openxiangda 1.0.197 → 1.0.199

package/lib/release-plan.js

@@ -16,6 +16,11 @@ function normalizeReleaseTargets(targets = {}, runtimeMode = 'legacy') {
       .map(([type, values]) => [type, uniqueSorted(values || [])])
       .filter(([, values]) => values.length > 0)
   );
+  const resourceDeletes = Object.fromEntries(
+    Object.entries(targets.resourceDeletes || {})
+      .map(([type, values]) => [type, uniqueSorted(values || [])])
+      .filter(([, values]) => values.length > 0)
+  );
   const logicalTargets = {
     forms: uniqueSorted(targets.forms || []),
     pages: uniqueSorted(targets.pages || []),
@@ -25,6 +30,7 @@ function normalizeReleaseTargets(targets = {}, runtimeMode = 'legacy') {
     jsCodeNodes: uniqueSorted(targets.jsCodeNodes || []),
     resources: Boolean(targets.resources),
     resourceSelectors,
+    resourceDeletes,
     runtime: Boolean(targets.runtime),
     other: uniqueSorted(targets.other || []),
   };
@@ -45,11 +51,25 @@ function normalizeReleaseTargets(targets = {}, runtimeMode = 'legacy') {
 function unsupportedAtomicReleaseTargets(targets = {}) {
   const unsupported = [];
   if (targets.resources) unsupported.push('generic-resources');
-  for (const [type, selectors] of Object.entries(targets.resourceSelectors || {})) {
-    if ((selectors || []).length > 0) {
+  for (const [type, selectors] of Object.entries(
+    targets.resourceSelectors || {}
+  )) {
+    if (
+      (selectors || []).length > 0 &&
+      (!DIRECT_RESOURCE_TYPE_BY_KEY[type] || type === 'unknown')
+    ) {
       unsupported.push(`${type}:${selectors.join(',')}`);
     }
   }
+  for (const [type, selectors] of Object.entries(
+    targets.resourceDeletes || {}
+  )) {
+    if ((selectors || []).length > 0) {
+      unsupported.push(
+        `destructive-resource-delete:${type}:${selectors.join(',')}`
+      );
+    }
+  }
   if (
     (targets.jsCodeNodes || []).length > 0 &&
     (targets.functions || []).length === 0 &&
@@ -60,6 +80,40 @@ function unsupportedAtomicReleaseTargets(targets = {}) {
   return unsupported;
 }
 
+const DIRECT_RESOURCE_TYPE_BY_KEY = Object.freeze({
+  roles: 'role',
+  connectors: 'connector',
+  notifications: 'notification',
+  menus: 'menu',
+  dataViews: 'data-view',
+  storageConfigs: 'storage',
+  authConfigs: 'auth-config',
+  routes: 'route',
+  publicAccessPolicies: 'public-access',
+  pagePermissionGroups: 'page-permission-group',
+  formPermissionGroups: 'form-permission-group',
+  scopeDimensions: 'scope-dimension',
+  scopeGrantSources: 'scope-grant-source',
+  dataScopePolicies: 'data-scope-policy',
+});
+
+const DIRECT_RESOURCE_RELEASE_ORDER = Object.freeze([
+  'roles',
+  'connectors',
+  'storageConfigs',
+  'authConfigs',
+  'routes',
+  'publicAccessPolicies',
+  'menus',
+  'dataViews',
+  'scopeDimensions',
+  'scopeGrantSources',
+  'dataScopePolicies',
+  'pagePermissionGroups',
+  'formPermissionGroups',
+  'notifications',
+]);
+
 function assertAtomicReleaseTargetsSupported(targets) {
   const unsupported = unsupportedAtomicReleaseTargets(targets);
   if (unsupported.length === 0) return;
@@ -128,18 +182,23 @@ function buildTargetedResourceReleaseSteps(
       ...functions.map(code => (qualify ? `function:${code}` : code)),
       ...automations.map(code => (qualify ? `automation:${code}` : code)),
     ];
+    const stagedFormContracts = uniqueSorted(targets.forms || []);
+    const args = [
+      'resource',
+      'publish',
+      resourceTypes.join(','),
+      '--only',
+      selectors.join(','),
+      '--stage-only',
+      ...(stagedFormContracts.length > 0
+        ? ['--staged-form-contracts', stagedFormContracts.join(',')]
+        : []),
+    ];
     steps.push(
       createStep(
         'backend-stage',
         appendProfileAndChange(
-          [
-            'resource',
-            'publish',
-            resourceTypes.join(','),
-            '--only',
-            selectors.join(','),
-            '--stage-only',
-          ],
+          args,
           profileArg,
           changeId
         ),
@@ -171,6 +230,40 @@ function buildTargetedResourceReleaseSteps(
   return steps;
 }
 
+function buildDirectConfigurationReleaseSteps(
+  targets,
+  profileArg,
+  changeId
+) {
+  return Object.entries(targets.resourceSelectors || {})
+    .filter(
+      ([type, selectors]) =>
+        DIRECT_RESOURCE_TYPE_BY_KEY[type] &&
+        uniqueSorted(selectors || []).length > 0
+    )
+    .sort(
+      ([left], [right]) =>
+        DIRECT_RESOURCE_RELEASE_ORDER.indexOf(left) -
+        DIRECT_RESOURCE_RELEASE_ORDER.indexOf(right)
+    )
+    .map(([type, selectors]) =>
+      createStep(
+        `config-${DIRECT_RESOURCE_TYPE_BY_KEY[type]}`,
+        appendProfileAndChange(
+          [
+            'resource',
+            'publish',
+            DIRECT_RESOURCE_TYPE_BY_KEY[type],
+            '--only',
+            uniqueSorted(selectors).join(','),
+          ],
+          profileArg,
+          changeId
+        )
+      )
+    );
+}
+
 function buildWorkspaceReleaseCommands(
   targetsInput,
   runtimeMode,
@@ -203,9 +296,28 @@ function buildWorkspaceReleaseSteps(
     targets.functions.length > 0 ||
     targets.automations.length > 0 ||
     targets.workflows.length > 0 ||
-    targets.jsCodeNodes.length > 0;
+    targets.jsCodeNodes.length > 0 ||
+    Object.values(targets.resourceSelectors || {}).some(
+      selectors => (selectors || []).length > 0
+    );
+  const directConfigurationSteps =
+    buildDirectConfigurationReleaseSteps(
+      targets,
+      profileArg,
+      changeId
+    );
   if (runtimeMode === 'react-spa') {
     if (targets.forms.length > 0) {
+      steps.push(
+        createStep(
+          'form-ensure',
+          appendProfileAndChange(
+            ['form', 'ensure', '--only', targets.forms.join(',')],
+            profileArg,
+            changeId
+          )
+        )
+      );
       steps.push(
         createStep(
           'form-stage',
@@ -224,6 +336,7 @@ function buildWorkspaceReleaseSteps(
         )
       );
     }
+    steps.push(...directConfigurationSteps);
     if (hasResourceTargets) {
       steps.push(
         ...buildTargetedResourceReleaseSteps(
@@ -251,8 +364,15 @@ function buildWorkspaceReleaseSteps(
       targets.functions.length > 0 ||
       targets.automations.length > 0 ||
       targets.workflows.length > 0 ||
-      targets.runtime
+      targets.runtime ||
+      directConfigurationSteps.length > 0
     ) {
+      const hasStagedChildren =
+        targets.forms.length > 0 ||
+        targets.functions.length > 0 ||
+        targets.automations.length > 0 ||
+        targets.workflows.length > 0 ||
+        targets.runtime;
       steps.push(
         createStep(
           'app-finalize',
@@ -260,8 +380,12 @@ function buildWorkspaceReleaseSteps(
             [
               'release',
               'app-finalize',
-              '--staged-resources-json',
-              `.openxiangda/releases/${changeId || 'change'}/staged-resources.json`,
+              ...(hasStagedChildren
+                ? [
+                    '--staged-resources-json',
+                    `.openxiangda/releases/${changeId || 'change'}/staged-resources.json`,
+                  ]
+                : []),
               '--wait',
             ],
             profileArg,
@@ -296,6 +420,7 @@ function buildWorkspaceReleaseSteps(
     );
   }
   if (hasResourceTargets) {
+    steps.push(...directConfigurationSteps);
     steps.push(
       ...buildTargetedResourceReleaseSteps(targets, profileArg, changeId)
     );

package/openxiangda-skills/SKILL.md

@@ -98,17 +98,17 @@ openxiangda release publish --change <release-change> --profile <name>
 Environment-managed application:
 
 ```bash
-openxiangda release candidate --change <release-change> --environment preproduction
-openxiangda release deploy --candidate <candidate-id> --environment preproduction
-openxiangda release test --deployment <deployment-id> --environment preproduction --evidence-json <file>
-openxiangda release promote --candidate <candidate-id> --environment production --confirm-production
+openxiangda release ship --change <release-change> --profile <name>
+# Stop here by default and validate the preproduction environment.
+openxiangda release ship --change <release-change> --profile <name> \
+  --confirm-production
 ```
 
-For a workspace registered by `openxiangda environment init` or connected to an existing set with `openxiangda environment attach`, production is never a direct publish target. The immutable candidate must first be deployed and passed in preproduction, and promotion must reuse the same candidate hash. Preproduction and production keep independent app/resource/data identities in `.openxiangda/state.json`; do not copy IDs between targets. `environment attach` may seed only the matching legacy app binding into preproduction and must leave production empty. Only during authorized commissioning/reclassification may `environment swap --reason "..." --confirm-production` atomically exchange the two existing roles; it preserves each app's data and Release Heads, remaps local resource IDs by appType, and does not enable production side effects by default. Use `openxiangda studio` for the loopback-only developer view of bindings, drift, evidence, and safe next actions.
+For a workspace registered by `openxiangda environment init` or connected to an existing set with `openxiangda environment attach`, production is never a direct publish target. Use the two-phase `release ship` fast path by default. Its first invocation creates/deploys the immutable candidate to preproduction and always returns `awaiting_production_confirmation`; it cannot promote. A second invocation with `--confirm-production` promotes the exact same candidate hash. Real human acceptance is the recommended normal practice and can be recorded with optional `--acceptance-note`, but do not invent an acceptance note and do not treat it as a universal hard platform gate when the user explicitly authorizes a low-risk or emergency promotion. The lower-level candidate/deploy/test/promote commands are recovery primitives, not the normal agent loop. Preproduction and production keep independent app/resource/data identities in `.openxiangda/state.json`; do not copy IDs between targets. `environment attach` may seed only the matching legacy app binding into preproduction and must leave production empty. Only during authorized commissioning/reclassification may `environment swap --reason "..." --confirm-production` atomically exchange the two existing roles; it preserves each app's data and Release Heads, remaps local resource IDs by appType, and does not enable production side effects by default. To change only one environment's side-effect policy, run `environment policy update <kind|id> --side-effect-policy-json <JSON|file> --reason "..." --dry-run` first, then repeat without `--dry-run`; never use swap for this. The update is revision-CAS and patch-preserving unless `--full-replace` is explicit, production needs `--confirm-production`, and `organizationWrites=explicit_capability_only` still requires `app:organization:manage`. Use `openxiangda studio` for the loopback-only developer view of bindings, drift, evidence, and safe next actions.
 
 `resource plan` and publish dry-runs are strictly GET/HEAD-only. `READ_ONLY_AUTH_REQUIRED` means the access token expired; run `openxiangda auth refresh --profile <name>` or log in again before retrying. Never add an automatic refresh POST inside a plan.
 
-`release publish` is the default promotion entrypoint only for legacy unmanaged workspaces. It verifies without rewriting reviewed `change.json`/`release.json`, waits for the app lease, freezes the App capture after ownership is acquired, executes deterministic exact staged steps, resumes from `.openxiangda/releases/<change>/execution.json`, atomically finalizes, verifies mainline integration, and releases the lease. Environment-managed applications use candidate/deploy/test/promote, and their execution journals are additionally scoped by deployment ID. `release begin` and child commands remain recovery/diagnostic primitives.
+`release publish` is the default promotion entrypoint only for legacy unmanaged workspaces. It verifies without rewriting reviewed `change.json`/`release.json`, waits for the app lease, freezes the App capture after ownership is acquired, executes deterministic exact staged steps, resumes from `.openxiangda/releases/<change>/execution.json`, atomically finalizes, verifies mainline integration, and releases the lease. Environment-managed applications use the two-phase `release ship`; candidate/deploy/test/promote, `release begin`, and child commands remain recovery/diagnostic primitives.
 
 Reviewed bundle commands may retain `<profile>` as a template. The explicit real `release publish --profile <name>` value is bound to actual child argv without rewriting tracked SDD. React SPA page codes are logical coverage targets and activate through one Runtime child; they do not require PageRelease. `release app-head` and `runtime releases` are compact by default; use `--full` only when the complete manifest is required.
 

package/openxiangda-skills/references/openxiangda-api.md

@@ -866,6 +866,10 @@ Binds the missing `preproduction` or `production` app identity. An appType can b
 
 Atomically exchanges the roles of the two existing app identities during an explicitly confirmed commissioning/reclassification operation. The request requires `confirmation=SWAP_PREPRODUCTION_AND_PRODUCTION` and a reason. Application data and Release Heads stay with their appType; local target resources are remapped by appType. Existing side-effect restrictions remain unless the request explicitly supplies replacement policies.
 
+### POST `/environment-sets/:code/environments/:kindOrId/policy`
+
+Updates only one environment's side-effect policy. The request requires `expectedRevision`, `reason`, and a strictly validated `sideEffectPolicy` patch; `fullReplace=true` is the only way to replace rather than merge. Production additionally requires `confirmProduction=true`. A successful transaction increments that environment revision and writes a durable audit containing actor, environment identity, reason, and secret-free before/after policies. It does not change either environment role, business data, or any App/Runtime/Backend/Page/Workflow Release Head. `externalDingTalkDepartmentRootId` accepts a string or safe integer and is stored as a string. `organizationWrites=explicit_capability_only` still requires the normal `app:organization:manage` permission.
+
 ### GET `/environment-sets/:code/status`
 
 Returns each target's active heads, latest deployment, side-effect policy, and candidate drift state for the local Developer Center.

package/openxiangda-skills/references/workspace-state.md

@@ -68,9 +68,16 @@ Environment-managed workspaces add a logical application and target-specific bin
       "environmentId": "PRE_ENV_UUID",
       "kind": "preproduction",
       "appType": "APP_PRE",
+      "revision": 4,
       "sideEffectPolicy": {
-        "notificationsEnabled": false,
-        "scheduledAutomationsEnabled": false
+        "notifications": "tester_allowlist",
+        "notificationAllowlist": [],
+        "organizationWrites": "deny",
+        "scheduledAutomations": "disabled",
+        "externalWrites": "allowlist",
+        "payments": "deny",
+        "publicIndexing": "deny",
+        "environmentBanner": true
       },
       "resources": {}
     },
@@ -101,5 +108,6 @@ Environment-managed workspaces add a logical application and target-specific bin
 - This protects the ID map from truncation/lost updates. Concurrent development still uses separate Git worktrees/branches; `.openxiangda/worktree-owner.json` binds one worktree to one active `CODEX_THREAD_ID` and blocks a second task at SDD context/publish time.
 - A prod publish must not read dev IDs.
 - Never copy target resource bindings. Use `openxiangda environment use <target>` or pass `--environment <target>` and let the CLI populate that target from its own deployment.
-- Managed targets cannot use direct `release publish`; use candidate → preproduction deploy/test → same-candidate production promotion.
+- Managed targets cannot use direct `release publish`; use two-phase `release ship`. The first invocation only prepares preproduction and stops; after confirming the preproduction result, a separate invocation with `--confirm-production` promotes the same candidate. Human acceptance is recommended and may be recorded with optional `--acceptance-note`.
+- Change a single target's side-effect policy with `openxiangda environment policy update <kind|id> --side-effect-policy-json <JSON|file> --reason "..." --dry-run`, inspect the exact diff, then repeat without `--dry-run`. The write uses the server revision as CAS and updates local `revision`; it does not swap roles or alter Release Heads. Omitted fields are preserved unless `--full-replace` is explicit, and production additionally requires `--confirm-production`.
 - Before publishing to another platform, run `openxiangda workspace bind --profile <name> --app-type <APP_XXX>`.

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -99,15 +99,15 @@ openxiangda release publish --change <release-change> --profile <name>
 Environment-managed application:
 
 ```bash
-openxiangda release candidate --change <release-change> --environment preproduction
-openxiangda release deploy --candidate <candidate-id> --environment preproduction
-openxiangda release test --deployment <deployment-id> --environment preproduction --evidence-json <file>
-openxiangda release promote --candidate <candidate-id> --environment production --confirm-production
+openxiangda release ship --change <release-change> --profile <name>
+# Stop by default and validate preproduction.
+openxiangda release ship --change <release-change> --profile <name> \
+  --confirm-production
 ```
 
-Once `environment init` registers a logical application, or `environment attach` connects an existing workspace, `preproduction` and `production` are separate target bindings with separate app/resource/data IDs. Never copy IDs between them. Existing legacy resource mappings may seed only the target whose appType matches (normally preproduction); production stays empty. The candidate is immutable and promotion must reuse the candidate that has fresh, passing, deployment-bound preproduction evidence. Direct `release publish` to either managed target fails closed. Only authorized commissioning/reclassification may run `environment swap --reason "..." --confirm-production`; the atomic operation preserves each app's data and Release Heads, remaps local resources by appType, and keeps existing side-effect restrictions unless explicit replacement policies are supplied. `openxiangda studio` is the local loopback-only developer view and exposes only registered safe actions.
+Once `environment init` registers a logical application, or `environment attach` connects an existing workspace, `preproduction` and `production` are separate target bindings with separate app/resource/data IDs. Never copy IDs between them. Existing legacy resource mappings may seed only the target whose appType matches (normally preproduction); production stays empty. The normal path is the two-phase `release ship`. Its first invocation creates and deploys the immutable candidate only to preproduction and stops at `awaiting_production_confirmation`. A different, later invocation with `--confirm-production` promotes the exact same candidate and fresh deployment-bound evidence. Human acceptance is recommended and an optional `--acceptance-note` records it, but it is not a universal hard platform gate for explicitly authorized low-risk or emergency releases. Direct `release publish` to either managed target fails closed. Only authorized commissioning/reclassification may run `environment swap --reason "..." --confirm-production`; the atomic operation preserves each app's data and Release Heads, remaps local resources by appType, and keeps existing side-effect restrictions unless explicit replacement policies are supplied. A single environment policy change uses `environment policy update <kind|id>` with a GET-only `--dry-run` first; it uses revision CAS, preserves omitted fields unless `--full-replace` is explicit, and never swaps roles or Release Heads. Production writes require `--confirm-production`. `organizationWrites=explicit_capability_only` only removes the environment deny and never bypasses `app:organization:manage`. `openxiangda studio` is the local loopback-only developer view and exposes only registered safe actions.
 
-`release publish` is the normal whole-app entrypoint for legacy unmanaged workspaces: it verifies SDD without mutating reviewed files, waits for the promotion lease, freezes one App capture, stages the exact Form/Backend/Runtime children, resumes from a private execution journal, finalizes once, and releases the lease. Managed applications use candidate/deploy/test/promote and deployment-scoped journals. Individual release commands are recovery/diagnostic primitives.
+`release publish` is the normal whole-app entrypoint for legacy unmanaged workspaces: it verifies SDD without mutating reviewed files, waits for the promotion lease, freezes one App capture, stages the exact Form/Backend/Runtime children, resumes from a private execution journal, finalizes once, and releases the lease. Managed applications use two-phase `release ship` and its deployment-scoped journal. Individual candidate/deploy/test/promote commands are recovery/diagnostic primitives.
 
 Reviewed bundle commands may retain `<profile>` as a template. The explicit real `release publish --profile <name>` value is bound to actual child argv without rewriting tracked SDD. React SPA page codes remain logical coverage targets and activate through the single Runtime child; they do not require PageRelease. If local lease state disappears, `release end --change <id>` reconciles a self-owned remote lease from the private execution journal and never reports inactive while a remote lease is active.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.197",
+  "version": "1.0.199",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {
@@ -64,7 +64,7 @@
     "build:sdk": "tsup --config packages/sdk/tsup.config.ts",
     "check": "node --check bin/openxiangda.js && node --check lib/*.js && node --check packages/sdk/src/build-source/src/cli.mjs && node --check packages/sdk/src/build-source/scripts/*.mjs && node --check packages/sdk/src/build-source/scripts/utils/*.mjs",
     "test": "npm run test:fast",
-    "test:fast": "npm run check && node scripts/http-proxy-smoke.mjs && node scripts/form-export-cli-smoke.mjs && node scripts/open-api-cli-smoke.mjs && node scripts/release-plan-smoke.mjs && node scripts/typed-resource-plan-smoke.mjs && node scripts/integration-bundle-smoke.mjs && node scripts/content-cache-smoke.mjs && node scripts/dependency-capsule-smoke.mjs && node scripts/sdd-stages-smoke.mjs && node scripts/environment-swap-cli-smoke.mjs",
+    "test:fast": "npm run check && node scripts/http-proxy-smoke.mjs && node scripts/form-export-cli-smoke.mjs && node scripts/open-api-cli-smoke.mjs && node scripts/release-plan-smoke.mjs && node scripts/typed-resource-plan-smoke.mjs && node scripts/integration-bundle-smoke.mjs && node scripts/content-cache-smoke.mjs && node scripts/dependency-capsule-smoke.mjs && node scripts/sdd-stages-smoke.mjs && node scripts/environment-swap-cli-smoke.mjs && node scripts/environment-policy-cli-smoke.mjs",
     "test:changed": "npm run check && node scripts/run-test-suite.mjs --changed --evidence",
     "test:contract": "npm run check && node scripts/run-test-suite.mjs --contract --evidence",
     "test:release": "npm run check && node scripts/run-test-suite.mjs --release --evidence",
@@ -112,7 +112,9 @@
     "test:page-release-cli": "node scripts/page-release-cli-smoke.mjs",
     "test:app-release-cli": "node scripts/app-release-cli-smoke.mjs",
     "test:application-environments": "node scripts/application-environments-smoke.mjs",
+    "test:release-ship": "node scripts/release-ship-gate-smoke.mjs",
     "test:environment-swap": "node scripts/environment-swap-cli-smoke.mjs",
+    "test:environment-policy": "node scripts/environment-policy-cli-smoke.mjs",
     "test:developer-center": "node scripts/developer-center-smoke.mjs",
     "test:form-release-cas": "node scripts/form-release-cas-smoke.mjs",
     "test:source-dependencies": "node scripts/source-dependencies-smoke.mjs",

package/templates/openxiangda-react-spa/AGENTS.md

@@ -43,17 +43,16 @@ openxiangda sdd verify <change> --changed --stage implementation
 openxiangda resource plan <type> --only <code1,code2> --profile <name>
 openxiangda sdd bundle <release-change> --changes <change-a,change-b>
 openxiangda release publish --change <release-change> --profile <name>
-openxiangda release candidate --change <release-change> --environment preproduction
-openxiangda release deploy --candidate <candidate-id> --environment preproduction
-openxiangda release test --deployment <deployment-id> --environment preproduction --evidence-json <file>
-openxiangda release promote --candidate <candidate-id> --environment production --confirm-production
+openxiangda release ship --change <release-change> --profile <name>
+# 确认预发结果后，另一次命令晋级同一 candidate；验收备注可选
+openxiangda release ship --change <release-change> --profile <name> --confirm-production
 openxiangda studio
 openxiangda commands --json
 ```
 
 模板已停用无范围的 `pnpm deploy` 聚合入口。日常变更必须使用 `resource plan|publish <type> --only <codes>`（单资源可用 `--code <code>`）。Form bundle、Backend Release 和 Runtime 都先暂存；CLI 会按 `--change` 自动聚合 `.openxiangda/releases/<change>/staged-resources.json`，最后只由一次 Root App finalize 原子激活。不要使用 `workspace publish --form`、单独 `runtime activate`、`pnpm publish:all`、`pnpm openxiangda:publish` 或 `lowcode-workspace publish-all`。
 
-工作区一旦通过 `environment init` 登记，或通过 `environment attach` 接入已有环境组，`release publish` 即不再是入口。必须冻结不可变 candidate，部署到 preproduction，提交与 deployment/candidate/appType/AppRelease 精确绑定且仍在有效期内的通过证据，再将同一 candidate 晋级 production。两套环境的 appType、资源 ID、数据和副作用策略完全独立；旧单目标资源映射只允许迁移到 appType 相同的预发 target，正式 target 必须为空。仅在用户明确授权的投产前重分类中使用 `environment swap --reason "..." --confirm-production` 原子交换两个既有应用的环境角色；数据和 Release Head 不移动，副作用默认不放开。`openxiangda studio` 提供仅本机访问的开发者页面，用于查看绑定、漂移、候选、部署、证据和下一安全动作。
+工作区一旦通过 `environment init` 登记，或通过 `environment attach` 接入已有环境组，`release publish` 即不再是入口。日常使用两段式 `release ship`：第一次冻结不可变 candidate 并只部署到 preproduction，停止在 `awaiting_production_confirmation`；确认预发结果后，第二次命令提供 `--confirm-production`，把同一 candidate 晋级 production，不会重新构建。真实人工验收是默认建议，可用可选的 `--acceptance-note` 留痕；但用户明确授权的低风险或紧急发布不受僵硬审批门禁阻塞。两套环境的 appType、资源 ID、数据和副作用策略完全独立；旧单目标资源映射只允许迁移到 appType 相同的预发 target，正式 target 必须为空。仅在用户明确授权的投产前重分类中使用 `environment swap --reason "..." --confirm-production` 原子交换两个既有应用的环境角色；数据和 Release Head 不移动，副作用默认不放开。单独调整某个环境的副作用策略时，先运行 `environment policy update <kind|id> ... --dry-run` 查看差异，再按 CAS revision 写入；不得借用 swap，遗漏字段默认保留，正式写入另需 `--confirm-production`。`organizationWrites=explicit_capability_only` 仍强制 `app:organization:manage`。`openxiangda studio` 提供仅本机访问的开发者页面，用于查看绑定、漂移、候选、部署、证据和下一安全动作。
 
 `resource plan` 与 publish dry-run 严格只允许 GET/HEAD。遇到 `READ_ONLY_AUTH_REQUIRED` 时，先执行 `openxiangda auth refresh --profile <name>` 或重新登录再重试；不得在 plan 内自动 POST 刷新 token。
 
@@ -64,11 +63,10 @@ openxiangda commands --json
 openxiangda sdd bundle <release-change> --changes <change-a,change-b>
 # 未登记环境的旧工作区：commit/push bundle 后由一个可恢复命令完成原子发布
 openxiangda release publish --change <release-change> --profile <name>
-# 已登记环境的工作区：冻结、预发、测试、同候选晋级
-openxiangda release candidate --change <release-change> --environment preproduction
-openxiangda release deploy --candidate <candidate-id> --environment preproduction
-openxiangda release test --deployment <deployment-id> --environment preproduction --evidence-json <file>
-openxiangda release promote --candidate <candidate-id> --environment production --confirm-production
+# 已登记环境的工作区：第一次只准备预发
+openxiangda release ship --change <release-change> --profile <name>
+# 确认预发结果后，第二次晋级同一候选
+openxiangda release ship --change <release-change> --profile <name> --confirm-production
 ```
 
 `pnpm build-js-code` 会检查并打包 `src/js-code-nodes/<code>/index.ts`、`src/automations/<code>/index.ts`、`src/functions/<code>/index.ts`，供 JS_CODE V2、代码自动化和 App Function 资源发布使用。批量目标使用 `pnpm build-js-code --scripts functions:a,functions:b,automations:c`，也兼容重复的 `--script a --script b --source functions`。正式 `resource plan/publish` 由 CLI 内置 scoped builder 一次批量构建选中入口及其传递/shared/ambient 依赖，不再为每个资源启动工作区 `pnpm`。缓存写入 `.openxiangda/build-cache.cli-v4.json`，稳定 `source_lineage_v1` 只按 authored source/dependencies 比较，不因构建器升级制造假冲突；需要强制重建时追加 `--force`。

package/templates/openxiangda-react-spa/scripts/deploy.mjs

@@ -6,8 +6,8 @@ const lines = [
   '',
   '请使用一个显式 change 和精确资源 selector：',
   '  openxiangda resource plan <type> --only <codes> --profile <name>',
-  '  环境托管应用：openxiangda release candidate --change <change> --environment preproduction',
-  '  然后依次执行 release deploy、release test、release promote --confirm-production。',
+  '  环境托管应用：openxiangda release ship --change <change> --profile <name>',
+  '  确认预发结果后，再执行 release ship --change <change> --profile <name> --confirm-production；可选 --acceptance-note 留痕。',
   '  未登记环境的旧工作区：openxiangda release publish --change <change> --profile <name>',
   '',
   '该命令只接受已经 merge/fast-forward 并 push 的权威主分支，自动暂存并原子激活。',

package/templates/sy-lowcode-app-workspace/AGENTS.md

@@ -57,7 +57,7 @@
 - ✅ `resource plan` 与 publish dry-run 严格只允许 GET/HEAD；遇到 `READ_ONLY_AUTH_REQUIRED` 时先执行 `openxiangda auth refresh --profile <name>` 或重新登录，不得在 plan 内自动 POST 刷新 token。
 - ✅ Function/Automation 使用 Backend Release v2；正式多资源发布用精确 `--only/--code` 加 `--stage-only` 暂存，同一 child 可混合 create、source-only update 和显式 manifest replacement，再由 Root App finalize 原子激活。整包 manifest 替换必须另加 `--replace-manifest --reason "..."`。
 - ✅ 未登记环境的旧工作区，正式 promotion 先聚合 mainline bundle 并 commit/push，再运行 `release publish --change <id> --profile <name>`。
-- ✅ 已通过 `environment init` 登记或 `environment attach` 接入的工作区必须走 `release candidate → release deploy --environment preproduction → release test → release promote --environment production --confirm-production`。候选不可变，正式晋级必须复用预发通过的同一候选；preproduction / production 的 appType、资源 ID、数据和副作用策略完全隔离，严禁跨环境复制 ID 或直接 `release publish`。旧单目标映射只允许按相同 appType 迁移到预发。仅在用户明确授权的投产前重分类中使用 `environment swap --reason "..." --confirm-production` 原子交换两个既有应用的环境角色；数据和 Release Head 不移动，副作用默认不放开。
+- ✅ 已通过 `environment init` 登记或 `environment attach` 接入的工作区默认使用两段式 `release ship`。第一次命令只冻结 candidate 并部署 preproduction，停止等待正式晋级确认；确认预发结果后，另一次命令提供 `--confirm-production`，即可晋级同一 candidate。人工验收是默认建议，可用可选的 `--acceptance-note` 留痕，但不是所有低风险或紧急发布的硬审批门禁。preproduction / production 的 appType、资源 ID、数据和副作用策略完全隔离，严禁跨环境复制 ID 或直接 `release publish`。旧单目标映射只允许按相同 appType 迁移到预发。仅在用户明确授权的投产前重分类中使用 `environment swap --reason "..." --confirm-production` 原子交换两个既有应用的环境角色；数据和 Release Head 不移动，副作用默认不放开。单环境副作用策略用 `environment policy update <kind|id> ... --dry-run` 预览后按 revision CAS 写入，禁止借用 swap；默认保留未指定字段，正式写入需 `--confirm-production`，且 `organizationWrites=explicit_capability_only` 不绕过 `app:organization:manage`。
 - ✅ 本地开发者可运行 `openxiangda studio` 查看两套环境、差异、候选、部署和测试证据；该页面只监听回环地址且只暴露注册动作，生产操作仍需显式确认。
 
 ## 严禁