cc-devflow 4.5.0 → 4.5.2

package/docs/examples/full-design-blocked/changes/REQ-002-bulk-invite-import/review/report-card.json

@@ -3,6 +3,74 @@
   "verdict": "blocked",
   "overall": "fail",
   "summary": "verdict=blocked quick=2/2 strict=0/0 review=blocked",
+  "specAlignment": "blocked",
+  "specDeltaVerified": false,
+  "specSyncReady": false,
+  "runtime": {
+    "status": "blocked",
+    "failureOwnership": [
+      {
+        "failure": "requirement semantics cannot be proven from current design",
+        "classification": "ambiguous",
+        "touchedByDiff": true,
+        "evidence": "duplicate-email and seat-limit outcomes lack a frozen row matrix",
+        "action": "reroute-cc-plan",
+        "status": "open"
+      }
+    ]
+  },
+  "claimEvidence": [
+    {
+      "claim": "tests-pass",
+      "requiredProof": "fresh targeted test command with exit 0",
+      "commandOrArtifact": "npm test -- src/invite/bulk-import.test.ts",
+      "exitStatus": 0,
+      "keyObservation": "targeted bulk invite rule tests passed",
+      "status": "pass"
+    },
+    {
+      "claim": "requirements-met",
+      "requiredProof": "line-by-line planning/tasks.md and task-manifest.json checklist",
+      "commandOrArtifact": "planning/design.md + planning/task-manifest.json",
+      "exitStatus": null,
+      "keyObservation": "duplicate-email and seat-limit semantics are still underspecified",
+      "status": "blocked"
+    }
+  ],
+  "qa": {
+    "status": "blocked",
+    "regressionProof": [],
+    "testQuality": [
+      {
+        "area": "bulk-invite-rules",
+        "checksRealBehavior": true,
+        "mockBoundary": "none",
+        "testOnlyProductionApi": false,
+        "status": "pass"
+      }
+    ],
+    "coverageAudit": {
+      "status": "blocked",
+      "coveragePct": null,
+      "pathMap": ["bulk invite parser", "admin panel happy path"],
+      "gaps": ["duplicate-email row semantics", "seat-limit partial-failure semantics"],
+      "testsAdded": ["src/invite/bulk-import.test.ts", "src/admin/BulkInvitePanel.test.tsx"],
+      "e2eRequired": true,
+      "evalRequired": false,
+      "qualityStars": "★"
+    },
+    "browserEvidence": {
+      "status": "skipped",
+      "mode": "not-applicable",
+      "affectedRoutes": [],
+      "screenshots": [],
+      "consoleErrors": [],
+      "healthScore": null,
+      "issues": [],
+      "skipReason": "design contract is blocked before browser QA can prove the intended behavior"
+    },
+    "tddException": "design contract is incomplete, so tests cannot prove final requirement semantics yet"
+  },
   "quickGates": [
     {
       "name": "bulk-rule-tests",
@@ -22,10 +90,35 @@
     "status": "blocked",
     "summary": "The implementation evidence is real, but the requirement-level design contract is still incomplete",
     "details": "Diff review found that duplicate-email and seat-limit semantics are still not frozen tightly enough to trust the current implementation as the requirement truth.",
+    "freshness": {
+      "status": "fresh",
+      "reviewedCommit": "example-head",
+      "currentCommit": "example-head",
+      "commitsSinceReview": 0,
+      "staleReason": ""
+    },
+    "qualityScore": 6,
+    "specialistReviews": [
+      {
+        "name": "testing",
+        "status": "blocked",
+        "required": true,
+        "summary": "tests are real but cannot cover semantics that are not frozen in design",
+        "skipReason": "",
+        "findings": []
+      }
+    ],
     "taskReviews": {
       "status": "pass",
       "required": true,
       "summary": "All completed tasks carry spec/code proof",
+      "reviewPacket": {
+        "baseSha": "example-base",
+        "headSha": "example-head",
+        "requirements": "planning/tasks.md",
+        "implemented": "bulk invite import implementation",
+        "reviewerContext": "task manifest plus current implementation evidence"
+      },
       "reviewers": [],
       "findings": []
     },
@@ -33,20 +126,64 @@
       "status": "blocked",
       "required": false,
       "summary": "Requirement-level review says the row-outcome matrix must be reopened in planning",
+      "reviewPacket": {
+        "baseSha": "example-base",
+        "headSha": "example-head",
+        "requirements": "planning/design.md",
+        "implemented": "bulk invite import implementation",
+        "reviewerContext": "requirement diff, plan completion, scope drift, docs staleness"
+      },
       "reviewers": [],
       "findings": [
-        "duplicate-email behavior is still underspecified",
-        "seat-limit partial-failure semantics are not frozen in design.md"
+        {
+          "severity": "important",
+          "confidence": "high",
+          "source": "diff-review",
+          "summary": "duplicate-email behavior is still underspecified",
+          "evidence": "planning/design.md does not freeze row-level duplicate semantics",
+          "action": "reroute-cc-plan",
+          "triageStatus": "clarification-needed",
+          "confidenceScore": 9,
+          "fingerprint": "diff-review:bulk-invite:duplicate-email-semantics",
+          "displayTier": "blocking",
+          "suppressionReason": null
+        },
+        {
+          "severity": "important",
+          "confidence": "high",
+          "source": "diff-review",
+          "summary": "seat-limit partial-failure semantics are not frozen in design.md",
+          "evidence": "planning/design.md lacks accepted row-outcome matrix",
+          "action": "reroute-cc-plan",
+          "triageStatus": "clarification-needed",
+          "confidenceScore": 9,
+          "fingerprint": "diff-review:bulk-invite:seat-limit-partial-failure",
+          "displayTier": "blocking",
+          "suppressionReason": null
+        }
       ]
     },
     "findings": [
-      "The current code may be locally green while still violating the intended admin trust model"
+      {
+        "severity": "important",
+        "confidence": "medium",
+        "source": "diff-review",
+        "summary": "The current code may be locally green while still violating the intended admin trust model",
+        "evidence": "tests pass but requirement claim remains blocked by design ambiguity",
+        "action": "reroute-cc-plan",
+        "triageStatus": "clarification-needed",
+        "confidenceScore": 7,
+        "fingerprint": "diff-review:bulk-invite:trust-model-ambiguous",
+        "displayTier": "warning",
+        "suppressionReason": null
+      }
     ]
   },
   "blockingFindings": [
     "design: duplicate-email row handling is not frozen tightly enough",
     "design: seat-limit partial-failure semantics must be reopened in cc-plan"
   ],
+  "gaps": ["duplicate-email row handling", "seat-limit partial-failure semantics"],
   "reroute": "cc-plan",
   "timestamp": "2026-04-16T12:15:00.000Z"
 }

package/docs/examples/full-design-blocked/roadmap-tracking.json

@@ -3,7 +3,7 @@
   "lastSyncedAt": "2026-04-19",
   "backlogMeta": {
     "roadmapVersion": "roadmap.v2",
-    "skillVersion": "4.3.2",
+    "skillVersion": "4.3.4",
     "currentFocusStage": "Stage 2"
   },
   "dependencyHandoff": {

package/docs/examples/local-handoff/BACKLOG.md

@@ -3,7 +3,7 @@
 ## Backlog Meta
 
 - Roadmap version: `roadmap.v2`
-- Skill version: `4.3.2`
+- Skill version: `4.3.4`
 - Last synced: `2026-04-19`
 - Current focus stage: `Stage 2`
 - Tracking source: `roadmap-tracking.json`

package/docs/examples/local-handoff/README.md

@@ -4,7 +4,7 @@
 
 - Example version: `1.0.0`
 - Last reviewed: `2026-04-17`
-- Bound skills: `cc-roadmap@4.3.2`, `cc-plan@3.5.4`, `cc-do@1.5.2`, `cc-check@1.8.2`, `cc-act@1.6.2`
+- Bound skills: `cc-roadmap@4.3.4`, `cc-plan@3.5.6`, `cc-do@1.5.2`, `cc-check@1.8.4`, `cc-act@1.6.4`
 
 This example shows verified work that is **ready to move forward**, but `cc-act` still chooses `local-handoff`.
 

package/docs/examples/local-handoff/ROADMAP.md

@@ -3,7 +3,7 @@
 ## Roadmap Meta
 
 - Roadmap version: `roadmap.v3`
-- Skill version: `4.3.2`
+- Skill version: `4.3.4`
 - Status: `active`
 - Last updated: `2026-04-16`
 - Owner / decider: `product-owner`

package/docs/examples/local-handoff/changes/REQ-003-audit-log-export/planning/design.md

@@ -4,7 +4,7 @@
 
 - Requirement version: `REQ-003.v1`
 - Design version: `design.v1`
-- CC-Plan skill version: `3.5.4`
+- CC-Plan skill version: `3.5.6`
 - Requirement ID: `REQ-003`
 - Design mode: `tiny-design`
 - Why this stays `tiny-design`: the patch adds one export action inside the existing admin audit UI without changing data contracts

package/docs/examples/local-handoff/changes/REQ-003-audit-log-export/planning/tasks.md

@@ -4,7 +4,7 @@
 
 - Requirement version: `REQ-003.v1`
 - Design version: `design.v1`
-- CC-Plan skill version: `3.5.4`
+- CC-Plan skill version: `3.5.6`
 - Source roadmap item: `RM-020`
 - Source roadmap version: `roadmap.v3`
 

package/docs/examples/local-handoff/changes/REQ-003-audit-log-export/review/report-card.json

@@ -3,6 +3,65 @@
   "verdict": "pass",
   "overall": "pass",
   "summary": "verdict=pass quick=2/2 strict=0/0 review=pass",
+  "specAlignment": "pass",
+  "specDeltaVerified": true,
+  "specSyncReady": true,
+  "runtime": {
+    "status": "pass",
+    "failureOwnership": []
+  },
+  "claimEvidence": [
+    {
+      "claim": "tests-pass",
+      "requiredProof": "fresh targeted test command with exit 0",
+      "commandOrArtifact": "npm test -- src/admin/AuditSummaryPanel.test.tsx",
+      "exitStatus": 0,
+      "keyObservation": "audit summary panel targeted tests passed",
+      "status": "pass"
+    },
+    {
+      "claim": "requirements-met",
+      "requiredProof": "line-by-line planning/tasks.md and task-manifest.json checklist",
+      "commandOrArtifact": "planning/tasks.md + planning/task-manifest.json",
+      "exitStatus": null,
+      "keyObservation": "approved tiny-design scope completed",
+      "status": "pass"
+    }
+  ],
+  "qa": {
+    "status": "pass",
+    "regressionProof": [],
+    "testQuality": [
+      {
+        "area": "audit-summary-panel",
+        "checksRealBehavior": true,
+        "mockBoundary": "none",
+        "testOnlyProductionApi": false,
+        "status": "pass"
+      }
+    ],
+    "coverageAudit": {
+      "status": "pass",
+      "coveragePct": 80,
+      "pathMap": ["audit summary render path", "empty audit state"],
+      "gaps": [],
+      "testsAdded": ["src/admin/AuditSummaryPanel.test.tsx"],
+      "e2eRequired": false,
+      "evalRequired": false,
+      "qualityStars": "★★"
+    },
+    "browserEvidence": {
+      "status": "skipped",
+      "mode": "not-applicable",
+      "affectedRoutes": [],
+      "screenshots": [],
+      "consoleErrors": [],
+      "healthScore": null,
+      "issues": [],
+      "skipReason": "local handoff example records component evidence without a live browser fixture"
+    },
+    "tddException": null
+  },
   "quickGates": [
     {
       "name": "targeted-tests",
@@ -22,10 +81,35 @@
     "status": "pass",
     "summary": "Task review proof and requirement-level diff review both passed",
     "details": "The diff stayed inside the approved tiny-design scope and verification evidence is fresh.",
+    "freshness": {
+      "status": "fresh",
+      "reviewedCommit": "example-head",
+      "currentCommit": "example-head",
+      "commitsSinceReview": 0,
+      "staleReason": ""
+    },
+    "qualityScore": 9,
+    "specialistReviews": [
+      {
+        "name": "testing",
+        "status": "pass",
+        "required": true,
+        "summary": "targeted tests cover the audit summary behavior for this example",
+        "skipReason": "",
+        "findings": []
+      }
+    ],
     "taskReviews": {
       "status": "pass",
       "required": true,
       "summary": "All completed tasks carry spec/code proof",
+      "reviewPacket": {
+        "baseSha": "example-base",
+        "headSha": "example-head",
+        "requirements": "planning/tasks.md",
+        "implemented": "audit log export summary view",
+        "reviewerContext": "task manifest plus changed audit panel files"
+      },
       "reviewers": [],
       "findings": []
     },
@@ -33,12 +117,20 @@
       "status": "pass",
       "required": false,
       "summary": "No blocking requirement-level findings",
+      "reviewPacket": {
+        "baseSha": "example-base",
+        "headSha": "example-head",
+        "requirements": "planning/design.md",
+        "implemented": "audit log export summary view",
+        "reviewerContext": "requirement diff, plan completion, scope drift, docs staleness"
+      },
       "reviewers": [],
       "findings": []
     },
     "findings": []
   },
   "blockingFindings": [],
+  "gaps": [],
   "reroute": "none",
   "timestamp": "2026-04-16T14:30:00.000Z"
 }

package/docs/examples/local-handoff/roadmap-tracking.json

@@ -3,7 +3,7 @@
   "lastSyncedAt": "2026-04-19",
   "backlogMeta": {
     "roadmapVersion": "roadmap.v2",
-    "skillVersion": "4.3.2",
+    "skillVersion": "4.3.4",
     "currentFocusStage": "Stage 2"
   },
   "dependencyHandoff": {

package/docs/examples/pdca-loop/BACKLOG.md

@@ -3,7 +3,7 @@
 ## Backlog Meta
 
 - Roadmap version: `roadmap.v1`
-- Skill version: `4.3.2`
+- Skill version: `4.3.4`
 - Last synced: `2026-04-19`
 - Current focus stage: `Stage 1`
 - Tracking source: `roadmap-tracking.json`

package/docs/examples/pdca-loop/README.md

@@ -4,7 +4,7 @@
 
 - Example version: `1.0.0`
 - Last reviewed: `2026-04-17`
-- Bound skills: `cc-roadmap@4.3.2`, `cc-plan@3.5.4`, `cc-do@1.5.2`, `cc-check@1.8.2`, `cc-act@1.6.2`
+- Bound skills: `cc-roadmap@4.3.4`, `cc-plan@3.5.6`, `cc-do@1.5.2`, `cc-check@1.8.4`, `cc-act@1.6.4`
 
 This folder shows one minimal but complete `cc-roadmap -> cc-plan -> cc-do -> cc-check -> cc-act` loop.
 

package/docs/examples/pdca-loop/ROADMAP.md

@@ -3,7 +3,7 @@
 ## Roadmap Meta
 
 - Roadmap version: `roadmap.v1`
-- Skill version: `4.3.2`
+- Skill version: `4.3.4`
 - Status: `active`
 - Last updated: `2026-04-15`
 - Owner / decider: `product-owner`

package/docs/examples/pdca-loop/changes/REQ-001-copy-invite-link/handoff/pr-brief.md

@@ -20,6 +20,25 @@
 - Base branch: `main`
 - PR / MR: not created yet
 
+## Review Range
+
+- Reviewed base SHA: `example-base`
+- Reviewed head SHA: `example-head`
+- Review packet: `planning/tasks.md#T001-T003`; `planning/design.md`
+- Finding triage: no findings
+- QA / claim evidence: `qa=pass`, `tests-pass=pass`, `requirements-met=pass`
+
+## Readiness Dashboard
+
+- Review freshness: `fresh`, reviewed `example-head`, current `example-head`
+- Review quality: `qualityScore=9`
+- Specialist review facets: `testing:pass`
+- QA coverage: `status=pass`, gaps `0`, e2eRequired `false`
+- Browser QA: `skipped`, example fixture uses targeted component evidence instead of a live browser
+- Failure ownership: no open failures recorded
+- Documentation release: README and CLAUDE unchanged for this scoped example
+- PR body accuracy: regenerate the PR body from this brief, current report-card, and current diff
+
 ## Summary
 
 - removes a small but visible sharing friction in the beta flow
@@ -35,6 +54,7 @@
 ## Verification Evidence
 
 - `report-card.json` verdict: `pass`
+- Merged-result verification: not applicable before merge
 - Fresh evidence:
   - `npm test -- src/features/share/ShareDialog.test.tsx`
   - `npm run lint -- src/features/share/ShareDialog.tsx`

package/docs/examples/pdca-loop/changes/REQ-001-copy-invite-link/planning/design.md

@@ -4,7 +4,7 @@
 
 - Requirement version: `REQ-001.v1`
 - Design version: `design.v1`
-- CC-Plan skill version: `3.5.4`
+- CC-Plan skill version: `3.5.6`
 - Requirement ID: `REQ-001`
 - Design mode: `tiny-design`
 - Why this stays `tiny-design`: the patch is limited to an existing dialog and test file, with no API or data model changes

package/docs/examples/pdca-loop/changes/REQ-001-copy-invite-link/planning/task-manifest.json

@@ -9,7 +9,7 @@
   "sourceRoadmap": {
     "itemId": "RM-001",
     "roadmapVersion": "roadmap.v1",
-    "roadmapSkillVersion": "4.3.2",
+    "roadmapSkillVersion": "4.3.4",
     "sourceStage": "Stage 1",
     "successSignal": "Users can copy the invite link with one click",
     "killSignal": "The patch requires backend or permission changes",
@@ -22,7 +22,7 @@
     ]
   },
   "planningMeta": {
-    "reqPlanSkillVersion": "3.5.4",
+    "reqPlanSkillVersion": "3.5.6",
     "designVersion": "design.v1",
     "approvedAt": "2026-04-15T10:05:00.000Z",
     "approvedBy": "user",

package/docs/examples/pdca-loop/changes/REQ-001-copy-invite-link/planning/tasks.md

@@ -4,7 +4,7 @@
 
 - Requirement version: `REQ-001.v1`
 - Design version: `design.v1`
-- CC-Plan skill version: `3.5.4`
+- CC-Plan skill version: `3.5.6`
 - Source roadmap item: `RM-001`
 - Source roadmap version: `roadmap.v1`
 

package/docs/examples/pdca-loop/changes/REQ-001-copy-invite-link/review/report-card.json

@@ -3,6 +3,65 @@
   "verdict": "pass",
   "overall": "pass",
   "summary": "verdict=pass quick=2/2 strict=0/0 review=pass",
+  "specAlignment": "pass",
+  "specDeltaVerified": true,
+  "specSyncReady": true,
+  "runtime": {
+    "status": "pass",
+    "failureOwnership": []
+  },
+  "claimEvidence": [
+    {
+      "claim": "tests-pass",
+      "requiredProof": "fresh targeted test command with exit 0",
+      "commandOrArtifact": "npm test -- src/features/share/ShareDialog.test.tsx",
+      "exitStatus": 0,
+      "keyObservation": "share dialog targeted tests passed",
+      "status": "pass"
+    },
+    {
+      "claim": "requirements-met",
+      "requiredProof": "line-by-line planning/tasks.md and task-manifest.json checklist",
+      "commandOrArtifact": "planning/tasks.md + planning/task-manifest.json",
+      "exitStatus": null,
+      "keyObservation": "T001-T003 complete with spec/code review proof",
+      "status": "pass"
+    }
+  ],
+  "qa": {
+    "status": "pass",
+    "regressionProof": [],
+    "testQuality": [
+      {
+        "area": "share-dialog",
+        "checksRealBehavior": true,
+        "mockBoundary": "none",
+        "testOnlyProductionApi": false,
+        "status": "pass"
+      }
+    ],
+    "coverageAudit": {
+      "status": "pass",
+      "coveragePct": 80,
+      "pathMap": ["copy invite link success path", "clipboard fallback error path"],
+      "gaps": [],
+      "testsAdded": ["src/features/share/ShareDialog.test.tsx"],
+      "e2eRequired": false,
+      "evalRequired": false,
+      "qualityStars": "★★"
+    },
+    "browserEvidence": {
+      "status": "skipped",
+      "mode": "not-applicable",
+      "affectedRoutes": [],
+      "screenshots": [],
+      "consoleErrors": [],
+      "healthScore": null,
+      "issues": [],
+      "skipReason": "example fixture uses targeted component evidence instead of a live browser"
+    },
+    "tddException": null
+  },
   "quickGates": [
     {
       "name": "targeted-tests",
@@ -22,10 +81,35 @@
     "status": "pass",
     "summary": "Task review proof and requirement-level diff review both passed",
     "details": "T001-T003 have matching spec/code review proof and the diff stays inside the approved tiny-design boundary.",
+    "freshness": {
+      "status": "fresh",
+      "reviewedCommit": "example-head",
+      "currentCommit": "example-head",
+      "commitsSinceReview": 0,
+      "staleReason": ""
+    },
+    "qualityScore": 9,
+    "specialistReviews": [
+      {
+        "name": "testing",
+        "status": "pass",
+        "required": true,
+        "summary": "targeted tests cover the share dialog behavior for this example",
+        "skipReason": "",
+        "findings": []
+      }
+    ],
     "taskReviews": {
       "status": "pass",
       "required": true,
       "summary": "All completed tasks carry spec/code proof",
+      "reviewPacket": {
+        "baseSha": "example-base",
+        "headSha": "example-head",
+        "requirements": "planning/tasks.md#T001-T003",
+        "implemented": "copy invite link workflow",
+        "reviewerContext": "task manifest plus changed share dialog files"
+      },
       "reviewers": [],
       "findings": []
     },
@@ -33,12 +117,20 @@
       "status": "pass",
       "required": false,
       "summary": "No blocking requirement-level findings",
+      "reviewPacket": {
+        "baseSha": "example-base",
+        "headSha": "example-head",
+        "requirements": "planning/design.md",
+        "implemented": "copy invite link workflow",
+        "reviewerContext": "requirement diff, plan completion, scope drift, docs staleness"
+      },
       "reviewers": [],
       "findings": []
     },
     "findings": []
   },
   "blockingFindings": [],
+  "gaps": [],
   "reroute": "none",
   "timestamp": "2026-04-15T11:20:00.000Z"
 }

package/docs/examples/pdca-loop/roadmap-tracking.json

@@ -3,7 +3,7 @@
   "lastSyncedAt": "2026-04-19",
   "backlogMeta": {
     "roadmapVersion": "roadmap.v1",
-    "skillVersion": "4.3.2",
+    "skillVersion": "4.3.4",
     "currentFocusStage": "Stage 1"
   },
   "dependencyHandoff": {

package/docs/guides/getting-started.md

@@ -98,6 +98,11 @@ Change truth lives in `devflow/changes/<change>/`.
 - Keep `change-state.json`, `change-meta.json`, planning docs, `task-manifest.json`, optional `team-state.json`, task `checkpoint.json`, `report-card.json`, and one final handoff file under each `devflow/changes/<change>/`.
 - Worker prompts, journals, assignments, and session logs belong under `devflow/workspaces/<change>/` as ephemeral scratch.
 
+Planning handoffs should be evidence-rich before implementation starts:
+
+- `cc-roadmap` records planning posture, evidence maturity, framing check, dependency graph, and any developer/operator adoption context.
+- `cc-plan` records option roles, implementation surface, decision horizon, error/rescue map, test framework source, coverage quality, and regression-test requirements when they apply.
+
 Typical public contract fields:
 
 - `triggers`, `reads`, structured `writes`, `effects`

package/docs/guides/getting-started.zh-CN.md

@@ -97,6 +97,11 @@ durable truth 分两层：
 - `devflow/changes/<change>/`：变更真相，保留 `change-state.json`、`change-meta.json`、planning 文档、`task-manifest.json`、可选 `team-state.json`、任务级 `checkpoint.json`、`report-card.json` 和唯一的最终 handoff 文件。
 - worker prompt、journal、assignment、session log 统一放到 `devflow/workspaces/<change>/`，作为 ephemeral scratch。
 
+进入实现前，planning handoff 应该先把证据写实：
+
+- `cc-roadmap` 记录 planning posture、evidence maturity、framing check、依赖图，以及适用时的 developer/operator adoption context。
+- `cc-plan` 记录 option roles、implementation surface、decision horizon、error/rescue map、测试框架来源、覆盖质量，以及适用时的 regression-test requirement。
+
 公开契约字段的典型形状：
 
 - `triggers`、`reads`、结构化 `writes`、`effects`