opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/fact-check-x-unified/scripts/fact_check_x.py

@@ -0,0 +1,1832 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import hashlib
+import html
+import json
+import os
+import re
+import secrets
+import shutil
+import subprocess
+import sys
+import zipfile
+from pathlib import Path, PureWindowsPath
+from urllib.parse import quote
+
+from common import PipelineError, dump_json, load_json, now_iso
+from trusted_search_config import (
+    PROVIDER_URL,
+    ConfigurationError,
+    load_trusted_search_key,
+    trusted_search_key_for_execution,
+)
+
+
+DEPENDENCIES = {
+    "collector": "llm-answer-reference-compare",
+    "comparison": "fact-check-x-knowledge-compare",
+    "authority": "fact-check-x-authoritative-verify",
+}
+
+DEPENDENCY_ENTRYPOINTS = {
+    "collector": Path("assets/tool/dist/cli.js"),
+    "comparison": Path("scripts/knowledge_compare.py"),
+    "authority": Path("scripts/authority_verify.py"),
+}
+
+COLLECTOR_RUNTIME_PACKAGES = (
+    Path("node_modules/@playwright/test/package.json"),
+    Path("node_modules/commander/package.json"),
+    Path("node_modules/zod/package.json"),
+)
+
+TRUSTED_SEARCH_CONFIGURATION_PROMPT = (
+    "部分知识点还需要调用可信搜索。首次使用时，我会打开深知智能 MaaS 平台"
+    f"（{PROVIDER_URL}）。您只需完成登录；技能会自动读取已有的可用 Key，"
+    "没有时创建 Fact-Check-X 专用 Key，验证后保存到本机共享配置，并自动继续。"
+    "后续在 Codex、Claude Code、WorkBuddy 等载体中都会直接复用，已有配置时"
+    "不会再次打开登录页。Key 不会进入对话、命令输出或核验报告。"
+)
+
+PORTABLE_REPORT_PACKAGE = "05-complete-report-package.zip"
+PORTABLE_REPORT_ROOT = Path("fact-check-x-report")
+PORTABLE_REPORT_README = """Fact-Check-X 完整事实核验报告包
+
+建议按以下顺序打开：
+1. 01-capture-report.html：各方答案汇总
+2. 02-comparison-report.html：各方答案聚合（未核验）
+3. 03-authority-report.html：权威核验后的最终答案
+4. 04-final-report.html：各方答案测评报告
+
+请先解压整个压缩包，再用浏览器打开 HTML 文件，以保留截图、页面存证和报告导航。
+"""
+
+REPORT_NAV_ITEMS = (
+    ("01-capture-report.html", "各方答案汇总"),
+    ("02-comparison-report.html", "各方答案聚合"),
+    ("03-authority-report.html", "权威核验答案"),
+    ("04-final-report.html", "各方答案测评报告"),
+)
+REPORT_NAV_STYLE = """
+.fcx-report-nav{display:flex;flex-wrap:wrap;gap:8px;margin:14px auto 18px;max-width:1440px;padding:10px 24px;border-top:1px solid #d7dde7;border-bottom:1px solid #d7dde7;background:#fff}
+.fcx-report-nav a,.fcx-report-nav span{display:inline-flex;align-items:center;min-height:32px;padding:5px 10px;border-radius:6px;font-size:13px;text-decoration:none}
+.fcx-report-nav a{border:1px solid #c8d1dc;background:#fff;color:#285a9f}
+.fcx-report-nav a:hover{border-color:#285a9f;color:#173f74}
+.fcx-report-nav span{border:1px solid #187454;background:#e8f5f0;color:#125b42;font-weight:700}
+@media(max-width:760px){.fcx-report-nav{padding:9px 12px;overflow-x:auto;flex-wrap:nowrap}.fcx-report-nav a,.fcx-report-nav span{white-space:nowrap}}
+.fcx-run-notice{max-width:1440px;margin:0 auto 18px;padding:12px 24px;border:1px solid #f0b429;border-left:5px solid #f0b429;border-radius:6px;background:#fffaf0;color:#6b4e07;font-size:13px;line-height:1.6}
+.fcx-run-notice strong{display:block;margin-bottom:6px;font-size:14px;color:#8a5a00}
+.fcx-run-notice ul{margin:0 0 6px;padding-left:20px}
+.fcx-run-notice li{margin:2px 0}
+.fcx-run-notice .fcx-run-notice-tail{color:#7a6320}
+@media(max-width:760px){.fcx-run-notice{padding:11px 12px}}
+""".strip()
+INTERACTION_GATE_FILE = "stage-checkpoints.json"
+INTERACTION_STAGE_ORDER = ("capture", "comparison", "authority", "evaluation")
+
+
+def interaction_gate_path(run_dir: Path) -> Path:
+    return run_dir / INTERACTION_GATE_FILE
+
+
+def initialize_interaction_gate(run_dir: Path, execution_mode: str) -> None:
+    dump_json(interaction_gate_path(run_dir), {
+        "schemaVersion": "fact-check-x/stage-checkpoints@1",
+        "executionMode": execution_mode,
+        "createdAt": now_iso(),
+        "stages": {},
+    })
+
+
+def load_interaction_gate(run_dir: Path) -> dict:
+    path = interaction_gate_path(run_dir)
+    if not path.exists():
+        raise PipelineError(
+            "缺少阶段交付门禁；请从 prepare-comparison 重新开始"
+        )
+    gate = load_json(path)
+    if gate.get("schemaVersion") != "fact-check-x/stage-checkpoints@1":
+        raise PipelineError("阶段交付门禁版本不正确")
+    return gate
+
+
+def record_stage_checkpoint(
+    run_dir: Path,
+    stage: str,
+    label: str,
+    path: Path,
+    next_stage: str | None,
+) -> dict:
+    if stage not in INTERACTION_STAGE_ORDER:
+        raise PipelineError(f"未知阶段：{stage}")
+    gate = load_interaction_gate(run_dir)
+    resolved = path.resolve()
+    if not resolved.is_file():
+        raise PipelineError(f"阶段产物不存在：{resolved}")
+    artifact = deliverable_descriptor(label, resolved)
+    status = "completed" if not next_stage else "awaiting_user"
+    token = f"fcx_{secrets.token_urlsafe(18)}" if status == "awaiting_user" else None
+    entry = {
+        "stage": stage,
+        "label": label,
+        "path": str(resolved),
+        "fileUri": artifact["fileUri"],
+        "sha256": capture_digest(resolved),
+        "status": status,
+        "nextStage": next_stage,
+        "token": token,
+        "createdAt": now_iso(),
+    }
+    gate.setdefault("stages", {})[stage] = entry
+    dump_json(interaction_gate_path(run_dir), gate)
+    checkpoint = {
+        "required": True,
+        "mustPresentBeforeNextStage": True,
+        "stage": stage,
+        "status": status,
+        "label": label,
+        "path": str(resolved),
+        "fileUri": artifact["fileUri"],
+        "markdownLink": artifact["markdownLink"],
+        "message": artifact["markdownLink"],
+        "gate": str(interaction_gate_path(run_dir).resolve()),
+    }
+    if next_stage:
+        checkpoint.update({
+            "nextStage": next_stage,
+            "choices": ["继续下一步", "修正当前结果", "到此结束并保留产物"],
+        })
+        if token:
+            checkpoint["acknowledgement"] = {
+                "required": True,
+                "token": token,
+                "command": (
+                    "acknowledge-stage --run-dir "
+                    f"{resolved.parent} --stage {stage} --token {token} --decision continue"
+                ),
+            }
+    return checkpoint
+
+
+def require_stage_acknowledged(run_dir: Path, stage: str) -> dict:
+    gate = load_interaction_gate(run_dir)
+    entry = (gate.get("stages") or {}).get(stage)
+    if not entry:
+        raise PipelineError(f"缺少 {stage} 阶段产物交付记录，禁止继续")
+    path = Path(str(entry.get("path") or ""))
+    if not path.is_file() or capture_digest(path) != entry.get("sha256"):
+        raise PipelineError(f"{stage} 阶段产物已缺失或被修改，禁止继续")
+    if entry.get("status") != "acknowledged":
+        raise PipelineError(
+            f"{stage} 阶段产物尚未得到‘继续下一步’确认，禁止进入后续流程"
+        )
+    return entry
+
+
+def acknowledge_stage(args: argparse.Namespace) -> dict:
+    run_dir = require_run(args.run_dir)
+    gate = load_interaction_gate(run_dir)
+    entry = (gate.get("stages") or {}).get(args.stage)
+    if not entry:
+        raise PipelineError(f"未找到可确认的 {args.stage} 阶段")
+    if gate.get("executionMode") != "interactive":
+        raise PipelineError("阶段交付门禁配置无效；请重新执行 prepare-comparison")
+    if entry.get("status") != "awaiting_user" or not secrets.compare_digest(
+        str(entry.get("token") or ""), str(args.token or "")
+    ):
+        raise PipelineError("阶段确认令牌无效或已使用")
+    path = Path(str(entry.get("path") or ""))
+    if not path.is_file() or capture_digest(path) != entry.get("sha256"):
+        raise PipelineError("待确认的阶段产物已缺失或被修改")
+    entry.update({
+        "status": "acknowledged" if args.decision == "continue" else args.decision,
+        "decision": args.decision,
+        "acknowledgedAt": now_iso(),
+        "token": None,
+    })
+    dump_json(interaction_gate_path(run_dir), gate)
+    return {
+        "status": "completed",
+        "stage": args.stage,
+        "decision": args.decision,
+        "nextStageAllowed": args.decision == "continue",
+        "artifact": str(path.resolve()),
+        "fileUri": file_uri_for_path(path.resolve()),
+    }
+
+
+def skill_candidates() -> list[Path]:
+    values = []
+    if os.getenv("FACTCHECK_SKILLS_DIR"):
+        values.append(Path(os.environ["FACTCHECK_SKILLS_DIR"]).expanduser())
+    # The WorkBuddy single-upload package carries the three business layers here.
+    values.append(Path(__file__).resolve().parents[1] / "modules")
+    values.append(Path(__file__).resolve().parents[2])
+    codex_home = Path(os.getenv("CODEX_HOME", Path.home() / ".codex")).expanduser()
+    values.append(codex_home / "skills")
+    output = []
+    for value in values:
+        resolved = value.resolve()
+        if resolved not in output:
+            output.append(resolved)
+    return output
+
+
+def locate_skills() -> dict[str, Path]:
+    found = {}
+    for key, directory in DEPENDENCIES.items():
+        for parent in skill_candidates():
+            candidate = parent / directory
+            if (candidate / "SKILL.md").exists() or (candidate / DEPENDENCY_ENTRYPOINTS[key]).exists():
+                found[key] = candidate
+                break
+        if key not in found:
+            searched = ", ".join(str(path / directory) for path in skill_candidates())
+            raise PipelineError(f"未找到依赖技能 {directory}；已检查：{searched}")
+    return found
+
+
+def installed_version() -> dict:
+    """读取当前实际运行的技能包版本。
+
+    载体界面显示的可能是应用市场上的可用版本而不是本机已安装的版本，两者不一致时
+    很难判断问题出在版本还是代码，所以每次准备运行时都把真实版本连同来源一并回传。
+    版本取自正在执行的这份脚本所在的技能目录，不依赖载体的安装记录。
+    """
+    root = Path(__file__).resolve().parent.parent
+    manifest = root / "package-manifest.json"
+    if manifest.is_file():
+        try:
+            return {
+                "version": str(json.loads(manifest.read_text(encoding="utf-8")).get("version") or "unknown"),
+                "source": str(manifest.resolve()),
+            }
+        except (json.JSONDecodeError, OSError):
+            pass
+    skill_md = root / "SKILL.md"
+    if skill_md.is_file():
+        for line in skill_md.read_text(encoding="utf-8").splitlines():
+            stripped = line.strip()
+            if stripped.startswith("version:"):
+                return {
+                    "version": stripped.split(":", 1)[1].strip().strip('"').strip("'"),
+                    "source": str(skill_md.resolve()),
+                }
+    return {"version": "unknown", "source": str(root.resolve())}
+
+
+def prepare_runtime(skills: dict[str, Path]) -> dict:
+    tool_root = skills["collector"] / "assets" / "tool"
+    package_json = tool_root / "package.json"
+    package_lock = tool_root / "package-lock.json"
+    if not package_json.is_file() or not package_lock.is_file():
+        raise PipelineError("采集运行时缺少 package.json 或 package-lock.json")
+
+    node = shutil.which("node")
+    if not node:
+        raise PipelineError("未找到 Node.js；请安装 Node.js 20 或更高版本后重试")
+
+    def runtime_ready() -> bool:
+        if not all((tool_root / relative).is_file() for relative in COLLECTOR_RUNTIME_PACKAGES):
+            return False
+        probe = subprocess.run(
+            [node, "dist/cli.js", "platforms"],
+            cwd=tool_root,
+            text=True,
+            capture_output=True,
+            check=False,
+            timeout=30,
+        )
+        return probe.returncode == 0
+
+    if runtime_ready():
+        return {
+            "status": "completed",
+            "runtime": "ready",
+            "installAction": "skipped",
+            "toolRoot": str(tool_root.resolve()),
+            "installedVersion": installed_version(),
+        }
+
+    npm = shutil.which("npm")
+    if not npm:
+        raise PipelineError("未找到 npm；请安装 Node.js 20 或更高版本后重试")
+    environment = os.environ.copy()
+    environment["PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD"] = "1"
+    try:
+        install = subprocess.run(
+            [npm, "ci", "--omit=dev", "--no-audit", "--no-fund"],
+            cwd=tool_root,
+            text=True,
+            capture_output=True,
+            check=False,
+            env=environment,
+            timeout=600,
+        )
+    except subprocess.TimeoutExpired as exc:
+        raise PipelineError("采集运行依赖安装超时，请检查 npm 网络后重试") from exc
+    if install.returncode:
+        detail = install.stderr.strip() or install.stdout.strip() or "npm ci 执行失败"
+        raise PipelineError(f"采集运行依赖安装失败：{detail}")
+    if not runtime_ready():
+        raise PipelineError("采集运行依赖安装完成，但运行时自检未通过")
+    return {
+        "status": "completed",
+        "runtime": "ready",
+        "installAction": "installed",
+        "toolRoot": str(tool_root.resolve()),
+        "installedVersion": installed_version(),
+    }
+
+
+def run(command: list[str], environment: dict[str, str] | None = None) -> dict:
+    process = subprocess.run(
+        command,
+        text=True,
+        capture_output=True,
+        check=False,
+        env=environment,
+    )
+    if process.returncode:
+        raise PipelineError(process.stdout.strip() or process.stderr.strip() or "子技能执行失败")
+    lines = [line for line in process.stdout.splitlines() if line.strip()]
+    try:
+        return json.loads(lines[-1]) if lines else {"status": "completed"}
+    except json.JSONDecodeError:
+        return {"status": "completed", "output": process.stdout.strip()}
+
+
+def trusted_search_key() -> str:
+    try:
+        return load_trusted_search_key()
+    except ConfigurationError as exc:
+        raise PipelineError(str(exc)) from exc
+
+
+def validated_authority_key() -> str:
+    try:
+        key, _, _ = trusted_search_key_for_execution()
+        return key
+    except ConfigurationError as exc:
+        raise PipelineError(str(exc)) from exc
+
+
+def trusted_search_configuration() -> dict:
+    helper = Path(__file__).with_name("trusted_search_config.py").resolve()
+    return {
+        "providerUrl": PROVIDER_URL,
+        "command": [sys.executable, str(helper), "configure"],
+        "interaction": "browser_login_only",
+        "requiresChatSecret": False,
+        "autoResume": True,
+        "sharedAcrossCarriers": True,
+    }
+
+
+def require_run(run_dir: str) -> Path:
+    path = Path(run_dir).resolve()
+    path.mkdir(parents=True, exist_ok=True)
+    return path
+
+
+def capture_digest(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for block in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def normalize_platform_path_text(path: Path | str, platform: str | None = None) -> str:
+    raw = str(path)
+    if (platform or os.name) == "nt":
+        match = re.match(r"^/([A-Za-z])(?:/(.*))?$", raw)
+        if match:
+            suffix = match.group(2) or ""
+            return f"{match.group(1).upper()}:/{suffix}"
+    return raw
+
+
+def file_uri_for_path(path: Path | str, platform: str | None = None) -> str:
+    """Return a standards-compliant file URI without guessing path separators."""
+    raw = normalize_platform_path_text(path, platform)
+    if re.match(r"^[A-Za-z]:[\\/]", raw) or raw.startswith("\\\\"):
+        posix_path = PureWindowsPath(raw).as_posix()
+        encoded = quote(posix_path, safe="/:")
+        return f"file:{encoded}" if posix_path.startswith("//") else f"file:///{encoded}"
+    return Path(raw).resolve().as_uri()
+
+
+def deliverable_descriptor(label: str, path: Path | str, **extra) -> dict:
+    resolved = Path(normalize_platform_path_text(path)).resolve()
+    if not resolved.is_file():
+        raise PipelineError(f"阶段产物不存在：{resolved}")
+    file_uri = file_uri_for_path(resolved)
+    return {
+        "label": label,
+        "path": str(resolved),
+        "fileUri": file_uri,
+        "markdownLink": f"[打开{label}](<{file_uri}>)",
+        **extra,
+    }
+
+
+def referenced_capture_artifacts(results_path: Path, results: dict) -> dict[str, Path]:
+    source_root = results_path.parent.resolve()
+    referenced: dict[str, Path] = {}
+    for platform in results.get("platforms") or []:
+        platform_id = str(platform.get("platform") or "unknown")
+        artifacts = platform.get("artifacts") or {}
+        if not isinstance(artifacts, dict):
+            raise PipelineError(f"{platform_id} 的采集存证格式不正确")
+        for artifact_type, value in artifacts.items():
+            raw_path = str(value or "").strip()
+            if not raw_path:
+                continue
+            relative = Path(raw_path)
+            if (
+                relative.is_absolute()
+                or ".." in relative.parts
+                or not relative.parts
+                or relative.parts[0] != "artifacts"
+            ):
+                raise PipelineError(
+                    f"{platform_id} 的 {artifact_type} 存证路径必须是 artifacts/ 下的相对路径：{raw_path}"
+                )
+            source = (source_root / relative).resolve()
+            try:
+                source.relative_to(source_root)
+            except ValueError as exc:
+                raise PipelineError(
+                    f"{platform_id} 的 {artifact_type} 存证路径越出采集目录：{raw_path}"
+                ) from exc
+            if not source.is_file():
+                raise PipelineError(
+                    f"{platform_id} 声明的 {artifact_type} 存证文件不存在：{raw_path}"
+                )
+            normalized = relative.as_posix()
+            previous = referenced.get(normalized)
+            if previous and previous != source:
+                raise PipelineError(f"采集存证路径冲突：{normalized}")
+            referenced[normalized] = source
+    return referenced
+
+
+def capture_artifact_hashes(results_path: Path, results: dict) -> dict[str, str]:
+    return {
+        relative: capture_digest(source)
+        for relative, source in sorted(
+            referenced_capture_artifacts(results_path, results).items()
+        )
+    }
+
+
+def sync_capture_evidence(run_dir: Path, results_path: Path, results: dict) -> None:
+    capture_dir = (run_dir / "capture").resolve()
+    source_dir = results_path.parent.resolve()
+    artifacts = referenced_capture_artifacts(results_path, results)
+    recovery_source = source_dir / "capture-recovery.json"
+    recovery_target = capture_dir / "capture-recovery.json"
+    artifact_bytes = {
+        relative: source.read_bytes() for relative, source in artifacts.items()
+    }
+    recovery_bytes = recovery_source.read_bytes() if recovery_source.is_file() else None
+    for target_root in (capture_dir, run_dir):
+        shutil.rmtree(target_root / "artifacts", ignore_errors=True)
+        for relative, content in artifact_bytes.items():
+            target = target_root / relative
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_bytes(content)
+    if recovery_bytes is not None:
+        recovery_target.write_bytes(recovery_bytes)
+    else:
+        recovery_target.unlink(missing_ok=True)
+
+
+def json_file_manifest(directory: Path, expected_names: set[str] | None = None) -> dict[str, str]:
+    actual = {path.name for path in directory.glob("*.json")} if directory.exists() else set()
+    if expected_names is not None and actual != expected_names:
+        missing = sorted(expected_names - actual)
+        extra = sorted(actual - expected_names)
+        raise PipelineError(f"{directory.name} 文件集合不匹配；缺失={missing}，额外/陈旧={extra}")
+    return {name: capture_digest(directory / name) for name in sorted(actual)}
+
+
+def require_digest(path: Path, expected: str, label: str) -> None:
+    if not path.exists() or capture_digest(path) != expected:
+        raise PipelineError(f"{label} 在门禁后缺失或被修改，禁止继续")
+
+
+def write_comparison_provenance(run_dir: Path, results_path: Path, analysis_path: Path, comparison_path: Path) -> Path:
+    gate = run_dir / "comparison-gate.json"
+    dump_json(gate, {
+        "schemaVersion": "fact-check-x/comparison-gate@1",
+        "status": "completed",
+        "createdAt": now_iso(),
+        "files": {
+            "results": {"path": str(results_path), "sha256": capture_digest(results_path)},
+            "analysis": {"path": str(analysis_path), "sha256": capture_digest(analysis_path)},
+            "comparison": {"path": str(comparison_path), "sha256": capture_digest(comparison_path)},
+        },
+    })
+    return gate
+
+
+def require_comparison_provenance(run_dir: Path) -> dict:
+    gate_path = run_dir / "comparison-gate.json"
+    if not gate_path.exists():
+        raise PipelineError("缺少 1.1 provenance 门禁；必须重新执行 complete-comparison")
+    gate = load_json(gate_path)
+    if gate.get("schemaVersion") != "fact-check-x/comparison-gate@1" or gate.get("status") != "completed":
+        raise PipelineError("1.1 provenance 门禁状态不正确")
+    for label, item in (gate.get("files") or {}).items():
+        require_digest(Path(str(item.get("path") or "")).resolve(), str(item.get("sha256") or ""), label)
+    return gate
+
+
+def expected_request_ids(manifest: dict) -> list[str]:
+    ids = [str(entry.get("requestId") or "") for entry in manifest.get("requests") or []]
+    if not ids or any(not value for value in ids) or len(ids) != len(set(ids)):
+        raise PipelineError("权威核验请求清单包含空 ID 或重复 ID")
+    return ids
+
+
+def scrub_portable_paths(value, run_dir: Path):
+    if isinstance(value, dict):
+        return {key: scrub_portable_paths(item, run_dir) for key, item in value.items()}
+    if isinstance(value, list):
+        return [scrub_portable_paths(item, run_dir) for item in value]
+    if isinstance(value, str):
+        run_uri = file_uri_for_path(run_dir.resolve()).rstrip("/")
+        if value == run_uri:
+            return "."
+        if value.startswith(run_uri + "/"):
+            return "../" + value[len(run_uri) + 1 :]
+        if run_uri + "/" in value:
+            return value.replace(run_uri + "/", "../")
+        path = Path(value)
+        if path.is_absolute():
+            try:
+                return path.relative_to(run_dir).as_posix()
+            except ValueError:
+                return path.name
+    return value
+
+
+def portable_file_bytes(path: Path, run_dir: Path) -> bytes:
+    if path.suffix.lower() == ".json":
+        payload = scrub_portable_paths(load_json(path), run_dir)
+        if path.name == "pipeline.json":
+            artifacts = payload.get("artifacts") or {}
+            artifacts.pop("reportPackageSha256", None)
+            artifacts.pop("reportPackageBytes", None)
+        return (json.dumps(payload, ensure_ascii=False, indent=2) + "\n").encode("utf-8")
+    return path.read_bytes()
+
+
+TECHNICAL_ACQUISITION_STATES = {"blocked", "failed"}
+
+
+def collect_technical_notices(run_dir: Path) -> list[str]:
+    """收集「本该执行但因技术原因没跑成、流程仍继续」的动作。
+
+    这些不是内容层面的证据不足，而是采集或调用本身没完成；判定口径不因此改变，
+    但必须在每一步报告的显著位置统一提示，供阅读者判断证据完整性。
+    """
+    notices: list[str] = []
+    results_path = run_dir / "capture" / "results.json"
+    if results_path.is_file():
+        incomplete: list[str] = []
+        for platform in load_json(results_path).get("platforms") or []:
+            hits = 0
+            for reference in platform.get("references") or []:
+                content_state = str(reference.get("contentAcquisition") or "")
+                source_state = str(reference.get("sourceAcquisitionStatus") or "")
+                if (
+                    content_state in TECHNICAL_ACQUISITION_STATES
+                    or source_state in TECHNICAL_ACQUISITION_STATES
+                ):
+                    hits += 1
+            if hits:
+                label = str(platform.get("label") or platform.get("platform") or "")
+                incomplete.append(f"{label} {hits} 条")
+        if incomplete:
+            notices.append(
+                "来源正文因访问受阻或采集失败未取得：" + "、".join(incomplete)
+                + "。相关主张只依据平台原文和已取得的证据判定。"
+            )
+    recovery_path = run_dir / "capture" / "capture-recovery.json"
+    if recovery_path.is_file():
+        recovery = load_json(recovery_path)
+        failed_platforms = [str(item) for item in (recovery.get("failedPlatforms") or [])]
+        status = str(recovery.get("status") or "")
+        if failed_platforms:
+            notices.append(
+                "采集恢复流程被触发，涉及：" + "、".join(failed_platforms)
+                + f"（状态 {status or '未知'}）。"
+            )
+    return notices
+
+
+def render_run_notices(notices) -> str:
+    items = "".join(f"<li>{html.escape(str(item))}</li>" for item in notices)
+    if not items:
+        return ""
+    return (
+        '<div class="fcx-run-notice" data-fcx-run-notice="1" role="note">'
+        "<strong>本次运行存在未完成的技术动作</strong>"
+        f"<ul>{items}</ul>"
+        '<span class="fcx-run-notice-tail">判定口径不因此改变；'
+        "以上项目可能影响相关结论的证据完整性，受影响且无法核验的主张按“疑似误导”呈现。</span></div>"
+    )
+
+
+def normalize_report_navigation(content: bytes, current_report: str, notices=()) -> bytes:
+    html = content.decode("utf-8")
+    html = html.replace('href="capture/report.html"', 'href="01-capture-report.html"')
+    html = html.replace('href="report.html"', 'href="04-final-report.html"')
+    html = re.sub(
+        r'<nav\s+class="(?:report-nav|nav|fcx-report-nav)"[^>]*>.*?</nav>',
+        "",
+        html,
+        flags=re.DOTALL,
+    )
+    items = []
+    for filename, label in REPORT_NAV_ITEMS:
+        if filename == current_report:
+            items.append(f'<span aria-current="page">{label}</span>')
+        else:
+            items.append(f'<a href="{filename}">{label}</a>')
+    navigation = (
+        '<nav class="fcx-report-nav" data-fcx-report-nav="1" '
+        'aria-label="事实核验四阶段报告导航">'
+        + "".join(items)
+        + "</nav>"
+        + render_run_notices(notices)
+    )
+    if REPORT_NAV_STYLE not in html:
+        if "</style>" in html:
+            html = html.replace("</style>", f"\n{REPORT_NAV_STYLE}\n</style>", 1)
+        else:
+            html = html.replace("</head>", f"<style>{REPORT_NAV_STYLE}</style></head>", 1)
+    if "<main" in html:
+        html = re.sub(r"(<main(?:\s[^>]*)?>)", navigation + r"\1", html, count=1)
+    else:
+        html = re.sub(r"(<body(?:\s[^>]*)?>)", r"\1" + navigation, html, count=1)
+    return html.encode("utf-8")
+
+
+def normalize_report_file(path: Path, notices=()) -> None:
+    path.write_bytes(
+        normalize_report_navigation(path.read_bytes(), path.name, notices)
+    )
+
+
+def build_portable_report_package(run_dir: Path) -> dict:
+    package_path = run_dir / PORTABLE_REPORT_PACKAGE
+    package_path.unlink(missing_ok=True)
+    reports = {
+        Path("01-capture-report.html"): run_dir / "01-capture-report.html",
+        Path("02-comparison-report.html"): run_dir / "02-comparison-report.html",
+        Path("03-authority-report.html"): run_dir / "03-authority-report.html",
+        Path("04-final-report.html"): run_dir / "04-final-report.html",
+    }
+    data_files = [
+        Path("capture/results.json"),
+        Path("capture/report.md"),
+        Path("capture/capture-recovery.json"),
+        Path("capture-gate.json"),
+        Path("comparison-task.json"),
+        Path("comparison-analysis.json"),
+        Path("comparison.json"),
+        Path("comparison-gate.json"),
+        Path("authority-gate.json"),
+        Path(INTERACTION_GATE_FILE),
+        Path("verification.json"),
+        Path("pipeline.json"),
+    ]
+    with zipfile.ZipFile(package_path, "w", compression=zipfile.ZIP_DEFLATED, compresslevel=6) as archive:
+        archive.writestr(str(PORTABLE_REPORT_ROOT / "README.txt"), PORTABLE_REPORT_README.encode("utf-8"))
+        for relative, source in reports.items():
+            if not source.exists():
+                raise PipelineError(f"缺少对外交付报告：{source.name}")
+            content = normalize_report_navigation(source.read_bytes(), relative.name)
+            archive.writestr(str(PORTABLE_REPORT_ROOT / relative), content)
+        artifacts_dir = run_dir / "capture" / "artifacts"
+        if artifacts_dir.exists():
+            for source in sorted(path for path in artifacts_dir.rglob("*") if path.is_file()):
+                relative = Path("artifacts") / source.relative_to(artifacts_dir)
+                archive.writestr(str(PORTABLE_REPORT_ROOT / relative), source.read_bytes())
+        for relative in data_files:
+            source = run_dir / relative
+            if source.exists():
+                archive.writestr(
+                    str(PORTABLE_REPORT_ROOT / "data" / relative),
+                    portable_file_bytes(source, run_dir),
+                )
+        for directory in (run_dir / "authority", run_dir / "report-input"):
+            if not directory.exists():
+                continue
+            for source in sorted(path for path in directory.rglob("*") if path.is_file()):
+                relative = Path("data") / source.relative_to(run_dir)
+                archive.writestr(
+                    str(PORTABLE_REPORT_ROOT / relative),
+                    portable_file_bytes(source, run_dir),
+                )
+    with zipfile.ZipFile(package_path) as archive:
+        broken = archive.testzip()
+        if broken:
+            raise PipelineError(f"对外报告包校验失败：{broken}")
+    return {
+        "path": str(package_path.resolve()),
+        "sha256": capture_digest(package_path),
+        "bytes": package_path.stat().st_size,
+    }
+
+
+def validate_capture_results(results_path: Path, minimum_platforms: int = 1) -> dict:
+    results = load_json(results_path)
+    if results.get("schemaVersion") != "1":
+        raise PipelineError("采集结果版本不正确，禁止进入知识点对比")
+    platforms = results.get("platforms") or []
+    if len(platforms) < minimum_platforms:
+        raise PipelineError(f"完整事实核验至少需要 {minimum_platforms} 个采集平台，当前只有 {len(platforms)} 个")
+    names = [str(item.get("platform") or "").strip() for item in platforms]
+    if len(set(names)) != len(names) or any(not name for name in names):
+        raise PipelineError("采集结果包含空平台或重复平台，禁止进入知识点对比")
+    incomplete = []
+    prompt_markers = (
+        "为您智能匹配到当前所在区域为",
+        "如想咨询其他区域可点击修改",
+        "请选择您想咨询的地区",
+        "请先完成登录",
+        "登录后即可提问",
+    )
+    def is_prompt_only(answer: str) -> bool:
+        compact = "".join(answer.split())
+        matches = ["".join(marker.split()) for marker in prompt_markers if "".join(marker.split()) in compact]
+        if not matches:
+            return False
+        return len(compact) <= max(240, sum(len(marker) for marker in matches) + 120)
+
+    for item in platforms:
+        answer = str(item.get("answerMarkdown") or "").strip()
+        if item.get("status") != "success" or not answer:
+            incomplete.append(
+                f"{item.get('label') or item.get('platform')}: "
+                f"{item.get('status')} ({item.get('error') or '无完整回答'})"
+            )
+        elif is_prompt_only(answer):
+            incomplete.append(f"{item.get('label') or item.get('platform')}: 捕获内容是登录、地区选择或初始化提示")
+    if incomplete:
+        raise PipelineError("采集未完成，已禁止进入知识点对比；请先重新采集失败平台：" + "；".join(incomplete))
+    recovery_path = results_path.parent / "capture-recovery.json"
+    if recovery_path.exists():
+        recovery = load_json(recovery_path)
+        if recovery.get("status") == "required":
+            raise PipelineError("采集恢复状态仍为 required，必须先由 Computer Use 完成浏览器恢复并重新采集")
+    return results
+
+
+def write_capture_gate(run_dir: Path, results_path: Path, results: dict) -> Path:
+    gate = run_dir / "capture-gate.json"
+    recovery_path = results_path.parent / "capture-recovery.json"
+    dump_json(gate, {
+        "schemaVersion": "fact-check-x/capture-gate@1",
+        "status": "completed",
+        "createdAt": now_iso(),
+        "results": str(results_path.resolve()),
+        "sha256": capture_digest(results_path),
+        "artifactSha256": capture_artifact_hashes(results_path, results),
+        "recoverySha256": capture_digest(recovery_path) if recovery_path.is_file() else None,
+        "question": results.get("question"),
+        "platforms": [item.get("platform") for item in results.get("platforms") or []],
+    })
+    return gate
+
+
+def validate_and_gate_capture(run_dir: Path, results_path: Path) -> dict:
+    results = validate_capture_results(results_path)
+    write_capture_gate(run_dir, results_path, results)
+    return results
+
+
+def require_capture_gate(run_dir: Path, results_path: Path | None = None) -> dict:
+    gate_path = run_dir / "capture-gate.json"
+    if not gate_path.exists():
+        raise PipelineError("缺少采集完整性门禁，禁止执行下游步骤；请先完成 1.0 采集并运行 prepare-comparison")
+    gate = load_json(gate_path)
+    if gate.get("schemaVersion") != "fact-check-x/capture-gate@1" or gate.get("status") != "completed":
+        raise PipelineError("采集完整性门禁状态不正确，禁止执行下游步骤")
+    checked_path = results_path or Path(str(gate.get("results") or "")).resolve()
+    results = validate_capture_results(checked_path)
+    if gate.get("sha256") != capture_digest(checked_path):
+        raise PipelineError("results.json 在采集门禁后发生变化，禁止继续；请重新执行 prepare-comparison")
+    if gate.get("artifactSha256") != capture_artifact_hashes(checked_path, results):
+        raise PipelineError("采集存证文件在门禁后缺失或被修改，禁止继续；请重新执行 prepare-comparison")
+    recovery_path = checked_path.parent / "capture-recovery.json"
+    recovery_sha256 = capture_digest(recovery_path) if recovery_path.is_file() else None
+    if gate.get("recoverySha256") != recovery_sha256:
+        raise PipelineError("采集恢复记录在门禁后缺失或被修改，禁止继续；请重新执行 prepare-comparison")
+    return gate
+
+
+def prepare_comparison(args: argparse.Namespace, skills: dict[str, Path]) -> dict:
+    run_dir = require_run(args.run_dir)
+    results_path = Path(args.results).resolve()
+    results = validate_and_gate_capture(run_dir, results_path)
+    capture_report = run([
+        "node",
+        str(skills["collector"] / "assets" / "tool" / "dist" / "report-cli.js"),
+        "--input",
+        str(results_path),
+        "--out",
+        str(run_dir / "capture"),
+    ])
+    sync_capture_evidence(run_dir, results_path, results)
+    capture_deliverable = run_dir / "01-capture-report.html"
+    shutil.copyfile(capture_report["report"], capture_deliverable)
+    normalize_report_file(capture_deliverable, collect_technical_notices(run_dir))
+    task = run_dir / "comparison-task.json"
+    result = run([sys.executable, str(skills["comparison"] / "scripts" / "knowledge_compare.py"), "--input", str(results_path), "--task-output", str(task)])
+    initialize_interaction_gate(run_dir, args.execution_mode)
+    result.update({
+        "stage": "capture_completed",
+        "analysisExecution": {
+            "mode": "single_pass",
+            "maxToolCallsAfterStageAcknowledgement": 3,
+            "instructions": [
+                "读取 comparison-task.json 一次，不读取技能源码、契约或完整 results.json 探路",
+                "直接写入 comparison-analysis.json 一次",
+                "执行 complete-comparison 一次，由程序使用完整采集正文校验",
+            ],
+        },
+        "platforms": [
+            {
+                "platform": item.get("platform"),
+                "label": item.get("label") or item.get("platform"),
+                "status": item.get("status"),
+                "referenceCount": len(item.get("references") or []),
+                "sourceMentionCount": len(item.get("sourceMentions") or []),
+                "sourceCountAudit": item.get("sourceCountAudit"),
+                "durationMs": item.get("durationMs"),
+            }
+            for item in results.get("platforms") or []
+        ],
+        "artifacts": {
+            "results": capture_report["results"],
+            "answerReferenceReport": capture_report["report"],
+            "answerReferenceMarkdown": capture_report["markdown"],
+            "captureDeliverable": str(capture_deliverable.resolve()),
+            "captureGate": str((run_dir / "capture-gate.json").resolve()),
+            "comparisonTask": str(task.resolve()),
+        },
+        "deliverables": [deliverable_descriptor("各方答案汇总", capture_deliverable)],
+        "checkpoint": record_stage_checkpoint(
+            run_dir, "capture", "各方答案汇总", capture_deliverable, "comparison"
+        ),
+    })
+    return result
+
+
+def complete_comparison(args: argparse.Namespace, skills: dict[str, Path]) -> dict:
+    run_dir = require_run(args.run_dir)
+    require_stage_acknowledged(run_dir, "capture")
+    results_path = Path(args.results).resolve()
+    results = validate_and_gate_capture(run_dir, results_path)
+    sync_capture_evidence(run_dir, results_path, results)
+    analysis_source = (
+        Path(args.analysis).resolve()
+        if args.analysis
+        else run_dir / "comparison-analysis.json"
+    )
+    analysis = run_dir / "comparison-analysis.json"
+    comparison = run_dir / "comparison.json"
+    result = run([
+        sys.executable,
+        str(skills["comparison"] / "scripts" / "knowledge_compare.py"),
+        "--input",
+        str(results_path),
+        "--analysis",
+        str(analysis_source),
+        "--canonical-analysis-output",
+        str(analysis),
+        "--output",
+        str(comparison),
+    ])
+    comparison_report = run_dir / "comparison.html"
+    run([sys.executable, str(skills["comparison"] / "scripts" / "render_comparison.py"), "--results", str(results_path), "--comparison", str(comparison), "--output", str(comparison_report)])
+    comparison_deliverable = run_dir / "02-comparison-report.html"
+    shutil.copyfile(comparison_report, comparison_deliverable)
+    normalize_report_file(comparison_deliverable, collect_technical_notices(run_dir))
+    comparison_data = load_json(comparison)
+    blocking_analysis_gaps = [
+        item
+        for item in comparison_data.get("analysisGaps") or []
+        if isinstance(item, dict) and item.get("blocking") is True
+    ]
+    if blocking_analysis_gaps:
+        details = "; ".join(
+            f"{item.get('knowledgePointId') or '?'}·{item.get('platform') or '?'}：{item.get('reason') or '比较分析结构错误'}"
+            for item in blocking_analysis_gaps[:5]
+        )
+        raise PipelineError(
+            "比较分析未通过原子性门禁，禁止进入权威核验。"
+            f"请补全 answerExcerpt 或拆分过宽主张，并重新执行 complete-comparison：{details}"
+        )
+    comparison_gate = write_comparison_provenance(run_dir, results_path, analysis, comparison)
+    result.update({
+        "stage": "comparison_completed",
+        "knowledgePointCount": len(comparison_data.get("knowledgePoints") or []),
+        "analysisGapCount": len(comparison_data.get("analysisGaps") or []),
+        "artifacts": {
+            "comparisonAnalysis": str(analysis.resolve()),
+            "comparison": str(comparison.resolve()),
+            "comparisonReport": str(comparison_report.resolve()),
+            "comparisonDeliverable": str(comparison_deliverable.resolve()),
+            "comparisonGate": str(comparison_gate.resolve()),
+        },
+        "deliverables": [deliverable_descriptor("各方答案聚合（未核验）", comparison_deliverable)],
+        "checkpoint": record_stage_checkpoint(
+            run_dir,
+            "comparison",
+            "各方答案聚合（未核验）",
+            comparison_deliverable,
+            "authority",
+        ),
+    })
+    return result
+
+
+def differing_claims(point: dict) -> list[dict]:
+    claims = []
+    for platform, claim in (point.get("claims") or {}).items():
+        value = str(claim.get("claim") or "").strip()
+        if claim.get("covered") and value:
+            claims.append({"platform": platform, "claim": value})
+    unique = {item["claim"] for item in claims}
+    if (point.get("comparison") or {}).get("status") in ("conflict", "partial", "mostly_consensus") and len(unique) >= 2:
+        return claims
+    return []
+
+
+def official_exempt_policy(point: dict) -> str:
+    anchor = point.get("trustedAnchor") or {}
+    policy = str(anchor.get("sourcePolicy") or "")
+    if (
+        not policy
+        and anchor.get("eligible")
+        and anchor.get("platform") in {"dknowc-chat", "dknowc-deep-research"}
+        and anchor.get("trustedSearchUsed") is True
+    ):
+        policy = "dknow_official_reference"
+    if anchor.get("eligible") and policy in {
+        "dknow_official_reference",
+        "gov_cn_reference",
+    }:
+        return policy
+    return ""
+
+
+def build_requests(comparison: dict, requests_dir: Path) -> dict:
+    if comparison.get("schemaVersion") != "fact-check-x/comparison@1":
+        raise PipelineError("comparison.json 版本不正确")
+    points = comparison.get("knowledgePoints") or []
+    if not points:
+        raise PipelineError("comparison.json 没有知识点")
+    requests_dir.mkdir(parents=True, exist_ok=True)
+    expected = {f"{point['id']}.json" for point in points}
+    stale = [path.name for path in requests_dir.glob("*.json") if path.name not in expected and path.name != "manifest.json"]
+    if stale:
+        raise PipelineError(f"请求目录存在不属于本次任务的旧文件：{stale}")
+    entries = []
+    for point in points:
+        knowledge_point = {
+            key: point.get(key)
+            for key in ("id", "description", "role", "claimType", "core")
+        }
+        payload = {"title": comparison.get("question"), "knowledgePoint": knowledge_point}
+        differences = differing_claims(point)
+        if differences:
+            payload["differingClaims"] = differences
+        request = {
+            "schemaVersion": "fact-check-x/authority-request@1",
+            "requestId": point["id"],
+            "title": comparison.get("question"),
+            "comparisonStatus": (point.get("comparison") or {}).get("status"),
+            "knowledgePoint": knowledge_point,
+            "claims": point.get("claims") or {},
+            "cloudPayload": payload,
+            "trustedAnchor": point.get("trustedAnchor") or {"eligible": False},
+        }
+        path = requests_dir / f"{point['id']}.json"
+        dump_json(path, request)
+        exempt_policy = official_exempt_policy(point)
+        entries.append({
+            "requestId": point["id"],
+            "file": str(path.resolve()),
+            "hasDifferingClaims": bool(differences),
+            "officialExempt": bool(exempt_policy),
+            "dknowExempt": exempt_policy == "dknow_official_reference",
+            "govExempt": exempt_policy == "gov_cn_reference",
+        })
+    manifest = {"schemaVersion": "fact-check-x/authority-requests@1", "createdAt": now_iso(), "question": comparison.get("question"), "taskCount": len(entries), "requests": entries}
+    dump_json(requests_dir / "manifest.json", manifest)
+    return manifest
+
+
+def prepare_authority(args: argparse.Namespace) -> dict:
+    run_dir = require_run(args.run_dir)
+    require_stage_acknowledged(run_dir, "comparison")
+    require_capture_gate(run_dir)
+    comparison_provenance = require_comparison_provenance(run_dir)
+    comparison_path = Path(args.comparison).resolve() if args.comparison else run_dir / "comparison.json"
+    recorded_comparison = Path(comparison_provenance["files"]["comparison"]["path"]).resolve()
+    if comparison_path != recorded_comparison:
+        raise PipelineError("prepare-authority 只能使用 complete-comparison 已锁定的 comparison.json")
+    comparison = load_json(comparison_path)
+    manifest = build_requests(comparison, run_dir / "authority" / "requests")
+    request_ids = expected_request_ids(manifest)
+    request_names = {f"{request_id}.json" for request_id in request_ids} | {"manifest.json"}
+    request_hashes = json_file_manifest(run_dir / "authority" / "requests", request_names)
+    required_count = sum(not entry.get("officialExempt") for entry in manifest.get("requests") or [])
+    configured = bool(trusted_search_key())
+    result = {
+        "status": "configuration_required" if required_count and not configured else "prepared",
+        "taskCount": manifest["taskCount"],
+        "trustedSearchRequiredCount": required_count,
+        "trustedSearchConfigured": configured,
+        "requests": str((run_dir / "authority" / "requests").resolve()),
+    }
+    if result["status"] == "configuration_required":
+        result.update({
+            "action": "configure_trusted_search",
+            "userPrompt": TRUSTED_SEARCH_CONFIGURATION_PROMPT,
+            "configuration": trusted_search_configuration(),
+            "blockedReason": "未配置 TRUSTED_SEARCH_KEY，禁止发起可信搜索或使用其他来源绕过",
+        })
+    dump_json(run_dir / "authority-gate.json", {
+        "schemaVersion": "fact-check-x/authority-gate@1",
+        "createdAt": now_iso(),
+        "status": result["status"],
+        "trustedSearchRequiredCount": required_count,
+        "trustedSearchConfigured": configured,
+        "requests": result["requests"],
+        "comparisonSha256": comparison_provenance["files"]["comparison"]["sha256"],
+        "requestHashes": request_hashes,
+    })
+    return result
+
+
+def search_authority(args: argparse.Namespace, skills: dict[str, Path]) -> dict:
+    run_dir = require_run(args.run_dir)
+    require_capture_gate(run_dir)
+    authority_gate_path = run_dir / "authority-gate.json"
+    if not authority_gate_path.exists():
+        raise PipelineError("缺少权威核验门禁；必须先执行 prepare-authority")
+    authority_gate = load_json(authority_gate_path)
+    if authority_gate.get("schemaVersion") != "fact-check-x/authority-gate@1":
+        raise PipelineError("权威核验门禁版本不正确")
+    requests_manifest = load_json(run_dir / "authority" / "requests" / "manifest.json")
+    request_ids = expected_request_ids(requests_manifest)
+    current_request_hashes = json_file_manifest(
+        run_dir / "authority" / "requests",
+        {f"{request_id}.json" for request_id in request_ids} | {"manifest.json"},
+    )
+    if current_request_hashes != authority_gate.get("requestHashes"):
+        raise PipelineError("权威核验请求在 prepare-authority 后被修改，禁止搜索")
+    require_comparison_provenance(run_dir)
+    required_count = sum(not entry.get("officialExempt") for entry in requests_manifest.get("requests") or [])
+    key = trusted_search_key()
+    if required_count and not args.fixtures:
+        key = validated_authority_key()
+    configured = bool(key)
+    if required_count and not configured and not args.fixtures:
+        return {
+            "status": "configuration_required",
+            "action": "configure_trusted_search",
+            "trustedSearchRequiredCount": required_count,
+            "trustedSearchConfigured": False,
+            "userPrompt": TRUSTED_SEARCH_CONFIGURATION_PROMPT,
+            "configuration": trusted_search_configuration(),
+            "blockedReason": "未配置 TRUSTED_SEARCH_KEY，禁止发起可信搜索或使用其他来源绕过",
+        }
+    if authority_gate.get("status") == "configuration_required" and not args.fixtures:
+        return {
+            "status": "configuration_required",
+            "action": "configure_trusted_search",
+            "trustedSearchRequiredCount": required_count,
+            "trustedSearchConfigured": configured,
+            "userPrompt": TRUSTED_SEARCH_CONFIGURATION_PROMPT,
+            "configuration": trusted_search_configuration(),
+            "blockedReason": "配置完成后必须重新执行 prepare-authority，禁止绕过权威核验门禁",
+        }
+    if authority_gate.get("status") != "prepared":
+        raise PipelineError("权威核验门禁状态不允许搜索；请重新执行 prepare-authority")
+    command = [
+        sys.executable,
+        str(skills["authority"] / "scripts" / "batch_search.py"),
+        "--requests-dir",
+        str(run_dir / "authority" / "requests"),
+        "--output-dir",
+        str(run_dir / "authority" / "evidence"),
+        "--max-workers",
+        str(args.max_workers),
+    ]
+    if args.service_area:
+        command.extend(["--service-area", args.service_area])
+    if args.fixtures:
+        command.extend(["--fixtures", str(Path(args.fixtures).resolve())])
+    environment = None
+    if key:
+        environment = {**os.environ, "TRUSTED_SEARCH_KEY": key}
+    result = run(command, environment)
+    if result.get("status") != "completed":
+        raise PipelineError("可信搜索批次未完成，禁止进入裁决")
+    evidence_hashes = json_file_manifest(
+        run_dir / "authority" / "evidence",
+        {f"{request_id}.json" for request_id in request_ids} | {"batch.json"},
+    )
+    dump_json(authority_gate_path, {
+        **authority_gate,
+        "status": "searched",
+        "searchedAt": now_iso(),
+        "batch": str((run_dir / "authority" / "evidence" / "batch.json").resolve()),
+        "evidenceHashes": evidence_hashes,
+    })
+    return result
+
+
+def finalize_authority(args: argparse.Namespace, skills: dict[str, Path]) -> dict:
+    run_dir = require_run(args.run_dir)
+    require_capture_gate(run_dir)
+    authority_gate_path = run_dir / "authority-gate.json"
+    if not authority_gate_path.exists():
+        raise PipelineError("缺少权威核验门禁，禁止裁决")
+    authority_gate = load_json(authority_gate_path)
+    if (
+        authority_gate.get("schemaVersion") != "fact-check-x/authority-gate@1"
+        or authority_gate.get("status") != "searched"
+    ):
+        raise PipelineError("可信搜索尚未通过程序门禁，禁止写入裁决或进入最终报告")
+    if not (run_dir / "authority" / "evidence" / "batch.json").exists():
+        raise PipelineError("缺少可信搜索批次证明，禁止裁决")
+    requests_dir = run_dir / "authority" / "requests"
+    manifest = load_json(requests_dir / "manifest.json")
+    request_ids = expected_request_ids(manifest)
+    if json_file_manifest(
+        requests_dir,
+        {f"{request_id}.json" for request_id in request_ids} | {"manifest.json"},
+    ) != authority_gate.get("requestHashes"):
+        raise PipelineError("权威核验请求已被修改，禁止裁决")
+    if json_file_manifest(
+        run_dir / "authority" / "evidence",
+        {f"{request_id}.json" for request_id in request_ids} | {"batch.json"},
+    ) != authority_gate.get("evidenceHashes"):
+        raise PipelineError("权威证据包已被修改或混入陈旧文件，禁止裁决")
+    require_comparison_provenance(run_dir)
+    evidence_dir = run_dir / "authority" / "evidence"
+    assessments_dir = Path(args.assessments_dir).resolve() if args.assessments_dir else run_dir / "authority" / "assessments"
+    results_dir = run_dir / "authority" / "results"
+    results_dir.mkdir(parents=True, exist_ok=True)
+    existing_results = list(results_dir.glob("*.json"))
+    if existing_results:
+        raise PipelineError("results 目录必须为空；检测到旧文件或手工结果，禁止覆盖式裁决")
+    expected_assessments = set()
+    for request_id in request_ids:
+        evidence = load_json(evidence_dir / f"{request_id}.json")
+        if evidence.get("status") == "verified":
+            expected_assessments.add(f"{request_id}.json")
+    assessment_hashes = json_file_manifest(assessments_dir, expected_assessments)
+    statuses = []
+    evidence_gap_count = 0
+    verification_path = run_dir / "verification.json"
+    authority_report = run_dir / "03-authority-report.html"
+    try:
+        for entry in manifest.get("requests") or []:
+            request_id = entry["requestId"]
+            command = [
+                sys.executable,
+                str(skills["authority"] / "scripts" / "authority_verify.py"),
+                "finalize",
+                "--request",
+                str(requests_dir / f"{request_id}.json"),
+                "--evidence",
+                str(evidence_dir / f"{request_id}.json"),
+                "--output",
+                str(results_dir / f"{request_id}.json"),
+            ]
+            assessment = assessments_dir / f"{request_id}.json"
+            if assessment.exists():
+                command.extend(["--assessment", str(assessment)])
+            statuses.append(run(command).get("status"))
+            point_result = load_json(results_dir / f"{request_id}.json")
+            evidence_gap_count += len(point_result.get("evidenceGaps") or [])
+        final_status = "completed"
+        result_hashes = json_file_manifest(
+            results_dir, {f"{request_id}.json" for request_id in request_ids}
+        )
+        comparison = load_json(run_dir / "comparison.json")
+        verification = merge_verification(comparison, results_dir)
+        dump_json(verification_path, verification)
+        run([
+            sys.executable,
+            str(skills["authority"] / "scripts" / "render_authority_report.py"),
+            "--verification",
+            str(verification_path),
+            "--output",
+            str(authority_report),
+        ])
+        normalize_report_file(authority_report, collect_technical_notices(run_dir))
+        dump_json(authority_gate_path, {
+            **authority_gate,
+            "status": "finalized",
+            "finalizedAt": now_iso(),
+            "finalizeStatus": final_status,
+            "results": str(results_dir.resolve()),
+            "assessmentHashes": assessment_hashes,
+            "resultHashes": result_hashes,
+            "verificationSha256": capture_digest(verification_path),
+            "authorityReportSha256": capture_digest(authority_report),
+        })
+    except Exception:
+        for result_path in results_dir.glob("*.json"):
+            result_path.unlink()
+        verification_path.unlink(missing_ok=True)
+        authority_report.unlink(missing_ok=True)
+        dump_json(authority_gate_path, authority_gate)
+        raise
+    return {
+        "status": final_status,
+        "stage": "authority_completed",
+        "taskCount": len(statuses),
+        "evidenceGapCount": evidence_gap_count,
+        "results": str(results_dir.resolve()),
+        "artifacts": {
+            "verification": str(verification_path.resolve()),
+            "authorityReport": str(authority_report.resolve()),
+            "authorityGate": str(authority_gate_path.resolve()),
+        },
+        "deliverables": [deliverable_descriptor("权威核验后的最终答案", authority_report)],
+        "checkpoint": record_stage_checkpoint(
+            run_dir,
+            "authority",
+            "权威核验后的最终答案",
+            authority_report,
+            "evaluation",
+        ),
+    }
+
+
+def reopen_authority(args: argparse.Namespace) -> dict:
+    run_dir = require_run(args.run_dir)
+    authority_gate_path = run_dir / "authority-gate.json"
+    if not authority_gate_path.is_file():
+        raise PipelineError("缺少已完成的权威核验门禁，无法重开")
+    authority_gate = load_json(authority_gate_path)
+    if (
+        authority_gate.get("schemaVersion") != "fact-check-x/authority-gate@1"
+        or authority_gate.get("status") != "finalized"
+        or authority_gate.get("finalizeStatus") != "completed"
+    ):
+        raise PipelineError("只有已完成且未被修改的权威核验可以受控重开")
+    requests_dir = run_dir / "authority" / "requests"
+    evidence_dir = run_dir / "authority" / "evidence"
+    results_dir = run_dir / "authority" / "results"
+    assessments_dir = run_dir / "authority" / "assessments"
+    manifest = load_json(requests_dir / "manifest.json")
+    request_ids = expected_request_ids(manifest)
+    if json_file_manifest(
+        requests_dir,
+        {f"{request_id}.json" for request_id in request_ids} | {"manifest.json"},
+    ) != authority_gate.get("requestHashes"):
+        raise PipelineError("请求文件已被修改，禁止重开")
+    if json_file_manifest(
+        evidence_dir,
+        {f"{request_id}.json" for request_id in request_ids} | {"batch.json"},
+    ) != authority_gate.get("evidenceHashes"):
+        raise PipelineError("证据文件已被修改，禁止重开")
+    if json_file_manifest(
+        results_dir,
+        {f"{request_id}.json" for request_id in request_ids},
+    ) != authority_gate.get("resultHashes"):
+        raise PipelineError("裁决结果已被修改或混入陈旧文件，禁止重开")
+    if json_file_manifest(
+        assessments_dir,
+        set((authority_gate.get("assessmentHashes") or {}).keys()),
+    ) != authority_gate.get("assessmentHashes"):
+        raise PipelineError("assessment 已被修改；请先恢复到锁定版本再重开")
+    verification_path = run_dir / "verification.json"
+    authority_report = run_dir / "03-authority-report.html"
+    if (
+        not verification_path.is_file()
+        or capture_digest(verification_path) != authority_gate.get("verificationSha256")
+        or not authority_report.is_file()
+        or capture_digest(authority_report) != authority_gate.get("authorityReportSha256")
+    ):
+        raise PipelineError("第三步锁定产物已缺失或被修改，禁止重开")
+
+    revisions_root = run_dir / "authority" / "revisions"
+    revisions_root.mkdir(parents=True, exist_ok=True)
+    revision_number = len([path for path in revisions_root.iterdir() if path.is_dir()]) + 1
+    revision_dir = revisions_root / f"revision-{revision_number:03d}"
+    revision_dir.mkdir()
+    archive_paths = (
+        Path("authority-gate.json"),
+        Path(INTERACTION_GATE_FILE),
+        Path("verification.json"),
+        Path("03-authority-report.html"),
+        Path("04-final-report.html"),
+        Path("report.html"),
+        Path("pipeline.json"),
+        Path(PORTABLE_REPORT_PACKAGE),
+        Path("report-input"),
+        Path("authority/results"),
+        Path("authority/assessments"),
+    )
+    archived = []
+    for relative_path in archive_paths:
+        source = run_dir / relative_path
+        if not source.exists():
+            continue
+        destination = revision_dir / relative_path
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        if source.is_dir():
+            shutil.copytree(source, destination)
+        else:
+            shutil.copy2(source, destination)
+        archived.append(str(relative_path).replace("\\", "/"))
+    dump_json(revision_dir / "revision.json", {
+        "schemaVersion": "fact-check-x/authority-revision@1",
+        "revision": revision_number,
+        "createdAt": now_iso(),
+        "reason": str(args.reason).strip(),
+        "archived": archived,
+        "priorFinalizedAt": authority_gate.get("finalizedAt"),
+        "priorVerificationSha256": authority_gate.get("verificationSha256"),
+        "priorAuthorityReportSha256": authority_gate.get("authorityReportSha256"),
+    })
+
+    for result_path in results_dir.glob("*.json"):
+        result_path.unlink()
+    for stale in (
+        verification_path,
+        authority_report,
+        run_dir / "04-final-report.html",
+        run_dir / "report.html",
+        run_dir / "pipeline.json",
+        run_dir / PORTABLE_REPORT_PACKAGE,
+    ):
+        stale.unlink(missing_ok=True)
+    shutil.rmtree(run_dir / "report-input", ignore_errors=True)
+    interaction_gate = load_interaction_gate(run_dir)
+    stages = interaction_gate.setdefault("stages", {})
+    stages.pop("authority", None)
+    stages.pop("evaluation", None)
+    dump_json(interaction_gate_path(run_dir), interaction_gate)
+    reopened_at = now_iso()
+    reopen_history = list(authority_gate.get("reopenHistory") or [])
+    reopen_history.append({
+        "revision": revision_number,
+        "reopenedAt": reopened_at,
+        "reason": str(args.reason).strip(),
+        "archive": str(revision_dir.resolve()),
+    })
+    reset_gate = {
+        key: value for key, value in authority_gate.items()
+        if key not in {
+            "finalizedAt", "finalizeStatus", "results", "assessmentHashes",
+            "resultHashes", "verificationSha256", "authorityReportSha256"
+        }
+    }
+    reset_gate.update({
+        "status": "searched",
+        "reopenedAt": reopened_at,
+        "reopenReason": str(args.reason).strip(),
+        "reopenHistory": reopen_history,
+    })
+    dump_json(authority_gate_path, reset_gate)
+    return {
+        "status": "completed",
+        "stage": "authority_reopened",
+        "revision": revision_number,
+        "archive": str(revision_dir.resolve()),
+        "nextCommand": "finalize-authority",
+        "message": "旧裁决已完整归档；可修改 assessment 后重新 finalize，新的第三步报告仍需重新确认。",
+    }
+
+
+def merge_verification(comparison: dict, results_dir: Path) -> dict:
+    points = []
+    evidence_gaps = []
+    request_count = 0
+    dknow_exempt_count = 0
+    gov_exempt_count = 0
+    downgraded_anchor_ids: list[str] = []
+    authority_verdicts: dict[tuple[str, str], str] = {}
+    for point in comparison.get("knowledgePoints") or []:
+        path = results_dir / f"{point['id']}.json"
+        if not path.exists():
+            raise PipelineError(f"缺少单点核验结果 {point['id']}")
+        authority = load_json(path)
+        if authority.get("schemaVersion") != "fact-check-x/authority-result@1" or authority.get("requestId") != point["id"]:
+            raise PipelineError(f"{point['id']} 的单点核验结果版本或 ID 不正确")
+        exempt_policy = official_exempt_policy(point)
+        expected_mode = {
+            "dknow_official_reference": "dknow_exempt",
+            "gov_cn_reference": "gov_exempt",
+        }.get(exempt_policy, "trusted_search")
+        expected_count = 0 if exempt_policy else 1
+        actual_mode = str(authority.get("searchMode") or "")
+        actual_count = int(authority.get("requestCount") or 0)
+        # 非对称门禁：比较阶段依据引用池认定「免搜索」，核验阶段可能独立判定该锚点
+        # 撑不住主张而改走可信搜索。多搜一次是保守方向，放行；反过来把本应搜索的
+        # 知识点降级成免搜索属于洗白，必须拦住。
+        if actual_mode == expected_mode:
+            if actual_count != expected_count:
+                raise PipelineError(
+                    f"{point['id']} 权威证据模式为 {actual_mode}，"
+                    f"请求数应为 {expected_count}，实际为 {actual_count}"
+                )
+        elif exempt_policy and actual_mode == "trusted_search" and actual_count >= 1:
+            downgraded_anchor_ids.append(str(point["id"]))
+        else:
+            raise PipelineError(
+                f"{point['id']} 权威证据模式应为 {expected_mode}，"
+                f"请求数应为 {expected_count}，"
+                f"实际为 {actual_mode or '未知'}／{actual_count}"
+            )
+        request_count += int(authority.get("requestCount") or 0)
+        dknow_exempt_count += int(authority.get("searchMode") == "dknow_exempt")
+        gov_exempt_count += int(authority.get("searchMode") == "gov_exempt")
+        for platform, verdict in (authority.get("verdicts") or {}).items():
+            authority_verdicts[(point["id"], platform)] = str(
+                verdict.get("verdict") or ""
+            )
+        finding = str(authority.get("authoritativeFinding") or "").strip()
+        if not finding:
+            finding = "未取得足够权威证据；该知识点保持证据不足。"
+            authority = {**authority, "authoritativeFinding": finding}
+        for gap in authority.get("evidenceGaps") or []:
+            evidence_gaps.append({"stage": "authority", "knowledgePointId": point["id"], **gap})
+        points.append({**point, "authority": authority})
+    for review in comparison.get("analysisGaps") or []:
+        key = (
+            str(review.get("knowledgePointId") or ""),
+            str(review.get("platform") or ""),
+        )
+        if (
+            review.get("stage") == "comparison"
+            and authority_verdicts.get(key) in ("supported", "contradicted")
+        ):
+            continue
+        evidence_gaps.append({
+            **review,
+            "reason": str(review.get("reason") or "")
+            or "当前分析信息不足，且权威证据未能完成裁决",
+        })
+    final_answer_lines = []
+    final_answer_items = []
+    final_answer_point_ids = []
+    excluded_point_ids = []
+    supplemental_items = []
+    supplemental_point_ids = []
+    supplemental_excluded_point_ids = []
+    for point in points:
+        authority = point.get("authority") or {}
+        claims = authority.get("claims") or {}
+        verdicts = authority.get("verdicts") or {}
+        resolved = any(
+            claims.get(platform, {}).get("covered")
+            and (
+                verdict.get("verdict") in {"supported", "contradicted"}
+                or verdict.get("category") == "recommendation"
+            )
+            for platform, verdict in verdicts.items()
+        )
+        point_id = str(point.get("id") or "")
+        role = str(point.get("role") or "direct")
+        if not resolved:
+            if role == "direct":
+                excluded_point_ids.append(point_id)
+            else:
+                supplemental_excluded_point_ids.append(point_id)
+            continue
+        finding = str(
+            (authority.get("authoritativeFinding") or "")
+        ).strip()
+        title = str(point.get("description") or point.get("id") or "").strip()
+        answer = finding
+        item = {
+            "knowledgePointId": point_id,
+            "title": title,
+            "answer": answer,
+        }
+        if role == "direct":
+            final_answer_point_ids.append(point_id)
+            final_answer_lines.append(answer)
+            final_answer_items.append(item)
+        else:
+            supplemental_point_ids.append(point_id)
+            supplemental_items.append(item)
+    final_answer_status = (
+        "verified"
+        if final_answer_point_ids and not excluded_point_ids
+        else "partially_verified"
+        if final_answer_point_ids
+        else "insufficient_evidence"
+    )
+    return {
+        "schemaVersion": "fact-check-x/verification@2",
+        "question": comparison.get("question"),
+        "coreQuestion": comparison.get("coreQuestion"),
+        "finalAnswer": {
+            "status": final_answer_status,
+            "answer": "\n".join(final_answer_lines)
+            or "当前没有足够权威证据形成确定答案；各项证据边界已在报告中列明。",
+            "items": final_answer_items,
+            "knowledgePointIds": final_answer_point_ids,
+            "excludedKnowledgePointIds": excluded_point_ids,
+        },
+        "supplementalFindings": {
+            "items": supplemental_items,
+            "knowledgePointIds": supplemental_point_ids,
+            "excludedKnowledgePointIds": supplemental_excluded_point_ids,
+        },
+        "createdAt": now_iso(),
+        "platforms": comparison.get("platforms") or [],
+        "knowledgePoints": points,
+        "trustedSearchRequestCount": request_count,
+        "dknowExemptCount": dknow_exempt_count,
+        "govExemptCount": gov_exempt_count,
+        "anchorDowngrades": downgraded_anchor_ids,
+        "officialExemptCount": dknow_exempt_count + gov_exempt_count,
+        "evidenceGaps": evidence_gaps,
+        "evidenceGapCount": len(evidence_gaps),
+        "status": "completed",
+    }
+
+
+def deliver(args: argparse.Namespace, skills: dict[str, Path]) -> dict:
+    run_dir = require_run(args.run_dir)
+    require_stage_acknowledged(run_dir, "capture")
+    require_stage_acknowledged(run_dir, "comparison")
+    require_stage_acknowledged(run_dir, "authority")
+    results_path = Path(args.results).resolve()
+    require_capture_gate(run_dir, results_path)
+    results = validate_capture_results(results_path)
+    authority_gate_path = run_dir / "authority-gate.json"
+    if not authority_gate_path.exists():
+        raise PipelineError("缺少权威核验门禁，禁止生成最终报告")
+    authority_gate = load_json(authority_gate_path)
+    if (
+        authority_gate.get("schemaVersion") != "fact-check-x/authority-gate@1"
+        or authority_gate.get("status") != "finalized"
+        or authority_gate.get("finalizeStatus") != "completed"
+    ):
+        raise PipelineError("权威核验尚未通过取证与裁决门禁，禁止生成最终报告")
+    comparison_gate = require_comparison_provenance(run_dir)
+    comparison_path = Path(args.comparison).resolve() if args.comparison else run_dir / "comparison.json"
+    if comparison_path != Path(comparison_gate["files"]["comparison"]["path"]).resolve():
+        raise PipelineError("deliver 只能使用 provenance 门禁锁定的 comparison.json")
+    requests_manifest = load_json(run_dir / "authority" / "requests" / "manifest.json")
+    request_ids = expected_request_ids(requests_manifest)
+    if json_file_manifest(
+        run_dir / "authority" / "requests",
+        {f"{request_id}.json" for request_id in request_ids} | {"manifest.json"},
+    ) != authority_gate.get("requestHashes"):
+        raise PipelineError("请求文件在裁决后被修改，禁止交付")
+    if json_file_manifest(
+        run_dir / "authority" / "evidence",
+        {f"{request_id}.json" for request_id in request_ids} | {"batch.json"},
+    ) != authority_gate.get("evidenceHashes"):
+        raise PipelineError("证据文件在裁决后被修改，禁止交付")
+    if json_file_manifest(
+        run_dir / "authority" / "results",
+        {f"{request_id}.json" for request_id in request_ids},
+    ) != authority_gate.get("resultHashes"):
+        raise PipelineError("结果文件被修改或混入额外/陈旧 ID，禁止交付")
+    assessments_dir = run_dir / "authority" / "assessments"
+    if json_file_manifest(assessments_dir, set((authority_gate.get("assessmentHashes") or {}).keys())) != authority_gate.get("assessmentHashes"):
+        raise PipelineError("assessment 文件被修改、缺失或混入额外文件，禁止交付")
+    verification_path = run_dir / "verification.json"
+    report_path = run_dir / "report.html"
+    capture_deliverable = run_dir / "01-capture-report.html"
+    comparison_deliverable = run_dir / "02-comparison-report.html"
+    authority_deliverable = run_dir / "03-authority-report.html"
+    final_deliverable = run_dir / "04-final-report.html"
+    report_package = run_dir / PORTABLE_REPORT_PACKAGE
+    if not verification_path.is_file():
+        raise PipelineError("缺少第三步已锁定的 verification.json，禁止重算或交付")
+    if capture_digest(verification_path) != authority_gate.get("verificationSha256"):
+        raise PipelineError("第三步权威核验结果已被修改，禁止第四步重算或交付")
+    if (
+        not authority_deliverable.is_file()
+        or capture_digest(authority_deliverable)
+        != authority_gate.get("authorityReportSha256")
+    ):
+        raise PipelineError("第三步报告已缺失或被修改，禁止第四步继续")
+    verification = load_json(verification_path)
+    for stale in (
+        run_dir / "03-final-report.html",
+        run_dir / "04-complete-report-package.zip",
+    ):
+        stale.unlink(missing_ok=True)
+    capture_report = {
+        "results": str((run_dir / "capture" / "results.json").resolve()),
+        "report": str((run_dir / "capture" / "report.html").resolve()),
+        "markdown": str((run_dir / "capture" / "report.md").resolve()),
+    }
+    for required in (
+        capture_deliverable,
+        comparison_deliverable,
+        authority_deliverable,
+        Path(capture_report["results"]),
+        Path(capture_report["report"]),
+        Path(capture_report["markdown"]),
+    ):
+        if not required.is_file():
+            raise PipelineError(f"缺少已完成阶段的锁定产物：{required.name}")
+    run([
+        sys.executable,
+        str(skills["authority"] / "scripts" / "render_final_report.py"),
+        "--results",
+        str(results_path),
+        "--comparison",
+        str(comparison_path),
+        "--verification",
+        str(verification_path),
+        "--output",
+        str(report_path),
+        "--intermediate-dir",
+        str(run_dir / "report-input"),
+    ])
+    shutil.copyfile(report_path, final_deliverable)
+    normalize_report_file(final_deliverable, collect_technical_notices(run_dir))
+    checkpoint = record_stage_checkpoint(
+        run_dir,
+        "evaluation",
+        "各方答案测评报告",
+        final_deliverable,
+        None,
+    )
+    manifest = {
+        "schemaVersion": "fact-check-x/pipeline@2",
+        "createdAt": now_iso(),
+        "status": verification["status"],
+        "skills": DEPENDENCIES,
+        "knowledgePointCount": len(verification["knowledgePoints"]),
+        "trustedSearchRequestCount": verification["trustedSearchRequestCount"],
+        "dknowExemptCount": verification["dknowExemptCount"],
+        "govExemptCount": verification["govExemptCount"],
+        "officialExemptCount": verification["officialExemptCount"],
+        "artifacts": {
+            "sourceResults": str(results_path),
+            "captureGate": str((run_dir / "capture-gate.json").resolve()),
+            "results": capture_report["results"],
+            "answerReferenceReport": capture_report["report"],
+            "captureDeliverable": str(capture_deliverable.resolve()),
+            "answerReferenceMarkdown": capture_report["markdown"],
+            "comparisonTask": str((run_dir / "comparison-task.json").resolve()),
+            "comparisonAnalysis": str(
+                (run_dir / "comparison-analysis.json").resolve()
+            ),
+            "comparison": str(comparison_path.resolve()),
+            "comparisonReport": str((run_dir / "comparison.html").resolve()),
+            "comparisonDeliverable": str(comparison_deliverable.resolve()),
+            "comparisonGate": str((run_dir / "comparison-gate.json").resolve()),
+            "authorityGate": str((run_dir / "authority-gate.json").resolve()),
+            "stageCheckpoints": str((run_dir / INTERACTION_GATE_FILE).resolve()),
+            "authorityDirectory": str((run_dir / "authority").resolve()),
+            "verification": str(verification_path.resolve()),
+            "authorityReport": str(authority_deliverable.resolve()),
+            "authorityDeliverable": str(authority_deliverable.resolve()),
+            "report": str(report_path.resolve()),
+            "finalDeliverable": str(final_deliverable.resolve()),
+            "reportPackage": str(report_package.resolve()),
+        },
+    }
+    dump_json(run_dir / "pipeline.json", manifest)
+    package = build_portable_report_package(run_dir)
+    manifest["artifacts"].update({
+        "reportPackageSha256": package["sha256"],
+        "reportPackageBytes": package["bytes"],
+    })
+    dump_json(run_dir / "pipeline.json", manifest)
+    return {
+        "status": manifest["status"],
+        "manifest": str((run_dir / "pipeline.json").resolve()),
+        "evidenceGapCount": len(verification.get("evidenceGaps") or []),
+        "artifacts": manifest["artifacts"],
+        "answerReferenceReport": manifest["artifacts"]["answerReferenceReport"],
+        "comparisonReport": manifest["artifacts"]["comparisonReport"],
+        "report": str(report_path.resolve()),
+        "deliverables": [
+            deliverable_descriptor("各方答案汇总", capture_deliverable),
+            deliverable_descriptor("各方答案聚合（未核验）", comparison_deliverable),
+            deliverable_descriptor("权威核验后的最终答案", authority_deliverable),
+            deliverable_descriptor("各方答案测评报告", final_deliverable),
+            deliverable_descriptor(
+                "完整可分发报告包",
+                package["path"],
+                sha256=package["sha256"],
+                portable=True,
+            ),
+        ],
+        "checkpoint": checkpoint,
+        "trustedSearchRequestCount": manifest["trustedSearchRequestCount"],
+        "dknowExemptCount": manifest["dknowExemptCount"],
+        "govExemptCount": manifest["govExemptCount"],
+        "officialExemptCount": manifest["officialExemptCount"],
+    }
+
+
+def parser() -> argparse.ArgumentParser:
+    root = argparse.ArgumentParser(description="Fact-Check-X 轻量统一编排入口。")
+    commands = root.add_subparsers(dest="command", required=True)
+    commands.add_parser("locate")
+    commands.add_parser("prepare-runtime")
+    prepare = commands.add_parser("prepare-comparison")
+    prepare.add_argument("--results", required=True)
+    prepare.add_argument("--run-dir", required=True)
+    prepare.add_argument(
+        "--execution-mode",
+        choices=("interactive",),
+        default="interactive",
+        help="固定为 interactive；每阶段均需用户确认后才能继续。",
+    )
+    acknowledge = commands.add_parser("acknowledge-stage")
+    acknowledge.add_argument("--run-dir", required=True)
+    acknowledge.add_argument(
+        "--stage",
+        required=True,
+        choices=("capture", "comparison", "authority"),
+    )
+    acknowledge.add_argument("--token", required=True)
+    acknowledge.add_argument(
+        "--decision",
+        required=True,
+        choices=("continue", "revise", "stop"),
+    )
+    complete = commands.add_parser("complete-comparison")
+    complete.add_argument("--results", required=True)
+    complete.add_argument("--run-dir", required=True)
+    complete.add_argument("--analysis")
+    authority = commands.add_parser("prepare-authority")
+    authority.add_argument("--run-dir", required=True)
+    authority.add_argument("--comparison")
+    search = commands.add_parser("search-authority")
+    search.add_argument("--run-dir", required=True)
+    search.add_argument("--max-workers", type=int, default=12)
+    search.add_argument("--service-area", default="")
+    search.add_argument("--fixtures")
+    final = commands.add_parser("finalize-authority")
+    final.add_argument("--run-dir", required=True)
+    final.add_argument("--assessments-dir")
+    reopen = commands.add_parser("reopen-authority")
+    reopen.add_argument("--run-dir", required=True)
+    reopen.add_argument("--reason", required=True)
+    delivery = commands.add_parser("deliver")
+    delivery.add_argument("--results", required=True)
+    delivery.add_argument("--run-dir", required=True)
+    delivery.add_argument("--comparison")
+    return root
+
+
+def main() -> int:
+    args = parser().parse_args()
+    try:
+        skills = locate_skills()
+        if args.command == "locate":
+            result = {"status": "completed", "skills": {key: str(path) for key, path in skills.items()}}
+        elif args.command == "prepare-runtime":
+            result = prepare_runtime(skills)
+        elif args.command == "prepare-comparison":
+            result = prepare_comparison(args, skills)
+        elif args.command == "acknowledge-stage":
+            result = acknowledge_stage(args)
+        elif args.command == "complete-comparison":
+            result = complete_comparison(args, skills)
+        elif args.command == "prepare-authority":
+            result = prepare_authority(args)
+        elif args.command == "search-authority":
+            result = search_authority(args, skills)
+        elif args.command == "finalize-authority":
+            result = finalize_authority(args, skills)
+        elif args.command == "reopen-authority":
+            result = reopen_authority(args)
+        else:
+            result = deliver(args, skills)
+        print(json.dumps(result, ensure_ascii=False))
+        if result.get("status") == "configuration_required":
+            return 3
+        return 0
+    except (PipelineError, OSError, ValueError, json.JSONDecodeError) as exc:
+        print(json.dumps({"status": "failed", "error": str(exc)}, ensure_ascii=False))
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())