ai-delivery-workflow 0.2.2 → 0.4.0

package/skills/ai-delivery-evolve-workflow/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "自进化工作流"
-  short_description: "持续记录反馈、评估信号并安全演进项目级交付工作流扩展能力"
+interface:
+  display_name: "自进化工作流"
+  short_description: "持续记录反馈、评估信号并安全演进项目级交付工作流扩展能力"
   default_prompt: "使用 $ai-delivery-evolve-workflow 记录当前意见并在安全点评估可验证的项目级扩展。"

package/skills/ai-delivery-execute-test/SKILL.md

@@ -9,7 +9,11 @@ Observe and report. Do not repair the candidate, change test expectations to mak
 
 ## Artifact Location
 
-Write every test report, log index, evidence manifest, and workflow document produced by this skill under project `.workflow/`, defaulting version-scoped outputs to `.workflow/iterations/<iteration-id>/<node-id>/`. Raw external logs may remain in controlled systems only when their immutable references and checksums are recorded in `.workflow/`.
+Write every test report, log index, evidence manifest, and workflow document produced by this skill under project `.workflow/`. Iteration candidate tests stay in `.workflow/iterations/<iteration-id>/05-candidate-assurance/`; release tests stay in `.workflow/releases/<release-id>/R05-release-verification/`. Raw external logs may remain in controlled systems only when their immutable references and checksums are recorded in `.workflow/`.
+
+## Development Node
+
+For iteration scope, this Skill executes an independent test phase inside `05-candidate-assurance` against the node attempt's bound candidate and cannot mutate it. Test rounds do not create formal nodes. Any candidate-changing correction returns through `04-implementation` before a new assurance attempt. Release scope remains part of `R05-release-verification`.
 
 ## Task State
 
@@ -19,7 +23,7 @@ Write every test report, log index, evidence manifest, and workflow document pro
 
 ## Workflow
 
-1. Read the work package, approved source artifacts, candidate identity, environment identity, applicable standards, evidence requirements, and exact page/canvas/file/element references for UI or prototype-conformance scope.
+1. Read the work package, approved source artifacts, candidate identity, environment identity, applicable standards, evidence requirements, exact Prototype revision and UI Mapping checksums, and terminal/Page/Review Scene/prototype-element/UI component/frontend-source/acceptance references for UI or prototype-conformance scope. Reject missing or conflicting references and never infer relationships from file names or row order.
 2. Confirm prerequisites and isolate test data.
 3. Derive additional cases from independent requirements and risk sources when allowed.
 4. Execute through public interfaces and retain reproducible commands, inputs, outputs, timestamps, and environment references.

package/skills/ai-delivery-execute-test/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Execute Test Work"
-  short_description: "Execute one risk-based independent test work package"
-  default_prompt: "Use $ai-delivery-execute-test to execute the assigned independent test work package."
+interface:
+  display_name: "Execute Test Work"
+  short_description: "Execute one risk-based independent test work package"
+  default_prompt: "Use $ai-delivery-execute-test to execute the assigned independent test work package."

package/skills/ai-delivery-execute-work-package/SKILL.md

@@ -9,7 +9,11 @@ Implement only the assigned package. Do not broaden scope, choose a different st
 
 ## Artifact Location
 
-Write every work-package document, TDD record, evidence manifest, and handoff record produced by this skill under project `.workflow/`, defaulting version-scoped outputs to `.workflow/iterations/<iteration-id>/<node-id>/`. Source code, automated test source, and non-document build artifacts remain in their declared modification scopes.
+Write every work-package document, TDD record, evidence manifest, and handoff record produced by this skill under project `.workflow/`, defaulting version-scoped outputs to `.workflow/iterations/<iteration-id>/04-implementation/`. Source code, automated test source, and non-document build artifacts remain in their declared modification scopes.
+
+## Development Node
+
+This Skill executes implementation and approved repair phases for a stable logical task inside `04-implementation`. It never creates a separate formal node for a work package, review round, fix round, or retry. Preserve the task ID across attempts and apply only the approved `change_set_id` when repairing review findings.
 
 ## Task State
 
@@ -19,15 +23,17 @@ Write every work-package document, TDD record, evidence manifest, and handoff re
 
 ## Preflight
 
-1. Read the work package, source baselines, applicable standards, confirmed test seam, repository instructions, and exact UI handoff, product reconciliation, experience-change mapping, prototype-set/member revisions, management/review/impact checksums, and page/canvas/file/element mappings when the package is UI-bearing. Require every mapped change to be `ready-for-development` and its action to be one of `create|update|remove|migrate|no-code`.
+1. Read the work package, source baselines, applicable standards, confirmed test seam, repository instructions, and exact UI handoff, `product-prototype-reconciliation.yaml`, experience-change mapping, Prototype revision/checksum, frontend scope checksum, UI Mapping checksum, normalized catalog and review/impact checksums, and terminal/Page/Review Scene/prototype-element/UI component/frontend-source/acceptance mappings when the package is UI-bearing. Require every mapped change to be `ready-for-development` and its action to be one of `create|update|remove|migrate|no-code`.
 2. Verify the current branch and worktree with `$ai-delivery-manage-git`.
 3. Inspect the current code and tests before planning edits.
-4. Stop on missing dependencies, prototype or page/canvas/file identity mismatch, overlapping ownership, ambiguous acceptance behavior, or an infeasible architecture. Return evidence to the orchestrator.
+4. Stop on missing dependencies, missing or conflicting Prototype revision or UI Mapping references, overlapping ownership, ambiguous acceptance behavior, or an infeasible architecture. Never infer relationships from file names or row order. Return evidence to the orchestrator.
 
 ## TDD Loop
 
 For one vertical behavior at a time:
 
+Before the first write to each production UI file in a behavior or approved repair, run `ai-delivery frontend-guard check-file <workspace> --path <exact-path>`. Proceed only when the current Prototype approval and UI Mapping or revision-bound ownership covers that path. This applies equally to copy, style, responsive, accessibility, Page/route addition or removal, and defect correction.
+
 1. Write a behavior test through the confirmed public interface.
 2. Run it and retain evidence that it fails for the expected reason.
 3. Implement the minimum behavior needed to pass.
@@ -42,6 +48,7 @@ Perform cleanup or refactoring only from a Green checkpoint and expose it to ind
 ## Finish
 
 - Run architecture-specified format, lint, type, build, test, migration, and security commands.
+- Run `ai-delivery frontend-guard verify-diff <workspace> --base <fixed-base> --head <candidate-head>` for a UI-bearing package and retain the independent Git diff report; local Hook success is not evidence.
 - Update task-to-experience-change traceability and advance implemented rows through the state CLI; update technical documentation, configuration catalogs, and migration/rollback notes when affected.
 - Record deviations and TDD exceptions explicitly.
 - Commit only files in the allowed scope and produce a review packet with commands and evidence.

package/skills/ai-delivery-execute-work-package/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Execute Technical Work"
-  short_description: "Implement one architecture-constrained technical work package"
-  default_prompt: "Use $ai-delivery-execute-work-package to implement the assigned technical work package."
+interface:
+  display_name: "Execute Technical Work"
+  short_description: "Implement one architecture-constrained technical work package"
+  default_prompt: "Use $ai-delivery-execute-work-package to implement the assigned technical work package."

package/skills/ai-delivery-execute-work-package/references/work-package-contract.md

@@ -5,7 +5,7 @@ A package is executable only when it declares:
 - stable task, iteration, and slice IDs;
 - objective and observable completion behavior;
 - approved source and standards references;
-- exact ready UI handoff, aligned product reconciliation, actionable experience-change IDs with create/update/remove/migrate/no-code actions, prototype-set identity/checksum, relevant member IDs/revisions/review-bundle checksums, management/review/impact checksums, and page/canvas/file/element IDs when UI-bearing;
+- exact ready UI handoff, aligned `product-prototype-reconciliation.yaml`, actionable experience-change IDs with create/update/remove/migrate/no-code actions, Prototype revision/checksum, source and review-bundle checksums, UI Mapping and normalized catalog checksums, review/impact checksums, and terminal/Page/Review Scene/prototype-element/UI component/frontend-source/acceptance IDs when UI-bearing;
 - required capability role;
 - allowed and forbidden modification scope;
 - predecessor outputs;

package/skills/ai-delivery-manage-git/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Manage Delivery Git"
-  short_description: "Manage iteration branches, worktrees, tags, and release locks"
+interface:
+  display_name: "Manage Delivery Git"
+  short_description: "Manage iteration branches, worktrees, tags, and release locks"
   default_prompt: "Use $ai-delivery-manage-git to perform the required transition in the correct workflow or code repository."

package/skills/ai-delivery-manage-standards/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "Manage Standards"
-  short_description: "Capture, approve, version, and resolve applicable standards"
-  default_prompt: "Use $ai-delivery-manage-standards to capture or resolve project standards."
+interface:
+  display_name: "Manage Standards"
+  short_description: "Capture, approve, version, and resolve applicable standards"
+  default_prompt: "Use $ai-delivery-manage-standards to capture or resolve project standards."

package/skills/ai-delivery-orchestrate/SKILL.md

@@ -11,6 +11,20 @@ Coordinate state and handoffs. Do not produce specialist product, architecture,
 
 Read `.workflow/config/workspace.yaml` before any Git or source operation. The workspace root is the workflow repository; the configured direct child is the only code repository. Workflow facts, approvals, manifests, and checkpoints are committed in the workflow repository. Source, tests, code branches, code Tags, and application commits exist only in the code repository. Every code reference in a workflow artifact must carry `repo_id`, `code_commit`, optional `code_tag`, `source_path`, and SHA-256.
 
+## Code Intelligence
+
+For source discovery and change-impact analysis, resolve `code_repository.path` from the authoritative workspace configuration. Prefer `codegraph_explore` with the absolute code repository as `projectPath`; when MCP is unavailable but the indexed CLI is ready, use `codegraph explore "<query>" --path <code-repository>`. When CodeGraph is unavailable, uninitialized, unsupported, or fails, fall back to Semble, then `rg` and direct source reads. Treat `codegraph affected` as test recommendations only; it never narrows required tests or a formal Gate. Keep CodeGraph indexes local and outside formal state, artifacts, events, checkpoints, manifests, and archives.
+
+## Mock System
+
+Use the standalone project Microcks Mock System when a Prototype or UI Acceptance scope needs protocol exchanges. Run `ai-delivery mock setup <workspace>` and `ai-delivery mock start <workspace>`, and register every entry with explicit External Dependency Mock or Product Backend Mock kind, owner, approved contract, replacement condition, operation/channel, and stable scenario identity in its isolated catalog. Review `ai-delivery mock sync <workspace> --dry-run`; that dry-run must validate every named scenario and dispatcher input before `ai-delivery mock sync <workspace>` may run. Export each actual managed UI OpenAPI/AsyncAPI definition into `mock-admin-exports/`, bind its kind, Mock ID, protocol, relative path, and SHA-256 in `mock-admin-export.yaml`, and require freeze to protocol-validate every mapped scenario against those bytes. Prohibit production traffic recording/credentials/unsanitized personal data, require sanitization evidence for explicit imports, and map every active Review Scene exactly once. Run `ai-delivery mock freeze ... --dry-run`, obtain explicit human confirmation of the candidate checksum, freeze, and formally register the exact immutable Mock Scenario Pack before treating it as authoritative. A Product Backend Mock may drive UI scenes, but the real backend is not proven and end-to-end acceptance is not satisfied by mock success. Runtime databases, logs, traffic, and port state are disposable and never enter formal state.
+
+## Prototype-First Frontend Guard
+
+For any production frontend change, keep the sequence fixed: update the isolated Prototype, obtain the user's Page approval through Workflow Manager P12/P13, freeze the revision with checksummed `frontend-change-scope.yaml` and UI Mapping, then modify production code. Require `ai-delivery frontend-guard check-file` immediately before each UI path is written. Before merge, Candidate Assurance, or another formal handoff, require `ai-delivery frontend-guard verify-diff` from a fixed base to candidate head so an independent Git diff rechecks the revision, receipts, and mapping without trusting the local Hook. A business-logic reason to add or remove a Page returns to experience design and user confirmation first; there is no emergency, copy-only, style-only, accessibility, responsive, or defect-fix exception.
+
+Inside `05-candidate-assurance`, every UI-bearing immutable candidate runs `ai-delivery ui-acceptance plan` and `verify` against its pinned Prototype revision, current Page receipts, UI Mapping, Scenario Pack, approved test strategy, and exact Playwright environment. UI Acceptance is part of Candidate Assurance, not a new formal node. Reject incomplete Scene/viewport coverage, visual ratios above policy, interaction/accessibility/responsive/recovery/protocol failures, stale bindings, or Product Backend Mock presented as real backend evidence. A candidate checksum change always returns to `04-implementation` and starts a new assurance attempt.
+
 ## Artifact Location
 
 Require every workflow document to be written under project `.workflow/`. Use `.workflow/delivery/` for workflow control, `.workflow/standards/` for standards, `.workflow/product/`, `.workflow/architecture/`, and `.workflow/experience/` for reusable baselines, and `.workflow/iterations/<iteration-id>/<node-id>/` for version-scoped node outputs. Keep source code, automated test source, repository configuration, and non-document build artifacts in their native locations.
@@ -18,22 +32,28 @@ Require every workflow document to be written under project `.workflow/`. Use `.
 ## Task State
 
 1. Invoke `$ai-delivery-bootstrap` in read-only inspect mode when the current session has not classified project state. Do this before checkpoint recovery because an empty or partially initialized project may not have a valid runtime store.
-2. After iteration planning, persist the ordered known-task plan and initialize every known task snapshot as `queued` with `sequence` and `depends_on`. When a node derives dynamic tasks, append and register the complete derived group before executing its first task.
-3. For a complete workflow, first read Bootstrap's `next_action_owner`. Only for `agent`, invoke `$ai-delivery-checkpoint-task recover --iteration-id <iteration-id>` before preflight. Recovery must rebuild local state from the latest Git-tracked shared checkpoint when local runtime is absent. Continue the returned `recommended_task_id`; never choose the next task from chat memory. For `user` or `external`, stop at the zero-mutation wait boundary in step 7.
-4. Activate the recommended task before project mutation. If no task is recommended, reconcile missing or unsatisfied task-plan entries before continuing.
-5. Checkpoint after every meaningful artifact, gate, validation, merge, deployment action, or other external milestone, and before compaction or interruption.
-6. Before returning, finish the snapshot as `completed`, `blocked`, `failed`, or `interrupted`, with actual outputs, evidence, blockers, and one idempotent next action. A Hook event alone never proves completion.
+2. After iteration planning, persist the ordered known-task plan and initialize every known task snapshot as `queued` with `sequence`, `depends_on`, `--scope`, `--acceptance`, and `--responsibility`. Keep one task ID while iteration, node, skill, goal, scope, responsibility, dependencies, and acceptance remain unchanged; the CLI rejects the same contract under another ID. A material contract change requires a new task ID linked with `--derived-from` or `--supersedes`; planning, review, triage, repair, test, and version rounds are not new tasks. When a node derives dynamic tasks, append and register the complete derived group before executing its first task.
+3. For a complete workflow, first read Bootstrap's `next_action_owner`. Only for `agent`, invoke `$ai-delivery-checkpoint-task recover --iteration-id <iteration-id>` before preflight. Recovery must rebuild local state from the latest Git-tracked shared checkpoint when local runtime is absent. Continue the returned `recommended_task_id`; when its status is `failed`, explicitly activate it with `--new-attempt --phase repair`. Never choose the next task from chat memory. For `user` or `external`, stop at the zero-mutation wait boundary in step 7.
+4. Run `task-state.mjs inspect --task-id <task-id>` for read-only diagnosis, then activate the recommended task with its structured `--phase` before project mutation, checkpoint, or finish. Initialize new tasks only as queued; activation is the only path that starts an attempt and checks dependencies. Never override derived phase status with `--phase-status`. If no task is recommended, reconcile missing or unsatisfied task-plan entries before continuing.
+5. Checkpoint after every meaningful artifact, gate, validation, merge, deployment action, or other external milestone, and before compaction or interruption. Finding history is append-only. Record resolution only for an existing open finding, in repair/test/verification, with evidence and one approved `change_set_id`; record paired time categories when measured.
+6. Before returning, finish the snapshot as `completed`, `blocked`, `failed`, or `interrupted`, with actual outputs, evidence, blockers, and one idempotent next action. Completion is refused while a task-level current blocking finding remains open. A failed task remains retryable work and never satisfies dependencies; retry an unchanged logical task only with explicit `activate --new-attempt --phase repair`. A Hook event alone never proves completion.
 7. Persist `next_action_owner` as `agent`, `user`, or `external`. A user- or external-owned next action is a zero-mutation wait state: on restart or a generic “continue”, return only the recorded question or wait condition. Do not recover, activate, checkpoint, mutate artifacts, or change Git state until the required input arrives and ownership is explicitly transferred to `agent` with a new idempotent next action through the task CLI.
 
 ## Formal State
 
+The installed producer route is `development-seven-node`: `00-bootstrap -> 01-product-shaping -> 02-solution-design -> 03-delivery-readiness -> 04-implementation -> 05-candidate-assurance -> 06-version-closeout`. Producer Skills and installed guidance use only these development node IDs. `development-legacy-13` is read-only compatibility: inspect, verify, rebuild, and explicit migration may consume historical state, while every new legacy task, artifact, transition, candidate, closeout, or Gate write is rejected. Release nodes `R00-release-request` through `R10-release-archive` remain writable.
+
+When Bootstrap reports legacy compatibility or a premature archive, use the packaged top-level CLI before normal orchestration. Run `ai-delivery migrate <project> --dry-run` and require a reviewed report with schemas, semantic task groups, ambiguities, conflicts, verified anchors, and exact file changes. A legacy root migration copies workflow material into `.workflow/`; flat task shards gain explicit attempts without changing their lifecycle status or scope. Resolve every ambiguity through a source-checksum-bound `--decisions` document with a `human:` actor and rationale, then rerun dry-run. Apply migration only when `can_apply` is true; its manifest and backups must preserve source bytes, task lifecycle facts, scope, formal views, and legacy event bytes. Resolve an incorrect archive only through `ai-delivery repair <project> --invalidate-archive <iteration-id>` with an explicit human actor, reason, RCA evidence, and recovery evidence. The resulting forward transaction invalidates current eligibility while the original archive remains byte-identical. Use rollback only before any post-migration schema 2 transaction or migrated-byte drift; afterward use forward repair. Compaction is never part of migration: run `ai-delivery compact <project> --dry-run` only after a trusted anchor exists, review its exact coverage and byte report, and apply only on explicit operator intent.
+
 1. Use `node .workflow/tools/state/state.mjs inspect` to read schema 2 formal state: independent `development_state` and `release_state` scopes, the top-level workflow audit revision, and the artifact-registry revision.
-2. Register every formal artifact with `artifact register`; change its lifecycle only with `artifact status`; create a new artifact ID and `--supersedes` instead of overwriting a registered version.
+2. Keep `draft` and `review-draft` files mutable and outside the formal registry. Register only immutable semantic revisions such as `submitted`, `rejected`, `approved`, `frozen`, or `failed`; every later decision uses a new artifact ID and `--supersedes`. `artifact status` exists only to migrate a legacy registered working draft once and must not mutate a formal revision.
 3. Start development with `iteration-started`; start release only after explicit user intent with `release-started`. Record node, candidate, closeout, and archive changes with `transition`. Record human or contract Gates with `gate request` and `gate decide`.
-4. Pass the current stream revision through `--expected-revision` for every mutation. On a conflict, inspect again and reconcile; never retry blindly.
-5. Run `verify` before handoff, node completion, version closeout, and after recovery. Let the CLI enforce graph prerequisites, successful completion evidence, current-attempt mandatory Gates, and scope identity. Release nodes independently require verification at every release handoff. Stop on checksum, schema, audit, identity, or state-invariant failure.
-6. Never directly edit controlled formal state, shared task/checkpoint shards, or runtime task state. Treat global workflow and artifact indexes as deterministic views over authoritative shards where available. If either state script fails, repair the input or script problem rather than bypassing it.
-7. When the user clearly expresses a workflow improvement, invoke `$ai-delivery-evolve-workflow feedback record` and report the feedback ID. Do not save ordinary discussion, full conversation text, secrets, or AI reasoning. Evaluate pending evidence only after a task, version closeout, or explicit evolution review.
+4. At Delivery Readiness, run `scope freeze` to enable `scope_contract_version: 1` and bind approved Slices, requirements, acceptance, tasks, and artifacts. Afterward, only a human-approved `scope amend` may change scope. Use `scope warn` for a budget overrun; it must remain `warn-only` with `reslice_performed: false` and must not automatically replan or reslice.
+5. Read `inspect.derived_node_states` instead of assigning formal node status from narration. The projection uses task facts and blocking findings, Gates, artifacts, candidate identity, the current scope manifest, and completion receipts. A governed node may complete only from `ready-to-complete`; completion writes a receipt bound to those facts. Historical scopes without `scope_contract_version` retain legacy compatibility.
+6. Pass `artifact_registry.revision` through `--expected-revision` for artifact mutations. For scope, transition, and Gate mutations, pass the owning `development_state.revision` or `release_state.revision` through `--expected-scope-revision`; the top-level workflow revision form remains compatibility-only. A transition or Gate that consumes evidence records an artifact handoff in the same transaction and advances the artifact-registry revision, so inspect again before the next artifact mutation. On a conflict, inspect again and reconcile; never retry blindly.
+7. Run routine `verify` before handoff, node completion, and after recovery. It validates current formal views without traversing historical shards or decompressing archives. At ordinary task safe points, run `snapshot create --reason configured-interval`; the command is a no-op until the configured event interval is reached. Run `verify --history --since-anchor` after an anchor exists. `artifact compact` and `artifact prune` default to zero-write plans. Compact preserves original legacy shards in a checksummed gzip bundle and removes loose files only after full replay reproduces the anchored registry checksum; afterward `verify --history` reports `compacted-history`. Only explicit `artifact prune --apply` may replace covered shards with a retention receipt; afterward verification reports `retained-history` and does not claim deleted bytes were re-audited. Let the CLI enforce graph prerequisites, successful completion evidence, current-attempt mandatory Gates, and scope identity. Release nodes independently require routine verification at every release handoff. Stop on checksum, schema, audit, identity, or state-invariant failure.
+8. Never directly edit controlled formal state, shared task/checkpoint shards, or runtime task state. Treat global workflow and artifact indexes as deterministic views over authoritative shards where available. If either state script fails, repair the input or script problem rather than bypassing it.
+9. When the user clearly expresses a workflow improvement, invoke `$ai-delivery-evolve-workflow feedback record` and report the feedback ID. Do not save ordinary discussion, full conversation text, secrets, or AI reasoning. Evaluate pending evidence only after a task, version closeout, or explicit evolution review.
 
 ## Preflight
 
@@ -47,22 +67,16 @@ Require every workflow document to be written under project `.workflow/`. Use `.
 
 ## Route The Workflow
 
-Use this first-release order:
-
-1. `$ai-delivery-bootstrap`: classify state, initialize missing project context, or route checkpoint recovery.
-2. `$ai-delivery-define-product`: discovery Gate A, then product baseline Gate B.
-3. `$ai-delivery-design-architecture`: initial mode and human approval of major decisions.
-4. Start `$ai-delivery-prepare-platform` as a parallel stream.
-5. `$ai-delivery-design-experience`: obtain one human authoring-tool selection per prototype member; create an executable low-fidelity prototype; pass human Gate `UX-LF`; define visual direction, design tokens, component states, and select a compatible UI framework; pass human Gate `UX-VS`; create a runnable formal UI; pass human Gate `UX-UI`; record every review adjustment and upstream impact.
-6. `$ai-delivery-define-product` in prototype-reconciliation mode: after all formal UI candidates are approved, reconcile the complete adjustment set bidirectionally with product requirements through `product-prototype-reconciliation.yaml`. Rebaseline and repeat affected experience Gates until the decision is `aligned`.
-7. `$ai-delivery-design-architecture`: reconcile mode, prototype architecture receipt, `ready-for-development` experience changes, and final architecture baseline.
-8. `$ai-delivery-plan-iteration`.
-9. `$ai-delivery-design-tests`: prototype test receipt and public test contract.
-10. `$ai-delivery-develop-iteration`, including independent change review.
-11. Join the candidate and delivery-platform streams in a reproducible test environment.
-12. `$ai-delivery-verify-candidate` with `scope: iteration`; route failures upstream.
-13. `$ai-delivery-close-version`; create the immutable `version-ready` tag, advance `line/<product-id>`, mark the version `release-ready`, move closed shared task/checkpoint shards to `.workflow/control/archives/versions/<version-id>/`, and remove them from active recovery collections.
-14. Stop. Continue the next cumulative planned version from the latest line head, or wait for explicit user intent.
+Use this producer order:
+
+1. `00-bootstrap`: `$ai-delivery-bootstrap` classifies state, initializes missing project context, or routes checkpoint recovery.
+2. `01-product-shaping`: `$ai-delivery-define-product` owns discovery `GATE-A`, product-baseline `GATE-B`, and prototype reconciliation. Reuse an unaffected approved product baseline by exact artifact identity and checksum instead of replaying its interviews or Gates.
+3. `02-solution-design`: `$ai-delivery-design-architecture` and `$ai-delivery-design-experience` coordinate initial architecture, `UX-VS`, `UX-UI`, product reconciliation, and final architecture. Reuse unaffected approved architecture or experience baselines by exact identity and checksum.
+4. `03-delivery-readiness`: `$ai-delivery-prepare-platform`, `$ai-delivery-plan-iteration`, and `$ai-delivery-design-tests` converge on one approved Slice, dependency, acceptance, task, artifact, environment, and public-test contract; then freeze it with `scope freeze`.
+5. `04-implementation`: `$ai-delivery-develop-iteration` coordinates stable logical-task attempts for implementation, package review, triage, repair, and developer tests. It completes only after selecting and retaining one immutable candidate as evidence.
+6. `05-candidate-assurance`: `$ai-delivery-review-change` and `$ai-delivery-verify-candidate` collect review feedback and independently verify the candidate bound when the node attempt starts. Findings are applied only as an approved `change_set_id`; any candidate-changing repair returns through `04-implementation` and creates a new candidate and assurance attempt.
+7. `06-version-closeout`: `$ai-delivery-close-version` creates the immutable `version-ready` tag, advances `line/<product-id>`, marks the version `release-ready`, archives closed task/checkpoint shards, and removes them from active recovery collections.
+8. Stop. Continue the next cumulative planned version from the latest line head, or wait for explicit user intent.
 
 At every task and version safe point, route eligible feedback and trial observations through `$ai-delivery-evolve-workflow`. Extension behavior begins with the next task or version and never mutates an in-progress execution.
 
@@ -76,19 +90,23 @@ Pause for humans at:
 
 - discovery Gate A and product baseline Gate B;
 - major architecture decisions;
-- each prototype member's authoring-tool selection before prototype authoring;
-- each visual or interactive prototype member's `UX-LF`, `UX-VS`, and `UX-UI` decisions, repeated until the latest round is approved and every comment is terminal;
+- the Prototype's authoring-tool selection before prototype authoring;
+- each visual or interactive Page revision's `UX-VS` and `UX-UI` decisions, repeated until the latest round is approved and every comment is terminal;
 - production deployment approval;
 - every proposed standard creation, update, deprecation, or exception.
 
 Allow downstream contract validation instead of human approval at ordinary intermediate handoffs.
 
+At either experience Gate, start or reuse `ai-delivery manager serve <workspace>`, report its loopback URL, and route the user to P11 for Visual Standard or P12/P13 for the exact Prototype revision. The Manager must bind the displayed content and every decision to the current checksummed target. A mismatched target, non-loopback origin, or target drift keeps ownership with the agent for repair and must never be presented for human approval.
+
+During `UX-UI`, route each human Page decision through Workflow Manager P13 and report the Page IDs in `pending-review`, `changes-requested`, or `stale`. Do not replace or re-slice the planned work automatically. Only an identical checksum may carry the latest approved Page decision forward; a later changes-requested decision blocks inheritance. When the user approves the final pending Page, require one atomic transaction to write both its immutable Page receipt and the `UX-UI` Gate decision before advancing the formal node. After that Gate is approved, reject further Page writes until a new immutable Prototype revision has a new pending `UX-UI` request.
+
 ## Maintain State
 
 - Give every project, iteration, artifact, feature, story, acceptance criterion, slice, task, test, defect, release item, and deployment a stable ID.
 - Record artifact input IDs and versions; never infer dependencies from filenames.
 - Treat approved baselines and release versions as immutable. Create a new version for changes.
-- Carry the same immutable UI handoff, aligned product reconciliation, experience-change set, prototype-set identity/checksum and relevant member identities, source revisions, review-bundle checksums, tool-selection checksums, page/canvas/file catalog checksums, review/adjustment checksums, and impact-assessment checksums through architecture, planning, test design, development, and verification.
+- Carry the same immutable UI handoff, aligned product reconciliation, experience-change set, exact Prototype revision/checksum, source revision/checksum, review-bundle checksum, UI Mapping and normalized catalog checksums, review/adjustment checksums, and impact-assessment checksum through architecture, planning, test design, development, and verification. Reject missing or conflicting references and never infer relationships from file names or catalog order.
 - Mark downstream artifacts stale after an upstream change and route only the impacted work.
 - Record the standards baseline used by every artifact.
 - Keep one production release transition locked at a time while allowing later cumulative iteration work in parallel.

package/skills/ai-delivery-orchestrate/agents/openai.yaml

@@ -1,4 +1,4 @@
-interface:
-  display_name: "AI Delivery Orchestrator"
-  short_description: "Coordinate AI delivery stages, gates, artifacts, and routing"
+interface:
+  display_name: "AI Delivery Orchestrator"
+  short_description: "Coordinate AI delivery stages, gates, artifacts, and routing"
   default_prompt: "Use $ai-delivery-orchestrate to start or continue the current workflow using the configured workflow and code repositories."

package/skills/ai-delivery-orchestrate/assets/project-template/.workflow/delivery/project.yaml

@@ -4,3 +4,4 @@ status: active
 created_at: ""
 current_iteration_id: INIT-0001
 production_release_id: null
+formal_state_snapshot_interval: 100

package/skills/ai-delivery-orchestrate/assets/project-template/.workflow/delivery/workflow-state.yaml

@@ -9,6 +9,7 @@ development_state:
   completed_nodes: []
   pending_gates: []
   gate_decisions: []
+  contract_retirement_receipts: []
   node_attempts: {}
   latest_candidate_id: null
   latest_release_id: null
@@ -22,6 +23,7 @@ release_state:
   completed_nodes: []
   pending_gates: []
   gate_decisions: []
+  contract_retirement_receipts: []
   node_attempts: {}
   latest_candidate_id: null
   latest_release_id: null

package/skills/ai-delivery-orchestrate/assets/project-template/.workflow/tools/frontend-guard/frontend-guard.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+
+import path from "node:path";
+import { runFrontendGuardCommand } from "./frontend-guard-runtime.mjs";
+
+function usage() {
+  return [
+    "Usage:",
+    "  frontend-guard <check-file|verify-diff> [project] [--path <file>] [--base <git-ref>] [--head <git-ref>] [--experience <relative-directory>] [--revision <relative-yaml>]",
+  ].join("\n");
+}
+
+function parseArgs(args) {
+  const options = new Map();
+  const positionals = [];
+  const valueOptions = new Set(["--path", "--base", "--head", "--experience", "--revision"]);
+  for (let index = 1; index < args.length; index += 1) {
+    const value = args[index];
+    if (valueOptions.has(value)) {
+      const optionValue = args[index + 1];
+      if (!optionValue || optionValue.startsWith("--")) throw new Error(`Missing value for ${value}`);
+      options.set(value, optionValue);
+      index += 1;
+    } else if (value.startsWith("--")) throw new Error(`Unknown option: ${value}`);
+    else positionals.push(value);
+  }
+  return { options, positionals };
+}
+
+try {
+  const args = process.argv.slice(2);
+  const action = args[0];
+  if (!action || action === "--help" || action === "help") {
+    process.stdout.write(`${usage()}\n`);
+  } else {
+    const { options, positionals } = parseArgs(args);
+    const target = path.resolve(positionals[0] || process.cwd());
+    const report = runFrontendGuardCommand(target, action, {
+      path: options.get("--path"),
+      base: options.get("--base"),
+      head: options.get("--head"),
+      experience: options.get("--experience"),
+      revision: options.get("--revision"),
+    });
+    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  }
+} catch (error) {
+  process.stderr.write(`ai-delivery-frontend-guard: ${error.message}\n`);
+  process.exitCode = 1;
+}

package/skills/ai-delivery-orchestrate/assets/project-template/.workflow/tools/hooks/hook-event.mjs

@@ -53,6 +53,96 @@ async function readStdin() {
   return Buffer.concat(chunks).toString("utf8");
 }
 
+function preToolUsePaths(input) {
+  const eventName = String(input.hook_event_name || input.hookEventName || "").toLowerCase();
+  if (eventName !== "pretooluse") return [];
+  const toolName = String(input.tool_name || input.toolName || "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]/g, "");
+  const mutatingFileTools = [
+    "applypatch", "edit", "editfile", "multiedit", "write", "writefile",
+    "createfile", "deletefile", "movefile", "renamefile", "replacefile",
+  ];
+  if (!mutatingFileTools.some((name) => toolName === name || toolName.endsWith(name))) return [];
+  const toolInput = input.tool_input && typeof input.tool_input === "object"
+    ? input.tool_input
+    : {};
+  const candidates = [];
+  for (const field of ["file_path", "path", "target_file"]) {
+    if (typeof toolInput[field] === "string") candidates.push(toolInput[field]);
+  }
+  if (Array.isArray(toolInput.edits)) {
+    for (const edit of toolInput.edits) {
+      if (!edit || typeof edit !== "object") continue;
+      for (const field of ["file_path", "path", "target_file"]) {
+        if (typeof edit[field] === "string") candidates.push(edit[field]);
+      }
+    }
+  }
+  for (const field of ["patch", "input"]) {
+    if (typeof toolInput[field] !== "string") continue;
+    for (const line of toolInput[field].split(/\r?\n/)) {
+      const match = line.match(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/)
+        || line.match(/^\*\*\* Move to: (.+)$/);
+      if (match) candidates.push(match[1]);
+    }
+  }
+  return [...new Set(candidates.map((item) => item.trim()).filter(Boolean))];
+}
+
+function owningGitRoot(file) {
+  let current = fs.existsSync(file) && fs.statSync(file).isDirectory() ? file : path.dirname(file);
+  while (!fs.existsSync(current)) {
+    const parent = path.dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+  const result = spawnSync("git", ["-C", current, "rev-parse", "--show-toplevel"], {
+    encoding: "utf8",
+    timeout: 5_000,
+    windowsHide: true,
+  });
+  return result.status === 0 ? path.resolve(result.stdout.trim()) : null;
+}
+
+function samePath(left, right) {
+  const normalize = (value) => process.platform === "win32"
+    ? path.resolve(value).toLowerCase()
+    : path.resolve(value);
+  return normalize(left) === normalize(right);
+}
+
+function enforceFrontendGuard(projectRoot, input) {
+  const changedPaths = preToolUsePaths(input);
+  if (!changedPaths.length) return;
+  const guardCli = path.join(projectRoot, ".workflow", "tools", "frontend-guard", "frontend-guard.mjs");
+  if (!fs.existsSync(guardCli)) {
+    throw new Error(`Frontend guard runtime is missing: ${guardCli}`);
+  }
+  for (const changedPath of changedPaths) {
+    const resolvedChangedPath = path.isAbsolute(changedPath)
+      ? changedPath
+      : path.resolve(process.cwd(), changedPath);
+    const gitRoot = owningGitRoot(resolvedChangedPath);
+    if (gitRoot && samePath(gitRoot, projectRoot)) continue;
+    const guarded = spawnSync(process.execPath, [
+      guardCli, "check-file", projectRoot, "--path", resolvedChangedPath,
+    ], {
+      cwd: projectRoot,
+      encoding: "utf8",
+      timeout: 15_000,
+      windowsHide: true,
+    });
+    if (guarded.error || guarded.status !== 0) {
+      throw new Error(
+        guarded.error?.message
+        || guarded.stderr.trim()
+        || `Frontend guard rejected ${resolvedChangedPath}.`,
+      );
+    }
+  }
+}
+
 try {
   const currentProjectFile = findUp(process.cwd(), path.join(".workflow", "delivery", "project.yaml"));
   const legacyProjectFile = currentProjectFile
@@ -67,6 +157,7 @@ try {
   const marker = fs.existsSync(markerFile) ? JSON.parse(fs.readFileSync(markerFile, "utf8")) : null;
   const raw = await readStdin();
   const input = raw.trim() ? JSON.parse(raw) : {};
+  enforceFrontendGuard(projectRoot, input);
   const taskId = safeId(process.env.AI_DELIVERY_TASK_ID || marker?.task_id || input.turn_id || input.session_id);
   const stateRoot = path.resolve(process.env.AI_DELIVERY_STATE_ROOT || marker?.state_root || projectRoot);
   const workflowRoot = fs.existsSync(path.join(stateRoot, ".workflow", "delivery", "project.yaml"))

package/skills/ai-delivery-orchestrate/assets/project-template/.workflow/tools/manager/manager.mjs

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+
+import path from "node:path";
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
+import {
+  WorkflowManagerError,
+  renderWorkflowManagerCommandHelp,
+  runWorkflowManagerCommand,
+} from "./workflow-manager-runtime.mjs";
+
+const runtimeRoot = path.dirname(fileURLToPath(import.meta.url));
+const defaultProjectRoot = path.resolve(runtimeRoot, "..", "..", "..");
+
+function option(args, name) {
+  const index = args.indexOf(name);
+  if (index === -1) return null;
+  const value = args[index + 1];
+  if (!value || value.startsWith("--")) throw new Error(`Missing value for ${name}`);
+  return value;
+}
+
+try {
+  const args = process.argv.slice(2);
+  const action = args[0];
+  if (!action || action === "help" || action === "--help") {
+    process.stdout.write(`${renderWorkflowManagerCommandHelp(null, { command: "manager" })}\n`);
+  } else if (action === "action" && args.includes("--help")) {
+    process.stdout.write(`${renderWorkflowManagerCommandHelp(args[1], { command: "manager" })}\n`);
+  } else {
+    const actionName = action === "action" ? args[1] : null;
+    const projectIndex = action === "action" ? 2 : 1;
+    const projectArg = args[projectIndex] && !args[projectIndex].startsWith("--")
+      ? args[projectIndex]
+      : defaultProjectRoot;
+    const inputFile = option(args, "--input");
+    const result = await runWorkflowManagerCommand(runtimeRoot, path.resolve(projectArg), action, {
+      port: option(args, "--port"),
+      open: !args.includes("--no-open"),
+      resource: option(args, "--resource"),
+      experience: option(args, "--experience"),
+      revision: option(args, "--revision"),
+      branch: option(args, "--branch"),
+      attachmentId: option(args, "--attachment-id"),
+      expectedChecksum: option(args, "--expected-checksum"),
+      terminalId: option(args, "--terminal-id"),
+      sourceSnapshotId: option(args, "--source-snapshot-id"),
+      sourceRef: option(args, "--source-ref"),
+      pageId: option(args, "--page-id"),
+      reviewSceneId: option(args, "--review-scene-id"),
+      actionName,
+      input: inputFile ? JSON.parse(fs.readFileSync(path.resolve(inputFile), "utf8")) : undefined,
+    });
+    process.stdout.write(`${JSON.stringify(result?.report || result, null, 2)}\n`);
+  }
+} catch (error) {
+  process.stderr.write(`${JSON.stringify({
+    error: {
+      code: error instanceof WorkflowManagerError ? error.code : "invalid-request",
+      message: error?.message || "Workflow Manager request failed",
+    },
+  })}\n`);
+  process.exitCode = 1;
+}

package/skills/ai-delivery-orchestrate/assets/project-template/.workflow/tools/manager/start.cmd

@@ -0,0 +1,4 @@
+@echo off
+setlocal
+node "%~dp0manager.mjs" serve %*
+endlocal

package/skills/ai-delivery-orchestrate/assets/project-template/.workflow/tools/manager/start.ps1

@@ -0,0 +1,2 @@
+$ErrorActionPreference = "Stop"
+node (Join-Path $PSScriptRoot "manager.mjs") serve @args

package/skills/ai-delivery-orchestrate/assets/project-template/.workflow/tools/{viewer → manager}/start.sh

@@ -1,4 +1,4 @@
 #!/usr/bin/env sh
 set -eu
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-exec node "$SCRIPT_DIR/server.mjs" "$@"
+exec node "$SCRIPT_DIR/manager.mjs" serve "$@"

package/skills/ai-delivery-orchestrate/assets/project-template/.workflow/tools/mock/mock.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+
+import path from "node:path";
+import { runMockSystemAction } from "./mock-system.mjs";
+
+function usage() {
+  return [
+    "Usage:",
+    "  mock <setup|start|stop|status|sync> [project] [--dry-run]",
+    "  mock freeze [project] --experience <relative-directory> --scenario-pack <relative-yaml> [--dry-run]",
+  ].join("\n");
+}
+
+function parseArgs(args) {
+  const options = new Map();
+  const positionals = [];
+  for (let index = 1; index < args.length; index += 1) {
+    const value = args[index];
+    if (value === "--dry-run") continue;
+    if (value === "--experience" || value === "--scenario-pack") {
+      const optionValue = args[index + 1];
+      if (!optionValue || optionValue.startsWith("--")) throw new Error(`Missing value for ${value}`);
+      options.set(value, optionValue);
+      index += 1;
+    } else if (value.startsWith("--")) throw new Error(`Unknown option: ${value}`);
+    else positionals.push(value);
+  }
+  return { options, positionals };
+}
+
+try {
+  const args = process.argv.slice(2);
+  const action = args[0];
+  if (!action || action === "--help" || action === "help") {
+    process.stdout.write(`${usage()}\n`);
+  } else {
+    const { options, positionals } = parseArgs(args);
+    const projectArg = positionals[0];
+    const target = path.resolve(projectArg || process.cwd());
+    const result = await runMockSystemAction(target, action, {
+      dryRun: args.includes("--dry-run"),
+      experience: options.get("--experience"),
+      scenarioPack: options.get("--scenario-pack"),
+    });
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  }
+} catch (error) {
+  process.stderr.write(`ai-delivery-mock: ${error.message}\n`);
+  process.exitCode = 1;
+}