@xulthekl/team-flow 0.65.0 → 0.68.0

package/scripts/lib/cmd-security.mjs

@@ -0,0 +1,61 @@
+// scripts/lib/cmd-security.mjs — tf security 子命令
+// v1.3（security-baseline-integration-design）：`tf security scope <change-dir> [--json]`
+// 运行共享推导模块（scripts/lib/security-scope.mjs 唯一实现），落盘 .security-scope.json
+// 并打印 scope_hash。调用点：① L3 派发前（主会话取适用子集随 dispatch prompt 传参）
+// ② 人工刷新（guard 对账 FAIL 后重跑）。LLM/人从不手写 scope JSON（设计 §二.6）。
+import { parseArgs } from 'node:util';
+import { deriveSecurityScope, loadSecurityBaseline, SCOPE_FILE } from './security-scope.mjs';
+
+export async function run(args) {
+  const { positionals, values } = parseArgs({
+    args,
+    options: { json: { type: 'boolean', default: false } },
+    allowPositionals: true,
+  });
+
+  const sub = positionals[0];
+
+  if (sub === 'baseline') {
+    // tf security baseline [--json] — 查看基线双载体（人类可读路径 + 版本锚）
+    const data = loadSecurityBaseline();
+    if (values.json) {
+      console.log(JSON.stringify({
+        baseline_version: data.baseline_version,
+        items: data.items.length,
+        path: new URL('../../skills/ce-brainstorm/references/security-baseline.json', import.meta.url).pathname,
+      }, null, 2));
+    } else {
+      console.log(`security-baseline ${data.baseline_version} — ${data.items.length} items (md+json 双载体，见 skills/ce-brainstorm/references/security-baseline.md)`);
+    }
+    return 0;
+  }
+
+  if (sub !== 'scope') {
+    console.error('Usage: tf security <scope|baseline> <args>\n' +
+      '  scope <change-dir> [--json]   推导适用触发类别并落盘 .security-scope.json\n' +
+      '  baseline [--json]             查看 44 项基线版本锚');
+    return 2;
+  }
+
+  const changeDir = positionals[1];
+  if (!changeDir) {
+    console.error('Usage: tf security scope <change-dir> [--json]');
+    return 2;
+  }
+
+  const result = deriveSecurityScope(changeDir, { source: 'cli' });
+
+  if (values.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    if (result.error) {
+      console.error(`scope derive degraded (error=${result.error}) — 基线/diff 不可用，gate 侧将 fail-closed`);
+    }
+    console.log(`Scope written: ${SCOPE_FILE}`);
+    console.log(`  triggered: ${result.triggered_categories.length ? result.triggered_categories.join(', ') : '(none — 静默 PASS 类别)'}`);
+    console.log(`  applicable items: ${result.applicable_items.length} (code: ${result.code_item_ids.length}, infra-only: ${result.infra_item_ids.length})`);
+    console.log(`  scope_hash: ${result.scope_hash}`);
+  }
+  // 推导失败（无基线/diff 失败）按 fail-closed 返回非零，供调用方判断
+  return result.error ? 1 : 0;
+}

package/scripts/lib/cmd-solutions.mjs

@@ -21,6 +21,8 @@ export async function run(args) {
       severity: { type: 'string' },
       summary: { type: 'string' },
       source: { type: 'string' },
+      // agent-governance P2-1：纠错条目的来源事件锚（HOLD 的 msg_id / 决策日志行）
+      'source-event': { type: 'string' },
       // v0.57.0 §4.1：inject 的展示条数控制与 backfill 的预演
       limit: { type: 'string' },
       all: { type: 'boolean' },
@@ -52,6 +54,7 @@ export async function run(args) {
       severity: values.severity,
       summary: values.summary,
       source: values.source,
+      source_event: values['source-event'],
       dir: values.dir,
     });
     return;

package/scripts/lib/cmd-state.mjs

@@ -1,7 +1,7 @@
 // scripts/lib/cmd-state.mjs — tf state subcommand handler
 import { parseArgs } from 'node:util';
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
 import path, { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 // VALID_STATES 统一从 state-loader.mjs 引入(状态机合法值唯一真相源),不再本地硬编码。
@@ -11,6 +11,26 @@ import { computeArtifactsHash, computeContractHash, computeTestMatrixHash } from
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
+/**
+ * P1-1：自 changeDir 向上（限 6 层）找 `<root>/.team-flow/prd-clarity.json` 并解析。
+ * 找不到 / 解析失败 → null（= 中性，init 不打字段）。
+ */
+function findProductClarityRecord(changeDir) {
+  let dir = path.resolve(changeDir);
+  for (let i = 0; i < 6; i += 1) {
+    const rec = path.join(dir, '.team-flow', 'prd-clarity.json');
+    if (existsSync(rec)) {
+      const parsed = JSON.parse(readFileSync(rec, 'utf-8'));
+      if (parsed && (parsed.status === 'pass' || parsed.status === 'fail')) return parsed;
+      return null;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
 // v0.13 §50（BUG-A 政策修正）：test_result 移出可手工设置字段——测试证据必须经
 // tf test record 程序化记录，手工自述值不再被 tests-passing 门禁接受。
 // v0.13 §48.2：test_matrix_skip_reason 可设置（显式 skip 的理由留痕）。
@@ -58,6 +78,11 @@ const SETTABLE_FIELDS = [
   'gates_probed_skipped', 'gates_probed_skip_reason', 'gates_probed_na',
   // v0.64.0（§4 arch-design-light）：轻架构说明显式跳过键（须附理由）
   'arch_design_light_skipped', 'arch_design_light_skip_reason',
+  // security-baseline-integration-design v1.3（§L2 三环第 3 环）：安全基线跳过三键。
+  // 三键必须与 state-loader BUILTIN_DEFAULTS + writeState 序列化分支同步注册，
+  // 缺任一环即「回显成功却零写入」。skip 写入规范：设置 skipped 必须同批带
+  // security_scope_hash（值取最近 tf security scope 输出），hash 缺失时 guard 判 skip 失效。
+  'security_baseline_skipped', 'security_baseline_skip_reason', 'security_scope_hash',
 ];
 
 export async function run(args) {
@@ -121,6 +146,16 @@ export async function run(args) {
       const state = readState(changeDir);
       if (!stateFileExisted) {
         state.schema_version = 1;
+        // P1-1 clarity 跨层管道：拷贝产品级记录（唯一写入路径——state 字段不在
+        // SETTABLE_FIELDS，防自助放行）。find 向上找 <root>/.team-flow/prd-clarity.json。
+        // 记录 fail 也拷：绕过 S2 冻结的 direct change 在变更级被 guard 拦下（双保险）。
+        try {
+          const rec = findProductClarityRecord(changeDir);
+          if (rec) {
+            state.prd_clarity_result = rec.status === 'fail' ? 'fail' : 'pass';
+            state.prd_clarity_hash = rec.prd_hash ?? null;
+          }
+        } catch { /* 无记录 = 中性，不阻断 init */ }
         // v0.64.0 P0（§4 扫描基线）：init 打戳 base_sha（架构 surface 扫描的 git 基线）。
         // 非 git 环境 / 尚无提交 → 保持 null，扫描时按 §4 退化参照（origin → FAIL）。
         try {

package/scripts/lib/security-scope.mjs

@@ -0,0 +1,188 @@
+// scripts/lib/security-scope.mjs — Scope Deriver（安全基线范围推导，唯一实现）
+// 设计：docs/plan/security-baseline-integration-design.md v1.3 §三
+// 单一真相源 = skills/ce-brainstorm/references/security-baseline.json（与 .md 双载体，
+// 一致性由测试断言锁）。本模块是推导的唯一实现——CLI `tf security scope` 与 guard
+// 检查器都只经此调用，杜绝多处各自实现漂移（§二.6）。
+//
+// 输出（写盘 <change-dir>/.security-scope.json）：
+//   { base_sha, triggered_categories[], applicable_items[], code_item_ids[],
+//     infra_item_ids[], scope_hash, derived_at, derived_by, files_scanned, error }
+// scope_hash 预像 = 规范化（排序）后的 triggered_categories + applicable_items id
+// （排除 derived_at 等易变字段）——见设计 §三 Scope Deriver 段。
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync, realpathSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join, resolve, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { gitChangedFiles } from './surface-scan.mjs';
+import { readState } from './state-loader.mjs';
+
+export const SCOPE_FILE = '.security-scope.json';
+
+const BASELINE_JSON_URL = new URL(
+  '../../skills/ce-brainstorm/references/security-baseline.json', import.meta.url,
+);
+
+export function loadSecurityBaseline() {
+  const raw = readFileSync(fileURLToPath(BASELINE_JSON_URL), 'utf-8');
+  const data = JSON.parse(raw);
+  if (!Array.isArray(data.items) || data.items.length !== 44) {
+    throw new Error(`security-baseline.json malformed: expected 44 items, got ${data.items?.length}`);
+  }
+  return data;
+}
+
+// --- 触发推导规则（路径启发式 + 文档关键词；规则改动须同步设计文档 §三） ---
+
+// 不构成暴露面的文件（文档 / 测试 / 元数据）——纯此类变更 → 无触发类别 → 静默 PASS
+const NON_SURFACE = /\.(md|txt|png|jpe?g|gif|svg|pdf|lock|sum|ipynb|css|scss|html?)$/i;
+const TEST_PATH = /(^|\/)(test|tests|__tests__|spec|e2e)(\/|$)|\.(test|spec)\.[jt]sx?$/i;
+
+// 源码扩展名 → 基础触发类别（改代码即查基础安全判据）
+const SOURCE_EXT = /\.(java|kt|kts|ts|tsx|js|jsx|mjs|cjs|vue|py|go|rs|cs|php|rb|scala|swift|sql|sh|groovy|xml|yaml|yml|json|toml|properties|conf|ini|dockerfile)$/i;
+const SOURCE_BASE_TRIGGERS = ['code-quality', 'input', 'output'];
+
+// 路径启发式 → 追加触发类别（对路径与文件名匹配，大小写不敏感）
+const PATH_RULES = [
+  { re: /upload|attachment|multipart|file[_-]?(io|controller|service|handler)/i, cat: 'file-io' },
+  { re: /auth|login|session|token|jwt|oauth|permission|rbac|role|sso|passwd|password/i, cat: 'authn-authz' },
+  { re: /redirect|forward|callback|goto|跳转|重定向/i, cat: 'redirect' },
+  { re: /audit|operat(ion|ing)_?log|审计/i, cat: 'audit' },
+  { re: /ingress|gateway|nginx|tls|ssl|cert|https|deploy|k8s|kubernetes/i, cat: 'transport' },
+  { re: /xml|soap|xxe|jaxb/i, cat: 'processing' },
+  { re: /pom\.xml$|package\.json$|requirements.*\.txt$|go\.mod$|build\.gradle$|gemfile$|composer\.json$/i, cat: 'deps' },
+];
+
+// 部署/依赖清单路径 → deps（与 SOURCE_EXT 重叠时两者都算）
+const DEPLOY_PATH = /(^|\/)(\.github|\.gitlab-ci|deploy|helm|charts|docker|k8s|infrastructure)(\/|$)|Dockerfile|docker-compose/i;
+
+// spec/arch 文档关键词 → 追加触发类别（文本扫描，中文+英文）
+const TEXT_RULES = [
+  { re: /文件上传|上传附件|multipart|file\s*upload/i, cat: 'file-io' },
+  { re: /登录|认证|鉴权|权限|会话|token|jwt|oauth/i, cat: 'authn-authz' },
+  { re: /跳转|重定向|redirect/i, cat: 'redirect' },
+  { re: /审计日志|操作日志|审计/i, cat: 'audit' },
+  { re: /https|tls|hsts|ssl|传输加密/i, cat: 'transport' },
+  { re: /xxe|xml\s*实体|soap/i, cat: 'processing' },
+  { re: /依赖升级|组件版本|中间件版本|cve/i, cat: 'deps' },
+  { re: /响应头|content-security-policy|x-frame|nosniff/i, cat: 'output' },
+  { re: /sql\s*注入|参数化|查询注入/i, cat: 'code-quality' },
+];
+
+const DOC_TARGETS = ['proposal.md', 'design.md', 'specs', 'architecture'];
+
+function scanDocText(changeDir) {
+  const texts = [];
+  for (const t of DOC_TARGETS) {
+    const p = join(changeDir, t);
+    if (!existsSync(p)) continue;
+    try {
+      const st = readFileSync(p, 'utf-8');
+      texts.push(st);
+    } catch { /* skip */ }
+  }
+  return texts.join('\n');
+}
+
+/**
+ * 推导安全基线适用范围。
+ * @param {string} changeDir
+ * @param {object} [opts]
+ * @param {'cli'|'guard'} [opts.source]  落盘 provenance 标记
+ * @param {boolean} [opts.write=true]    是否写盘 .security-scope.json
+ * @returns 推导结果对象（含 error 字段：'no-baseline'|'diff-failed'|null）
+ */
+export function deriveSecurityScope(changeDir, opts = {}) {
+  const { source = 'cli', write = true } = opts;
+  const state = readState(changeDir);
+  const baseline = loadSecurityBaseline();
+
+  const changed = gitChangedFiles(changeDir, state);
+  const error = changed.error; // no-baseline / diff-failed / null
+  // 排除 change 目录自身（.team-flow.yaml / .security-*.json / .superpowers/ 等
+  // 流程产物会被 git status 三源扫到——它们不是变更代码的暴露面）。
+  const changeRoot = relativeRepoPrefix(changeDir);
+  const files = (changed.files || []).filter(f =>
+    !(changeRoot && f.startsWith(changeRoot)) && !f.startsWith('.superpowers/'));
+
+  const triggered = new Set();
+  let filesScanned = 0;
+
+  for (const f of files) {
+    if (TEST_PATH.test(f)) continue;
+    if (NON_SURFACE.test(f) && !DEPLOY_PATH.test(f)) continue;
+    filesScanned++;
+    if (SOURCE_EXT.test(f) || DEPLOY_PATH.test(f)) {
+      for (const c of SOURCE_BASE_TRIGGERS) triggered.add(c);
+    }
+    for (const rule of PATH_RULES) {
+      if (rule.re.test(f)) triggered.add(rule.cat);
+    }
+    if (DEPLOY_PATH.test(f)) triggered.add('deps');
+  }
+
+  const docText = scanDocText(changeDir);
+  if (docText) {
+    for (const rule of TEXT_RULES) {
+      if (rule.re.test(docText)) triggered.add(rule.cat);
+    }
+  }
+
+  const triggeredList = [...triggered].sort();
+  const applicable = baseline.items
+    .filter(i => triggeredList.includes(i.trigger))
+    .sort((a, b) => a.id - b.id);
+
+  const hashPreimage = JSON.stringify({
+    triggered: triggeredList,
+    items: applicable.map(i => i.id),
+  });
+  const scopeHash = createHash('sha256').update(hashPreimage).digest('hex').slice(0, 16);
+
+  const result = {
+    base_sha: changed.base ?? state.base_sha ?? null,
+    triggered_categories: triggeredList,
+    applicable_items: applicable.map(i => i.id),
+    code_item_ids: applicable.filter(i => i.locus.includes('code')).map(i => i.id),
+    infra_item_ids: applicable.filter(i => !i.locus.includes('code')).map(i => i.id),
+    scope_hash: scopeHash,
+    derived_at: new Date().toISOString(),
+    derived_by: source,
+    files_scanned: filesScanned,
+    error,
+  };
+
+  if (write) {
+    writeFileSync(join(changeDir, SCOPE_FILE), JSON.stringify(result, null, 2) + '\n', 'utf-8');
+  }
+  return result;
+}
+
+/** changeDir 在其 git 仓库内的相对前缀（带尾 /），用于过滤流程产物自身。
+ *  双侧 realpath 归一——macOS /var → /private/var 符号链接会让字符串前缀比较失效。 */
+function relativeRepoPrefix(changeDir) {
+  try {
+    // stdio 收窄：非 git 目录时 git 会往 stderr 打 fatal 原文（报错不指向真因），
+    // 由调用侧按 error=no-baseline 给结构化提示
+    const root = realpathSync(execFileSync('git', ['rev-parse', '--show-toplevel'], {
+      cwd: changeDir, encoding: 'utf-8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim());
+    if (!root) return null;
+    const abs = realpathSync(resolve(changeDir));
+    if (!abs.startsWith(root)) return null;
+    const rel = relative(root, abs);
+    return rel && !rel.startsWith('..') ? rel.replace(/\\/g, '/') + '/' : '';
+  } catch {
+    return null;
+  }
+}
+
+export function readScopeFile(changeDir) {
+  const p = join(changeDir, SCOPE_FILE);
+  if (!existsSync(p)) return null;
+  try {
+    return JSON.parse(readFileSync(p, 'utf-8'));
+  } catch {
+    return null;
+  }
+}

package/scripts/lib/solutions-capture.mjs

@@ -42,6 +42,10 @@ export function run(args = {}) {
   const severity = args.severity || 'medium';
   const summary = args.summary || '(no summary)';
   const source = args.source || '';
+  // agent-governance P2-1：来源事件锚——correction 条目的毕业条件消费它
+  //（P2-2「锚未标撤销」判定；无锚条目按未毕业处理）。HOLD 场景 = escalation msg_id
+  // 或决策日志行；非空才写入 frontmatter。
+  const sourceEvent = args.source_event || '';
   const dir = args.dir || 'docs/solutions';
 
   // 注：process.exit 后补 return——真实 CLI 下 exit 即终止；测试环境 mock exit 时
@@ -79,6 +83,7 @@ type: ${type}
 severity: ${severity}
 date: ${date}
 source: ${source}
+${sourceEvent ? `source_event: ${sourceEvent}` : ''}
 title: ${title}
 ---
 

package/scripts/lib/solutions-index-gen.mjs

@@ -41,6 +41,34 @@ import { parseFrontmatter, listSolutionEntries } from './solutions-entry.mjs';
 /** INDEX 保留的最大**条目数**（非行数——文件还含 4 行头部） */
 export const MAX_INDEX_ENTRIES = 150;
 
+/**
+ * agent-governance P2-2（earned automation 见习）：毕业阈值。
+ * `flags` 列派生规则（**纯派生、随重建重算**——INDEX 是投影）：
+ * - 条目有 `source_event` 锚（P2-1 起的 correction 条目）：confirmations ≥ 本阈值 → `auto-ok`，
+ *   否则 → `probation`（见习：不进自动注入上下文）。
+ *   「锚被标撤销」的毕业否决暂无实现（撤销动作未建，如实声明——source_event 锚已就位，
+ *   撤销标记是其消费侧的未来项）。
+ * - 无锚存量条目 → `auto-ok`（**grandfather**：它们已在注入通道，见习化 = 行为回退，不采纳；
+ *   与 schema_version 存量豁免同构）。
+ * - 红区硬排除不在此处：红区判定是**消费侧**职责（inject 按 summary/domain 关键词排除），
+ *   flags 表示毕业状态、不表示区域。
+ */
+export const GRADUATED_MIN_CONFIRMATIONS = 3;
+
+/** 解析 frontmatter confirmations 计数（宽松：仅计数，promote 的严格解析不在此复用）。 */
+function countConfirmations(fm) {
+  const raw = fm?.confirmations;
+  if (raw == null || raw === '') return 0;
+  return String(raw).replace(/[[\]]/g, '').split(',').map((s) => s.trim()).filter(Boolean).length;
+}
+
+/** 派生 flags（见上注释的规则表）。 */
+export function deriveFlags(fm) {
+  const hasAnchor = Boolean(fm?.source_event && String(fm.source_event).trim());
+  if (!hasAnchor) return 'auto-ok';
+  return countConfirmations(fm) >= GRADUATED_MIN_CONFIRMATIONS ? 'auto-ok' : 'probation';
+}
+
 /**
  * 解析条目文件的 frontmatter（扁平键值）——**收敛到共享层**（v0.57.0 P4 二轮）。
  *
@@ -111,6 +139,8 @@ export function refreshIndex(dir, { phases = SOLUTION_PHASES, maxEntries = MAX_I
         file: `${phase}/${file}`,
         // v0.57.0 P4：source 进 INDEX 供 inject 做同源聚类（此前只存在于条目文件，消费方读不到）
         source: fm.source || '',
+        // P2-2：见习/毕业派生状态（规则见 GRADUATED_MIN_CONFIRMATIONS 注释）
+        flags: deriveFlags(fm),
       });
     }
   }
@@ -133,10 +163,10 @@ export function refreshIndex(dir, { phases = SOLUTION_PHASES, maxEntries = MAX_I
   // "只读 INDEX、不读条目文件"，故聚类键必须进索引。消费方对 7/8 列都容错（见 solutions-inject）。
   let index = '# Solutions Index\n';
   index += `<!-- 每条一行，排序 severity 降序 → date 降序 → file 兜底，≤${maxEntries} 条上限；summary/source 内的 | 转义为 \\| -->\n`;
-  index += '| date | phase | domain | type | severity | summary | file | source |\n';
-  index += '|------|-------|--------|------|----------|---------|------|--------|\n';
+  index += '| date | phase | domain | type | severity | summary | file | source | flags |\n';
+  index += '|------|-------|--------|------|----------|---------|------|--------|-------|\n';
   for (const e of kept) {
-    index += `| ${escapeCell(e.date)} | ${escapeCell(e.phase)} | ${escapeCell(e.domain)} | ${escapeCell(e.type)} | ${escapeCell(e.severity)} | ${escapeCell(e.summary)} | ${escapeCell(e.file)} | ${escapeCell(e.source)} |\n`;
+    index += `| ${escapeCell(e.date)} | ${escapeCell(e.phase)} | ${escapeCell(e.domain)} | ${escapeCell(e.type)} | ${escapeCell(e.severity)} | ${escapeCell(e.summary)} | ${escapeCell(e.file)} | ${escapeCell(e.source)} | ${escapeCell(e.flags)} |\n`;
   }
 
   writeFileSync(join(dir, 'INDEX.md'), index, 'utf-8');

package/scripts/lib/solutions-inject.mjs

@@ -37,16 +37,31 @@ import { severityRank } from './severity.mjs';
 import { parseTableRow } from './md-normalize.mjs';
 
 /**
- * INDEX 表列数范围（date | phase | domain | type | severity | summary | file [| source]）。
- * v0.57.0 P4：`source` 列是本版新增 ⇒ 7（存量 INDEX）与 8（本版重建）都要接受。
+ * INDEX 表列数范围（date | phase | domain | type | severity | summary | file | source | flags）。
+ * v0.57.0 P4：`source` 列新增 ⇒ 7/8 都要接受；
+ * agent-governance P2-2：`flags` 列（见习/毕业）新增 ⇒ 8（上版重建）与 9（本版）都要接受，
+ * **7 列最旧存量同样接受**（flags 缺失 = 无锚存量 = grandfather auto-ok，见 index-gen deriveFlags）。
  */
 const INDEX_COLUMNS_MIN = 7;
-const INDEX_COLUMNS_MAX = 8;
+const INDEX_COLUMNS_MAX = 9;
 /** `file` 列的形状（`<phase>/<name>.md`）——语义校验，见下方列解析注释 */
 const ENTRY_FILE_RE = /^[a-z][a-z-]*\/.+\.md$/;
 /** 默认展示条数 */
 const DEFAULT_LIMIT = 5;
 
+/**
+ * P2-2 红区硬排除：DP-A / Code Landing / publish 相关的复利建议**永不自动注入**
+ * （memo §2.4 红区护栏——红区永久人工，连"建议"也不自动进上下文，防复利通道
+ * 变相给红区动作背书）。宁可少注入（安全方向）不误放。
+ */
+const RED_ZONE_RE = /\bDP-A\b|Code Landing|\bpublish\b|发布闸|代码落地/i;
+
+/** P2-2 见习判定：flags 列非 auto-ok（probation 或未知新值）即不自动注入。 */
+function isProbation(flags) {
+  const f = String(flags || '').toLowerCase();
+  return f !== '' && f !== 'auto-ok';
+}
+
 export function run(args = {}) {
   const phase = args.phase || 'cross-phase';
   const domain = args.domain || '';
@@ -63,6 +78,8 @@ export function run(args = {}) {
 
   const content = readFileSync(indexPath, 'utf-8');
   const entries = [];
+  // P2-2 门控计数（可观察性：跳过多少 = 门在工作的证据）
+  const excluded = { probation: 0, redZone: 0 };
 
   for (const line of content.split('\n')) {
     if (!line.startsWith('|') || line.startsWith('| date') || line.startsWith('|--')) continue;
@@ -70,7 +87,7 @@ export function run(args = {}) {
     const cells = parseTableRow(line);
     // 上下界同时校验：只查下界无法发现"summary 含 `|` 导致列数变多、file 列错位"（v0.38.0 test-merge 同型缺陷）
     if (cells.length < INDEX_COLUMNS_MIN || cells.length > INDEX_COLUMNS_MAX) continue;
-    const [date, ePhase, eDomain, type, severity, summary, file, source = ''] = cells;
+    const [date, ePhase, eDomain, type, severity, summary, file, source = '', flags = ''] = cells;
     // file 列语义校验（v0.57.0 P4）：列数在界内仍可能错位——例如 summary 含**未转义**的 `|`
     // 时列数恰好落进 7/8 区间，摘要后半段会顶到 file 位。形状不符即丢弃，避免注入错位的路径。
     if (!ENTRY_FILE_RE.test(file)) continue;
@@ -79,7 +96,10 @@ export function run(args = {}) {
     const domainMatch = !domain || !eDomain || eDomain === 'general' || eDomain === domain;
 
     if (phaseMatch && domainMatch) {
-      entries.push({ date, phase: ePhase, domain: eDomain, type, severity, summary, file, source, isNative: ePhase === phase });
+      // P2-2 两道消费侧门控（跳过 = 不注入，落 excluded 计数可观察）
+      if (isProbation(flags)) { excluded.probation += 1; continue; }
+      if (RED_ZONE_RE.test(`${summary} ${eDomain}`)) { excluded.redZone += 1; continue; }
+      entries.push({ date, phase: ePhase, domain: eDomain, type, severity, summary, file, source, flags, isNative: ePhase === phase });
     }
   }
 
@@ -119,12 +139,17 @@ export function run(args = {}) {
   const shown = all ? clustered : clustered.slice(0, limit);
 
   if (shown.length === 0) {
-    console.log(`<!-- No matching solutions found (phase=${phase}, domain=${domain || 'any'}) -->`);
-    return { entries: [] };
+    // P2-2：「被门控排除成空」与「本来无匹配」语义不同——前者必须可见，否则门 = 隐形
+    const excl = (excluded.probation + excluded.redZone) > 0
+      ? `（P2-2 门控排除 ${excluded.probation} 条见习 + ${excluded.redZone} 条红区）` : '';
+    console.log(`<!-- No matching solutions found (phase=${phase}, domain=${domain || 'any'})${excl} -->`);
+    return { entries: [], excluded };
   }
 
   const foldedNote = foldedCount > 0 ? `, ${foldedCount} 条同源已折叠` : '';
-  console.log(`## Solutions Context (phase=${phase}, domain=${domain || 'any'}, showing ${shown.length}/${clustered.length}${foldedNote})`);
+  const excludedNote = (excluded.probation + excluded.redZone) > 0
+    ? `, P2-2 门控排除 ${excluded.probation} 条见习 + ${excluded.redZone} 条红区` : '';
+  console.log(`## Solutions Context (phase=${phase}, domain=${domain || 'any'}, showing ${shown.length}/${clustered.length}${foldedNote}${excludedNote})`);
   console.log('');
   for (const e of shown) {
     console.log(`- [${e.severity}] ${e.summary} (${e.phase}/${e.domain}, ${e.date}) → ${e.file}`);
@@ -140,7 +165,7 @@ export function run(args = {}) {
     console.log('');
   }
 
-  return { entries: shown, total: clustered.length, folded: foldedCount, hidden };
+  return { entries: shown, total: clustered.length, folded: foldedCount, hidden, excluded };
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {

package/scripts/lib/state-loader.mjs

@@ -89,6 +89,11 @@ const BUILTIN_DEFAULTS = {
   test_matrix_skip_reason: null,
   // Test evidence (v0.13 §50：tf test record 落盘的 runner 输出证据路径)
   test_evidence_path: null,
+  // Product-level PRD clarity record（agent-governance P1-1 跨层管道）：
+  // 唯一写入路径 = tf state init 从 <root>/.team-flow/prd-clarity.json 拷贝；
+  // **有意不在 cmd-state SETTABLE_FIELDS**——可 set 就是自助放行通道（gate-hint-is-a-bypass）。
+  prd_clarity_result: null,
+  prd_clarity_hash: null,
   // Tasks gate (v0.22 §85：hotfix/tweak 跳过 spec-writer 时显式跳过 tasks.md)
   tasks_skipped: null,
   tasks_skip_reason: null,
@@ -109,6 +114,13 @@ const BUILTIN_DEFAULTS = {
   // 与 arch_merge_skipped / test_matrix_skipped 同型：跳过必须附理由留痕）
   arch_design_light_skipped: null,
   arch_design_light_skip_reason: null,
+  // Security baseline gate (security-baseline-integration-design v1.3 §L2)
+  // 三键全量三环（BUILTIN_DEFAULTS + writeState 序列化 + cmd-state SETTABLE_FIELDS），
+  // 缺任一环即「回显成功却零写入」（v0.59.0 同型教训）。security_scope_hash 绑定
+  // 最近一次推导的 scope_hash——范围变化（hash 不匹配）时 skip 自动失效（防跨轮固化）。
+  security_baseline_skipped: null,
+  security_baseline_skip_reason: null,
+  security_scope_hash: null,
   // 注意：schema_version 故意不在 BUILTIN_DEFAULTS 中（v0.13 §48.1）——
   // 它只由 `tf state init` 在 change 创建时打戳，字段缺失本身就是"存量 change"信号。
 };
@@ -184,6 +196,14 @@ export function writeState(changeDir, state) {
   lines.push('# === Hashes (fast staleness detection) ===');
   lines.push(`artifacts_hash: ${state.artifacts_hash ?? 'null'}`);
   lines.push(`contract_hash: ${state.contract_hash ?? 'null'}`);
+  // P1-1 clarity 管道：条件序列化（同 schema_version 模式）——存量 change 无记录不追加，
+  // readState 缺失回退 BUILTIN_DEFAULTS 的 null（= 变更级维度中性）。
+  if (state.prd_clarity_result != null) {
+    lines.push(`prd_clarity_result: ${state.prd_clarity_result}`);
+  }
+  if (state.prd_clarity_hash != null) {
+    lines.push(`prd_clarity_hash: ${state.prd_clarity_hash}`);
+  }
   lines.push('');
   lines.push('# === Execution progress ===');
   lines.push(`execution_mode: ${state.execution_mode ?? 'null'}`);
@@ -268,6 +288,11 @@ export function writeState(changeDir, state) {
   lines.push('# === Light architecture design gate (v0.64.0) ===');
   lines.push(`arch_design_light_skipped: ${state.arch_design_light_skipped ?? 'null'}`);
   lines.push(`arch_design_light_skip_reason: ${state.arch_design_light_skip_reason ?? 'null'}`);
+  lines.push('');
+  lines.push('# === Security baseline gate (security-baseline-integration-design v1.3) ===');
+  lines.push(`security_baseline_skipped: ${state.security_baseline_skipped ?? 'null'}`);
+  lines.push(`security_baseline_skip_reason: ${state.security_baseline_skip_reason ?? 'null'}`);
+  lines.push(`security_scope_hash: ${state.security_scope_hash ?? 'null'}`);
 
   fs.writeFileSync(filePath, lines.join('\n') + '\n', 'utf-8');
 }

package/scripts/team-flow.mjs

@@ -44,6 +44,8 @@ const COMMANDS = {
   'glaf4-evidence-export': () => import('./lib/glaf4-evidence-export.mjs'),
   'glaf4-delegation': () => import('./lib/glaf4-delegation.mjs'),
   'repo-layout': () => import('./lib/cmd-repo-layout.mjs'),
+  // security-baseline-integration-design v1.3：安全基线范围推导（Scope Deriver CLI 入口）
+  security:            () => import('./lib/cmd-security.mjs'),
   test:                () => import('./lib/test-record.mjs'),
 };
 
@@ -94,6 +96,11 @@ Commands:
   config [options]      Display or modify configuration
   config --resolve-model <profile>  Resolve a configured model profile without switching models
   state <sub> <dir>     Manage .team-flow.yaml state (init|check|transition|get|rebuild|set|upgrade)
+  security scope <change-dir> [--json]
+                        Derive security-baseline applicability (trigger categories + items),
+                        write .security-scope.json, print scope_hash (v1.3 Scope Deriver CLI)
+  security baseline [--json]
+                        Show 44-item enterprise security baseline version anchor (md+json 双载体)
   inject <dir>          Generate phase-guard artifacts; use --platforms <name|all> when platform is ambiguous
   audit <dir>           Generate decision-point-audit.md from .team-flow.yaml
   checkpoint save <change-dir> --task <id> --next <text>

package/skills/ce-brainstorm/SKILL.md

@@ -195,13 +195,13 @@ For detailed routing logic, read `references/phase0-routing.md`. Summary:
 - **0.1b Classify**: software → continue; non-software → `references/universal-brainstorming.md`; neither → respond directly
 - **0.1c Verdict**: verdict-shaped requests → offer `/ce-pov` handoff via `references/verdict-routing.md`
 - **0.2 Assess**: clear requirements → skip to Phase 2.5; ambiguous → full brainstorm
-- **0.3 Scope**: Lightweight / Standard / Deep (+ feature vs product); arm visual-probe and blindspot tripwires
+- **0.3 Scope**: Lightweight / Standard / Deep (+ feature vs product); arm visual-probe and blindspot tripwires. **Scope 推荐降阈值（agent-governance P1-2 · A 档）**：需求一句话可述、无跨模块疑点、`arch_baseline` 已建档时，**默认推荐 Lightweight**（跳 BP-1~3 + Path A 轻确认），用户确认即走；含糊/多义/涉新模块 → 推荐 Standard（含糊才升 Deep）。推荐是建议非决定，用户可任选档位；**判定不清时按 Standard 起步**（宁多问不漏问）。
 - **0.4 Spine**: create 5-task tracking spine for Standard/Deep
 - **0.5 Iteration**: resolve `ITERATION_VERSION` from `requirement/` directory (legacy: fallback `prd/`)
 
 ### Phase 1: Understand the Idea
 
-**1.1 Context Scan** — For Standard/Deep, dispatch grounding scout sub-agent (extraction-tier) to produce a grounding dossier. For the scout prompt, scratch directory setup, and Slack routing, read `references/grounding.md`. Two rules: **verify before claiming** (check infrastructure exists) and **defer design to planning**.
+**1.1 Context Scan** — For Standard/Deep, dispatch grounding scout sub-agent (extraction-tier) to produce a grounding dossier. For the scout prompt, scratch directory setup, and Slack routing, read `references/grounding.md`. Two rules: **verify before claiming** (check infrastructure exists) and **defer design to planning**. **复利注入（P2-3 顶层调用，不限 scope）**：Phase 1 开始前跑 `tf solutions inject --phase prd --limit 5`（CLI 内含见习/红区门控；**Lightweight 同样注入**——它是轻命令，不随 scout 一起被 scope 门掉，防 A 档默认轻档路径零注入）；空结果静默跳过——冷启动不计收益 0。
 
 **1.2 Pressure Test** — Scan opening for rigor gaps (evidence, specificity, counterfactual, attachment). Read `references/product-pressure-test.md` for per-tier lens catalog. Session-settled decisions count as already-probed.
 
@@ -273,7 +273,7 @@ Read `references/brainstorm-sections.md` for doc-warranted criteria. If warrante
 
 ### QA-4: PRD Quality Check
 
-Fires after Phase 3 (or Phase 3.5 if prototype loop ran). Read `references/evidence-chain-validation.md` for QA-4 criteria. Evaluates PRD completeness and traceability against business analysis artifacts. **冻结前完整性评审（6 维，含 §8.4 信息齐备性与业务可读形态 D6）的派发点已归并**：standalone 路径由 Phase 3.5（`references/prototype-loop.md` §3.5.5）派发 prd-completeness-reviewer；orchestrated 路径由 orchestrator S2 派发（见 `workflow-orchestrator/references/s2-prd-prototype-loop.md`）；**QA-4 自身不重复派发**，仅按评审结果判定是否回 Phase 1.3/Phase 3 修订。
+Fires after Phase 3 (or Phase 3.5 if prototype loop ran). Read `references/evidence-chain-validation.md` for QA-4 criteria. Evaluates PRD completeness and traceability against business analysis artifacts. **冻结前完整性评审（6 维，含 §8.4 信息齐备性与业务可读形态 D6）的派发点已归并**：standalone 路径由 Phase 3.5（`references/prototype-loop.md` §3.5.5）派发 prd-completeness-reviewer；orchestrated 路径由 orchestrator S2 派发（见 `workflow-orchestrator/references/s2-prd-prototype-loop.md`）；**QA-4 自身不重复派发**，仅按评审结果判定是否回 Phase 1.3/Phase 3 修订。**冻结前先过清晰度机械门 `tf prd check-clarity`（P0-1，checker 先于 reviewer，FAIL 则回改不派发）**——调用细则见 `references/prototype-loop.md` §3.5.5 前置段（standalone）/ `s2-prd-prototype-loop.md` step 3.4（orchestrated）。
 
 ### Phase 3.6: PRD ↔ Scenario/Process Bidirectional Validation
 

package/skills/ce-brainstorm/references/grounding.md

@@ -9,7 +9,7 @@ Detailed context scanning logic for Phase 1.1. The main SKILL.md describes the h
 **Standard and Deep** — Two passes:
 
 *Constraint Check (inline)* — Use the project's active instructions and conventions already in your context. Read `STRATEGY.md` if it exists for product direction and `CONCEPTS.md` if it exists for canonical vocabulary — it lives at **`docs/architecture/CONCEPTS.md`** (the repo-root location was retired in v0.23.0, so a root-only probe misses bootstrapped projects). Use canonical names in dialogue, approaches, and the Product Contract.
-- **Solutions index (v0.5)**: Read `docs/solutions/INDEX.md` if it exists. Filter entries where `phase = prd OR phase = cross-phase` and `domain` matches the current topic. Inject the **top 5** summaries as context constraints, ordered **severity → phase-match → date** (the CLI's ordering). Widen the window with `tf solutions inject --phase prd --limit <n>` when cross-phase entries saturate it — otherwise this stage's own entries are unreachable. If INDEX.md does not exist or is empty, skip silently — a missing index makes the CLI print one WARN, which is not an error.
+- **Solutions index (v0.5)**: Run `tf solutions inject --phase prd --limit 5` first（CLI 内含 P2-2 见习/红区门控）; only if the CLI is unavailable, fall back to reading `docs/solutions/INDEX.md` manually — filter `phase = prd OR cross-phase` + domain match, top 5, ordered **severity → phase-match → date**. **手动降级不降门（P2-2）**：跳过 `flags=probation`（见习）行与红区关键词行（`DP-A`/`Code Landing`/`publish`/`发布闸`/`代码落地`）。If INDEX.md does not exist or is empty, skip silently — a missing index makes the CLI print one WARN, which is not an error（冷启动不计收益 0）。
 
 ## Topic Scan (Grounding Scout)