@surlymochan/evalid 0.3.1 → 0.5.0

package/CHANGELOG.md

@@ -3,6 +3,34 @@
 All notable changes to this project are documented here. Detailed notes live in
 [RELEASE_NOTES.md](RELEASE_NOTES.md).
 
+## [Unreleased]
+
+## [0.5.0] - 2026-11-06
+
+### Added
+- **CR review seal partition (issue #5, P1-2)**: the J6 review proof (`cr/review-0.json`) now splits the changed files into `sealed_unchanged` (bytes still identical to the green TDD proof's sealed hashes) and `seal_drifted`, with a `reread_count`. The yolo skill's verify-consistency guidance uses the partition so the review pass re-reads only drifted files instead of everything the gate already verified. Reporting only — verdicts are unchanged, and without a green seal the partition is `null` and everything is re-read.
+- **Bench Verified set extended to 15 instances (issue #5, P2-2)**: `bench/swebench/instances.json` grows from 12 to 15, adding sympy-15599, sympy-19040 and sympy-24213, and a structural validation of the instance set (`bench/swebench/test_instances.py`) now runs in CI. Gold-patch checks for the three new instances stay pending the benchmark environment.
+- **Bench report aggregates median (IQR) (issue #5, P2-1)**: `bench/swebench/report.py` now aggregates per-arm wall-clock, token and cost results with q1/median/q3 and presents them as median (IQR); reps isolation and the aggregation itself are pinned by `bench/swebench/test_reps_report.py`. Live multi-rep runs stay pending the benchmark environment.
+- **P0-2 acceptance pinned against saved pre-fix patches (issue #5, P0-2)**: regression tests in `bench/swebench/test_diff_filter.py` run the saved pre-fix patches through the evidence filter (`specs/`, `.xflow/`, `.as-xflow/` excluded from solution patches). The saved 9.7 MB evidence-laden patch filters down to 4.3 KB, and every saved patch lands under the 200 KB acceptance line.
+
+## [0.4.1] - 2026-11-06
+
+### Fixed
+- **TDD gate counts skipped/todo tests again on Node 24**: the gate parsed skip/todo counts only from the TAP reporter's `# skipped / # todo` summary lines, but Node 24's built-in runner defaults to the spec reporter when piped, whose summary lines carry a `ℹ` marker — an all-skipped/todo run exited 0, parsed as zero skips, and was waved through as green. The parser now reads the runner's summary block in both reporter formats (anchored to the summary lines, gated on the full node signature), and fails closed: a node summary whose gate counts cannot be fully parsed classifies as `counts_unknown` and is rejected by proof validation (`tests_counts_unknown`) instead of reading as zero skipped.
+
+### Added
+- **Phase cost evidence on every run (issue #5 P1-1)**: the per-phase timing/token report (`src/core/phase-cost.js`, landed in 0.3.0) now also rides on the `workflow_failed` execution-log event — a run that stops mid-way still reports where its time and tokens went — and is persisted as a standalone artifact at `.as-xflow/phase-cost.json` on both completion and failure, so the breakdown is readable without mining the ndjson execution log. Acceptance rerun on the SWE-bench cells stays pending the benchmark environment; the accounting structure (phase sum vs wall clock within 5%) is covered by `test/phase-cost.test.js`.
+
+## [0.4.0] - 2026-11-04
+
+### Changed
+- **Overhead cut 1 (v0.4 F2, issue #5 P1-2/P1-4)**: the lite (yolo) track seals the TDD red proof immediately after `plan` — the issue/branch ceremony no longer sits between planning and red-proof, and the planning pass now authors the failing test, so plan and red share one agent pass. `xflow workflow run --title "..."` also derives the change id from the title when the branch cannot provide one (previously a hard stop on `main` that pushed agents into manual atom-by-atom driving). TDD snapshots are scoped: inside a git work tree I6a seals only the files that differ from HEAD plus the files the test command names, and I6b materializes the rest from the recorded HEAD at replay — on the SWE-bench sympy tree the sealed manifest drops from 1,543 files / 164 KB to the changed files only (2 files / 197 B for a one-file change), and the snapshot copy from 26.9 MB to ~51 KB. Proofs sealed before this change keep verifying (the scope joins the binding only when present).
+
+### Added
+- **CR gate `J6.cr.review` wired into the verify stage (v0.4 F1)**: closes the v0.3.0 known gap where J6 was registered and unit-tested but no workflow phase invoked it. The yolo `verify-consistency` phase and the corps `qa` phase now run J6 on every change — after the spec-delta review, before the stage flips to verify — and declare its verdict record `specs/changes/<change_id>/cr/review-0.json` as a required artifact. A failing verdict (spec misalignment, changed code with no test follow, net assertion decrease, blown loop budget) stops the workflow at verify instead of waving the change through to archive. Orchestration evidence: `test/cr-review-wiring.test.js` drives the real yolo verify phase through `WorkflowExecutor` against a git fixture — an aligned, tested change passes with a verdict record, and an untested change is stopped at the phase.
+- **SWE-bench predictions emitted directly by `run.py` (v0.4 F3)**: the bench harness no longer relies on a one-off converter outside the repo. A stdlib-only `bench/swebench/harness/predictions.py` builds records with exactly `instance_id`, `model_name_or_path`, `model_patch`, re-applies the P0-2 evidence filter (`specs/`, `.xflow/`, `.as-xflow/`) on both paths, and upserts per-arm files so resumable reruns never duplicate lines; `run.py --export-predictions` rebuilds the same files from saved patches with no model calls. Regression: all four pilot arms rebuilt through the new path are byte-identical to the hand-converted pilot files (`cmp` = 0 across 24 instances), and the largest openflow-arm patch stays at 9,650 bytes, well under the 200 KB line.
+- **`xflow init` writes the project `.gitignore` (v0.4 F4)**: init now creates or merges `.gitignore` entries for evalid local state (`.as-xflow/`, `specs/changes/`), appending only the entries that are missing and never modifying existing lines; `.xflow/` stays tracked on purpose (`GOAL.md` is a reviewable project document). Re-running `init --force` tops up projects initialized before v0.4. Closes the v0.3.0 known gap.
+
 ## [0.3.1] - 2026-11-04
 
 ### Changed

package/README.md

@@ -22,12 +22,12 @@ Underneath, a workflow engine (spec → implement → verify loops with per-phas
 
 _Renamed from OpenFlow in v0.3.1 (2026-11-04); old repository and package links redirect._
 
-## Benchmarks: OpenFlow vs superpowers (2026-10-17)
+## Benchmarks: evalid vs superpowers (2026-10-17)
 
-_These results were recorded when the project was named OpenFlow; the version labels in this section are kept exactly as measured._
+_These results were measured before the rename, when the project was named OpenFlow; product names in this section have been unified to the current names (evalid, swrm), and all versions and figures are the original measurements._
 
 For the synthetic and evidence-check results below, the same model (`grok-4.7-high` via local `cursor-agent`) and same
-harness are used for every arm; the SWE-bench block uses DeepSeek via Pi. Pinned: OpenFlow 0.2.1,
+harness are used for every arm; the SWE-bench block uses DeepSeek via Pi. Pinned: evalid 0.2.1,
 [superpowers](https://github.com/obra/superpowers) v7.0.0 (`bb92a77`). Scripts, raw results and methodology:
 [`bench/`](bench/README.md) and [`bench/e2e/`](bench/e2e/README.md). Losses are shown as measured.
 
@@ -40,11 +40,11 @@ DeepSeek-V4.1-Flash (`deepseek-flash`), n=1 per cell, 20-minute cap; details and
 | --- | --- | --- | --- | --- | --- |
 | Plain agent (baseline) | 3/6 (50%) | 124 s (110–175) | $0.0234 | $0.16 | 6 |
 | superpowers v7.0.0 | 2/6 (33%) | 154 s (136–340) | $0.0285 | $0.31 | 6 |
-| OpenFlow 0.2.1 | 4/6 (67%) | 230 s (200–266) | $0.0412 | $0.23 | 6 |
-| openswarm (Pi executor) | 5/6 (83%) | 228 s (187–254) | $0.0377 | $0.21 | 6 |
+| evalid 0.2.1 | 4/6 (67%) | 230 s (200–266) | $0.0412 | $0.23 | 6 |
+| swrm (Pi executor) | 5/6 (83%) | 228 s (187–254) | $0.0377 | $0.21 | 6 |
 
 **Caveats:** n=1 on 6 instances, so one or two resolves are within noise. The two workflow tools took about 1.8x the
-baseline's median wall-clock and cost 76% (evalid) / 61% (openswarm) more per task. The first published table undercounted
+baseline's median wall-clock and cost 76% (evalid) / 61% (swrm) more per task. The first published table undercounted
 pytest because of a shared temp-dir race in grading; it is now fixed and regraded
 ([regrade notes](bench/swebench/README.md#regrade-2026-10-18)). On the MiniMax-M3.1-Flash-Preview subset, baseline
 resolved 3/4 and superpowers 2/4; evalid had no clean MiniMax run because the plan's usage cap was hit.
@@ -58,7 +58,7 @@ results: [#5](https://github.com/surlymochan/evalid/issues/5).
 | --- | --- | --- | --- | --- |
 | Plain agent (baseline) | 24/24 (100%) | 55 s (46–132) | 105k / 28k | 24 |
 | superpowers v7.0.0 | 24/24 (100%) | 187 s (121–299) | 312k / 59k | 24 |
-| OpenFlow 0.2.1 | 11/12 (92%) | 985 s (920–1195) | 5.29M / 233k ¹ | 12 ² |
+| evalid 0.2.1 | 11/12 (92%) | 985 s (920–1195) | 5.29M / 233k ¹ | 12 ² |
 
 On tasks this small the plain agent already succeeds every time, and evalid's full ceremony is the slowest and most
 token-hungry arm. 3 of 12 evalid runs hit the 20-minute cap while still running the workflow; their code already passed.
@@ -70,10 +70,10 @@ proofs, skipped tests, weak or wrong assertions, contradictory specs, …) and 1
 
 | Checker | Faulty caught | Honest wrongly rejected | Cost per check |
 | --- | --- | --- | --- |
-| OpenFlow 0.2.1 gates (deterministic code) | 22/25 (88%): original 16/17, held-out 6/8 | 0/11 | ~0.1–0.2 s, no model tokens |
+| evalid 0.2.1 gates (deterministic code) | 22/25 (88%): original 16/17, held-out 6/8 | 0/11 | ~0.1–0.2 s, no model tokens |
 | superpowers v7.0.0 skills + LLM judge | 25/25 (100%) | 1/11 | one agent call per check |
 | LLM judge, no skills | 25/25 (100%) ³ | 0/11 | one agent call per check |
-| OpenFlow 0.2.0 (before this benchmark, original 24 only) | 10/17 (59%) | 3/7 | – |
+| evalid 0.2.0 (before this benchmark, original 24 only) | 10/17 (59%) | 3/7 | – |
 
 An LLM reviewer that is explicitly asked to audit an episode, and is allowed to rerun the tests, caught more than evalid's static gates did.
 evalid's gates are deterministic and cost no model calls, but they still miss plausible-but-wrong expected values,

package/RELEASE_NOTES.md

@@ -1,5 +1,41 @@
 # Release Notes
 
+## 0.5.0 - Review re-reads only drifted files; the bench set grows to 15
+
+Minor release. One product change — the CR review now spends its re-reads only where the seal says bytes moved — plus three bench-hygiene landings from the issue #5 backlog, each pinned by tests rather than by a live run.
+
+**Review re-reads only drifted files (#32, issue #5 P1-2).** The J6 review proof (`cr/review-0.json`) now carries a seal partition: every changed file is classified `sealed_unchanged` (bytes still identical to the green TDD proof's sealed hashes) or `seal_drifted`, with a `reread_count`. The yolo verify-consistency guidance consumes the partition, so the review pass re-reads only the drifted files instead of everything the gate already verified. This is reporting only — verdicts are unchanged, and without a green seal the partition is `null` and everything is re-read, exactly as before.
+
+**The Verified bench set grows from 12 to 15 instances (#30, issue #5 P2-2).** `bench/swebench/instances.json` adds sympy-15599, sympy-19040 and sympy-24213, and a structural validation of the instance set (`bench/swebench/test_instances.py`) now runs in CI, so a malformed instance entry fails the build instead of a bench run. Gold-patch checks for the three new instances are pending the benchmark environment.
+
+**Bench reports now aggregate as median (IQR) (#31, issue #5 P2-1).** `bench/swebench/report.py` aggregates per-arm wall-clock, token and cost results with q1/median/q3 and presents them in median (IQR) form. Reps isolation — repeat runs of the same cell never share grading state — and the aggregation itself are pinned by `bench/swebench/test_reps_report.py`.
+
+**P0-2 acceptance is now pinned by regression tests (#29, issue #5 P0-2).** The evidence exclusion itself landed earlier (solution patches drop `specs/`, `.xflow/` and `.as-xflow/`); what was missing was a test that would notice if it regressed. `bench/swebench/test_diff_filter.py` now runs the saved pre-fix patches through the filter: the saved 9.7 MB evidence-laden patch comes out at 4.3 KB, and every saved patch lands under the 200 KB acceptance line.
+
+Acceptance debt, stated plainly: the live-run acceptance for P1-2, P2-1 and P2-2 — multi-rep bench runs on the restored environment, including the wall-clock/token lines from issue #5 and gold checks for the new instances — is still pending the benchmark environment. No performance numbers are claimed in this release; what shipped is the reporting, the larger instance set, and the tests that pin their behaviour.
+
+## 0.4.1 - Failed runs report phase costs; Node 24 test counts fail closed
+
+Patch release. Two fixes, both about the gate trusting evidence it had not actually read.
+
+**Failed runs now report where the time and tokens went (#22).** The per-phase cost report landed in 0.3.0 but only rode on successful runs. It now also rides on the `workflow_failed` execution-log event — a run that stops mid-way still reports its per-phase timing/token breakdown — and is persisted as a standalone artifact at `.as-xflow/phase-cost.json` on both completion and failure, so the breakdown is readable without mining the ndjson execution log. The accounting structure (phase sum vs wall clock within 5%) is covered by `test/phase-cost.test.js`. This lands item P1-1 from issue #5.
+
+**TDD gate reads test counts correctly on Node 24, and fails closed when it cannot (#23).** The gate parsed skip/todo counts only from the TAP reporter's summary lines. Node 24's built-in runner defaults to the spec reporter when piped, whose summary lines carry a different marker — an all-skipped/todo run on Node 24 exited 0, parsed as zero skips, and was waved through as green. The parser now reads the runner's summary block in both reporter formats (TAP and spec), requires the full node signature before treating a block as a node summary, and anchors summary lines at line start so test names or program output cannot forge counts. When a detected node summary cannot be fully parsed, the run classifies as `counts_unknown` and proof validation rejects it (`tests_counts_unknown`) instead of reading unknown counts as zero. Measured against pinned captured outputs: the new count-parsing tests pass 9/9 under Node 22 and 9/9 under Node 24; the end-to-end TDD proof suite passes 18/18 under both (it was 17/18 on Node 24 before this fix).
+
+With P1-1 landed here, the P0/P1 items tracked on the optimization backlog in #5 stand checked off as verified; the remaining longer-horizon items stay tracked there.
+
+## 0.4.0 - CR gate wired in, overhead cut 1, predictions direct
+
+**The CR gate now runs inside the pipeline (F1, #15).** In 0.3.0 `J6.cr.review` was registered and unit-tested but no workflow invoked it — the release notes said so, and this release closes that gap. The yolo `verify-consistency` phase and the corps `qa` phase run J6 on every change, after the spec-delta review and before the stage flips to verify, and the verdict record `cr/review-0.json` is a required artifact: a failing verdict stops the workflow instead of waving the change through to archive. The wiring is proven end-to-end, not just by unit tests: `test/cr-review-wiring.test.js` drives the real yolo verify phase through `WorkflowExecutor` against a git fixture — an aligned, tested change passes with a verdict record on disk, and a code change with no test follow is stopped at the phase with the `cr_code_without_test` finding.
+
+**Overhead cut 1 (F2, #17).** The lite (yolo) track seals the TDD red proof immediately after `plan` — the issue/branch ceremony no longer sits between planning and red-proof, and the planning pass authors the failing test, so plan and red share one agent pass. `xflow workflow run --title "..."` derives the change id from the title when the branch cannot provide one. TDD snapshots are scoped: inside a git work tree, I6a seals only the files that differ from HEAD plus the files the test command names, and I6b materializes the rest from the recorded HEAD at replay. Offline measurements on the SWE-bench sympy tree: the sealed manifest drops from 1,543 files / 164 KB to the changed files only (2 files / 197 B for a one-file change), and the snapshot copy from 26.9 MB to ~51 KB. Proofs sealed before this change keep verifying.
+
+Acceptance debt, stated plainly: the v0.4 acceptance line for F2 was a live rerun of the same 6 SWE-bench instances — wall-clock ≤ 1.3× the baseline median, total tokens ≤ 2.0M, resolved ≥ 4/6. The bench generation environment is not currently restored, so those three numbers are still owed; they are not claimed here. If the rerun misses the line when it lands, the remaining overhead work continues as v0.4.1 rather than being declared done.
+
+**Predictions come straight out of `run.py` (F3, #16).** The official SWE-bench predictions format (`instance_id`, `model_name_or_path`, `model_patch`) is now produced by the bench harness itself, with the P0-2 evidence filter re-applied on both the live and replay paths — the one-off converter outside the repo is retired. Regression evidence: all four pilot arms rebuilt through `run.py --export-predictions` are byte-identical to the hand-converted pilot files (`cmp` = 0, 24 instances).
+
+**`xflow init` writes `.gitignore` (F4, #18).** Init now creates or merges the project `.gitignore` for evalid local state (`.as-xflow/`, `specs/changes/`), appending only missing entries and never modifying existing lines — the first line of defense ahead of the diff filtering added in #8. This closes the second v0.3.0 known gap; both are now done.
+
 ## 0.3.1 - Renamed: OpenFlow → evalid
 
 Same code as 0.3.0, new name and positioning. The project is now **evalid** — a runtime verification layer for coding agents: it seals each test run and replays it from a clean snapshot, so a claim only ships if the evidence replays green. Repository: `surlymochan/evalid` (old `openflow` links redirect); npm package: `evalid`. The `xflow` CLI name is unchanged in this release.

package/bin/xflow.js

@@ -5079,15 +5079,55 @@ async function handleInit(args) {
   mkdirSync(configDir, { recursive: true });
   writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
 
+  const gitignore = ensureXflowGitignore(projectRoot);
+
   if (parsedArgs.json) {
-    console.log(JSON.stringify({ ok: true, config_path: configPath, config }, null, 2));
+    console.log(JSON.stringify({ ok: true, config_path: configPath, config, gitignore }, null, 2));
     return;
   }
 
   console.log(`xflow init: wrote ${configPath}`);
+  if (gitignore.created) {
+    console.log(`xflow init: wrote ${gitignore.path} (ignores ${gitignore.added.join(', ')})`);
+  } else if (gitignore.added.length > 0) {
+    console.log(`xflow init: updated ${gitignore.path} (+ ${gitignore.added.join(', ')})`);
+  } else {
+    console.log(`xflow init: ${gitignore.path} already covers evalid local state`);
+  }
   console.log('Next: xflow doctor --project-root <path>');
 }
 
+// Local runtime state an evalid project should never commit: the .as-xflow
+// state dir (config, sqlite state, logs, pending gates/tasks, snapshots) and
+// per-change spec artifacts (proofs, status files). These mirror the entries
+// this repository keeps in its own .gitignore.
+const XFLOW_GITIGNORE_ENTRIES = ['.as-xflow/', 'specs/changes/'];
+const XFLOW_GITIGNORE_HEADER = '# evalid local state (added by xflow init)';
+
+function normalizeGitignoreEntry(line) {
+  return line.trim().replace(/^\//, '').replace(/\/$/, '');
+}
+
+function ensureXflowGitignore(projectRoot) {
+  const gitignorePath = resolve(projectRoot, '.gitignore');
+
+  if (!existsSync(gitignorePath)) {
+    writeFileSync(gitignorePath, `${XFLOW_GITIGNORE_HEADER}\n${XFLOW_GITIGNORE_ENTRIES.join('\n')}\n`, 'utf8');
+    return { path: gitignorePath, created: true, added: [...XFLOW_GITIGNORE_ENTRIES] };
+  }
+
+  const original = readFileSync(gitignorePath, 'utf8');
+  const present = new Set(original.split('\n').map(normalizeGitignoreEntry));
+  const missing = XFLOW_GITIGNORE_ENTRIES.filter((entry) => !present.has(normalizeGitignoreEntry(entry)));
+  if (missing.length === 0) {
+    return { path: gitignorePath, created: false, added: [] };
+  }
+
+  const separator = original.length === 0 ? '' : original.endsWith('\n') ? '\n' : '\n\n';
+  writeFileSync(gitignorePath, `${original}${separator}${XFLOW_GITIGNORE_HEADER}\n${missing.join('\n')}\n`, 'utf8');
+  return { path: gitignorePath, created: false, added: missing };
+}
+
 // ─── goal ────────────────────────────────────────────────────────────────────
 
 async function handleGoal(sub, args) {
@@ -5421,7 +5461,17 @@ async function handleWorkflow(sub, args) {
       }
       const isDryRun = args.includes('--dry-run');
       const input = buildWorkflowInput(parsedArgs);
-      const changeId = resolveChangeId({ explicit: parsedArgs.change_id, projectRoot });
+      let changeId = resolveChangeId({ explicit: parsedArgs.change_id, projectRoot });
+      if (!changeId && input.title) {
+        // Lite-track turn economy (issue #5 P1-2): the documented invocation
+        // is `workflow run yolo --title "..."`, which dead-ended on branches
+        // like `main` that cannot derive a change id and pushed agents into
+        // manual atom-by-atom driving. Derive the id from the title instead.
+        changeId = normalizeChangeId(input.title);
+        if (changeId) {
+          console.log(`Derived --change-id "${changeId}" from --title (pass --change-id to override).`);
+        }
+      }
       ensureChangeId(changeId, 'workflow run', projectRoot);
       const { load, dryRun } = await import('../src/core/workflow-loader.js');
       if (isDryRun) {
@@ -6667,7 +6717,10 @@ function printInitHelp() {
 Usage: xflow init [--project-root <path>] [--force] [--json]
 
 Create a project-local .as-xflow/config.json with portable defaults for
-workflow paths, skill sync paths, and issue routing.
+workflow paths, skill sync paths, and issue routing. Also creates or updates
+the project .gitignore so evalid local state (.as-xflow/, specs/changes/)
+stays out of version control; existing entries are never modified and
+re-running init adds nothing twice.
 
 Options:
   --project-root PATH Initialize a specific project root

package/docs/launch-dossier.md

@@ -1,6 +1,6 @@
 # evalid Launch Dossier
 
-Generated: 2026-11-03T18:52:08.690Z
+Generated: 2026-11-05T19:40:37.700Z
 Mode: post_publish
 Verdict: conditionally ready: engine and adoption evidence are strong, registry publication remains required for a splash launch
 Launch ready: not yet
@@ -117,7 +117,7 @@ Evidence:
 - Adoption records: 1; status: pass
 - Goal audit: pass; goal: Keep evalid credible as an open-source agent delivery runtime: repo-owned workflow contracts, executable verification gates, durable project context, and honest benchmark evidence.
 - Package evidence: missing; source: registry_json
-- Package name/version: @surlymochan/evalid@0.3.1
+- Package name/version: @surlymochan/evalid@0.5.0
 
 ## Passing Evidence
 

package/docs/npm-publish-handoff.md

@@ -6,6 +6,19 @@ Use this page for the final irreversible public publish step. Everything here
 is intentionally explicit because `npm publish --access public` changes public
 distribution state.
 
+## Automated publish (trusted publishing)
+
+The registry-mutating step normally runs from GitHub Actions, not from a
+local shell: `.github/workflows/npm-publish.yml` publishes via npm trusted
+publishing (OIDC — no stored npm token anywhere) whenever a GitHub Release
+is published, and can also be started manually (workflow_dispatch) to
+publish the version in `package.json` if that version is not on npm yet.
+Before publishing it runs the same `npm run release:pack` gate as the manual
+sequence below, and for release events it refuses to publish when the
+release tag does not match the `package.json` version. The manual sequence
+below remains the fallback for when Actions or the trusted-publisher
+registration on npmjs.com is unavailable.
+
 ## Current Verified State
 
 - Package: `evalid@0.2.0`

package/docs/workflow-manual.md

@@ -130,7 +130,7 @@
   └──────────────────────────────────────────────────────────────────────────┘
 
   ┌──────────────────────────── Verify / Review ────────────────────────────┐
-  │ 23  verify-consistency  impl vs proposal/plan/specs/AHA.md 漂移检查      │
+  │ 23  verify-consistency  impl vs proposal/plan/specs/AHA.md 漂移检查 + J6 CR 门禁 │
   │ 24  review              对抗性代码评审 + patch-challenge（corps）          │
   │ 25  qa                  行为 + 视觉验证，截图支持（corps）                 │
   │ 26  gate_final          镜像 frozen contract，pass/fail/needs-human       │
@@ -195,6 +195,12 @@ CHANGE_ID=<id> xflow workflow run workflows/yolo.yaml
            │ exist
     ▼
 ┌──────────────────────┐
+│  21a tdd-red         │  atoms: I6a(red) + I6b(red) + B3 transition
+│  gate: artifact-verify│◄─── red 必须失败（F2 起紧随 plan 封存，与规划同一轮次）
+└──────────┬───────────┘
+           │ exist
+    ▼
+┌──────────────────────┐
 │  19  openissue       │  atoms: A1 issue + A2 branch + B2b status
 │  gate: deterministic │◄─── E6 post-openissue
 └──────────┬───────────┘
@@ -207,19 +213,18 @@ CHANGE_ID=<id> xflow workflow run workflows/yolo.yaml
            │ pass
     ▼
 ┌──────────────────────┐
-│  21a tdd-red         │  atoms: I6a(red) + I6b(red)
-│  21b tdd-green       │  atoms: I6a(green) + I6b(green) + I6c quality
-│  gate: artifact-verify│◄─── red 必须失败；green/refactor 必须通过
-└──────────┬───────────┘
-           │ exist
-    ▼
-┌──────────────────────┐
 │  22  execute         │  atoms: B3 transition
 │  gate: human ⏸       │◄─── 等待 xflow gate ack execute
 └──────────┬───────────┘
            │ ack
     ▼
 ┌──────────────────────┐
+│  21b tdd-green       │  atoms: I6a(green) + I6b(green) + I6c quality
+│  gate: artifact-verify│◄─── green/refactor 必须通过
+└──────────┬───────────┘
+           │ exist
+    ▼
+┌──────────────────────┐
 │  23  verify-consist. │  atoms: J1 tests.run + J4a structural + J4b delta
 │  gate: deterministic │◄─── J4a 漂移扫描 + J4b spec delta review
 └──────────┬───────────┘

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@surlymochan/evalid",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Claimed != verified: a runtime verification layer for coding agents. It seals each test run and replays it from a clean snapshot, with a zero-judge gate pipeline (spec clarification, code review, TDD proof) and the xflow CLI.",
   "keywords": [
     "ai-agents",

package/specs/workflow.md

@@ -79,9 +79,9 @@ No workflow may define a phase not listed here. Phase IDs here are authoritative
 
 | # | ID | Source | Description |
 |---|----|--------|-------------|
-| 23 | `verify-consistency` | yolo | Impl vs proposal/plan/specs/AHA.md structural drift check |
+| 23 | `verify-consistency` | yolo | Impl vs proposal/plan/specs/AHA.md structural drift check + deterministic CR gate (`J6.cr.review`: spec alignment, test follow, assertion balance, loop budget) |
 | 24 | `review` | agentos | Adversarial code review + patch-challenge |
-| 25 | `qa` | agentos | Behavior + visual verification, screenshot-backed for strict UI work |
+| 25 | `qa` | agentos | Behavior + visual verification, screenshot-backed for strict UI work; runs the same `J6.cr.review` gate (verdict record `cr/review-0.json`) |
 | 26 | `gate_final` | agentos | Mirror frozen contract; decide pass / fail / needs-human |
 
 ### Archive

package/src/core/workflow-executor.js

@@ -91,9 +91,24 @@ export class WorkflowExecutor {
       phases: this.runtime.phaseCosts,
       wallClockMs,
     });
+    this.persistCostReport(this.runtime.costReport);
     return this.runtime.costReport;
   }
 
+  // The cost report is run evidence (issue #5 P1-1): besides riding on the
+  // terminal execution-log event, persist it as a standalone artifact so a
+  // reader never has to mine the ndjson log for the per-phase breakdown.
+  // Best-effort by design — accounting must never fail the run itself.
+  persistCostReport(report) {
+    try {
+      const dir = resolve(this.projectRoot, '.as-xflow');
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(resolve(dir, 'phase-cost.json'), JSON.stringify(report, null, 2));
+    } catch {
+      // The execution-log event still carries the report.
+    }
+  }
+
   async run() {
     this.runtime.workflowStartedAtMs = Date.now();
     this.runtime.currentPhaseTokens = emptyTokenUsage();
@@ -720,6 +735,7 @@ export class WorkflowExecutor {
         phase_label: phase?.label || null,
         reason,
         detail: detail || null,
+        cost: this.buildCostReport(),
       });
     } catch {
       // Failure logging is best-effort and must not hide the real stop reason.

package/workflows/corps.yaml

@@ -428,6 +428,7 @@ phases:
     atoms:
       - id: J1.tests.run
       - id: J4b.spec_delta.review
+      - id: J6.cr.review
       - id: H5.visual.review
         with: { mode: "qa" }
       - id: E5.artifact.verify
@@ -441,6 +442,7 @@ phases:
       - id: J5.gate.evidence_collect
     artifacts:
       - { path: "specs/changes/${change_id}/qa_acceptance.json", optional: false }
+      - { path: "specs/changes/${change_id}/cr/review-0.json", optional: false }
     gate:
       type: artifact-verify
       on_fail: stop

package/workflows/yolo.yaml

@@ -110,6 +110,28 @@ phases:
       type: artifact-verify
       on_fail: stop
 
+  # F2 (issue #5 P1-2): on the lite track the red proof is sealed immediately
+  # after planning, in the same agent pass that authored the plan and the
+  # failing test. The issue/branch ceremony (openissue, set-in-progress) no
+  # longer sits between planning and red-proof, where it forced a separate
+  # exploration pass; it still completes before execute.
+  - id: tdd-red
+    label: "21a · TDD red"
+    catalog_ref: 21
+    required: true
+    atoms:
+      - id: I6a.tdd.run
+        with: { phase: "red", test_command: "${input.tdd_red_command}", expect: "fail" }
+      - id: I6b.tdd.proof_validate
+        with: { phase: "red", tdd_mode: "${input.tdd_mode}" }
+      - id: B3.status.transition
+        with: { to_stage: "tdd" }
+    artifacts:
+      - { path: "specs/changes/${change_id}/tdd/red-0.json", optional: false }
+    gate:
+      type: artifact-verify
+      on_fail: stop
+
   - id: openissue
     label: "19 · Open issue + branch"
     catalog_ref: 19
@@ -145,23 +167,6 @@ phases:
       with: { phase: "pre-exec" }
       on_fail: stop
 
-  - id: tdd-red
-    label: "21a · TDD red"
-    catalog_ref: 21
-    required: true
-    atoms:
-      - id: I6a.tdd.run
-        with: { phase: "red", test_command: "${input.tdd_red_command}", expect: "fail" }
-      - id: I6b.tdd.proof_validate
-        with: { phase: "red", tdd_mode: "${input.tdd_mode}" }
-      - id: B3.status.transition
-        with: { to_stage: "tdd" }
-    artifacts:
-      - { path: "specs/changes/${change_id}/tdd/red-0.json", optional: false }
-    gate:
-      type: artifact-verify
-      on_fail: stop
-
   - id: execute
     label: "22 · Execute"
     catalog_ref: 22
@@ -199,12 +204,15 @@ phases:
       - id: J1.tests.run
       - id: J4a.spec_consistency.structural
       - id: J4b.spec_delta.review
+      - id: J6.cr.review
       - id: B3.status.transition
         with: { to_stage: "verify" }
       - id: B2b.status.write
         with:
           fields:
             verification_status: "running"
+    artifacts:
+      - { path: "specs/changes/${change_id}/cr/review-0.json", optional: false }
     gate:
       type: deterministic
       atom: J4a.spec_consistency.structural

package/xflow/atoms/i6a_tdd_run.py

@@ -64,7 +64,9 @@ def main():
 
     passed = exit_code == 0
     combined = f"{stdout}\n{stderr}"
-    file_hashes = tdd_lib.write_snapshot(project, args.change_id, args.phase, args.attempt)
+    file_hashes, snapshot_scope = tdd_lib.write_snapshot(
+        project, args.change_id, args.phase, args.attempt, command=args.test_command
+    )
     proof = {
         'phase': args.phase,
         'attempt': args.attempt,
@@ -79,6 +81,7 @@ def main():
         'output_sha256': tdd_lib.output_digest(stdout, stderr),
         'git_head': tdd_lib.git_head(project),
         'file_hashes': file_hashes,
+        'snapshot_scope': snapshot_scope,
         'failure_kind': 'timeout' if timed_out else tdd_lib.classify_output(combined, passed),
         'recorded_at': datetime.now(timezone.utc).isoformat(),
     }

package/xflow/atoms/i6b_tdd_proof_validate.py

@@ -95,8 +95,17 @@ def main():
     if found is None or found != proof.get('file_hashes'):
         emit({'ok': False, 'verdict': 'snapshot_mismatch', 'phase': args.phase}, 1)
 
+    scope = proof.get('snapshot_scope')
+    scoped = isinstance(scope, dict) and bool(proof.get('git_head'))
     try:
-        actual_exit, actual_text = tdd_lib.reexec_snapshot(destination, proof.get('command') or '', timeout=120)
+        if scoped:
+            actual_exit, actual_text = tdd_lib.reexec_scoped_snapshot(
+                project, destination, proof.get('command') or '', proof['git_head'], scope, timeout=120
+            )
+        else:
+            actual_exit, actual_text = tdd_lib.reexec_snapshot(destination, proof.get('command') or '', timeout=120)
+    except RuntimeError as exc:
+        emit({'ok': False, 'verdict': 'replay_source_missing', 'phase': args.phase, 'error': str(exc)[:300]}, 1)
     except subprocess.TimeoutExpired:
         emit({'ok': False, 'verdict': 'reexec_timeout', 'phase': args.phase}, 1)
 
@@ -127,6 +136,13 @@ def main():
             path = project / rel
             if not path.is_file() or tdd_lib.sha256_bytes(path.read_bytes()) != digest:
                 mismatched.append(rel)
+        if scoped:
+            # Test files outside the sealed scope were pinned to the recorded
+            # HEAD at seal time; any that have drifted since are unsealed edits.
+            sealed = set(proof.get('file_hashes', {}))
+            for rel in tdd_lib.changed_since(project, proof['git_head']):
+                if rel not in sealed and tdd_lib.is_test_file(rel):
+                    mismatched.append(rel)
         if mismatched:
             emit({
                 'ok': False,
@@ -138,6 +154,9 @@ def main():
     if proof.get('failure_kind') == 'skipped' or tdd_lib.output_non_result(actual_text):
         emit({'ok': False, 'verdict': 'tests_skipped_or_todo', 'phase': args.phase}, 1)
 
+    if proof.get('failure_kind') == 'counts_unknown' or tdd_lib.output_counts_unknown(actual_text):
+        emit({'ok': False, 'verdict': 'tests_counts_unknown', 'phase': args.phase}, 1)
+
     expected_passed = expected_result(args.phase)
     if expected_passed is not None and proof.get('passed') is not expected_passed:
         emit({

package/xflow/atoms/i6c_tdd_quality_review.py

@@ -95,6 +95,15 @@ def proof_skipped(proof: dict) -> bool:
     return tdd_lib.output_non_result(blob)
 
 
+def proof_counts_unknown(proof: dict) -> bool:
+    if not proof:
+        return False
+    if proof.get("failure_kind") == "counts_unknown":
+        return True
+    blob = f"{proof.get('stdout_tail') or ''}\n{proof.get('stderr_tail') or ''}"
+    return tdd_lib.output_counts_unknown(blob)
+
+
 def symbols_in(project_root: Path, code_files: list[str]) -> set[str]:
     symbols = set()
     for relative in code_files:
@@ -298,6 +307,12 @@ def main() -> None:
                 "code": "tests_skipped_or_todo",
                 "message": "A recorded run skipped or marked todo the tests it claims to have executed.",
             })
+        if proof_counts_unknown(red_proof) or proof_counts_unknown(green_proof):
+            findings.append({
+                "severity": "fail",
+                "code": "tests_counts_unknown",
+                "message": "A recorded run's summary counts could not be fully parsed, so its skip/todo counts are unknown and the run cannot be verified.",
+            })
         symbols = symbols_in(project_root, code_files)
         if symbols and test_files:
             for relative in test_files:

package/xflow/atoms/j6_cr_review.py

@@ -26,6 +26,11 @@ Checks (findings are structured JSON, severity fail | warn):
    (--max-files / --max-lines, or status.json cr_max_files /
    cr_max_lines). Over budget is a warn with a split-the-spec
    recommendation; over 2x budget fails.
+5. Seal partition (reporting only, never a verdict input) - the proof
+   splits the changed files into those still byte-identical to the
+   green TDD seal (file_hashes in tdd/green-0.json) and those that
+   drifted or were never sealed. A review pass re-reads only the
+   drifted set; the sealed set is exactly what the TDD gate verified.
 
 Self-contained on purpose: this atom does not import tdd_lib so it can
 run standalone in a reviewed tree. The file/symbol/assertion semantics
@@ -36,6 +41,7 @@ directory is excluded from the reviewed diff.
 """
 import argparse
 import fnmatch
+import hashlib
 import json
 import os
 import re
@@ -200,6 +206,38 @@ def assertion_delta(project_root: Path, diff_ref: str, test_files: list, deleted
     return added, removed
 
 
+def seal_partition(project_root: Path, change_dir: Path, files: list):
+    """Split changed files by whether they still match the green seal.
+
+    The green TDD proof (tdd/green-0.json) records the sha256 of every
+    file I6a sealed when the proof was produced (issue #5, P1-2). A
+    changed file whose current bytes still hash to the sealed value is
+    byte-for-byte what the TDD gate verified, so a review pass does not
+    need to re-read it; anything else — drifted after the seal, or never
+    sealed — must be re-read. Returns None when no usable green seal
+    exists (the review then re-reads everything).
+    """
+    green = read_json(change_dir / "tdd" / "green-0.json")
+    hashes = green.get("file_hashes")
+    if not isinstance(hashes, dict) or not hashes:
+        return None
+    sealed, drifted = [], []
+    for relative in files:
+        full = project_root / relative
+        digest = None
+        if full.is_file():
+            digest = hashlib.sha256(full.read_bytes()).hexdigest()
+        if digest is not None and hashes.get(relative) == digest:
+            sealed.append(relative)
+        else:
+            drifted.append(relative)
+    return {
+        "sealed_unchanged": sealed,
+        "seal_drifted": drifted,
+        "reread_count": len(drifted),
+    }
+
+
 def tokenize(text: str) -> set:
     tokens = set()
     for raw in re.findall(r"[A-Za-z_][A-Za-z0-9_]*", text):
@@ -416,6 +454,7 @@ def main() -> None:
         "changed_files": all_files,
         "code_files": code_files,
         "test_files": test_files,
+        "seal_partition": seal_partition(project_root, change_dir, all_files),
         "spec_aligned_files": aligned_files,
         "assertions": {"added": added_assertions, "removed": removed_assertions},
         "budget": budget,

package/xflow/atoms/tdd_lib.py

@@ -8,6 +8,13 @@ fails unless the snapshot really exits that way and the binding is rebuilt.
 An agent who can write the tree can still record a genuine failing snapshot
 and later replace the working tree; the digest is not a trusted third party.
 Byte-identical stdout is not required, because runners print timings.
+
+Scoped sealing (issue #5 P1-4): inside a git work tree the snapshot copies
+only the files that differ from HEAD plus the files the test command names.
+Every other file is pinned to the recorded HEAD: I6b materializes it from
+`git archive` at replay time, so the replayed tree is byte-identical to the
+sealed one while the stored manifest stays proportional to the change.
+Outside a git work tree the legacy full-tree copy is used unchanged.
 """
 import hashlib
 import json
@@ -44,6 +51,7 @@ BINDING_FIELDS = (
     "stderr_tail",
     "git_head",
     "file_hashes",
+    "snapshot_scope",
     "failure_kind",
     "recorded_at",
 )
@@ -134,9 +142,16 @@ def sha256_bytes(data: bytes) -> str:
     return hashlib.sha256(data).hexdigest()
 
 
+# Optional binding fields join the payload only when present, so proofs
+# sealed before the field existed keep verifying byte-for-byte.
+OPTIONAL_BINDING_FIELDS = {"snapshot_scope"}
+
+
 def binding_payload(proof: dict) -> dict:
     payload = {}
     for field in BINDING_FIELDS:
+        if field in OPTIONAL_BINDING_FIELDS and proof.get(field) is None:
+            continue
         payload[field] = proof.get(field)
     return payload
 
@@ -187,20 +202,128 @@ def iter_project_files(project_root: Path, skip_prefix: str):
             yield rel, full
 
 
-def write_snapshot(project_root: Path, change_id: str, phase: str, attempt: int) -> dict:
+def _git_status_paths(project_root: Path):
+    """(changed, deleted) path sets from `git status --porcelain -z`.
+
+    Returns None when the project is not a git work tree. Renames report the
+    new path as changed and the old path as deleted.
+    """
+    result = subprocess.run(
+        ["git", "status", "--porcelain=v1", "-z", "--untracked-files=all"],
+        cwd=project_root,
+        capture_output=True,
+    )
+    if result.returncode != 0:
+        return None
+    entries = result.stdout.decode("utf-8", errors="replace").split("\0")
+    changed: set[str] = set()
+    deleted: set[str] = set()
+    index = 0
+    while index < len(entries):
+        entry = entries[index]
+        index += 1
+        if len(entry) < 4:
+            continue
+        code, rel = entry[:2], entry[3:]
+        if "R" in code or "C" in code:
+            old = entries[index] if index < len(entries) else ""
+            index += 1
+            if old:
+                deleted.add(old)
+        if "D" in code:
+            deleted.add(rel)
+        elif rel:
+            changed.add(rel)
+    return changed, deleted
+
+
+def changed_since(project_root: Path, ref: str) -> set[str]:
+    """Paths whose working-tree content differs from `ref`, plus untracked."""
+    paths: set[str] = set()
+    diff = subprocess.run(
+        ["git", "diff", "--name-only", "-z", ref],
+        cwd=project_root,
+        capture_output=True,
+    )
+    if diff.returncode == 0:
+        paths.update(p for p in diff.stdout.decode("utf-8", errors="replace").split("\0") if p)
+    others = subprocess.run(
+        ["git", "ls-files", "--others", "--exclude-standard", "-z"],
+        cwd=project_root,
+        capture_output=True,
+    )
+    if others.returncode == 0:
+        paths.update(p for p in others.stdout.decode("utf-8", errors="replace").split("\0") if p)
+    return paths
+
+
+def snapshot_scope(project_root: Path, change_id: str, command: str | None) -> dict | None:
+    """Files the proof actually depends on (issue #5 P1-4).
+
+    Scoped sealing only applies inside a git work tree: every file that
+    differs from HEAD is sealed by copy, and every other file is pinned to
+    the recorded HEAD and materialized from git at replay time. Returns None
+    when no HEAD exists to pin the rest of the tree to (legacy full copy).
+    """
+    if git_head(project_root) is None:
+        return None
+    status = _git_status_paths(project_root)
+    if status is None:
+        return None
+    changed, deleted = status
+    evidence_prefix = (Path("specs") / "changes" / change_id).as_posix() + "/"
+
+    def excluded(rel: str) -> bool:
+        return rel.startswith(evidence_prefix)
+
+    def noise(rel: str) -> bool:
+        return any(part in SKIP_DIR_NAMES for part in rel.split("/"))
+
+    files = {rel for rel in changed if not excluded(rel) and not noise(rel)}
+    for rel in test_paths(command or ""):
+        if not excluded(rel) and (project_root / rel).is_file():
+            files.add(rel)
+    return {
+        "version": 1,
+        "files": sorted(files),
+        "deleted": sorted(rel for rel in deleted if not excluded(rel) and not noise(rel)),
+    }
+
+
+def write_snapshot(project_root: Path, change_id: str, phase: str, attempt: int,
+                   command: str | None = None) -> tuple[dict, dict | None]:
+    """Seal the tree state a proof ran against.
+
+    With a scope (git work tree), only the scoped files are copied and
+    hashed; the manifest stays proportional to the change, not the tree.
+    Without one, the legacy full-tree copy is used.
+    """
     skip_prefix = (Path("specs") / "changes" / change_id / "tdd").as_posix()
     destination = snapshot_dir(project_root, change_id, phase, attempt)
     if destination.exists():
         shutil.rmtree(destination)
     destination.mkdir(parents=True, exist_ok=True)
+    scope = snapshot_scope(project_root, change_id, command)
     hashes = {}
-    for rel, full in iter_project_files(project_root, skip_prefix):
+    if scope is None:
+        for rel, full in iter_project_files(project_root, skip_prefix):
+            data = full.read_bytes()
+            hashes[rel] = sha256_bytes(data)
+            target = destination / rel
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_bytes(data)
+        return hashes, None
+    for rel in scope["files"]:
+        full = project_root / rel
+        if full.is_symlink() or not full.is_file():
+            continue
         data = full.read_bytes()
         hashes[rel] = sha256_bytes(data)
         target = destination / rel
         target.parent.mkdir(parents=True, exist_ok=True)
         target.write_bytes(data)
-    return hashes
+    scope = {**scope, "files": sorted(hashes)}
+    return hashes, scope
 
 
 def snapshot_tree_hashes(destination: Path):
@@ -220,27 +343,68 @@ def output_digest(stdout: str, stderr: str) -> str:
     return hashlib.sha256(f"{stdout}\0{stderr}".encode("utf-8")).hexdigest()
 
 
+# Node's built-in test runner ends a run with a summary block of
+# "<marker> <label> <count>" lines — the runner's own structured tally.
+# The marker depends on the reporter: "#" for the TAP reporter (the piped
+# default up to Node 22) and "ℹ" for the spec reporter (the piped default
+# from Node 24, and selectable on any version). The gate reads only these
+# line-anchored summary lines, never free-floating text, so test names or
+# program output cannot forge a count.
+_NODE_GATE_LABELS = ("pass", "fail", "skipped", "todo")
+# Lines every node:test summary block carries and other TAP emitters do
+# not; their joint presence is what marks a block as a node summary.
+_NODE_SIGNATURE_LABELS = ("tests", "suites", "cancelled")
+
+
 def _summary_count(text: str, label: str):
-    match = re.search(rf"#\s+{label}\s+(\d+)\b", text)
+    match = re.search(rf"^[#\u2139]\s*{label}\s+(\d+)\b", text, re.MULTILINE)
     if not match:
         return None
     return int(match.group(1))
 
 
+def node_run_counts(text: str):
+    """Summary counts from a node:test run, or None when there is no summary.
+
+    A dict is returned once a block carries the full node signature
+    (tests/suites/cancelled). A gate label the block does not carry maps
+    to None — unknown, never silently zero: a truncated or reshaped
+    block must not read as "zero skipped".
+    """
+    if not text:
+        return None
+    if any(_summary_count(text, label) is None for label in _NODE_SIGNATURE_LABELS):
+        return None
+    labels = _NODE_SIGNATURE_LABELS + _NODE_GATE_LABELS
+    return {label: _summary_count(text, label) for label in labels}
+
+
+def output_counts_unknown(text: str) -> bool:
+    """True when a node:test summary is present but a gate count is unreadable."""
+    counts = node_run_counts(text)
+    if counts is None:
+        return False
+    return any(counts[label] is None for label in _NODE_GATE_LABELS)
+
+
 def output_non_result(text: str) -> bool:
     """True when the runner reported skip/todo/xfail and no passing test."""
     if not text:
         return False
-    skipped = _summary_count(text, "skipped") or 0
-    todo = _summary_count(text, "todo") or 0
-    passed = _summary_count(text, "pass")
-    failed = _summary_count(text, "fail")
-    if skipped + todo > 0 and (passed or 0) == 0 and (failed or 0) == 0:
-        return True
+    counts = node_run_counts(text)
+    node_failed = None
+    if counts is not None:
+        skipped = counts["skipped"]
+        todo = counts["todo"]
+        passed = counts["pass"]
+        node_failed = counts["fail"]
+        if None not in (skipped, todo, passed, node_failed):
+            if skipped + todo > 0 and passed == 0 and node_failed == 0:
+                return True
     py_skipped = sum(int(item) for item in re.findall(r"\b(\d+)\s+skipped\b", text))
     py_skipped += sum(int(item) for item in re.findall(r"\b(\d+)\s+xfailed\b", text))
     py_passed = sum(int(item) for item in re.findall(r"\b(\d+)\s+passed\b", text))
-    if py_skipped > 0 and py_passed == 0 and (failed or 0) == 0:
+    if py_skipped > 0 and py_passed == 0 and (node_failed or 0) == 0:
         return True
     return False
 
@@ -249,6 +413,11 @@ def classify_output(text: str, passed: bool) -> str:
     if output_non_result(text):
         return "skipped"
     if passed:
+        # Fail closed: a node:test summary that cannot be fully read does
+        # not prove a clean pass — the skip/todo counts may sit in the
+        # part that failed to parse, so the run is unverifiable, not green.
+        if output_counts_unknown(text):
+            return "counts_unknown"
         return "passed"
     if re.search(r"does not provide an export named|cannot import name\b", text, re.IGNORECASE):
         return "test_error"
@@ -676,6 +845,46 @@ def reexec_snapshot(destination: Path, command: str, timeout: int = 120):
         shutil.rmtree(temp, ignore_errors=True)
 
 
+def reexec_scoped_snapshot(project_root: Path, destination: Path, command: str,
+                           git_head_ref: str, scope: dict, timeout: int = 120):
+    """Replay a scoped proof: rebuild the sealed tree, then re-run.
+
+    Unchanged files come from `git archive` at the recorded HEAD (their
+    seal-time content is HEAD content by construction of the scope), deleted
+    paths stay deleted, and the sealed scoped files are overlaid last so
+    they win over the archive.
+    """
+    temp = Path(tempfile.mkdtemp(prefix="evalid-proof-"))
+    try:
+        archive = subprocess.run(
+            ["git", "archive", git_head_ref],
+            cwd=project_root,
+            capture_output=True,
+        )
+        if archive.returncode != 0:
+            raise RuntimeError(f"git archive {git_head_ref} failed: {archive.stderr.decode('utf-8', errors='replace')[:300]}")
+        extract = subprocess.run(
+            ["tar", "-x", "-C", str(temp)],
+            input=archive.stdout,
+            capture_output=True,
+        )
+        if extract.returncode != 0:
+            raise RuntimeError(f"replay tree extraction failed: {extract.stderr.decode('utf-8', errors='replace')[:300]}")
+        for rel in list(scope.get("deleted", [])) + list(scope.get("files", [])):
+            target = temp / rel
+            if target.is_dir() and not target.is_symlink():
+                shutil.rmtree(target)
+            elif target.exists() or target.is_symlink():
+                target.unlink()
+        if any(destination.iterdir()):
+            shutil.copytree(destination, temp, dirs_exist_ok=True)
+        result = run_shell(command, temp, timeout=timeout)
+        text = f"{result.stdout or ''}\n{result.stderr or ''}"
+        return result.returncode, text
+    finally:
+        shutil.rmtree(temp, ignore_errors=True)
+
+
 def copy_project(project_root: Path, destination: Path) -> None:
     def ignore(_directory, names):
         return [name for name in names if name in SKIP_DIR_NAMES]

package/xflow/plan/SKILL.md

@@ -30,6 +30,15 @@ reuse it instead of rewriting the same plan again.
 If the file is missing or still a scaffold placeholder, create the reusable
 plan once and leave routing to the execution workflow.
 
+## Lite-track merged pass
+
+When the change will run the lite (yolo) track, do the red-proof authoring
+in the same pass as the plan: write the failing test and fix the red test
+command in the plan itself. The yolo workflow seals `tdd-red` immediately
+after `plan`, so a separate test-authoring pass would only re-read the
+same files. This does not apply to the corps track, which keeps planning
+and proof authoring apart.
+
 ## Boundary
 
 - This skill does not open issues.

package/xflow/scripts/common.py

@@ -25,7 +25,10 @@ ALLOWED_STAGE_TRANSITIONS: dict[str, set[str]] = {
     "proposal-freeze": {"proposal-freeze", "proposal-consistency-check", "plan"},
     "proposal-consistency-check": {"proposal-consistency-check", "plan"},
     "plan": {"plan", "tdd"},
-    "openissue": {"openissue", "tdd"},
+    # "execute" is reachable from openissue on the lite track: since F2 the
+    # red proof is sealed before the issue is filed, so execution may start
+    # straight from the openissue stage.
+    "openissue": {"openissue", "tdd", "execute"},
     "tdd": {"tdd", "execute", "verify"},
     "execute": {"execute", "tdd", "verify"},
     "verify": {"verify", "tdd", "execute", "archive"},

package/xflow/yolo/SKILL.md

@@ -22,6 +22,10 @@ For a full run:
 xflow workflow run workflows/yolo.yaml --title "<中文标题>" --change-type backend
 ```
 
+When `--change-id` is omitted and the current branch cannot provide one
+(e.g. `main`), the run derives the change id from `--title` and prints it;
+pass `--change-id` explicitly to override.
+
 ## Plan reuse rule
 
 - Read `.xflow/GOAL.md` before execution when present. State whether the current
@@ -45,13 +49,26 @@ xflow workflow run workflows/yolo.yaml --title "<中文标题>" --change-type ba
 4. `proposal-freeze`
 5. `proposal-consistency-check`
 6. `plan`
-7. `openissue`
-8. `set-in-progress`
-9. `tdd`
+7. `tdd` (red proof — sealed in the same pass as the plan, see below)
+8. `openissue`
+9. `set-in-progress`
 10. `execute`
 11. `verify-consistency`
 12. `archive`
 
+On the lite track the red proof is sealed immediately after planning: the
+pass that writes the plan also writes the failing test, so `tdd-red` only
+runs and seals it — no second exploration pass, and the issue/branch
+ceremony no longer sits between planning and the red proof.
+
+In `verify-consistency`, run the deterministic gates first. The J6 proof
+(`specs/changes/${CHANGE_ID}/cr/review-0.json`) carries a `seal_partition`:
+files whose bytes still match the green proof's sealed hashes
+(`sealed_unchanged`) are exactly what the TDD gate verified — the review
+pass does not re-read them. Only `seal_drifted` files (changed after the
+green seal, or never sealed) get a fresh read. When `seal_partition` is
+null there is no green seal to trust, and the review re-reads everything.
+
 The workflow YAML is the canonical execution source for atom order, gates, and
 artifact checks. This skill only explains the contract.