cc-devflow 4.3.0 → 4.4.1

package/docs/examples/full-design-blocked/changes/REQ-002-bulk-invite-import/planning/tasks.md

@@ -0,0 +1,78 @@
+# TASKS
+
+## Plan Meta
+
+- Requirement version: `REQ-002.v2`
+- Design version: `design.v2`
+- CC-Plan skill version: `3.5.3`
+- Source roadmap item: `RM-010`
+- Source roadmap version: `roadmap.v2`
+
+## Execution Handoff
+
+- Canonical design: `design.md`
+- Execution mode: `single-path`
+- Frozen decisions:
+  - bulk invite results must classify each row
+  - audit behavior must match visible results
+- Read first:
+  - `design.md`
+  - `src/admin/BulkInvitePanel.tsx`
+  - `src/invite/bulk-import.ts`
+  - `src/audit/invite-log.ts`
+- Commands to trust:
+  - `npm test -- src/invite/bulk-import.test.ts`
+  - `npm test -- src/admin/BulkInvitePanel.test.tsx`
+- Do not re-decide:
+  - duplicate handling semantics
+  - seat-limit fallback behavior
+  - audit row-result contract
+- Parallel boundaries: no parallel execution until row-outcome semantics are frozen
+
+## Phase 1: Rule Matrix
+
+- [x] T001 [TEST] Add failing tests for duplicate and over-limit row outcomes (dependsOn:none) `src/invite/bulk-import.test.ts`
+  Goal: 先把最危险的 bulk invite 行为变成红灯。
+  Files: `src/invite/bulk-import.test.ts`
+  Read first: `design.md`, `src/invite/bulk-import.ts`
+  Verification: `npm test -- src/invite/bulk-import.test.ts`
+  Evidence: failing output
+  Ready when: 当前规则文件已经可定位
+
+- [x] T002 [IMPL] Implement the initial bulk invite row classification (dependsOn:T001) `src/invite/bulk-import.ts`
+  Goal: 给 duplicate / over-limit 行为一个最小实现。
+  Files: `src/invite/bulk-import.ts`
+  Read first: `design.md`, `src/invite/bulk-import.test.ts`
+  Verification: `npm test -- src/invite/bulk-import.test.ts`
+  Evidence: passing output + checkpoint
+  Ready when: T001 已见红
+
+## Phase 2: Surface Integration
+
+- [x] T003 [TEST] Add failing admin panel tests for mixed CSV results (dependsOn:T002) `src/admin/BulkInvitePanel.test.tsx`
+  Goal: 在 UI 层看到 mixed row outcomes 的真实表现。
+  Files: `src/admin/BulkInvitePanel.test.tsx`
+  Read first: `design.md`, `src/admin/BulkInvitePanel.tsx`
+  Verification: `npm test -- src/admin/BulkInvitePanel.test.tsx`
+  Evidence: failing output
+  Ready when: T002 已完成
+
+- [x] T004 [IMPL] Render bulk invite results in the admin panel (dependsOn:T003) `src/admin/BulkInvitePanel.tsx`
+  Goal: 把 row outcomes 接进管理界面。
+  Files: `src/admin/BulkInvitePanel.tsx`
+  Read first: `design.md`, `src/admin/BulkInvitePanel.test.tsx`
+  Verification: `npm test -- src/admin/BulkInvitePanel.test.tsx`
+  Evidence: passing output + review notes
+  Ready when: T003 已见红
+
+## Phase 3: Verification
+
+- [x] T005 Run mixed-surface checks and gather review evidence (dependsOn:T004) `bulk invite quality gates`
+  Goal: 为 `cc-check` 准备 bulk invite 的新鲜证据。
+  Files: `src/admin/BulkInvitePanel.tsx`, `src/invite/bulk-import.ts`
+  Read first: `tasks.md`, `task-manifest.json`
+  Verification:
+  - `npm test -- src/invite/bulk-import.test.ts`
+  - `npm test -- src/admin/BulkInvitePanel.test.tsx`
+  Evidence: passing output + review notes
+  Ready when: T004 已完成

package/docs/examples/full-design-blocked/changes/REQ-002-bulk-invite-import/review/report-card.json

@@ -0,0 +1,52 @@
+{
+  "changeId": "REQ-002",
+  "verdict": "blocked",
+  "overall": "fail",
+  "summary": "verdict=blocked quick=2/2 strict=0/0 review=blocked",
+  "quickGates": [
+    {
+      "name": "bulk-rule-tests",
+      "status": "pass",
+      "command": "npm test -- src/invite/bulk-import.test.ts",
+      "summary": "targeted bulk invite rule tests passed"
+    },
+    {
+      "name": "admin-panel-tests",
+      "status": "pass",
+      "command": "npm test -- src/admin/BulkInvitePanel.test.tsx",
+      "summary": "admin panel tests passed for the current diff"
+    }
+  ],
+  "strictGates": [],
+  "review": {
+    "status": "blocked",
+    "summary": "The implementation evidence is real, but the requirement-level design contract is still incomplete",
+    "details": "Diff review found that duplicate-email and seat-limit semantics are still not frozen tightly enough to trust the current implementation as the requirement truth.",
+    "taskReviews": {
+      "status": "pass",
+      "required": true,
+      "summary": "All completed tasks carry spec/code proof",
+      "reviewers": [],
+      "findings": []
+    },
+    "diffReview": {
+      "status": "blocked",
+      "required": false,
+      "summary": "Requirement-level review says the row-outcome matrix must be reopened in planning",
+      "reviewers": [],
+      "findings": [
+        "duplicate-email behavior is still underspecified",
+        "seat-limit partial-failure semantics are not frozen in design.md"
+      ]
+    },
+    "findings": [
+      "The current code may be locally green while still violating the intended admin trust model"
+    ]
+  },
+  "blockingFindings": [
+    "design: duplicate-email row handling is not frozen tightly enough",
+    "design: seat-limit partial-failure semantics must be reopened in cc-plan"
+  ],
+  "reroute": "cc-plan",
+  "timestamp": "2026-04-16T12:15:00.000Z"
+}

package/docs/examples/full-design-blocked/roadmap-tracking.json

@@ -0,0 +1,50 @@
+{
+  "version": 2,
+  "lastSyncedAt": "2026-04-19",
+  "backlogMeta": {
+    "roadmapVersion": "roadmap.v2",
+    "skillVersion": "4.3.1",
+    "currentFocusStage": "Stage 2"
+  },
+  "dependencyHandoff": {
+    "serialSpine": "RM-010",
+    "parallelReadyNextWave": "-",
+    "notesOnBlockers": "verification is blocked until the import contract covers limits, duplicates, billing, and audit consistency"
+  },
+  "items": [
+    {
+      "rmId": "RM-010",
+      "item": "Add CSV bulk invite import for admins",
+      "stage": "Stage 2",
+      "priority": "P1",
+      "primaryCapability": "cap-bulk-invite-import",
+      "secondaryCapabilities": [
+        "cap-workspace-membership"
+      ],
+      "expectedSpecDelta": "define import semantics before widening current truth",
+      "dependsOn": [],
+      "status": "Verification blocked",
+      "req": "REQ-002",
+      "progress": "80%",
+      "backlog": {
+        "capabilityGap": "admins can invite one user at a time but cannot safely import invite batches",
+        "evidence": "sales onboarding asks for spreadsheet-scale invites",
+        "parallelWith": [],
+        "unknowns": "duplicate-email policy, seat enforcement, audit fan-out",
+        "nextDecision": "reroute to full design before more execution work",
+        "ready": true,
+        "whyNow": "demand is real, but the contract is too wide to keep improvising in code",
+        "successSignal": "the capability has a trusted import contract before implementation resumes",
+        "entryConstraints": "must freeze limits, duplicates, warnings, and audit behavior first",
+        "openRisks": "another partial implementation pass would deepen the semantic drift",
+        "firstPlanningQuestion": "which subflows share one import contract and which need explicit splits?",
+        "requiredContextToLoad": "invite limits, billing rules, duplicate handling, audit logging",
+        "whyReadyNow": "the blocker is design truth, not implementation effort",
+        "parked": false,
+        "parkedReason": "",
+        "triggerToReopen": "",
+        "missingEvidence": ""
+      }
+    }
+  ]
+}

package/docs/examples/local-handoff/BACKLOG.md

@@ -0,0 +1,45 @@
+# BACKLOG
+
+## Backlog Meta
+
+- Roadmap version: `roadmap.v2`
+- Skill version: `4.3.1`
+- Last synced: `2026-04-19`
+- Current focus stage: `Stage 2`
+- Tracking source: `roadmap-tracking.json`
+
+## Queue
+
+| RM-ID | Title | Source Stage | Priority | Primary Capability | Secondary Capabilities | Capability Gap | Expected Spec Delta | Evidence | Depends On | Parallel With | Unknowns | Next Decision | Ready |
+|------|------|------|------|------|------|------|------|------|------|------|------|------|------|
+| RM-020 | Add an audit-log export summary download | Stage 2 | P1 | cap-audit-log-export | - | admins can export raw audit data but not a compact summary for review | codify local export summary truth | support escalations keep asking for a lightweight summary bundle | - | - | csv-only or csv-plus-markdown summary | resume from local handoff once remote access returns | Yes |
+
+## Dependency Handoff
+
+- Serial spine: RM-020
+- Parallel-ready next wave: -
+- Notes on blockers: export work stays local-only until the next maintainer has remote access
+
+## Ready For Req-Plan
+
+- RM-020:
+  - Primary Capability: `cap-audit-log-export`
+  - Secondary Capabilities: `-`
+  - Why now: the implementation and proof already exist, only the landing path is deferred
+  - Success signal: admins can download a concise audit summary without manual spreadsheet cleanup
+  - Entry constraints: stay local-only and avoid remote automation
+  - Capability gap: admins can export raw audit data but not a compact summary for review
+  - Expected spec delta: codify local export summary truth
+  - Open risks: handoff may age if schema changes before the next maintainer resumes
+  - First planning question: does the summary format need another review before remote landing?
+  - Required context to load: admin export screen, generated summary fixture, local handoff notes
+  - Depends On: `-`
+  - Parallel With: `-`
+  - Why this is ready now: the requirement is already proven and only needs a clean resume point
+
+## Parked
+
+- RM-XXX:
+  - Reason parked:
+  - Trigger to reopen:
+  - Missing evidence:

package/docs/examples/local-handoff/README.md

@@ -0,0 +1,56 @@
+# Local-Handoff Example
+
+## Example Meta
+
+- Example version: `1.0.0`
+- Last reviewed: `2026-04-17`
+- Bound skills: `cc-roadmap@4.3.1`, `cc-plan@3.5.3`, `cc-do@1.5.1`, `cc-check@1.8.1`, `cc-act@1.6.1`
+
+This example shows verified work that is **ready to move forward**, but `cc-act` still chooses `local-handoff`.
+
+That is not a failure.
+
+It simply means:
+
+- the requirement passed verification
+- a PR or remote push is intentionally not the next action
+- the workflow still must leave a clean handoff for the next maintainer
+
+## Scenario
+
+The fictional product now adds a downloadable audit-log export summary inside the admin console.
+
+The implementation is done and verified.
+
+But the current environment is local-only:
+
+- remote access is unavailable
+- the branch should not be pushed yet
+- another maintainer will pick it up later
+
+## What To Look For
+
+1. Why `cc-check` is `pass`
+2. Why `cc-act` still does not choose `create-pr`
+3. How `resume-index.md` becomes the only final handoff file
+
+## Artifact Map
+
+- `ROADMAP.md`
+- `roadmap-tracking.json` (shared roadmap/backlog truth)
+- `BACKLOG.md`
+- `changes/REQ-003-audit-log-export/planning/design.md`
+- `changes/REQ-003-audit-log-export/planning/tasks.md`
+- `changes/REQ-003-audit-log-export/planning/task-manifest.json`
+- `changes/REQ-003-audit-log-export/review/report-card.json`
+- `changes/REQ-003-audit-log-export/handoff/resume-index.md`
+
+## Why There Is No `pr-brief.md`
+
+This sample intentionally chooses `local-handoff`.
+
+That mode needs:
+
+- `resume-index.md`
+
+It does **not** require a PR brief yet.

package/docs/examples/local-handoff/ROADMAP.md

@@ -0,0 +1,45 @@
+# ROADMAP
+
+## Roadmap Meta
+
+- Roadmap version: `roadmap.v3`
+- Skill version: `4.3.1`
+- Status: `active`
+- Last updated: `2026-04-16`
+- Owner / decider: `product-owner`
+- Current focus stage: `Stage 2`
+- Confidence: `medium`
+- Supersedes roadmap version: `roadmap.v2`
+
+## Context Snapshot
+
+- Product / repo: `workspace-lite`
+- Project stage: collaboration and admin reporting are now both in use
+- Users: workspace admins reviewing activity and sharing reports internally
+- Pain: admins can inspect audit events, but cannot export a concise summary
+- Existing workaround: manually copy rows into an internal note
+- Strongest demand evidence: admins ask for a downloadable summary during weekly reviews
+- Why now: admin trust now depends on visibility and operational clarity
+- Distribution path: internal admin beta
+- Deadline / forcing function: internal ops review on `2026-04-25`
+- Team / capacity: one engineer
+- Hard constraints: keep export local to the current admin console
+- Adoption / trust bottleneck: admins want proof they can take activity history out of the UI cleanly
+- Known unknowns: whether CSV alone is enough or if JSON export will be needed later
+
+## Recommended Route
+
+- Recommendation: `wedge-first`
+- Why this route wins now: a simple downloadable summary removes the current reporting pain without broader analytics work
+- Why the rejected routes lose now: platform and rescue variants add scope before the current operator need is solved
+- First signal to watch: admins can finish weekly review without copying rows manually
+- Kill signal / stop condition: if export requires a shared reporting pipeline redesign
+
+## Implementation Tracking
+- Tracking source: `roadmap-tracking.json`
+
+<!-- roadmap-tracking:start -->
+| RM-ID | Item | Stage | Priority | Primary Capability | Secondary Capabilities | Expected Spec Delta | Depends On | Status | REQ | Progress |
+|------|------|------|------|------|------|------|------|------|------|------|
+| RM-020 | Add an audit-log export summary download | Stage 2 | P1 | cap-audit-log-export | - | codify local export summary truth | - | Local handoff | REQ-003 | 100% |
+<!-- roadmap-tracking:end -->

package/docs/examples/local-handoff/changes/REQ-003-audit-log-export/handoff/resume-index.md

@@ -0,0 +1,39 @@
+# Resume Index
+
+## Current Reality
+
+- Requirement: `REQ-003`
+- Roadmap item: `RM-020`
+- Verification state: `pass`
+- Ship mode: `local-handoff`
+- Current branch: `feature/audit-summary-export`
+- Blocking environment fact: remote push / PR creation is unavailable right now
+
+## What Is Already Done
+
+- design approved as `tiny-design`
+- implementation tasks `T001-T003` completed
+- targeted test and lint evidence collected
+- `report-card.json` confirms `pass`
+
+## Next Entry
+
+- when remote access is restored, rerun `detect-ship-target`
+- if the branch still has no PR, switch from `local-handoff` to `create-pr`
+- use `resume-index.md` and `report-card.json` as the truth sources for the next ship step
+
+## Read First
+
+- `design.md`
+- `tasks.md`
+- `task-manifest.json`
+- `report-card.json`
+
+## How To Re-Verify
+
+- `npm test -- src/admin/AuditSummaryPanel.test.tsx`
+- `npm run lint -- src/admin/AuditSummaryPanel.tsx`
+
+## Open Follow-Up
+
+- if operators ask for JSON or scheduled exports, lift that into a new roadmap item instead of reopening `REQ-003`

package/docs/examples/local-handoff/changes/REQ-003-audit-log-export/handoff/status.md

@@ -0,0 +1,29 @@
+# Status Report
+
+## Requirement
+
+- Change ID: `REQ-003`
+- Roadmap item: `RM-020`
+- Current state: verified and ready for `local-handoff`
+
+## What Is True Now
+
+- The admin audit summary panel can export the currently visible summary rows as CSV
+- The patch stayed inside the approved `tiny-design` boundary
+- Fresh targeted test and lint evidence both passed
+- `cc-check` returned `pass`
+
+## Ship Decision
+
+- Recommended mode: `local-handoff`
+- Why now: the work is verified, but remote push / PR creation is intentionally unavailable in this environment
+- Why not others:
+  - not `create-pr`: remote access is unavailable
+  - not `update-pr`: there is no existing PR to refresh
+  - not `post-merge-closeout`: the change is not merged yet
+
+## Docs And Follow-Up
+
+- README / release docs: unchanged; this is not a public release step
+- Backlog writeback: if admins request additional export formats, open a new roadmap item
+- Next entry point: use `resume-index.md` to pick up the branch when remote access becomes available

package/docs/examples/local-handoff/changes/REQ-003-audit-log-export/planning/design.md

@@ -0,0 +1,71 @@
+# DESIGN
+
+## Document Meta
+
+- Requirement version: `REQ-003.v1`
+- Design version: `design.v1`
+- CC-Plan skill version: `3.5.3`
+- Requirement ID: `REQ-003`
+- Design mode: `tiny-design`
+- Why this stays `tiny-design`: the patch adds one export action inside the existing admin audit UI without changing data contracts
+- Approval status: `approved`
+- Source roadmap item: `RM-020`
+- Source roadmap version: `roadmap.v3`
+
+## Source Handoff
+
+- Why now: admins need a lightweight way to take weekly activity summaries out of the UI
+- Inherited success signal: admins can download the summary without manual row copying
+- Inherited kill signal: if export requires a shared reporting pipeline, reopen planning
+- Inherited non-goals: no JSON export mode, no scheduled reporting
+- Upstream evidence: repeated internal admin requests during weekly reviews
+
+## Frozen Design Card
+
+- Change: add a `Download summary` action that exports the visible audit summary rows as CSV
+- Keep out: no multi-format export and no shared reporting backend
+- Touched files:
+  - `src/admin/AuditSummaryPanel.tsx`
+  - `src/admin/AuditSummaryPanel.test.tsx`
+- Contract changes: none; reuse the existing summary rows already shown in the panel
+- Key decisions that `cc-do` must not re-decide:
+  - export only what is already visible in the panel
+  - use CSV as the single output format
+  - keep the action inside the current admin panel
+- Upgrade trigger to `full-design`: if export needs background generation or new reporting contracts
+
+## Validation
+
+- Primary check: targeted panel test proves the export action is available and uses current summary rows
+- Secondary checks:
+  - existing audit summary rendering stays green
+  - lint passes for the touched panel
+- Evidence to collect:
+  - failing test before implementation
+  - passing test and lint after implementation
+
+## Main Risk
+
+- Risk: admins may soon ask for more export formats
+- Mitigation: treat JSON or scheduled exports as later roadmap items
+
+## Review Gate
+
+- Placeholder scan: pass
+- Consistency scan: pass
+- Scope scan: pass
+- Ambiguity scan: pass
+- Feasibility scan: pass
+- Final recommendation: approved as `tiny-design`
+
+## Approval
+
+- User approval status: approved
+- Deferred questions:
+  - if admins ask for machine-readable export next, open a separate requirement
+
+## First-Read Test
+
+- 一眼能看出这次为什么够小
+- 一眼能看出什么情况会逼它升级成 `full-design`
+- `cc-do` 看完不会继续追问“导出的字段从哪里来”

package/docs/examples/local-handoff/changes/REQ-003-audit-log-export/planning/task-manifest.json

@@ -0,0 +1,98 @@
+{
+  "changeId": "REQ-003",
+  "goal": "Add a local CSV export for the existing audit summary panel without introducing new reporting contracts.",
+  "createdAt": "2026-04-16T13:00:00.000Z",
+  "updatedAt": "2026-04-16T14:20:00.000Z",
+  "requirementId": "REQ-003",
+  "requirementVersion": "REQ-003.v1",
+  "currentTaskId": null,
+  "activePhase": null,
+  "tasks": [
+    {
+      "id": "T001",
+      "title": "[TEST] Add a failing test for the missing download action",
+      "type": "TEST",
+      "phase": 1,
+      "parallel": false,
+      "dependsOn": [],
+      "touches": ["audit-summary", "tests"],
+      "files": ["src/admin/AuditSummaryPanel.test.tsx"],
+      "run": ["npm test -- src/admin/AuditSummaryPanel.test.tsx"],
+      "checks": ["test fails before implementation"],
+      "acceptance": ["the missing download action is reproduced as a failing test"],
+      "verification": ["npm test -- src/admin/AuditSummaryPanel.test.tsx"],
+      "evidence": ["failing test output"],
+      "context": {
+        "readFiles": ["design.md", "tasks.md", "src/admin/AuditSummaryPanel.tsx"],
+        "commands": ["npm test -- src/admin/AuditSummaryPanel.test.tsx"],
+        "notes": ["stay inside the current audit summary panel"]
+      },
+      "reviews": { "spec": "pass", "code": "pass" },
+      "status": "passed",
+      "attempts": 1,
+      "maxRetries": 1
+    },
+    {
+      "id": "T002",
+      "title": "[IMPL] Add the download summary action",
+      "type": "IMPL",
+      "phase": 1,
+      "parallel": false,
+      "dependsOn": ["T001"],
+      "touches": ["audit-summary"],
+      "files": ["src/admin/AuditSummaryPanel.tsx"],
+      "run": ["npm test -- src/admin/AuditSummaryPanel.test.tsx"],
+      "checks": ["panel test passes"],
+      "acceptance": ["admins can trigger a CSV download from the existing summary panel"],
+      "verification": ["npm test -- src/admin/AuditSummaryPanel.test.tsx"],
+      "evidence": ["passing test output", "checkpoint summary"],
+      "context": {
+        "readFiles": ["design.md", "tasks.md", "src/admin/AuditSummaryPanel.test.tsx"],
+        "commands": ["npm test -- src/admin/AuditSummaryPanel.test.tsx"],
+        "notes": ["reuse visible summary rows as the export source"]
+      },
+      "reviews": { "spec": "pass", "code": "pass" },
+      "status": "passed",
+      "attempts": 1,
+      "maxRetries": 1
+    },
+    {
+      "id": "T003",
+      "title": "Run targeted checks and collect handoff evidence",
+      "type": "OTHER",
+      "phase": 2,
+      "parallel": false,
+      "dependsOn": ["T002"],
+      "touches": ["quality-gates"],
+      "files": ["src/admin/AuditSummaryPanel.tsx", "src/admin/AuditSummaryPanel.test.tsx"],
+      "run": [
+        "npm test -- src/admin/AuditSummaryPanel.test.tsx",
+        "npm run lint -- src/admin/AuditSummaryPanel.tsx"
+      ],
+      "checks": ["targeted tests pass", "lint passes"],
+      "acceptance": ["fresh verification evidence exists for local handoff"],
+      "verification": [
+        "npm test -- src/admin/AuditSummaryPanel.test.tsx",
+        "npm run lint -- src/admin/AuditSummaryPanel.tsx"
+      ],
+      "evidence": ["passing test output", "clean lint output"],
+      "context": {
+        "readFiles": ["tasks.md", "task-manifest.json"],
+        "commands": [
+          "npm test -- src/admin/AuditSummaryPanel.test.tsx",
+          "npm run lint -- src/admin/AuditSummaryPanel.tsx"
+        ],
+        "notes": ["remote push is intentionally out of scope for this example"]
+      },
+      "reviews": { "spec": "pass", "code": "pass" },
+      "status": "passed",
+      "attempts": 1,
+      "maxRetries": 1
+    }
+  ],
+  "metadata": {
+    "source": "tasks.md",
+    "generatedBy": "docs-example",
+    "planVersion": 1
+  }
+}

package/docs/examples/local-handoff/changes/REQ-003-audit-log-export/planning/tasks.md

@@ -0,0 +1,59 @@
+# TASKS
+
+## Plan Meta
+
+- Requirement version: `REQ-003.v1`
+- Design version: `design.v1`
+- CC-Plan skill version: `3.5.3`
+- Source roadmap item: `RM-020`
+- Source roadmap version: `roadmap.v3`
+
+## Execution Handoff
+
+- Canonical design: `design.md`
+- Execution mode: `single-path`
+- Frozen decisions:
+  - export only the visible audit summary rows
+  - CSV is the only format in this requirement
+- Read first:
+  - `design.md`
+  - `src/admin/AuditSummaryPanel.tsx`
+  - `src/admin/AuditSummaryPanel.test.tsx`
+- Commands to trust:
+  - `npm test -- src/admin/AuditSummaryPanel.test.tsx`
+  - `npm run lint -- src/admin/AuditSummaryPanel.tsx`
+- Do not re-decide:
+  - summary row source
+  - export format
+  - panel placement
+- Parallel boundaries: none
+
+## Phase 1: Foundation
+
+- [x] T001 [TEST] Add a failing test for the missing download action (dependsOn:none) `src/admin/AuditSummaryPanel.test.tsx`
+  Goal: 证明现在还没有可下载的 summary export。
+  Files: `src/admin/AuditSummaryPanel.test.tsx`
+  Read first: `design.md`, `src/admin/AuditSummaryPanel.tsx`
+  Verification: `npm test -- src/admin/AuditSummaryPanel.test.tsx`
+  Evidence: failing output
+  Ready when: 当前 audit summary test 已可运行
+
+- [x] T002 [IMPL] Add the download summary action (dependsOn:T001) `src/admin/AuditSummaryPanel.tsx`
+  Goal: 用最小实现让 summary export 真的可用。
+  Files: `src/admin/AuditSummaryPanel.tsx`
+  Read first: `design.md`, `src/admin/AuditSummaryPanel.test.tsx`
+  Verification: `npm test -- src/admin/AuditSummaryPanel.test.tsx`
+  Evidence: passing output + checkpoint
+  Ready when: T001 已见红
+
+## Phase 2: Verify
+
+- [x] T003 Run targeted checks and collect handoff evidence (dependsOn:T002) `audit summary quality gates`
+  Goal: 为 `cc-check` 和 `cc-act` 留下这次导出改动的真实证据。
+  Files: `src/admin/AuditSummaryPanel.tsx`, `src/admin/AuditSummaryPanel.test.tsx`
+  Read first: `tasks.md`, `task-manifest.json`
+  Verification:
+  - `npm test -- src/admin/AuditSummaryPanel.test.tsx`
+  - `npm run lint -- src/admin/AuditSummaryPanel.tsx`
+  Evidence: passing output + clean lint output
+  Ready when: T002 已完成

package/docs/examples/local-handoff/changes/REQ-003-audit-log-export/review/report-card.json

@@ -0,0 +1,44 @@
+{
+  "changeId": "REQ-003",
+  "verdict": "pass",
+  "overall": "pass",
+  "summary": "verdict=pass quick=2/2 strict=0/0 review=pass",
+  "quickGates": [
+    {
+      "name": "targeted-tests",
+      "status": "pass",
+      "command": "npm test -- src/admin/AuditSummaryPanel.test.tsx",
+      "summary": "audit summary panel targeted tests passed"
+    },
+    {
+      "name": "lint",
+      "status": "pass",
+      "command": "npm run lint -- src/admin/AuditSummaryPanel.tsx",
+      "summary": "lint passed for the touched panel file"
+    }
+  ],
+  "strictGates": [],
+  "review": {
+    "status": "pass",
+    "summary": "Task review proof and requirement-level diff review both passed",
+    "details": "The diff stayed inside the approved tiny-design scope and verification evidence is fresh.",
+    "taskReviews": {
+      "status": "pass",
+      "required": true,
+      "summary": "All completed tasks carry spec/code proof",
+      "reviewers": [],
+      "findings": []
+    },
+    "diffReview": {
+      "status": "pass",
+      "required": false,
+      "summary": "No blocking requirement-level findings",
+      "reviewers": [],
+      "findings": []
+    },
+    "findings": []
+  },
+  "blockingFindings": [],
+  "reroute": "none",
+  "timestamp": "2026-04-16T14:30:00.000Z"
+}