openxiangda 1.0.172 → 1.0.174

package/lib/sdd.js

@@ -3,6 +3,11 @@ const path = require('path');
 const os = require('os');
 const { readGitSourceBase } = require('./change-baseline');
 const { assertReleaseSourceIntegrated } = require('./release-mainline');
+const {
+  buildWorkspaceReleaseCommands,
+  normalizeReleaseTargets,
+  releasePlanHash,
+} = require('./release-plan');
 
 const DEFAULT_SDD_DIR = 'openspec';
 const SDD_CONFIG_FILE = 'config.yaml';
@@ -110,9 +115,12 @@ function readJsonFile(file, fallback = null) {
   }
 }
 
-function writeJsonFile(file, value) {
+function writeJsonFile(file, value, options = {}) {
   ensureDir(path.dirname(file));
-  fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+  fs.writeFileSync(
+    file,
+    `${JSON.stringify(value, null, options.compact ? 0 : 2)}\n`
+  );
 }
 
 function extractSddBlock(configText) {
@@ -573,6 +581,15 @@ function formatAffectedList(items) {
 }
 
 function createProposalContent(meta) {
+  if (meta.changeMode === 'quick') {
+    return [
+      `# Quick Change: ${meta.title}`,
+      '',
+      `User intent and approval are recorded in \`${CHANGE_META_FILE}\`.`,
+      `Exact resource/file scope is recorded in \`${COVERAGE_FILE}\`; no additional proposal prose is required.`,
+      '',
+    ].join('\n');
+  }
   return `# Proposal: ${meta.title}
 
 ## Intent
@@ -601,6 +618,14 @@ Deliver "${meta.title}" as one focused OpenXiangda application change.
 }
 
 function createDesignContent(meta) {
+  if (meta.changeMode === 'quick') {
+    return [
+      '# Design',
+      '',
+      'L1 exact-scope change; implementation stays inside coverage.json and uses the generated atomic release plan.',
+      '',
+    ].join('\n');
+  }
   return `# Design: ${meta.title}
 
 ## OpenXiangda Resource Impact
@@ -635,22 +660,19 @@ function createTasksContent(meta = {}) {
       '',
       '## Implementation',
       '',
-      '- [x] Record exact L1 scope and explicit approval basis',
-      '- [ ] Implement the focused change',
+      '- [ ] Implement the exact covered change',
       '',
       '## Prepublish',
       '',
-      '- [ ] Record implementation checks and dry-run evidence',
-      '- [ ] Confirm the exact release plan',
+      '- [ ] Run the focused check and confirm the generated release plan',
       '',
       '## Postpublish',
       '',
-      '- [ ] Record publish/deploy result',
-      '- [ ] Merge/fast-forward the frozen release SHA and push the authoritative default branch',
+      '- [ ] Record atomic publish and mainline integration status',
       '',
       '## Archive',
       '',
-      '- [ ] Confirm the released change is ready to archive',
+      '- [ ] Archive the released change',
       '',
     ].join('\n');
   }
@@ -681,7 +703,21 @@ function createTasksContent(meta = {}) {
   ].join('\n');
 }
 
-function createEvidenceContent() {
+function createEvidenceContent(meta = {}) {
+  if (meta.changeMode === 'quick') {
+    return [
+      '# Evidence',
+      '',
+      '## Verification',
+      '',
+      '- [ ] Record the focused check result',
+      '',
+      '## Release',
+      '',
+      '- [ ] Record the atomic publish result',
+      '',
+    ].join('\n');
+  }
   return [
     '# Evidence',
     '',
@@ -703,6 +739,22 @@ function createEvidenceContent() {
 }
 
 function createDeltaSpecContent(meta, domain) {
+  if (meta.changeMode === 'quick') {
+    return [
+      `# ${domain} Delta Spec`,
+      '',
+      '## ADDED Requirements',
+      '',
+      `### Requirement: ${meta.title}`,
+      'The application SHALL preserve existing behavior except for the exact approved L1 scope.',
+      '',
+      '#### Scenario: Focused change',
+      '- **Given** the existing application behavior',
+      `- **When** ${meta.title} is applied`,
+      '- **Then** only the covered target changes and unrelated behavior remains unchanged',
+      '',
+    ].join('\n');
+  }
   return `# ${domain} Delta Spec
 
 ## ADDED Requirements
@@ -802,13 +854,16 @@ function proposeSddChange(options = {}) {
   const meta = createChangeMetadata(changeId, options);
   const coverage = createCoverageManifest(meta, domain);
   const release = createReleaseManifest(meta);
-  writeJsonFile(path.join(changeDir, CHANGE_META_FILE), meta);
-  writeJsonFile(path.join(changeDir, COVERAGE_FILE), coverage);
-  writeJsonFile(path.join(changeDir, RELEASE_FILE), release);
+  const jsonWriteOptions = {
+    compact: meta.changeMode === 'quick',
+  };
+  writeJsonFile(path.join(changeDir, CHANGE_META_FILE), meta, jsonWriteOptions);
+  writeJsonFile(path.join(changeDir, COVERAGE_FILE), coverage, jsonWriteOptions);
+  writeJsonFile(path.join(changeDir, RELEASE_FILE), release, jsonWriteOptions);
   fs.writeFileSync(path.join(changeDir, 'proposal.md'), createProposalContent(meta));
   fs.writeFileSync(path.join(changeDir, 'design.md'), createDesignContent(meta));
   fs.writeFileSync(path.join(changeDir, 'tasks.md'), createTasksContent(meta));
-  fs.writeFileSync(path.join(changeDir, 'evidence.md'), createEvidenceContent());
+  fs.writeFileSync(path.join(changeDir, 'evidence.md'), createEvidenceContent(meta));
   fs.writeFileSync(
     path.join(changeDir, 'specs', domain, 'spec.md'),
     createDeltaSpecContent(meta, domain)
@@ -868,6 +923,19 @@ function createMainlineSddBundle(options = {}) {
   if (affected.functions.length > 0 || affected.automations.length > 0) {
     affected.backend = true;
   }
+  const runtimeMode = /runtimeMode\s*:\s*['"]react-spa['"]/.test(
+    options.configText || ''
+  )
+    ? 'react-spa'
+    : 'legacy';
+  const normalizedTargets = normalizeReleaseTargets(affected, runtimeMode);
+  const profile = String(options.profile || '<profile>').trim() || '<profile>';
+  const commands = buildWorkspaceReleaseCommands(
+    normalizedTargets.logicalTargets,
+    runtimeMode,
+    profile,
+    changeId
+  );
   const createdAt = nowIso();
   const meta = {
     ...createChangeMetadata(changeId, {
@@ -913,19 +981,18 @@ function createMainlineSddBundle(options = {}) {
     changeId,
     mainlinePolicy: 'publish-from-main-v1',
     bundledChanges: sourceIds,
-    targets: {
-      forms: affected.forms,
-      pages: affected.pages,
-      functions: affected.functions,
-      automations: affected.automations,
-      workflows: affected.workflows,
-      jsCodeNodes: affected.jsCodeNodes,
-      resources: affected.resources,
-      runtime: affected.runtime,
-      other: [],
-    },
+    targets: normalizedTargets.activationTargets,
+    logicalTargets: normalizedTargets.logicalTargets,
     changedFiles: affected.files,
-    commands: [],
+    commands,
+    entryCommand:
+      `openxiangda release publish --change ${changeId} --profile ${profile}`,
+    planHash: releasePlanHash({
+      changeId,
+      runtimeMode,
+      targets: normalizedTargets.activationTargets,
+      commands,
+    }),
     verifiedAt: null,
   };
   const changeDir = path.join(governance.rootDir, 'changes', changeId);
@@ -1007,7 +1074,9 @@ function approveSddChange(options = {}) {
     ...(options.approvalBasis ? { approvalBasis: options.approvalBasis } : {}),
     updatedAt: nowIso(),
   };
-  writeJsonFile(loaded.metaFile, meta);
+  writeJsonFile(loaded.metaFile, meta, {
+    compact: meta.changeMode === 'quick',
+  });
   return {
     schemaVersion: meta.schemaVersion,
     change: meta,
@@ -1847,14 +1916,24 @@ function buildUpdatedReleaseManifest(loaded, releasePlan, verificationStage = 'd
   const canonicalCommands = Array.isArray(releasePlan?.commands)
     ? releasePlan.commands.filter(command => String(command || '').trim())
     : [];
+  const actualExecution = releasePlan?.actualCommands === true;
   return {
     schemaVersion: SDD_SCHEMA_VERSION,
     changeId: loaded.changeId,
     ...(loaded.release && !loaded.release.__invalid ? loaded.release : {}),
-    targets: releasePlan?.targets || loaded.release?.targets || {},
-    changedFiles: releasePlan?.changedFiles || loaded.release?.changedFiles || [],
+    targets:
+      actualExecution
+        ? loaded.release?.targets || {}
+        : releasePlan?.activationTargets ||
+          releasePlan?.targets ||
+          loaded.release?.targets ||
+          {},
+    changedFiles:
+      actualExecution
+        ? loaded.release?.changedFiles || []
+        : releasePlan?.changedFiles || loaded.release?.changedFiles || [],
     commands:
-      canonicalCommands.length > 0
+      !actualExecution && canonicalCommands.length > 0
         ? canonicalCommands
         : reviewedCommands,
     verifiedAt,
@@ -1872,6 +1951,37 @@ function updateReleaseManifest(loaded, releasePlan, verificationStage = 'default
   return release;
 }
 
+function writeReleaseAttestation(cwd, changeId, name, value) {
+  const root = path.resolve(cwd || process.cwd());
+  const dir = path.join(
+    root,
+    '.openxiangda',
+    'releases',
+    normalizeChangeId(changeId)
+  );
+  ensureDir(dir);
+  const file = path.join(dir, name);
+  const tempFile = `${file}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(tempFile, `${JSON.stringify(value, null, 2)}\n`, {
+    mode: 0o600,
+  });
+  fs.renameSync(tempFile, file);
+  return path.relative(root, file).replace(/\\/g, '/');
+}
+
+function readReleaseAttestation(cwd, changeId, name) {
+  const file = path.join(
+    path.resolve(cwd || process.cwd()),
+    '.openxiangda',
+    'releases',
+    normalizeChangeId(changeId),
+    name
+  );
+  if (!fs.existsSync(file)) return null;
+  const value = readJsonFile(file, null);
+  return value && !value.__invalid ? value : null;
+}
+
 function recordSddReleaseSourceRevision(options = {}) {
   const loaded = loadSddChange(options);
   const input = options.releaseSourceRevision;
@@ -1885,6 +1995,16 @@ function recordSddReleaseSourceRevision(options = {}) {
     branch: String(input.branch || '').trim() || null,
     remoteName: String(input.remoteName || '').trim() || null,
     remoteUrlHash: String(input.remoteUrlHash || '').trim().toLowerCase() || null,
+    remoteUrlHashAliases: Array.isArray(input.remoteUrlHashAliases)
+      ? input.remoteUrlHashAliases
+          .map(value => String(value || '').trim().toLowerCase())
+          .filter(value => /^sha256:[0-9a-f]{64}$/.test(value))
+      : [],
+    repoAliases: Array.isArray(input.repoAliases)
+      ? input.repoAliases
+          .map(value => String(value || '').trim().toLowerCase())
+          .filter(value => /^sha256:[0-9a-f]{64}$/.test(value))
+      : [],
     mainBranch: String(input.mainBranch || '').trim() || null,
     mainTipCommit: String(input.mainTipCommit || '').trim().toLowerCase() || null,
     capturedAt: input.capturedAt || nowIso(),
@@ -1901,7 +2021,13 @@ function recordSddReleaseSourceRevision(options = {}) {
       'releaseSourceRevision 缺少有效的 repo/baseCommit/treeHash/remoteName/remoteUrlHash/mainBranch'
     );
   }
-  const existing = loaded.release?.releaseSourceRevision;
+  const existing =
+    readReleaseAttestation(
+      options.cwd || process.cwd(),
+      loaded.changeId,
+      'source-revision.json'
+    )?.releaseSourceRevision ||
+    loaded.release?.releaseSourceRevision;
   if (
     existing?.baseCommit &&
     (existing.baseCommit !== releaseSourceRevision.baseCommit ||
@@ -1917,20 +2043,29 @@ function recordSddReleaseSourceRevision(options = {}) {
     error.code = 'RELEASE_PUBLISH_REVISION_CHANGED';
     throw error;
   }
-  const release = {
+  writeReleaseAttestation(
+    options.cwd || process.cwd(),
+    loaded.changeId,
+    'source-revision.json',
+    {
+      schemaVersion: SDD_SCHEMA_VERSION,
+      changeId: loaded.changeId,
+      mainlinePolicy: 'publish-from-main-v1',
+      releaseSourceRevision,
+    }
+  );
+  return {
     ...(loaded.release && !loaded.release.__invalid ? loaded.release : {}),
-    schemaVersion: SDD_SCHEMA_VERSION,
-    changeId: loaded.changeId,
-    mainlinePolicy: 'publish-from-main-v1',
     releaseSourceRevision,
   };
-  if (JSON.stringify(release) !== JSON.stringify(loaded.release)) {
-    writeJsonFile(loaded.releaseFile, release);
-  }
-  return release;
 }
 
-function validateReleaseManifest(release, releasePlan, legacyMode = false) {
+function validateReleaseManifest(
+  release,
+  releasePlan,
+  legacyMode = false,
+  options = {}
+) {
   const errors = [];
   const warnings = [];
   if (!release || release.__invalid) {
@@ -1942,9 +2077,14 @@ function validateReleaseManifest(release, releasePlan, legacyMode = false) {
     else errors.push(issue);
     return { errors, warnings };
   }
-  const targets = releasePlan?.targets || release.targets || {};
-  if (releasePlan?.targets) {
-    const releaseTargetCoverage = affectedCoversTargets(release.targets || {}, releasePlan.targets);
+  const plannedTargets =
+    releasePlan?.activationTargets || releasePlan?.targets || null;
+  const targets = plannedTargets || release.targets || {};
+  if (plannedTargets) {
+    const releaseTargetCoverage = affectedCoversTargets(
+      release.targets || {},
+      plannedTargets
+    );
     if (!releaseTargetCoverage.covered) {
       errors.push({
         name: 'sdd-release-targets-uncovered',
@@ -1955,10 +2095,19 @@ function validateReleaseManifest(release, releasePlan, legacyMode = false) {
   if (hasHighRiskTargets(targets) && !Array.isArray(release.commands)) {
     errors.push({ name: 'sdd-release-commands-missing', message: 'release.json commands 必须是数组' });
   }
-  if (releasePlan?.commands?.length && (!Array.isArray(release.commands) || release.commands.length === 0)) {
+  if (
+    !options.actualExecution &&
+    releasePlan?.commands?.length &&
+    (!Array.isArray(release.commands) || release.commands.length === 0)
+  ) {
     errors.push({ name: 'sdd-release-commands-empty', message: 'release.json 未记录发布命令' });
   }
-  if (!legacyMode && Array.isArray(release.commands)) {
+  if (
+    !legacyMode &&
+    !options.actualExecution &&
+    Array.isArray(release.commands) &&
+    release.commands.length > 0
+  ) {
     errors.push(
       ...validateAtomicReleaseCommands(
         release.commands,
@@ -2288,12 +2437,25 @@ function verifySddChange(options = {}) {
     if (strictDocumentation) errors.push(issue);
     else warnings.push(issue);
   }
+  const actualExecution = options.releasePlan?.actualCommands === true;
   const release =
-    options.releasePlan && loaded.release && !loaded.release.__invalid
-      ? buildUpdatedReleaseManifest(loaded, options.releasePlan, verificationStage)
+    options.releasePlan &&
+    loaded.release &&
+    !loaded.release.__invalid &&
+    !actualExecution
+      ? buildUpdatedReleaseManifest(
+          loaded,
+          options.releasePlan,
+          verificationStage
+        )
       : loaded.release;
   if (stagePolicy.requireRelease) {
-    const releaseValidation = validateReleaseManifest(release, options.releasePlan, legacyMode);
+    const releaseValidation = validateReleaseManifest(
+      release,
+      options.releasePlan,
+      legacyMode,
+      { actualExecution }
+    );
     errors.push(...releaseValidation.errors);
     warnings.push(...releaseValidation.warnings);
     const reviewedPlannedCommands = loaded.meta?.release?.plannedCommands;
@@ -2347,11 +2509,28 @@ function verifySddChange(options = {}) {
     updatedAt: verifiedAt,
   };
   let metadataWritten = false;
+  let attestationFile = null;
   if (options.writeMetadata && passed) {
-    if (options.releasePlan && loaded.release && !loaded.release.__invalid) {
-      updateReleaseManifest(loaded, options.releasePlan, verificationStage);
-    }
-    writeJsonFile(loaded.metaFile, verifiedMeta);
+    attestationFile = writeReleaseAttestation(
+      options.cwd || process.cwd(),
+      loaded.changeId,
+      `verification-${verificationStage}.json`,
+      {
+        schemaVersion: SDD_SCHEMA_VERSION,
+        changeId: loaded.changeId,
+        stage: verificationStage,
+        passed,
+        verifiedAt,
+        planHash: releasePlanHash({
+          targets,
+          commands: release?.commands || [],
+          changedFiles:
+            options.releasePlan?.changedFiles ||
+            loaded.release?.changedFiles ||
+            [],
+        }),
+      }
+    );
     metadataWritten = true;
   }
   return {
@@ -2365,6 +2544,8 @@ function verifySddChange(options = {}) {
     blockingErrors: errors,
     passed,
     metadataWritten,
+    trackedMetadataWritten: false,
+    attestationFile,
     targets,
     highRiskFiles,
     stage: verificationStage,
@@ -2559,6 +2740,15 @@ function syncSddChange(options = {}) {
 
 function archiveSddChange(options = {}) {
   const releaseLoaded = loadSddChange(options);
+  const sourceRevisionAttestation = readReleaseAttestation(
+    options.cwd || process.cwd(),
+    releaseLoaded.changeId,
+    'source-revision.json'
+  );
+  const releaseSourceRevision =
+    sourceRevisionAttestation?.releaseSourceRevision ||
+    releaseLoaded.release?.releaseSourceRevision ||
+    null;
   const coverageTargets = normalizeCoverageResources(releaseLoaded.coverage, {});
   const releaseTargets = mergeAffectedScopes(
     options.targets,
@@ -2595,20 +2785,20 @@ function archiveSddChange(options = {}) {
     classifyHighRiskFiles(releaseTargets.files).length > 0 ||
     metadataDeclaresHighRisk ||
     Boolean(releaseLoaded.release?.mainlinePolicy) ||
-    Boolean(releaseLoaded.release?.releaseSourceRevision);
+    Boolean(releaseSourceRevision);
   if (requiresMainlineClosure) {
     if (
       !releaseLoaded.release ||
       releaseLoaded.release.__invalid ||
-      !releaseLoaded.release.releaseSourceRevision
+      !releaseSourceRevision
     ) {
       const error = new Error(
-        'SDD_RELEASE_SOURCE_LINEAGE_REQUIRED: 高风险 change 归档必须保留 release.json 的冻结发布提交；--force 不能绕过主分支回合证据'
+        'SDD_RELEASE_SOURCE_LINEAGE_REQUIRED: 高风险 change 归档必须保留冻结发布提交的本地 attestation；--force 不能绕过主分支回合证据'
       );
       error.code = 'SDD_RELEASE_SOURCE_LINEAGE_REQUIRED';
       throw error;
     }
-    assertReleaseSourceIntegrated(releaseLoaded.release.releaseSourceRevision, {
+    assertReleaseSourceIntegrated(releaseSourceRevision, {
       cwd: options.cwd || process.cwd(),
     });
   }

package/openxiangda-skills/SKILL.md

@@ -60,6 +60,8 @@ openxiangda sdd quick <change> --kind copy --pages <page> --files <file> --summa
 
 Function quick changes require the complete `--risk-json` assessment; Automation, Workflow, schema, permissions, auth/public access, migrations, destructive and cross-resource changes cannot use quick mode. Before release run `--stage prepublish`; use `postpublish` only after promotion and `archive` only when all evidence exists.
 
+Quick changes use compact generated JSON/prose. Do not expand them into proposal/design essays; implement the exact covered code, run the focused check, and let the mainline bundle own final atomic promotion.
+
 Keep development lightweight: structured approval plus exact resource/file scope are authoritative. By default, unfinished tasks/evidence/spec prose produces warnings at every stage and does not block release; set `strictDocumentation: true` only for a workspace that intentionally wants prose as a gate. Actual publish argv, mainline identity, CAS, lease, destructive scope, and atomic activation remain hard gates.
 
 The CLI regenerates one canonical command set from structured coverage instead of asking agents to maintain two command copies. A single Function uses `resource publish function --only <code>`; qualified selectors are used only when Function and Automation are mixed. Generated React SPA plans use exact Form bundles, one Backend `--stage-only` command, Runtime `--no-activate`, and Root `app-finalize`. Actual argv is validated again at write time.
@@ -82,16 +84,16 @@ React SPA resources/runtime:
 # In the clean main checkout:
 openxiangda sdd bundle <release-change> --changes <change-a,change-b>
 # Commit and push the generated bundle on main, then:
-openxiangda sdd verify <release-change> --changed --stage prepublish --profile <name>
-openxiangda release begin --change <release-change> --profile <name>
-# Execute the canonical exact commands printed by workspace plan/verify.
-openxiangda release integration-status --profile <name>
-openxiangda release end --profile <name>
+openxiangda release publish --change <release-change> --profile <name>
 ```
 
 `resource plan` and publish dry-runs are strictly GET/HEAD-only. `READ_ONLY_AUTH_REQUIRED` means the access token expired; run `openxiangda auth refresh --profile <name>` or log in again before retrying. Never add an automatic refresh POST inside a plan.
 
-`release begin --change` freezes a clean committed `HEAD` only when the current branch is the authoritative default `main`/`master` and its commit exactly equals the live remote tip. Before any live write, the CLI preflights the complete target set and rejects source changes during the release. A feature worktree or unpushed main receives `RELEASE_SOURCE_MAINLINE_REQUIRED` / `RELEASE_SOURCE_MAINLINE_NOT_PUSHED`; merge, test, push, and start the one mainline release instead of forcing it.
+`release publish` is the default promotion entrypoint. It verifies without rewriting reviewed `change.json`/`release.json`, waits for the app lease, freezes the App capture after ownership is acquired, executes deterministic exact staged steps, resumes from `.openxiangda/releases/<change>/execution.json`, atomically finalizes, verifies mainline integration, and releases the lease. `release begin` and child commands remain recovery/diagnostic primitives.
+
+Reviewed bundle commands may retain `<profile>` as a template. The explicit real `release publish --profile <name>` value is bound to actual child argv without rewriting tracked SDD. React SPA page codes are logical coverage targets and activate through one Runtime child; they do not require PageRelease. `release app-head` is compact by default; use `--full` only when the complete manifest is required.
+
+`release begin --change` freezes a clean committed `HEAD` only when the current branch is the authoritative default `main`/`master` and its commit exactly equals the live remote tip. Before any live write, the CLI preflights the complete target set and rejects source changes during the release. A feature worktree or unpushed main receives `RELEASE_SOURCE_MAINLINE_REQUIRED` / `RELEASE_SOURCE_MAINLINE_NOT_PUSHED`; merge, test, push, and start the one mainline release instead of forcing it. Optional `.git` remote suffix differences are aliases of the same repository; genuinely different remotes still fail closed.
 
 Because promotion begins from the already-pushed authoritative mainline, `release integration-status` should pass immediately after activation. Run it, then `release end`; no post-release branch merge is required.
 

package/openxiangda-skills/references/openxiangda-api.md

@@ -442,13 +442,13 @@ Requires app admin permission. Upserts a binding with `templateCode` or `templat
 
 ## Organization
 
-Organization APIs are app-scoped and require `app:organization:manage` on the target app. Platform admins pass through the same permission service. Runtime service principals are not accepted by themselves: trusted runtime calls must carry a real audit actor, and permission is checked against that user.
+Organization APIs are app-scoped. List/detail operations accept `app:organization:read` or `app:organization:manage`; create/update/password operations require `app:organization:manage`. Platform admins pass through the same permission service. Runtime service principals are not accepted by themselves: trusted runtime calls must carry a real audit actor, and permission is checked against that user.
 
 Use these endpoints for OpenXiangda app-managed platform departments and accounts. Do not use legacy `/user` or `/department` write endpoints for new app organization management.
 
 ### GET `/apps/:appType/organization/capabilities`
 
-Requires Bearer token. Returns whether the current actor can manage organization data for the app, the permission code, and supported operations.
+Requires Bearer token. Returns `canRead`, `canManage`, `readPermissionCode`, `managePermissionCode`, the compatibility `permissionCode`, and supported operations.
 
 CLI:
 
@@ -458,11 +458,11 @@ openxiangda organization capabilities --json
 
 ### GET `/apps/:appType/organization/departments`
 
-Requires `app:organization:manage`. Lists platform departments in the current tenant.
+Requires `app:organization:read` or `app:organization:manage`. Lists platform departments in the current tenant.
 
 ### GET `/apps/:appType/organization/departments/:departmentId`
 
-Requires `app:organization:manage`. Returns one platform department.
+Requires `app:organization:read` or `app:organization:manage`. Returns one platform department.
 
 ### POST `/apps/:appType/organization/departments`
 
@@ -492,11 +492,11 @@ Requires `app:organization:manage`. Updates department metadata, visibility/memb
 
 ### GET `/apps/:appType/organization/accounts`
 
-Requires `app:organization:manage`. Lists tenant platform accounts. Supports `ids`, `departmentIds`, `keyword`, `name`, `username`, `phone`, `email`, `jobNumber`, `page`, and `pageSize`.
+Requires `app:organization:read` or `app:organization:manage`. Lists tenant platform accounts. Supports `ids`, `departmentIds`, `keyword`, `name`, `username`, `phone`, `email`, `jobNumber`, `page`, and `pageSize`.
 
 ### GET `/apps/:appType/organization/accounts/:userId`
 
-Requires `app:organization:manage`. Returns one platform account. Password, login failure counters, and lock fields are removed from the response.
+Requires `app:organization:read` or `app:organization:manage`. Returns one platform account. Password, login failure counters, and lock fields are removed from the response.
 
 ### POST `/apps/:appType/organization/accounts`
 

package/openxiangda-skills/references/pages/page-sdk.md

@@ -17,7 +17,7 @@ Guidelines:
 - Use `sdk.connector.invoke`, `sdk.connector.call("connector.api")`, or `sdk.connector.download` for external services. The SDK calls the platform runtime connector endpoint; it must not call third-party domains directly.
 - Use `sdk.notification.sendByType` and `batchSendByType` for reusable business messages. Custom notification types must be declared in `src/resources/notifications/` and published with `openxiangda resource publish`.
 - Use `AttachmentPreviewList`, `ImagePreviewGrid`, or `useFilePreview` from `openxiangda/runtime/react` for in-page attachment previews in a custom React SPA page. They use the current PageSdk context and enforce the platform capability and ticket contracts. Use `sdk.createFileAccessTicket(bucketName, objectName, fileName, "preview", { appType })` only when the page needs a shareable or new-window preview link. `appType` defaults to the current page context. Open `response.result.previewPageUrl`; do not use `previewUrl` or `/service/file/preview-by-ticket/:ticket` as the page entry.
-- Use `sdk.organization.departments.*` and `sdk.organization.accounts.*` only for admin-style app pages that intentionally manage platform departments/accounts. The current user needs `app:organization:manage` on the app. Do not call legacy `/user` or `/department` write endpoints from pages.
+- Use `sdk.organization.departments.*` and `sdk.organization.accounts.*` only for intentional organization pages. Read-only list/detail pages need `app:organization:read` or `app:organization:manage`; writes and password operations need `app:organization:manage`. Do not call legacy `/user` or `/department` endpoints from pages.
 - Use `sdk.workCenter.listItems({ boxType })` and `sdk.workCenter.getStats()` for current-user work center lists and counts. `boxType` is one of `todo`, `done`, `cc`, or `initiated`. This is the end-user task/handled/cc/initiated surface; do not build todo pages by reading workflow operation logs, automation logs, or raw process-task tables.
 - `sdk.form.create` returns identifiers and generated serial number values only. Treat `formInstId` / `formInstanceId` as the required success contract; `serialNumber` / `serialNumbers` are present only when the form has `SerialNumberField`. Do not expect the save response to contain the full row, formula results, or other server-generated field values. Call `sdk.form.getDetail` explicitly after create when those values are needed.
 - Missing `formInstId` / `formInstanceId` is a real error in strict mode. Do not create fake IDs, mock rows, or fallback display data to hide it.

package/openxiangda-skills/references/permissions-settings.md

@@ -33,9 +33,10 @@ in `src/resources/roles/<code>.json`; otherwise the user may have the business
 role but still fail when calling role-setting APIs.
 
 For app-managed platform accounts or departments, use `sdk.organization.*` or
-`ctx.organization.*`. The real current operator must have
-`app:organization:manage`; do not bypass OpenXiangda with legacy user or
-department write APIs.
+`ctx.organization.*`. The real current operator needs `app:organization:read`
+or `app:organization:manage` for list/detail queries and
+`app:organization:manage` for writes/password operations; do not bypass
+OpenXiangda with legacy user or department APIs.
 
 ## Role Codes
 

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -89,14 +89,16 @@ Forms, Backend resources, and frontend Runtime are staged children of one Root A
 ```bash
 openxiangda sdd bundle <release-change> --changes <change-a,change-b>
 # Commit and push the bundle on main/master.
-openxiangda sdd verify <release-change> --changed --stage prepublish --profile <name>
-openxiangda release begin --change <release-change> --profile <name>
-# Run the canonical exact staged commands emitted by the release plan.
-openxiangda release integration-status --profile <name>
-openxiangda release end --profile <name>
+openxiangda release publish --change <release-change> --profile <name>
 ```
 
-`runtime deploy --no-activate` uploads an immutable preview release from a clean committed mainline `HEAD`. Before acquiring a lease, the CLI confirms `package.json#scripts.build` and existing dependencies; it uses `npm run build` to execute the declared script so pnpm worktree symlinks do not trigger a reinstall. The protected upload plan still runs before the actual build because its provider-specific `assetBaseUrl` is compiled into the bundle. `release begin` requires local main/master and the live remote default tip to be identical, so `integration-status` is already satisfied after activation and `release end` does not wait for a later merge.
+`release publish` is the normal whole-app entrypoint: it verifies SDD without mutating reviewed files, waits for the promotion lease, freezes one App capture, stages the exact Form/Backend/Runtime children, resumes from a private execution journal, finalizes once, and releases the lease. Individual release commands are recovery/diagnostic primitives.
+
+Reviewed bundle commands may retain `<profile>` as a template. The explicit real `release publish --profile <name>` value is bound to actual child argv without rewriting tracked SDD. React SPA page codes remain logical coverage targets and activate through the single Runtime child; they do not require PageRelease. If local lease state disappears, `release end --change <id>` reconciles a self-owned remote lease from the private execution journal and never reports inactive while a remote lease is active.
+
+`runtime deploy --no-activate` uploads an immutable preview release from a clean committed mainline `HEAD`. It reads a narrow Runtime head instead of the full app snapshot. Before acquiring a lease, the CLI confirms `package.json#scripts.build` and existing dependencies; it uses `npm run build` to execute the declared script so pnpm worktree symlinks do not trigger a reinstall. Immutable Git-base artifact hashes are cached under the Git common directory. `release begin` requires local main/master and the live remote default tip to be identical, so `integration-status` is already satisfied after activation and `release end` does not wait for a later merge.
+
+`release app-head` returns a compact head/resource-count summary by default. Use `--full` only when the complete manifest is required.
 
 `resource plan`, `resource publish`, and `runtime deploy` report coarse phases on stderr and emit a heartbeat after 15 seconds without completion. JSON stdout stays machine-readable and includes `timings`; use it to identify whether time is spent in plan, preflight, build, upload, write, or activate instead of rerunning an opaque command.
 

package/openxiangda-skills/skills/openxiangda-permission-settings/SKILL.md

@@ -22,7 +22,7 @@ description: Manage OpenXiangda app **roles** (角色), **page permission groups
 - ✅ For dynamic multi-role apps, build a role maintenance form + automation/JS_CODE sync, not hardcoded role logic in page code.
 - ✅ For permission scope keys, derive hidden scalars (`collegeScopeKey`, `classScopeKey`, `ownerDeptScopeKey`, `ownerUserScopeKey`, `roleCode`) via `valueSync` from visible select/person/department fields.
 - ✅ Use page permission groups for entry visibility, form permission groups for real data isolation with condition-based data permissions.
-- ✅ For app-managed platform accounts/departments, use `sdk.organization.*` / `ctx.organization.*` and require the current operator to have `app:organization:manage`.
+- ✅ For app-managed platform accounts/departments, use `sdk.organization.*` / `ctx.organization.*`. Read-only list/detail operations require `app:organization:read` or `app:organization:manage`; writes and password operations require `app:organization:manage`.
 - ✅ For delegated administrators such as 校区管理员, put role-setting API permissions in the role manifest with `apiPermissionCodes`; use `app:role:manage` for app role creation/member assignment/API-permission assignment, and add page/form/organization management permission codes only when needed.
 - ✅ If a delegated administrator creates another role that can also manage accounts, roles, or permission groups, publish that new role with its own `apiPermissionCodes`.
 - ❌ Expose raw ID text fields to users for permission scopes.
@@ -85,9 +85,10 @@ For dynamic multi-role apps, do not hardcode role behavior only in page code. Cr
 For managed platform account governance, use organization/account forms and sync
 functions as a closed loop: organization units, system accounts, role
 assignments, roles resources, page groups, form groups, sync App Functions, and
-backend role/scope checks. Platform account writes must go through
-`sdk.organization` or `ctx.organization`; the current operator must have
-`app:organization:manage`.
+backend role/scope checks. Platform account access must go through
+`sdk.organization` or `ctx.organization`; give read-only operators
+`app:organization:read` and require `app:organization:manage` for writes and
+password operations.
 
 ## Page Permission Groups