openxiangda 1.0.174 → 1.0.176

package/README.md

@@ -1,3 +1,4 @@
+<!-- OpenXiangda-Policy-Version: 3 -->
 # OpenXiangda
 
 OpenXiangda is a lightweight CLI and skill package for private low-code platforms.
@@ -37,12 +38,17 @@ openxiangda sdd context --change add-customer-page --changed --json
 openxiangda sdd propose add-customer-page --pages customer --runtime
 openxiangda sdd approve add-customer-page --summary "用户确认"
 openxiangda sdd verify add-customer-page --changed --stage implementation --profile dev
+openxiangda sdd ready add-customer-page --profile dev
+openxiangda task status --change add-customer-page
 openxiangda resource validate function --only customer_get,customer_save --profile dev
 openxiangda resource plan function --only customer_get,customer_save --profile dev
 # merge/push approved task commits to main, then create and push one release bundle
 openxiangda sdd bundle mainline-release --changes add-customer-page,fix-customer-api
 # verify, wait for the lease, stage exact children, atomically finalize, and release
 openxiangda release publish --change mainline-release --profile dev
+openxiangda release status --change mainline-release --watch
+openxiangda release explain --change mainline-release --profile dev
+openxiangda policy check
 openxiangda resource explain public-access --json
 openxiangda inspect app --profile dev --json
 openxiangda app snapshot APP_XXXX --profile dev --json
@@ -58,6 +64,33 @@ Parallel tasks develop and test in isolated worktrees, but feature worktrees do
 
 Because promotion starts from an already-pushed authoritative mainline commit, `openxiangda release integration-status --profile <name>` should pass immediately after activation. Run it and `release end`; there is no post-release merge step.
 
+`openxiangda task status --change <id>` is the compact, read-only answer to
+“现在到哪一步”：it combines SDD、TaskResult、IntegrationBundle、execution
+journal、lease 和 post-commit outbox，输出进度、ETA、是否已经发生平台写入、
+当前阻塞层和下一条动作。`release status --watch` only polls those read APIs; it
+does not renew leases, retry writes, or change release state. A successful
+`sdd ready` releases the worktree owner only when the current thread/change owns
+that exact record; stale owners expire after the canonical two-hour TTL.
+
+Workflow changes participate through an immutable WorkflowRelease child. Generic
+resources that do not yet have an immutable staged/versioned platform model are
+rejected by the unified atomic release before any live write. Use their explicit
+direct maintenance commands only when a reviewed non-atomic operation is intended;
+OpenXiangda never silently falls back from `--stage-only` or Root App release to
+direct publishing.
+
+The canonical engineering rules are machine-readable:
+
+```bash
+openxiangda policy show --json
+openxiangda policy check
+openxiangda policy render
+```
+
+`policy check` detects drift in installed skills, workspace templates, and AI
+entrypoints. Generated documents carry `OpenXiangda-Policy-Version`; edit the
+canonical policy first instead of independently changing duplicate instructions.
+
 Source-triggered Function and Automation publishing is source-only by default. Backend Release v2 can mix create, source-only update, and manifest replacement update in one immutable child; a stale target therefore causes zero resource writes instead of failing halfway through 88 Functions and 11 Automations. `--stage-only` stops after verification, reports all handled selectors, and never falls back to direct Function/Automation writes when the platform is missing or incompatible. The release preserves online `resourceBindings`, input/output contracts, descriptive metadata, trigger/view configuration, and enabled/published state, and planned noops do not advance resource versions or timestamps. To intentionally make a complete local manifest replace the online definition, select exact codes and opt in explicitly with `--replace-manifest --reason "<why this replacement is safe>"`; `--sdd-bypass` does not widen that scope. Standard workspaces use the CLI-bundled scoped builder without spawning workspace `pnpm`, and `source_lineage_v1` compares authored source/dependencies independently from generated bundle bytes.
 
 React SPA templates include stable Vite manual chunk grouping for React, antd, ECharts, editor dependencies, and OpenXiangda runtime/component entrypoints. The SDK keeps large UI dependencies such as `antd-mobile` and `dayjs` external so the application bundler can split them by route. Applications should import from public package entrypoints such as `openxiangda`, `openxiangda/runtime`, and `openxiangda/runtime/react`; do not import `openxiangda/packages/sdk/dist/...` internals to chase bundle size.
@@ -92,9 +125,9 @@ Domestic npm mirrors may lag and return an older OpenXiangda version. `openxiang
 
 Architecture-class requests are plan-gated by default. For new apps, complex pages, login/register, public/no-login access, role/data-scope design, workflow/automation, App Function, connector, notification, and external integration work, AI agents must plan first and implement only after the user confirms the design.
 
-Risk is tiered. Read-only/docs/tests are L0. Narrow reversible fixes are L1 and use `sdd quick`; L2/L3 retain explicit approval and exact structured coverage. SDD is streamlined by default: incomplete task/evidence/spec prose warns but does not block. Workspaces that intentionally require prose completion may set `strictDocumentation: true`. Actual argv, exact scope, mainline identity, lease, CAS, destructive operations, Secrets, and Root App atomic activation remain hard gates.
+Risk is tiered. Read-only/docs/tests are L0. Narrow reversible fixes are L1 and use `sdd quick`; L2/L3 retain explicit approval and exact structured coverage. SDD is structured-first by default: `change.json`, `coverage.json`, and `release.json` are authoritative, while proposal/design/tasks/evidence/spec prose is generated only by `openxiangda sdd render <change>` or `documentationMode: 'full'`. Workspaces that intentionally require prose completion may set `strictDocumentation: true`. Actual argv, exact scope, mainline identity, lease, CAS, destructive operations, Secrets, and Root App atomic activation remain hard gates.
 
-L1 quick records are generated in a compact form and should not be expanded into design essays. Mainline bundles may keep `<profile>` in reviewed command templates; `release publish --profile <name>` binds the real profile to actual argv without rewriting tracked SDD. React SPA page codes remain logical coverage and activate through one Runtime child. `release app-head` returns a compact summary by default; add `--full` for the complete manifest.
+L1 quick records are generated in a compact form and should not be expanded into design essays. Mainline bundles may keep `<profile>` in reviewed command templates; `release publish --profile <name>` binds the real profile to actual argv without rewriting tracked SDD. React SPA page codes remain logical coverage and activate through one Runtime child. `release app-head` and `runtime releases` return compact summaries by default; add `--full` for the complete manifest.
 
 Every concurrent task uses its own Git worktree/branch and development change. The mainline release coordinator bundles selected approved changes after merge; dependency impact outside the approved scope is reported as a warning rather than silently widening a small release. Live commands still require canonical exact selectors, and app-wide/delete operations need explicit authority.