openxiangda 1.0.177 → 1.0.178

package/README.md

@@ -58,9 +58,15 @@ User tokens are stored in `~/.openxiangda/profiles.json` with `0600` permissions
 
 `resource plan` and `resource publish --dry-run` run behind a strict GET/HEAD-only HTTP guard. If a read receives HTTP 401, the command fails with `READ_ONLY_AUTH_REQUIRED` and never calls the token refresh POST from inside the plan. Run `openxiangda auth refresh --profile <name>` (or log in again) before retrying; a plan must not mutate auth state or platform resources.
 
+For Function/Automation plans, `formFieldContracts` checks statically declared
+Form filter/order fields against frozen online Form schemas. A missing binding
+or field makes publish fail before lease/write; dynamic field names are checked
+again by the platform before SQL and return `FORM_FIELD_NOT_FOUND` instead of a
+database-column error.
+
 React SPA workspaces publish their frontend with `openxiangda runtime deploy`. Every finalized Runtime release is built from a clean, committed Git `HEAD`; the CLI freezes `sourceRevision`, the current active release, and its source revision before any build/upload. Deploy fails with `RUNTIME_SOURCE_BASE_DIVERGED` when its `HEAD` does not descend from the online Runtime source, including with `--no-activate`, so an old isolated worktree cannot stage and later activate a silent rollback. `.openxiangda/`, `openspec/`, `dist/`, and other pure generated/governance/state paths do not make the source dirty, but `--no-build` cannot bypass the lineage gate. An intentional rollback requires `--allow-runtime-rollback --reason "<at least 8 characters>"`, which is persisted for audit and never bypasses dirty/non-Git checks.
 
-Parallel tasks develop and test in isolated worktrees, but feature worktrees do not publish. After approved commits are merged and pushed, `sdd bundle <release-change> --changes ...` unions their exact structured scope. Commit/push the bundle, then run `release publish --change <release-change> --profile <name>` from a clean local main/master whose commit exactly equals the authoritative remote tip. It verifies without rewriting reviewed SDD files, waits for the app lease, freezes one authoritative App capture, executes exact Form/Backend/Runtime staged steps, atomically finalizes the Root App release, and records a resumable local execution journal. Runtime checks use the narrow head endpoint; immutable Git-base artifact hashes are reused across plans.
+Parallel tasks develop and test in isolated worktrees, but feature worktrees do not publish. After approved commits are merged and pushed, `sdd bundle <release-change> --changes ...` unions their exact structured scope and preserves the source changes' common Git baseline instead of adopting the post-merge `HEAD`. Old imported changes that predate source-base metadata must pass `--source-base-ref <commit>` explicitly. Commit/push the bundle, then run `release publish --change <release-change> --profile <name>` from a clean local main/master whose commit exactly equals the authoritative remote tip. It verifies without rewriting reviewed SDD files, waits for the app lease, freezes one authoritative App capture, executes exact Form/Backend/Runtime staged steps, atomically finalizes the Root App release, and records a resumable local execution journal. Runtime checks use the narrow head endpoint; immutable Git-base artifact hashes are reused across plans.
 
 Because promotion starts from an already-pushed authoritative mainline commit, `openxiangda release integration-status --profile <name>` should pass immediately after activation. Run it and `release end`; there is no post-release merge step.
 

package/lib/cli.js

@@ -82,6 +82,10 @@ const {
   writeContentCache,
 } = require('./content-cache');
 const { explainReleaseExecution } = require('./release-explain');
+const {
+  classifyReleaseExecutionFailure,
+  isDefinitelyPreWriteReleaseError,
+} = require('./release-error-classification');
 const { buildTaskStatus, findAppReleaseId } = require('./task-status');
 const {
   checkEngineeringPolicyMarkers,
@@ -94,6 +98,10 @@ const {
   getImpactedResourceTargets,
   validateManifestSourceBindings,
 } = require('./source-dependencies');
+const {
+  collectFormSnapshotFieldIds,
+  validateFormFieldContracts,
+} = require('./form-field-contract');
 const { getSkillStatusReport, installSkills } = require('./skills');
 const {
   assertOrClaimWorktreeOwner,
@@ -705,7 +713,7 @@ async function sdd(args) {
       '  openxiangda sdd quick tune-customer-copy --kind copy --pages customer_list --files src/pages/customer_list/index.tsx --summary "用户确认小范围文案调整"',
       '  openxiangda sdd approve add-customer-list --summary "用户确认设计"',
       '  openxiangda sdd ready add-customer-list',
-      '  openxiangda sdd bundle mainline-release --changes add-customer-list,fix-order-log',
+      '  openxiangda sdd bundle mainline-release --changes add-customer-list,fix-order-log [--source-base-ref <commit>]',
       '  openxiangda sdd context --change add-customer-list --json',
       '  openxiangda sdd verify --change add-customer-list --stage prepublish --json',
       '  openxiangda sdd render add-customer-list  # 仅在确实需要完整文档时',
@@ -720,6 +728,7 @@ async function sdd(args) {
       '  - verify stage 可选 implementation、prepublish、postpublish、archive；不传保持旧版全量校验。',
       '  - 默认 streamlined 校验只把 approval、精确资源/文件范围、实际发布命令作为硬门禁；任务、证据和规格文案仅告警。配置 strictDocumentation: true 可恢复严格文档门禁。',
       '  - bundle 聚合多个 approved change；提交并推送该 bundle 后，在权威主分支执行一次 staged + atomic 发布。',
+      '  - bundle 默认保留来源 change 创建时的共同 Git 基线；仅迁移旧 change 缺少 sourceBase 时使用 --source-base-ref 显式补充。',
       '  - 新 release 只能从已推送且与权威远端默认主分支一致的 clean HEAD 开始。',
     ].join('\n'));
     return;
@@ -800,6 +809,7 @@ async function sdd(args) {
       changes: flags.changes,
       integration,
       profile: flags.profile,
+      sourceBaseRef: flags['source-base-ref'],
       force: Boolean(flags.force),
     });
     if (flags.json) return writeJson(result);
@@ -824,6 +834,7 @@ async function sdd(args) {
       changeId,
       targets: scope.targets,
       changedFiles: scope.changedFiles,
+      sourceBase: scope.change?.sourceBase,
     });
     const ownerStatus = getWorktreeOwnerStatus({ cwd: process.cwd() });
     if (
@@ -1138,30 +1149,6 @@ function releaseExecutionContextFromBegin(result, target, changeId) {
   };
 }
 
-function isDefinitelyPreWriteReleaseError(error) {
-  const code = String(error?.code || '');
-  if (new Set([
-    'RELEASE_PUBLISH_REVISION_CHANGED',
-    'RELEASE_SOURCE_DIRTY',
-    'RELEASE_SOURCE_BRANCH_REQUIRED',
-    'RELEASE_SOURCE_MAINLINE_REQUIRED',
-    'RELEASE_SOURCE_MAINLINE_NOT_PUSHED',
-    'RELEASE_SOURCE_BEHIND_MAIN',
-    'RELEASE_GIT_AUTH_REQUIRED',
-    'RELEASE_MAIN_BRANCH_UNRESOLVED',
-    'RELEASE_MAIN_REF_UNVERIFIED',
-    'SDD_PREPUBLISH_FAILED',
-    'PUBLISH_CONTEXT_REQUIRED',
-    'APP_RELEASE_STAGED_SCOPE_REQUIRED',
-    'APP_RELEASE_STAGED_SCOPE_MISMATCH',
-  ]).has(code)) {
-    return true;
-  }
-  return /^(?:SDD_|RELEASE_(?:SOURCE|GIT|MAINLINE|MAIN_BRANCH|MAIN_REF)|RUNTIME_(?:SOURCE|BUILD|PACKAGE|DEPENDENCY))/.test(
-    code
-  );
-}
-
 function parseChildJsonOutput(stdout) {
   const text = String(stdout || '').trim();
   if (!text) return null;
@@ -1691,11 +1678,11 @@ async function publishWorkspaceRelease(config, target, flags = {}) {
         execution.writeAttempted = true;
       }
     }
-    execution.status = execution.stagedWriteOccurred
-      ? 'staged-resumable'
-      : execution.writeAttempted
-        ? 'write-review-required'
-        : 'failed';
+    execution.status = classifyReleaseExecutionFailure({
+      error,
+      stagedWriteOccurred: execution.stagedWriteOccurred,
+      writeAttempted: execution.writeAttempted,
+    });
     execution.updatedAt = new Date().toISOString();
     writePrivateJsonAtomic(releaseExecutionFile(changeId), execution);
     if (!execution.writeAttempted) {
@@ -3822,9 +3809,25 @@ function resolveChangeSourceBase(changeId, flags = {}) {
   if (!explicitBaseRef && changeId) {
     try {
       const scope = getSddChangeScope({ cwd: process.cwd(), changeId });
-      const recorded = scope?.change?.sourceBase;
+      const recorded =
+        scope?.change?.sourceBase ||
+        scope?.release?.sourceBase;
       if (recorded?.baseCommit && recorded?.treeHash) return recorded;
-    } catch {
+      const recordedBaseRevision =
+        scope?.change?.baseRevision ||
+        scope?.release?.baseRevision;
+      if (recordedBaseRevision) {
+        return readGitSourceBase(process.cwd(), recordedBaseRevision);
+      }
+      if (scope?.change?.changeMode === 'mainline-bundle') {
+        const error = new Error(
+          `SDD_SOURCE_BASE_REQUIRED: mainline bundle ${changeId} 缺少 sourceBase/baseRevision，禁止退化为当前 HEAD`
+        );
+        error.code = 'SDD_SOURCE_BASE_REQUIRED';
+        throw error;
+      }
+    } catch (error) {
+      if (error?.code === 'SDD_SOURCE_BASE_REQUIRED') throw error;
       // A direct release may use --change without a local SDD record. In that
       // case the current Git HEAD is still a deterministic, auditable base.
     }
@@ -10494,6 +10497,18 @@ async function resource(args) {
       error.missingSecretRefs = missing;
       throw error;
     }
+    if (publishPlan.formFieldContracts?.valid === false) {
+      const violations = publishPlan.formFieldContracts.errors || [];
+      const error = new Error(
+        `FORM_FIELD_CONTRACT_INVALID: ${violations
+          .slice(0, 8)
+          .map(item => item.message)
+          .join('; ')}`
+      );
+      error.code = 'FORM_FIELD_CONTRACT_INVALID';
+      error.violations = violations;
+      throw error;
+    }
     const pruneCandidates = flags.prune
       ? await telemetry.runPhase('prune-plan', async () =>
           collectPruneResourceCandidates(config, target, manifest)
@@ -15053,6 +15068,18 @@ async function publishResourcesForWorkspace(config, profileName, options = {}) {
   }
   const target = getWorkspaceTarget(config, profileName, {});
   const plan = await buildResourcePlan(config, target, manifest);
+  if (plan.formFieldContracts?.valid === false) {
+    const violations = plan.formFieldContracts.errors || [];
+    const error = new Error(
+      `FORM_FIELD_CONTRACT_INVALID: ${violations
+        .slice(0, 8)
+        .map(item => item.message)
+        .join('; ')}`
+    );
+    error.code = 'FORM_FIELD_CONTRACT_INVALID';
+    error.violations = violations;
+    throw error;
+  }
   const pruneCandidates = options.prune
     ? await collectPruneResourceCandidates(config, target, manifest)
     : [];
@@ -15088,7 +15115,10 @@ async function buildResourcePlan(config, target, manifest) {
     manifest
   );
   await prepareManifestJsCodeBundlesForPlan(manifest);
-  const existing = await fetchExistingResourceMaps(config, target, manifest);
+  const [existing, formFieldContracts] = await Promise.all([
+    fetchExistingResourceMaps(config, target, manifest),
+    buildFormFieldContractPlan(config, target, manifest),
+  ]);
   const actions = [];
   addPlanActions(actions, 'role', manifest.roles, existing.roles, roleEquals);
   addPlanActions(actions, 'menu', manifest.menus, existing.menus, (item, current) => menuEquals(target.bound, item, current));
@@ -15128,6 +15158,7 @@ async function buildResourcePlan(config, target, manifest) {
     ...(manifest.resourceCodeFilters ? { resourceCodeFilters: manifest.resourceCodeFilters } : {}),
     actions,
     summary: summarizeActions(actions),
+    formFieldContracts,
     ...(functionSecretRefs
       ? {
           capabilities: {
@@ -16518,7 +16549,14 @@ async function publishResourceManifest(config, target, manifest, options = {}) {
   }
 
   await publishRoleResources(config, target, manifest.roles || [], result, publishOptions);
-  await publishFormSettingsResources(config, target, manifest.formSettings || [], result, publishOptions);
+  await publishFormSettingsResources(
+    config,
+    target,
+    manifest.formSettings || [],
+    manifest.formPermissionGroups || [],
+    result,
+    publishOptions
+  );
   await publishMenuResources(config, target, manifest.menus || [], result, publishOptions);
   await publishConnectorResources(config, target, manifest.connectors || [], result, publishOptions);
   await publishNotificationResources(config, target, manifest.notifications || [], result, publishOptions);
@@ -16548,7 +16586,13 @@ async function publishResourceManifest(config, target, manifest, options = {}) {
   await publishStorageConfigResources(config, target, manifest.storageConfigs || [], result, publishOptions);
   await publishPublicAccessPolicyResources(config, target, manifest.publicAccessPolicies || [], result, publishOptions);
   await publishPagePermissionGroupResources(config, target, manifest.pagePermissionGroups || [], result, publishOptions);
-  await publishFormPermissionGroupResources(config, target, manifest.formPermissionGroups || [], result, publishOptions);
+  await publishFormPermissionGroupResources(
+    config,
+    target,
+    manifest.formPermissionGroups || [],
+    result,
+    publishOptions
+  );
   if (options.prune) {
     await pruneResourceManifest(
       config,
@@ -17939,22 +17983,82 @@ async function publishFormSettingsResources(
   config,
   target,
   settingsItems,
+  permissionGroups,
   result,
   options = {}
 ) {
+  const settingsByForm = new Map();
   for (const item of settingsItems) {
     const code = item.code || item.formCode || item.formUuid;
-    if (shouldSkipNoopResource(options, 'formSetting', code)) {
-      recordNoopResource(result, 'formSetting', code, options);
+    const formUuid = resolveManifestFormUuid(target.bound, item, {
+      fallbackToCode: true,
+    });
+    if (!formUuid) fail(`表单设置 ${code} 无法解析 formUuid`);
+    settingsByForm.set(formUuid, { item, code });
+  }
+  const changedGroupsByForm = new Map();
+  options.formReleaseHandledPermissionCodes =
+    options.formReleaseHandledPermissionCodes || new Set();
+  for (const group of permissionGroups || []) {
+    const code = group.code || group.resourceCode;
+    if (shouldSkipNoopResource(options, 'formPermissionGroup', code)) {
+      recordNoopResource(result, 'formPermissionGroup', code, options);
+      options.formReleaseHandledPermissionCodes.add(code);
       continue;
     }
-    const formUuid = resolveManifestFormUuid(target.bound, item, { fallbackToCode: true });
-    if (!formUuid) fail(`表单设置 ${code} 无法解析 formUuid`);
-    const action = getPlannedResourceAction(options, 'formSetting', code);
+    const formUuid = resolveManifestFormUuid(target.bound, group);
+    if (!formUuid) {
+      fail(`表单权限组 ${code} 无法解析 formUuid，不能进入 FormRelease`);
+    }
+    if (!changedGroupsByForm.has(formUuid)) {
+      changedGroupsByForm.set(formUuid, []);
+    }
+    changedGroupsByForm.get(formUuid).push(group);
+  }
+  const formUuids = unique([
+    ...settingsByForm.keys(),
+    ...changedGroupsByForm.keys(),
+  ]).sort();
+  for (const formUuid of formUuids) {
+    const setting = settingsByForm.get(formUuid);
+    const item = setting?.item || null;
+    const groups = changedGroupsByForm.get(formUuid) || [];
+    const code =
+      setting?.code ||
+      groups[0]?.formCode ||
+      groups[0]?.form ||
+      formUuid;
+    const settingNoop =
+      item && shouldSkipNoopResource(options, 'formSetting', code);
+    if (settingNoop) {
+      recordNoopResource(result, 'formSetting', code, options);
+    }
+    if (settingNoop && groups.length === 0) continue;
+    const action = item
+      ? getPlannedResourceAction(options, 'formSetting', code)
+      : null;
     const frozen =
       frozenFormConfigFromPlanAction(action) ||
       (await fetchFrozenFormConfig(config, target, formUuid));
-    const bundleBody = buildFormSettingBundleBody(item);
+    const bundleBody =
+      item && !settingNoop ? buildFormSettingBundleBody(item) : {};
+    if (groups.length > 0) {
+      bundleBody.permissionGroups = groups.map(group => {
+        const body = {
+          ...withoutResourceMeta(group),
+          resourceCode: group.code || group.resourceCode,
+          name: group.name || group.code || group.resourceCode,
+          type: group.type || 'view',
+          roles: group.roles || [],
+        };
+        delete body.code;
+        delete body.formCode;
+        delete body.form;
+        delete body.formUuid;
+        return body;
+      });
+      bundleBody.permissionGroupsMode = 'merge';
+    }
     const activate = options.activateFormBundles === true;
     const artifactId = stableFormArtifactId(
       'config-bundle',
@@ -17975,7 +18079,19 @@ async function publishFormSettingsResources(
       },
       { frozen, artifactId }
     );
-    saveResourceEntry(target, 'formSettings', code, { formUuid });
+    if (item) {
+      saveResourceEntry(target, 'formSettings', code, { formUuid });
+    }
+    for (const group of groups) {
+      const groupCode = group.code || group.resourceCode;
+      saveFormPermissionGroupResource(
+        target,
+        groupCode,
+        undefined,
+        { formUuid }
+      );
+      options.formReleaseHandledPermissionCodes.add(groupCode);
+    }
     const releaseId = data?.release?.id;
     const contentHash = String(
       data?.release?.contentHash || data?.contentHash || ''
@@ -18024,20 +18140,36 @@ async function publishFormSettingsResources(
         delete result.stagedResource;
       }
     }
-    result.published.push({
-      kind: 'formSetting',
-      code,
-      action: data?.noop ? 'noop' : data?.active ? 'update' : 'stage',
-      formUuid,
-      revision: data?.revision,
-      activeFormReleaseHead: data?.activeFormReleaseHead,
-      staged: Boolean(data?.staged),
-      active: Boolean(data?.active),
-      releaseStatus: data?.releaseStatus,
-      releaseId,
-      contentHash: contentHash || undefined,
-      ...(stagedResource ? { stagedResource } : {}),
-    });
+    if (item && !settingNoop) {
+      result.published.push({
+        kind: 'formSetting',
+        code,
+        action: data?.noop ? 'noop' : data?.active ? 'update' : 'stage',
+        formUuid,
+        revision: data?.revision,
+        activeFormReleaseHead: data?.activeFormReleaseHead,
+        staged: Boolean(data?.staged),
+        active: Boolean(data?.active),
+        releaseStatus: data?.releaseStatus,
+        releaseId,
+        contentHash: contentHash || undefined,
+        ...(stagedResource ? { stagedResource } : {}),
+      });
+    }
+    for (const group of groups) {
+      result.published.push({
+        kind: 'formPermissionGroup',
+        code: group.code || group.resourceCode,
+        action: data?.noop ? 'noop' : data?.active ? 'update' : 'stage',
+        formUuid,
+        staged: Boolean(data?.staged),
+        active: Boolean(data?.active),
+        releaseStatus: data?.releaseStatus,
+        releaseId,
+        contentHash: contentHash || undefined,
+        ...(stagedResource ? { stagedResource } : {}),
+      });
+    }
   }
 }
 
@@ -19158,38 +19290,24 @@ async function findExistingPagePermissionGroup(config, target, code) {
 
 async function publishFormPermissionGroupResources(config, target, groups, result, options = {}) {
   for (const group of groups) {
+    if (
+      options.formReleaseHandledPermissionCodes?.has(
+        group.code || group.resourceCode
+      )
+    ) {
+      continue;
+    }
     if (shouldSkipNoopResource(options, 'formPermissionGroup', group.code)) {
       recordNoopResource(result, 'formPermissionGroup', group.code, options);
       continue;
     }
-    const formUuid = resolveManifestFormUuid(target.bound, group);
-    const existing = await findExistingFormPermissionGroup(config, target, group.code, formUuid);
-    const body = {
-      ...withoutResourceMeta(group),
-      resourceCode: group.code,
-      formUuid,
-      name: group.name || group.code,
-      type: group.type || 'view',
-      roles: group.roles || [],
-    };
-    delete body.code;
-    delete body.formCode;
-    delete body.form;
-    const data = existing
-      ? await requestWithAuth(
-          config,
-          target.profileName,
-          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups/${encodeURIComponent(existing.id)}`,
-          { method: 'POST', body }
-        )
-      : await requestWithAuth(
-          config,
-          target.profileName,
-          `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}/permission-groups`,
-          { method: 'POST', body }
-        );
-    if (data?.id) saveFormPermissionGroupResource(target, group.code, data.id, { formUuid, name: data.name, resourceCode: group.code });
-    result.published.push({ kind: 'formPermissionGroup', code: group.code, action: existing ? 'update' : 'create', id: data?.id });
+    const error = new Error(
+      `FORM_PERMISSION_GROUP_STAGE_REQUIRED: ${
+        group.code || group.resourceCode
+      } 未进入 FormRelease，禁止回退为直接线上写入`
+    );
+    error.code = 'FORM_PERMISSION_GROUP_STAGE_REQUIRED';
+    throw error;
   }
 }
 
@@ -24233,8 +24351,104 @@ async function runWorkspaceChildCommand(command, args, options = {}) {
       error.code = options.failureCode || 'WORKSPACE_CHILD_COMMAND_FAILED';
       error.exitCode = Number.isInteger(code) ? code : 1;
       reject(error);
-    });
   });
+  });
+}
+
+async function buildFormFieldContractPlan(config, target, manifest) {
+  const targets = [];
+  for (const [manifestKey, kind] of [
+    ['functions', 'Function'],
+    ['automations', 'Automation'],
+    ['workflows', 'Workflow'],
+    ['jsCodeNodes', 'JsCodeNode'],
+  ]) {
+    for (const item of manifest[manifestKey] || []) {
+      const analysis = item.__sourceAnalysis;
+      if (!analysis?.formFieldReferences?.length) continue;
+      const code =
+        item.code ||
+        item.functionCode ||
+        item.resourceCode ||
+        item.scriptCode;
+      for (const reference of analysis.formFieldReferences) {
+        const formUuid = resolveManifestFormBindingForContract(
+          target,
+          item,
+          reference.formCode
+        );
+        targets.push({
+          kind,
+          code,
+          formCode: reference.formCode,
+          formUuid,
+          field: reference.field,
+          api: reference.api,
+          file: reference.file,
+          line: reference.line,
+        });
+      }
+    }
+  }
+  if (targets.length === 0) {
+    return {
+      contractVersion: 'form_field_contract_v1',
+      valid: true,
+      checkedForms: 0,
+      checkedReferences: 0,
+      errors: [],
+    };
+  }
+  const snapshots = new Map();
+  const formTargets = unique(
+    targets.map(item => item.formUuid).filter(Boolean)
+  ).sort();
+  await Promise.all(
+    formTargets.map(async formUuid => {
+      const frozen = await fetchFrozenFormConfig(
+        config,
+        target,
+        formUuid
+      );
+      snapshots.set(formUuid, collectFormSnapshotFieldIds(frozen.snapshot));
+    })
+  );
+  return validateFormFieldContracts(targets, snapshots);
+}
+
+function resolveManifestFormBindingForContract(target, item, formCode) {
+  const containers = [
+    item.resourceBindings,
+    item.resources,
+    item.definitionJson?.resourceBindings,
+    item.definitionJson?.resources,
+  ];
+  if (item.definitionFile) {
+    try {
+      const definition = JSON.parse(
+        fs.readFileSync(
+          path.resolve(item.__dir || process.cwd(), item.definitionFile),
+          'utf8'
+        )
+      );
+      containers.push(definition.resourceBindings, definition.resources);
+    } catch {
+      // Resource validation reports invalid definition files separately.
+    }
+  }
+  for (const container of containers) {
+    const binding = container?.forms?.[formCode];
+    if (typeof binding === 'string' && binding.trim()) return binding.trim();
+    const formUuid = String(
+      binding?.formUuid || binding?.id || binding?.uuid || ''
+    ).trim();
+    if (formUuid) return formUuid;
+  }
+  return resolveManifestFormUuid(
+    target.bound,
+    { formCode },
+    { fallbackToCode: false }
+  );
 }
 
 function buildWorkspacePublishEnv(profileName, profile, appType, globalEnv) {

package/lib/form-field-contract.js

@@ -0,0 +1,79 @@
+const FORM_QUERY_SYSTEM_FIELDS = new Set([
+  'approvalResult',
+  'createTime',
+  'currentApprovalNodeName',
+  'modifiedTime',
+  'originator',
+  'originatorCorp',
+  'originatorName',
+  'processInstanceId',
+  'processInstanceStatus',
+  'processInstanceTitle',
+]);
+
+function collectFormSnapshotFieldIds(snapshot) {
+  const fields = new Set();
+  const formFields = snapshot?.form?.formFields || {};
+  for (const [key, value] of Object.entries(formFields)) {
+    if (key) fields.add(String(key));
+    for (const candidate of [value?.fieldId, value?.field_id]) {
+      if (candidate) fields.add(String(candidate));
+    }
+  }
+  const visit = value => {
+    if (!value || typeof value !== 'object') return;
+    if (Array.isArray(value)) {
+      value.forEach(visit);
+      return;
+    }
+    const fieldId = value.fieldId || value.props?.fieldId;
+    if (fieldId) fields.add(String(fieldId));
+    Object.values(value).forEach(visit);
+  };
+  visit(snapshot?.form?.schema);
+  return fields;
+}
+
+function validateFormFieldContracts(targets, snapshots) {
+  const references = Array.isArray(targets) ? targets : [];
+  const snapshotFields =
+    snapshots instanceof Map ? snapshots : new Map(Object.entries(snapshots || {}));
+  const errors = [];
+  for (const item of references) {
+    const { code: resourceCode, ...detail } = item;
+    if (!item.formUuid) {
+      errors.push({
+        code: 'FORM_FIELD_CONTRACT_BINDING_MISSING',
+        resourceCode,
+        ...detail,
+        message: `${item.kind}:${resourceCode} ${item.file}:${item.line} 查询 ${item.formCode}.${item.field}，但无法解析该表单的 profile 绑定`,
+      });
+      continue;
+    }
+    if (
+      FORM_QUERY_SYSTEM_FIELDS.has(item.field) ||
+      snapshotFields.get(item.formUuid)?.has(item.field)
+    ) {
+      continue;
+    }
+    errors.push({
+      code: 'FORM_FIELD_CONTRACT_FIELD_MISSING',
+      resourceCode,
+      ...detail,
+      message: `${item.kind}:${resourceCode} ${item.file}:${item.line} 通过 ${item.api} 查询 ${item.formCode}.${item.field}，但线上 Form ${item.formUuid} 不存在该字段`,
+    });
+  }
+  return {
+    contractVersion: 'form_field_contract_v1',
+    valid: errors.length === 0,
+    checkedForms: new Set(references.map(item => item.formUuid).filter(Boolean)).size,
+    checkedReferences: references.length,
+    errors,
+  };
+}
+
+module.exports = {
+  FORM_QUERY_SYSTEM_FIELDS,
+  collectFormSnapshotFieldIds,
+  validateFormFieldContracts,
+};

package/lib/integration-bundle.js

@@ -2,7 +2,8 @@ const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
-const TASK_RESULT_SCHEMA_VERSION = 'openxiangda_task_result_v1';
+const TASK_RESULT_SCHEMA_VERSION = 'openxiangda_task_result_v2';
+const LEGACY_TASK_RESULT_SCHEMA_VERSION = 'openxiangda_task_result_v1';
 const INTEGRATION_BUNDLE_SCHEMA_VERSION = 'openxiangda_integration_bundle_v1';
 
 function runGit(cwd, args, options = {}) {
@@ -77,6 +78,16 @@ function recordIntegrationTaskResult(options = {}) {
     commit,
     treeHash,
     branch,
+    ...(options.sourceBase?.baseCommit && options.sourceBase?.treeHash
+      ? {
+          sourceBase: {
+            repo: options.sourceBase.repo,
+            baseCommit: options.sourceBase.baseCommit,
+            treeHash: options.sourceBase.treeHash,
+          },
+          baseRevision: options.sourceBase.baseCommit,
+        }
+      : {}),
     targets: options.targets || {},
     changedFiles: Array.from(
       new Set((options.changedFiles || []).map(String).filter(Boolean))
@@ -96,7 +107,10 @@ function readIntegrationTaskResult(cwd, changeId) {
   if (!fs.existsSync(file)) return null;
   try {
     const value = JSON.parse(fs.readFileSync(file, 'utf8'));
-    return value?.schemaVersion === TASK_RESULT_SCHEMA_VERSION
+    return [
+      TASK_RESULT_SCHEMA_VERSION,
+      LEGACY_TASK_RESULT_SCHEMA_VERSION,
+    ].includes(value?.schemaVersion)
       ? { ...value, file }
       : null;
   } catch {
@@ -146,6 +160,13 @@ function collectIntegrationTaskResults(options = {}) {
       commit: result.commit,
       treeHash: result.treeHash,
       sourceBranch: result.branch,
+      ...(result.sourceBase?.baseCommit && result.sourceBase?.treeHash
+        ? {
+            sourceBase: result.sourceBase,
+            baseRevision:
+              result.baseRevision || result.sourceBase.baseCommit,
+          }
+        : {}),
     })),
     verifiedAgainst: runGit(cwd, ['rev-parse', 'HEAD']).stdout,
     createdAt: new Date().toISOString(),

package/lib/release-error-classification.js

@@ -0,0 +1,41 @@
+const DEFINITELY_PRE_WRITE_CODES = new Set([
+  'APP_RELEASE_STAGED_SCOPE_MISMATCH',
+  'APP_RELEASE_STAGED_SCOPE_REQUIRED',
+  'BASELINE_SCOPE_MISSING',
+  'FORM_FIELD_CONTRACT_INVALID',
+  'PUBLISH_CONTEXT_REQUIRED',
+  'RELEASE_GIT_AUTH_REQUIRED',
+  'RELEASE_MAIN_BRANCH_UNRESOLVED',
+  'RELEASE_MAIN_REF_UNVERIFIED',
+  'RELEASE_PUBLISH_REVISION_CHANGED',
+  'RELEASE_SOURCE_BEHIND_MAIN',
+  'RELEASE_SOURCE_BRANCH_REQUIRED',
+  'RELEASE_SOURCE_DIRTY',
+  'RELEASE_SOURCE_MAINLINE_NOT_PUSHED',
+  'RELEASE_SOURCE_MAINLINE_REQUIRED',
+  'RESOURCE_FIELD_CONFLICT',
+  'SDD_PREPUBLISH_FAILED',
+  'SOURCE_BASE_DIVERGED',
+]);
+
+function isDefinitelyPreWriteReleaseError(error) {
+  const code = String(error?.code || '').trim();
+  if (DEFINITELY_PRE_WRITE_CODES.has(code)) return true;
+  return /^(?:SDD_|RELEASE_(?:SOURCE|GIT|MAINLINE|MAIN_BRANCH|MAIN_REF)|RUNTIME_(?:SOURCE|BUILD|PACKAGE|DEPENDENCY))/.test(
+    code
+  );
+}
+
+function classifyReleaseExecutionFailure({
+  stagedWriteOccurred = false,
+  writeAttempted = false,
+} = {}) {
+  if (stagedWriteOccurred) return 'staged-resumable';
+  if (writeAttempted) return 'write-review-required';
+  return 'failed';
+}
+
+module.exports = {
+  classifyReleaseExecutionFailure,
+  isDefinitelyPreWriteReleaseError,
+};

package/lib/sdd.js

@@ -1,6 +1,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { spawnSync } = require('child_process');
 const { readGitSourceBase } = require('./change-baseline');
 const { assertReleaseSourceIntegrated } = require('./release-mainline');
 const {
@@ -604,6 +605,7 @@ function createChangeMetadata(changeId, options = {}) {
         baseCommit: sourceBase.baseCommit,
         treeHash: sourceBase.treeHash,
       };
+      metadata.baseRevision = sourceBase.baseCommit;
     }
   } catch {
     // SDD can still be used before a workspace is initialized as a Git repo.
@@ -1013,6 +1015,30 @@ function createMainlineSddBundle(options = {}) {
   if (nested) {
     throw new Error(`mainline bundle 不允许嵌套: ${nested.changeId}`);
   }
+  const bundleSourceBase = resolveMainlineBundleSourceBase(
+    sourceChanges,
+    options
+  );
+  const integratedChanges = sourceChanges.map(item => {
+    const sourceBase =
+      normalizeSddSourceBase(item.meta.sourceBase) || bundleSourceBase;
+    const task = options.integration?.requiredCommits?.find(
+      candidate => candidate.changeId === item.changeId
+    );
+    return {
+      changeId: item.changeId,
+      sourceBase,
+      baseRevision:
+        item.meta.baseRevision || sourceBase.baseCommit,
+      ...(task
+        ? {
+            commit: task.commit,
+            treeHash: task.treeHash,
+            sourceBranch: task.sourceBranch,
+          }
+        : {}),
+    };
+  });
 
   const affected = mergeAffectedScopes(
     ...sourceChanges.flatMap(item => [
@@ -1041,16 +1067,19 @@ function createMainlineSddBundle(options = {}) {
   const createdAt = nowIso();
   const meta = {
     ...createChangeMetadata(changeId, {
+      cwd: options.cwd,
       title: options.title || `Mainline release: ${sourceIds.join(', ')}`,
       affected,
       changeMode: 'mainline-bundle',
       riskLevel: 'medium',
+      sourceBase: bundleSourceBase,
     }),
     status: 'approved',
     approvedAt: createdAt,
     approvedBy: 'mainline-release-coordinator',
     approvalSummary: `Aggregate approved changes on authoritative mainline: ${sourceIds.join(', ')}`,
     bundledChanges: sourceIds,
+    integratedChanges,
     createdAt,
     updatedAt: createdAt,
   };
@@ -1083,6 +1112,9 @@ function createMainlineSddBundle(options = {}) {
     changeId,
     mainlinePolicy: 'publish-from-main-v1',
     bundledChanges: sourceIds,
+    sourceBase: bundleSourceBase,
+    baseRevision: bundleSourceBase.baseCommit,
+    integratedChanges,
     ...(options.integration ? { integration: options.integration } : {}),
     targets: normalizedTargets.activationTargets,
     logicalTargets: normalizedTargets.logicalTargets,
@@ -1092,6 +1124,8 @@ function createMainlineSddBundle(options = {}) {
       `openxiangda release publish --change ${changeId} --profile ${profile}`,
     planHash: releasePlanHash({
       changeId,
+      baseRevision: bundleSourceBase.baseCommit,
+      integratedChanges,
       runtimeMode,
       targets: normalizedTargets.activationTargets,
       commands,
@@ -1137,6 +1171,103 @@ function createMainlineSddBundle(options = {}) {
   };
 }
 
+function normalizeSddSourceBase(value) {
+  if (!value?.baseCommit || !value?.treeHash) return null;
+  return {
+    repo: value.repo,
+    baseCommit: String(value.baseCommit),
+    treeHash: String(value.treeHash),
+  };
+}
+
+function runSddGit(cwd, args, options = {}) {
+  const result = spawnSync('git', args, {
+    cwd: cwd || process.cwd(),
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  if (result.status !== 0 && !options.allowFailure) {
+    const error = new Error(
+      String(result.stderr || result.stdout || `git ${args.join(' ')} failed`).trim()
+    );
+    error.code = 'SDD_SOURCE_BASE_GIT_FAILED';
+    throw error;
+  }
+  return {
+    ok: result.status === 0,
+    stdout: String(result.stdout || '').trim(),
+  };
+}
+
+function resolveMainlineBundleSourceBase(sourceChanges, options = {}) {
+  const cwd = options.cwd || process.cwd();
+  if (options.sourceBaseRef) {
+    return readGitSourceBase(cwd, options.sourceBaseRef);
+  }
+  const missing = sourceChanges.filter(
+    item => !normalizeSddSourceBase(item.meta.sourceBase)
+  );
+  if (missing.length > 0) {
+    const error = new Error(
+      `SDD_SOURCE_BASE_REQUIRED: ${missing
+        .map(item => item.changeId)
+        .join(', ')} 缺少创建变更时冻结的 sourceBase；请用 --source-base-ref <commit> 明确指定共同基线`
+    );
+    error.code = 'SDD_SOURCE_BASE_REQUIRED';
+    error.changes = missing.map(item => item.changeId);
+    throw error;
+  }
+  const sourceBases = sourceChanges.map(item =>
+    normalizeSddSourceBase(item.meta.sourceBase)
+  );
+  const repos = Array.from(
+    new Set(sourceBases.map(item => item.repo).filter(Boolean))
+  );
+  if (repos.length > 1) {
+    const error = new Error(
+      'SDD_SOURCE_BASE_REPOSITORY_MISMATCH: mainline bundle 的来源变更不属于同一 Git 仓库'
+    );
+    error.code = 'SDD_SOURCE_BASE_REPOSITORY_MISMATCH';
+    throw error;
+  }
+  for (const item of sourceChanges) {
+    const task = options.integration?.requiredCommits?.find(
+      candidate => candidate.changeId === item.changeId
+    );
+    if (
+      task?.commit &&
+      !runSddGit(cwd, [
+        'merge-base',
+        '--is-ancestor',
+        item.meta.sourceBase.baseCommit,
+        task.commit,
+      ], { allowFailure: true }).ok
+    ) {
+      const error = new Error(
+        `SDD_SOURCE_BASE_NOT_ANCESTOR: ${item.changeId} 的 sourceBase 不是任务提交 ${String(task.commit).slice(0, 12)} 的祖先`
+      );
+      error.code = 'SDD_SOURCE_BASE_NOT_ANCESTOR';
+      error.changeId = item.changeId;
+      throw error;
+    }
+  }
+  const commits = Array.from(
+    new Set(sourceBases.map(item => item.baseCommit))
+  );
+  const commonCommit =
+    commits.length === 1
+      ? commits[0]
+      : runSddGit(cwd, ['merge-base', '--octopus', ...commits]).stdout;
+  if (!commonCommit) {
+    const error = new Error(
+      'SDD_SOURCE_BASE_COMMON_ANCESTOR_REQUIRED: 来源变更没有可验证的共同 Git 基线'
+    );
+    error.code = 'SDD_SOURCE_BASE_COMMON_ANCESTOR_REQUIRED';
+    throw error;
+  }
+  return readGitSourceBase(cwd, commonCommit);
+}
+
 function loadSddChange(options = {}) {
   const governance = getSddGovernanceConfig(options);
   const changeId = normalizeChangeId(options.changeId);

package/lib/source-dependencies.js

@@ -245,6 +245,122 @@ function readStaticObjectProperty(expression, propertyNames, bindings) {
   return null;
 }
 
+function resolveStaticExpression(expression, bindings, seen = new Set()) {
+  const value = unwrapExpression(expression);
+  if (!value || !ts.isIdentifier(value)) return value;
+  if (seen.has(value.text)) return value;
+  const initializer = bindings.get(value.text);
+  if (!initializer) return value;
+  const nextSeen = new Set(seen);
+  nextSeen.add(value.text);
+  return resolveStaticExpression(initializer, bindings, nextSeen);
+}
+
+function readStaticObjectPropertyExpression(
+  expression,
+  propertyNames,
+  bindings
+) {
+  const value = resolveStaticExpression(expression, bindings);
+  if (!value || !ts.isObjectLiteralExpression(value)) return null;
+  for (const property of value.properties) {
+    if (!ts.isPropertyAssignment(property)) continue;
+    if (!propertyNames.includes(propertyNameText(property.name))) continue;
+    return property.initializer;
+  }
+  return null;
+}
+
+function collectStaticQueryFieldNodes(
+  expression,
+  bindings,
+  result,
+  fieldPropertyNames,
+  seen = new Set()
+) {
+  const value = resolveStaticExpression(expression, bindings, seen);
+  if (!value || seen.has(value)) return;
+  seen.add(value);
+  if (ts.isArrayLiteralExpression(value)) {
+    for (const element of value.elements) {
+      collectStaticQueryFieldNodes(
+        element,
+        bindings,
+        result,
+        fieldPropertyNames,
+        seen
+      );
+    }
+    return;
+  }
+  if (!ts.isObjectLiteralExpression(value)) return;
+  for (const property of value.properties) {
+    if (ts.isSpreadAssignment(property)) {
+      collectStaticQueryFieldNodes(
+        property.expression,
+        bindings,
+        result,
+        fieldPropertyNames,
+        seen
+      );
+      continue;
+    }
+    if (!ts.isPropertyAssignment(property)) continue;
+    const name = propertyNameText(property.name);
+    if (fieldPropertyNames.has(name)) {
+      const field = readStaticString(property.initializer, bindings);
+      if (field) result.push({ field, node: property.initializer });
+    }
+    collectStaticQueryFieldNodes(
+      property.initializer,
+      bindings,
+      result,
+      fieldPropertyNames,
+      seen
+    );
+  }
+}
+
+function addFormFieldReferences(
+  formFieldReferences,
+  sourceFile,
+  workspaceRoot,
+  bindings,
+  formCode,
+  inputExpression,
+  api
+) {
+  if (!formCode || !inputExpression) return;
+  const fields = [];
+  for (const propertyName of ['filters', 'order']) {
+    const expression = readStaticObjectPropertyExpression(
+      inputExpression,
+      [propertyName],
+      bindings
+    );
+    if (expression) {
+      collectStaticQueryFieldNodes(
+        expression,
+        bindings,
+        fields,
+        new Set(
+          propertyName === 'order'
+            ? ['id', 'key', 'field', 'fieldId']
+            : ['key', 'field', 'fieldId']
+        )
+      );
+    }
+  }
+  for (const item of fields) {
+    formFieldReferences.push({
+      formCode,
+      field: item.field,
+      api,
+      ...sourceLocation(sourceFile, item.node, workspaceRoot),
+    });
+  }
+}
+
 function sourceLocation(sourceFile, node, workspaceRoot) {
   const start = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
   return {
@@ -274,10 +390,46 @@ function addDynamicReferenceWarning(warnings, sourceFile, node, workspaceRoot, a
   });
 }
 
-function inspectResourceCall(node, sourceFile, workspaceRoot, bindings, references, warnings) {
+function inspectResourceCall(
+  node,
+  sourceFile,
+  workspaceRoot,
+  bindings,
+  references,
+  formFieldReferences,
+  warnings
+) {
   if (!ts.isCallExpression(node)) return;
   const callee = getPropertyPath(node.expression, bindings);
-  if (!callee || callee[0] !== 'ctx' || callee.length < 3) return;
+  if (!callee) return;
+  if (
+    callee.length === 1 &&
+    callee[0] === 'queryAdvancedFormPage'
+  ) {
+    const formCode = readStaticString(node.arguments[1], bindings);
+    if (formCode) {
+      addReference(
+        references,
+        sourceFile,
+        node,
+        workspaceRoot,
+        'forms',
+        formCode,
+        'queryAdvancedFormPage'
+      );
+      addFormFieldReferences(
+        formFieldReferences,
+        sourceFile,
+        workspaceRoot,
+        bindings,
+        formCode,
+        node.arguments[2],
+        'queryAdvancedFormPage'
+      );
+    }
+    return;
+  }
+  if (callee[0] !== 'ctx' || callee.length < 3) return;
   const namespace = callee[1];
   const method = callee[2];
   const api = callee.join('.');
@@ -304,7 +456,22 @@ function inspectResourceCall(node, sourceFile, workspaceRoot, bindings, referenc
   if (namespace === 'form') {
     const code = readStaticObjectProperty(firstArgument, ['formCode', 'code'], bindings) ||
       readStaticString(firstArgument, bindings);
-    if (code) addReference(references, sourceFile, node, workspaceRoot, 'forms', code, api);
+    if (code) {
+      addReference(references, sourceFile, node, workspaceRoot, 'forms', code, api);
+      addFormFieldReferences(
+        formFieldReferences,
+        sourceFile,
+        workspaceRoot,
+        bindings,
+        code,
+        ts.isObjectLiteralExpression(
+          resolveStaticExpression(firstArgument, bindings)
+        )
+          ? firstArgument
+          : node.arguments[1],
+        api
+      );
+    }
     else if (firstArgument) addDynamicReferenceWarning(warnings, sourceFile, node, workspaceRoot, api, 'forms');
     return;
   }
@@ -396,6 +563,7 @@ function analyzeTypeScriptEntry(options = {}) {
   const visited = new Set();
   const sourceDependencies = new Set();
   const references = [];
+  const formFieldReferences = [];
   const warnings = [];
 
   while (queue.length > 0) {
@@ -439,7 +607,15 @@ function analyzeTypeScriptEntry(options = {}) {
 
     const bindings = collectConstInitializers(sourceFile);
     const inspect = node => {
-      inspectResourceCall(node, sourceFile, workspaceRoot, bindings, references, warnings);
+      inspectResourceCall(
+        node,
+        sourceFile,
+        workspaceRoot,
+        bindings,
+        references,
+        formFieldReferences,
+        warnings
+      );
       ts.forEachChild(node, inspect);
     };
     inspect(sourceFile);
@@ -486,6 +662,10 @@ function analyzeTypeScriptEntry(options = {}) {
     sourceDependencies: Array.from(sourceDependencies).sort(),
     resourceReferences,
     resourceReferenceDetails,
+    formFieldReferences: dedupeDetails(
+      formFieldReferences,
+      ['formCode', 'field', 'file', 'line', 'column', 'api']
+    ),
     warnings: dedupeDetails(warnings, ['code', 'file', 'line', 'column', 'api', 'message']),
   };
 }
@@ -610,11 +790,16 @@ function mergeAnalyses(workspaceRoot, entries) {
       ).sort(),
     ])
   );
+  const formFieldReferences = dedupeDetails(
+    analyses.flatMap(analysis => analysis.formFieldReferences || []),
+    ['formCode', 'field', 'file', 'line', 'column', 'api']
+  );
   return {
     entryFiles: entries.map(entry => workspaceRelativePath(workspaceRoot, entry)).sort(),
     sourceDependencies,
     resourceReferences,
     resourceReferenceDetails,
+    formFieldReferences,
     warnings: dedupeDetails(
       analyses.flatMap(analysis => analysis.warnings),
       ['code', 'file', 'line', 'column', 'api', 'message']
@@ -712,6 +897,7 @@ function validateManifestSourceBindings(options = {}) {
       entryFiles: target.entryFiles,
       sourceDependencies: target.sourceDependencies,
       resourceReferences: target.resourceReferences,
+      formFieldReferences: target.formFieldReferences,
     })),
   };
 }

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -59,6 +59,8 @@ openxiangda resource publish function --only function_a,function_b --profile <na
 
 Selectors apply before manifest parsing, source dependency analysis, and JS_CODE typecheck/build. A scoped Function/Automation plan must touch only the selected targets plus their transitive/shared/ambient dependencies; an unscoped plan intentionally retains full-workspace behavior. Resource commands use the canonical scoped builder packaged with the installed CLI for standard workspaces, so old checked-in builders still receive the optimization; refresh/bootstrap the workspace script only for equivalent manual `pnpm build-js-code` behavior. Nonstandard custom builders remain an explicit compatibility fallback.
 
+Function/Automation source analysis also extracts statically declared Form filter and order fields. `resource plan` compares them with each bound Form's frozen online schema and reports `formFieldContracts`; publish fails before lease/write when a binding or field is missing. Fix the source or stage the Form schema in the same reviewed release instead of waiting for a production SQL-column error. Dynamic field names remain runtime-validated by the platform and return `FORM_FIELD_NOT_FOUND` as a configuration error.
+
 Source-triggered Function/Automation targets use Backend Release v2 when the platform exposes that capability. One child may mix create, source-only update, and manifest replacement update through explicit per-resource `operation/mode`; the CLI freezes the current Backend Release parent plus Git/change baseline, then runs `prepare -> verify -> activate` or stops verified for `--stage-only`. Activation CAS-checks the entire set and applies all updates in one transaction. `--stage-only` and Secret-bound Function publishing fail closed when Backend Release v2 is unavailable; compatibility fallback is limited to non-staged, non-Secret publishing after an explicit Backend head 404. Existing online bindings, contracts, metadata, trigger/view configuration, and enabled/published state remain unchanged; noops do not advance versions/timestamps. A deliberate whole-definition replacement requires exact `--only/--code` and `--replace-manifest --reason "<why>"`; SDD bypass does not imply replacement authority.
 
 Functions with a top-level `secretRefs` field use `backend_release_v2`, including an explicit empty list that removes bindings. This path never falls back to source PATCH. It requires the per-app Secret capability probe to grant `app_function_secrets_v1`, `trusted_node_v2`, `backend_release_v2`, and `atomic_staged_children_v2`; otherwise plan/publish fails closed.

package/openxiangda-skills/skills/openxiangda-form/SKILL.md

@@ -84,7 +84,7 @@ For a single form edit, still keep the child staged until Root App finalize:
 openxiangda resource publish form-setting --only <formCode> --change <change> --profile <name>
 ```
 
-The Form resource bundle carries schema, settings, indexes, data-management, runtime-write, and public-access configuration under one CAS parent. It returns a canonical staged FormRelease and the CLI records it in the change-scoped staged-resources file. `workspace publish --form` is limited to an intentional first-time bootstrap or isolated repair outside a governed multi-resource release; it is not the normal release path.
+The Form resource bundle carries schema, settings, indexes, data-management, runtime-write, public-access configuration, and changed form permission groups under one CAS parent. It returns a canonical staged FormRelease and the CLI records it in the change-scoped staged-resources file. `workspace publish --form` is limited to an intentional first-time bootstrap or isolated repair outside a governed multi-resource release; it is not the normal release path.
 
 For Phase 6 React SPA workspaces, `app-workspace.config.ts` should declare
 `runtimeMode: "react-spa"`. In that mode, `workspace publish --form <code>` is
@@ -110,7 +110,7 @@ Do not use `openxiangda form create` as the normal way to generate a user-facing
 ## Form Release / CAS Safety
 
 - Treat all Form configuration as one immutable release stream. Freeze `revision`, `etag`, and `activeFormReleaseHead` from one snapshot before writing.
-- Publish declared schema, packages, settings, indexes, data-management, runtime-write, and public-access configuration through one `resource publish form-setting --only <codes> --change <change>` Form `bundle` mutation. Resource Form bundles are stage-only by default and return immutable `contentHash` plus a canonical `stagedResource` (stable identity is `formUuid`); the CLI merges each entry into `.openxiangda/releases/<change>/staged-resources.json`. Root `app-finalize` atomically switches all child heads plus the App head. Use direct `--activate` only for an intentional form-only repair outside a governed multi-resource release; never use `workspace publish --form` inside an atomic React SPA release.
+- Publish declared schema, packages, settings, indexes, data-management, runtime-write, public-access configuration, and `formPermissionGroups` through one Form `bundle` mutation. `resource publish form-setting,form-permission-group --only <codes> --change <change>` groups changes by `formUuid`, stages one immutable FormRelease per form, and never falls back to direct live permission-group writes. Resource Form bundles return immutable `contentHash` plus a canonical `stagedResource` (stable identity is `formUuid`); the CLI merges each entry into `.openxiangda/releases/<change>/staged-resources.json`. Root `app-finalize` atomically switches all child heads plus the App head. Use direct `--activate` only for an intentional form-only repair outside a governed multi-resource release; never use `workspace publish --form` inside an atomic React SPA release.
 - Every mutation must carry `If-Match`, `expectedRevision`, `expectedParent`, and a stable artifact ID. Creation starts at revision `0`.
 - A revision/head conflict is not retryable. Stop with zero later writes, re-plan, and explicitly merge the competing change; never silently adopt the newer live head.
 - Use `openxiangda form release-head|release-list|release-detail|release-diff` for inspection and `release-activate|release-rollback|release-abort` for controlled recovery. See `docs/openxiangda-form-releases.md` in the OpenXiangda tool repository.

package/openxiangda-skills/skills/openxiangda-permission-settings/SKILL.md

@@ -159,6 +159,14 @@ openxiangda permission form-group-create sales_limited \
 for real backend read/write field access (`edit`, `readonly`, `hidden`) with
 `defaultAccess` plus field-ID exceptions.
 
+For governed application publishing, declare groups under
+`src/resources/formPermissionGroups` and publish them through exact
+`resource publish ... --only ... --change ...` scope. The CLI folds changed
+groups into the owning Form's immutable FormRelease, freezes a permission-group
+parent hash, and keeps live rows unchanged until Root App finalize. The
+low-level `permission form-group-create/update/delete` commands are for
+intentional maintenance and diagnostics, not an atomic multi-resource release.
+
 ## Inspection
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.177",
+  "version": "1.0.178",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {
@@ -100,6 +100,7 @@
     "test:publish-lease-heartbeat": "node scripts/publish-lease-heartbeat-smoke.mjs",
     "test:release-telemetry": "node scripts/release-telemetry-smoke.mjs",
     "test:release-explain": "node scripts/release-explain-smoke.mjs",
+    "test:release-error-classification": "node scripts/release-error-classification-smoke.mjs",
     "test:task-status": "node scripts/task-status-smoke.mjs",
     "test:policy": "node scripts/policy-smoke.mjs",
     "test:release-plan": "node scripts/release-plan-smoke.mjs",
@@ -111,6 +112,7 @@
     "test:app-release-cli": "node scripts/app-release-cli-smoke.mjs",
     "test:form-release-cas": "node scripts/form-release-cas-smoke.mjs",
     "test:source-dependencies": "node scripts/source-dependencies-smoke.mjs",
+    "test:form-field-contract": "node scripts/form-field-contract-smoke.mjs",
     "test:package-runtime-dependencies": "node scripts/package-runtime-dependencies-smoke.mjs",
     "test:packed-cli": "node scripts/packed-cli-smoke.mjs",
     "test:runtime-deploy": "node scripts/runtime-deploy-smoke.mjs",