duaer-spec 0.26.0 → 0.27.0

package/.duaer/active-job.json

@@ -1,5 +1,5 @@
 {
-  "feature": "260-release-026",
-  "branch": "feat/release-026",
-  "worktree": ".worktree/feat-release-026"
+  "feature": "269-release-027",
+  "branch": "chore/release-027",
+  "worktree": ".worktree/chore-release-027"
 }

package/.duaer/specs/260-release-026/delivery.json

@@ -1,18 +1,19 @@
 {
   "status": "accepted",
-  "acceptedAt": "2026-09-20T13:33:00.000Z",
+  "acceptedAt": "2026-09-20T14:14:57.110Z",
   "verification": {
-    "levels": ["docs"],
+    "levels": [
+      "docs"
+    ],
     "commands": [
-      "git push origin develop main",
-      "gh release create v0.26.0",
-      "gh run view 35513791762"
+      "gh workflow run npm-publish.yml --ref main",
+      "npm view duaer-spec version"
     ],
-    "result": "partial",
-    "notes": "GitHub Release v0.26.0 on main. npm Trusted Publishing failed: GitHub Actions account locked (billing). Re-run workflow npm-publish.yml after billing is cleared."
+    "result": "pass",
+    "notes": "npm duaer-spec@0.26.0 published via Trusted Publishing after Duaer repo URL fix"
   },
   "preview": {
-    "url": "https://github.com/Duaer/duaer-spec/releases/tag/v0.26.0",
-    "label": "GitHub Release v0.26.0"
+    "url": "https://www.npmjs.com/package/duaer-spec/v/0.26.0",
+    "label": "npm duaer-spec@0.26.0"
   }
 }

package/.duaer/specs/260-release-026/tasks.md

@@ -1,5 +1,3 @@
-# Tasks: Release 0.26.0
-
 - [x] T001 Bump package.json to 0.26.0 and fold CHANGELOG
 - [x] T002 Merge develop, promote main, push, GitHub release
-- [x] T003 Stamp delivery.json (npm blocked: Actions billing lock — re-run npm-publish.yml after unlock)
+- [x] T003 npm 0.26.0 published (Trusted Publishing + Duaer provenance URL)

package/.duaer/specs/261-fde-baseline-sign/delivery.json

@@ -0,0 +1,10 @@
+{
+  "status": "accepted",
+  "acceptedAt": "2026-09-21T00:20:00.000Z",
+  "summary": "FDE-01: confirm card baseline fields, signed fingerprint gate before kickoff, change order + deliverables.",
+  "verification": {
+    "L0": "node --check bin/duaer-live.mjs web/live-dev/app.js web/live-dev/baseline.mjs bin/live-modules.mjs — pass",
+    "L1": "npm test — 225 pass (incl. baseline-sign)",
+    "L3": "npm run test:live — pass"
+  }
+}

package/.duaer/specs/261-fde-baseline-sign/spec.md

@@ -0,0 +1,37 @@
+# Feature Specification: FDE-01 scope + acceptance baseline sign gate
+
+## Goal
+
+Enforce a signed scope/acceptance baseline before kickoff (联调), per WeCom
+FDE pain FDE-01: no unsigned baseline may enter dispatch; post-sign scope
+changes require an explicit change order and re-sign.
+
+## In scope
+
+- Confirm card fields: device matrix, critical paths, exception cases (feature)
+- Project baseline sign (signer + time + fingerprint of confirmed modules)
+- Kickoff / dispatch hard-blocked until baseline signed and fingerprint matches
+- Change order: reason → unlock modules for re-confirm → clear sign → re-sign
+- Deliverables page shows baseline + change history
+- Docs / E2E / tests
+
+## Out of scope
+
+- Real e-sign / PKI
+- Automatic schedule recalculation
+- Cloud browser matrix execution
+- Full RACI (FDE-10)
+
+## Acceptance
+
+1. Feature confirm without device matrix / critical paths / exception cases fails local validate
+2. Unsigned baseline: 「写入 Brief 并启动」disabled or blocked with clear copy
+3. After sign, kickoff allowed when fingerprint matches confirmed modules
+4. Opening a change order with a reason clears the sign and returns modules to re-confirm
+5. Deliverables HTML shows signer, signed time, and change reasons when present
+6. `npm test` and `npm run test:live` pass
+
+## Assumptions
+
+- Bug desk skips the three new field requirements but still needs baseline sign before dispatch
+- Worktree: `.worktree/feat-fde-baseline-sign` · Brief: `.duaer/specs/261-fde-baseline-sign/`

package/.duaer/specs/261-fde-baseline-sign/tasks.md

@@ -0,0 +1,8 @@
+# Tasks: FDE-01 baseline sign
+
+- [x] T001 Clip card + session baseline helpers (`baseline.mjs` / modules / chat)
+- [x] T002 Confirm card UI fields + i18n (device / paths / exceptions)
+- [x] T003 Baseline sign + change-order UI in dispatch; gate doDispatch
+- [x] T004 Server validate + dispatch reject unsigned / stale fingerprint
+- [x] T005 Deliverables page + live-desk / E2E / CHANGELOG
+- [x] T006 L0/L1/L3 verify; stamp delivery

package/.duaer/specs/262-fde01-readme-docs/delivery.json

@@ -0,0 +1,9 @@
+{
+  "status": "accepted",
+  "acceptedAt": "2026-09-21T00:25:00.000Z",
+  "summary": "Document FDE-01 baseline sign in README zh-CN and en.",
+  "verification": {
+    "waiver": "docs-only",
+    "note": "README + CHANGELOG only; CJK scan on README.md clean"
+  }
+}

package/.duaer/specs/262-fde01-readme-docs/spec.md

@@ -0,0 +1,23 @@
+# Feature Specification: Document FDE-01 in README
+
+## Goal
+
+Update user-facing README (zh-CN + en) so FDE-01 baseline fields and sign
+gate match the live console.
+
+## In scope
+
+- `README.zh-CN.md` and `README.md` capability bullets + FDE flow steps
+- Brief / delivery stamp
+
+## Out of scope
+
+- Product code / i18n / ADR
+- Push / release
+
+## Acceptance
+
+1. zh-CN README mentions device matrix / critical paths / exception cases on feature confirm
+2. Both READMEs mention signed baseline before kickoff and change-order re-sign
+3. English README has no CJK
+4. Docs-only waiver in delivery verification

package/.duaer/specs/262-fde01-readme-docs/tasks.md

@@ -0,0 +1,5 @@
+# Tasks: Document FDE-01 in README
+
+- [x] T001 Update README.zh-CN.md capability + flow
+- [x] T002 Update README.md capability + flow
+- [x] T003 Stamp delivery (docs-only waiver)

package/.duaer/specs/263-arch-edge-via/delivery.json

@@ -0,0 +1,9 @@
+{
+  "status": "accepted",
+  "acceptedAt": "2026-09-21T00:35:00.000Z",
+  "summary": "Auto-detour architecture edges that would fail Archify clean-flow/edge-through-node.",
+  "verification": {
+    "L0": "node --check bin/live-archify.mjs — pass",
+    "L1": "node --test test/live-archify.test.mjs — 14 pass"
+  }
+}

package/.duaer/specs/263-arch-edge-via/spec.md

@@ -0,0 +1,25 @@
+# Feature Specification: Auto-route architecture edges that cross nodes
+
+## Goal
+
+When Archify rejects architecture IR with `clean-flow/edge-through-node`
+(long same-row reverse edges from LLM layout), duaer-live auto-detours those
+edges with `fromSide`/`toSide`/`via` so render succeeds.
+
+## In scope
+
+- `routeCrossingEdges` in `bin/live-archify.mjs` (called from layout)
+- Unit test using the failing PPT IR (state→gen)
+- CHANGELOG / brief note in live-desk if needed
+
+## Out of scope
+
+- Changing Archify itself
+- Relayouting all LLM positions from scratch
+- Showcase quality profile
+
+## Acceptance
+
+1. Saved IR `state`→`gen` (crosses user/ui/check/doc) renders via Archify without error
+2. Neighbor edges without intermediates keep no forced via
+3. `npm test` live-archify tests pass

package/.duaer/specs/263-arch-edge-via/tasks.md

@@ -0,0 +1,5 @@
+# Tasks: Auto-route crossing architecture edges
+
+- [x] T001 Implement `routeCrossingEdges` + wire into layout / viewBox
+- [x] T002 Unit test for PPT IR state→gen case
+- [x] T003 CHANGELOG; verify; stamp delivery

package/.duaer/specs/264-baseline-field-guide/delivery.json

@@ -0,0 +1,10 @@
+{
+  "status": "accepted",
+  "acceptedAt": "2026-09-21T00:40:00.000Z",
+  "summary": "Guide chat and placeholders to fill FDE-01 baseline confirm fields.",
+  "verification": {
+    "L0": "node --check bin/duaer-live.mjs web/live-dev/app.js — pass",
+    "L1": "node --test test/live-i18n-common.test.mjs — pass",
+    "L3": "npm run test:live — pass"
+  }
+}

package/.duaer/specs/264-baseline-field-guide/spec.md

@@ -0,0 +1,23 @@
+# Feature Specification: Guide filling FDE-01 baseline fields
+
+## Goal
+
+Chat and confirm UX must guide (and preferably fill) device matrix, critical
+paths, and exception cases — not leave them as empty「待确认」forever.
+
+## In scope
+
+- Feature SYSTEM / ACCEPT / FIX / REVISE prompts include the three fields
+- Field-specific placeholders (examples) in UI + i18n
+- Smoke assert prompts mention the fields
+
+## Out of scope
+
+- Bug desk (still skips the three fields)
+- Changing validate rules
+
+## Acceptance
+
+1. `SYSTEM_PROMPT` / accept / fix prompts list `deviceMatrix` / `criticalPaths` / `exceptionCases`
+2. Feature confirm textareas use example placeholders (not bare「待确认」)
+3. `npm test` + `npm run test:live` pass

package/.duaer/specs/264-baseline-field-guide/tasks.md

@@ -0,0 +1,5 @@
+# Tasks: Guide filling FDE-01 baseline fields
+
+- [x] T001 Update chat / accept / fix / revise prompts
+- [x] T002 Per-field placeholders + i18n locales
+- [x] T003 Smoke assert; stamp delivery

package/.duaer/specs/265-baseline-chat-passthrough/delivery.json

@@ -0,0 +1,9 @@
+{
+  "status": "accepted",
+  "acceptedAt": "2026-09-21T00:45:00.000Z",
+  "summary": "Pass deviceMatrix/criticalPaths/exceptionCases through chat parse and SSE done.",
+  "verification": {
+    "L0": "node --check bin/duaer-live.mjs — pass",
+    "L3": "npm run test:live — pass"
+  }
+}

package/.duaer/specs/265-baseline-chat-passthrough/spec.md

@@ -0,0 +1,22 @@
+# Feature Specification: Pass baseline fields through chat parse/SSE
+
+## Goal
+
+When the model returns deviceMatrix / criticalPaths / exceptionCases in chat
+JSON, they must reach the middle confirm card (not be stripped by
+parseChatResult / chatDoneSsePayload).
+
+## In scope
+
+- parseChatResult + chatDoneSsePayload passthrough (top-level + modules[])
+- Unit / smoke coverage
+
+## Out of scope
+
+- Prompt wording (already done in 264)
+
+## Acceptance
+
+1. Parsed chat JSON with baseline fields retains them in the done payload shape
+2. Middle card merge path receives the three keys from SSE done
+3. `npm run test:live` + targeted unit pass

package/.duaer/specs/265-baseline-chat-passthrough/tasks.md

@@ -0,0 +1,4 @@
+# Tasks: Pass baseline fields through chat parse/SSE
+
+- [x] T001 Fix parseChatResult + chatDoneSsePayload
+- [x] T002 Unit test; smoke marker; stamp delivery

package/.duaer/specs/266-fde02-api-contract/delivery.json

@@ -0,0 +1,10 @@
+{
+  "status": "accepted",
+  "acceptedAt": "2026-09-21T00:55:00.000Z",
+  "summary": "FDE-02: apiContract confirm field, validate gate, kickoff contract tasks, deliverables.",
+  "verification": {
+    "L0": "node --check — pass",
+    "L1": "npm test — pass",
+    "L3": "npm run test:live — pass"
+  }
+}

package/.duaer/specs/266-fde02-api-contract/spec.md

@@ -0,0 +1,28 @@
+# Feature Specification: FDE-02 API contract gate
+
+## Goal
+
+Enforce an API contract declaration on feature confirm cards (OpenAPI/types
+path, or explicit「本模块无 HTTP API」). When HTTP APIs are in scope, kickoff
+injects contract sync / Mock / CI contract-test tasks so联调不再追字段.
+
+## In scope
+
+- Confirm card field `apiContract` + validate / chat prompts / SSE passthrough
+- Fingerprint includes the field
+- Task pool injects FDE-02 shared tasks when any module declares a contract path
+- Deliverables show the field
+- Docs / E2E / tests
+
+## Out of scope
+
+- Built-in OpenAPI editor, codegen, or running customer CI
+- Bug desk (skips field like other FDE-01 extras)
+
+## Acceptance
+
+1. Feature confirm without apiContract fails local validate
+2. 「本模块无 HTTP API」passes without injecting contract tasks
+3. A path like `openapi/openapi.yaml` injects three shared pool tasks
+4. Chat SSE / clip / deliverables carry the field
+5. `npm test` + `npm run test:live` pass

package/.duaer/specs/266-fde02-api-contract/tasks.md

@@ -0,0 +1,7 @@
+# Tasks: FDE-02 API contract gate
+
+- [x] T001 `api-contract.mjs` + clipCard / fingerprint / localAccept
+- [x] T002 Chat prompts + parseChatResult / SSE passthrough
+- [x] T003 UI + i18n placeholders; app.js merge/apply
+- [x] T004 Task pool inject + deliverables
+- [x] T005 Tests / docs / CHANGELOG; stamp delivery

package/.duaer/specs/267-baseline-restore/delivery.json

@@ -0,0 +1,9 @@
+{
+  "status": "accepted",
+  "summary": "Desk refresh restores device matrix, critical paths, exception cases, and API contract onto the confirm card.",
+  "verification": {
+    "L0": "node --check web/live-dev/app.js web/live-dev/confirm-card.mjs — pass",
+    "L1": "npm test — 234 pass",
+    "L3": "npm run test:live — pass"
+  }
+}

package/.duaer/specs/267-baseline-restore/spec.md

@@ -0,0 +1,24 @@
+# Feature Specification: Keep baseline fields after desk refresh
+
+## Goal
+
+Refreshing the Duaer console must keep the four feature confirm fields
+(device matrix, critical paths, exception cases, API contract) that were
+already on the card.
+
+## In scope
+
+- Session restore copies those four fields onto each module card before the
+  form is filled
+- Confirm fingerprint includes `apiContract` so a later edit re-validates
+
+## Out of scope
+
+- Bug desk (those fields stay hidden)
+- Changing validate rules
+
+## Acceptance
+
+1. Restoring a saved module card keeps deviceMatrix, criticalPaths,
+   exceptionCases, and apiContract
+2. `npm test` and `npm run test:live` pass

package/.duaer/specs/267-baseline-restore/tasks.md

@@ -0,0 +1,5 @@
+# Tasks — 267-baseline-restore
+
+- [x] Restore the four baseline fields when loading a saved desk session
+- [x] Include apiContract in the confirm fingerprint
+- [x] Tests, merge develop, handoff

package/.duaer/specs/268-fde07-uat/delivery.json

@@ -0,0 +1,9 @@
+{
+  "status": "accepted",
+  "summary": "Feature confirm requires a UAT pack (empty, failure, permission, timeout, retry) and kickoff schedules those checks.",
+  "verification": {
+    "L0": "node --check bin/duaer-live.mjs bin/live-modules.mjs web/live-dev/app.js — pass",
+    "L1": "npm test — 237 pass",
+    "L3": "npm run test:live — pass"
+  }
+}

package/.duaer/specs/268-fde07-uat/spec.md

@@ -0,0 +1,30 @@
+# Feature Specification: FDE-07 UAT pack on confirm
+
+## Goal
+
+Feature confirm must not treat a single happy-path note as acceptance.
+Exception cases have to cover the UAT pack, and kickoff must schedule
+those checks.
+
+## In scope
+
+- Local validate requires empty, failure, permission, timeout, and retry
+- When the module declares an API contract path, exception text must name
+  an error code or HTTP status
+- Kickoff adds a UAT task per confirmed module, plus a contract error-code
+  task when a path is declared
+- Confirm hints, placeholders, and chat/accept prompts match the pack
+
+## Out of scope
+
+- Bug desk
+- Running the UAT cases against a customer environment
+
+## Acceptance
+
+1. A feature card that only mentions one exception class fails local validate
+2. A card covering the five classes passes that check; a contract path also
+   needs an error code or status
+3. Confirmed modules get an FDE-07 UAT task; no-HTTP modules skip the
+   error-code task
+4. `npm test` and `npm run test:live` pass

package/.duaer/specs/268-fde07-uat/tasks.md

@@ -0,0 +1,5 @@
+# Tasks — 268-fde07-uat
+
+- [x] Validate exception cases against the UAT pack
+- [x] Inject FDE-07 kickoff tasks
+- [x] Update hints, prompts, docs, and tests

package/.duaer/specs/269-release-027/spec.md

@@ -0,0 +1,12 @@
+# Feature Specification: Release 0.27.0
+
+## Goal
+
+Ship 0.27.0: FDE-01 signed baseline, FDE-02 API contract gate, FDE-07 UAT
+pack, baseline field restore, architecture edge detour. Promote develop to
+main, publish a GitHub Release, and let npm Trusted Publishing run.
+
+## Acceptance
+
+1. `package.json` is `0.27.0`; CHANGELOG has `0.27.0` and an empty Unreleased section.
+2. Tag `v0.27.0` is on `main`; GitHub Release is published.

package/.duaer/specs/269-release-027/tasks.md

@@ -0,0 +1,4 @@
+# Tasks — 269-release-027
+
+- [x] Bump 0.27.0 and move changelog notes
+- [ ] Promote develop to main, tag, GitHub Release

package/CHANGELOG.md

@@ -2,6 +2,52 @@
 
 ## Unreleased
 
+## 0.27.0 — 2026-09-21
+
+### Feat: FDE-07 UAT pack on confirm
+
+- Feature exception cases must cover empty, failure, permission, timeout, and retry
+- A declared API contract also requires an error code or HTTP status in that text
+- Kickoff adds a UAT task per confirmed module
+
+### Fix: keep baseline confirm fields after desk refresh
+
+- Restoring a project session copies device matrix, critical paths, exception
+  cases, and API contract back onto the confirm card
+
+### Feat: FDE-02 API contract gate on confirm + kickoff tasks
+
+- Feature confirm requires `apiContract` (OpenAPI/types path or「本模块无 HTTP API」)
+- Kickoff injects contract sync / Mock / CI contract-test tasks when a path is declared
+- Deliverables and baseline fingerprint include the field
+
+### Fix: pass FDE-01 baseline fields through chat SSE
+
+- `parseChatResult` / `chatDoneSsePayload` keep deviceMatrix, criticalPaths,
+  exceptionCases so the middle confirm card fills from chat JSON
+
+### Fix: guide filling FDE-01 baseline confirm fields
+
+- Feature chat / accept / fix / revise prompts include device matrix, critical
+  paths, and exception cases (fill defaults or offer options — do not leave empty)
+- Confirm card placeholders show examples instead of bare「待确认」
+
+### Fix: auto-route architecture edges that cross unrelated nodes
+
+- Before Archify deliver, long same-row edges that would pass through other
+  components get a bottom `via` detour (`clean-flow/edge-through-node`)
+
+### Docs: README covers FDE-01 baseline sign
+
+- zh-CN / en README: feature confirm fields, signed baseline before kickoff,
+  change order, deliverables baseline history
+
+### Feat: FDE-01 signed scope + acceptance baseline before kickoff
+
+- Confirm card requires device matrix, critical paths, and exception cases (feature)
+- Dispatch requires a signed baseline (signer + fingerprint); change order clears sign and reopens confirm
+- Deliverables page shows baseline sign-off and change history
+
 ## 0.26.0 — 2026-09-20
 
 ### Fix: npm provenance repository URL after GitHub move

package/README.md

@@ -65,15 +65,17 @@ After install, these are the capabilities you actually use:
 A local web console (`duaer live`) for “chat → confirm → dispatch → watch → open result”:
 
 - **Projects.** Create and switch projects; each keeps its own chat and progress.
-- **Chat until the ask is clear.** Left chat; center confirm cards (goal / out of scope / checkable acceptance). Vague acceptance cannot be confirmed. Beside **Send**, tap **Record** to capture speech; with a **speech recognition (STT) model** in Settings (OpenAI-compatible `/audio/transcriptions`, e.g. whisper-1), the clip is decoded into the composer—edit, then send.
+- **Chat until the ask is clear.** Left chat; center confirm cards (goal / out of scope / checkable acceptance). Feature cards also need **device matrix, critical paths, and exception cases**. Vague acceptance cannot be confirmed. Beside **Send**, tap **Record** to capture speech; with a **speech recognition (STT) model** in Settings (OpenAI-compatible `/audio/transcriptions`, e.g. whisper-1), the clip is decoded into the composer—edit, then send.
 - **Split big work into modules.** Confirm module by module; nothing starts until you kick off after the ones you care about are confirmed.
 - **Architecture diagram.** After requirements, review the system diagram; click it for fullscreen; kickoff waits until architecture is confirmed. If chat claims the diagram is ready but the middle panel is empty, the same bubble offers Regenerate — it does not leave a false “ready” line.
+- **Sign the scope + acceptance baseline before kickoff.** After architecture confirm, an operator must **sign** (signer + time; fingerprint of confirmed module cards). Unsigned or stale fingerprints block **Write Brief and start**. An **open change** (with reason) clears the sign, returns modules for re-confirm, then architecture and re-sign.
 - **Dispatch digital employees to code.** Pick a product folder and Cursor Agent or Claude Code; work happens in an isolated worktree, not directly on your long-lived branches.
 - **Visible task progress.** Work is a checklist; each finished item is checked off and the console refreshes; dependent tasks release in waves so agents don’t pile on blocked work.
 - **Employee roles.** Top-bar **digital employee** directory (Implementer / Functional regression / Deployer). Optional parallel workers on the same CLI. See the next section.
 - **Locales.** Console UI: zh-CN, zh-TW, en, ja, ko, es, pt-BR, fr, de, ru, vi.
 - **Deliverables and results.** Open a deliverables page (requirements timeline,
-  architecture, tasks, delivery); when done, open the page or the project folder.
+  confirmation, baseline sign-off and change history, architecture, tasks,
+  delivery); when done, open the page or the project folder.
 - **Revise when it’s not right.** Continue in left chat → re-confirm → relaunch on
   the same job without starting from scratch. After deploy, **Revise again** and
   **Fix a bug** stay on the result bar.
@@ -163,15 +165,21 @@ mock LLM — no paid API).
    content. Messy multi-topic talk is fine: the console evolves **`modules[]`**
    (tabs). Chat bubbles render **Markdown** (`**bold**`, code, links).  
 2. Per module: fill the confirm card (goal / out-of-scope / **checkable**
-   acceptance / assumptions). Vague acceptance fails the gate; validate must
-   pass before **Confirm**. Confirming a module **locks that card only** — it
-   does **not** write a Brief or start workers yet. Jump between modules freely.  
+   acceptance / assumptions; feature cards also need **device matrix /
+   critical paths / exception cases**). Vague acceptance or missing baseline
+   fields fails the gate; validate must pass before **Confirm**. Confirming a
+   module **locks that card only** — it does **not** write a Brief or start
+   workers yet. Jump between modules freely.  
 3. When **all** modules you care about are confirmed → review / confirm
-   **architecture** (Archify) → **kickoff**. Kickoff writes the Brief, builds a
-   **dependency-aware task pool** (`dependsOn`), and assigns work. Default is
-   **1** worker; optionally **N** parallel workers on the **same CLI**. Shared
-   tasks go to worker 1; module tasks round-robin. Each worker gets its own
-   **Terminal queue lane** (`live-terminal` / `live-terminal/w2`…).  
+   **architecture** (Archify) → **sign the scope + acceptance baseline**
+   (signer) → **kickoff**. Kickoff stays blocked while unsigned or when the
+   fingerprint no longer matches confirmed cards. Kickoff writes the Brief,
+   builds a **dependency-aware task pool** (`dependsOn`), and assigns work.
+   Default is **1** worker; optionally **N** parallel workers on the **same
+   CLI**. Shared tasks go to worker 1; module tasks round-robin. Each worker
+   gets its own **Terminal queue lane** (`live-terminal` /
+   `live-terminal/w2`…). To change scope: **open change** (reason) → clear
+   sign and re-confirm modules → architecture again → re-sign.  
 4. Pick a product repo (browse / scan / recent), or paste a path / project name.
    Missing paths are created; set **Projects parent folder** so short names
    resolve under it. Non-git folders get `git init -b develop`; missing
@@ -184,10 +192,10 @@ mock LLM — no paid API).
    `.worktree/feat-*` and opens **Terminal** for each worker lane.  
 7. Progress shows a **next-action** stage strip, then `tasks.md` polling.
    **View deliverables** (above progress) opens a generated HTML page of stage
-   artifacts (requirements doc timeline, confirmation, architecture, task pool,
-   delivery). On delivery, workers update the product **README** before
-   `delivery.json` is `accepted`. Then open **Results** (**View result** when a
-   page exists, otherwise **Open
+   artifacts (requirements doc timeline, confirmation, baseline sign-off and
+   change history, architecture, task pool, delivery). On delivery, workers
+   update the product **README** before `delivery.json` is `accepted`. Then open
+   **Results** (**View result** when a page exists, otherwise **Open
    project folder**).  
 8. If the result is not right: **Continue improving (left chat)** → confirm the
    revise card (same validate gate) → re-confirm architecture (keep or redesign)

package/README.zh-CN.md

@@ -28,14 +28,15 @@
 本机开一个网页控制台（`duaer live`），专门管「从聊需求到派工、看进度、看结果」：
 
 - **项目管理。** 建项目、切换项目；每个项目自己的对话和进度，互不搅在一起。
-- **聊着把需求聊清楚。** 左边聊天；中间把目标、边界、验收写成确认卡；空话验收过不了，得能检查才给确认。发送旁可点 **录音**；在设置里配置 **语音识别模型**（兼容 OpenAI `/audio/transcriptions`，如 whisper-1）后，录完会解码成文字填入输入框，改完再发送。
+- **聊着把需求聊清楚。** 左边聊天；中间把目标、边界、验收写成确认卡；功能卡还要填 **浏览器/设备矩阵、关键路径、异常态**。空话验收过不了，得能检查才给确认。发送旁可点 **录音**；在设置里配置 **语音识别模型**（兼容 OpenAI `/audio/transcriptions`，如 whisper-1）后，录完会解码成文字填入输入框，改完再发送。
 - **大需求可拆成多个模块。** 一块一块确认，确认完一块不会立刻开工，全部谈妥再一起派。
 - **系统架构图。** 确认需求后一起看架构；点图可全屏查看；架构确认后才能派工。若对话称已生成但中间栏没有图，同一条气泡会改成提示并提供「重新生成架构图」，不会留下假的「已生成」。
+- **签署范围与验收基线再开工。** 架构确认后须签署（签字人 + 时间；指纹对上已确认模块卡）；未签或卡面改过不得「写入 Brief 并启动」。开 **变更单**（写原因）会清签、退回重确认，再架构、再签。
 - **一键派数字员工写代码。** 选产品目录、选 Cursor Agent 或 Claude Code，点开工；它在隔离目录里改代码，不直接乱动你的主分支。
 - **任务进度看得见。** 任务拆成一条条可勾选项；做完勾一项，控制台实时刷新；有依赖的任务会排队放行，不会一窝蜂乱做。
 - **数字员工分工。** 顶部有「数字员工」目录（实现 / 功能回归 / 部署）；可开多个并行（同一套 CLI）。详见下一节。
 - **中 / 繁中 / 英 / 日 / 韩 / 西 / 葡 / 法 / 德 / 俄 / 越界面。** 控制台文案可切换语种。
-- **看交付物和结果。** 可打开交付物页（需求时间线、架构、任务、交付记录）；做完了可打开页面或项目文件夹。
+- **看交付物和结果。** 可打开交付物页（需求时间线、确认书、基线签署与变更记录、架构、任务、交付）；做完了可打开页面或项目文件夹。
 - **不满意就继续改。** 左侧继续聊改进 → 再确认 → 同一次任务上续派，不用从头建仓。部署后结果栏仍可「再改一版」和「修 bug」。
 - **修 bug。** 走缺陷卡（不拆多模块），默认跳过架构，短任务池，开 `fix/` 分支（可选从 `main` 出紧急修复）。交付过的地址/启动信息会自动带入；缺陷和迭代排在同一条项目时间线上。
 - **快速导航。** 对话栏右缘「导航」可跳到：对话底部 · 确认卡 · 结果 · 进度。
@@ -145,15 +146,15 @@ duaer live config --base-url https://api.openai.com/v1 --api-key sk-... --model
 **流程**
 
 1. 打开或新建**项目**，再聊天。右上角「项目」列表会显示每个项目的**交付状态**；有内容时可直接打开**交付物**。话题可以乱跳：控制台会演进 **`modules[]`**（模块页签）。气泡支持 **Markdown**（加粗、代码、链接）。  
-2. **按模块**填确认卡（目标 / 不做 / **可检查验收** / 假设）。空泛验收过不了门禁；须校验通过才能点确认。确认只**锁住该模块卡**，**不会**立刻写 Brief 或开工。模块之间可随时切换。  
-3. 关心的模块都确认完 → 审 / 确认**架构**（Archify）→ **开工（kickoff）**。开工才写 Brief，建带 **`dependsOn` 的任务池**，并分派。默认 **1** 个数字员工；可选 **N** 个同 CLI 并行。共享任务给 1 号；模块任务轮询。每个 worker 独占一条 **Terminal 队列泳道**（`live-terminal` / `live-terminal/w2`…）。  
+2. **按模块**填确认卡（目标 / 不做 / **可检查验收** / 假设；功能卡另填 **设备矩阵 / 关键路径 / 异常态**）。空泛验收或缺基线字段过不了门禁；须校验通过才能点确认。确认只**锁住该模块卡**，**不会**立刻写 Brief 或开工。模块之间可随时切换。  
+3. 关心的模块都确认完 → 审 / 确认**架构**（Archify）→ **签署范围与验收基线**（签字人）→ **开工（kickoff）**。未签或指纹与已确认卡不一致时开工按钮不可用。开工才写 Brief，建带 **`dependsOn` 的任务池**，并分派。默认 **1** 个数字员工；可选 **N** 个同 CLI 并行。共享任务给 1 号；模块任务轮询。每个 worker 独占一条 **Terminal 队列泳道**（`live-terminal` / `live-terminal/w2`…）。范围要改：开 **变更单**（写原因）→ 清签并退回模块重确认 → 再架构、再签。  
 4. 浏览 / 扫描 / 点选产品仓，或粘贴路径 / 项目名。路径不存在会自动创建；可先设**产品父目录**，再填短名在其下新建。非 git 目录会 `git init -b develop`；没有 develop/main/master 会建本地 `develop`。  
 5. 只选 **CLI 数字员工**：**Cursor Agent** 或 **Claude Code**  
    - Cursor：`curl https://cursor.com/install -fsS | bash`  
    - Claude Code：`npm install -g @anthropic-ai/claude-code`（或 `curl -fsSL https://claude.ai/install.sh | bash`）  
    - 要用 **DeepSeek 等其它模型**写代码：把 Claude Code 接到对应 API，见 [`docs/agent/worker-models.zh-CN.md`](docs/agent/worker-models.zh-CN.md)。FDE「配置模型」页下方也有同样说明。  
 6. 编辑「启动命令」（须以 `Duaer` 开头）→ 开工建 `.worktree/feat-*`，并为每条 worker 泳道打开 **Terminal**。  
-7. 右侧进度列先提示**下一步**（阶段条），并轮询 `tasks.md`。进度上方 **查看交付物** 会打开生成的 HTML 页（需求文档时间线、确认书、架构、任务池、交付等）。交付时数字员工先更新产品仓 **README**，再把 `delivery.json` 标为 `accepted`。然后出现 **结果**（有页面时 **查看结果**；否则 **打开项目目录**）。  
+7. 右侧进度列先提示**下一步**（阶段条），并轮询 `tasks.md`。进度上方 **查看交付物** 会打开生成的 HTML 页（需求文档时间线、确认书、基线签署与变更、架构、任务池、交付等）。交付时数字员工先更新产品仓 **README**，再把 `delivery.json` 标为 `accepted`。然后出现 **结果**（有页面时 **查看结果**；否则 **打开项目目录**）。  
 8. 成品不满意：点 **继续改进（左侧对话）** → 确认改进卡（同样须校验）→ 再确认架构（保留或重画）→ 同 worktree 续派（先清残留 Agent 再入队）。进度跟本轮 `R{n}-*`。启动失败会回滚本轮 Brief Revision；状态行按泳道显示 Terminal 忙闲/队列。  
 9. 若需要上线 / 公网：在控制台选 **计划托管平台**（Cloudflare / 阿里云 / AWS / GitHub Pages），说明见 [`docs/agent/deploy-targets.md`](docs/agent/deploy-targets.md)。未指定时默认 **GitHub CLI（`gh`）+ Actions**（[`docs/agent/deploy-github.md`](docs/agent/deploy-github.md)）