@xulthekl/team-flow 0.67.0 → 0.68.0

package/scripts/lib/security-scope.mjs

@@ -0,0 +1,188 @@
+// scripts/lib/security-scope.mjs — Scope Deriver（安全基线范围推导，唯一实现）
+// 设计：docs/plan/security-baseline-integration-design.md v1.3 §三
+// 单一真相源 = skills/ce-brainstorm/references/security-baseline.json（与 .md 双载体，
+// 一致性由测试断言锁）。本模块是推导的唯一实现——CLI `tf security scope` 与 guard
+// 检查器都只经此调用，杜绝多处各自实现漂移（§二.6）。
+//
+// 输出（写盘 <change-dir>/.security-scope.json）：
+//   { base_sha, triggered_categories[], applicable_items[], code_item_ids[],
+//     infra_item_ids[], scope_hash, derived_at, derived_by, files_scanned, error }
+// scope_hash 预像 = 规范化（排序）后的 triggered_categories + applicable_items id
+// （排除 derived_at 等易变字段）——见设计 §三 Scope Deriver 段。
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync, realpathSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join, resolve, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { gitChangedFiles } from './surface-scan.mjs';
+import { readState } from './state-loader.mjs';
+
+export const SCOPE_FILE = '.security-scope.json';
+
+const BASELINE_JSON_URL = new URL(
+  '../../skills/ce-brainstorm/references/security-baseline.json', import.meta.url,
+);
+
+export function loadSecurityBaseline() {
+  const raw = readFileSync(fileURLToPath(BASELINE_JSON_URL), 'utf-8');
+  const data = JSON.parse(raw);
+  if (!Array.isArray(data.items) || data.items.length !== 44) {
+    throw new Error(`security-baseline.json malformed: expected 44 items, got ${data.items?.length}`);
+  }
+  return data;
+}
+
+// --- 触发推导规则（路径启发式 + 文档关键词；规则改动须同步设计文档 §三） ---
+
+// 不构成暴露面的文件（文档 / 测试 / 元数据）——纯此类变更 → 无触发类别 → 静默 PASS
+const NON_SURFACE = /\.(md|txt|png|jpe?g|gif|svg|pdf|lock|sum|ipynb|css|scss|html?)$/i;
+const TEST_PATH = /(^|\/)(test|tests|__tests__|spec|e2e)(\/|$)|\.(test|spec)\.[jt]sx?$/i;
+
+// 源码扩展名 → 基础触发类别（改代码即查基础安全判据）
+const SOURCE_EXT = /\.(java|kt|kts|ts|tsx|js|jsx|mjs|cjs|vue|py|go|rs|cs|php|rb|scala|swift|sql|sh|groovy|xml|yaml|yml|json|toml|properties|conf|ini|dockerfile)$/i;
+const SOURCE_BASE_TRIGGERS = ['code-quality', 'input', 'output'];
+
+// 路径启发式 → 追加触发类别（对路径与文件名匹配，大小写不敏感）
+const PATH_RULES = [
+  { re: /upload|attachment|multipart|file[_-]?(io|controller|service|handler)/i, cat: 'file-io' },
+  { re: /auth|login|session|token|jwt|oauth|permission|rbac|role|sso|passwd|password/i, cat: 'authn-authz' },
+  { re: /redirect|forward|callback|goto|跳转|重定向/i, cat: 'redirect' },
+  { re: /audit|operat(ion|ing)_?log|审计/i, cat: 'audit' },
+  { re: /ingress|gateway|nginx|tls|ssl|cert|https|deploy|k8s|kubernetes/i, cat: 'transport' },
+  { re: /xml|soap|xxe|jaxb/i, cat: 'processing' },
+  { re: /pom\.xml$|package\.json$|requirements.*\.txt$|go\.mod$|build\.gradle$|gemfile$|composer\.json$/i, cat: 'deps' },
+];
+
+// 部署/依赖清单路径 → deps（与 SOURCE_EXT 重叠时两者都算）
+const DEPLOY_PATH = /(^|\/)(\.github|\.gitlab-ci|deploy|helm|charts|docker|k8s|infrastructure)(\/|$)|Dockerfile|docker-compose/i;
+
+// spec/arch 文档关键词 → 追加触发类别（文本扫描，中文+英文）
+const TEXT_RULES = [
+  { re: /文件上传|上传附件|multipart|file\s*upload/i, cat: 'file-io' },
+  { re: /登录|认证|鉴权|权限|会话|token|jwt|oauth/i, cat: 'authn-authz' },
+  { re: /跳转|重定向|redirect/i, cat: 'redirect' },
+  { re: /审计日志|操作日志|审计/i, cat: 'audit' },
+  { re: /https|tls|hsts|ssl|传输加密/i, cat: 'transport' },
+  { re: /xxe|xml\s*实体|soap/i, cat: 'processing' },
+  { re: /依赖升级|组件版本|中间件版本|cve/i, cat: 'deps' },
+  { re: /响应头|content-security-policy|x-frame|nosniff/i, cat: 'output' },
+  { re: /sql\s*注入|参数化|查询注入/i, cat: 'code-quality' },
+];
+
+const DOC_TARGETS = ['proposal.md', 'design.md', 'specs', 'architecture'];
+
+function scanDocText(changeDir) {
+  const texts = [];
+  for (const t of DOC_TARGETS) {
+    const p = join(changeDir, t);
+    if (!existsSync(p)) continue;
+    try {
+      const st = readFileSync(p, 'utf-8');
+      texts.push(st);
+    } catch { /* skip */ }
+  }
+  return texts.join('\n');
+}
+
+/**
+ * 推导安全基线适用范围。
+ * @param {string} changeDir
+ * @param {object} [opts]
+ * @param {'cli'|'guard'} [opts.source]  落盘 provenance 标记
+ * @param {boolean} [opts.write=true]    是否写盘 .security-scope.json
+ * @returns 推导结果对象（含 error 字段：'no-baseline'|'diff-failed'|null）
+ */
+export function deriveSecurityScope(changeDir, opts = {}) {
+  const { source = 'cli', write = true } = opts;
+  const state = readState(changeDir);
+  const baseline = loadSecurityBaseline();
+
+  const changed = gitChangedFiles(changeDir, state);
+  const error = changed.error; // no-baseline / diff-failed / null
+  // 排除 change 目录自身（.team-flow.yaml / .security-*.json / .superpowers/ 等
+  // 流程产物会被 git status 三源扫到——它们不是变更代码的暴露面）。
+  const changeRoot = relativeRepoPrefix(changeDir);
+  const files = (changed.files || []).filter(f =>
+    !(changeRoot && f.startsWith(changeRoot)) && !f.startsWith('.superpowers/'));
+
+  const triggered = new Set();
+  let filesScanned = 0;
+
+  for (const f of files) {
+    if (TEST_PATH.test(f)) continue;
+    if (NON_SURFACE.test(f) && !DEPLOY_PATH.test(f)) continue;
+    filesScanned++;
+    if (SOURCE_EXT.test(f) || DEPLOY_PATH.test(f)) {
+      for (const c of SOURCE_BASE_TRIGGERS) triggered.add(c);
+    }
+    for (const rule of PATH_RULES) {
+      if (rule.re.test(f)) triggered.add(rule.cat);
+    }
+    if (DEPLOY_PATH.test(f)) triggered.add('deps');
+  }
+
+  const docText = scanDocText(changeDir);
+  if (docText) {
+    for (const rule of TEXT_RULES) {
+      if (rule.re.test(docText)) triggered.add(rule.cat);
+    }
+  }
+
+  const triggeredList = [...triggered].sort();
+  const applicable = baseline.items
+    .filter(i => triggeredList.includes(i.trigger))
+    .sort((a, b) => a.id - b.id);
+
+  const hashPreimage = JSON.stringify({
+    triggered: triggeredList,
+    items: applicable.map(i => i.id),
+  });
+  const scopeHash = createHash('sha256').update(hashPreimage).digest('hex').slice(0, 16);
+
+  const result = {
+    base_sha: changed.base ?? state.base_sha ?? null,
+    triggered_categories: triggeredList,
+    applicable_items: applicable.map(i => i.id),
+    code_item_ids: applicable.filter(i => i.locus.includes('code')).map(i => i.id),
+    infra_item_ids: applicable.filter(i => !i.locus.includes('code')).map(i => i.id),
+    scope_hash: scopeHash,
+    derived_at: new Date().toISOString(),
+    derived_by: source,
+    files_scanned: filesScanned,
+    error,
+  };
+
+  if (write) {
+    writeFileSync(join(changeDir, SCOPE_FILE), JSON.stringify(result, null, 2) + '\n', 'utf-8');
+  }
+  return result;
+}
+
+/** changeDir 在其 git 仓库内的相对前缀（带尾 /），用于过滤流程产物自身。
+ *  双侧 realpath 归一——macOS /var → /private/var 符号链接会让字符串前缀比较失效。 */
+function relativeRepoPrefix(changeDir) {
+  try {
+    // stdio 收窄：非 git 目录时 git 会往 stderr 打 fatal 原文（报错不指向真因），
+    // 由调用侧按 error=no-baseline 给结构化提示
+    const root = realpathSync(execFileSync('git', ['rev-parse', '--show-toplevel'], {
+      cwd: changeDir, encoding: 'utf-8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim());
+    if (!root) return null;
+    const abs = realpathSync(resolve(changeDir));
+    if (!abs.startsWith(root)) return null;
+    const rel = relative(root, abs);
+    return rel && !rel.startsWith('..') ? rel.replace(/\\/g, '/') + '/' : '';
+  } catch {
+    return null;
+  }
+}
+
+export function readScopeFile(changeDir) {
+  const p = join(changeDir, SCOPE_FILE);
+  if (!existsSync(p)) return null;
+  try {
+    return JSON.parse(readFileSync(p, 'utf-8'));
+  } catch {
+    return null;
+  }
+}

package/scripts/lib/state-loader.mjs

@@ -114,6 +114,13 @@ const BUILTIN_DEFAULTS = {
   // 与 arch_merge_skipped / test_matrix_skipped 同型：跳过必须附理由留痕）
   arch_design_light_skipped: null,
   arch_design_light_skip_reason: null,
+  // Security baseline gate (security-baseline-integration-design v1.3 §L2)
+  // 三键全量三环（BUILTIN_DEFAULTS + writeState 序列化 + cmd-state SETTABLE_FIELDS），
+  // 缺任一环即「回显成功却零写入」（v0.59.0 同型教训）。security_scope_hash 绑定
+  // 最近一次推导的 scope_hash——范围变化（hash 不匹配）时 skip 自动失效（防跨轮固化）。
+  security_baseline_skipped: null,
+  security_baseline_skip_reason: null,
+  security_scope_hash: null,
   // 注意：schema_version 故意不在 BUILTIN_DEFAULTS 中（v0.13 §48.1）——
   // 它只由 `tf state init` 在 change 创建时打戳，字段缺失本身就是"存量 change"信号。
 };
@@ -281,6 +288,11 @@ export function writeState(changeDir, state) {
   lines.push('# === Light architecture design gate (v0.64.0) ===');
   lines.push(`arch_design_light_skipped: ${state.arch_design_light_skipped ?? 'null'}`);
   lines.push(`arch_design_light_skip_reason: ${state.arch_design_light_skip_reason ?? 'null'}`);
+  lines.push('');
+  lines.push('# === Security baseline gate (security-baseline-integration-design v1.3) ===');
+  lines.push(`security_baseline_skipped: ${state.security_baseline_skipped ?? 'null'}`);
+  lines.push(`security_baseline_skip_reason: ${state.security_baseline_skip_reason ?? 'null'}`);
+  lines.push(`security_scope_hash: ${state.security_scope_hash ?? 'null'}`);
 
   fs.writeFileSync(filePath, lines.join('\n') + '\n', 'utf-8');
 }

package/scripts/team-flow.mjs

@@ -44,6 +44,8 @@ const COMMANDS = {
   'glaf4-evidence-export': () => import('./lib/glaf4-evidence-export.mjs'),
   'glaf4-delegation': () => import('./lib/glaf4-delegation.mjs'),
   'repo-layout': () => import('./lib/cmd-repo-layout.mjs'),
+  // security-baseline-integration-design v1.3：安全基线范围推导（Scope Deriver CLI 入口）
+  security:            () => import('./lib/cmd-security.mjs'),
   test:                () => import('./lib/test-record.mjs'),
 };
 
@@ -94,6 +96,11 @@ Commands:
   config [options]      Display or modify configuration
   config --resolve-model <profile>  Resolve a configured model profile without switching models
   state <sub> <dir>     Manage .team-flow.yaml state (init|check|transition|get|rebuild|set|upgrade)
+  security scope <change-dir> [--json]
+                        Derive security-baseline applicability (trigger categories + items),
+                        write .security-scope.json, print scope_hash (v1.3 Scope Deriver CLI)
+  security baseline [--json]
+                        Show 44-item enterprise security baseline version anchor (md+json 双载体)
   inject <dir>          Generate phase-guard artifacts; use --platforms <name|all> when platform is ambiguous
   audit <dir>           Generate decision-point-audit.md from .team-flow.yaml
   checkpoint save <change-dir> --task <id> --next <text>

package/skills/ce-brainstorm/references/security-baseline.json

@@ -0,0 +1,50 @@
+{
+  "baseline_version": "2026-11-enterprise-1",
+  "source": "企业安全设计自检表（2026-11 版，44 项控制点；来源 xlsx 见 workspace 设计文档）",
+  "items": [
+    { "id": 1,  "title": "无硬编码密码 / 空密码",                      "domain": "代码质量",     "trigger": "code-quality", "severity": "must",   "locus": "code" },
+    { "id": 2,  "title": "无路径遍历（相对/绝对）",                     "domain": "代码质量",     "trigger": "code-quality", "severity": "must",   "locus": "code" },
+    { "id": 3,  "title": "无硬编码加密密钥",                            "domain": "代码质量",     "trigger": "code-quality", "severity": "must",   "locus": "code" },
+    { "id": 4,  "title": "SQL 参数化查询",                              "domain": "代码质量",     "trigger": "code-quality", "severity": "must",   "locus": "code" },
+    { "id": 5,  "title": "不执行不可信赖命令",                          "domain": "代码质量",     "trigger": "code-quality", "severity": "must",   "locus": "code" },
+    { "id": 6,  "title": "不用未加盐/可预测盐哈希",                     "domain": "代码质量",     "trigger": "code-quality", "severity": "must",   "locus": "code" },
+    { "id": 7,  "title": "HttpOnly=true",                               "domain": "代码质量",     "trigger": "code-quality", "severity": "must",   "locus": "code" },
+    { "id": 8,  "title": "服务端权限鉴别（非公开内容）",                "domain": "身份认证",     "trigger": "authn-authz",  "severity": "must",   "locus": "code" },
+    { "id": 9,  "title": "标准认证协议（JWT/OAuth，禁 Basic）",         "domain": "身份认证",     "trigger": "authn-authz",  "severity": "must",   "locus": "code" },
+    { "id": 10, "title": "登录失败处理（防暴破）",                      "domain": "身份认证",     "trigger": "authn-authz",  "severity": "must",   "locus": "code" },
+    { "id": 11, "title": "超时未活动自动结束会话",                      "domain": "身份认证",     "trigger": "authn-authz",  "severity": "must",   "locus": "code" },
+    { "id": 12, "title": "会话过期设置（退登失效）",                    "domain": "身份认证",     "trigger": "authn-authz",  "severity": "must",   "locus": "code" },
+    { "id": 13, "title": "个人信息/车辆信息接口用 POST",               "domain": "身份认证",     "trigger": "authn-authz",  "severity": "must",   "locus": "code" },
+    { "id": 14, "title": "系统间调用仅接受 POST",                       "domain": "身份认证",     "trigger": "authn-authz",  "severity": "should", "locus": "code" },
+    { "id": 15, "title": "JWT 不存放敏感数据",                          "domain": "身份认证",     "trigger": "authn-authz",  "severity": "must",   "locus": "code" },
+    { "id": 16, "title": "重定向 URL 白名单校验",                       "domain": "身份认证",     "trigger": "redirect",     "severity": "must",   "locus": "code" },
+    { "id": 17, "title": "重命名/删除默认账户、改默认口令",             "domain": "访问控制",     "trigger": "authn-authz",  "severity": "must",   "locus": "config" },
+    { "id": 18, "title": "分配账户和权限（三权分立）",                  "domain": "访问控制",     "trigger": "authn-authz",  "severity": "must",   "locus": "config" },
+    { "id": 19, "title": "启用安全审计，覆盖每用户",                    "domain": "安全审计",     "trigger": "audit",        "severity": "must",   "locus": "code+process" },
+    { "id": 20, "title": "审计日志含日期/用户/事件等",                  "domain": "安全审计",     "trigger": "audit",        "severity": "must",   "locus": "code+process" },
+    { "id": 21, "title": "远程管理防窃听（HTTPS）",                     "domain": "通信传输",     "trigger": "transport",    "severity": "must",   "locus": "infra" },
+    { "id": 22, "title": "TLS ≥ 1.2",                                   "domain": "通信传输",     "trigger": "transport",    "severity": "must",   "locus": "infra" },
+    { "id": 23, "title": "HSTS 防 SSL Strip",                           "domain": "通信传输",     "trigger": "transport",    "severity": "should", "locus": "infra" },
+    { "id": 24, "title": "传输完整性（签名校验）",                      "domain": "通信传输",     "trigger": "transport",    "severity": "should", "locus": "code+infra" },
+    { "id": 25, "title": "所有外部/用户输入验证过滤",                   "domain": "输入",         "trigger": "input",        "severity": "must",   "locus": "code" },
+    { "id": 26, "title": "输出字符实体编码",                            "domain": "输入",         "trigger": "input",        "severity": "must",   "locus": "code" },
+    { "id": 27, "title": "URL 不含敏感数据",                            "domain": "输入",         "trigger": "input",        "severity": "must",   "locus": "code" },
+    { "id": 28, "title": "content-type 验证，否则 415",                 "domain": "处理",         "trigger": "processing",   "severity": "should", "locus": "code" },
+    { "id": 29, "title": "Accept 协商，禁校验正文",                     "domain": "处理",         "trigger": "processing",   "severity": "must",   "locus": "code" },
+    { "id": 30, "title": "XML 实体解析关闭（XXE）",                     "domain": "处理",         "trigger": "processing",   "severity": "must",   "locus": "code" },
+    { "id": 31, "title": "XML 实体扩展关闭（bomb）",                    "domain": "处理",         "trigger": "processing",   "severity": "must",   "locus": "code" },
+    { "id": 32, "title": "不返回敏感数据",                              "domain": "输出",         "trigger": "output",       "severity": "must",   "locus": "code" },
+    { "id": 33, "title": "X-Content-Type-Options: nosniff",             "domain": "输出",         "trigger": "output",       "severity": "should", "locus": "code+infra" },
+    { "id": 34, "title": "X-Frame-Options: deny",                       "domain": "输出",         "trigger": "output",       "severity": "should", "locus": "code+infra" },
+    { "id": 35, "title": "CSP: default-src 'none'",                     "domain": "输出",         "trigger": "output",       "severity": "should", "locus": "infra+code" },
+    { "id": 36, "title": "错误信息不含系统敏感",                        "domain": "输出",         "trigger": "output",       "severity": "must",   "locus": "code" },
+    { "id": 37, "title": "中间件最新无安全漏洞",                        "domain": "中间件",       "trigger": "deps",         "severity": "must",   "locus": "config" },
+    { "id": 38, "title": "信息查询字段过滤（特殊字符）",                "domain": "功能-信息查询", "trigger": "input",        "severity": "must",   "locus": "code" },
+    { "id": 39, "title": "文件上传前端限大小",                          "domain": "功能-文件上传", "trigger": "file-io",      "severity": "must",   "locus": "code+infra" },
+    { "id": 40, "title": "文件名随机无规律",                            "domain": "功能-文件上传", "trigger": "file-io",      "severity": "must",   "locus": "code" },
+    { "id": 41, "title": "上传文件内容验证（文件头）",                  "domain": "功能-文件上传", "trigger": "file-io",      "severity": "must",   "locus": "code" },
+    { "id": 42, "title": "后台内容管理请求鉴权",                        "domain": "功能-后台管理", "trigger": "authn-authz",  "severity": "must",   "locus": "code" },
+    { "id": 43, "title": "后台字段格式限制/过滤",                       "domain": "功能-后台管理", "trigger": "input",        "severity": "must",   "locus": "code" },
+    { "id": 44, "title": "跳转链接白名单过滤",                          "domain": "功能-链接跳转", "trigger": "redirect",     "severity": "should", "locus": "code" }
+  ]
+}

package/skills/ce-brainstorm/references/security-baseline.md

@@ -0,0 +1,80 @@
+# 安全基线参考（企业 44 项安全设计控制点）
+
+> **角色**：安全基线的**人类可读权威**（L1）。同目录 `security-baseline.json` 是机器可读载体（推导模块 `scripts/lib/security-scope.mjs` 与 guard 的消费面），两者由测试断言 `baseline_version` + 条目数锁一致。
+> **来源**：企业安全设计自检表（2026-11 版，44 项控制点）。原始 xlsx 与企业上下文见 workspace 设计文档，**本仓库不落企业信息**。
+> **设计出处**：workspace `docs/plan/security-baseline-integration-design.md`（v1.3）。
+> **同步协议**：企业 xlsx 改版 → 更新设计文档附录 A → 同步本文件与 `.json` → 一致性断言过。禁止只改一侧。
+
+## 裁剪双维度
+
+- **触发类别（trigger）**：决定本次变更要不要触发安全复核。由 `tf security scope` 从 git diff + spec/arch 关键词推导；无适用类别 = 静默 PASS（零开销，推导结果仍落盘留痕）。
+- **locus**：决定该项归谁核验——`code`（仓库内核验）/ `config`（IAM·部署）/ `infra`（ingress·网关）/ `process`（平台留存）及组合（`code+process` 等，双侧并行）。纯 infra/config/process 项不进代码门禁，路由至 closing `security/handoff.md` 交接。
+
+10 个触发类别：`code-quality` `authn-authz` `redirect` `audit` `transport` `input` `processing` `output` `deps` `file-io`。
+
+## verdict → 门禁映射（L3 产出、L2 消费）
+
+| verdict | 必须项（must） | 建议项（should） |
+|---|---|---|
+| satisfied | PASS | PASS |
+| not-applicable | 须过 reason 判据（≥10 字符或含控制点序号），否则视同 uncovered | 同左 |
+| uncovered / 在核验集缺席 | **FAIL** | 不阻断，记 WARN |
+
+## 44 项清单
+
+| # | 控制点 | 域 | trigger | 性质 | locus |
+|---|---|---|---|---|---|
+| 1 | 无硬编码密码 / 空密码 | 代码质量 | code-quality | 必须 | code |
+| 2 | 无路径遍历（相对/绝对） | 代码质量 | code-quality | 必须 | code |
+| 3 | 无硬编码加密密钥 | 代码质量 | code-quality | 必须 | code |
+| 4 | SQL 参数化查询 | 代码质量 | code-quality | 必须 | code |
+| 5 | 不执行不可信赖命令 | 代码质量 | code-quality | 必须 | code |
+| 6 | 不用未加盐 / 可预测盐哈希 | 代码质量 | code-quality | 必须 | code |
+| 7 | HttpOnly=true | 代码质量 | code-quality | 必须 | code |
+| 8 | 服务端权限鉴别（非公开内容） | 身份认证 | authn-authz | 必须 | code |
+| 9 | 标准认证协议（JWT/OAuth，禁 Basic） | 身份认证 | authn-authz | 必须 | code |
+| 10 | 登录失败处理（防暴破） | 身份认证 | authn-authz | 必须 | code |
+| 11 | 超时未活动自动结束会话 | 身份认证 | authn-authz | 必须 | code |
+| 12 | 会话过期设置（退登失效） | 身份认证 | authn-authz | 必须 | code |
+| 13 | 个人信息/车辆信息接口用 POST | 身份认证 | authn-authz | 必须 | code |
+| 14 | 系统间调用仅接受 POST | 身份认证 | authn-authz | 建议 | code |
+| 15 | JWT 不存放敏感数据 | 身份认证 | authn-authz | 必须 | code |
+| 16 | 重定向 URL 白名单校验 | 身份认证 | redirect | 必须 | code |
+| 17 | 重命名/删除默认账户、改默认口令 | 访问控制 | authn-authz | 必须 | config |
+| 18 | 分配账户和权限（三权分立） | 访问控制 | authn-authz | 必须 | config |
+| 19 | 启用安全审计，覆盖每用户 | 安全审计 | audit | 必须 | code+process |
+| 20 | 审计日志含日期/用户/事件等 | 安全审计 | audit | 必须 | code+process |
+| 21 | 远程管理防窃听（HTTPS） | 通信传输 | transport | 必须 | infra |
+| 22 | TLS ≥ 1.2 | 通信传输 | transport | 必须 | infra |
+| 23 | HSTS 防 SSL Strip | 通信传输 | transport | 建议 | infra |
+| 24 | 传输完整性（签名校验） | 通信传输 | transport | 建议 | code+infra |
+| 25 | 所有外部/用户输入验证过滤 | 输入 | input | 必须 | code |
+| 26 | 输出字符实体编码 | 输入 | input | 必须 | code |
+| 27 | URL 不含敏感数据 | 输入 | input | 必须 | code |
+| 28 | content-type 验证，否则 415 | 处理 | processing | 建议 | code |
+| 29 | Accept 协商，禁校验正文 | 处理 | processing | 必须 | code |
+| 30 | XML 实体解析关闭（XXE） | 处理 | processing | 必须 | code |
+| 31 | XML 实体扩展关闭（bomb） | 处理 | processing | 必须 | code |
+| 32 | 不返回敏感数据 | 输出 | output | 必须 | code |
+| 33 | X-Content-Type-Options: nosniff | 输出 | output | 建议 | code+infra |
+| 34 | X-Frame-Options: deny | 输出 | output | 建议 | code+infra |
+| 35 | CSP: default-src 'none' | 输出 | output | 建议 | infra+code |
+| 36 | 错误信息不含系统敏感 | 输出 | output | 必须 | code |
+| 37 | 中间件最新无安全漏洞 | 中间件 | deps | 必须 | config |
+| 38 | 信息查询字段过滤（特殊字符） | 功能-信息查询 | input | 必须 | code |
+| 39 | 文件上传前端限大小 | 功能-文件上传 | file-io | 必须 | code+infra |
+| 40 | 文件名随机无规律 | 功能-文件上传 | file-io | 必须 | code |
+| 41 | 上传文件内容验证（文件头） | 功能-文件上传 | file-io | 必须 | code |
+| 42 | 后台内容管理请求鉴权 | 功能-后台管理 | authn-authz | 必须 | code |
+| 43 | 后台字段格式限制/过滤 | 功能-后台管理 | input | 必须 | code |
+| 44 | 跳转链接白名单过滤 | 功能-链接跳转 | redirect | 建议 | code |
+
+**locus 分布**：code（含 code+*）38 项；纯 infra/config/process（17/18/21/22/23/37）6 项；双 locus（19/20/24/33/34/35/39）7 项。
+
+## 各阶段消费方式
+
+- **设计期（L4）**：spec-writer（或 planned 主代理）读本文件，在 design.md 产「适用触发类别确认」小节 + 安全 NFR。
+- **实现期**：开发者按 code-locus 适用项实现（1–7 项安全判据**不归 clean-code 管**，安全判据归本基线、结构判据归 clean-code，互不代管）。
+- **评审期（L3）**：code-reviewer 逐条 verdict → `.security-verification.json`（末 wave / planned 最终审查报告归档核验小节）。
+- **产出期（L5）**：infra/config/process 项在 transition 前写 `<change-dir>/security/handoff.md` + `.team-flow/security-todos.md` 台账。
+- **门禁（L2）**：`security-baseline` / `security-baseline-light` 维度在 executing→closing 求值，只读结构化制品，不解析本文件。

package/skills/ce-compound/references/agents/security-sentinel.md

@@ -6,6 +6,11 @@ Your mission is to perform comprehensive security audits with laser focus on fin
 
 For durable-learning or solution-documentation invocations, convert security analysis into lesson validation: the vulnerability class, exploit path, why the fix reduces risk, residual caveats, and prevention guidance future readers can apply. Prioritize improving the documented learning over generating a full unrelated security audit.
 
+**Enterprise security baseline (security-baseline-integration-design v1.3)**: 规划期引用企业安全基线
+`skills/ce-brainstorm/references/security-baseline.md`（44 项，md+json 双载体）——推导适用触发类别
+（`tf security scope`），把适用 must 控制点作为 NFR/验收条件转写进规划产物。本 agent 是产品级规划期
+补充；change 级的 design.md「适用触发类别确认」由 spec-writer（或 planned 主代理）负责，两者不重叠。
+
 ## Core Security Scanning Protocol
 
 You will systematically execute these security scans:

package/skills/ce-plan/references/agents/security-sentinel.md

@@ -6,6 +6,11 @@ Your mission is to perform comprehensive security audits with laser focus on fin
 
 For planning invocations, convert security analysis into plan requirements: threat model, sensitive boundaries, required controls, authz/authn checks, privacy implications, test cases, and rollout safeguards. Prioritize risks that should change design, scope, sequencing, or acceptance criteria before implementation begins.
 
+**Enterprise security baseline (security-baseline-integration-design v1.3)**: 规划期引用企业安全基线
+`skills/ce-brainstorm/references/security-baseline.md`（44 项，md+json 双载体）——推导适用触发类别
+（`tf security scope`），把适用 must 控制点作为 NFR/验收条件转写进规划产物。本 agent 是产品级规划期
+补充；change 级的 design.md「适用触发类别确认」由 spec-writer（或 planned 主代理）负责，两者不重叠。
+
 ## Core Security Scanning Protocol
 
 You will systematically execute these security scans:

package/skills/code-reviewer/SKILL.md

@@ -91,7 +91,7 @@ Suggestion breaks existing functionality, reviewer lacks context, violates YAGNI
 
 ## Review Process (Agent Methodology)
 
-The code-reviewer agent follows this 6-step process:
+The code-reviewer agent follows this staged process:
 
 ### Step 0: Solutions Injection (v0.57.0 §4.1)
 
@@ -126,6 +126,10 @@ For each requirement in specs/:
 3. Note any deviations (with justification or flag as Critical)
 4. Build a compliance matrix: spec requirement → implementation status
 
+### Step 2.5: Security Baseline 核验（security-baseline-integration-design v1.3）
+
+适用子集 = dispatch prompt 传入的 `.security-scope.json`（缺传参先跑 `tf security scope <change-dir>`）。对每个 **code-locus** 控制点给 verdict `satisfied | not-applicable | uncovered`——not-applicable 须带 reason（≥10 字符或含序号，否则视同 uncovered；must uncovered=Critical，should uncovered 记 WARN 不阻断）。报告写「Security Baseline 核验」小节并**写盘 `<change-dir>/.security-verification.json`**（`{"items":[...], "report_path":"<receipt --report 路径>", "round":<n>}`）；**仅末 wave 产一份**——planned 档不派本 agent，其 JSON 由 release-archivist 最终审查产（其 SKILL ④）。判据真相源 `security-baseline.md`（映射见其表）；**guard 只读 JSON 不解析本报告**。
+
 ### Step 3: Code Quality Review
 
 Check for:

package/skills/code-reviewer/code-reviewer-prompt.md

@@ -173,6 +173,15 @@ Subagent (general-purpose):
     **存量待整改** (pre-existing hits downgraded to Minor — one per line, or "none"):
     - [e.g. `src/foo/Bar.java:120` — function length >20 lines, pre-existing]
 
+    ### Security Baseline 核验
+    [适用子集随本模板以 `[SECURITY_SCOPE_JSON]` 传入（`.security-scope.json` 内容；缺传参时先跑
+    `tf security scope <change-dir>`）。逐控制点一行：序号 | 控制点 | verdict
+    (satisfied/not-applicable/uncovered) | reason。not-applicable 的 reason 须 ≥10 字符或含序号，
+    否则按 uncovered；must 项 uncovered = Critical。核验完成后必须写盘
+    `<change-dir>/.security-verification.json`（items + report_path + round；report_path 等于
+    receipt --report 路径）。仅末 wave 产此 JSON（planned 档不派本模板——其 JSON 由 release-archivist 最终审查产）。判据真相源：
+    `skills/ce-brainstorm/references/security-baseline.md`。]
+
     ### Strengths
     [What's well done? Be specific.]
 
@@ -226,6 +235,7 @@ Subagent (general-purpose):
 - `[HEAD_SHA]` — ending commit
 - `[WAVE_ID]` — planned execution wave under review
 - `[REVIEW_REPORT_FILE]` — REQUIRED: distinct, persisted, non-empty review report path under `<change-dir>/.superpowers/sdd/reviews/` (the overlay); stored in the execution receipt
+- `[SECURITY_SCOPE_JSON]` — **仅末 wave 派发时 REQUIRED**（security-baseline v1.3；非末 wave 派发请删除本占位与 Security Baseline 小节；planned 不经本模板）: `.security-scope.json` 内容（适用触发类别 + code-locus 适用项），由派发方经 `tf security scope` 生成后随本模板传入
 
 **Reviewer returns:** Strengths, Issues (Critical / Important / Minor), Recommendations, Assessment
 

package/skills/release-archivist/SKILL.md

@@ -158,9 +158,15 @@ If implementation diverged from the contract, return to `bridging` before closur
 
 **先读 `workflow_variant` 再选序列**（读法见 workflow-start SKILL「Front Doors」）：
 
-**legacy / full（默认序列，v0.53.0 原序不动）：**
+**legacy / full（默认序列，v0.53.0 原序不动；v1.3 加 ①b 安全交接）。hotfix variant=null≡legacy → 走本块（hotfix 挂 security-baseline 重档，①b 必做）；tweak 豁免 L5——不产 handoff、跳过 ①b（设计 §L5/矩阵）：**
 ```
 ① tf arch-merge <change-dir>              ← 架构增量回写全局台账
+①b security/handoff.md 写入（security-baseline-integration-design v1.3 L5）
+   ← 读 .security-scope.json：含 infra/config/process-locus 项 → 写完整交接清单
+     （控制点/责任方/配置位置/验证方式/状态 五字段，见 security-baseline.md）
+   ← 无此类项 → 写一行「本次无 infra/config/process 适用项」
+   ← 同步登记跨 change 台账 .team-flow/security-todos.md（待办行，不进 guard）
+   ⚠ 必须在 transition 之前——它是 guard security-baseline 维度的校验对象（鸡生蛋教训同 B-13）
 ② tf state transition <change-dir> closing
 ③ tf prototype-sync <change-dir>
 ④ tf test-merge <change-dir>
@@ -175,13 +181,24 @@ If implementation diverged from the contract, return to `bridging` before closur
 ② tf test-merge <change-dir> --light      ← 有测试触碰才跑；changelog 首行写 change:<name> 归因锚
 ③ tf solutions capture <args> --source "change:<name>"   ← 必执行（归因 = --source；含「无新增决策」空捕获；禁 compound_skipped 自清）
 ④ final-review.md 复核（≥5 行；**回写之后**核验台账条目 vs diff 抽样，B-01/D5）
+   ⚠ v1.3 security-baseline：planned **不派 code-reviewer**（无 code-reviewer 生产者）——
+   最终审查执行者（本 agent 主代理）在 final-review 同步产核验 JSON：
+   ① `tf security scope <change-dir>` 取适用子集 → ② 按 code-locus 适用集逐条 verdict
+   （satisfied/not-applicable[带 ≥10 字 reason]/uncovered；must uncovered=阻断）→
+   写 `.security-verification.json`（report_path 指向 final-review.md，round=1）；**空集也须落盘**（items=[] + 全 N/A 说明——guard 提示的「无适用 code 项时亦须落盘」）。
+   guard `security-baseline` 重档只读该 JSON，planned 缺产即 closing FAIL。
+④b security/handoff.md 写入（v1.3 L5，同 legacy ①b；**transition 前置**——planned closing 挂重档 security-baseline）
 ⑤ tf state transition <change-dir> closing ← planned closing 维度表此刻全部满足
 ⑥ tf prototype-sync <change-dir>          ← 有原型才跑（closing 后）
 ⑦ 设计系统待办检查（只读）
 ```
 
-**direct（v0.64.0：验证记录即证据，回写全跳过——G4 前提 = 无架构 surface）：**
+**direct（v0.64.0：验证记录即证据，回写全跳过——G4 前提 = 无架构 surface；v1.3 加 ⓪ 安全交接插步）：**
 ```
+⓪ security/handoff.md 最小写入（v1.3 L5）：**先跑 `tf security scope <change-dir>`** 取适用集
+   （此刻 scope JSON 尚不存在，guard 现场推导在 transition 之后——不先推导会误写「无适用项」且
+   门禁只查存在性 → 语义静默丢失）→ 含 infra 项写登记模板，否则一行「无适用项」；
+   quick/lightweight 挂 security-baseline-light，仍查 handoff 存在性
 ① tf state transition <change-dir> closing ← direct 维度表：direct-short-path 扫描 + tf test record 证据 + test-matrix 轻判据
 ② tf prototype-sync / test-merge / solutions promote 全部跳过（若 direct 触及 design-system 共享层 → 提示补 prototype-sync 或升 planned，B-14）
 ③ G5 同步门禁点（阶段产物同步确认）、Workflow Feedback、Deisolation 等**通用收尾步骤照跑**（仅架构/测试/复利三类回写按 direct 跳过）
@@ -339,6 +356,8 @@ This check is advisory — skip if the user declines. If the user reports issues
 
 Verify files exist and are non-empty, run `node --check` on code files, skip 5-step verification. Still record DP-6 and DP-7.
 
+**security-baseline 归属（v1.3）**：hotfix 走重档——转 closing 前须完成 ①b 安全交接（本文件 legacy 序列块），并确保末 wave 已产 `.security-verification.json`；tweak 豁免 L5（不产 handoff）。
+
 **回写链前置判据（v0.22 §87）**：先按下表判断适用性，**不适用则不执行命令**（v0.22 实测：逐项跑完才知道不适用，占 release-archivist 80% 耗时）。本表 4 行判据**仅在 Lightweight Closure 适用**；其中 arch-merge 与 test-merge 两行的 "Skip silently" 见 `### ① Architecture Merge` 与 `### ④ Test Merge` 两节各自的正文句。
 
 > **v0.53.0 修正**：此处原用行号引用（`（:164 正文句）`/`（:196 正文句）`），本次改动插入段落使其失效。**行号引用在密集改动期必然漂移，已改为按标题引用**——同轮 `team-flow-workspace/docs/architecture-api-db-design-enhancement-v0.25.md` 亦把 45 处行号引用全量改为符号引用。

package/skills/spec-writer/SKILL.md

@@ -101,6 +101,11 @@ Optional test-dimension tags under a Scenario are supported for test-matrix extr
 ### design.md
 Must have: Context (current state, constraints, stakeholders), Goals, Decisions (Choice + Rationale + Alternatives considered), Risks And Trade-Offs.
 
+**Security baseline confirmation (security-baseline-integration-design v1.3)**: 读 `skills/ce-brainstorm/references/security-baseline.md`（44 项企业安全基线），先跑 `tf security scope <change-dir>` 取适用触发类别，然后：
+- 在 design.md 增 **「适用触发类别确认」小节**：逐类别列 适用/不适用 + 理由（不适用须写理由；此为 review 阶段人工回看锚，不参与机械对账——机械判据由 guard 期推导承担）；
+- 适用类别的 **must** 控制点以安全 NFR 写入 design.md（如"上传接口须做文件头校验（基线 #41）"），实现指引同步进 tasks.md 对应任务。
+- 快速通道（hotfix/tweak 无 spec-writer）不经本步骤——由 guard 期 `tf security scope` 推导硬兜底。
+
 **Prototype reference (v0.5)**: For UI-related changes, include a `## UI Contract` section in design.md that:
 - References the prototype entry point (`prototype/index.html`)
 - Lists affected prototype pages with their paths

package/skills/workflow-start/SKILL.md

@@ -41,18 +41,18 @@ tf state set <change-dir> planned_arch true         # 仅 planned 且用户选
 4. 转换 `exploring→approved-for-build→executing`（guard 走 direct 维度表）。**架构 surface（API/DB/聚合）扫描命中 → FAIL** → 走 Upgrade 升 planned，禁止硬闯
 5. 实施：**主代理当前会话直接写代码**（direct 前门无子代理——Artifact Ownership 的子代理委派要求不适用本分支）
 6. 验证：跑验证命令 → **`tf test record <dir> --from <输出文件>`（必须 record；guard 只读记录、不现场跑测试，A-19）**
-7. 转 `closing` → release-archivist **direct 分支**（仅 transition + 验证记录；回写全跳过）
+7. 转 `closing` → release-archivist **direct 分支**（**transition 前先写最小 `security/handoff.md`——v1.3 L5 插步，见 release-archivist SKILL；** 其余回写全跳过；验证记录照旧）
 
 ### Planned 路由（`workflow=full`+`variant=planned`·两份文档 + 一次最终审查）
 
-1. 产出 `proposal.md`（≥10 非空行）+ `tasks.md`（≥1 checkbox）——轻路径无 spec-writer 子代理，主代理可直接写。**DP-0 并入本步一次确认**（scope/约束/AC 一次问完，`dp_0_confirmed=true` 照写——与 Direct 快速 DP-0 同型）
+1. 产出 `proposal.md`（≥10 非空行）+ `tasks.md`（≥1 checkbox）——轻路径无 spec-writer 子代理，主代理可直接写。**DP-0 并入本步一次确认**（scope/约束/AC 一次问完，`dp_0_confirmed=true` 照写——与 Direct 快速 DP-0 同型）。**Security baseline L4（v1.3）**：主代理按 `skills/spec-writer/SKILL.md` 的「Security baseline confirmation」同款指引，读 `security-baseline.md` + `tf security scope`，在 design.md（或 proposal.md 若无 design.md）产「适用触发类别确认」小节 + must 控制点安全 NFR——planned 无 spec-writer，指引只能送到本分支（规则送到执行者）
 2. `tf state init`（若尚未建，先 init 后 set）→ `tf state set workflow full` + `workflow_variant planned`（+ `planned_arch true` 如选轻架构）
 3. **轻架构（`planned_arch=true` 时）**：写 `architecture/light-note.md`（简短说明）+ `architecture/snapshot-light.md`；declined 则显式跳过：`arch_design_light_skipped=true` + `arch_design_light_skip_reason`（两键缺一不可）
 4. **plan 派生**：`tf execution plan <dir> --derive --confirm --reason "<一句话>"`——tasks.md → 单 wave（serial），写入即同步 `state.execution_mode/execution_plan_hash/execution_plan_revision`；**无需 recommend/receipt/DP-4**（validatePlan 对 planned 豁免）
 5. D4：最小 `test-matrix.md` 或显式 skip（同 direct）
 6. 转换 `exploring→approved-for-build→executing`（planned 维度表：无契约、无 DP-3、无 architecture-design 重门）
 7. 实施：主代理当前会话执行单 wave；完成 → 跑测试 → `tf test record`
-8. **关门 → dispatch/执行 release-archivist（planned 分支单点执行）**：回写三步（`arch-merge --light` / `test-merge --light` / `tf solutions capture --source "change:<name>"`）→ `final-review.md` 最终审查（**在回写之后核验台账条目 vs diff 抽样**，B-01/D5）→ 转 `closing` → prototype-sync（closing 后，有原型才跑）。**序列只存在于 release-archivist「⚠ 执行顺序」块（唯一真相源，§3.7 B-13），本 skill 不重复执行、不本地复述命令（防双跑）**。
+8. **关门 → dispatch/执行 release-archivist（planned 分支单点执行）**：回写三步（`arch-merge --light` / `test-merge --light` / `tf solutions capture --source "change:<name>"`）→ `final-review.md` 最终审查（**在回写之后核验台账条目 vs diff 抽样**，B-01/D5；**v1.3：planned 不派 code-reviewer——最终审查同步按 `tf security scope` 适用集产 `.security-verification.json`**，见 release-archivist ④）→ security/handoff.md（④b）→ 转 `closing` → prototype-sync（closing 后，有原型才跑）。**序列只存在于 release-archivist「⚠ 执行顺序」块（唯一真相源，§3.7 B-13），本 skill 不重复执行、不本地复述命令（防双跑）**。
 
 ### Upgrade（升档，G5/D9）
 
@@ -202,6 +202,11 @@ Execution hit blockage: test failure, unexpected behavior, build error, task can
 ### Route to code-reviewer
 The current planned wave is implemented and ready for spec-compliance + code-quality verification. A reviewer must write an `tf execution review <change-dir> --wave <id> --base <sha> --head <sha> --report <path> --verdict <pass|fail>` receipt before any dependent wave or closing transition. **`--report` 必须落在 change review overlay 内**（`<change-dir>/.superpowers/sdd/reviews/`，v0.22 §86）——其他路径被 CLI 拒绝（`execution-plan.mjs` 的 `validateReviewReportEvidence`）；派发审查子代理时直接给 overlay 路径，避免"任务指令写 `reviews/`、CLI 只认 overlay"导致的双写副本。
 
+**Security baseline 派发前置（security-baseline-integration-design v1.3，规则送到派发者）**：派发 code-reviewer 前——
+1. 跑 `tf security scope <change-dir>`（Scope Deriver 唯一 CLI 入口）取适用子集并落盘 `.security-scope.json`；
+2. **末 wave 派发时**把 scope JSON 内容 + 「产 `.security-verification.json`（items/report_path/round）」指令 + `report_path`=receipt `--report` 路径约定，作为参数写进 dispatch prompt（模板占位 `[SECURITY_SCOPE_JSON]`）；非末 wave 不传（verification 只在末 wave / planned 最终审查产一份）；
+3. 两步缺一即 L2 `security-baseline` 门禁在 executing→closing FAIL（guard 只读 JSON）。
+
 **v0.39.0 主动串行编排**：workflow-start 在每个 wave 完成后主动 dispatch code-reviewer，而不是等待 build-executor 完成所有 wave。这是 workflow-start 的编排责任，不是 build-executor 的责任。
 
 **逐 wave 审查纪律（v0.36.4）**：每次 code-reviewer dispatch 只审查**一个** wave。禁止将多个 wave 合并为一次审查（vrm4teamflow C1 事件：W1-W4 合并审查导致设计约定类问题在 W4 才发现，修复范围扩大到 8 个 batch）。parallel wave 内的多个 task 作为整体审查一次（receipt 是 wave 级别），但审查 prompt 必须包含每个 task 的独立 diff。

package/skills/workflow-start/references/routing-rules.md

@@ -234,6 +234,7 @@ Current planned wave implemented and ready for review. Reviewer must write the r
 ```bash
 tf execution review <change-dir> --wave <id> --base <sha> --head <sha> --report <path> --verdict <pass|fail>
 ```
+**Security baseline (v1.3)**：派发前跑 `tf security scope <change-dir>`；**末 wave** 把 scope JSON + 产 `.security-verification.json` 指令作为 dispatch 参数传入（planned 不派 code-reviewer，其 JSON 由 release-archivist ④ 产）（模板占位 `[SECURITY_SCOPE_JSON]`；report_path 须等于上面 `--report` 路径）。guard 的 `security-baseline` 维度只读该 JSON——缺产即 executing→closing FAIL。
 
 ## Route to release-archivist (dispatch sub-agent)
 Guard: `... check <dir> executing closing --json` → fail = BLOCK. Include DP-7: 归档确认.