openxiangda 1.0.176 → 1.0.177

package/README.md

@@ -123,13 +123,15 @@ Domestic npm mirrors may lag and return an older OpenXiangda version. `openxiang
 
 ## AI design gate and resource CLI
 
-Architecture-class requests are plan-gated by default. For new apps, complex pages, login/register, public/no-login access, role/data-scope design, workflow/automation, App Function, connector, notification, and external integration work, AI agents must plan first and implement only after the user confirms the design.
+Architecture-class requests run the relevant design gate first. AI agents pause only for unresolved business, security, or data choices that would change the implementation. When the user already supplied concrete requirements and acceptance criteria, agents record the structured SDD scope and implement without a long design essay or duplicate confirmation.
 
 Risk is tiered. Read-only/docs/tests are L0. Narrow reversible fixes are L1 and use `sdd quick`; L2/L3 retain explicit approval and exact structured coverage. SDD is structured-first by default: `change.json`, `coverage.json`, and `release.json` are authoritative, while proposal/design/tasks/evidence/spec prose is generated only by `openxiangda sdd render <change>` or `documentationMode: 'full'`. Workspaces that intentionally require prose completion may set `strictDocumentation: true`. Actual argv, exact scope, mainline identity, lease, CAS, destructive operations, Secrets, and Root App atomic activation remain hard gates.
 
 L1 quick records are generated in a compact form and should not be expanded into design essays. Mainline bundles may keep `<profile>` in reviewed command templates; `release publish --profile <name>` binds the real profile to actual argv without rewriting tracked SDD. React SPA page codes remain logical coverage and activate through one Runtime child. `release app-head` and `runtime releases` return compact summaries by default; add `--full` for the complete manifest.
 
-Every concurrent task uses its own Git worktree/branch and development change. The mainline release coordinator bundles selected approved changes after merge; dependency impact outside the approved scope is reported as a warning rather than silently widening a small release. Live commands still require canonical exact selectors, and app-wide/delete operations need explicit authority.
+Every concurrent task uses its own Git worktree/branch and development change. The canonical main checkout is reserved for integration and release; tasks never stash/restore each other's files to make it publishable. The mainline release coordinator bundles selected approved changes after merge; dependency impact outside the approved scope is reported as a warning rather than silently widening a small release. Live commands still require canonical exact selectors, and app-wide/delete operations need explicit authority.
+
+Agent investigation is bounded to one complete CodeGraph survey plus at most one focused follow-up, and ordinary work loads one domain skill. Unchanged lease/build waits use `task status --watch` and produce updates only on material transitions.
 
 Before confirmation, agents may read, inspect, snapshot, dry-run, ask questions, and output/write the architecture document. They must not edit source files, mutate platform resources, publish, deploy, send notifications, or call live write/delete endpoints.
 

package/lib/cli.js

@@ -170,13 +170,32 @@ let readOnlyHttpGuardDepth = 0;
 let readOnlyHttpGuardLabel = null;
 let activePublishRequestContext = null;
 let activePublishLeaseHeartbeat = null;
+let activeCommandScopedPublishLease = null;
 const genericGitBasePlanCache = new Map();
 
 async function main(argv) {
+  let commandError = null;
   try {
     return await mainImpl(argv);
+  } catch (error) {
+    commandError = error;
+    throw error;
   } finally {
     await stopActivePublishLeaseHeartbeat();
+    try {
+      await finalizeCommandScopedPublishLease({
+        succeeded: commandError === null,
+      });
+    } catch (cleanupError) {
+      if (!commandError) throw cleanupError;
+      commandError.publishLeaseCleanupError = {
+        code: cleanupError?.code || 'PUBLISH_LEASE_CLEANUP_FAILED',
+        message: maskText(cleanupError?.message || String(cleanupError)),
+      };
+      warn(
+        `发布命令失败后的租约清理也未完成：${commandError.publishLeaseCleanupError.message}`
+      );
+    }
     activePublishRequestContext = null;
   }
 }
@@ -1005,6 +1024,10 @@ function releaseExecutionFile(changeId) {
   return path.join(releaseExecutionDir(changeId), 'execution.json');
 }
 
+function directPublishReceiptFile(changeId) {
+  return path.join(releaseExecutionDir(changeId), 'direct-publish.json');
+}
+
 function writePrivateJsonAtomic(file, value) {
   fs.mkdirSync(path.dirname(file), { recursive: true });
   const tempFile = `${file}.${process.pid}.${Date.now()}.tmp`;
@@ -1026,6 +1049,39 @@ function readReleaseExecution(changeId) {
   }
 }
 
+function readDirectPublishReceipt(changeId) {
+  const file = directPublishReceiptFile(changeId);
+  if (!fs.existsSync(file)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch (error) {
+    fail(
+      `DIRECT_PUBLISH_RECEIPT_INVALID: ${path.relative(process.cwd(), file)} 无法读取: ${error.message}`
+    );
+  }
+}
+
+function writeDirectPublishReceipt(changeId, input = {}) {
+  if (!changeId) return null;
+  const receipt = {
+    schemaVersion: 'openxiangda_direct_publish_receipt_v1',
+    changeId,
+    status: 'completed',
+    command: input.command || null,
+    writeAttempted: Boolean(input.writeAttempted),
+    selectors: unique(input.selectors || []).sort(),
+    sourceRevision: input.sourceRevision || null,
+    result: input.result || null,
+    completedAt: new Date().toISOString(),
+  };
+  const file = directPublishReceiptFile(changeId);
+  writePrivateJsonAtomic(file, receipt);
+  return {
+    file: path.relative(process.cwd(), file).replace(/\\/g, '/'),
+    receipt,
+  };
+}
+
 function summarizeReleaseStepResult(result) {
   const value =
     result && typeof result === 'object' && !Array.isArray(result)
@@ -1181,6 +1237,8 @@ async function waitForPublishLeaseAvailability(config, target, flags = {}) {
   const deadline = startedAt + waitSeconds * 1000;
   const clientSessionId = createPublishClientSessionId();
   let attempts = 0;
+  let lastNoticeFingerprint = '';
+  let lastNoticeAt = 0;
   while (true) {
     const remote = await fetchPublishLeaseStatus(
       config,
@@ -1191,10 +1249,11 @@ async function waitForPublishLeaseAvailability(config, target, flags = {}) {
       return { waitedMs: Date.now() - startedAt, attempts, remote };
     }
     const remoteHolder =
-      (typeof remote?.holder === 'string' ? remote.holder : null) ||
-      remote?.holder?.changeId ||
       remote?.changeId ||
+      remote?.clientSessionId ||
+      remote?.holder?.changeId ||
       remote?.holder?.clientSessionId ||
+      (typeof remote?.holder === 'string' ? remote.holder : null) ||
       'another release';
     if (Date.now() >= deadline) {
       fail(
@@ -1210,9 +1269,20 @@ async function waitForPublishLeaseAvailability(config, target, flags = {}) {
       30000,
       Math.max(1000, deadline - Date.now())
     );
-    warn(
-      `发布队列等待中: app=${target.appType} holder=${remoteHolder} retry=${Math.ceil(delayMs / 1000)}s`
-    );
+    const noticeFingerprint = [
+      remoteHolder,
+      remote?.leaseId || '',
+    ].join(':');
+    if (
+      noticeFingerprint !== lastNoticeFingerprint ||
+      Date.now() - lastNoticeAt >= 120_000
+    ) {
+      warn(
+        `发布队列等待中: app=${target.appType} holder=${remoteHolder} retry=${Math.ceil(delayMs / 1000)}s${remote?.expiresAt ? ` expiresAt=${remote.expiresAt}` : ''}`
+      );
+      lastNoticeFingerprint = noticeFingerprint;
+      lastNoticeAt = Date.now();
+    }
     await sleep(delayMs);
   }
 }
@@ -1443,6 +1513,9 @@ async function publishWorkspaceRelease(config, target, flags = {}) {
       execution: null,
     };
   }
+  const plannedSourceRevision = prepareReleaseSourceRevision({
+    cwd: process.cwd(),
+  });
   const existing = readReleaseExecution(changeId);
   if (
     existing &&
@@ -1462,6 +1535,11 @@ async function publishWorkspaceRelease(config, target, flags = {}) {
       'RELEASE_WRITE_REVIEW_REQUIRED: 上次写请求结果不确定；请先只读核对 staged release，确认可重试后追加 --resume-after-review'
     );
   }
+  if (existing?.releaseSourceRevision) {
+    assertReleaseSourceRevisionStable(existing.releaseSourceRevision, {
+      cwd: process.cwd(),
+    });
+  }
   const now = new Date().toISOString();
   const execution = existing || {
     schemaVersion: 'openxiangda_release_execution_v1',
@@ -1469,6 +1547,7 @@ async function publishWorkspaceRelease(config, target, flags = {}) {
     profile: target.profileName,
     changeId,
     planHash,
+    releaseSourceRevision: plannedSourceRevision,
     status: 'planned',
     createdAt: now,
     updatedAt: now,
@@ -1493,6 +1572,9 @@ async function publishWorkspaceRelease(config, target, flags = {}) {
       },
     ],
   };
+  if (!execution.releaseSourceRevision) {
+    execution.releaseSourceRevision = plannedSourceRevision;
+  }
   if (execution.status === 'completed') {
     return {
       completed: true,
@@ -1662,7 +1744,7 @@ async function release(args) {
       '  - begin 获取应用级单写者 promotion lease；不同工作区仍可并行开发和验证。',
       '  - 带 --change 的 resource/runtime 写命令在没有本地 lease 时会自动 begin，并在后续命令复用。',
       '  - 子 Runtime/Page/Backend/Form Release 默认先 stage；app-finalize 用 --staged-resources-json 覆盖 capture 中的 changed children，并在同一事务中原子激活。',
-      '  - 默认 TTL 为 1800 秒；长异步发布每 30 秒检查并在到期前自动续租，续租失败会以 PUBLISH_LEASE_LOST 阻断后续写入。',
+      '  - 默认 TTL 为 120 秒；活动发布每 30 秒心跳并在到期前续租，客户端退出后孤儿租约最多阻塞约 2 分钟。',
       '  - begin 仅接受 clean 且与权威远端默认 main/master 完全一致的 HEAD；feature branch 先合并并 push，再由主分支一次发布。',
       '  - 因发布源已在远端主线，成功激活后 integration-status 会立即通过，end 不再等待补合并。',
       '  - integration-status --check 可作为 CI 门禁；尚未回合时返回非零。',
@@ -2080,7 +2162,14 @@ async function loadTaskStatusSnapshot(config, target, changeId) {
     process.cwd(),
     changeId
   );
-  const integration = taskResult
+  const execution = readReleaseExecution(changeId);
+  const directPublish = readDirectPublishReceipt(changeId);
+  const sourceRevision =
+    execution?.releaseSourceRevision ||
+    execution?.releaseContext?.releaseSourceRevision ||
+    directPublish?.sourceRevision ||
+    null;
+  let integration = taskResult
     ? inspectIntegrationBundleCommits(
         {
           requiredCommits: [
@@ -2095,13 +2184,26 @@ async function loadTaskStatusSnapshot(config, target, changeId) {
         { cwd: process.cwd() }
       )
     : null;
-  const execution = readReleaseExecution(changeId);
+  let integrationError = null;
+  if (!integration && sourceRevision) {
+    try {
+      integration = inspectReleaseSourceIntegration(sourceRevision, {
+        cwd: process.cwd(),
+      });
+    } catch (error) {
+      integrationError = {
+        code: error?.code || 'RELEASE_INTEGRATION_STATUS_UNAVAILABLE',
+        message: maskText(error?.message || String(error)),
+      };
+    }
+  }
   const localLease = getStoredPublishLease(target);
   const baseline = getStoredChangeBaseline(target, {
     access: 'reconciliation-read',
   });
   const clientSessionId =
     localLease?.clientSessionId ||
+    execution?.releaseContext?.clientSessionId ||
     baseline?.clientSessionId ||
     createPublishClientSessionId();
   let remoteLease = null;
@@ -2145,6 +2247,8 @@ async function loadTaskStatusSnapshot(config, target, changeId) {
       taskResult,
       integration,
       execution,
+      directPublish,
+      sourceRevision,
       remoteLease,
       postCommit,
     }),
@@ -2152,6 +2256,7 @@ async function loadTaskStatusSnapshot(config, target, changeId) {
     diagnostics: {
       remoteLeaseError,
       postCommitError,
+      integrationError,
     },
   };
 }
@@ -3918,6 +4023,7 @@ async function resolvePublishLeaseForWrite(config, target, flags = {}) {
   const explicitLeaseId = readStringFlag(flags, 'publish-lease-id');
   const changeId = readStringFlag(flags, 'change');
   const storedLease = getStoredPublishLease(target);
+  let acquiredByCommand = false;
   assertOrClaimWorktreeOwner({
     cwd: process.cwd(),
     changeId: changeId || storedLease?.changeId || 'unscoped-publish',
@@ -3981,6 +4087,7 @@ async function resolvePublishLeaseForWrite(config, target, flags = {}) {
         ...flags,
         'client-session-id': clientSessionId,
       });
+      acquiredByCommand = true;
     } catch (error) {
       clearRejectedPendingBaseline(target, baseline, error);
       throw error;
@@ -4017,6 +4124,17 @@ async function resolvePublishLeaseForWrite(config, target, flags = {}) {
   if (shouldRenewPublishLease(lease)) {
     lease = await heartbeat.beforeWrite({ forceRenew: true });
   }
+  if (acquiredByCommand) {
+    activeCommandScopedPublishLease = {
+      config,
+      target,
+      leaseId: lease.leaseId,
+      changeId: lease.changeId || changeId,
+      writeAttempted: false,
+      retain: false,
+      retentionReason: null,
+    };
+  }
   return lease;
 }
 
@@ -4084,6 +4202,112 @@ async function stopActivePublishLeaseHeartbeat() {
   if (active?.heartbeat) await active.heartbeat.stop();
 }
 
+function markCommandScopedPublishWriteAttempted() {
+  if (activeCommandScopedPublishLease) {
+    activeCommandScopedPublishLease.writeAttempted = true;
+  }
+}
+
+function retainCommandScopedPublishLease(reason = 'staged-release') {
+  if (!activeCommandScopedPublishLease) return false;
+  activeCommandScopedPublishLease.retain = true;
+  activeCommandScopedPublishLease.retentionReason = String(reason || 'staged-release');
+  return true;
+}
+
+async function finalizeCommandScopedPublishLease(options = {}) {
+  const active = activeCommandScopedPublishLease;
+  if (!active) return null;
+  activeCommandScopedPublishLease = null;
+  if (active.retain) {
+    return {
+      managed: true,
+      released: false,
+      retained: true,
+      reason: active.retentionReason,
+    };
+  }
+  if (options.succeeded === false && active.writeAttempted) {
+    warn(
+      `PUBLISH_WRITE_REVIEW_REQUIRED: change=${active.changeId || '-'} 的写请求结果未完整确认，租约已保留供只读核对和恢复`
+    );
+    return {
+      managed: true,
+      released: false,
+      retained: true,
+      reason: 'write-result-review',
+    };
+  }
+
+  await stopActivePublishLeaseHeartbeat();
+  const stored = getStoredPublishLease(active.target);
+  if (!stored || stored.leaseId !== active.leaseId) {
+    return {
+      managed: true,
+      released: false,
+      retained: false,
+      reason: 'local-lease-already-cleared',
+    };
+  }
+  const baseline = getStoredChangeBaseline(active.target, {
+    access: 'reconciliation-read',
+  });
+  const integration = assertReleaseSourceIntegrated(
+    baseline?.releaseSourceRevision,
+    { cwd: process.cwd() }
+  );
+  try {
+    await requestWithAuth(
+      active.config,
+      active.target.profileName,
+      publishLeaseApiPath(
+        active.target,
+        `/${encodeURIComponent(active.leaseId)}/release`
+      ),
+      {
+        method: 'POST',
+        body: {
+          completion:
+            options.succeeded === false
+              ? 'prewrite-failed'
+              : 'direct-publish-completed',
+          sourceCommit: integration.sourceCommit,
+          mainBranch: integration.mainBranch,
+          mainTipCommit: integration.mainTipCommit,
+        },
+      }
+    );
+  } catch (error) {
+    if (
+      !['PUBLISH_LEASE_EXPIRED', 'PUBLISH_LEASE_INVALID'].includes(
+        error?.code
+      )
+    ) {
+      activeCommandScopedPublishLease = active;
+      throw error;
+    }
+  }
+  clearPublishLease(active.target, active.leaseId);
+  if (baseline) {
+    clearChangeBaseline(
+      active.target,
+      baseline.baselineId || baseline.id
+    );
+  }
+  releaseWorktreeOwner({ cwd: process.cwd() });
+  activePublishRequestContext = null;
+  return {
+    managed: true,
+    released: true,
+    retained: false,
+    completion:
+      options.succeeded === false
+        ? 'prewrite-failed'
+        : 'direct-publish-completed',
+    integration,
+  };
+}
+
 function publishContextRequiredError(label, detail) {
   const suffix = detail ? `（${detail}）` : '';
   const error = new Error(
@@ -5773,7 +5997,12 @@ async function workspace(args) {
             flags
           );
         }
-        runReactSpaFormSchemaPublish(profileName, profile, bound.appType, publishOptions);
+        await runReactSpaFormSchemaPublish(
+          profileName,
+          profile,
+          bound.appType,
+          publishOptions
+        );
       } else {
         fail(
           [
@@ -5794,7 +6023,12 @@ async function workspace(args) {
           flags
         );
       }
-      runWorkspacePublish(profileName, profile, bound.appType, publishOptions.workspaceArgs);
+      await runWorkspacePublish(
+        profileName,
+        profile,
+        bound.appType,
+        publishOptions.workspaceArgs
+      );
     }
     if (publishOptions.includeResources) {
       if (publishOptions.dryRun) {
@@ -5828,6 +6062,7 @@ async function workspace(args) {
     } else if (!publishOptions.quietResourceSkip) {
       print('已跳过 src/resources 发布；如需同时发布资源，传 --resources。');
     }
+    await finalizeCommandScopedPublishLease({ succeeded: true });
     return;
   }
 
@@ -6644,6 +6879,12 @@ async function page(args) {
         },
       }
     );
+    const leaseCompletion = await finalizeCommandScopedPublishLease({
+      succeeded: true,
+    });
+    if (leaseCompletion && data && typeof data === 'object') {
+      data.publishLeaseLifecycle = leaseCompletion;
+    }
     return outputPageResult(data, flags);
   }
 
@@ -6719,6 +6960,15 @@ async function page(args) {
         legacyFormUuid: item.legacyFormUuid,
       });
     }
+    if (!activate) {
+      retainCommandScopedPublishLease('staged-page');
+    }
+    const leaseCompletion = await finalizeCommandScopedPublishLease({
+      succeeded: true,
+    });
+    if (leaseCompletion && data && typeof data === 'object') {
+      data.publishLeaseLifecycle = leaseCompletion;
+    }
     return outputPageResult(data, flags);
   }
 
@@ -10347,6 +10597,8 @@ async function resource(args) {
           : [];
     const stagedChangeId =
       flags.change || getStoredChangeBaseline(target)?.changeId;
+    const directPublishSourceRevision =
+      getStoredChangeBaseline(target)?.releaseSourceRevision || null;
     if (stagedResources.length > 0 && stagedChangeId) {
       result.stagedResourcesFile = recordStagedAppReleaseResources(
         stagedChangeId,
@@ -10366,7 +10618,42 @@ async function resource(args) {
         target
       );
     }
+    if (stagedResources.length > 0 || flags['stage-only']) {
+      retainCommandScopedPublishLease('staged-resource');
+    }
+    const leaseCompletion = await telemetry.runPhase(
+      'lease-release',
+      async () =>
+        finalizeCommandScopedPublishLease({
+          succeeded: true,
+        })
+    );
+    if (leaseCompletion) {
+      result.publishLeaseLifecycle = leaseCompletion;
+    }
     result.timings = telemetry.stop();
+    if (leaseCompletion?.released && stagedChangeId) {
+      const receipt = writeDirectPublishReceipt(stagedChangeId, {
+        command: 'resource publish',
+        writeAttempted:
+          (result.published || []).some(item => item.action !== 'noop') ||
+          (result.deleted || []).length > 0,
+        selectors: [
+          ...(result.published || []).map(
+            item => `${item.kind || 'resource'}:${item.code}`
+          ),
+          ...(result.deleted || []).map(
+            item => `${item.kind || 'resource'}:${item.code}`
+          ),
+        ],
+        sourceRevision: directPublishSourceRevision,
+        result: {
+          published: (result.published || []).length,
+          deleted: (result.deleted || []).length,
+        },
+      });
+      result.directPublishReceipt = receipt?.file || null;
+    }
     if (flags.json) return writeJson(result);
     printResourceResult(result);
   } finally {
@@ -10599,6 +10886,10 @@ async function runtime(args) {
       target,
       flags
     );
+    const directChangeId =
+      flags.change || getStoredChangeBaseline(target)?.changeId;
+    const directSourceRevision =
+      getStoredChangeBaseline(target)?.releaseSourceRevision || null;
     await runRuntimeChangeBaselinePreflight(config, target);
     const activationPreconditions = await resolveRuntimeActivationPreconditions(
       config,
@@ -10623,6 +10914,18 @@ async function runtime(args) {
       }
     );
     saveRuntimeReleaseState(target, data);
+    const leaseCompletion = await finalizeCommandScopedPublishLease({
+      succeeded: true,
+    });
+    if (leaseCompletion?.released && directChangeId) {
+      writeDirectPublishReceipt(directChangeId, {
+        command: 'runtime activate',
+        writeAttempted: true,
+        selectors: ['runtime:active'],
+        sourceRevision: directSourceRevision,
+        result: { releaseId: data?.id || releaseId },
+      });
+    }
     if (flags.json) return writeJson(data);
     print(`runtime release 已激活: ${data.id || releaseId} build=${data.buildId || '-'}`);
     return;
@@ -10666,8 +10969,8 @@ async function runtime(args) {
     // Keep build after lease acquisition. In direct-storage modes the build
     // embeds the provider-specific assetBaseUrl returned by the protected
     // upload plan; substituting the gateway URL would change chunk/publicPath
-    // behavior. The 3600-second pre-build renewal below is therefore the safe
-    // fail-closed boundary.
+    // behavior. The async build keeps the short publish-lease heartbeat alive
+    // instead of extending a crash-prone one-hour lease.
     let publishLease = await telemetry.runPhase('lease', async () =>
       resolveRuntimePublishLeaseForWrite(config, target, flags)
     );
@@ -10748,19 +11051,8 @@ async function runtime(args) {
       }
     }
     if (!flags['no-build']) {
-      // spawnSync blocks the Node event loop, so the background heartbeat
-      // cannot run while the local Runtime build is executing. Extend to the
-      // server maximum first; if the build still outlives it, the first
-      // subsequent write performs a real renew and fails closed.
-      publishLease = await renewPublishLeaseFailClosed(
-        config,
-        target,
-        publishLease,
-        {
-          ...flags,
-          ttl: 3600,
-        }
-      );
+      // Runtime builds run in an asynchronous child process so the promotion
+      // heartbeat keeps renewing the short lease while compilation proceeds.
       await telemetry.runPhase('build', async () =>
         runRuntimeBuild({
           buildId,
@@ -10952,8 +11244,35 @@ async function runtime(args) {
       traceId,
       ...(stagedResource ? { stagedResource } : {}),
       ...(stagedResourcesFile ? { stagedResourcesFile } : {}),
-      timings: telemetry.stop(),
     };
+    if (stagedResource) {
+      retainCommandScopedPublishLease('staged-runtime');
+    }
+    const leaseCompletion = await telemetry.runPhase(
+      'lease-release',
+      async () =>
+        finalizeCommandScopedPublishLease({
+          succeeded: true,
+        })
+    );
+    if (leaseCompletion) {
+      result.publishLeaseLifecycle = leaseCompletion;
+    }
+    result.timings = telemetry.stop();
+    if (leaseCompletion?.released && stagedChangeId) {
+      const receipt = writeDirectPublishReceipt(stagedChangeId, {
+        command: 'runtime deploy',
+        writeAttempted: true,
+        selectors: ['runtime:active'],
+        sourceRevision: runtimeLineage.sourceRevision,
+        result: {
+          releaseId: data?.id || null,
+          buildId,
+          activated: true,
+        },
+      });
+      result.directPublishReceipt = receipt?.file || null;
+    }
     if (flags.json) return writeJson(result);
     print(
       [
@@ -11056,32 +11375,61 @@ async function createRuntimeOssUploadBasePlan(options) {
   );
 }
 
-function runRuntimeBuild(options) {
+async function runRuntimeBuild(options) {
   const command = options.command || defaultRuntimeBuildCommand();
   if (options.jsonOutput) {
     printRuntimeProgress(`构建 React SPA runtime: ${command}`);
   } else {
     print(`构建 React SPA runtime: ${command}`);
   }
-  const result = spawnSync(command, [], {
-    cwd: process.cwd(),
-    shell: true,
-    stdio: options.jsonOutput ? 'pipe' : 'inherit',
-    encoding: options.jsonOutput ? 'utf8' : undefined,
-    env: {
-      ...process.env,
-      OPENXIANGDA_APP_TYPE: options.appType,
-      APP_TYPE: options.appType,
-      OPENXIANGDA_BUILD_ID: options.buildId,
-      OPENXIANGDA_RUNTIME_ASSET_BASE: options.assetBaseUrl,
-    },
+  await new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(command, [], {
+        cwd: process.cwd(),
+        shell: true,
+        stdio: options.jsonOutput
+          ? ['ignore', 'pipe', 'pipe']
+          : 'inherit',
+        env: {
+          ...process.env,
+          OPENXIANGDA_APP_TYPE: options.appType,
+          APP_TYPE: options.appType,
+          OPENXIANGDA_BUILD_ID: options.buildId,
+          OPENXIANGDA_RUNTIME_ASSET_BASE: options.assetBaseUrl,
+        },
+      });
+    } catch (error) {
+      reject(
+        new Error(`runtime build 无法启动: ${error?.message || String(error)}`)
+      );
+      return;
+    }
+    if (options.jsonOutput) {
+      child.stdout?.on('data', chunk => {
+        process.stderr.write(maskText(String(chunk)));
+      });
+      child.stderr?.on('data', chunk => {
+        process.stderr.write(maskText(String(chunk)));
+      });
+    }
+    child.once('error', error => {
+      reject(new Error(`runtime build 无法启动: ${error.message}`));
+    });
+    child.once('close', (code, signal) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      reject(
+        new Error(
+          `runtime build 失败: ${
+            Number.isInteger(code) ? `exit ${code}` : `signal ${signal || '-'}`
+          }`
+        )
+      );
+    });
   });
-  if (options.jsonOutput) {
-    if (result.stdout) process.stderr.write(maskText(result.stdout));
-    if (result.stderr) process.stderr.write(maskText(result.stderr));
-  }
-  if (result.error) fail(`runtime build 无法启动: ${result.error.message}`);
-  if (result.status !== 0) fail(`runtime build 失败: exit ${result.status}`);
 }
 
 function assertRuntimeBuildReady(explicitCommand) {
@@ -23461,6 +23809,32 @@ function publishContextHeadersForRequest(config, profileName, apiPath, options =
   );
 }
 
+function isPublishMutationRequest(apiPath, options = {}) {
+  const method = String(options.method || 'GET').toUpperCase();
+  if (['GET', 'HEAD', 'OPTIONS'].includes(method)) return false;
+  const normalizedPath = String(apiPath || '').split('?')[0];
+  if (
+    normalizedPath.includes('/publish-lease/') ||
+    normalizedPath.endsWith('/publish-lease/acquire') ||
+    normalizedPath.includes('/change-baselines')
+  ) {
+    return false;
+  }
+  if (
+    normalizedPath.endsWith('/oss-upload-plan') &&
+    options.body?.planOnly === true
+  ) {
+    return false;
+  }
+  if (
+    normalizedPath.endsWith('/schema-storage-plan') ||
+    normalizedPath.endsWith('/storage-plan')
+  ) {
+    return false;
+  }
+  return true;
+}
+
 async function requestWithAuth(config, profileName, apiPath, options = {}) {
   assertReadOnlyHttpRequest(apiPath, options);
   const resolved = getProfile(config, profileName);
@@ -23482,6 +23856,9 @@ async function requestWithAuth(config, profileName, apiPath, options = {}) {
     ) {
       await activePublishLeaseHeartbeat?.heartbeat?.beforeWrite();
     }
+    if (isPublishMutationRequest(apiPath, requestOptions)) {
+      markCommandScopedPublishWriteAttempted();
+    }
     // Build headers after the lease check: a successful renew may replace the
     // live client session/expiry metadata, and auth/transient retries must not
     // replay stale publish context.
@@ -23542,6 +23919,7 @@ async function requestFormWithAuth(config, profileName, apiPath, formDataFactory
     if (!skipPublishLeaseHeartbeat) {
       await activePublishLeaseHeartbeat?.heartbeat?.beforeWrite();
     }
+    markCommandScopedPublishWriteAttempted();
     const currentRequestOptions = {
       ...requestOptions,
       headers: {
@@ -23759,7 +24137,7 @@ function normalizeWorkspacePublishOptions(flags) {
   };
 }
 
-function runWorkspacePublish(profileName, profile, appType, publishArgs = []) {
+async function runWorkspacePublish(profileName, profile, appType, publishArgs = []) {
   const packageFile = path.join(process.cwd(), 'package.json');
   if (!fs.existsSync(packageFile)) {
     fail('当前目录没有 package.json，无法识别工作区发布脚本');
@@ -23781,14 +24159,13 @@ function runWorkspacePublish(profileName, profile, appType, publishArgs = []) {
     ? ['run', scriptName, '--', ...publishArgs]
     : ['run', scriptName];
   const globalEnv = loadGlobalEnv();
-  const result = spawnSync(command, args, {
+  await runWorkspaceChildCommand(command, args, {
     cwd: process.cwd(),
-    stdio: 'inherit',
     env: buildWorkspacePublishEnv(profileName, profile, appType, globalEnv),
+    failureCode: 'WORKSPACE_PUBLISH_FAILED',
+    label: scriptName,
+    marksPublishWrite: true,
   });
-  if (result.status !== 0) {
-    process.exit(result.status || 1);
-  }
 }
 
 function isReactSpaWorkspace() {
@@ -23798,7 +24175,12 @@ function isReactSpaWorkspace() {
   return /runtimeMode\s*:\s*['"]react-spa['"]/.test(content);
 }
 
-function runReactSpaFormSchemaPublish(profileName, profile, appType, publishOptions) {
+async function runReactSpaFormSchemaPublish(
+  profileName,
+  profile,
+  appType,
+  publishOptions
+) {
   const packageFile = path.join(process.cwd(), 'package.json');
   if (!fs.existsSync(packageFile)) {
     fail('当前目录没有 package.json，无法识别工作区发布脚本');
@@ -23818,14 +24200,41 @@ function runReactSpaFormSchemaPublish(profileName, profile, appType, publishOpti
     `React SPA 表单 schema 发布${publishOptions.dryRun ? ' (dry-run)' : ''}: ${publishOptions.targetForm}`
   );
   const globalEnv = loadGlobalEnv();
-  const result = spawnSync(command, args, {
+  await runWorkspaceChildCommand(command, args, {
     cwd: process.cwd(),
-    stdio: 'inherit',
     env: buildWorkspacePublishEnv(profileName, profile, appType, globalEnv),
+    failureCode: 'FORM_SCHEMA_PUBLISH_FAILED',
+    label: `form schema ${publishOptions.targetForm}`,
+    marksPublishWrite: true,
+  });
+}
+
+async function runWorkspaceChildCommand(command, args, options = {}) {
+  await new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd || process.cwd(),
+      stdio: 'inherit',
+      env: options.env || process.env,
+    });
+    child.once('spawn', () => {
+      if (options.marksPublishWrite) {
+        markCommandScopedPublishWriteAttempted();
+      }
+    });
+    child.once('error', reject);
+    child.once('close', (code, signal) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      const error = new Error(
+        `${options.label || command} 执行失败${signal ? `（signal=${signal}）` : `（exit=${code ?? 1}）`}`
+      );
+      error.code = options.failureCode || 'WORKSPACE_CHILD_COMMAND_FAILED';
+      error.exitCode = Number.isInteger(code) ? code : 1;
+      reject(error);
+    });
   });
-  if (result.status !== 0) {
-    process.exit(result.status || 1);
-  }
 }
 
 function buildWorkspacePublishEnv(profileName, profile, appType, globalEnv) {

package/lib/publish-lease-heartbeat.js

@@ -1,5 +1,5 @@
 const DEFAULT_HEARTBEAT_INTERVAL_MS = 30_000;
-const DEFAULT_RENEW_WINDOW_MS = 180_000;
+const DEFAULT_RENEW_WINDOW_MS = 60_000;
 
 class PublishLeaseLostError extends Error {
   constructor(message, cause) {

package/lib/publish-lease.js

@@ -4,8 +4,8 @@ const path = require('path');
 
 const { saveProjectState } = require('./config');
 
-const DEFAULT_CLI_PUBLISH_LEASE_TTL_SECONDS = 1800;
-const PUBLISH_LEASE_RENEW_WINDOW_SECONDS = 180;
+const DEFAULT_CLI_PUBLISH_LEASE_TTL_SECONDS = 120;
+const PUBLISH_LEASE_RENEW_WINDOW_SECONDS = 60;
 
 function getStoredPublishLease(target) {
   const lease = target?.bound?.promotion?.publishLease;

package/lib/task-status.js

@@ -1,5 +1,6 @@
 function buildTaskStatus(input = {}) {
   const execution = object(input.execution);
+  const directPublish = object(input.directPublish);
   const steps = Array.isArray(execution?.steps) ? execution.steps : [];
   const completed = steps.filter(step => step.status === 'completed');
   const failed = steps.find(step => step.status === 'failed') || null;
@@ -7,12 +8,28 @@ function buildTaskStatus(input = {}) {
     steps.find(step => ['running', 'write-started'].includes(step.status)) ||
     null;
   const pending = steps.filter(step => step.status === 'pending');
-  const releaseState = execution?.status || 'not-started';
+  const releaseState =
+    execution?.status ||
+    (directPublish?.status === 'completed'
+      ? 'direct-publish-completed'
+      : 'not-started');
   const postCommit = object(input.postCommit);
   const remoteLease = object(input.remoteLease);
   const taskResult = object(input.taskResult);
   const integration = object(input.integration);
   const change = object(input.change);
+  const sourceRevision =
+    object(input.sourceRevision) ||
+    object(directPublish?.sourceRevision) ||
+    object(execution?.releaseSourceRevision) ||
+    object(execution?.releaseContext?.releaseSourceRevision);
+  const changeId =
+    input.changeId || change?.id || execution?.changeId || null;
+  const leaseBlocked = isRemoteLeaseBlocking({
+    remoteLease,
+    execution,
+    changeId,
+  });
   const phase = inferPhase({
     releaseState,
     steps,
@@ -29,14 +46,19 @@ function buildTaskStatus(input = {}) {
     remoteLease,
     integration,
     postCommit,
+    leaseBlocked,
   });
   const startedAt =
     execution?.createdAt ||
+    directPublish?.completedAt ||
     change?.createdAt ||
     taskResult?.recordedAt ||
     null;
   const endedAt =
     execution?.completedAt ||
+    (releaseState === 'direct-publish-completed'
+      ? directPublish?.completedAt
+      : null) ||
     (phase === 'integration-ready' ? taskResult?.recordedAt : null);
   const now = Number.isFinite(Number(input.now))
     ? Number(input.now)
@@ -49,17 +71,18 @@ function buildTaskStatus(input = {}) {
     running,
   );
   const wrotePlatform = Boolean(
-    execution?.writeAttempted ||
+    directPublish?.writeAttempted ||
+      execution?.writeAttempted ||
       execution?.stagedWriteOccurred ||
       completed.some(step => step.id !== 'lease-and-capture'),
   );
   const healthy =
-    releaseState === 'completed' &&
+    ['completed', 'direct-publish-completed'].includes(releaseState) &&
     (!postCommit || postCommit.status === 'completed');
 
   return {
     schemaVersion: 'openxiangda_task_status_v1',
-    changeId: input.changeId || change?.id || execution?.changeId || null,
+    changeId,
     phase,
     healthy,
     wrotePlatform,
@@ -73,8 +96,8 @@ function buildTaskStatus(input = {}) {
     },
     source: {
       changeStatus: change?.status || null,
-      taskCommit: taskResult?.commit || null,
-      taskReady: Boolean(taskResult),
+      taskCommit: taskResult?.commit || sourceRevision?.baseCommit || null,
+      taskReady: Boolean(taskResult || sourceRevision),
       integrated: inferIntegrated(integration),
     },
     release: {
@@ -86,6 +109,10 @@ function buildTaskStatus(input = {}) {
         remoteLease?.holder?.changeId ||
         remoteLease?.holder?.clientSessionId ||
         remoteLease?.changeId ||
+        remoteLease?.clientSessionId ||
+        (typeof remoteLease?.holder === 'string'
+          ? remoteLease.holder
+          : null) ||
         null,
     },
     blocker: blockingLayer
@@ -100,7 +127,7 @@ function buildTaskStatus(input = {}) {
           message:
             failed?.error?.message ||
             failed?.error ||
-            blockerMessage(blockingLayer),
+            blockerMessage(blockingLayer, remoteLease),
         }
       : null,
     nextAction: nextAction({
@@ -111,6 +138,7 @@ function buildTaskStatus(input = {}) {
       postCommit,
       taskResult,
       integration,
+      leaseBlocked,
     }),
   };
 }
@@ -124,6 +152,7 @@ function inferPhase(input) {
     return 'health';
   }
   if (input.releaseState === 'completed') return 'healthy';
+  if (input.releaseState === 'direct-publish-completed') return 'healthy';
   if (input.releaseState === 'write-review-required') return 'write-review';
   if (input.failed) return 'failed';
   if (input.running) return phaseFromStep(input.running.id);
@@ -163,13 +192,7 @@ function inferBlockingLayer(input) {
   if (input.postCommit?.status && input.postCommit.status !== 'completed') {
     return 'post-commit';
   }
-  if (
-    input.remoteLease?.active &&
-    input.releaseState !== 'running' &&
-    input.releaseState !== 'staged-resumable'
-  ) {
-    return 'lease';
-  }
+  if (input.leaseBlocked) return 'lease';
   if (input.integration && inferIntegrated(input.integration) === false) {
     return 'git-mainline';
   }
@@ -231,13 +254,26 @@ function nextAction(input) {
   if (input.failed) {
     return `修复 ${input.failed.id || '失败步骤'} 后重跑同一条 release publish。`;
   }
-  if (input.remoteLease?.active && input.releaseState === 'not-started') {
-    return '等待当前应用发布租约释放；开发与测试可继续并行。';
+  if (input.leaseBlocked) {
+    const holder =
+      input.remoteLease?.changeId ||
+      input.remoteLease?.clientSessionId ||
+      input.remoteLease?.holder?.changeId ||
+      input.remoteLease?.holder?.clientSessionId ||
+      input.remoteLease?.holder ||
+      '另一发布任务';
+    const expiry = input.remoteLease?.expiresAt
+      ? `，最晚 ${input.remoteLease.expiresAt} 到期`
+      : '';
+    return `等待 ${holder} 释放当前应用租约${expiry}；本任务尚未写平台，可继续本地开发与测试。`;
   }
   if (input.releaseState === 'staged-resumable') {
     return '重跑同一条 release publish，从已验证的 staged child 继续。';
   }
   if (input.releaseState === 'completed') return '执行业务验收并归档 change。';
+  if (input.releaseState === 'direct-publish-completed') {
+    return '直接发布已完成；执行业务验收并归档 change。';
+  }
   if (input.taskResult && inferIntegrated(input.integration) === false) {
     return '把 task commit 合并并推送到权威主分支，再创建 mainline bundle。';
   }
@@ -245,9 +281,11 @@ function nextAction(input) {
   return '完成实现和聚焦测试，提交后运行 sdd ready。';
 }
 
-function blockerMessage(layer) {
+function blockerMessage(layer, remoteLease) {
   const messages = {
-    lease: '另一个发布任务持有应用租约。',
+    lease: remoteLease?.changeId
+      ? `发布任务 ${remoteLease.changeId} 持有应用租约。`
+      : '另一个发布任务持有应用租约。',
     'git-mainline': '任务提交尚未完整进入权威主分支。',
     'post-commit': '发布已激活，提交后动作仍在自动重试。',
     'write-result': '上次写请求结果不确定，需要只读核对。',
@@ -255,6 +293,31 @@ function blockerMessage(layer) {
   return messages[layer] || '当前阶段需要处理失败后才能继续。';
 }
 
+function isRemoteLeaseBlocking(input = {}) {
+  const remote = object(input.remoteLease);
+  if (!remote?.active) return false;
+  const execution = object(input.execution);
+  const context = object(execution?.releaseContext);
+  if (
+    remote.leaseId &&
+    context?.leaseId &&
+    String(remote.leaseId) === String(context.leaseId)
+  ) {
+    return false;
+  }
+  if (
+    remote.clientSessionId &&
+    context?.clientSessionId &&
+    String(remote.clientSessionId) === String(context.clientSessionId) &&
+    (!remote.changeId ||
+      !input.changeId ||
+      String(remote.changeId) === String(input.changeId))
+  ) {
+    return false;
+  }
+  return true;
+}
+
 function object(value) {
   return value && typeof value === 'object' && !Array.isArray(value)
     ? value

package/openxiangda-skills/SKILL.md

@@ -10,6 +10,13 @@ OpenXiangda connects an AI coding workspace to the private low-code platform thr
 
 This file is a router and safety card. Read only the one or two subskills selected below; do not load every OpenXiangda reference into the same turn.
 
+## Keep the agent loop small
+
+- Start with one broad CodeGraph exploration that names the complete flow or feature. Use at most one focused follow-up when the first result explicitly omits a required symbol; do not repeat overlapping surveys.
+- Ordinary work uses this router plus one domain subskill. Add a second domain subskill only when the accepted scope genuinely crosses domains; three or more OpenXiangda subskills require stopping and narrowing the task.
+- When the user already supplied concrete requirements and acceptance criteria, record the structured SDD scope and implement. Do not turn a resolved request into a long design essay or ask for a duplicate confirmation.
+- During an unchanged lease/build wait, report the first blocker and then only material state changes. Prefer `openxiangda task status --watch` over repeated narrative updates.
+
 ## Decide the track
 
 | Intent | Read next | First action |
@@ -27,7 +34,7 @@ This file is a router and safety card. Read only the one or two subskills select
 ## Scope before work
 
 1. Work from the app workspace root and pass `--profile <name>` to every write or release command.
-2. In a shared or dirty checkout, use an isolated Git worktree/branch for development. Merge approved task commits into the authoritative remote default branch before any live release. Formal publish runs once from a clean local `main`/`master` that exactly equals the remote tip; feature worktrees never publish.
+2. In a shared app repository, reserve the canonical `main`/`master` checkout for integration and release. Every development task uses an isolated Git worktree/branch from the latest remote mainline; never stash, restore, or overwrite another task's changes to make the canonical checkout publishable. Merge approved task commits into the authoritative remote default branch before any live release. Formal publish runs once from a clean local `main`/`master` that exactly equals the remote tip; feature worktrees never publish.
 3. Give the task one stable SDD change id. Use `--change <id>` on context, plan, check, verify, publish, and archive commands when supported.
 4. Plan and publish exact resource codes with `--only <codes>` or `--code <code>`; a type-only or full-resource publish is allowed only when the dependency closure intentionally contains the whole type/application.
 5. A React SPA page change rebuilds one application runtime. Commit the complete build input first, upload/preview with `runtime deploy --no-activate`, and promote only from a clean merged release head that descends from the online Runtime source revision.

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -24,7 +24,9 @@ openxiangda sdd context --change <change> --changed --json
 
 Run `openxiangda update check --json` once per substantial task, on a suspected mismatch, or when the cached check is older than one day. If an update is installed, refresh skills once with `openxiangda skill install --force`.
 
-Every write/release command must include `--profile <name>`. Parallel tasks develop in isolated Git worktrees/branches, but do not publish there. Merge approved commits into the authoritative remote default branch, create one `sdd bundle` for the intended changes, commit/push it, and publish once from a clean local `main`/`master` that exactly equals the remote tip.
+Every write/release command must include `--profile <name>`. In a shared app repository the canonical main checkout is integration/release-only; parallel tasks develop in isolated Git worktrees/branches and never stash or restore another task's files. Merge approved commits into the authoritative remote default branch, create one `sdd bundle` for the intended changes, commit/push it, and publish once from a clean local `main`/`master` that exactly equals the remote tip.
+
+Keep investigation proportional: one complete CodeGraph survey plus at most one focused follow-up, normally one domain subskill, and no optional prose for a request whose requirements and acceptance criteria are already explicit. Unchanged lease waits should use `task status --watch` and emit only material transitions.
 
 SDD is structured-first by default: only `change.json`, `coverage.json`, and `release.json` are created. Generate optional prose with `openxiangda sdd render <change>`; missing checklist/evidence/spec prose is a warning, while approval, exact structured scope, actual argv, mainline identity, child CAS, lease, and atomic activation remain hard gates. Set `strictDocumentation: true` only when prose completion must intentionally block a workspace.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.176",
+  "version": "1.0.177",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {

package/templates/openxiangda-react-spa/AGENTS.md

@@ -5,10 +5,11 @@
 
 ## 开发原则
 
-- 架构类需求默认只规划、不实现。新应用、复杂页面、登录注册、公开访问、权限数据范围、流程自动化、连接器/通知等需求，先运行 `openxiangda doctor --json` 和 `openxiangda design gates --topic <code> --json`，输出设计并等用户确认；确认前只允许读取、快照、dry-run、提问和写设计文档，不允许改源码、写平台、发布或发送通知。
+- 架构类需求先运行 `openxiangda doctor --json` 和 `openxiangda design gates --topic <code> --json`。只有仍存在会改变实现方向的业务、安全或数据选择时才输出设计并等待确认；用户已经给出具体需求与验收标准时，直接记录结构化 SDD 范围并实现，不再写长篇设计或重复确认。
 - 先按风险分级：只读/文档/测试为 L0；纯文案样式或单一既有资源绑定等可逆窄改为 L1，可用受限的 `openxiangda sdd quick` 记录精确范围；表单结构、业务函数、自动化/流程、权限、登录/公开访问、数据写入和 runtime/config 为 L2；不可逆、生产迁移或应用级扩权为 L3。L2/L3 必须挂完整 SDD，并由 `coverage.json` 把需求与场景映射到精确的文件、表单、页面及工程资源范围。
 - 一个开发任务只使用一个显式 change，并从 `openxiangda sdd context --change <change> --changed --json` 开始；默认只维护 change/coverage/release 三份结构化事实源，需要文档时才执行 `openxiangda sdd render <change>`。结构化 approval、资源和文件范围是硬约束，任务/证据/规格文案默认只告警。只有明确配置 `strictDocumentation: true` 才把文案完成度恢复为门禁。
-- 多会话开发使用独立 Git worktree/branch，但 feature worktree 不发布。把已批准提交合并并 push 到权威默认主分支后，用 `sdd bundle <release-change> --changes ...` 聚合范围；只从与远端 tip 完全一致的 clean `main`/`master` 一次发布。
+- 多会话开发把规范的 `main`/`master` 检出专用于集成和发布；每个开发任务从最新远端主线使用独立 Git worktree/branch，禁止为了发布 stash/restore 或覆盖其他任务的文件。feature worktree 不发布。把已批准提交合并并 push 到权威默认主分支后，用 `sdd bundle <release-change> --changes ...` 聚合范围；只从与远端 tip 完全一致的 clean `main`/`master` 一次发布。
+- 调查预算默认为一次覆盖完整调用链的 CodeGraph 查询，只有明确缺失符号时再补一次精确查询；普通任务只加载一个领域技能。租约、构建或部署状态未变化时不重复输出相同进度，使用 `openxiangda task status --watch` 等待状态变化。
 - 账号、角色、权限、数据范围、组织账号、RBAC、查询参数授权需求必须先运行 `openxiangda design gates --topic permissions --json`，选择 `managed-platform-account` / `existing-platform-user-assignment` / `static-role-permission` / `query-param-context`，输出权限矩阵后再实现。
 - 应用角色只读查询组织账号时声明 `app:organization:read`；创建、修改账号/部门或重置密码时声明 `app:organization:manage`。创建角色、分配成员或维护权限组也必须在角色资源的 `apiPermissionCodes` 声明对应的 `app:role:manage`、`app:page-permission-group:manage`、`app:form-permission-group:manage`。
 - 默认用户界面保持克制：左侧应用导航、顶部账号信息、首页内容区域。

package/templates/sy-lowcode-app-workspace/AGENTS.md

@@ -8,7 +8,9 @@
 
 **所有"发布 / 上线 / 部署 / publish / deploy / ship / release"请求，唯一正确入口是 `openxiangda workspace publish --profile <name>`，不要直接 `pnpm publish:all`。**
 
-**架构类需求默认只规划、不实现。** 新应用、复杂页面、登录注册、公开访问、权限数据范围、流程自动化、连接器/通知等需求，先 `openxiangda doctor --json` + `openxiangda design gates --topic <code> --json`，输出设计并等待用户确认；确认前只允许读取、快照、dry-run、提问和写设计文档，不允许改源码、写平台、发布、部署或发送通知。
+**架构类需求先过设计门。** 新应用、复杂页面、登录注册、公开访问、权限数据范围、流程自动化、连接器/通知等需求，先 `openxiangda doctor --json` + `openxiangda design gates --topic <code> --json`。只有仍存在会改变实现方向的业务、安全或数据选择时才输出设计并等待确认；用户已经给出具体需求与验收标准时，直接记录结构化 SDD 范围并实现，不再写长篇设计或重复确认。
+
+共享应用仓库把规范 `main`/`master` 检出专用于集成和发布；每个开发任务从最新远端主线使用独立 Git worktree/branch，禁止为了发布 stash/restore 或覆盖其他任务文件。调查默认只做一次完整 CodeGraph 查询，明确缺失时最多补一次精确查询；普通任务只加载一个领域技能。等待状态未变化时使用 `openxiangda task status --watch`，不要重复输出相同进度。
 
 **按风险分级治理。** 只读/文档/测试为 L0；纯文案样式或单一既有资源绑定等窄小可逆改动为 L1，可用受限的 `openxiangda sdd quick` 记录精确范围；表单结构、业务 Function、Automation/Workflow、权限、登录/公开访问、数据写入和 runtime/config 为 L2；不可逆、生产迁移或应用级扩权为 L3。L2/L3 必须挂完整 SDD，并由 `coverage.json` 把需求与场景映射到精确的文件、表单、页面及工程资源范围。