openxiangda 1.0.172 → 1.0.173

package/lib/runtime-lineage.js

@@ -2,6 +2,7 @@ const path = require('path');
 const { spawnSync } = require('child_process');
 
 const { readGitSourceBase } = require('./change-baseline');
+const { identitiesIntersect } = require('./git-remote-identity');
 
 const MIN_ROLLBACK_REASON_LENGTH = 8;
 const PURE_RUNTIME_OUTPUT_PREFIXES = Object.freeze([
@@ -58,7 +59,13 @@ function prepareRuntimeDeployLineage(options = {}) {
 
   const legacyBootstrap = Boolean(parentReleaseId && !parentSourceRevision);
   if (parentSourceRevision) {
-    const sameRepository = parentSourceRevision.repo === sourceRevision.repo;
+    const sameRepository = identitiesIntersect(
+      [
+        parentSourceRevision.repo,
+        ...(parentSourceRevision.repoAliases || []),
+      ],
+      [sourceRevision.repo, ...(sourceRevision.repoAliases || [])]
+    );
     const descendsFromActive =
       sameRepository &&
       isGitAncestor(cwd, parentSourceRevision.baseCommit, sourceRevision.baseCommit);
@@ -73,7 +80,13 @@ function prepareRuntimeDeployLineage(options = {}) {
       );
     }
     return stripUndefinedValues({
-      sourceRevision,
+      sourceRevision: sameRepository
+        ? {
+            ...sourceRevision,
+            repo: parentSourceRevision.repo,
+            repositoryId: parentSourceRevision.repo,
+          }
+        : sourceRevision,
       parentReleaseId,
       parentSourceRevision,
       lineageBypassReason: rollback.enabled ? rollback.reason : undefined,
@@ -246,7 +259,14 @@ function normalizeRuntimeSourceRevision(value, options = {}) {
       '线上 Runtime source revision 缺少有效的 repo/baseCommit/treeHash'
     );
   }
-  return { repo, baseCommit, treeHash };
+  const repoAliases = Array.from(
+    new Set(
+      [repo, ...(Array.isArray(input.repoAliases) ? input.repoAliases : [])]
+        .map(item => String(item || '').trim().toLowerCase())
+        .filter(item => /^sha256:[0-9a-f]{64}$/.test(item))
+    )
+  );
+  return { repo, repoAliases, baseCommit, treeHash };
 }
 
 function normalizeAppSnapshot(value) {

package/lib/sdd.js

@@ -3,6 +3,11 @@ const path = require('path');
 const os = require('os');
 const { readGitSourceBase } = require('./change-baseline');
 const { assertReleaseSourceIntegrated } = require('./release-mainline');
+const {
+  buildWorkspaceReleaseCommands,
+  normalizeReleaseTargets,
+  releasePlanHash,
+} = require('./release-plan');
 
 const DEFAULT_SDD_DIR = 'openspec';
 const SDD_CONFIG_FILE = 'config.yaml';
@@ -868,6 +873,19 @@ function createMainlineSddBundle(options = {}) {
   if (affected.functions.length > 0 || affected.automations.length > 0) {
     affected.backend = true;
   }
+  const runtimeMode = /runtimeMode\s*:\s*['"]react-spa['"]/.test(
+    options.configText || ''
+  )
+    ? 'react-spa'
+    : 'legacy';
+  const normalizedTargets = normalizeReleaseTargets(affected, runtimeMode);
+  const profile = String(options.profile || '<profile>').trim() || '<profile>';
+  const commands = buildWorkspaceReleaseCommands(
+    normalizedTargets.logicalTargets,
+    runtimeMode,
+    profile,
+    changeId
+  );
   const createdAt = nowIso();
   const meta = {
     ...createChangeMetadata(changeId, {
@@ -913,19 +931,18 @@ function createMainlineSddBundle(options = {}) {
     changeId,
     mainlinePolicy: 'publish-from-main-v1',
     bundledChanges: sourceIds,
-    targets: {
-      forms: affected.forms,
-      pages: affected.pages,
-      functions: affected.functions,
-      automations: affected.automations,
-      workflows: affected.workflows,
-      jsCodeNodes: affected.jsCodeNodes,
-      resources: affected.resources,
-      runtime: affected.runtime,
-      other: [],
-    },
+    targets: normalizedTargets.activationTargets,
+    logicalTargets: normalizedTargets.logicalTargets,
     changedFiles: affected.files,
-    commands: [],
+    commands,
+    entryCommand:
+      `openxiangda release publish --change ${changeId} --profile ${profile}`,
+    planHash: releasePlanHash({
+      changeId,
+      runtimeMode,
+      targets: normalizedTargets.activationTargets,
+      commands,
+    }),
     verifiedAt: null,
   };
   const changeDir = path.join(governance.rootDir, 'changes', changeId);
@@ -1847,14 +1864,24 @@ function buildUpdatedReleaseManifest(loaded, releasePlan, verificationStage = 'd
   const canonicalCommands = Array.isArray(releasePlan?.commands)
     ? releasePlan.commands.filter(command => String(command || '').trim())
     : [];
+  const actualExecution = releasePlan?.actualCommands === true;
   return {
     schemaVersion: SDD_SCHEMA_VERSION,
     changeId: loaded.changeId,
     ...(loaded.release && !loaded.release.__invalid ? loaded.release : {}),
-    targets: releasePlan?.targets || loaded.release?.targets || {},
-    changedFiles: releasePlan?.changedFiles || loaded.release?.changedFiles || [],
+    targets:
+      actualExecution
+        ? loaded.release?.targets || {}
+        : releasePlan?.activationTargets ||
+          releasePlan?.targets ||
+          loaded.release?.targets ||
+          {},
+    changedFiles:
+      actualExecution
+        ? loaded.release?.changedFiles || []
+        : releasePlan?.changedFiles || loaded.release?.changedFiles || [],
     commands:
-      canonicalCommands.length > 0
+      !actualExecution && canonicalCommands.length > 0
         ? canonicalCommands
         : reviewedCommands,
     verifiedAt,
@@ -1872,6 +1899,37 @@ function updateReleaseManifest(loaded, releasePlan, verificationStage = 'default
   return release;
 }
 
+function writeReleaseAttestation(cwd, changeId, name, value) {
+  const root = path.resolve(cwd || process.cwd());
+  const dir = path.join(
+    root,
+    '.openxiangda',
+    'releases',
+    normalizeChangeId(changeId)
+  );
+  ensureDir(dir);
+  const file = path.join(dir, name);
+  const tempFile = `${file}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(tempFile, `${JSON.stringify(value, null, 2)}\n`, {
+    mode: 0o600,
+  });
+  fs.renameSync(tempFile, file);
+  return path.relative(root, file).replace(/\\/g, '/');
+}
+
+function readReleaseAttestation(cwd, changeId, name) {
+  const file = path.join(
+    path.resolve(cwd || process.cwd()),
+    '.openxiangda',
+    'releases',
+    normalizeChangeId(changeId),
+    name
+  );
+  if (!fs.existsSync(file)) return null;
+  const value = readJsonFile(file, null);
+  return value && !value.__invalid ? value : null;
+}
+
 function recordSddReleaseSourceRevision(options = {}) {
   const loaded = loadSddChange(options);
   const input = options.releaseSourceRevision;
@@ -1885,6 +1943,16 @@ function recordSddReleaseSourceRevision(options = {}) {
     branch: String(input.branch || '').trim() || null,
     remoteName: String(input.remoteName || '').trim() || null,
     remoteUrlHash: String(input.remoteUrlHash || '').trim().toLowerCase() || null,
+    remoteUrlHashAliases: Array.isArray(input.remoteUrlHashAliases)
+      ? input.remoteUrlHashAliases
+          .map(value => String(value || '').trim().toLowerCase())
+          .filter(value => /^sha256:[0-9a-f]{64}$/.test(value))
+      : [],
+    repoAliases: Array.isArray(input.repoAliases)
+      ? input.repoAliases
+          .map(value => String(value || '').trim().toLowerCase())
+          .filter(value => /^sha256:[0-9a-f]{64}$/.test(value))
+      : [],
     mainBranch: String(input.mainBranch || '').trim() || null,
     mainTipCommit: String(input.mainTipCommit || '').trim().toLowerCase() || null,
     capturedAt: input.capturedAt || nowIso(),
@@ -1901,7 +1969,13 @@ function recordSddReleaseSourceRevision(options = {}) {
       'releaseSourceRevision 缺少有效的 repo/baseCommit/treeHash/remoteName/remoteUrlHash/mainBranch'
     );
   }
-  const existing = loaded.release?.releaseSourceRevision;
+  const existing =
+    readReleaseAttestation(
+      options.cwd || process.cwd(),
+      loaded.changeId,
+      'source-revision.json'
+    )?.releaseSourceRevision ||
+    loaded.release?.releaseSourceRevision;
   if (
     existing?.baseCommit &&
     (existing.baseCommit !== releaseSourceRevision.baseCommit ||
@@ -1917,20 +1991,29 @@ function recordSddReleaseSourceRevision(options = {}) {
     error.code = 'RELEASE_PUBLISH_REVISION_CHANGED';
     throw error;
   }
-  const release = {
+  writeReleaseAttestation(
+    options.cwd || process.cwd(),
+    loaded.changeId,
+    'source-revision.json',
+    {
+      schemaVersion: SDD_SCHEMA_VERSION,
+      changeId: loaded.changeId,
+      mainlinePolicy: 'publish-from-main-v1',
+      releaseSourceRevision,
+    }
+  );
+  return {
     ...(loaded.release && !loaded.release.__invalid ? loaded.release : {}),
-    schemaVersion: SDD_SCHEMA_VERSION,
-    changeId: loaded.changeId,
-    mainlinePolicy: 'publish-from-main-v1',
     releaseSourceRevision,
   };
-  if (JSON.stringify(release) !== JSON.stringify(loaded.release)) {
-    writeJsonFile(loaded.releaseFile, release);
-  }
-  return release;
 }
 
-function validateReleaseManifest(release, releasePlan, legacyMode = false) {
+function validateReleaseManifest(
+  release,
+  releasePlan,
+  legacyMode = false,
+  options = {}
+) {
   const errors = [];
   const warnings = [];
   if (!release || release.__invalid) {
@@ -1942,9 +2025,14 @@ function validateReleaseManifest(release, releasePlan, legacyMode = false) {
     else errors.push(issue);
     return { errors, warnings };
   }
-  const targets = releasePlan?.targets || release.targets || {};
-  if (releasePlan?.targets) {
-    const releaseTargetCoverage = affectedCoversTargets(release.targets || {}, releasePlan.targets);
+  const plannedTargets =
+    releasePlan?.activationTargets || releasePlan?.targets || null;
+  const targets = plannedTargets || release.targets || {};
+  if (plannedTargets) {
+    const releaseTargetCoverage = affectedCoversTargets(
+      release.targets || {},
+      plannedTargets
+    );
     if (!releaseTargetCoverage.covered) {
       errors.push({
         name: 'sdd-release-targets-uncovered',
@@ -1955,10 +2043,18 @@ function validateReleaseManifest(release, releasePlan, legacyMode = false) {
   if (hasHighRiskTargets(targets) && !Array.isArray(release.commands)) {
     errors.push({ name: 'sdd-release-commands-missing', message: 'release.json commands 必须是数组' });
   }
-  if (releasePlan?.commands?.length && (!Array.isArray(release.commands) || release.commands.length === 0)) {
+  if (
+    !options.actualExecution &&
+    releasePlan?.commands?.length &&
+    (!Array.isArray(release.commands) || release.commands.length === 0)
+  ) {
     errors.push({ name: 'sdd-release-commands-empty', message: 'release.json 未记录发布命令' });
   }
-  if (!legacyMode && Array.isArray(release.commands)) {
+  if (
+    !legacyMode &&
+    Array.isArray(release.commands) &&
+    release.commands.length > 0
+  ) {
     errors.push(
       ...validateAtomicReleaseCommands(
         release.commands,
@@ -2288,12 +2384,25 @@ function verifySddChange(options = {}) {
     if (strictDocumentation) errors.push(issue);
     else warnings.push(issue);
   }
+  const actualExecution = options.releasePlan?.actualCommands === true;
   const release =
-    options.releasePlan && loaded.release && !loaded.release.__invalid
-      ? buildUpdatedReleaseManifest(loaded, options.releasePlan, verificationStage)
+    options.releasePlan &&
+    loaded.release &&
+    !loaded.release.__invalid &&
+    !actualExecution
+      ? buildUpdatedReleaseManifest(
+          loaded,
+          options.releasePlan,
+          verificationStage
+        )
       : loaded.release;
   if (stagePolicy.requireRelease) {
-    const releaseValidation = validateReleaseManifest(release, options.releasePlan, legacyMode);
+    const releaseValidation = validateReleaseManifest(
+      release,
+      options.releasePlan,
+      legacyMode,
+      { actualExecution }
+    );
     errors.push(...releaseValidation.errors);
     warnings.push(...releaseValidation.warnings);
     const reviewedPlannedCommands = loaded.meta?.release?.plannedCommands;
@@ -2347,11 +2456,28 @@ function verifySddChange(options = {}) {
     updatedAt: verifiedAt,
   };
   let metadataWritten = false;
+  let attestationFile = null;
   if (options.writeMetadata && passed) {
-    if (options.releasePlan && loaded.release && !loaded.release.__invalid) {
-      updateReleaseManifest(loaded, options.releasePlan, verificationStage);
-    }
-    writeJsonFile(loaded.metaFile, verifiedMeta);
+    attestationFile = writeReleaseAttestation(
+      options.cwd || process.cwd(),
+      loaded.changeId,
+      `verification-${verificationStage}.json`,
+      {
+        schemaVersion: SDD_SCHEMA_VERSION,
+        changeId: loaded.changeId,
+        stage: verificationStage,
+        passed,
+        verifiedAt,
+        planHash: releasePlanHash({
+          targets,
+          commands: release?.commands || [],
+          changedFiles:
+            options.releasePlan?.changedFiles ||
+            loaded.release?.changedFiles ||
+            [],
+        }),
+      }
+    );
     metadataWritten = true;
   }
   return {
@@ -2365,6 +2491,8 @@ function verifySddChange(options = {}) {
     blockingErrors: errors,
     passed,
     metadataWritten,
+    trackedMetadataWritten: false,
+    attestationFile,
     targets,
     highRiskFiles,
     stage: verificationStage,
@@ -2559,6 +2687,15 @@ function syncSddChange(options = {}) {
 
 function archiveSddChange(options = {}) {
   const releaseLoaded = loadSddChange(options);
+  const sourceRevisionAttestation = readReleaseAttestation(
+    options.cwd || process.cwd(),
+    releaseLoaded.changeId,
+    'source-revision.json'
+  );
+  const releaseSourceRevision =
+    sourceRevisionAttestation?.releaseSourceRevision ||
+    releaseLoaded.release?.releaseSourceRevision ||
+    null;
   const coverageTargets = normalizeCoverageResources(releaseLoaded.coverage, {});
   const releaseTargets = mergeAffectedScopes(
     options.targets,
@@ -2595,20 +2732,20 @@ function archiveSddChange(options = {}) {
     classifyHighRiskFiles(releaseTargets.files).length > 0 ||
     metadataDeclaresHighRisk ||
     Boolean(releaseLoaded.release?.mainlinePolicy) ||
-    Boolean(releaseLoaded.release?.releaseSourceRevision);
+    Boolean(releaseSourceRevision);
   if (requiresMainlineClosure) {
     if (
       !releaseLoaded.release ||
       releaseLoaded.release.__invalid ||
-      !releaseLoaded.release.releaseSourceRevision
+      !releaseSourceRevision
     ) {
       const error = new Error(
-        'SDD_RELEASE_SOURCE_LINEAGE_REQUIRED: 高风险 change 归档必须保留 release.json 的冻结发布提交；--force 不能绕过主分支回合证据'
+        'SDD_RELEASE_SOURCE_LINEAGE_REQUIRED: 高风险 change 归档必须保留冻结发布提交的本地 attestation；--force 不能绕过主分支回合证据'
       );
       error.code = 'SDD_RELEASE_SOURCE_LINEAGE_REQUIRED';
       throw error;
     }
-    assertReleaseSourceIntegrated(releaseLoaded.release.releaseSourceRevision, {
+    assertReleaseSourceIntegrated(releaseSourceRevision, {
       cwd: options.cwd || process.cwd(),
     });
   }

package/openxiangda-skills/SKILL.md

@@ -82,16 +82,14 @@ React SPA resources/runtime:
 # In the clean main checkout:
 openxiangda sdd bundle <release-change> --changes <change-a,change-b>
 # Commit and push the generated bundle on main, then:
-openxiangda sdd verify <release-change> --changed --stage prepublish --profile <name>
-openxiangda release begin --change <release-change> --profile <name>
-# Execute the canonical exact commands printed by workspace plan/verify.
-openxiangda release integration-status --profile <name>
-openxiangda release end --profile <name>
+openxiangda release publish --change <release-change> --profile <name>
 ```
 
 `resource plan` and publish dry-runs are strictly GET/HEAD-only. `READ_ONLY_AUTH_REQUIRED` means the access token expired; run `openxiangda auth refresh --profile <name>` or log in again before retrying. Never add an automatic refresh POST inside a plan.
 
-`release begin --change` freezes a clean committed `HEAD` only when the current branch is the authoritative default `main`/`master` and its commit exactly equals the live remote tip. Before any live write, the CLI preflights the complete target set and rejects source changes during the release. A feature worktree or unpushed main receives `RELEASE_SOURCE_MAINLINE_REQUIRED` / `RELEASE_SOURCE_MAINLINE_NOT_PUSHED`; merge, test, push, and start the one mainline release instead of forcing it.
+`release publish` is the default promotion entrypoint. It verifies without rewriting reviewed `change.json`/`release.json`, waits for the app lease, freezes the App capture after ownership is acquired, executes deterministic exact staged steps, resumes from `.openxiangda/releases/<change>/execution.json`, atomically finalizes, verifies mainline integration, and releases the lease. `release begin` and child commands remain recovery/diagnostic primitives.
+
+`release begin --change` freezes a clean committed `HEAD` only when the current branch is the authoritative default `main`/`master` and its commit exactly equals the live remote tip. Before any live write, the CLI preflights the complete target set and rejects source changes during the release. A feature worktree or unpushed main receives `RELEASE_SOURCE_MAINLINE_REQUIRED` / `RELEASE_SOURCE_MAINLINE_NOT_PUSHED`; merge, test, push, and start the one mainline release instead of forcing it. Optional `.git` remote suffix differences are aliases of the same repository; genuinely different remotes still fail closed.
 
 Because promotion begins from the already-pushed authoritative mainline, `release integration-status` should pass immediately after activation. Run it, then `release end`; no post-release branch merge is required.
 

package/openxiangda-skills/references/openxiangda-api.md

@@ -442,13 +442,13 @@ Requires app admin permission. Upserts a binding with `templateCode` or `templat
 
 ## Organization
 
-Organization APIs are app-scoped and require `app:organization:manage` on the target app. Platform admins pass through the same permission service. Runtime service principals are not accepted by themselves: trusted runtime calls must carry a real audit actor, and permission is checked against that user.
+Organization APIs are app-scoped. List/detail operations accept `app:organization:read` or `app:organization:manage`; create/update/password operations require `app:organization:manage`. Platform admins pass through the same permission service. Runtime service principals are not accepted by themselves: trusted runtime calls must carry a real audit actor, and permission is checked against that user.
 
 Use these endpoints for OpenXiangda app-managed platform departments and accounts. Do not use legacy `/user` or `/department` write endpoints for new app organization management.
 
 ### GET `/apps/:appType/organization/capabilities`
 
-Requires Bearer token. Returns whether the current actor can manage organization data for the app, the permission code, and supported operations.
+Requires Bearer token. Returns `canRead`, `canManage`, `readPermissionCode`, `managePermissionCode`, the compatibility `permissionCode`, and supported operations.
 
 CLI:
 
@@ -458,11 +458,11 @@ openxiangda organization capabilities --json
 
 ### GET `/apps/:appType/organization/departments`
 
-Requires `app:organization:manage`. Lists platform departments in the current tenant.
+Requires `app:organization:read` or `app:organization:manage`. Lists platform departments in the current tenant.
 
 ### GET `/apps/:appType/organization/departments/:departmentId`
 
-Requires `app:organization:manage`. Returns one platform department.
+Requires `app:organization:read` or `app:organization:manage`. Returns one platform department.
 
 ### POST `/apps/:appType/organization/departments`
 
@@ -492,11 +492,11 @@ Requires `app:organization:manage`. Updates department metadata, visibility/memb
 
 ### GET `/apps/:appType/organization/accounts`
 
-Requires `app:organization:manage`. Lists tenant platform accounts. Supports `ids`, `departmentIds`, `keyword`, `name`, `username`, `phone`, `email`, `jobNumber`, `page`, and `pageSize`.
+Requires `app:organization:read` or `app:organization:manage`. Lists tenant platform accounts. Supports `ids`, `departmentIds`, `keyword`, `name`, `username`, `phone`, `email`, `jobNumber`, `page`, and `pageSize`.
 
 ### GET `/apps/:appType/organization/accounts/:userId`
 
-Requires `app:organization:manage`. Returns one platform account. Password, login failure counters, and lock fields are removed from the response.
+Requires `app:organization:read` or `app:organization:manage`. Returns one platform account. Password, login failure counters, and lock fields are removed from the response.
 
 ### POST `/apps/:appType/organization/accounts`
 

package/openxiangda-skills/references/pages/page-sdk.md

@@ -17,7 +17,7 @@ Guidelines:
 - Use `sdk.connector.invoke`, `sdk.connector.call("connector.api")`, or `sdk.connector.download` for external services. The SDK calls the platform runtime connector endpoint; it must not call third-party domains directly.
 - Use `sdk.notification.sendByType` and `batchSendByType` for reusable business messages. Custom notification types must be declared in `src/resources/notifications/` and published with `openxiangda resource publish`.
 - Use `AttachmentPreviewList`, `ImagePreviewGrid`, or `useFilePreview` from `openxiangda/runtime/react` for in-page attachment previews in a custom React SPA page. They use the current PageSdk context and enforce the platform capability and ticket contracts. Use `sdk.createFileAccessTicket(bucketName, objectName, fileName, "preview", { appType })` only when the page needs a shareable or new-window preview link. `appType` defaults to the current page context. Open `response.result.previewPageUrl`; do not use `previewUrl` or `/service/file/preview-by-ticket/:ticket` as the page entry.
-- Use `sdk.organization.departments.*` and `sdk.organization.accounts.*` only for admin-style app pages that intentionally manage platform departments/accounts. The current user needs `app:organization:manage` on the app. Do not call legacy `/user` or `/department` write endpoints from pages.
+- Use `sdk.organization.departments.*` and `sdk.organization.accounts.*` only for intentional organization pages. Read-only list/detail pages need `app:organization:read` or `app:organization:manage`; writes and password operations need `app:organization:manage`. Do not call legacy `/user` or `/department` endpoints from pages.
 - Use `sdk.workCenter.listItems({ boxType })` and `sdk.workCenter.getStats()` for current-user work center lists and counts. `boxType` is one of `todo`, `done`, `cc`, or `initiated`. This is the end-user task/handled/cc/initiated surface; do not build todo pages by reading workflow operation logs, automation logs, or raw process-task tables.
 - `sdk.form.create` returns identifiers and generated serial number values only. Treat `formInstId` / `formInstanceId` as the required success contract; `serialNumber` / `serialNumbers` are present only when the form has `SerialNumberField`. Do not expect the save response to contain the full row, formula results, or other server-generated field values. Call `sdk.form.getDetail` explicitly after create when those values are needed.
 - Missing `formInstId` / `formInstanceId` is a real error in strict mode. Do not create fake IDs, mock rows, or fallback display data to hide it.

package/openxiangda-skills/references/permissions-settings.md

@@ -33,9 +33,10 @@ in `src/resources/roles/<code>.json`; otherwise the user may have the business
 role but still fail when calling role-setting APIs.
 
 For app-managed platform accounts or departments, use `sdk.organization.*` or
-`ctx.organization.*`. The real current operator must have
-`app:organization:manage`; do not bypass OpenXiangda with legacy user or
-department write APIs.
+`ctx.organization.*`. The real current operator needs `app:organization:read`
+or `app:organization:manage` for list/detail queries and
+`app:organization:manage` for writes/password operations; do not bypass
+OpenXiangda with legacy user or department APIs.
 
 ## Role Codes
 

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -89,14 +89,12 @@ Forms, Backend resources, and frontend Runtime are staged children of one Root A
 ```bash
 openxiangda sdd bundle <release-change> --changes <change-a,change-b>
 # Commit and push the bundle on main/master.
-openxiangda sdd verify <release-change> --changed --stage prepublish --profile <name>
-openxiangda release begin --change <release-change> --profile <name>
-# Run the canonical exact staged commands emitted by the release plan.
-openxiangda release integration-status --profile <name>
-openxiangda release end --profile <name>
+openxiangda release publish --change <release-change> --profile <name>
 ```
 
-`runtime deploy --no-activate` uploads an immutable preview release from a clean committed mainline `HEAD`. Before acquiring a lease, the CLI confirms `package.json#scripts.build` and existing dependencies; it uses `npm run build` to execute the declared script so pnpm worktree symlinks do not trigger a reinstall. The protected upload plan still runs before the actual build because its provider-specific `assetBaseUrl` is compiled into the bundle. `release begin` requires local main/master and the live remote default tip to be identical, so `integration-status` is already satisfied after activation and `release end` does not wait for a later merge.
+`release publish` is the normal whole-app entrypoint: it verifies SDD without mutating reviewed files, waits for the promotion lease, freezes one App capture, stages the exact Form/Backend/Runtime children, resumes from a private execution journal, finalizes once, and releases the lease. Individual release commands are recovery/diagnostic primitives.
+
+`runtime deploy --no-activate` uploads an immutable preview release from a clean committed mainline `HEAD`. It reads a narrow Runtime head instead of the full app snapshot. Before acquiring a lease, the CLI confirms `package.json#scripts.build` and existing dependencies; it uses `npm run build` to execute the declared script so pnpm worktree symlinks do not trigger a reinstall. Immutable Git-base artifact hashes are cached under the Git common directory. `release begin` requires local main/master and the live remote default tip to be identical, so `integration-status` is already satisfied after activation and `release end` does not wait for a later merge.
 
 `resource plan`, `resource publish`, and `runtime deploy` report coarse phases on stderr and emit a heartbeat after 15 seconds without completion. JSON stdout stays machine-readable and includes `timings`; use it to identify whether time is spent in plan, preflight, build, upload, write, or activate instead of rerunning an opaque command.
 

package/openxiangda-skills/skills/openxiangda-permission-settings/SKILL.md

@@ -22,7 +22,7 @@ description: Manage OpenXiangda app **roles** (角色), **page permission groups
 - ✅ For dynamic multi-role apps, build a role maintenance form + automation/JS_CODE sync, not hardcoded role logic in page code.
 - ✅ For permission scope keys, derive hidden scalars (`collegeScopeKey`, `classScopeKey`, `ownerDeptScopeKey`, `ownerUserScopeKey`, `roleCode`) via `valueSync` from visible select/person/department fields.
 - ✅ Use page permission groups for entry visibility, form permission groups for real data isolation with condition-based data permissions.
-- ✅ For app-managed platform accounts/departments, use `sdk.organization.*` / `ctx.organization.*` and require the current operator to have `app:organization:manage`.
+- ✅ For app-managed platform accounts/departments, use `sdk.organization.*` / `ctx.organization.*`. Read-only list/detail operations require `app:organization:read` or `app:organization:manage`; writes and password operations require `app:organization:manage`.
 - ✅ For delegated administrators such as 校区管理员, put role-setting API permissions in the role manifest with `apiPermissionCodes`; use `app:role:manage` for app role creation/member assignment/API-permission assignment, and add page/form/organization management permission codes only when needed.
 - ✅ If a delegated administrator creates another role that can also manage accounts, roles, or permission groups, publish that new role with its own `apiPermissionCodes`.
 - ❌ Expose raw ID text fields to users for permission scopes.
@@ -85,9 +85,10 @@ For dynamic multi-role apps, do not hardcode role behavior only in page code. Cr
 For managed platform account governance, use organization/account forms and sync
 functions as a closed loop: organization units, system accounts, role
 assignments, roles resources, page groups, form groups, sync App Functions, and
-backend role/scope checks. Platform account writes must go through
-`sdk.organization` or `ctx.organization`; the current operator must have
-`app:organization:manage`.
+backend role/scope checks. Platform account access must go through
+`sdk.organization` or `ctx.organization`; give read-only operators
+`app:organization:read` and require `app:organization:manage` for writes and
+password operations.
 
 ## Page Permission Groups
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.172",
+  "version": "1.0.173",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {
@@ -86,6 +86,7 @@
     "test:publish-lease-state": "node scripts/publish-lease-state-smoke.mjs",
     "test:publish-lease-heartbeat": "node scripts/publish-lease-heartbeat-smoke.mjs",
     "test:release-telemetry": "node scripts/release-telemetry-smoke.mjs",
+    "test:release-plan": "node scripts/release-plan-smoke.mjs",
     "test:release-mainline": "node scripts/release-mainline-smoke.mjs",
     "test:publish-lease-cli": "node scripts/publish-lease-cli-smoke.mjs",
     "test:publish-context": "node scripts/publish-context-smoke.mjs",

package/packages/sdk/dist/runtime/react.d.mts

@@ -264,6 +264,9 @@ interface AppFunctionNotificationApi {
 interface OrganizationCapabilities {
     appType: string;
     permissionCode: "app:organization:manage" | string;
+    readPermissionCode: "app:organization:read" | string;
+    managePermissionCode: "app:organization:manage" | string;
+    canRead: boolean;
     canManage: boolean;
     actor?: Record<string, unknown>;
     runtimeServicePrincipalRequiresAuditActor: boolean;

package/packages/sdk/dist/runtime/react.d.ts

@@ -264,6 +264,9 @@ interface AppFunctionNotificationApi {
 interface OrganizationCapabilities {
     appType: string;
     permissionCode: "app:organization:manage" | string;
+    readPermissionCode: "app:organization:read" | string;
+    managePermissionCode: "app:organization:manage" | string;
+    canRead: boolean;
     canManage: boolean;
     actor?: Record<string, unknown>;
     runtimeServicePrincipalRequiresAuditActor: boolean;

package/templates/openxiangda-react-spa/AGENTS.md

@@ -9,7 +9,7 @@
 - 一个开发任务只使用一个显式 change，并从 `openxiangda sdd context --change <change> --changed --json` 开始；结构化 approval、coverage 资源和文件范围是硬约束，任务/证据/规格文案默认只告警，不阻断开发或发布。只有明确配置 `strictDocumentation: true` 才把文案完成度恢复为门禁。
 - 多会话开发使用独立 Git worktree/branch，但 feature worktree 不发布。把已批准提交合并并 push 到权威默认主分支后，用 `sdd bundle <release-change> --changes ...` 聚合范围；只从与远端 tip 完全一致的 clean `main`/`master` 一次发布。
 - 账号、角色、权限、数据范围、组织账号、RBAC、查询参数授权需求必须先运行 `openxiangda design gates --topic permissions --json`，选择 `managed-platform-account` / `existing-platform-user-assignment` / `static-role-permission` / `query-param-context`，输出权限矩阵后再实现。
-- 应用角色如果要创建角色、分配角色成员、给角色授接口权限、维护页面/表单权限组或管理组织账号，必须在角色资源声明 `apiPermissionCodes`，例如 `app:role:manage`、`app:page-permission-group:manage`、`app:form-permission-group:manage`、`app:organization:manage`。
+- 应用角色只读查询组织账号时声明 `app:organization:read`；创建、修改账号/部门或重置密码时声明 `app:organization:manage`。创建角色、分配成员或维护权限组也必须在角色资源的 `apiPermissionCodes` 声明对应的 `app:role:manage`、`app:page-permission-group:manage`、`app:form-permission-group:manage`。
 - 默认用户界面保持克制：左侧应用导航、顶部账号信息、首页内容区域。
 - 不在默认可见页面展示 SDK、Runtime、Cookie、Proxy、Playwright、AI 验证、调试上下文、构建号等开发语言。
 - 使用 React Router 管理路由，路由定义在 `src/app/router.tsx`。
@@ -17,7 +17,7 @@
 - 菜单和首页文案优先改 `src/app/navigation.ts`、`src/app/starter-content.ts` 与 `src/pages/admin/AdminDashboardPage.tsx`。
 - 页面、表单、字段、数据范围、流程动作、文件、连接器权限以后端接口为准；前端只做展示保护和清晰状态页。
 - 查询参数只能作为上下文、筛选或 ticket 输入，不能作为敏感数据授权依据；敏感读写必须由 public-access grants、平台角色、页面/表单权限组或 App Function 后端校验保护。
-- 应用管理平台账号/部门时，必须走 `sdk.organization` / `ctx.organization`，并要求当前操作者具备 `app:organization:manage`。
+- 应用查询平台账号/部门时必须走 `sdk.organization` / `ctx.organization`，当前操作者至少具备 `app:organization:read`；写入和密码操作必须具备 `app:organization:manage`。
 - 只给用户分配“管理员”业务角色不等于授权其设置角色；缺少 `app:role:manage` 时角色创建、成员分配和角色接口权限授予会被后端拒绝。
 - 本地开发通过 Vite `/service` 代理远端平台，保持 HttpOnly Cookie 同域访问。
 - 新公开访问页使用 `/view/:appType/public/*`、`src/resources/routes/`、`src/resources/public-access/` 和 `PublicAccessGate`。不要使用旧 `?publicAccess=guest`。
@@ -40,10 +40,7 @@ openxiangda sdd context --change <change> --changed --json
 openxiangda sdd verify <change> --changed --stage implementation
 openxiangda resource plan <type> --only <code1,code2> --profile <name>
 openxiangda sdd bundle <release-change> --changes <change-a,change-b>
-openxiangda sdd verify <release-change> --changed --stage prepublish --profile <name>
-openxiangda release begin --change <release-change> --profile <name>
-openxiangda release integration-status --profile <name>
-openxiangda release end --profile <name>
+openxiangda release publish --change <release-change> --profile <name>
 openxiangda commands --json
 ```
 
@@ -56,11 +53,8 @@ openxiangda commands --json
 ```bash
 # 先合并所有 approved task commits 到 main/master 并 push
 openxiangda sdd bundle <release-change> --changes <change-a,change-b>
-# commit/push bundle 后执行 verify，随后按生成的唯一 canonical command set 暂存并原子激活
-openxiangda sdd verify <release-change> --changed --stage prepublish --profile <name>
-openxiangda release begin --change <release-change> --profile <name>
-openxiangda release integration-status --profile <name>
-openxiangda release end --profile <name>
+# commit/push bundle 后由一个可恢复命令完成 verify、排队、暂存和原子激活
+openxiangda release publish --change <release-change> --profile <name>
 ```
 
 `pnpm build-js-code` 会检查并打包 `src/js-code-nodes/<code>/index.ts`、`src/automations/<code>/index.ts`、`src/functions/<code>/index.ts`，供 JS_CODE V2、代码自动化和 App Function 资源发布使用。批量目标使用 `pnpm build-js-code --scripts functions:a,functions:b,automations:c`，也兼容重复的 `--script a --script b --source functions`。正式 `resource plan/publish` 由 CLI 内置 scoped builder 一次批量构建选中入口及其传递/shared/ambient 依赖，不再为每个资源启动工作区 `pnpm`。缓存写入 `.openxiangda/build-cache.cli-v4.json`，稳定 `source_lineage_v1` 只按 authored source/dependencies 比较，不因构建器升级制造假冲突；需要强制重建时追加 `--force`。