ai-delivery-workflow 0.4.0 → 0.5.1

package/docs/agents/workflow-manager-acceptance-matrix.md

@@ -8,7 +8,7 @@ This matrix is the completion ledger for P0/P1/P2. `covered` means current autom
 
 | Requirement | Current implementation | Executable evidence | Status |
 | --- | --- | --- | --- |
-| One installed control surface | Manager runtime, React assets and cross-platform launchers; no Viewer on new install | `verification/workflow-manager.test.mjs`, `verification/project-installer.test.mjs` | covered |
+| One installed control surface | Manager runtime, React assets and cross-platform launchers | `verification/workflow-manager.test.mjs`, `verification/project-installer.test.mjs` | covered |
 | CLI/HTTP/UI parity | all call `workflow-manager.mjs` resources/actions | package, installed CLI and HTTP equality tests | covered |
 | Seven-node formal state | P01/P02 derive only from `state inspect.derived_node_states` | delivery-state and browser tests | covered |
 | Stable context | workspace, project, branch, iteration, revision and checksum fields | Manager inspect/resource tests | covered |
@@ -16,8 +16,8 @@ This matrix is the completion ledger for P0/P1/P2. `covered` means current autom
 | Governed writes | fixed action allowlist, actor, revision/checksum, idempotency and plan checksum as applicable | governance, prototypes, systems and Mock tests | covered |
 | Receipts and events | all stateful Manager actions use formal service or write immutable Receipt/Event | module-specific tests | covered |
 | Desktop visual contract | Chinese Operational Carbon, IBM Plex, Lucide; 1280x720 and 1440x900 | 19 Page browser acceptance | covered |
-| Package installation lifecycle | new install, Viewer remove/backup/rollback, installed Manager | installer and Manager tests | covered |
-| `0.4.0` candidate and target project | package, isolated install/upgrade/migrate/rollback, tushare read-only preflight | candidate SHA-256, isolated receipts, installed Manager probes and target-project dry-run summaries below | covered |
+| Package installation lifecycle | new install, current-contract upgrade, installed Manager | installer and Manager tests | covered |
+| `0.4.0` candidate and target project | package and isolated current-contract install/doctor | candidate SHA-256 and installed Manager probes | covered |
 
 ## Page delivery
 
@@ -45,25 +45,20 @@ This matrix is the completion ledger for P0/P1/P2. `covered` means current autom
 
 `P13` is contextual and absent from fixed navigation. Page identifiers are fixed and unique; new Pages append identities without reusing retired numbers.
 
-## Legacy convergence
+## Current contract
 
 | Surface | Current evidence | Status |
 | --- | --- | --- |
-| Workflow Viewer | template/runtime/tests removed; new manifest omits Viewer; old Viewer is Receipt-backed `remove` and rollback restore | covered |
+| Workflow Manager | one installed Manager control surface | covered |
 | User-visible Prototype Review Server | CLI/server/static shell/tests removed; target and Page Receipt internals retained for Manager | covered |
 | Public documentation | current guides route users and agents to Manager P11/P12/P13 | covered |
-| Historical 13-node state | read-only state compatibility remains; Manager exposes only seven-node producer model | covered |
+| Formal state | schema 2 and seven-node producer model | covered |
 
 ## `0.4.0` candidate evidence
 
 The canonical candidate identity, SHA-256, file count, source commit, and lifecycle report are recorded in the maintenance-repository file `audit/WORKFLOW-MANAGER-P0-P1-P2-CLOSURE.md`. The archive and expanded lifecycle workspace remain in ignored `.tmp/`; the audit record is outside the npm package, so the archive does not self-reference its own checksum.
 
 - A fresh isolated project passed Doctor except for the optional CodeGraph warning. The historical r8 candidate returned HTTP 200, health `true`, schema `workflow-manager.v1`, 19 Pages, seven nodes, Prototype `wm-prototype-r24@4452c605`, and 25 discoverable governed actions.
-- An isolated `0.3.0` project produced an upgrade plan with zero conflicts, one Manager addition, eight managed replacements, one Viewer removal, and no code-repository write. Applying the upgrade produced Receipt `UPGRADE-20260812T221812525Z-cde0bf7d`.
-- Rolling back that Receipt restored manifest version `0.3.0`, restored all seven Viewer files, removed Manager, changed the Receipt status to `rolled_back`, and left both isolated Git worktrees byte-for-byte clean against their pre-upgrade commits. The recorded pre-upgrade Viewer digest remains `5cfb8de36f36ccf8149e6f8047e85e48b573a52ef28e67adf35d675497148369`.
-- Against `E:\work\ai\codex\tushare`, `doctor`, `upgrade --dry-run`, and `migrate --dry-run` completed without formal apply. Doctor reported the existing pre-upgrade managed-runtime drift; the upgrade plan has one addition, eight replacements and one removal with zero managed-asset conflicts and `code_repository.write_planned=false`. Each dry-run was bracketed by an identical current-state Git status digest.
-- The `tushare` migration preflight deliberately returned `can_apply=false`: one legacy Prototype source checksum conflicts with its manifest and 24 task families require human semantic-grouping decisions across 183 historical tasks. No business state was changed. This is the required fail-closed result, not authorization to apply or force migration.
-- The maintainer cancelled the formal `tushare` upgrade/migration on 2026-08-21. The target remains read-only; the failed-closed migration plan is retained as evidence and must not be forced into an apply.
 
 The current formal Manager baseline has since been promoted to `wm-prototype-r33@f98e7595` through the independent Prototype-to-Frontend gate. The historical `0.4.0` candidate above remains bound to r24 and is immutable evidence; it does not contain the r33 promotion and cannot be reused for npm publication. A new release candidate is required before publication.
 
@@ -77,9 +72,9 @@ This addendum covers the destructive v2 Prototype Revision contract. It does not
 | Fresh tarball installation delivers v2-only Manager/Experience material | `isolated package Candidate Assurance binds v2 Revision facts across installed CLI, HTTP, and P07/P11-P17` in `verification/workflow-manager.test.mjs` runs `npm pack`, consumer install, `init`, and `doctor` | covered |
 | P07 and P11-P17 use one Revision fact through installed CLI, HTTP, and UI | the same isolated test compares installed CLI/HTTP JSON, verifies each Web browser request and response is `TERM-WEB` scoped, and proves P12 renders the independent `TERM-ADMIN` target at `1280x720` and `1440x900` | covered |
 | Component Candidate lifecycle write is controlled across Agent and UI service boundaries | the same isolated test runs P11 `candidate -> under-review`, installed CLI `under-review -> registered`, and HTTP `registered -> modified`; each apply emits a Receipt/event and both Agent clients replay idempotently | covered |
-| Old catalog input has no compatibility fallback | the same isolated test removes the required `components` catalog and verifies matching CLI/HTTP errors plus the P13 controlled error state | covered |
+| Incomplete catalog input is rejected | the same isolated test removes the required `components` catalog and verifies matching CLI/HTTP errors plus the P13 controlled error state | covered |
 
-`prototype-set.yaml` and its members are retained only as read-only migration inputs. New Experience production uses `prototype-revision-catalog.v2`; no new install, Manager read model, or Candidate Assurance path emits a legacy set.
+New Experience production uses `prototype-revision-catalog.v2`; no install, Manager read model, or Candidate Assurance path emits an obsolete set.
 
 ## Release gate
 
@@ -88,6 +83,5 @@ P0/P1/P2 completes only after all of the following are current and green:
 1. `node --test verification/workflow-manager*.test.mjs` and the full `npm test` suite.
 2. `npm run manager:build`, `npm run skills:validate`, `npm run pack:check`, and `git diff --check`.
 3. Final `index.html` asset references are Git-tracked and present in the tarball.
-4. A `0.4.0` candidate passes isolated new install, upgrade, migrate dry-run, rollback and installed Manager CLI/API/UI checks.
-5. The candidate passes `doctor`, `upgrade --dry-run`, and `migrate --dry-run` against `E:\work\ai\codex\tushare` without formal apply.
+4. A `0.4.0` candidate passes isolated current-contract install and installed Manager CLI/API/UI checks.
 6. Gitee P0/P1/P2 Issues contain the same evidence, duplicate tickets are merged or closed, dependencies are corrected, and every write is read back. This is covered: `IK8BA0` through `IK8BA5`, `IK8B9Z`, `IK8B9U`, `IK6HCD`, `IK89SN`, and `IK6HCE` were closed in the Gitee UI after explicit user confirmation and API v5 subsequently returned `state: rejected` for each, which is Gitee's API representation of the UI's “已关闭” status.

package/docs/agents/workflow-manager-current-state.md

@@ -1,15 +1,15 @@
 # 工作流与工作流管理器阶段现状
 
-更新时间：2026-08-21
+更新时间：2026-08-22
 
 本文是继续设计、实现或审核 Workflow Manager 时的阶段入口。它区分已经进入正式工作流源码的能力、已经接受但尚未实现的产品决策、仅在隔离原型中验证的交互，以及仍未完成的事项。领域术语以根目录 `CONTEXT.md` 为准，不以本文替代 ADR、正式状态契约或 Issue。
 
 ## 1. 当前基线
 
 - 当前仓库是 `ai-delivery-workflow` 的维护与发行源码仓库，不是安装了工作流的业务项目。
-- 当前实施分支为 `codex/workflow-manager-foundation`；Workflow Manager 实现在 `ae70304`，外部 Issue 收尾在 `e727af1`。`0.4.0` 的最终候选身份、校验和及生命周期证据记录在维护仓库的 `audit/WORKFLOW-MANAGER-P0-P1-P2-CLOSURE.md`；该记录不随安装包分发，候选包和展开验证工作区保留在被忽略的 `.tmp/`。工作树仍包含用户维护的文档和参考资料变更。
+- 当前正式源码候选版本为 `0.5.1`（待完成发布 Gate）；上一版 `0.5.0` 的提交、Git tag、npm 包身份及 Workflow Manager 的历史 `0.4.0` 候选身份、校验和和生命周期证据仍记录在维护仓库的 `audit/WORKFLOW-MANAGER-P0-P1-P2-CLOSURE.md`，这些历史记录不可改写。候选包和展开验证工作区保留在被忽略的 `.tmp/`。
 - 正式维护源码位于 `bin/`、`lib/`、`skills/`、`docs/`、`verification/` 和 `audit/`。
-- Workflow Manager 设计原型位于 `.tmp/workflow-manager-prototype/`，属于可重建临时物料，不进入发行包，也不等于正式前端已经实现。
+- Workflow Manager 设计原型位于 `prototypes/workflow-manager/`，业务项目原型夹具位于 `prototypes/order-ops-business/`。两者是可版本化设计资产，不进入发行包，也不等于正式前端已经实现；运行时依赖、构建产物和一次性验证工作区仍放在 `.tmp/`。
 
 ## 2. 已进入正式工作流源码
 
@@ -51,11 +51,11 @@
 - Delivery Readiness 后使用 `scope freeze` 冻结范围；只有明确人工批准的 `scope amend` 可以改变范围。
 - Slice 超出逻辑任务数、活跃工时、墙钟时长或阻塞修复轮次预算时，只执行 `scope warn`。其结果固定为 `warn-only` 和 `reslice_performed: false`，不会自动重新切片、重排计划或改变验收。
 - 任务使用一个稳定任务 ID，并在任务内部记录 attempt 和 phase。过去的 `F/R/T/P/vN` 后缀任务模式已被替代。
-- 物料登记、事件分片、可信快照、历史校验、prune 和 compact 已进入正式源码；正式 revision 和审核凭证不可原地覆盖。
+- 物料登记、事件分片、可信快照、历史校验和 prune 已进入正式源码；正式 revision 和审核凭证不可原地覆盖。
 
 ### 2.4 原型优先 UI 治理
 
-- 不再使用 UX-LF。`UX-VS` 负责视觉规范确认，`UX-UI` 负责正式原型审核，两者归入 `02-solution-design`。
+- `UX-VS` 负责视觉规范确认，`UX-UI` 负责正式原型审核，两者归入 `02-solution-design`。
 - 所有用户可见 UI 修改都遵守“先修改隔离 Prototype -> 用户确认 -> 再修改正式前端”，不存在小改、紧急修复或业务逻辑调整例外。
 - 一个项目只有一个逻辑 Prototype。Page 是稳定路由页面，Review Scene 是 Page 的可审核状态；原型必须列出错误、空态、权限、恢复等正式系统中只在条件满足时出现的状态。
 - 页面级 Prototype 审核、Revision/checksum 绑定、Review Shell、Page Receipt、正式前端守卫和 Candidate Assurance UI Acceptance 已进入维护源码。
@@ -67,13 +67,13 @@
 
 - Microcks 是默认项目级 Mock System。External Dependency Mock 和 Product Backend Mock 分开管理；协议定义和 Mock Scenario Pack 可版本化，运行数据库、流量和日志可丢弃。
 - CodeGraph 是可选、可降级的代码导航适配器。工作流只管理项目索引，不安装全局 MCP；不可用时降级到 Semble 和 `rg`，其分析结果不能替代正式 Gate 或既定测试集。
-- 面向旧项目的 Prototype 迁移、UX-LF 契约退役、升级保护报告、UI Acceptance 迁移和历史压缩均已有正式实现和验证。
+- 当前正式路径只接受 `.workflow/`、schema 2 和 v2 Prototype Revision；旧布局、旧 schema 和旧 catalog 由 CLI、HTTP 与 UI 确定性拒绝。
 
 ## 3. 已实现的 Workflow Manager 契约
 
 ### 3.1 产品边界
 
-项目绑定的 Workflow Manager 已取代 Workflow Viewer 和独立的用户可见 Review Server。它负责工作流状态、合法流转、人工决策、项目原型审核、项目系统、Mock、需求、任务、测试、交付成果、事件和设置。
+项目绑定的 Workflow Manager 负责工作流状态、合法流转、人工决策、项目原型审核、项目系统、Mock、需求、任务、测试、交付成果、事件和设置。
 
 Workflow Manager 不是任意命令执行器、文件编辑器或 AI 执行器。它只暴露有契约的读取和变更动作；直接 YAML 修改、任意 shell、任意文件路径和绕过 Gate 均不属于产品能力。
 
@@ -160,16 +160,13 @@ Workflow Manager 从一开始就是人和 AI 共同使用的控制面。UI 与 W
 
 - 当前 P0/P1/P2 候选包的精确路径、SHA-256、文件数和生命周期报告由维护仓库的 `audit/WORKFLOW-MANAGER-P0-P1-P2-CLOSURE.md` 固定登记。审计记录不在 npm 包范围内，因此不会导致候选包自引用；实际 tarball 和展开验证工作区仍保留在 `.tmp/`。
 - 隔离新安装的 Doctor 除可选 CodeGraph 提示外全部通过；安装后 Manager 的主页、健康检查、`workflow-manager.v1` Schema、19 个 Page、七节点投影、25 个可发现受控动作和 r33 Prototype 投影均已实测。
-- 隔离 `0.3.0` 项目的升级、迁移 dry-run、正式升级及回滚已实测。升级 Receipt 为 `UPGRADE-20260812T221812525Z-cde0bf7d`；回滚恢复 `0.3.0`、全部 7 个 Viewer 文件和升级前两个 Git 工作树状态，移除 Manager，并把 Receipt 标记为 `rolled_back`。升级前 Viewer 摘要为 `5cfb8de36f36ccf8149e6f8047e85e48b573a52ef28e67adf35d675497148369`。
-- 候选包已对 `E:\work\ai\codex\tushare` 执行 `doctor`、`upgrade --dry-run` 和 `migrate --dry-run`，没有执行正式 apply。Doctor 识别出该旧安装已有的受管 Skill/运行时完整性漂移；升级计划没有受管资产冲突、不写代码仓库，并计划新增 Manager、替换 8 处受管资产、移除 Viewer。每个 dry-run 前后的工作流 Git 状态摘要一致。维护者于 2026-08-21 明确取消 `tushare` 正式升级/迁移；该项目保持只读，不得再次尝试 apply 或 force。
-- `tushare` 当前不能直接迁移：一个旧 Prototype 来源文件与清单 checksum 不一致，183 个历史任务中有 24 个任务家族需要人工判断语义分组。迁移正确返回 `can_apply=false` 且没有修改业务状态；不得把该结果改写成迁移已就绪，也不得使用 force 绕过人工决策。
 
 ### 4.2 v2 Prototype catalog Candidate Assurance
 
 - 新安装交付把 v2 Prototype Revision 的运行时、Manager、Agent Interface、Experience Skill 和全部必需 catalog 模板列为包表面。`doctor` 在包表面缺失时立即失败，不再继续计算会因缺失运行时而崩溃的受管资产摘要。
-- 新的生产路径只接受 `prototype-revision-catalog.v2`。Experience Skill、Project Template、安装后的 Manager 与 Candidate Assurance 都从同一 Revision/checksum 读取事实；缺少任一必需 catalog 的旧 Revision 被 CLI、HTTP 和 UI 确定性拒绝。`prototype-set.yaml` 及 member 文件仍保留为只读迁移输入，明确标记 `compatibility_mode: read-only-legacy` 和 `current_flow_output: false`，不得作为新流程输出或兼容回退。
+- 新的生产路径只接受 `prototype-revision-catalog.v2`。Experience Skill、Project Template、安装后的 Manager 与 Candidate Assurance 都从同一 Revision/checksum 读取事实；缺少任一必需 catalog 时由 CLI、HTTP 和 UI 确定性拒绝。
 - `verification/workflow-manager.test.mjs` 的隔离 Candidate Assurance 用当前工作树实际执行 `npm pack`，在 `.tmp/` 的独立 consumer 安装 tarball，并由安装后的 `ai-delivery init` 与 `doctor` 建立项目。它用多 Logical Terminal 的 v2 fixture 证明安装后的 Manager CLI、HTTP 和 P07/P11-P17 浏览器 UI 读取同一 Prototype Revision 身份和 checksum：每个 Web UI 请求和返回都显式为 `TERM-WEB`，P12 的 `TERM-ADMIN` 路由实际显示 Admin 目标而不回退到 Web。Component Candidate 通过 P11 提交 `candidate -> under-review`、已安装 CLI 提交 `under-review -> registered`、HTTP 提交 `registered -> modified`；每次 apply 均产生 Receipt/Event，CLI 与 HTTP 均重放同一幂等键。初始 CLI/HTTP 计划仍返回相同 plan/successor；删除 v2 `components` catalog 后，三种入口返回相同受控拒绝。测试覆盖 `1280x720` 与 `1440x900` 桌面视口，且有效 Revision 路径没有浏览器 console error/warn。
-- 可重建证据和边界记录在 `audit/WORKFLOW-MANAGER-V2-CANDIDATE-ASSURANCE.md`。它不声明新的 npm 发布或替代 `audit/WORKFLOW-MANAGER-P0-P1-P2-CLOSURE.md` 的历史候选身份；生成的 tarball、consumer、缓存和浏览器临时文件都留在被忽略的 `.tmp/` 并在测试结束后删除。
+- 可重建证据和边界记录在 `audit/WORKFLOW-MANAGER-V2-CANDIDATE-ASSURANCE.md`。它不替代 `audit/WORKFLOW-MANAGER-P0-P1-P2-CLOSURE.md` 的历史候选身份；`0.5.0` 发布时的源码已通过完整 `release:check`、npm 2FA Gate 并发布。生成的 tarball、consumer、缓存和浏览器临时文件都留在被忽略的 `.tmp/` 并在测试结束后删除。
 
 ## 5. 开放事项
 
@@ -185,14 +182,14 @@ Workflow Manager 从一开始就是人和 AI 共同使用的控制面。UI 与 W
 ### 已关闭的历史 Issue
 
 - [IK89SN](https://gitee.com/hzr1348/work-flow/issues/IK89SN)：P13 已实现 `Ctrl+V` 粘贴图片、持久化、checksum 绑定和 AI 可读附件接口。
-- [IK6HCD](https://gitee.com/hzr1348/work-flow/issues/IK6HCD)：由 Workflow Manager 收敛旧 Viewer 的状态投影需求，避免继续建设重复产品。
-- [IK6HCE](https://gitee.com/hzr1348/work-flow/issues/IK6HCE)：`0.4.0` 候选包、隔离升级/迁移/回滚及 tushare dry-run 均已验证；正式 apply 与发布仍属于独立人工 Gate。
+- [IK6HCD](https://gitee.com/hzr1348/work-flow/issues/IK6HCD)：Workflow Manager 控制面与 P13 附件能力已收敛。
+- [IK6HCE](https://gitee.com/hzr1348/work-flow/issues/IK6HCE)：`0.4.0` 候选包与隔离安装验证已完成；正式发布仍属于独立人工 Gate。
 
 ### 下一阶段顺序
 
 1. P0/P1/P2 及 Prototype 治理 01–07 已完成；实现提交为 `ae70304`，后续 v2 Candidate Assurance 收尾提交为 `db8abfb`，候选验证与 11 个 Gitee Issue 收尾均已完成。
-2. `tushare` 正式升级/迁移已按维护者指示取消并保持只读；不得把历史 dry-run 改写为 apply 许可。
-3. r33 晋级改变了当前源码候选内容，历史 `0.4.0` r8 候选证据仍不可变且不能复用。npm 发布需在干净且同步的 `main` 上重新生成候选并通过 `release:check`、账号/2FA 与人工发布 Gate。
+2. 后续变更继续沿当前 `.workflow/`、schema 2 与 v2 Prototype Revision 契约推进。
+3. r33 晋级改变了当前源码候选内容，历史 `0.4.0` r8 候选证据仍不可变且不能复用；该变更已在 `0.5.0` 中完成发布闭环。后续发布仍需从干净且同步的 `main` 重新生成候选，并通过 `release:check`、账号/2FA 与人工发布 Gate。
 
 ## 6. 继续工作时必须读取的来源
 
@@ -202,4 +199,4 @@ Workflow Manager 从一开始就是人和 AI 共同使用的控制面。UI 与 W
 - Workflow Manager 与 AI 接口：`docs/adr/0003-workflow-manager-governed-control-surface.md`
 - 视觉规范：`docs/adr/0004-operational-carbon-visual-standard.md`
 - 项目原型页面化：`docs/adr/0005-prototype-management-as-routed-pages.md`
-- 当前临时原型说明：`.tmp/workflow-manager-prototype/README.md`
+- 当前原型说明：`prototypes/workflow-manager/README.md`