--description <text>", "new description").option("--vcs-enabled <bool>", "gate VCS checks for this project (true/false; false=all git checks N/A)").option("--vcs-repo-path <path>", "repository absolute path (default: MCP host cwd probing)").option("--vcs-base-branch <branch>", "base branch (2nd level of the base-branch resolution chain)").option("--vcs-branch-pattern <pattern>", "task branch prefix pattern for A1").option("--vcs-worktree-mode <bool>", "worktree parallel mode (true=A6 stay-on-base N/A)").option("--vcs-archive-to-base <bool>", "project declares merge-back-to-base archive flow (false=A5 N/A)").option("--vcs-doc-paths <paths>", "B7 exemption paths, comma separated (dirs need trailing /, glob like *.md)").action(async (id, opts) => {
     const client = createClient(opts.url);
+    const parseBool = (v, flag) => {
+      if (v === void 0) return void 0;
+      if (v === "true") return true;
+      if (v === "false") return false;
+      renderResult("json", fail({
+        message: `${flag} \u53EA\u63A5\u53D7 true/false\uFF0C\u6536\u5230\uFF1A${v}`,
+        hint: "\u5E03\u5C14\u65D7\u6807\u663E\u5F0F\u4F20\u503C\uFF08--vcs-enabled true\uFF09\uFF0C\u4E0D\u7528\u88F8\u65D7\u6807\u5F62\u6001",
+        httpStatus: 0
+      }));
+      return "invalid";
+    };
+    const vcsFields = {};
+    let vcsProvided = false;
+    const enabled = parseBool(opts.vcsEnabled, "--vcs-enabled");
+    const worktreeMode = parseBool(opts.vcsWorktreeMode, "--vcs-worktree-mode");
+    const archiveToBase = parseBool(opts.vcsArchiveToBase, "--vcs-archive-to-base");
+    if (enabled === "invalid" || worktreeMode === "invalid" || archiveToBase === "invalid") return;
+    if (enabled !== void 0) {
+      vcsFields.enabled = enabled;
+      vcsProvided = true;
+    }
+    if (opts.vcsRepoPath !== void 0) {
+      vcsFields.repoPath = opts.vcsRepoPath;
+      vcsProvided = true;
+    }
+    if (opts.vcsBaseBranch !== void 0) {
+      vcsFields.baseBranch = opts.vcsBaseBranch;
+      vcsProvided = true;
+    }
+    if (opts.vcsBranchPattern !== void 0) {
+      vcsFields.branchPattern = opts.vcsBranchPattern;
+      vcsProvided = true;
+    }
+    if (worktreeMode !== void 0) {
+      vcsFields.worktreeMode = worktreeMode;
+      vcsProvided = true;
+    }
+    if (archiveToBase !== void 0) {
+      vcsFields.archiveToBase = archiveToBase;
+      vcsProvided = true;
+    }
+    if (opts.vcsDocPaths !== void 0) {
+      vcsFields.docPaths = opts.vcsDocPaths.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+      vcsProvided = true;
+    }
     const patch = {
       ...opts.name !== void 0 ? { name: opts.name } : {},
-      ...opts.description !== void 0 ? { description: opts.description } : {}
+      ...opts.description !== void 0 ? { description: opts.description } : {},
+      ...vcsProvided ? { vcs: vcsFields } : {}
     };
     const result = await handleUpdateProject(client, id, patch);
     renderResult("json", result);
@@ -6005,7 +7037,8 @@ function projectFields(p) {
     ["key", p.key],
     ["name", p.name],
     ["status", p.status],
-    ["description", p.description]
+    ["description", p.description],
+    ["vcs", p.vcs]
   ];
 }
 
@@ -6927,13 +7960,13 @@ function renderReport(report, format) {
 
 // src/commands/install/command.ts
 import { Command as Command12 } from "commander";
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 import { createInterface as createInterface2 } from "readline/promises";
 import { dirname as dirname5, join as join9 } from "path";
 import { AGENT_MAIN_DOC as AGENT_MAIN_DOC5, SKILL_MAIN_DOC as SKILL_MAIN_DOC5, VERSION as VERSION3 } from "@siming-org/core";
 
 // src/commands/install/writer.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync15, renameSync as renameSync4, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync15, renameSync as renameSync4, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
 import { dirname as dirname4, join as join8 } from "path";
 import { homedir as homedir4 } from "os";
 import { parse as parseYaml3, stringify as stringifyYaml } from "yaml";
@@ -7005,7 +8038,7 @@ function permissionsToMatrix(permissions) {
   }
   return matrix;
 }
-var AGENT_INFO_BOUNDARY = "\u4EFB\u52A1\u4F9D\u636E\u9650\u4E8E\u9879\u76EE\u4EE3\u7801\u3001\u8BBE\u8BA1\u6587\u6863/\u6267\u884C\u62A5\u544A\u53CA\u4EFB\u52A1\u4E0A\u4E0B\u6587\uFF08\u542B\u4EFB\u52A1\u4FE1\u606F\u3001\u63D0\u793A\u8BCD\u3001\u59D4\u6D3E\u6750\u6599\uFF09\uFF1B\u7981\u6B62\u81EA\u884C\u8BFB\u53D6\u65E5\u5FD7\u3001\u4E34\u65F6\u6587\u4EF6\u7B49\u8FC7\u7A0B\u4EA7\u7269\uFF0C\u7981\u6B62\u81EA\u884C\u6267\u884C\u6D4B\u8BD5\u3001\u547D\u4EE4\u6216\u5176\u4ED6\u64CD\u4F5C\uFF0C\u59D4\u6D3E\u4EFB\u52A1\u660E\u786E\u8981\u6C42\u65F6\u9664\u5916\u3002";
+var AGENT_INFO_BOUNDARY = "\u4EFB\u52A1\u4F9D\u636E\u9650\u4E8E\u9879\u76EE\u4EE3\u7801\u3001\u8BBE\u8BA1\u6587\u6863/\u6267\u884C\u62A5\u544A\u53CA\u4EFB\u52A1\u4E0A\u4E0B\u6587\uFF08\u542B\u4EFB\u52A1\u4FE1\u606F\u3001\u63D0\u793A\u8BCD\u3001\u59D4\u6D3E\u6750\u6599\uFF09\uFF1B\u4E0D\u4FEE\u6539\u4EE3\u7801\u6216\u6587\u6863\uFF0C\u4E0D\u6267\u884C\u6D4B\u8BD5\u3001\u6784\u5EFA\u6216\u53D1\u5E03\u547D\u4EE4\uFF1B\u81EA\u8EAB\u89D2\u8272\u5B9A\u4E49\u6388\u6743\u7684\u91C7\u8BC1\u64CD\u4F5C\uFF08\u5982\u6D4F\u89C8\u5668\u4EA4\u4E92\u3001\u622A\u56FE\u53D6\u8BC1\u3001\u8BFB\u53D6\u8FD0\u884C\u8BC1\u636E\uFF09\u4E0D\u53D7\u6B64\u9650\uFF0C\u5176\u4F59\u8FC7\u7A0B\u4EA7\u7269\u8BFB\u53D6\u4E0E\u547D\u4EE4\u6267\u884C\u4ECD\u7981\u6B62\u3002";
 function agentToMarkdown(agent, realModel) {
   const fm = {
     name: agent.name,
@@ -7034,7 +8067,7 @@ function agentTargetPath(dir, agent) {
   return join8(dir, "agents", agent.name, "agent.md");
 }
 function readSimingVersion(path) {
-  if (!existsSync7(path)) return null;
+  if (!existsSync8(path)) return null;
   let text;
   try {
     text = readFileSync15(path, "utf-8");
@@ -7059,7 +8092,7 @@ function isPlainObject(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function readMcpConfig(path) {
-  if (!existsSync7(path)) return { state: "absent" };
+  if (!existsSync8(path)) return { state: "absent" };
   let text;
   try {
     text = readFileSync15(path, "utf-8");
@@ -7299,7 +8332,7 @@ function compareSkill(s, dir) {
   if (!isSafeAssetName(s.name)) {
     return { ...base, action: "conflict", reason: `unsafe asset name "${s.name}"` };
   }
-  if (!existsSync8(path)) return { ...base, action: "install", reason: "not installed locally" };
+  if (!existsSync9(path)) return { ...base, action: "install", reason: "not installed locally" };
   const marked = readSimingVersion(path);
   if (marked === null) {
     return { ...base, localVersion: "unknown", action: "conflict", reason: "no siming-version marker (third-party asset; use --force to overwrite)" };
@@ -7317,7 +8350,7 @@ function compareAgent(a, dir) {
   if (!isSafeAssetName(a.name)) {
     return { ...base, action: "conflict", reason: `unsafe asset name "${a.name}"` };
   }
-  if (!existsSync8(path)) return { ...base, action: "install", reason: "not installed locally" };
+  if (!existsSync9(path)) return { ...base, action: "install", reason: "not installed locally" };
   const marked = readSimingVersion(path);
   if (marked === null) {
     return { ...base, localVersion: "unknown", action: "conflict", reason: "no siming-version marker (third-party asset; use --force to overwrite)" };
@@ -7410,7 +8443,7 @@ async function applyInstall(client, scope, projectId, items, opts) {
           results.push({ name: item.name, type: "skill", action: "failed", reason: `invalid reference doc from server: ${invalidRef}`, hint: "\u5F15\u7528\u6587\u6863\u975E\u6CD5\uFF08\u6570\u636E\u53EF\u80FD\u88AB\u7ED5\u8FC7\u6821\u9A8C\u5199\u5165\uFF09\uFF1B\u4FEE\u6B63 server \u6570\u636E\u540E\u91CD\u8BD5\uFF0C\u672C\u6761\u672A\u5199\u5165" });
           continue;
         }
-        const targetExists = existsSync8(targetPath);
+        const targetExists = existsSync9(targetPath);
         writeAssetDirectory(dirname5(targetPath), [
           { relPath: SKILL_MAIN_DOC5, content: skillToMarkdown(r.data) },
           ...(r.data.references ?? []).map((ref) => ({ relPath: ref.path, content: ref.content }))
@@ -7446,7 +8479,7 @@ async function applyInstall(client, scope, projectId, items, opts) {
           results.push({ name: item.name, type: "agent", action: "failed", reason: `invalid reference doc from server: ${invalidRef}`, hint: "\u5F15\u7528\u6587\u6863\u975E\u6CD5\uFF08\u6570\u636E\u53EF\u80FD\u88AB\u7ED5\u8FC7\u6821\u9A8C\u5199\u5165\uFF09\uFF1B\u4FEE\u6B63 server \u6570\u636E\u540E\u91CD\u8BD5\uFF0C\u672C\u6761\u672A\u5199\u5165" });
           continue;
         }
-        const targetExists = existsSync8(targetPath);
+        const targetExists = existsSync9(targetPath);
         writeAssetDirectory(dirname5(targetPath), [
           { relPath: AGENT_MAIN_DOC5, content: agentToMarkdown(r.data, realModel) },
           ...(r.data.references ?? []).map((ref) => ({ relPath: ref.path, content: ref.content }))
@@ -7563,7 +8596,7 @@ var PHASE2_NEXT_STEPS = `\u8D44\u4EA7\u5DF2\u5C31\u7EEA\uFF08\u5168\u5C40\u8D44\
         \uFF08siming task create --template <\u6A21\u677Fcode> --track <\u8F68\u9053> --project <\u9879\u76EEkey> --title "<\u6807\u9898>"\uFF09
         \u5E76\u8BFB\u53D6\u9996\u8282\u70B9\u4E0A\u4E0B\u6587\uFF1Asiming task context <taskId>`;
 var MCP_TOOLING_TEXT = `\u63A5\u53E3\u5206\u5DE5\u73B0\u72B6\uFF08\u6743\u5A01\uFF09\uFF1A
-- MCP \u4EC5\u4E09\u4E2A\u5DE5\u5177\uFF1Asiming_task\uFF08\u4EFB\u52A1\u751F\u547D\u5468\u671F\u8BFB\u5199\uFF0C22 \u4E2A action\uFF09\u3001siming_template\uFF08\u53EA\u8BFB\u6A21\u677F\u67E5\u8BE2\uFF0Clist/show\uFF09\u3001siming_auth\uFF08\u8EAB\u4EFD\u67E5\u8BE2\uFF0Cwhoami\uFF09\uFF1B
+- MCP \u4EC5\u4E09\u4E2A\u5DE5\u5177\uFF1Asiming_task\uFF08\u4EFB\u52A1\u751F\u547D\u5468\u671F\u8BFB\u5199\uFF0C24 \u4E2A action\uFF09\u3001siming_template\uFF08\u53EA\u8BFB\u6A21\u677F\u67E5\u8BE2\uFF0Clist/show\uFF09\u3001siming_auth\uFF08\u8EAB\u4EFD\u67E5\u8BE2\uFF0Cwhoami\uFF09\uFF1B
 - \u8D44\u4EA7\u3001\u9879\u76EE\u3001\u6A21\u677F\u5199\u5165/\u5BFC\u5165/\u5347\u7EA7\u3001\u521D\u59CB\u5316\u3001\u5B89\u88C5\u3001\u8BCA\u65AD\u7B49\u4E00\u5207\u8D44\u4EA7\u7BA1\u7406\u4E0E\u8FD0\u7EF4\u64CD\u4F5C\u4E00\u5F8B\u8D70 CLI \u547D\u4EE4\u3002
 
 \u5BBF\u4E3B\u517C\u5BB9\u6027\u81EA\u68C0\u4E0E\u9002\u914D\uFF08\u63A5\u5165\u540E\u5FC5\u505A\uFF09\uFF1A
@@ -8005,7 +9038,7 @@ async function handleUpdateEnums(client, category, body) {
 // src/commands/settings/command.ts
 function createSettingsCommand() {
   const settings = new Command16("settings").description("Settings (enum registries)");
-  withCommonOpts(settings.command("enums [category]"), "fancy").description("Show enum registry (all 7 categories, or one category)").action(async (category, opts) => {
+  withCommonOpts(settings.command("enums [category]"), "fancy").description("Show enum registry (all categories, or one category)").action(async (category, opts) => {
     const client = createClient(opts.url);
     const catR = category ? EnumRegistryCategorySchema.safeParse(category) : null;
     if (category && !catR?.success) {
@@ -8059,7 +9092,7 @@ import { VERSION as VERSION4, SIMING_CONFIG_KEYS as SIMING_CONFIG_KEYS2 } from "
 
 // src/commands/server/daemon.ts
 import { execFileSync } from "child_process";
-import { closeSync, existsSync as existsSync9, lstatSync, mkdirSync as mkdirSync6, openSync, readFileSync as readFileSync16, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { closeSync, existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync6, openSync, readFileSync as readFileSync16, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
 import { join as join10, resolve as resolve2 } from "path";
 import { spawn } from "child_process";
 
@@ -8270,7 +9303,7 @@ function readLogTail(lines = 30) {
 }
 function spawnDaemon(configEnv) {
   const entry = resolve2(process.argv[1] ?? "");
-  if (entry.length === 0 || !existsSync9(entry)) {
+  if (entry.length === 0 || !existsSync10(entry)) {
     throw new Error(`\u65E0\u6CD5\u5B9A\u4F4D siming \u5165\u53E3\u811A\u672C\uFF08process.argv[1]=${process.argv[1] ?? "(\u7A7A)"}\uFF09`);
   }
   if (entry.endsWith(".ts")) {