openone-workflow-kit 0.1.0

package/test/smoke.cjs

@@ -0,0 +1,272 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const root = path.resolve(__dirname, '..');
+const init = path.join(root, 'bin', 'init-workspace.cjs');
+const { toPortablePath } = require(init);
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-workflow-smoke-'));
+
+// Windows path.relative() emits backslashes. Generated team-profile paths are
+// portable identifiers and must always use POSIX separators.
+const windowsRepoPath = path.win32.relative('C:\\workspace', 'C:\\workspace\\apps\\web');
+if (toPortablePath(windowsRepoPath) !== 'apps/web') {
+  throw new Error(`Windows relative path was not normalized: ${windowsRepoPath}`);
+}
+
+function mkdir(rel) {
+  fs.mkdirSync(path.join(tmp, rel), { recursive: true });
+}
+
+function write(rel, content) {
+  const file = path.join(tmp, rel);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, content);
+}
+
+function run(args, options = {}) {
+  const result = spawnSync(process.execPath, [init, ...args], {
+    cwd: tmp,
+    encoding: 'utf8',
+    ...options
+  });
+  if (result.status !== 0) {
+    throw new Error(`命令执行失败: ${result.stderr || result.stdout}`);
+  }
+  return result;
+}
+
+function assertFile(rel) {
+  const file = path.join(tmp, rel);
+  if (!fs.existsSync(file)) throw new Error(`missing file: ${rel}`);
+}
+
+function assertContains(rel, text) {
+  const file = path.join(tmp, rel);
+  const content = fs.readFileSync(file, 'utf8');
+  if (!content.includes(text)) throw new Error(`${rel} does not contain ${text}`);
+}
+
+mkdir('docs/product');
+write('docs/business-overview.md', '# Business overview\n');
+write('docs/frontend-rules.md', '# Frontend rules\n');
+write('apps/web/package.json', JSON.stringify({
+  dependencies: { vue: 'latest', vite: 'latest', typescript: 'latest' }
+}, null, 2));
+write('services/api/pom.xml', '<project></project>\n');
+
+run([
+  '--target', tmp,
+  '--tools', 'codex,claude,cursor,copilot,codebuddy,kiro,trea',
+  '--yes'
+]);
+
+for (const rel of [
+  'AGENTS.md',
+  'CLAUDE.md',
+  '.codex/prompts/init-workspace.md',
+  '.codex/prompts/04-代码实现.md',
+  '.codex/prompts/05-代码审查.md',
+  '.codex/prompts/10-复盘总结.md',
+  '.codex/prompts/new-product.md',
+  '.codex/prompts/B1-业务定位.md',
+  '.claude/commands/04-代码实现.md',
+  '.claude/commands/B1-业务定位.md',
+  '.claude/commands/B9-策略复盘.md',
+  '.cursor/rules/agent-workflow-core.mdc',
+  '.github/copilot-instructions.md',
+  '.codebuddy/instructions.md',
+  '.kiro/instructions.md',
+  '.trae/instructions.md',
+  'workflow/team-profile.yaml',
+  'workflow/INITIALIZATION_QUESTIONS.md',
+  'workflow/core/commands/init-workspace.md',
+  'workflow/core/commands/04-代码实现.md',
+  'workflow/core/commands/定义完成.md',
+  'workflow/core/commands/交付至完成.md',
+  'workflow/core/commands/澄清.md',
+  'workflow/core/commands/一致性检查.md',
+  'workflow/core/templates/completion-contract.md',
+  'workflow/core/templates/constitution.template.md',
+  'workflow/core/templates/living-spec.md',
+  'workflow/core/capabilities/definition-lint.md',
+  'workflow/core/capabilities/acceptance-oracle-tracker.md',
+  'workflow/constitution.md',
+  'workflow/standards/README.md',
+  'specs/README.md',
+  '.claude/commands/定义完成.md',
+  '.claude/commands/交付至完成.md',
+  'workflow/core/commands/new-product.md',
+  'workflow/core/commands/B1-业务定位.md',
+  'workflow/core/commands/B1-B8-商业化准备.md',
+  'workflow/core/commands/B5-渠道漏斗映射.md',
+  'workflow/core/commands/B9-策略复盘.md',
+  'workflow/core/templates/00-business-status.md',
+  'workflow/core/templates/business-stage-document.md',
+  'workflow/core/capabilities/market-evidence-grader.md',
+  'workflow/core/capabilities/channel-experiment-tracker.md',
+  'workflow/core/capabilities/branch-gatekeeper.md',
+  'workflow/core/capabilities/release-safety-checker.md',
+  'workflow/core/capabilities/prd-code-diff-checker.md',
+  'workflow/core/capabilities/contract-tracer.md',
+  'workflow/core/capabilities/deployment-readiness-checker.md',
+  'workflow/core/capabilities/runtime-evidence-triage.md',
+  'workflow/core/capabilities/data-change-safety-checker.md',
+  'workflow/core/capabilities/protocol-state-machine-checker.md'
+]) {
+  assertFile(rel);
+}
+
+assertContains('workflow/team-profile.yaml', '- trae');
+assertContains('workflow/team-profile.yaml', 'apps/web');
+assertContains('workflow/team-profile.yaml', 'services/api');
+assertContains('workflow/INSTALL_REPORT.md', '初始化器没有执行远程 Git 命令');
+assertContains('workflow/team-profile.yaml', 'agent-allowed-after-scope-check');
+
+// AGENTS.md must contain the comprehensive usage guide, not just hard gates.
+assertContains('AGENTS.md', '## 快速开始');
+assertContains('AGENTS.md', '## 工作流命令');
+assertContains('AGENTS.md', '## 任务描述模板');
+assertContains('AGENTS.md', '## 工具使用方式');
+assertContains('AGENTS.md', '### Cursor');
+assertContains('AGENTS.md', '/04-代码实现');
+// The command table must list every stage.
+assertContains('AGENTS.md', '/08-发布准备');
+assertContains('AGENTS.md', '/09-发布执行');
+assertContains('AGENTS.md', '/10-复盘总结');
+// The business track must be wired into the guide, profile, and adapters.
+assertContains('AGENTS.md', '/new-product');
+assertContains('AGENTS.md', '/B1-业务定位');
+assertContains('AGENTS.md', '/B9-策略复盘');
+assertContains('workflow/team-profile.yaml', 'business_dir');
+assertContains('workflow/team-profile.yaml', 'outbound_marketing_actions');
+assertContains('workflow/team-profile.yaml', 'market_research');
+assertContains('.cursor/commands/B1-业务定位.md', 'workflow/core/commands/B1-业务定位.md');
+assertContains('.cursor/rules/agent-workflow-core.mdc', 'B9-策略复盘');
+// Definition-of-done mechanics must be wired through guide, profile, and adapters.
+assertContains('AGENTS.md', '/定义完成');
+assertContains('AGENTS.md', '/交付至完成');
+assertContains('AGENTS.md', '完成合同');
+assertContains('workflow/team-profile.yaml', 'specs_dir');
+assertContains('workflow/team-profile.yaml', 'done_verdict');
+assertContains('.cursor/rules/agent-workflow-core.mdc', '定义完成');
+assertContains('.cursor/commands/定义完成.md', 'workflow/core/commands/定义完成.md');
+
+// Contract checker: a well-formed frozen contract passes, a broken one fails.
+const checker = path.join(root, 'bin', 'check-contract.cjs');
+const goodContract = `# 完成合同：demo
+
+## 合同状态
+
+| 项 | 内容 |
+| --- | --- |
+| 需求名称 | demo |
+| 复杂度档位 | S |
+| 状态 | 已冻结 |
+| 冻结时间 | 2026-01-01 |
+| 冻结确认 | 用户于会话中确认 |
+| Definition Lint | 通过 |
+
+## ★ 目标与非目标
+
+- WHEN 用户提交空表单 THE SYSTEM SHALL 阻止提交
+
+## ★ 术语表
+
+| 术语 | 本合同内的精确定义 | 被替代的模糊说法 |
+| --- | --- | --- |
+| 提交成功 | 服务端返回 201 且列表可见 | 提交成功 |
+
+## ★ 验收 Oracle
+
+| ID | 验收标准 | 验证方法 | 类型 | blocking | 状态 | 证据 | 更新时间 |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| O-001 | WHEN 提交空表单 THE SYSTEM SHALL 阻止并提示 | npm test -- form.spec | auto | 是 | PASS | 输出片段 | 2026-01-01 |
+
+## ★ 待澄清项
+
+- 无
+
+## 修订记录
+
+| 时间 | 修订内容 | 原因 | 用户确认 |
+| --- | --- | --- | --- |
+`;
+write('features/demo/00-完成合同.md', goodContract);
+const goodRun = spawnSync(process.execPath, [checker, path.join(tmp, 'features/demo/00-完成合同.md')], { encoding: 'utf8' });
+if (goodRun.status !== 0) {
+  throw new Error(`check-contract should pass a valid contract: ${goodRun.stdout} ${goodRun.stderr}`);
+}
+const badContract = goodContract
+  .replace('| Definition Lint | 通过 |', '| Definition Lint | 未运行 |')
+  .replace('npm test -- form.spec', '待填写');
+write('features/demo-bad/00-完成合同.md', badContract);
+const badRun = spawnSync(process.execPath, [checker, path.join(tmp, 'features/demo-bad/00-完成合同.md')], { encoding: 'utf8' });
+if (badRun.status === 0) {
+  throw new Error('check-contract should fail a frozen contract without lint pass and verification method');
+}
+
+// The Cursor rule must explain how to run a stage via Cursor custom commands.
+assertContains('.cursor/rules/agent-workflow-core.mdc', '.cursor/commands/');
+assertContains('.cursor/rules/agent-workflow-core.mdc', 'workflow/core/commands/04-代码实现.md');
+// Cursor custom slash command adapters must be generated for every stage.
+assertFile('.cursor/commands/04-代码实现.md');
+assertFile('.cursor/commands/10-复盘总结.md');
+assertContains('.cursor/commands/04-代码实现.md', 'workflow/core/commands/04-代码实现.md');
+
+run(['--target', tmp, '--tools', 'codex', '--yes']);
+assertFile('workflow/team-profile.yaml.agent-workflow-new');
+
+const beforeDryRun = fs.readdirSync(tmp).sort().join('\n');
+run(['--target', tmp, '--tools', 'codex', '--dry-run']);
+const afterDryRun = fs.readdirSync(tmp).sort().join('\n');
+if (beforeDryRun !== afterDryRun) {
+  throw new Error('dry-run changed top-level files');
+}
+
+// Upgrade path: --upgrade --force should overwrite in place without writing new
+// .agent-workflow-new files. Clean up stale .agent-workflow-new files left by
+// previous non-force runs before measuring.
+for (const stale of fs.readdirSync(path.join(tmp, 'workflow'))) {
+  if (stale.endsWith('.agent-workflow-new')) {
+    fs.unlinkSync(path.join(tmp, 'workflow', stale));
+  }
+}
+const profileBefore = fs.readFileSync(path.join(tmp, 'workflow/team-profile.yaml'), 'utf8');
+fs.writeFileSync(path.join(tmp, 'workflow/team-profile.yaml'), profileBefore + '\n# user note\n');
+run(['--target', tmp, '--tools', 'codex,claude,cursor', '--upgrade', '--force', '--yes']);
+const profileAfter = fs.readFileSync(path.join(tmp, 'workflow/team-profile.yaml'), 'utf8');
+if (profileAfter.includes('# user note')) {
+  throw new Error('upgrade --force did not overwrite team-profile.yaml');
+}
+const upgradeStrayFiles = fs
+  .readdirSync(path.join(tmp, 'workflow'))
+  .filter((name) => name.endsWith('.agent-workflow-new'));
+if (upgradeStrayFiles.length) {
+  throw new Error(`upgrade --force should not produce new .agent-workflow-new files, found: ${upgradeStrayFiles.join(',')}`);
+}
+
+// Cursor-only install must still generate AGENTS.md (the tool-neutral usage guide),
+// even though codex is not selected.
+const cursorTmp = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-workflow-cursor-'));
+spawnSync(process.execPath, [init, '--target', cursorTmp, '--tools', 'cursor', '--yes'], {
+  cwd: cursorTmp,
+  encoding: 'utf8'
+});
+for (const rel of [
+  'AGENTS.md',
+  '.cursor/rules/agent-workflow-core.mdc',
+  '.cursor/commands/04-代码实现.md'
+]) {
+  if (!fs.existsSync(path.join(cursorTmp, rel))) {
+    throw new Error(`cursor-only install missing file: ${rel}`);
+  }
+}
+const cursorAgents = fs.readFileSync(path.join(cursorTmp, 'AGENTS.md'), 'utf8');
+if (!cursorAgents.includes('### Cursor')) {
+  throw new Error('cursor-only AGENTS.md missing the Cursor usage section');
+}
+
+console.log('Smoke test passed.');

package/workflow/adapters/README.md

@@ -0,0 +1,16 @@
+# Adapters
+
+Adapters 是从同一套 workflow core 和 `team-profile.yaml` 生成的工具特定薄入口。
+
+它们的职责：
+
+- 帮当前工具找到 `AGENTS.md`、`workflow/core/` 和 `workflow/team-profile.yaml`。
+- 按当前工具能力暴露 slash commands、prompts、rules 或 instructions。
+- 保持工具入口轻量，不复制或改写 core 规则。
+
+它们不能：
+
+- 削弱 `workflow/core` 的硬闸门。
+- 调用另一个工具的私有能力。
+- 承诺所有工具体验完全一致。
+- 写入凭证、真实客户数据、私有 URL 或生产配置。

package/workflow/core/README.md

@@ -0,0 +1,38 @@
+# Workflow Core
+
+`workflow/core` 是工具无关的工作流层，定义阶段、闸门、模板和可复用检查能力。它不得包含公司特定业务事实、内部仓库名、私有 URL、凭证、客户数据或某个工具的私有能力。
+
+工作流分两条轨道：研发轨（`/new-feature`、`/01` 到 `/10`，加上 `/澄清`、`/定义完成`、`/一致性检查`、`/交付至完成`，产物在 `features/{feature}/`）和商业化轨（`/new-product`、`/B1` 到 `/B9`，产物在 `business/{product}/`）。两轨共享同一套授权口径：本地文档和本地 git 动作可由 agent 执行，对外动作必须用户授权。
+
+研发轨的判定核心是《完成合同》：`/定义完成` 把前序结论编译为合同（目标/非目标、数据流、失败路径、质量预算、验收 Oracle、术语表、影响边界），Definition Lint 通过并经用户确认后冻结；宣布完成 = blocking Oracle 全 PASS。`workflow/constitution.md` 存放跨需求不可协商原则，`workflow/standards/` 存放个人代码规范，工作区级 `specs/` 存放已实现行为的 living specs。
+
+## Core 规则
+
+- 同一套 core，多个工具 adapter 分层增强。
+- 不承诺所有工具体验完全一致。
+- 业务代码修改必须通过功能分支闸门和实现阶段闸门。
+- 个人项目允许 agent 在范围明确且工作树已检查后执行本地分支命名、创建、commit、tag 和本地 merge。
+- 远程 Git、push、GitHub release、商店提交、部署、数据库写入和生产配置写入必须获得用户明确授权。
+- 同仓多需求进入实现阶段后必须使用独立 worktree。
+- adapter 可以增强或降级体验，但不能削弱 core 闸门。
+- 商业化轨只产出文档和清单：对外发布内容、投放广告、cold outreach、联系合作方必须用户明确授权或自行执行；营销工程需求通过 `/new-feature` 回流研发轨，不在 B 阶段直接改代码。
+- 商业化结论必须做证据分级（一手/二手/推断），不得编造市场数据、用户评价或竞品价格。
+- M/L 档需求进入实现前，完成合同必须已冻结且 Definition Lint 通过；S 档必须有 ★ 必填节完整的迷你合同。
+- 合同冻结后不得静默修改标准、阈值或 blocking 标记；变更走修订记录并经用户确认。
+- Oracle 状态只能由 `/交付至完成` 或 `/07-测试执行` 翻转且必须附证据；blocking Oracle 存在 NOT_RUN/FAIL/STALE 时不得宣布完成或进入发布执行。
+- constitution 与需求冲突时先修订宪法（经用户确认），不得绕过。
+
+## 目录地图
+
+- `commands/`: 每个阶段的契约。
+- `templates/`: 通用文档模板。
+- `capabilities/`: 可复用检查能力。
+
+## 项目特化
+
+不要为了加入单个项目事实而修改 core 文件。项目特化内容应放在：
+
+- `workflow/team-profile.yaml`
+- `features/{feature}/`
+- 目标项目自己的规范和本地资料
+- 工具 adapter 的薄入口

package/workflow/core/capabilities/README.md

@@ -0,0 +1,61 @@
+# Capabilities
+
+Capabilities 是可复用检查能力。不同工具可以把它们实现成 prompt、规则、hooks、checklist 或 subagent；实现形态可以不同，但核心阻断规则不能被削弱。
+
+## 能力等级
+
+| 等级 | 含义 | 常见实现 |
+| --- | --- | --- |
+| L0 | 文档规则 | `AGENTS.md`、core 文档 |
+| L1 | Prompt 或 checklist | prompts、命令模板 |
+| L2 | 工具原生规则 | slash commands、editor rules |
+| L3 | Hooks 或前置检查 | 本地 validator |
+| L4 | 多 agent 路由 | 支持 subagent 的工具 |
+
+## 分层定义
+
+| 分层 | 含义 |
+| --- | --- |
+| essential | 首批必须接入；直接保护实现闸门和核心交付风险。 |
+| recommended | 第二批接入；补齐范围扫描、运行验证、数据变更和发布准备。 |
+| optional | 多项目规模或高风险场景需要时再接入。 |
+
+## 最小能力集
+
+| 分层 | Capability | 用途 | 阶段 |
+| --- | --- | --- | --- |
+| essential | [definition-lint](./definition-lint.md) | 冻结前按八维度检查完成合同，配按项目类型的定义面试题库 | `/定义完成` |
+| essential | [acceptance-oracle-tracker](./acceptance-oracle-tracker.md) | 验收 Oracle 状态机：绑定验证方法、证据与 STALE 复验，完成=blocking 全绿 | `/定义完成`, `/07`, `/交付至完成`, `/08` |
+| essential | [branch-gatekeeper](./branch-gatekeeper.md) | 阻止在错误分支或错误阶段修改业务代码 | `/04` |
+| essential | [release-safety-checker](./release-safety-checker.md) | 对比发布候选与生产基线，防止范围漂移 | `/05`, `/07`, `/08`, `/09` |
+| essential | [prd-code-diff-checker](./prd-code-diff-checker.md) | 对比产品意图、技术方案与真实 diff | `/05` |
+| essential | [contract-tracer](./contract-tracer.md) | 追踪跨服务、跨层或前后端契约变更 | `/03`, `/05` |
+| recommended | [worktree-isolator](./worktree-isolator.md) | 同仓多需求进入实现后强制 worktree 隔离 | `/04` |
+| recommended | [repo-baseline-scanner](./repo-baseline-scanner.md) | 记录分支、dirty 状态和事实来源降级 | `/03` |
+| recommended | [impact-scope-analyzer](./impact-scope-analyzer.md) | 扫描仓库、API、UI、数据、配置和测试影响面 | `/03` |
+| recommended | [security-reviewer](./security-reviewer.md) | 审查凭证、鉴权、隐私、ACL、配置和审计风险 | `/05` |
+| recommended | [verify-app](./verify-app.md) | 记录真实执行的构建、单测、集成、浏览器或人工验证 | `/04`, `/07` |
+| recommended | [deployment-readiness-checker](./deployment-readiness-checker.md) | 区分构建成功、启动成功、部署生效和路由可达 | `/07`, `/08`, `/09` |
+| recommended | [runtime-evidence-triage](./runtime-evidence-triage.md) | 用运行态证据替代静态猜测，定位部署、路由、配置和日志问题 | `/03`, `/05`, `/07` |
+| recommended | [data-change-safety-checker](./data-change-safety-checker.md) | 管理 DDL/DML/数据修复的交付位置、预检查、后检查和回滚口径 | `/03`, `/05`, `/07` |
+| recommended | [protocol-state-machine-checker](./protocol-state-machine-checker.md) | 让多步外部协议按状态机建模，明确终态、幂等和失败语义 | `/03`, `/05`, `/07` |
+| recommended | [personal-git-operator](./personal-git-operator.md) | 允许个人项目中的本地分支、commit、tag 和本地 merge 自动化 | `/04`, `/08`, `/09` |
+| recommended | [personal-release-checklist](./personal-release-checklist.md) | 迁移独立开发者发布 SOP：双分支、tag、artifact、渠道清单和回滚 | `/08`, `/09` |
+| recommended | [knowledge-capture-maintainer](./knowledge-capture-maintainer.md) | 把复盘经验沉淀到 Markdown 知识层并保持索引/日志 | `/10` |
+| optional | [test-evidence-reviewer](./test-evidence-reviewer.md) | 检查测试是否真的证明需求行为 | `/06`, `/07` |
+| optional | [ui-baseline-reviewer](./ui-baseline-reviewer.md) | 检查 UI 实现是否符合设计和前端规范 | `/02`, `/04A`, `/05` |
+| optional | [memory-curator](./memory-curator.md) | 把复盘中的可复用经验脱敏沉淀为结构化记忆 | `/10` |
+| optional | [rule-extractor](./rule-extractor.md) | 从复盘中提炼可进入 workflow core 的通用规则候选 | `/10` |
+
+## 商业化跑道能力
+
+商业化跑道（`/new-product`、`/B1` 到 `/B9`）复用上面的能力分级口径。首批接入下面两个能力，保护“市场结论不编造、渠道投放不失控”这两条商业化最容易翻车的边界。
+
+| 分层 | Capability | 用途 | 阶段 |
+| --- | --- | --- | --- |
+| essential | [market-evidence-grader](./market-evidence-grader.md) | 给市场、竞品和客户结论做一手/二手/推断证据分级，禁止编造数据 | `/B1`-`/B5`, `/B9` |
+| essential | [channel-experiment-tracker](./channel-experiment-tracker.md) | 把每个渠道当实验管理：假设、双预算上限、周期和事前判定标准 | `/B5`-`/B9` |
+
+## 接入建议
+
+先接入四个 essential 能力，保护“分支 / 阶段 / 发布范围 / PRD-diff / 契约追踪”这些最容易造成严重返工的边界。稳定后再接入 recommended 能力，补齐部署有效性、运行态证据、数据变更和多步协议风险。optional 能力适合多项目进入规模化使用后逐步增强。启用商业化跑道时，market-evidence-grader 和 channel-experiment-tracker 与 B 阶段同批接入。

package/workflow/core/capabilities/acceptance-oracle-tracker.md

@@ -0,0 +1,45 @@
+# Acceptance Oracle Tracker
+
+## Purpose
+
+Make "done" a machine-checkable verdict instead of a feeling: every acceptance criterion is an oracle bound to a reproducible verification method, tracked through an explicit state machine. Declaring completion means all blocking oracles are PASS (or user-confirmed WAIVED) — nothing else counts.
+
+## Sources
+
+- `features/{feature}/00-完成合同.md` oracle table
+- `features/{feature}/交付至完成.md` or `07-测试执行.md` execution evidence
+- Local test/build/browser/manual-check outputs
+
+## Oracle Format
+
+| 字段 | 要求 |
+| --- | --- |
+| ID | `O-###`，稳定不复用 |
+| 验收标准 | EARS（WHEN/WHILE/IF…THEN/WHERE + SHALL）或 Given/When/Then；绑定数字或可观察行为 |
+| 验证方法 | auto：可复现命令/脚本/测试名；manual：编号步骤 + 明确判定标准 |
+| 类型 | auto / manual（auto 优先；manual 用于体验直觉与无法自动化的检查） |
+| blocking | 是/否；发布准入只看 blocking 集合 |
+| 状态 | NOT_RUN / PASS / FAIL / STALE / WAIVED |
+| 证据 | 命令输出、退出码、截图路径、日志片段；manual 附执行人与时间 |
+
+## State Machine
+
+- 初始一律 `NOT_RUN`；只有真实执行过验证方法才能进入 `PASS` 或 `FAIL`。
+- `PASS` 之后，其覆盖的代码或配置再次变更 → 立即置 `STALE`，必须复验；`STALE` 不等于 `PASS`。
+- `WAIVED` 只能由用户书面确认产生，必须记录理由与风险；agent 不得自我豁免。
+- 状态只能由 `/交付至完成` 或 `/07-测试执行` 翻转，且逐次附证据；其他阶段只读。
+- 冻结后不得修改标准、阈值、blocking 标记或删除 Oracle；确需变更走合同修订记录 + 用户确认。
+
+## Verdict Rules
+
+- 宣布完成 = blocking 全部 `PASS` 或 `WAIVED`（带确认）；存在 `NOT_RUN`/`FAIL`/`STALE` 的 blocking 项时，任何"基本完成/差不多了"表述都是违规。
+- 非 blocking 项不阻塞发布，但终态汇总必须如实列出其状态。
+- 无法执行的验证方法（缺环境/凭据）记为 `NOT_RUN` + 精确阻塞说明，不得凭推测标 `PASS`。
+
+## Failure Modes
+
+- 把"代码写完了"当成 PASS 的证据。
+- 复用旧运行结果糊弄复验（证据必须对应当前 commit）。
+- 修改测试或阈值使其通过，而不是修复实现。
+- manual Oracle 没有步骤和判定标准，执行时临场发挥。
+- STALE 项在发布前被悄悄当作 PASS 统计。

package/workflow/core/capabilities/branch-gatekeeper.md

@@ -0,0 +1,57 @@
+# Capability: branch-gatekeeper
+
+- **Tier**: essential
+- **Stage**: `/04`, `/04A`, `/04B`
+- **Purpose**: 在业务代码写入前确认功能分支闸门和实现阶段闸门，防止代码落到错误基线。
+
+## 为什么需要
+
+分支漂移和阶段漂移是代码管理失控的高频来源。实现必须同时满足：当前请求已进入实现阶段，且每个受影响仓库都在本需求功能分支或登记 worktree 中。
+
+## 输入
+
+- `workflow/team-profile.yaml#branch_model`
+- 每个受影响仓库的当前分支
+- 用户请求和 `features/{feature}/00-工作流状态.md` 中的当前阶段
+- 功能名称和前序阶段文档
+
+## 输出
+
+```yaml
+result: PASS | WARN | BLOCK
+checks:
+  - name: stage_gate
+    status: pass | block
+    detail: "..."
+  - name: branch_gate_per_repo
+    status: pass | block
+    repos:
+      - path: "<repo>"
+        branch: "<current branch>"
+        verdict: pass | block
+        reason: "..."
+blocked_reason: "..."
+recommended_action: "请按 team-profile 中的分支规则准备功能分支。"
+```
+
+## 阻断规则
+
+- 当前不是 `/04`、`/04A`、`/04B`，但 agent 将要修改业务源码、配置、SQL、迁移或部署文件时阻断。
+- 任一受影响仓库位于生产、集成、历史、不明或无关分支时阻断。
+- 功能分支不符合 `branch_model.feature_branch_rule` 时阻断。
+- 无 Git 元数据时降级为 WARN，并要求用户明确确认本地快照风险后才能继续。
+
+## Adapter 示例
+
+- **L0**: 在 `AGENTS.md` 中写明闸门规则。
+- **L1**: prompt 要求用户粘贴当前分支输出。
+- **L2**: slash command 运行仓级分支检查并输出结论。
+- **L3**: 写入前 hook 发现分支不合规时中断。
+- **L4**: 独立 subagent 负责执行准入检查并返回结构化结果。
+
+## 反模式
+
+- 因为目录名看起来正确就跳过分支检查。
+- 认为“小改动”可以绕过 04 阶段。
+- 在 `main`、`prod`、`test` 或 integration 分支上直接修代码。
+- 两个需求混用同一个功能分支。

package/workflow/core/capabilities/channel-experiment-tracker.md

@@ -0,0 +1,32 @@
+# Channel Experiment Tracker
+
+## Purpose
+
+Run every marketing channel as an explicit experiment with a hypothesis, budget cap, time box, and predefined kill criteria, so solo developers avoid open-ended spend of money and attention.
+
+## Sources
+
+- `business/{product}/B5-渠道漏斗映射.md`, `B6-营销获客策略.md`, `B7-营销预算.md`, `B8-渠道执行策略.md`
+- Channel analytics, spend records, and time logs kept by the user
+- `business/{product}/B9-策略复盘.md` history
+
+## Rules
+
+- Each experiment records: channel, funnel position, hypothesis, action cadence, money cap, time cap, time box, primary metric, decision threshold, and notes.
+- Define kill / keep / scale criteria before the experiment starts, not after seeing results.
+- Time cost counts: hours-heavy channels are not "free" just because no cash was spent.
+- Results use real numbers with date ranges; missing data is recorded as a collection gap, never silently estimated.
+- Every experiment ends with an explicit verdict — validated / invalidated / inconclusive — feeding `/B9-策略复盘`.
+- Outbound actions inside an experiment (posting, sending, spending) still require explicit user authorization or user execution.
+
+## Suggested Outputs
+
+- An experiment ledger table in `B8-渠道执行策略.md`, one row per experiment per cycle.
+- Per-cycle verdicts and channel disposal recommendations (scale / keep / reduce / kill) for `/B9-策略复盘`.
+
+## Failure Modes
+
+- Running a channel "to see how it goes" with no metric or end date.
+- Moving the decision threshold after results arrive.
+- Running several overlapping experiments that share one primary metric window, making attribution impossible.
+- Letting an inconclusive experiment run indefinitely instead of re-scoping or ending it.

package/workflow/core/capabilities/ci-cd-automation-governor.md

@@ -0,0 +1,123 @@
+# Capability: ci-cd-automation-governor
+
+- **Tier**: recommended
+- **Stage**: `/03`, `/04`, `/07`, `/08`, `/09`; revisit in `/10`
+- **Purpose**: Introduce CI/CD and deployment automation in controlled stages, so automation improves repeatability without silently releasing unreviewed or untested changes.
+
+## Why
+
+Personal projects still need disciplined release flow. The risk is not "too much process"; the risk is automation publishing the wrong branch, leaking secrets, skipping App Store/release requirements, or deploying code whose tests do not match the feature scope. CI should start early because it is read-only verification. CD should start manual-gated, then become progressively automated only after the first stable production release and rollback path exist.
+
+## Automation Maturity Model
+
+```yaml
+level_0_manual:
+  when: "before first production release or when repo has no stable build"
+  allowed:
+    - local validation commands
+    - documented manual deployment checklist
+  blocked:
+    - automatic deployment
+    - production secret writes
+
+level_1_ci_only:
+  when: "repo has repeatable build/test commands"
+  allowed:
+    - branch and pull-request CI checks
+    - lint, unit tests, type checks, build checks
+    - artifact creation without deployment
+  blocked:
+    - automatic production deployment
+
+level_2_manual_cd:
+  when: "first prod release exists and rollback is documented"
+  allowed:
+    - manually approved deployment job
+    - deployment from main to prod after tests pass
+    - tagged release artifacts
+  blocked:
+    - unattended production deployment
+
+level_3_guarded_auto_cd:
+  when: "several stable releases have passed with reliable CI and rollback"
+  allowed:
+    - automatic non-production preview deployment
+    - optional automatic production deployment from prod tags or protected prod branch
+  required:
+    - branch protection
+    - required CI checks
+    - environment protection or equivalent manual approval for high-risk changes
+    - rollback runbook tested at least once
+```
+
+## Branch Flow Contract
+
+Automation must respect the workspace branch model:
+
+- Development branches are created from `prod`.
+- CI runs on development branches and on `main`.
+- `main` is the testing/integration branch.
+- Release promotion goes from `main` to `prod`.
+- No separate `test` branch is created for personal projects.
+- Production deployment must be tied to `prod` or a release tag produced from `prod`.
+
+## Inputs
+
+- `workflow/team-profile.yaml#branch_model`
+- `workflow/team-profile.yaml#risk_policy`
+- Target repository package/build/test scripts
+- Runtime and deployment provider docs for the target project
+- Secret inventory and environment variable list
+- Workspace-level `features/{feature}/03-技术架构.md`
+- Workspace-level `features/{feature}/07-测试执行.md`
+- Workspace-level `features/{feature}/08-发布准备.md`
+- Workspace-level `features/{feature}/09-发布执行.md`
+
+## Outputs
+
+```yaml
+result: PASS | WARN | BLOCK
+automation_level: 0 | 1 | 2 | 3
+ci:
+  required_checks:
+    - "<command or workflow>"
+  evidence:
+    - "<log, URL, or local command output>"
+cd:
+  deployment_mode: "none" | "manual-gated" | "guarded-auto"
+  source_branch: "main" | "prod" | "<tag>"
+  target_environment: "preview" | "production"
+  rollback_plan: "<path or summary>"
+secrets:
+  location: "platform secret store only"
+  repo_committed_secrets: false
+blocked_reason: "..."
+recommended_action: "..."
+```
+
+## Blocking Rules
+
+- Block automatic production deployment before the first manual production release succeeds.
+- Block any deployment automation that can deploy from a development branch directly to production.
+- Block production deployment if required CI checks are missing, failing, or not clearly tied to the release commit.
+- Block automation that stores secrets in source code, workflow documents, `.env` committed files, logs, screenshots, or prompt transcripts.
+- Block deployment from `main` to `prod` unless the release scope has passed `/07-测试执行`, `/08-发布准备` records the rollback plan, and `/09-发布执行` has explicit user authorization for remote or production actions.
+- Block creating a `test` branch as a deployment environment for personal projects; use `main` for testing/integration and provider preview environments for previews.
+- Downgrade to WARN when the project has no code yet; require a CI/CD plan document but do not create workflows until implementation begins.
+
+## Adapter Examples
+
+- **L0**: A checklist in `/03`, `/08`, and `/09` stating the automation level, CI commands, deployment trigger, secret storage, authorization, and rollback path.
+- **L1**: A prompt that asks for package scripts and deployment provider, then drafts a CI/CD plan.
+- **L2**: A slash command that validates workflow files against branch and secret rules.
+- **L3**: A pre-push or CI policy check that blocks deployment workflow changes without required checks and rollback notes.
+- **L4**: A deployment-safety subagent that reviews workflow YAML, provider configuration, release notes, and evidence before promotion.
+
+## Anti-Patterns
+
+- Treating "personal project" as permission to deploy from a laptop without repeatable checks.
+- Enabling auto-deploy before the first manual production release proves the runbook.
+- Using `main` as both development and production.
+- Creating a `test` branch when provider preview environments or `main` integration are enough.
+- Committing platform secrets, API keys, provisioning profiles, or App Store credentials.
+- Letting CI pass on a different commit than the one promoted to `prod`.