bmad-speckit-sdd-flow 1.0.3 → 1.2.0

package/README.md

@@ -7,7 +7,7 @@ English | [简体中文](README.zh-CN.md)
 </p>
 
 <h3 align="center">
-  Governed Spec-Driven AI Delivery for Cursor and Claude Code
+  Governed Spec-Driven AI Delivery for Cursor, Claude Code, and Codex
 </h3>
 
 <p align="center">
@@ -79,6 +79,7 @@ This is the verified off-repo path for the published package contract.
 npx --yes --package bmad-speckit-sdd-flow@latest bmad-speckit version
 npx --yes --package bmad-speckit-sdd-flow@latest bmad-speckit-init . --agent claude-code --full --no-package-json
 npx --yes --package bmad-speckit-sdd-flow@latest bmad-speckit-init . --agent cursor --full --no-package-json
+npx --yes --package bmad-speckit-sdd-flow@latest bmad-speckit-init . --agent codex --full --no-package-json
 npx --yes --package bmad-speckit-sdd-flow@latest bmad-speckit check
 npx --yes --package bmad-speckit-sdd-flow@latest bmad-speckit dashboard-status
 ```

package/_bmad/_config/AUDIT_PROMPTS_STRATEGY.md

@@ -3,7 +3,7 @@
 ## 现状
 
 - **`_bmad/i18n/manifests/*.yaml`**：已有 `zh` / `en` 键，由 `scripts/i18n/render-template.ts` 渲染，**与 `references/audit-prompts*.md` 不是同一条管线**。
-- **`audit-prompts*.md`**：`code-reviewer-config.yaml` 的 `prompt_template` 写 **stem 文件名**（如 `audit-prompts-code.md`）；**按 locale 选实际文件**由 `resolveAuditPromptPath` + **`getAuditPromptLocaleFromRuntimeContext()`**（读取 `project.json` 的 `languagePolicy`，**不使用环境变量**）完成（见下「加载规则」与 `npm run audit-prompt:resolve`）。
+- **`audit-prompts*.md`**：`code-reviewer-config.yaml` 的 `prompt_template` 写 **stem 文件名**（如 `audit-prompts-code.md`）；**按 locale 选实际文件**由 `resolveAuditPromptPath` + 当前 Requirement 的 `runtimePolicySnapshot.locale` 完成。不得再读取 `_bmad-output/runtime/context/project.json` 作为 locale 真相源。
 
 ## 维护约定：每个逻辑名 **3 个文件**
 
@@ -20,7 +20,7 @@
 ## 加载规则（已实现）
 
 1. **解析器**：`scripts/i18n/resolve-audit-prompt-path.ts`（单测 `tests/i18n/resolve-audit-prompt-path.test.ts`）。
-2. **locale**：`_bmad-output/runtime/context/project.json` → `languagePolicy.resolvedMode`（`en` → 英文侧车；`zh` / `bilingual` → 中文稿；缺文件或无效字段 → 默认 **zh**）。**禁止**依赖 `BMAD_AUDIT_PROMPTS_LOCALE` 等环境变量。API：**`getAuditPromptLocaleFromRuntimeContext(projectRoot?)`**（同文件导出 `getAuditPromptLocale` 别名）。
+2. **locale**：当前 active Requirement 的 `runtimePolicySnapshot.locale`（`en-US` → 英文侧车；`zh-CN` / `bilingual` → 中文稿）。缺 snapshot、hash 不匹配或字段无效时不得 fallback 到 `project.json`，应 fail closed 或重新 readiness。**禁止**依赖 `BMAD_AUDIT_PROMPTS_LOCALE` 等环境变量。
 3. **解析顺序**：`en` → `{stem}.en.md`，缺则回退 `{stem}.md`；`zh` → `{stem}.zh.md`，缺则 `{stem}.md`。
 4. **IDE/技能**：须在读取模板前调用上述解析器或等价逻辑；`prompt_template` 仍为 **stem 文件名**（如 `audit-prompts-code.md`）。
 
@@ -29,7 +29,7 @@
 - **命令**：`npm run audit-prompt:resolve -- <refsDir> <templateBasename> [projectRoot]`  
   例：`npm run audit-prompt:resolve -- _bmad/cursor/skills/speckit-workflow/references audit-prompts-code.md`
 - **实现**：`scripts/i18n/print-resolved-audit-prompt.ts` — 向 stdout 打印 JSON：`locale`、`projectRoot`、`resolvedPath`、`usedFallback`、`variant`、`exists`。
-- **用途**：子代理脚本、人工校验在**当前 runtime context** 下实际解析到的路径；**不**替代技能内联 `read_file` 逻辑，仅作确定性入口。
+- **用途**：子代理脚本、人工校验在**当前 active Requirement runtimePolicySnapshot** 下实际解析到的路径；**不**替代技能内联 `read_file` 逻辑，仅作确定性入口。
 
 ## 与 TASKS 策略 A/B/C
 

package/_bmad/_config/architecture-confirmation-hash-recipe.contract.yaml

@@ -0,0 +1,124 @@
+schemaVersion: architecture-confirmation-hash-recipe.contract/v1
+recipeVersion: architecture-confirmation-hash/v1
+description: >
+  Canonical hash recipe for requirement-scoped architecture confirmations.
+  Producers, controlled ingest, Implementation Readiness Gate, and Delivery
+  Closeout Gate must resolve this file instead of embedding private hash logic.
+
+canonicalization:
+  encoding: utf8
+  bom: forbidden
+  newline: LF
+  jsonCanonicalization:
+    objectKeyOrder: lexicographic
+    preserveNumberFormat: false
+    preserveInsignificantWhitespace: false
+    nullPolicy: include_explicit_nulls
+  arrayOrdering:
+    targetPaths: lexicographic
+    forbiddenChanges: lexicographic
+    consumerImpactScan: fixed_category_order
+    governanceImpactScan: fixed_category_order
+    fullArchitectureTriggerMatrix: fixed_category_order
+    evidenceRefs: lexicographic
+
+pathNormalization:
+  rootRelative: true
+  separator: /
+  lowercaseWindowsDriveLetter: true
+  trimTrailingSlash: true
+  removeDotSegments: true
+  deduplicate: true
+  sort: lexicographic
+
+fixedCategoryOrder:
+  consumerImpactScan:
+    - product_capability
+    - data_model
+    - api_or_integration
+    - frontend_ux
+    - security_compliance
+    - operations_deployment
+    - reliability_performance
+    - testing_strategy
+    - compatibility_migration
+    - cross_module_impact
+    - user_commitment
+    - ai_automation
+  governanceImpactScan:
+    - shared_schema_type_contract_event_registry
+    - orchestration_hook_gate_ingest_rerun_closeout
+    - scoring_sft_dashboard_data_routes
+    - runtime_policy_registry_host_mode_fallback
+    - consumer_install_skill_hook_template_surface
+
+volatileFieldsExcludedFromArtifactHash:
+  - generatedAt
+  - renderedAt
+  - checkedAt
+  - confirmedAt
+  - htmlPath
+  - htmlHash
+  - renderMetadata
+  - temporaryLogPath
+  - localAbsolutePath
+
+hashInputs:
+  targetPathsHash:
+    includes:
+      - implementationTasks[].targetPaths[]
+      - implementationTasks[].forbiddenChanges[]
+      - consumerInstallSurfacePaths[]
+      - sharedSchemaTypeContractPaths[]
+    normalization: pathNormalization
+  consumerImpactScanHash:
+    includes:
+      - consumerImpactScan[]
+    ordering: fixedCategoryOrder.consumerImpactScan
+  governanceImpactScanHash:
+    includes:
+      - governanceImpactScan[]
+    ordering: fixedCategoryOrder.governanceImpactScan
+  currentArtifactHash:
+    includes:
+      - architecture confirmation JSON body
+    excludes: volatileFieldsExcludedFromArtifactHash
+
+stateTransitionHashCoverage:
+  requiredHashFields:
+    - sourceDocumentHash
+    - implementationConfirmationHash
+    - targetPathsHash
+    - consumerImpactScanHash
+    - governanceImpactScanHash
+    - currentArtifactHash
+    - resolvedRecipeHash
+  eachHashMustDeclareRecipeVersion: true
+  allowedToStatusValues:
+    - active
+    - stale
+    - blocked
+    - missing
+    - superseded
+  allowedReasonCodes:
+    - hash_match
+    - source_hash_mismatch
+    - implementation_confirmation_hash_mismatch
+    - target_paths_hash_mismatch
+    - consumer_impact_scan_hash_mismatch
+    - governance_impact_scan_hash_mismatch
+    - artifact_hash_mismatch
+    - current_confirmation_missing
+    - current_artifact_missing
+    - cannot_validate_current_confirmation
+
+controlledIngestRules:
+  missingRecipeDecision: blocked
+  invalidRecipeDecision: blocked
+  resolverBypassDecision: blocked
+  privateHashLogicDecision: blocked
+  recipeVersionMismatchDecision: blocked
+  hashMismatchDecision: fail
+  hashMatchDecision: pass
+  staleMustBePersisted: true
+  memoryOnlyStaleCheckForbidden: true

package/_bmad/_config/bmads-runtime.yaml

@@ -0,0 +1,193 @@
+schemaVersion: bmads-runtime/v1
+
+contracts:
+  governance: _bmad/_config/orchestration-governance.contract.yaml
+  dispatch: scripts/orchestration-dispatch-contract.ts
+  stageMapping: _bmad/_config/stage-mapping.yaml
+
+entry:
+  canonicalCommand: bmads
+  aliases:
+    - bmad-speckit
+    - $bmads
+    - /bmads
+    - $bmad-speckit
+    - /bmad-speckit
+  advisory:
+    bmadHelpCommand: bmad-help
+    message: Run bmad-help for full BMAD Method workflow guidance.
+
+layers:
+  - id: layer_1
+    name: Product Definition
+    stages:
+      - id: prd
+        governanceStage: prd
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        recommendedWorkflows:
+          - bmad-bmm-create-product-brief
+          - bmad-bmm-create-prd
+          - bmad-bmm-validate-prd
+        evidence:
+          completionMarker: _bmad-output/runtime/context/layer_1-prd.complete.json
+          primaryArtifacts:
+            - _bmad-output/planning-artifacts/{branch}/prd.md
+            - _bmad-output/planning-artifacts/prd.md
+            - _bmad-output/planning-artifacts/product-brief-*.md
+        next:
+          layer: layer_2
+          stage: arch
+
+  - id: layer_2
+    name: Architecture
+    stages:
+      - id: arch
+        governanceStage: arch
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        recommendedWorkflows:
+          - bmad-bmm-create-architecture
+          - bmad-bmm-validate-architecture
+        evidence:
+          primaryArtifacts:
+            - _bmad-output/planning-artifacts/{branch}/architecture.md
+            - _bmad-output/planning-artifacts/architecture.md
+            - docs/architecture/**
+        next:
+          layer: layer_3
+          stage: epics
+
+  - id: layer_3
+    name: Epic And Story Planning
+    stages:
+      - id: epics
+        governanceStage: epics
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        recommendedWorkflows:
+          - bmad-bmm-create-epics-and-stories
+          - bmad-bmm-sprint-planning
+        evidence:
+          primaryArtifacts:
+            - _bmad-output/planning-artifacts/{branch}/epics.md
+            - _bmad-output/planning-artifacts/epics.md
+        next:
+          layer: layer_3
+          stage: story_create
+      - id: story_create
+        governanceStage: story_create
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        recommendedWorkflows:
+          - bmad-bmm-create-epics-and-stories
+          - bmad-bmm-check-implementation-readiness
+          - bmad-bmm-sprint-planning
+          - bmad-bmm-create-story
+        evidence:
+          primaryArtifacts:
+            - _bmad-output/sprint-status.yaml
+            - docs/stories/**
+        next:
+          layer: layer_4
+          stage: specify
+
+  - id: layer_4
+    name: Speckit Implementation
+    stages:
+      - id: specify
+        governanceStage: specify
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        recommendedWorkflows:
+          - speckit-workflow
+        dispatch:
+          taskType: document
+          hosts: [cursor, claude, codex]
+        next:
+          layer: layer_4
+          stage: plan
+      - id: plan
+        governanceStage: plan
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        recommendedWorkflows:
+          - speckit-workflow
+        dispatch:
+          taskType: document
+          hosts: [cursor, claude, codex]
+        next:
+          layer: layer_4
+          stage: gaps
+      - id: gaps
+        governanceStage: gaps
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        recommendedWorkflows:
+          - speckit-workflow
+        dispatch:
+          taskType: audit
+          hosts: [cursor, claude, codex]
+        next:
+          layer: layer_4
+          stage: tasks
+      - id: tasks
+        governanceStage: tasks
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        recommendedWorkflows:
+          - speckit-workflow
+        dispatch:
+          taskType: document
+          hosts: [cursor, claude, codex]
+        next:
+          layer: layer_4
+          stage: implement
+      - id: implement
+        governanceStage: implement
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        recommendedWorkflows:
+          - speckit-workflow
+        dispatch:
+          taskType: implement
+          hosts:
+            - cursor
+            - claude
+            - codex
+        next:
+          layer: layer_5
+          stage: post_audit
+
+  - id: layer_5
+    name: Closeout
+    stages:
+      - id: post_audit
+        governanceStage: post_audit
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        recommendedWorkflows:
+          - bmad-code-reviewer-lifecycle
+        dispatch:
+          taskType: audit
+          hosts: [cursor, claude, codex]
+        next:
+          layer: layer_5
+          stage: pr_review
+      - id: pr_review
+        governanceStage: post_audit
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        gates:
+          required:
+            - pr_topology_closed
+        next:
+          layer: layer_5
+          stage: release_gate
+      - id: release_gate
+        governanceStage: post_audit
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        gates:
+          required:
+            - release_gate
+            - quality_gate
+            - sprint_audit
+        next:
+          layer: layer_5
+          stage: delivery_truth_gate
+      - id: delivery_truth_gate
+        governanceStage: post_audit
+        requiredGovernanceSignalsFrom: orchestration-governance.contract.yaml
+        gates:
+          required:
+            - delivery_truth_gate
+            - long_run_development_evidence

package/_bmad/_config/code-reviewer-config.yaml

@@ -4,7 +4,7 @@
 # - host carrier source: _bmad/cursor/agents/code-reviewer.md / _bmad/claude/agents/code-reviewer.md
 # - route precedence / fallback business rules: scripts/reviewer-registry.ts
 # This file now only owns mode/dimensions/prompt_template configuration and must not become the reviewer carrier truth source again.
-# audit-prompts 多语言：locale 来自 _bmad-output/runtime/context/project.json → languagePolicy.resolvedMode（非 env）。解析见
+# audit-prompts 多语言：locale 来自当前 active Requirement 的 runtimePolicySnapshot.locale（非 env，禁止 fallback 到 project.json）。解析见
 # scripts/i18n/resolve-audit-prompt-path.ts；文件约定见 _bmad/_config/AUDIT_PROMPTS_STRATEGY.md（.md / .zh.md / .en.md）。
 # GAP-009 修复：prompt_template 路径规则
 # GAP-076 修复：prompt_template 路径解析优先级：(1) 相对于 config 文件所在目录；(2) 若不存在则 {SKILLS_ROOT}/speckit-workflow/references/