openxiangda 1.0.138 → 1.0.140

package/openxiangda-skills/SKILL.md

@@ -40,7 +40,7 @@ OpenXiangda supports two workspace modes. Classic `sy-lowcode-app-workspace` pub
 ### Hard rules — always
 
 - ✅ Publish classic workspaces through `openxiangda workspace publish --profile <name>`; publish React SPA forms first with `openxiangda workspace publish --form <formCode>`, then resources/runtime through `openxiangda resource validate` → `openxiangda resource publish --dry-run` → `openxiangda resource publish` → `openxiangda runtime deploy`.
-- ✅ High-risk changes must be attached to SDD records before implementation/publish. Run `openxiangda sdd context --json`; for forms/pages/resources/functions/automations/workflows/JS_CODE/runtime/config changes create or continue `openxiangda sdd propose <change>`, wait for user confirmation, run `openxiangda sdd approve <change>`, then verify with `openxiangda sdd verify <change> --changed`.
+- ✅ High-risk changes must be attached to OpenXiangda SDD v2 records before implementation/publish. Run `openxiangda sdd context --json`; for forms/pages/resources/functions/automations/workflows/JS_CODE/runtime/config changes create or continue `openxiangda sdd propose <change>`, wait for user confirmation, run `openxiangda sdd approve <change>`, then complete `coverage.json`, `release.json`, `evidence.md`, and `tasks.md` before `openxiangda sdd verify <change> --changed`.
 - ✅ Before publishing AI-authored changes, run `openxiangda workspace plan --changed --json` and `openxiangda workspace check --changed`. Fix reported fake IDs, fallback data, direct `/openxiangda-api` page calls, missing schema, or resource/runtime omissions before publish.
 - ✅ When unsure about runtime response shape, run `openxiangda contract explain <contract-name> --json`. `sdk.form.create` returns identifiers and generated serial number values only; fetch detail explicitly for full row data, formula results, or other server-generated fields.
 - ✅ Architecture-class requests are plan-gated by default. For 新应用、复杂页面、登录注册、公开访问、权限数据范围、流程自动化、连接器/通知、外部集成, first run `openxiangda doctor --json` when a workspace exists and `openxiangda design gates --topic <code> --json`; then ask the user to confirm the design. Before confirmation, only read files, inspect/snapshot, dry-run, ask questions, and write/output design docs. Do not edit source files, write platform resources, send notifications, publish, or deploy.

package/openxiangda-skills/references/permission-design-patterns.md

@@ -162,9 +162,11 @@ Default semantics:
 - Authorization source rows should include an explicit status/enabled field and
   grant sources should use `filterJson` or `enabledField` so drafts, disabled
   rows, or rejected assignments are not materialized.
-- Source forms must have a sync path. `sync: true` on the manifest runs during
-  publish; runtime changes need an automation/App Function or platform API call
-  that resyncs the affected grant source after create/update/delete.
+- Source authorization forms are synced by the platform after form
+  create/update/delete/import when the grant source uses the default
+  `syncMode: "on_write"`. Use `syncMode: "manual"` only for externally
+  maintained sources or unusual bulk jobs; `sync: true` still performs an
+  immediate full sync during resource publish.
 - Policy target fields should normally be hidden scalar keys. If targeting a
   JSONB option/person/department field directly, declare `valuePath: "value"` or
   `componentType`; multi-value fields should be normalized into a scalar key or

package/openxiangda-skills/references/permissions-settings.md

@@ -260,6 +260,7 @@ Declare scope resources:
       { "field": "status", "op": "eq", "value": "enabled" }
     ]
   },
+  "syncMode": "on_write",
   "sync": true
 }
 ```
@@ -354,10 +355,11 @@ Default runtime semantics:
 - `filterJson` filters authorization source rows before materializing grants.
   Use it for enabled/approved/effective authorization rows; unsupported filter
   operations do not match.
-- Source authorization forms must be synced after changes. For formal apps,
-  create an automation/App Function that runs `openxiangda scope sync` or the
-  equivalent platform API after authorization rows are created, updated, or
-  deleted. Publishing with `"sync": true` only syncs during resource publish.
+- Source authorization forms are synced by the platform after create/update/
+  delete/import when the grant source uses the default `syncMode: "on_write"`.
+  Use `syncMode: "manual"` only for externally maintained sources or unusual
+  bulk jobs that explicitly call `openxiangda scope sync`. Publishing with
+  `"sync": true` still performs an immediate full sync during resource publish.
 - App Function `ctx.form.queryOne/queryMany/getById` enforces the caller's view
   permission when there is a real current user. No matching view permission
   group means deny; backend system automations can still use trusted internal

package/openxiangda-skills/references/resource-manifest-cheatsheet.md

@@ -334,6 +334,7 @@ Grant source:
       { "field": "status", "op": "eq", "value": "enabled" }
     ]
   },
+  "syncMode": "on_write",
   "sync": true
 }
 ```
@@ -373,9 +374,12 @@ Data View permission groups use the same `dataPermission` object inside
 default; large grant sets use DB `EXISTS` instead of huge `IN` SQL. Prefer
 hidden scalar target fields such as `collegeCode`; if the target is a JSONB
 option/person/department field, set `valuePath: "value"` or `componentType`.
-Runtime changes to the authorization source form need an automation/App
-Function or explicit platform API call to resync the grant source; manifest
-`sync: true` only runs during resource publish.
+Authorization source form changes are synced by the platform after
+create/update/delete/import when the grant source uses the default
+`syncMode: "on_write"`. Use `syncMode: "manual"` only for externally maintained
+sources or special bulk jobs that explicitly call `openxiangda scope sync`.
+Manifest `sync: true` still performs an immediate full sync during resource
+publish.
 
 ## 3. Connector — `src/resources/connectors/<code>.json`
 

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -19,10 +19,10 @@ description: Core OpenXiangda CLI workflow — normal-user token login, platform
 openxiangda env --profile <name>
 openxiangda auth status --profile <name>
 openxiangda update check --json   # if updateAvailable: openxiangda update install
-openxiangda sdd context --json    # high-risk changes need an approved SDD change
+openxiangda sdd context --json    # high-risk changes need an approved SDD v2 change
 
 # 2. preview the change set (NEVER skip --dry-run on routine edits)
-openxiangda sdd verify <change> --changed
+openxiangda sdd verify <change> --changed # checks tasks, delta specs, coverage.json, release.json, evidence.md
 openxiangda workspace publish --profile <name> --changed --dry-run
 
 # 3. publish only what changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.138",
+  "version": "1.0.140",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {

package/templates/openxiangda-react-spa/.cursor/rules/openxiangda.mdc

@@ -21,7 +21,7 @@ This is an OpenXiangda React SPA workspace. See [AGENTS.md](mdc:AGENTS.md) for f
 
 - Writes and deploys must pass `--profile <name>` explicitly.
 - Architecture-class work is plan-gated: run `openxiangda design gates --topic <code> --json` and wait for confirmation.
-- High-risk changes must start with `openxiangda sdd context --json`, use an approved change, and run `openxiangda sdd verify <change> --changed` before release.
+- High-risk changes must start with `openxiangda sdd context --json`, use an approved change, complete `coverage.json`, `release.json`, `evidence.md`, and `tasks.md`, then run `openxiangda sdd verify <change> --changed` before release.
 - Account/role/permission/RBAC/organization-account/query-param authorization work must run `openxiangda design gates --topic permissions --json`, choose `managed-platform-account`, `existing-platform-user-assignment`, `static-role-permission`, or `query-param-context`, and write the permission matrix.
 - Roles that create roles, assign members, grant API permissions, maintain permission groups, or manage organization accounts must declare `apiPermissionCodes`, such as `app:role:manage`, `app:page-permission-group:manage`, `app:form-permission-group:manage`, and `app:organization:manage`.
 - `src/resources/**` is the resource source of truth; use `validate -> plan -> publish`.

package/templates/openxiangda-react-spa/.qoder/rules/openxiangda.md

@@ -21,7 +21,7 @@ This is an OpenXiangda React SPA workspace. Read [AGENTS.md](AGENTS.md) for full
 
 - 发布和写平台资源必须显式传 `--profile <name>`。
 - 架构类需求先跑 `openxiangda design gates --topic <code> --json` 并等用户确认。
-- 高风险变更先跑 `openxiangda sdd context --json`，创建/继续 change，并在用户确认后 `openxiangda sdd approve <change>`；发布前 `openxiangda sdd verify <change> --changed`。
+- 高风险变更先跑 `openxiangda sdd context --json`，创建/继续 change，并在用户确认后 `openxiangda sdd approve <change>`；发布前必须补齐 `coverage.json` / `release.json` / `evidence.md`、完成 `tasks.md`，再运行 `openxiangda sdd verify <change> --changed`。
 - 账号/角色/权限/RBAC/组织账号/查询参数授权需求先跑 `openxiangda design gates --topic permissions --json`，选择 `managed-platform-account` / `existing-platform-user-assignment` / `static-role-permission` / `query-param-context` 并输出权限矩阵。
 - 角色能新增角色、分配成员、授接口权限、维护权限组或管理组织账号时，角色资源必须声明 `apiPermissionCodes`，例如 `app:role:manage`、`app:page-permission-group:manage`、`app:form-permission-group:manage`、`app:organization:manage`。
 - `src/resources/**` 是工程化资源来源，正式多资源变更走 `validate -> plan -> publish`。

package/templates/openxiangda-react-spa/AGENTS.md

@@ -5,7 +5,7 @@
 ## 开发原则
 
 - 架构类需求默认只规划、不实现。新应用、复杂页面、登录注册、公开访问、权限数据范围、流程自动化、连接器/通知等需求，先运行 `openxiangda doctor --json` 和 `openxiangda design gates --topic <code> --json`，输出设计并等用户确认；确认前只允许读取、快照、dry-run、提问和写设计文档，不允许改源码、写平台、发布或发送通知。
-- 高风险变更必须挂到 SDD change。修改 `src/forms/**`、`src/pages/**`、`src/resources/**`、`src/functions/**`、`src/automations/**`、`src/workflows/**`、`src/js-code-nodes/**`、`src/runtime/**` 或 `app-workspace.config.ts` 前，先运行 `openxiangda sdd context --json`，没有合适 change 就 `openxiangda sdd propose <change>`，等用户确认后运行 `openxiangda sdd approve <change>` 再实现。发布前运行 `openxiangda sdd verify <change> --changed`、`openxiangda workspace check --changed`、`openxiangda resource plan --profile <name>`。
+- 高风险变更必须挂到 SDD change。修改 `src/forms/**`、`src/pages/**`、`src/resources/**`、`src/functions/**`、`src/automations/**`、`src/workflows/**`、`src/js-code-nodes/**`、`src/runtime/**` 或 `app-workspace.config.ts` 前，先运行 `openxiangda sdd context --json`，没有合适 change 就 `openxiangda sdd propose <change>`，等用户确认后运行 `openxiangda sdd approve <change>` 再实现。`approve` 只代表允许进入实现；发布前必须补齐 `coverage.json` / `release.json` / `evidence.md`，完成 `tasks.md`，运行 `openxiangda sdd verify <change> --changed`、`openxiangda workspace check --changed`、`openxiangda resource plan --profile <name>`。
 - 账号、角色、权限、数据范围、组织账号、RBAC、查询参数授权需求必须先运行 `openxiangda design gates --topic permissions --json`，选择 `managed-platform-account` / `existing-platform-user-assignment` / `static-role-permission` / `query-param-context`，输出权限矩阵后再实现。
 - 应用角色如果要创建角色、分配角色成员、给角色授接口权限、维护页面/表单权限组或管理组织账号，必须在角色资源声明 `apiPermissionCodes`，例如 `app:role:manage`、`app:page-permission-group:manage`、`app:form-permission-group:manage`、`app:organization:manage`。
 - 默认用户界面保持克制：左侧应用导航、顶部账号信息、首页内容区域。

package/templates/openxiangda-react-spa/app-workspace.config.ts

@@ -42,6 +42,7 @@ export default defineAppWorkspaceConfig({
       strictHighRisk:
         process.env.OPENXIANGDA_SDD_STRICT_HIGH_RISK === "false" ? false : true,
       path: process.env.OPENXIANGDA_SDD_PATH || "openspec",
+      schemaVersion: "openxiangda-sdd-v2",
     },
   },
 });

package/templates/sy-lowcode-app-workspace/.cursor/rules/openxiangda.mdc

@@ -25,7 +25,7 @@ This is a `sy-lowcode-app-workspace` managed by the `openxiangda` CLI. See [AGEN
 ## Always
 
 - For routine edits, default to incremental publish: `workspace publish --profile <name> --changed --dry-run` then `--changed` or targeted `--page <code>` / `--form <code>`.
-- High-risk changes must use SDD first: `openxiangda sdd context --json` -> `openxiangda sdd propose <change>` -> user confirmation -> `openxiangda sdd approve <change>`; before release run `openxiangda sdd verify <change> --changed`.
+- High-risk changes must use SDD first: `openxiangda sdd context --json` -> `openxiangda sdd propose <change>` -> user confirmation -> `openxiangda sdd approve <change>`; before release complete `coverage.json`, `release.json`, `evidence.md`, and `tasks.md`, then run `openxiangda sdd verify <change> --changed`.
 - Account/role/permission/RBAC/organization-account/query-param authorization work must choose a mode first: `managed-platform-account`, `existing-platform-user-assignment`, `static-role-permission`, or `query-param-context`, then write the permission matrix.
 - Roles that create roles, assign members, grant API permissions, maintain permission groups, or manage organization accounts must declare `apiPermissionCodes` in `src/resources/roles/<code>.json`, such as `app:role:manage`, `app:page-permission-group:manage`, `app:form-permission-group:manage`, and `app:organization:manage`.
 - Confirm current profile before any write: `openxiangda env --profile <name>`.

package/templates/sy-lowcode-app-workspace/.qoder/rules/openxiangda.md

@@ -25,7 +25,7 @@ This is a `sy-lowcode-app-workspace` managed by the `openxiangda` CLI. Read [AGE
 ## Always
 
 - 单文件改动默认增量发布：先 `workspace publish --profile <name> --changed --dry-run`，再 `--changed` 或 `--page <code>` / `--form <code>`。
-- 高风险变更先走 SDD：`openxiangda sdd context --json` → `openxiangda sdd propose <change>` → 用户确认 → `openxiangda sdd approve <change>`；发布前 `openxiangda sdd verify <change> --changed`。
+- 高风险变更先走 SDD：`openxiangda sdd context --json` → `openxiangda sdd propose <change>` → 用户确认 → `openxiangda sdd approve <change>`；发布前必须补齐 `coverage.json` / `release.json` / `evidence.md`、完成 `tasks.md`，再运行 `openxiangda sdd verify <change> --changed`。
 - 账号/角色/权限/RBAC/组织账号/查询参数授权需求先选权限模式：`managed-platform-account` / `existing-platform-user-assignment` / `static-role-permission` / `query-param-context`，并输出权限矩阵。
 - 角色能新增角色、分配成员、授接口权限、维护权限组或管理组织账号时，`src/resources/roles/<code>.json` 必须声明 `apiPermissionCodes`，例如 `app:role:manage`、`app:page-permission-group:manage`、`app:form-permission-group:manage`、`app:organization:manage`。
 - 任何写操作前确认当前 profile：`openxiangda env --profile <name>`。

package/templates/sy-lowcode-app-workspace/AGENTS.md

@@ -9,7 +9,7 @@
 
 **架构类需求默认只规划、不实现。** 新应用、复杂页面、登录注册、公开访问、权限数据范围、流程自动化、连接器/通知等需求，先 `openxiangda doctor --json` + `openxiangda design gates --topic <code> --json`，输出设计并等待用户确认；确认前只允许读取、快照、dry-run、提问和写设计文档，不允许改源码、写平台、发布、部署或发送通知。
 
-**高风险变更必须挂到 SDD change。** 修改 `src/forms/**`、`src/pages/**`、`src/resources/**`、`src/functions/**`、`src/automations/**`、`src/workflows/**`、`src/js-code-nodes/**`、`src/runtime/**` 或 `app-workspace.config.ts` 前，先运行 `openxiangda sdd context --json`，没有合适 change 就 `openxiangda sdd propose <change>`，等用户确认后运行 `openxiangda sdd approve <change>` 再实现。发布前运行 `openxiangda sdd verify <change> --changed` 和 `openxiangda workspace check --changed`。
+**高风险变更必须挂到 SDD change。** 修改 `src/forms/**`、`src/pages/**`、`src/resources/**`、`src/functions/**`、`src/automations/**`、`src/workflows/**`、`src/js-code-nodes/**`、`src/runtime/**` 或 `app-workspace.config.ts` 前，先运行 `openxiangda sdd context --json`，没有合适 change 就 `openxiangda sdd propose <change>`，等用户确认后运行 `openxiangda sdd approve <change>` 再实现。`approve` 只代表允许进入实现；发布前必须补齐 `coverage.json` / `release.json` / `evidence.md`，完成 `tasks.md`，运行 `openxiangda sdd verify <change> --changed` 和 `openxiangda workspace check --changed`。
 
 工作区内的 npm scripts（`publish:all` / `publish:oss` / `register`）已加 `_guard:publish` 守卫；缺少 `OPENXIANGDA_PROFILE` 环境变量时会立即 fail，提示重新走 CLI 入口。
 
@@ -36,7 +36,7 @@
 
 - ✅ 先 preflight：`openxiangda env --profile <name>` + `openxiangda auth status --profile <name>` + `openxiangda update check --json`。
 - ✅ 架构类需求先 plan gate：`openxiangda doctor --profile <name> --json` + `openxiangda design gates --topic <code> --json`，用户确认后再实现。
-- ✅ 高风险变更先 SDD gate：`openxiangda sdd context --json` → `openxiangda sdd propose <change>` → 用户确认 → `openxiangda sdd approve <change>`。
+- ✅ 高风险变更先 SDD gate：`openxiangda sdd context --json` → `openxiangda sdd propose <change>` → 用户确认 → `openxiangda sdd approve <change>` → 补齐 `coverage.json` / `release.json` / `evidence.md` → `openxiangda sdd verify <change> --changed`。
 - ✅ 涉及账号、角色、权限、数据范围、组织账号、RBAC、查询参数授权时，先跑 `openxiangda design gates --topic permissions --json`，选择 `managed-platform-account` / `existing-platform-user-assignment` / `static-role-permission` / `query-param-context`，并输出权限矩阵后再改资源。
 - ✅ 某个应用角色如果要创建角色、分配角色成员、给角色授接口权限、维护页面/表单权限组或管理组织账号，必须在 `src/resources/roles/<code>.json` 声明 `apiPermissionCodes`，例如 `app:role:manage`、`app:page-permission-group:manage`、`app:form-permission-group:manage`、`app:organization:manage`。
 - ✅ 单文件改动默认增量发布：`workspace publish --profile <name> --changed --dry-run` → `--changed` / `--page` / `--form`。
@@ -83,7 +83,7 @@ sy-lowcode-app-workspace/
 ├── AGENTS.md                        # 本文件
 ├── .qoder/rules/openxiangda.md      # Qoder always-on 项目规则
 ├── .cursor/rules/openxiangda.mdc    # Cursor always-on 项目规则
-├── openspec/                        # SDD specs / changes / archive
+├── openspec/                        # SDD v2 specs / changes / coverage / release / archive
 ├── .openxiangda/state.json          # profile → appType → 资源 ID 的权威映射（CLI 维护）
 ├── app-workspace.config.ts
 ├── package.json                     # publish:all/publish:oss/register 都被 _guard:publish 守卫

package/templates/sy-lowcode-app-workspace/app-workspace.config.ts

@@ -43,6 +43,7 @@ export default defineAppWorkspaceConfig({
       strictHighRisk:
         process.env.OPENXIANGDA_SDD_STRICT_HIGH_RISK === "false" ? false : true,
       path: process.env.OPENXIANGDA_SDD_PATH || "openspec",
+      schemaVersion: "openxiangda-sdd-v2",
     },
   },
 });

package/templates/sy-lowcode-app-workspace/src/types/app-workspace.types.ts

@@ -39,6 +39,7 @@ export interface AppWorkspaceConfig {
       enabled?: boolean;
       strictHighRisk?: boolean;
       path?: string;
+      schemaVersion?: "openxiangda-sdd-v2" | string;
     };
   };
 }