kld-sdd 2.7.8-2 → 2.7.8-4

package/templates/git-hooks/commit-msg-sdd-trailer.cjs

@@ -1,19 +1,8 @@
 #!/usr/bin/env node
 'use strict';
 
-/**
- * commit-msg hook，两种布局：
- *
- * - 多仓（代码仓有 .sdd.yaml，spec 是另一个 clone）：
- *   写 Spec-Revision（spec 干净 HEAD 的完整 SHA）+ Spec-Change（活动 change，可多条）。
- * - 单仓（openspec 与代码同仓）：
- *   spec 与代码在同一次 commit 里，指针自指无意义 → 只写 Spec-Change，不写 Spec-Revision，
- *   且不做「spec 工作区干净」检查（提交进行中必然是脏的）。
- *
- * Spec-Change 来源：KLD_SDD_CHANGE（显式覆盖）> sdd.config.yaml active_changes。
- * Not from branch name, ever.
- *
- * Authority: 10-最小化多仓库关联与变更命名方案.md
+/** Local provenance only. Explicit Change or exact reviewed index match; failures are advisory.
+ * Spec-Revision is written only for a clean, matching, separate Spec repository.
  */
 
 const fs = require('fs');
@@ -30,7 +19,7 @@ function resolveOntologyDir() {
 const ontologyDir = resolveOntologyDir();
 const changeKey = require(path.join(ontologyDir, 'change-key.cjs'));
 const sddConfig = require(path.join(ontologyDir, 'sdd-config.cjs'));
-const activeChanges = require(path.join(ontologyDir, 'active-changes.cjs'));
+const snap = require('./delivery-snapshot.cjs');
 const { parseFrontmatter } = require(path.join(ontologyDir, 'artifact-parser.cjs'));
 
 function projectRootFromHook() {
@@ -40,8 +29,7 @@ function projectRootFromHook() {
 }
 
 function fail(message) {
-  console.error(`[kld-sdd commit-msg] ${message}`);
-  process.exit(1);
+  throw new Error(message);
 }
 
 function isSddLinkedCodeRepo(codeRepoRoot) {
@@ -67,9 +55,6 @@ function resolveLayout(repoRoot, env = process.env) {
   if (!context.specPath) {
     fail(context.message || '无法解析 spec clone 路径。请执行 kld-sdd link-spec --path=<spec>');
   }
-  if (context.code === sddConfig.CODES.SPEC_PATH_INVALID) {
-    fail(context.message);
-  }
   // specPath 指回本仓根：等同单仓（兼容旧平铺）；若指向仓内包裹包仍按 mono
   const resolvedSpec = path.resolve(context.specPath);
   const resolvedRoot = path.resolve(repoRoot);
@@ -79,6 +64,7 @@ function resolveLayout(repoRoot, env = process.env) {
   if (resolvedSpec.startsWith(`${resolvedRoot}${path.sep}`)) {
     return { mode: 'mono', specPath: resolvedSpec, context };
   }
+  if (context.code === sddConfig.CODES.SPEC_PATH_INVALID) fail(context.message);
   return { mode: 'multi', specPath: context.specPath, context };
 }
 
@@ -101,24 +87,42 @@ function parseEnvChangeKeys(env = process.env) {
 }
 
 /**
- * Spec-Change values: explicit env wins, otherwise every active change
- * registered in the spec repo's sdd.config.yaml.
+ * Spec-Change values: explicit env wins, otherwise an exact reviewed index match.
  */
-function resolveChangeKeys(specRoot, env = process.env) {
+function resolveChangeKeys(specRoot, env = process.env, repoRoot = projectRootFromHook()) {
   const fromEnv = parseEnvChangeKeys(env);
   if (fromEnv) {
-    for (const key of fromEnv) {
-      requireChangeDir(specRoot, key, { strict: true });
-    }
+    for (const key of fromEnv) requireChangeDir(specRoot, key, { strict: true });
     return { keys: fromEnv, source: 'env' };
   }
-  const registered = activeChanges.activeChangeKeys(specRoot);
-  const keys = registered.filter((key) => requireChangeDir(specRoot, key, { strict: false }));
-  return { keys, source: 'sdd.config.yaml' };
+  // The active registry describes ongoing work, not the ownership of this commit.
+  const identity = snap.repoIdentity(repoRoot);
+  const file = path.join(specRoot, 'skywalk-sdd/state/delivery-associations', `${snap.digest(identity)}.json`);
+  if (!fs.existsSync(file)) return { keys: [], source: 'pending' };
+  const saved = JSON.parse(fs.readFileSync(file, 'utf8'));
+  const staged = snap.git(repoRoot, ['diff', '--cached', '--name-only', '--no-renames', '-z']).split('\0').filter(Boolean);
+  if (!staged.length || staged.length > 200 || saved.repository !== identity) return { keys: [], source: 'pending' };
+  const knownFiles = new Set(Object.values(saved.changes || {}).flatMap(item => (item.coveredFiles || []).map(f => f.path)));
+  if (staged.some(file => !knownFiles.has(file))) return { keys: [], source: 'pending' };
+  const candidates = [];
+  const entries = snap.entriesAt(repoRoot, 'index').filter(e => staged.includes(e.path));
+  const blobs = snap.readBlobs(repoRoot, entries);
+  for (const [key, association] of Object.entries(saved.changes || {})) {
+    const covered = new Map((association.coveredFiles || []).map(f => [f.path, f]));
+    if (staged.every(file => {
+      const meta = covered.get(file);
+      if (!meta) return false;
+      if (meta.deleted) return !entries.some(e => e.path === file);
+      const content = blobs.get(file);
+      return content && snap.fileMeta(file, content, meta.mode).sha256 === meta.sha256 && entries.find(e => e.path === file)?.mode === meta.mode;
+    }) && requireChangeDir(specRoot, key, { strict: false })) candidates.push(key);
+  }
+  // Multiple matching reviews are ambiguous too; explicit selection supports multi-change commits.
+  return { keys: candidates.length === 1 ? candidates : [], source: candidates.length === 1 ? 'review' : 'pending' };
 }
 
 /**
- * @param {{ strict: boolean }} options strict=true 阻断提交；false 仅警告并跳过该条
+ * @param {{ strict: boolean }} options strict=true 抛出关联错误；false 仅警告并跳过该条（外层均允许保存）
  */
 function requireChangeDir(specRoot, key, options = { strict: true }) {
   const proposalPath = path.join(specRoot, 'openspec', 'changes', key, 'proposal.md');
@@ -181,52 +185,39 @@ function resolveMsgFile(argv = process.argv) {
 
 function main(env = process.env) {
   const msgFile = resolveMsgFile();
-  if (!msgFile) {
-    fail('缺少 commit message 文件参数');
-  }
-
+  if (!msgFile) fail('缺少 commit message 文件参数');
   const repoRoot = projectRootFromHook();
-  const layout = resolveLayout(repoRoot, env);
-
-  // 未接入 SDD 的普通代码仓：不写 Trailer
-  if (layout.mode === 'unlinked') {
-    process.exit(0);
-  }
-
-  const trailers = {
-    // 多个活动 change 时写多条 Spec-Change
-    'Spec-Change': resolveChangeKeys(layout.specPath, env).keys,
-  };
-
-  if (layout.mode === 'multi') {
-    const context = layout.context;
-    // remote mismatch：仍允许写本地 Revision（溯源本地快照）；仅警告
-    if (context.code === sddConfig.CODES.REMOTE_MISMATCH) {
-      console.error(`[kld-sdd commit-msg] 警告: ${context.message}`);
-    }
-
-    if (!sddConfig.gitWorkingTreeClean(layout.specPath)) {
-      fail('spec 工作区不干净。请先提交或暂存 spec 变更后再提交代码。');
-    }
-
-    const revision = sddConfig.gitHeadSha(layout.specPath);
-    if (!revision || revision.length < 40) {
-      fail(`无法读取完整 Spec-Revision（需要完整 SHA）: ${revision}`);
+  // Keep only the index context for the code repo (git commit -a uses a temporary index).
+  for (const key of ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES']) delete process.env[key];
+  const original = fs.readFileSync(msgFile, 'utf8');
+  let trailers = { 'Spec-Change': [], 'Spec-Revision': [] };
+  try {
+    const layout = resolveLayout(repoRoot, env);
+    if (layout.mode === 'unlinked') return;
+    const association = resolveChangeKeys(layout.specPath, env, repoRoot);
+    trailers['Spec-Change'] = association.keys;
+    if (!association.keys.length) console.error('[SDD] 本次提交的 Change 待关联；未从活动列表猜测归属');
+    if (layout.mode === 'multi' && association.keys.length) {
+      if (layout.context.code === sddConfig.CODES.REMOTE_MISMATCH) fail(layout.context.message);
+      if (!layout.context.sddYaml?.ok || !layout.context.specRemote || !sddConfig.remotesMatch(layout.context.sddYaml.spec_repository, layout.context.specRemote)) fail('Spec 来源仓库尚未确认，不能写入精确 Revision');
+      const dirty = snap.git(layout.specPath, ['status', '--porcelain', '--untracked-files=normal']).trim();
+      if (dirty) console.error('[SDD] Spec 尚有未提交内容，Spec-Revision 待绑定；本次提交继续');
+      else {
+        const revision = snap.git(layout.specPath, ['rev-parse', '--verify', 'HEAD']).trim();
+        if (!/^[a-f0-9]{40}$|^[a-f0-9]{64}$/.test(revision)) fail('无法读取完整 Spec-Revision');
+        trailers['Spec-Revision'] = revision;
+      }
     }
-    trailers['Spec-Revision'] = revision;
+  } catch (error) {
+    trailers = { 'Spec-Change': [], 'Spec-Revision': [] };
+    console.error(`[SDD] 关联待补充：${error.message}；本次提交继续`);
   }
-
-  const original = fs.readFileSync(msgFile, 'utf8');
-  const updated = upsertTrailers(original, trailers);
-  fs.writeFileSync(msgFile, updated, 'utf8');
+  fs.writeFileSync(msgFile, upsertTrailers(original, trailers), 'utf8');
 }
 
 if (require.main === module) {
-  try {
-    main();
-  } catch (error) {
-    fail(error.message || String(error));
-  }
+  try { main(); }
+  catch (error) { console.error(`[SDD] 关联待补充：${error.message}；本次提交继续`); }
 }
 
 module.exports = {

package/templates/git-hooks/consistency-check-core.cjs

@@ -1,26 +1,10 @@
 #!/usr/bin/env node
 'use strict';
 
-/**
- * consistency-check-core.cjs
- *
- * pre-commit / pre-push 一致性校验 hook 的共享核心（非独立插件，不在 hooks.config 中登记）。
- * 两个入口脚本通过 require 引用本模块，注入各自差异配置：
- * - diff 采集方式（pre-commit: git diff HEAD；pre-push: 待推送范围 @{push}..HEAD）
- * - 是否检查置信度（pre-commit 检查；pre-push 轻量跳过）
- * - strict 模式（仅 pre-commit 支持 SDD_STRICT_CONSISTENCY）
- * - 过期比对来源（pre-commit: 工作区内容；pre-push: HEAD 已提交内容，staleFromHead）
- * - 提示文案（提交 / 推送）
- *
- * 核心行为（简化版）：
- * - diff 驱动：仅检查 diff 文件与报告 coveredFiles 有交集的 change，无关 change 跳过
- * - 多仓归属过滤：报告 repositories 已声明覆盖仓库且不含当前仓的 change 静默跳过（不输出、不拦截）
- * - 纯注释/空行/空格变更过滤：diff 中所有变更行均为注释/空行/空格的文件直接跳过，不参与校验
- * - 报告存在性：活跃 change 无报告 → 阻止
- * - 报告过期：diff 业务代码与 coveredFiles 交集文件内容变化（size 短路 + SHA-256）→ 阻止
- * - 置信度门禁（仅 pre-commit）：low → 阻止；strict 时 medium 也阻止
- * - 无活跃 change 但 diff 有业务代码 → 阻止（提示先执行 opsx-propose）
- * - 变更范围采集失败 → 阻止（避免静默放行的 fail-open）
+/** Shared collection utilities and the optional strict index entry.
+ * Delivery readiness uses delivery-check.cjs receipts with complete input fingerprints.
+ * Legacy JSON parsing helpers remain available for readers; old confidence-only reports
+ * cannot satisfy the strict entry. Daily commit/push do not call this module by default.
  */
 
 const fs = require('fs');
@@ -105,7 +89,7 @@ function parseReport(reportPath) {
         : raw;
       const t = new Date(normalized.replace(/-/g, '/')).getTime();
       if (!isNaN(t)) {
-        generatedAtMs = t + 1000;
+        generatedAtMs = t;
       } else {
         generatedAtFormatError = `generatedAt 无法解析（实际: ${raw}，应为 YYYY-MM-DD HH:mm:ss 本地时间）`;
       }
@@ -417,8 +401,7 @@ function getModifiedFiles(projectRoot, diffFn, options = {}) {
 /**
  * 解析 INI 风格的 [consistency] 段，返回段内所有 key=value。
  */
-function parseConsistencySection() {
-  const configPath = path.join(__dirname, 'hooks.config');
+function parseConsistencySection(configPath = path.join(__dirname, 'hooks.config')) {
   const values = {};
   try {
     const content = fs.readFileSync(configPath, 'utf8');
@@ -448,8 +431,8 @@ const CONSISTENCY_CONFIG = parseConsistencySection();
  * 业务代码扩展名白名单（business_code_exts，唯一来源为 hooks.config，无内置默认值）。
  * @returns {{exts: Set<string>, source: 'config'|'missing'|'empty', configPath: string|null}}
  */
-function loadBusinessCodeExts() {
-  const { configPath, values } = CONSISTENCY_CONFIG;
+function loadBusinessCodeExts(file) {
+  const { configPath, values } = file ? parseConsistencySection(file) : CONSISTENCY_CONFIG;
   const rawValue = Object.prototype.hasOwnProperty.call(values, 'business_code_exts')
     ? values.business_code_exts : null;
 
@@ -490,14 +473,14 @@ const CONSISTENCY_MODE = loadConsistencyMode();
 const TOOLCHAIN_CONFIG_RE = /^(?:vite|vitest|next|nuxt|astro|svelte|remix|webpack|rollup|babel|jest|playwright|cypress|eslint|prettier|tailwind|postcss|karma|wrangler|nest-cli|angular|vue|craco|rspack|metro|tsconfig|jsconfig|turbo|nx)\.(?:config|conf)\.[a-z]+$/i;
 const DOTFILE_CONFIG_RE = /^\.?(?:eslintrc|babelrc|prettierrc|stylelintrc)\.[a-z]+$/i;
 
-function isBusinessCode(file) {
+function isBusinessCode(file, exts = BUSINESS_CODE_EXTS) {
   const normalized = String(file).replace(/\\/g, '/');
   const base = normalized.split('/').pop() || '';
 
   const dot = base.lastIndexOf('.');
   if (dot < 0) return false;
   const ext = base.slice(dot).toLowerCase();
-  if (!BUSINESS_CODE_EXTS.has(ext)) return false;
+  if (!(exts instanceof Set ? exts : BUSINESS_CODE_EXTS).has(ext)) return false;
 
   if (/\.d\.tsx?$/i.test(base)) return false;
   if (/(^|\/)(dist|build|target|out|node_modules)\//.test(normalized)) return false;
@@ -634,25 +617,12 @@ function normalizeEolLf(buf) {
   return Buffer.from(str.replace(/\r\n/g, '\n'), 'binary');
 }
 
-/**
- * 单文件过期判断（mtime 快速跳过 + size 短路 + SHA-256，行尾归一化）。
- * mtime 快速路径：文件修改时间早于报告生成时间 → 报告生成后从未被碰过 → 内容必然未变，
- * 跳过读取和哈希（大变更场景省 100-300ms/百文件）。mtime 晚于报告时间才做精确哈希判断，
- * 因此 git pull/checkout 重置 mtime（内容未变）只会多算一次哈希，不会误判过期。
- */
+/** 内容哈希是有效性依据，mtime 不参与正确性判断。 */
 function isFileChangedOnDisk(fp, metas, reportTime, readContent = readWorkingFile, relFile = '') {
   const list = Array.isArray(metas) ? metas : (metas ? [metas] : []);
   const hashed = list.filter(m => m && m.sha256);
 
   if (hashed.length) {
-    // mtime 快速跳过：仅在能拿到本地文件时（readContent 为工作区读取）且 mtime 可信时启用
-    if (readContent === readWorkingFile) {
-      try {
-        if (fs.statSync(fp).mtimeMs <= reportTime) return false;
-      } catch {
-        return true; // 文件不存在 → 过期
-      }
-    }
     const content = readContent(fp, relFile);
     if (content === null) return true;
     const normalized = normalizeEolLf(content);
@@ -663,14 +633,8 @@ function isFileChangedOnDisk(fp, metas, reportTime, readContent = readWorkingFil
     return !candidates.some(m => hash === String(m.sha256).toLowerCase());
   }
 
-  // 无哈希条目：mtime 比较
-  let stat;
-  try {
-    stat = fs.statSync(fp);
-  } catch {
-    return true;
-  }
-  return stat.mtimeMs > reportTime;
+  // mtime cannot prove content equality. Legacy entries without hashes need review.
+  return true;
 }
 
 /**
@@ -773,205 +737,62 @@ function generateInstructions(opts, result, warnOnly) {
  * @param {object} opts 入口差异配置
  */
 function runConsistencyCheck(opts) {
-  const {
-    label, actionNoun, diffFn,
-    checkConfidence = false, includeUntracked = true,
-    staleFromHead = false,
-  } = opts;
+  const { label, actionNoun, diffFn, includeUntracked = false, staleFromHead = false, staleFromIndex = false } = opts;
   const projectRoot = path.resolve(readArg('project') || process.env.SDD_PROJECT || process.cwd());
-
-  // 模式解析
-  const envSkip = process.env.SDD_SKIP_CONSISTENCY_CHECK;
-  const envStrict = process.env.SDD_STRICT_CONSISTENCY;
-  const envWarnOnly = process.env.SDD_WARN_ONLY;
-  const skip = envSkip !== undefined ? envSkip === '1' : CONSISTENCY_MODE.skip;
-  const strict = envStrict !== undefined ? envStrict === '1' : CONSISTENCY_MODE.strict;
-  const warnOnly = envWarnOnly !== undefined ? envWarnOnly === '1' : CONSISTENCY_MODE.warnOnly;
-
-  // 互斥检查
-  const activeModes = [skip, strict, warnOnly].filter(Boolean).length;
-  if (activeModes > 1) {
-    const names = [
-      ...(skip ? ['SDD_SKIP_CONSISTENCY_CHECK' + (envSkip === undefined ? '(hooks.config)' : '')] : []),
-      ...(strict ? ['SDD_STRICT_CONSISTENCY' + (envStrict === undefined ? '(hooks.config)' : '')] : []),
-      ...(warnOnly ? ['SDD_WARN_ONLY' + (envWarnOnly === undefined ? '(hooks.config)' : '')] : []),
-    ];
-    console.error(`${label} 错误：${names.join('、')} 互斥，只能启用一个`);
-    process.exit(1);
-  }
-
-  if (skip) {
-    console.log(`${label} 跳过校验`);
-    process.exit(0);
-  }
-
-  if (warnOnly) console.log(`${label} 仅告警模式`);
-
-  // 配置缺失/空清单显式告警
-  if (BUSINESS_CODE_EXTS_INFO.source !== 'config') {
-    const reason = BUSINESS_CODE_EXTS_INFO.source === 'missing'
-      ? '未配置 business_code_exts（hooks.config 缺失或无 [consistency] 段）'
-      : 'business_code_exts 为空清单';
-    console.warn(`${label} ⚠️  ${reason}，一致性校验不拦截任何业务代码文件（仅保留报告存在性/过期检查）`);
-    console.warn(`${label} ℹ️  请在 ${BUSINESS_CODE_EXTS_INFO.configPath || path.join(__dirname, 'hooks.config')} 的 [consistency] 段配置 business_code_exts`);
-  }
-
-  const specRoot = resolveSpecRoot();
-
-  // 1. 采集 diff 文件
-  const { files: modifiedFiles, deleted: deletedFiles, failed: diffFailed } =
-    getModifiedFiles(projectRoot, diffFn, { includeUntracked });
-
-  if (diffFailed) {
-    console.log(`${label} ❌ 无法确定本次${actionNoun}的变更范围（git diff 采集失败），拒绝${actionNoun}`);
-    if (warnOnly) {
-      console.log(`${label} 仅告警模式，放行${actionNoun}`);
-      process.exit(0);
-    }
+  const mode = loadConsistencyMode();
+  const skip = process.env.SDD_SKIP_CONSISTENCY_CHECK === undefined ? mode.skip : process.env.SDD_SKIP_CONSISTENCY_CHECK === '1';
+  const strict = process.env.SDD_STRICT_CONSISTENCY === undefined ? mode.strict : process.env.SDD_STRICT_CONSISTENCY === '1';
+  const warnOnly = process.env.SDD_WARN_ONLY === undefined ? mode.warnOnly : process.env.SDD_WARN_ONLY === '1';
+  if ([skip, strict, warnOnly].filter(Boolean).length > 1) {
+    console.error(`${label} skip / strict / warn_only 互斥`);
     process.exit(1);
   }
-
-  // 2. 筛选业务代码文件
-  const diffBusinessFiles = modifiedFiles.filter(isBusinessCode);
-  const deletedBusinessFiles = deletedFiles.filter(isBusinessCode);
-
-  // 3. 无业务代码文件 → 放行
-  if (diffBusinessFiles.length === 0 && deletedBusinessFiles.length === 0) {
+  if (skip) { console.log(`${label} 跳过校验`); process.exit(0); }
+  const problems = [];
+  const { files, deleted, failed } = getModifiedFiles(projectRoot, diffFn, { includeUntracked });
+  if (failed) problems.push('无法确定变更范围');
+  if (BUSINESS_CODE_EXTS_INFO.source !== 'config') problems.push('business_code_exts 未配置，不能证明检查完整');
+  const required = [...new Set([...files, ...deleted])].filter(isBusinessCode);
+  if (!problems.length && !required.length) {
     console.log(`${label} 本次${actionNoun}无业务代码文件，跳过一致性校验`);
     process.exit(0);
   }
-
-  // 4. 活跃 change 发现
-  const changes = discoverActiveChanges(specRoot);
-  if (!changes.length) {
-    console.log([
-      '', '==========================================',
-      `${label} 存在业务代码变更但无活跃 change 可归属，拒绝${actionNoun}：`,
-      '',
-      '  请先执行 opsx-propose 创建变更（登记到 sdd.config.yaml 的 active_changes），',
-      '  再执行 opsx-consistency-check 生成一致性报告。',
-      '==========================================', '',
-    ].join('\n'));
-    if (warnOnly) {
-      console.log(`${label} 仅告警模式，放行${actionNoun}`);
-      process.exit(0);
-    }
-    process.exit(1);
-  }
-
-  // 5. 逐 change 解析报告
-  const parseError = [];
-  const invalid = [];
-  const lowConfidence = [];
-  const stale = [];
-  const missing = [];
-  const parsedReports = new Map();
-
-  // 当前代码仓目录名（多仓布局下用于报告归属过滤 + normalizeCoveredFiles 兜底前缀剥离）
-  const currentRepoName = path.basename(projectRoot).toLowerCase();
-
-  for (const cn of changes) {
-    const rp = findReportJson(specRoot, cn);
-    if (!rp) {
-      missing.push(cn);
-      continue;
-    }
-
-    const report = parseReport(rp);
-    if (report.parseError) {
-      console.warn(`${label} ⚠️  ${cn} 报告解析失败`);
-      parseError.push(cn);
-      continue;
-    }
-
-    // 旧格式报告（无 coveredFiles）
-    if (!report.coveredFiles) {
-      console.log(`${label} ⚠️  ${cn}: 报告为旧格式（缺少 coveredFiles），建议重新生成`);
-      missing.push(cn);
-      continue;
-    }
-
-    // 字段合法性校验（仅 confidence + generatedAt）
-    const fieldErrors = validateReportFields(report);
-    if (fieldErrors.length) {
-      console.warn(`${label} ⚠️  ${cn} 报告字段不合法：${fieldErrors.join('；')}`);
-      invalid.push({ cn, errors: fieldErrors });
-      continue;
-    }
-
-    const covered = normalizeCoveredFiles(report, currentRepoName);
-    parsedReports.set(cn, { report, covered });
-  }
-
-  // 6. 对 diff（含删除）与 coveredFiles 有交集的 change 检查报告
-  const checkFiles = [...new Set([...diffBusinessFiles, ...deletedBusinessFiles])];
-  const checkFilesLower = checkFiles.map(f => f.toLowerCase());
-
-  let headContentCache = null;
-  const readContent = staleFromHead
-    ? (fp, relFile) => {
-        if (headContentCache === null) {
-          headContentCache = gitShowHeadContentBatch(projectRoot, checkFiles);
-        }
-        const fromHead = headContentCache.get(relFile);
-        return fromHead !== undefined && fromHead !== null ? fromHead : readWorkingFile(fp);
-      }
-    : readWorkingFile;
-
-  for (const [cn, { report, covered }] of parsedReports) {
-    // 多仓归属过滤：报告显式声明了覆盖仓库且不含当前仓 → 与本仓无关，静默跳过
-    // （repositories 为空视为未声明，保持原交集判断行为，兼容单仓与旧报告）
-    const declaredRepos = (report.repositories || [])
-      .map(r => String(r && r.path || '').replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase())
-      .filter(Boolean);
-    if (declaredRepos.length && !declaredRepos.includes(currentRepoName)) {
-      continue;
-    }
-
-    const hasIntersection = checkFilesLower.some(f => covered.has(f));
-    if (!hasIntersection) {
-      console.log(`${label} ⏭️  ${cn}: 与本次${actionNoun}无交集，跳过`);
-      continue;
-    }
-
-    if (isReportStale(report, covered, checkFiles, projectRoot, readContent)) {
-      console.log(`${label} ⚠️  ${cn}: 报告已过期`);
-      stale.push(cn);
-      continue;
-    }
-
-    if (checkConfidence) {
-      const c = report.confidence;
-      if (c === 'low' || (c === 'medium' && strict)) {
-        console.log(`${label} ❌ ${cn}: 置信度 ${c}`);
-        lowConfidence.push(cn);
+  const delivery = require('./delivery-check.cjs');
+  const snap = require('./delivery-snapshot.cjs');
+  const specRoot = resolveSpecRoot();
+  const explicit = String(readArg('change') || process.env.KLD_SDD_CHANGE || '').split(/[,\s]+/).filter(Boolean);
+  const changes = explicit.length ? explicit : discoverActiveChanges(specRoot);
+  const covered = new Set();
+  for (const change of changes) {
+    try {
+      const identity = snap.repoIdentity(projectRoot);
+      const rp = delivery.reviewPath({ specRoot, change, identity });
+      if (!fs.existsSync(rp)) {
+        // Unrelated active changes do not require a report for this commit.
+        if (explicit.includes(change)) problems.push(`${change}: 缺少一致性检查回执，请运行 opsx-consistency-check`);
         continue;
       }
-      console.log(`${label} ✅ ${cn}: 置信度 ${c}`);
-    } else {
-      console.log(`${label} ✅ ${cn}: 报告有效`);
-    }
-  }
-
-  const result = {
-    missing, parseError, invalid, lowConfidence, stale,
-  };
-
-  const hasBlocking = missing.length || parseError.length || invalid.length || lowConfidence.length
-    || stale.length;
-
-  if (hasBlocking) {
-    console.log(generateInstructions(opts, result, warnOnly));
-
-    if (warnOnly) {
-      console.log(`${label} 仅告警模式，放行${actionNoun}`);
-      process.exit(0);
-    }
-
-    process.exit(1);
-  }
-
-  console.log(`\n${label} ✅ 本次${actionNoun}涉及的业务代码均已通过一致性校验，放行${actionNoun}`);
+      const report = JSON.parse(fs.readFileSync(rp, 'utf8'));
+      if (!explicit.includes(change) && !required.some(f => (report.reviewedFiles || []).includes(f))) continue;
+      const ctx = delivery.context({ project: projectRoot, 'spec-root': specRoot, change,
+        scope: staleFromHead ? 'commit' : staleFromIndex ? 'index' : 'worktree',
+        base: opts.base || report.base, ref: opts.ref || 'HEAD', 'spec-ref': opts.specRef });
+      // This report need only cover its own files; union coverage is asserted below.
+      ctx.required = required.filter(f => (report.reviewedFiles || []).includes(f));
+      const errors = delivery.reviewErrors(ctx, report);
+      if (errors.length) problems.push(`${change}: 报告过期或未完成：${errors.join('；')}`);
+      else for (const file of ctx.required) covered.add(file);
+    } catch (error) { problems.push(`${change}: ${error.message}`); }
+  }
+  const uncovered = required.filter(file => !covered.has(file));
+  if (uncovered.length) problems.push(`缺少有效检查覆盖（UNCOVERED_FILES）：${uncovered.join(', ')}`);
+  if (problems.length) {
+    console.log(`${label} 未通过：\n${problems.map(p => `  - ${p}`).join('\n')}`);
+    console.log('请由 opsx-consistency-check 更新回执；日常提交默认不运行此严格入口。');
+    if (warnOnly) console.log(`${label} 仅告警模式，放行${actionNoun}（不代表已通过检查）`);
+    process.exit(warnOnly ? 0 : 1);
+  }
+  console.log(`${label} 本次${actionNoun}涉及的业务代码均已通过一致性校验`);
   process.exit(0);
 }