kld-sdd 2.6.12 → 2.6.13

package/skywalk-sdd/ontology/archive-package.cjs

@@ -4,9 +4,11 @@ const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const { generateUuidV7 } = require('./id.cjs');
+const { resolveRuntimeMetadata } = require('../runtime-metadata.cjs');
 
-const PRODUCER_VERSION = require('../../package.json').version;
-const PRODUCER = `kld-sdd@${PRODUCER_VERSION}`;
+const RUNTIME_METADATA = resolveRuntimeMetadata();
+const PRODUCER_VERSION = RUNTIME_METADATA.version;
+const PRODUCER = RUNTIME_METADATA.producer;
 const MANIFEST_SCHEMA_VERSION = 'kld-sdd-archive-manifest/v2';
 const CANONICAL_FACTS_SCHEMA_VERSION = 'kld-sdd-canonical-facts/v2';
 const CONVERSION_REPORT_SCHEMA_VERSION = 'kld-sdd-conversion-report/v1';
@@ -15,7 +17,7 @@ const MANIFEST_PATH = 'archive-manifest.json';
 const ONTOLOGY_PATH = 'archive-ontology.json';
 const CANONICAL_FACTS_PATH = 'canonical-facts.json';
 const CONVERSION_REPORT_PATH = 'conversion-report.json';
-const PACKAGE_SUFFIXES = new Set(['.md', '.json', '.jsonl', '.yaml', '.yml']);
+const PACKAGE_SUFFIXES = new Set(['.md', '.html', '.json', '.jsonl', '.yaml', '.yml']);
 
 function sha256(content) {
   return crypto.createHash('sha256').update(content).digest('hex');
@@ -495,6 +497,77 @@ function writeArchiveZip(archiveDir, packagePath, manifest) {
   return packagePath;
 }
 
+function readStoredZipEntries(packagePath) {
+  const bytes = fs.readFileSync(packagePath);
+  const entries = new Map();
+  let offset = 0;
+  while (offset + 4 <= bytes.length && bytes.readUInt32LE(offset) === 0x04034b50) {
+    if (offset + 30 > bytes.length) {
+      throw new Error('Archive Package ZIP local header 不完整');
+    }
+    const flags = bytes.readUInt16LE(offset + 6);
+    const method = bytes.readUInt16LE(offset + 8);
+    const checksum = bytes.readUInt32LE(offset + 14);
+    const compressedSize = bytes.readUInt32LE(offset + 18);
+    const uncompressedSize = bytes.readUInt32LE(offset + 22);
+    const nameLength = bytes.readUInt16LE(offset + 26);
+    const extraLength = bytes.readUInt16LE(offset + 28);
+    const nameStart = offset + 30;
+    const contentStart = nameStart + nameLength + extraLength;
+    const contentEnd = contentStart + compressedSize;
+    if ((flags & 0x0800) !== 0x0800 || method !== 0 || contentEnd > bytes.length) {
+      throw new Error('Archive Package ZIP 只允许完整的 UTF-8 stored entry');
+    }
+    const name = bytes.subarray(nameStart, nameStart + nameLength).toString('utf8');
+    const safeName = safePackagePath(name);
+    if (entries.has(safeName)) {
+      throw new Error(`Archive Package ZIP 包含重复路径: ${safeName}`);
+    }
+    const content = bytes.subarray(contentStart, contentEnd);
+    if (compressedSize !== uncompressedSize || crc32(content) !== checksum) {
+      throw new Error(`Archive Package ZIP entry 校验失败: ${safeName}`);
+    }
+    entries.set(safeName, content);
+    offset = contentEnd;
+  }
+  if (entries.size === 0 || offset + 4 > bytes.length || bytes.readUInt32LE(offset) !== 0x02014b50) {
+    throw new Error('Archive Package ZIP 缺少 central directory');
+  }
+  return entries;
+}
+
+function verifyArchivePackage(archiveDir, packagePath, manifest) {
+  const expectedPaths = [MANIFEST_PATH, ...(manifest.files || []).map((item) => safePackagePath(item.path))];
+  const expectedUnique = new Set(expectedPaths);
+  if (expectedUnique.size !== expectedPaths.length) {
+    throw new Error('Archive Package Manifest 包含重复路径');
+  }
+  const entries = readStoredZipEntries(packagePath);
+  const actualPaths = [...entries.keys()];
+  if (
+    actualPaths.length !== expectedPaths.length
+    || expectedPaths.some((entryPath) => !entries.has(entryPath))
+  ) {
+    throw new Error('Archive Package ZIP 与 Manifest 文件清单不一致');
+  }
+  const manifestBytes = fs.readFileSync(path.join(archiveDir, MANIFEST_PATH));
+  if (!entries.get(MANIFEST_PATH)?.equals(manifestBytes)) {
+    throw new Error('Archive Package ZIP 中的 Manifest 不是最终落盘版本');
+  }
+  for (const item of manifest.files || []) {
+    const content = entries.get(item.path);
+    const expectedHash = `sha256:${sha256(content)}`;
+    if (item.content_hash !== expectedHash) {
+      throw new Error(`Archive Package 内容哈希不一致: ${item.path}`);
+    }
+  }
+  return {
+    entry_count: entries.size,
+    package_hash: `sha256:${sha256(fs.readFileSync(packagePath))}`,
+    paths: actualPaths,
+  };
+}
+
 function materializeArchivePackage(options = {}) {
   const projectRoot = path.resolve(options.projectRoot || process.cwd());
   const archiveDir = path.resolve(requiredText(options.archiveDir, 'archiveDir', 'Archive Package'));
@@ -588,6 +661,41 @@ function materializeArchivePackage(options = {}) {
   };
 }
 
+function finalizeArchivePackageAfterReports(options = {}) {
+  const projectRoot = path.resolve(options.projectRoot || process.cwd());
+  const changeName = requiredText(options.changeName, 'changeName', 'Archive finalizer');
+  const runIdentity = requiredText(options.runIdentity, 'runIdentity', 'Archive finalizer');
+  const { withChangeLock } = require('./change-lock.cjs');
+  return withChangeLock(projectRoot, changeName, options.lockOptions || {}, (lock) => {
+    const prepared = typeof options.prepare === 'function'
+      ? options.prepare(lock)
+      : {};
+    const produced = materializeArchivePackage({
+      ...options,
+      ...prepared,
+      projectRoot,
+      changeName,
+    });
+    if (!produced.package_path) {
+      throw new Error('Archive finalizer 必须生成 ZIP');
+    }
+    const verification = verifyArchivePackage(
+      path.resolve(prepared.archiveDir || options.archiveDir),
+      produced.package_path,
+      produced.manifest,
+    );
+    return {
+      ...produced,
+      finalizer: {
+        run_identity: runIdentity,
+        lock_token: lock.token,
+        verified: true,
+        ...verification,
+      },
+    };
+  });
+}
+
 module.exports = {
   PRODUCER_VERSION,
   PRODUCER,
@@ -605,5 +713,8 @@ module.exports = {
   buildCanonicalFacts,
   collectPackageFilePaths,
   writeArchiveZip,
+  readStoredZipEntries,
+  verifyArchivePackage,
   materializeArchivePackage,
+  finalizeArchivePackageAfterReports,
 };

package/skywalk-sdd/ontology/resolve-spec-root.cjs

@@ -5,98 +5,38 @@ const path = require('path');
 const sddConfig = require('./sdd-config.cjs');
 const workspaceLayout = require('./workspace-layout.cjs');
 
-function isSpecPackageRoot(dir) {
-  const root = path.resolve(dir);
-  return (
-    fs.existsSync(path.join(root, 'openspec', 'changes'))
-    || fs.existsSync(path.join(root, 'modules.yaml'))
-    || fs.existsSync(path.join(root, 'sdd.config.yaml'))
-  );
+function resolveHint(anchorRoot) {
+  const hintPath = path.join(anchorRoot, '.sdd-spec-root');
+  if (!fs.existsSync(hintPath)) return null;
+  const hint = fs.readFileSync(hintPath, 'utf8').trim();
+  if (!hint) return null;
+  const resolved = path.resolve(anchorRoot, hint);
+  return fs.existsSync(resolved) ? resolved : null;
 }
 
-/**
- * 解析 SDD 文档根（*-sdd-specs 包裹包或旧平铺 spec 根）。
- * openspec CLI 只认 cwd 下的 openspec/；本函数供 log.cjs / ontology cli 自动定位包裹包。
- *
- * 解析顺序：
- * 1. start 本身已是 spec 包根
- * 2. KLD_SDD_SPEC_ROOT（绝对或相对 start）
- * 3. 单仓 layout: mono → spec_path / 子目录 *-sdd-specs
- * 4. 工作区 layout → specRepo
- * 5. start 下嵌套包裹包
- * 6. 代码仓 git config sdd.specPath（含仓内 nested 包裹）
- * 7. 向上最多 3 层找 mono / 嵌套包（Git 根、工作区根常见）
- * 8. 回退 start
- */
-function resolveSpecProjectRoot(startDir = process.cwd(), options = {}) {
-  const start = path.resolve(startDir || process.cwd());
-  if (options.skipResolve || options.forCodeRepo) return start;
-  if (isSpecPackageRoot(start)) return start;
+function resolveSpecProjectRoot(projectRoot = process.cwd()) {
+  const root = path.resolve(projectRoot);
+  const hinted = resolveHint(root);
+  if (hinted) return hinted;
 
-  const envRoot = process.env.KLD_SDD_SPEC_ROOT && String(process.env.KLD_SDD_SPEC_ROOT).trim();
-  if (envRoot) {
-    const candidate = path.isAbsolute(envRoot) ? envRoot : path.resolve(start, envRoot);
-    if (fs.existsSync(candidate)) return candidate;
+  if (sddConfig.isMonoLayout(root)) {
+    return sddConfig.resolveMonoSpecRoot(root);
   }
 
-  if (sddConfig.isMonoLayout(start)) {
-    const monoRoot = sddConfig.resolveMonoSpecRoot(start);
-    if (fs.existsSync(monoRoot)) return monoRoot;
-  }
-
-  const layout = workspaceLayout.detectWorkspaceLayout(start);
-  if (layout.specRepo && fs.existsSync(layout.specRepo.abs)) {
-    return layout.specRepo.abs;
-  }
+  const layout = workspaceLayout.detectWorkspaceLayout(root);
+  if (layout.specRepo) return layout.specRepo.abs;
 
-  const nested = workspaceLayout.findNestedSpecPackage(start);
+  const nested = workspaceLayout.findNestedSpecPackage(root);
   if (nested) return nested.abs;
 
-  const specPathResult = sddConfig.resolveSpecPath(start);
-  if (specPathResult.ok) {
-    const valid = sddConfig.validateSpecPath(specPathResult.path, { allowNestedPackage: true });
-    if (valid.ok) return valid.path;
-  }
-
-  let dir = start;
-  for (let depth = 0; depth < 3; depth += 1) {
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    if (sddConfig.isMonoLayout(parent)) {
-      const monoRoot = sddConfig.resolveMonoSpecRoot(parent);
-      if (fs.existsSync(monoRoot)) return monoRoot;
-    }
-    const parentNested = workspaceLayout.findNestedSpecPackage(parent);
-    if (parentNested) return parentNested.abs;
-    const parentLayout = workspaceLayout.detectWorkspaceLayout(parent);
-    if (parentLayout.specRepo && fs.existsSync(parentLayout.specRepo.abs)) {
-      return parentLayout.specRepo.abs;
-    }
-    dir = parent;
-  }
-
-  return start;
+  return root;
 }
 
-/**
- * CLI / skills 用：解析 --project 参数。
- * '.' 或未显式绝对 spec 根时走 resolve；link-spec 等代码仓命令传 forCodeRepo:true。
- */
-function resolveProjectArg(projectArg, startDir = process.cwd(), options = {}) {
-  const raw = projectArg == null || projectArg === '' ? '.' : String(projectArg);
-  const resolved = path.resolve(startDir, raw);
-  if (options.forCodeRepo) return resolved;
-  if (raw !== '.' && raw !== './' && path.isAbsolute(raw)) {
-    return isSpecPackageRoot(resolved) ? resolved : resolveSpecProjectRoot(resolved, options);
-  }
-  if (raw !== '.' && raw !== './') {
-    if (isSpecPackageRoot(resolved)) return resolved;
-  }
-  return resolveSpecProjectRoot(startDir, options);
+function resolveProjectArg(projectArg = '.', cwd = process.cwd()) {
+  return resolveSpecProjectRoot(path.resolve(cwd, projectArg));
 }
 
 module.exports = {
-  isSpecPackageRoot,
-  resolveSpecProjectRoot,
   resolveProjectArg,
+  resolveSpecProjectRoot,
 };

package/skywalk-sdd/ontology/working-artifacts.cjs

@@ -2,6 +2,7 @@
 
 const crypto = require('crypto');
 const path = require('path');
+const { resolveRuntimeMetadata } = require('../runtime-metadata.cjs');
 
 const WORKING_ARTIFACT_SCHEMA_VERSION = 'kld-sdd-working-artifact-facts/v1';
 const ARTIFACT_INDEX_SCHEMA_VERSION = 'kld-sdd-working-artifact-index/v1';
@@ -141,7 +142,7 @@ function compareFacts(left, right) {
 
 function buildWorkingArtifactFacts(result, options = {}) {
   const state = result.state || {};
-  const producerVersion = String(options.producerVersion || require('../../package.json').version);
+  const producerVersion = String(options.producerVersion || resolveRuntimeMetadata().version);
   const reviewStatus = state.review_status === 'pending' ? 'pending' : 'draft';
   const rawEntities = Array.isArray(state.entities) ? state.entities : [];
   const entityByAnchor = new Map(rawEntities.map((entity) => [

package/templates/hooks/claude/hooks/sdd-apply-test-gate.cjs

@@ -144,6 +144,26 @@ function isRealTestDetails(testResults) {
   return false;
 }
 
+function isPassingTestDetails(testResults) {
+  if (!isRealTestDetails(testResults)) return false;
+  const failed = Number(testResults.failed);
+  const exitCode = Number(testResults.exit_code);
+  return (!Number.isFinite(failed) || failed === 0)
+    && (!Number.isFinite(exitCode) || exitCode === 0);
+}
+
+function isStrictTestEvidence(event, changeName) {
+  const testResults = event?.details?.test_results;
+  if (event?.type !== 'test_result' || event.change !== changeName) return false;
+  if (!event.run_id || !event.source || testResults?.evidence_tier !== 'strict') return false;
+  if (!['green', 'refactor', 'regression'].includes(testResults.tdd_phase)) return false;
+  if (!Number.isInteger(testResults.exit_code) || testResults.counts_known !== true) return false;
+  return event.result === 'success'
+    && testResults.exit_code === 0
+    && Number(testResults.failed) === 0
+    && isPassingTestDetails(testResults);
+}
+
 function loadChangeEvents(projectRoot, changeName) {
   const safe = safeChangeName(changeName);
   const dir = path.join(projectRoot, 'skywalk-sdd', 'events', safe);
@@ -170,33 +190,36 @@ function loadChangeEvents(projectRoot, changeName) {
 function hasRealTestExecution(projectRoot, changeName, capability, sinceTimestamp) {
   const since = sinceTimestamp ? new Date(sinceTimestamp).getTime() : 0;
   const events = loadChangeEvents(projectRoot, changeName);
+  let legacyEvidence = null;
 
   for (const event of events) {
     const ts = new Date(event.timestamp || 0).getTime();
     if (since && ts < since) continue;
 
-    if (event.type === 'stage_end' && event.command === 'test' &&
-        (event.result === 'success' || event.result === 'failure')) {
-      return { kind: 'opsx-test', event };
+    if (event.type === 'stage_end' && event.command === 'test' && event.result === 'success') {
+      legacyEvidence ||= { kind: 'legacy-opsx-test', event };
     }
 
     if (event.type === 'test_result') {
       const tr = event.details && event.details.test_results;
-      if (isRealTestDetails(tr)) {
-        return { kind: 'test_result', event };
+      if (isStrictTestEvidence(event, changeName)) {
+        return { kind: 'strict-test-result', event };
+      }
+      if (event.result === 'success' && isPassingTestDetails(tr)) {
+        legacyEvidence ||= { kind: 'legacy-test-result', event };
       }
     }
 
     if (event.type === 'task_update' && (event.command === 'apply' || !event.command)) {
       const tr = event.details && event.details.test_results;
-      if (isRealTestDetails(tr)) {
+      if (event.result !== 'failure' && isPassingTestDetails(tr)) {
         if (!capability || !event.capability || event.capability === capability) {
-          return { kind: 'task_update', event };
+          legacyEvidence ||= { kind: 'legacy-task-update', event };
         }
       }
     }
   }
-  return null;
+  return legacyEvidence;
 }
 
 function isApplyCompletionBash(command) {
@@ -281,9 +304,10 @@ function shouldGate(projectRoot, applyEvent) {
     applyEvent.capability,
     applyEvent.timestamp
   );
-  if (evidence) {
+  if (evidence?.kind === 'strict-test-result') {
     return null;
   }
+  if (evidence) return { strategy, changeName: applyEvent.change, capability: applyEvent.capability, legacyEvidence: evidence };
   return { strategy, changeName: applyEvent.change, capability: applyEvent.capability };
 }
 
@@ -441,6 +465,11 @@ if (require.main === module) {
   if (!gate) {
     process.exit(0);
   }
+  if (gate.legacyEvidence) {
+    recordWarning(projectRoot, { ...activeApply, test_strategy: gate.strategy }, 'legacy_test_evidence',
+      '仅检测到旧版测试证据；本次兼容放行，请补录包含 run-id、exit code、TDD phase 和严格身份字段的 test_result');
+    process.exit(0);
+  }
 
   const reason = buildReason(gate.strategy, gate.changeName, gate.capability);
   recordWarning(projectRoot, { ...activeApply, test_strategy: gate.strategy }, 'apply_test_missing', 'Apply test gate blocked: no unit test evidence');
@@ -458,5 +487,6 @@ module.exports = {
   detectMissingTddRed,
   hasExistingWarning,
   isRealTestDetails,
+  isStrictTestEvidence,
   requiresUnitTests,
 };

package/templates/hooks/claude/hooks/sdd-post-tool.cjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { execFileSync } = require('child_process');
 
 function readStdin() {
@@ -75,13 +76,48 @@ function latestActiveStage(projectRoot) {
 // v2.5 契约变更：返回类型从 string 变为对象（含 exit_code_known 标注）；旧调用方 `inferResult(input) === 'success'` 需改为 `.result === 'success'`
 function inferResult(input) {
   const response = input.tool_response || input.toolResponse || {};
-  if (typeof response.exit_code === 'number') return { result: response.exit_code === 0 ? 'success' : 'failure', exit_code_known: true };
-  if (typeof response.exitCode === 'number') return { result: response.exitCode === 0 ? 'success' : 'failure', exit_code_known: true };
-  if (typeof response.success === 'boolean') return { result: response.success ? 'success' : 'failure', exit_code_known: true };
+  if (typeof response.exit_code === 'number') return { result: response.exit_code === 0 ? 'success' : 'failure', exit_code_known: true, exit_code: response.exit_code };
+  if (typeof response.exitCode === 'number') return { result: response.exitCode === 0 ? 'success' : 'failure', exit_code_known: true, exit_code: response.exitCode };
+  if (typeof response.success === 'boolean') return { result: response.success ? 'success' : 'failure', exit_code_known: true, exit_code: response.success ? 0 : 1 };
   // fallback：从 stdout/stderr 识别构建失败信号；无法判定时 partial 且 exit_code_known=false
   const out = String(response.stdout || response.stderr || '');
-  if (/BUILD FAILED|error TS\d+|ERR_/i.test(out)) return { result: 'failure', exit_code_known: false };
-  return { result: 'partial', exit_code_known: false };
+  if (/BUILD FAILED|error TS\d+|ERR_/i.test(out)) return { result: 'failure', exit_code_known: false, exit_code: null };
+  return { result: 'partial', exit_code_known: false, exit_code: null };
+}
+
+function parseTestCounts(output) {
+  const text = String(output || '');
+  const tapPass = text.match(/#\s*pass(?:ed)?\s+(\d+)/i);
+  const tapFail = text.match(/#\s*fail(?:ed)?\s+(\d+)/i);
+  const tapSkip = text.match(/#\s*skip(?:ped)?\s+(\d+)/i);
+  if (tapPass || tapFail) {
+    return {
+      counts_known: true,
+      passed: Number(tapPass?.[1] || 0),
+      failed: Number(tapFail?.[1] || 0),
+      skipped: Number(tapSkip?.[1] || 0),
+    };
+  }
+  const summary = text.match(/Tests?\s+.*?(\d+)\s+passed(?:.*?(\d+)\s+failed)?(?:.*?(\d+)\s+skipped)?/i);
+  if (summary) {
+    return {
+      counts_known: true,
+      passed: Number(summary[1] || 0),
+      failed: Number(summary[2] || 0),
+      skipped: Number(summary[3] || 0),
+    };
+  }
+  return { counts_known: false };
+}
+
+function stableRunId(input, activeStage, command) {
+  const explicit = input.tool_use_id || input.toolUseId || input.tool_call_id || input.toolCallId;
+  if (explicit) return String(explicit);
+  const response = input.tool_response || input.toolResponse || {};
+  return `hook-${crypto.createHash('sha256')
+    .update(JSON.stringify([activeStage.event_id || '', activeStage.session_id || '', command, response]))
+    .digest('hex')
+    .slice(0, 20)}`;
 }
 
 function inferRecord(command) {
@@ -113,6 +149,34 @@ function recordTelemetry(projectRoot, activeStage, record, result, exitCodeKnown
   const toolInput = (input && (input.tool_input || input.toolInput)) || {};
   const toolResponse = (input && (input.tool_response || input.toolResponse)) || {};
   const details = { [record.detailsKey]: { ...record.details } };
+  let strictTestEvent = false;
+  let runId = null;
+  if (record.type === 'test_result') {
+    const output = String(toolResponse.stdout || '') + '\n' + String(toolResponse.stderr || '');
+    const counts = parseTestCounts(output);
+    const exitCode = typeof toolResponse.exit_code === 'number'
+      ? toolResponse.exit_code
+      : (typeof toolResponse.exitCode === 'number'
+        ? toolResponse.exitCode
+        : (typeof toolResponse.success === 'boolean' ? (toolResponse.success ? 0 : 1) : null));
+    const tddPhase = toolInput.tdd_phase || input.tdd_phase || 'regression';
+    details.test_results = {
+      command: toolInput.command || record.details.command,
+      tdd_phase: tddPhase,
+      exit_code: exitCode,
+      counts_known: counts.counts_known,
+      ...(counts.counts_known ? {
+        passed: counts.passed,
+        failed: counts.failed,
+        skipped: counts.skipped,
+      } : {}),
+      duration_ms: Number.isFinite(toolResponse.duration_ms) ? toolResponse.duration_ms : 0,
+      failure_type: result === 'failure' ? (exitCode == null ? 'infrastructure' : 'assertion') : 'none',
+      expected_failure: tddPhase === 'red' && result === 'failure' && exitCode != null,
+    };
+    strictTestEvent = exitCode != null && Boolean(activeStage.task_id);
+    runId = stableRunId(input || {}, activeStage, details.test_results.command);
+  }
   if (record.type === 'build_result') {
     details.build_results.success = result === 'success';
     details.build_results.error_count = result === 'success' ? 0 : null;
@@ -126,7 +190,7 @@ function recordTelemetry(projectRoot, activeStage, record, result, exitCodeKnown
     logCli,
     'record',
     `--type=${record.type}`,
-    `--command=${toolInput.command || activeStage.command || activeStage.stage || 'unknown'}`,
+    `--command=${activeStage.command || activeStage.stage || 'unknown'}`,
     `--project=${projectRoot}`,
     `--change=${activeStage.change || 'general'}`,
     `--agent=${activeStage.agent_type || 'claude-code'}`,
@@ -135,9 +199,16 @@ function recordTelemetry(projectRoot, activeStage, record, result, exitCodeKnown
     `--summary=Claude hook captured ${record.type}`,
     `--details-json=${JSON.stringify(details)}`,
   ];
+  if (strictTestEvent) {
+    args.push(
+      '--strict',
+      `--run-id=${runId}`,
+      `--session-id=${activeStage.session_id || `stage-${activeStage.event_id}`}`,
+    );
+  }
   if (activeStage.capability) args.push(`--capability=${activeStage.capability}`);
   if (activeStage.task_id) args.push(`--task-id=${activeStage.task_id}`);
-  if (activeStage.session_id) args.push(`--session-id=${activeStage.session_id}`);
+  if (!strictTestEvent && activeStage.session_id) args.push(`--session-id=${activeStage.session_id}`);
   const run = runner || ((a) => execFileSync('node', a, { cwd: projectRoot, stdio: 'ignore' }));
   run(args);
 }
@@ -164,4 +235,12 @@ if (require.main === module) {
   }
 }
 
-module.exports = { inferResult, inferRecord, recordTelemetry, findProjectRoot, latestActiveStage };
+module.exports = {
+  inferResult,
+  inferRecord,
+  parseTestCounts,
+  stableRunId,
+  recordTelemetry,
+  findProjectRoot,
+  latestActiveStage,
+};

package/templates/hooks/claude/hooks/sdd-prompt.cjs

@@ -94,8 +94,10 @@ const activeStages = readActiveStages(projectRoot)
 
 const lines = [
   'SDD Telemetry reminder:',
+  '- Resolve the exact change key first; every standard OPSX start/end command must include --change=<change-key>.',
   '- Run node "$(cat .sdd-spec-root)/skywalk-sdd/log.cjs" start before the OPSX stage work begins.',
-  '- Run node "$(cat .sdd-spec-root)/skywalk-sdd/log.cjs" end before stopping the stage.',
+  '- Run node "$(cat .sdd-spec-root)/skywalk-sdd/log.cjs" end with the same change, stage, session and event identity before stopping.',
+  '- change=general is reserved for explicitly allowed explore events and must later use scope_link for historical attribution.',
   '- Hooks are only an enhancement; OPSX skill instructions remain authoritative.',
 ];
 

package/templates/hooks/codebuddy/hooks/sdd-apply-test-gate.cjs

@@ -74,6 +74,26 @@ function isRealTestDetails(testResults) {
   return false;
 }
 
+function isPassingTestDetails(testResults) {
+  if (!isRealTestDetails(testResults)) return false;
+  const failed = Number(testResults.failed);
+  const exitCode = Number(testResults.exit_code);
+  return (!Number.isFinite(failed) || failed === 0)
+    && (!Number.isFinite(exitCode) || exitCode === 0);
+}
+
+function isStrictTestEvidence(event, changeName) {
+  const testResults = event?.details?.test_results;
+  if (event?.type !== 'test_result' || event.change !== changeName) return false;
+  if (!event.run_id || !event.source || testResults?.evidence_tier !== 'strict') return false;
+  if (!['green', 'refactor', 'regression'].includes(testResults.tdd_phase)) return false;
+  if (!Number.isInteger(testResults.exit_code) || testResults.counts_known !== true) return false;
+  return event.result === 'success'
+    && testResults.exit_code === 0
+    && Number(testResults.failed) === 0
+    && isPassingTestDetails(testResults);
+}
+
 function loadChangeEvents(projectRoot, changeName) {
   const safe = safeChangeName(changeName);
   const dir = path.join(projectRoot, 'skywalk-sdd', 'events', safe);
@@ -100,33 +120,36 @@ function loadChangeEvents(projectRoot, changeName) {
 function hasRealTestExecution(projectRoot, changeName, capability, sinceTimestamp) {
   const since = sinceTimestamp ? new Date(sinceTimestamp).getTime() : 0;
   const events = loadChangeEvents(projectRoot, changeName);
+  let legacyEvidence = null;
 
   for (const event of events) {
     const ts = new Date(event.timestamp || 0).getTime();
     if (since && ts < since) continue;
 
-    if (event.type === 'stage_end' && event.command === 'test' &&
-        (event.result === 'success' || event.result === 'failure')) {
-      return { kind: 'opsx-test', event };
+    if (event.type === 'stage_end' && event.command === 'test' && event.result === 'success') {
+      legacyEvidence ||= { kind: 'legacy-opsx-test', event };
     }
 
     if (event.type === 'test_result') {
       const tr = event.details && event.details.test_results;
-      if (isRealTestDetails(tr)) {
-        return { kind: 'test_result', event };
+      if (isStrictTestEvidence(event, changeName)) {
+        return { kind: 'strict-test-result', event };
+      }
+      if (event.result === 'success' && isPassingTestDetails(tr)) {
+        legacyEvidence ||= { kind: 'legacy-test-result', event };
       }
     }
 
     if (event.type === 'task_update' && (event.command === 'apply' || !event.command)) {
       const tr = event.details && event.details.test_results;
-      if (isRealTestDetails(tr)) {
+      if (event.result !== 'failure' && isPassingTestDetails(tr)) {
         if (!capability || !event.capability || event.capability === capability) {
-          return { kind: 'task_update', event };
+          legacyEvidence ||= { kind: 'legacy-task-update', event };
         }
       }
     }
   }
-  return null;
+  return legacyEvidence;
 }
 
 function isApplyCompletionBash(command) {
@@ -210,9 +233,10 @@ function shouldGate(projectRoot, applyEvent) {
     applyEvent.capability,
     applyEvent.timestamp
   );
-  if (evidence) {
+  if (evidence?.kind === 'strict-test-result') {
     return null;
   }
+  if (evidence) return { strategy, changeName: applyEvent.change, capability: applyEvent.capability, legacyEvidence: evidence };
   return { strategy, changeName: applyEvent.change, capability: applyEvent.capability };
 }
 
@@ -374,6 +398,11 @@ if (require.main === module) {
   if (!gate) {
     process.exit(0);
   }
+  if (gate.legacyEvidence) {
+    recordWarning(projectRoot, { ...activeApply, test_strategy: gate.strategy }, 'legacy_test_evidence',
+      '仅检测到旧版测试证据；本次兼容放行，请补录包含 run-id、exit code、TDD phase 和严格身份字段的 test_result');
+    process.exit(0);
+  }
 
   const reason = buildReason(gate.strategy, gate.changeName, gate.capability);
   recordWarning(projectRoot, { ...activeApply, test_strategy: gate.strategy }, 'apply_test_missing', 'Apply test gate blocked: no unit test evidence');
@@ -391,5 +420,6 @@ module.exports = {
   detectMissingTddRed,
   hasExistingWarning,
   isRealTestDetails,
+  isStrictTestEvidence,
   requiresUnitTests,
 };