npm - openxiangda - Versions diffs - 1.0.242 → 1.0.244 - Mend

openxiangda 1.0.242 → 1.0.244

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/README.md +4 -0
package/lib/application-environments.js +8 -0
package/lib/cli.js +403 -23
package/openxiangda-skills/SKILL.md +2 -0
package/openxiangda-skills/skills/openxiangda-core/SKILL.md +2 -0
package/package.json +4 -2
package/templates/openxiangda-react-spa/AGENTS.md +2 -0
package/templates/sy-lowcode-app-workspace/AGENTS.md +1 -0

package/README.md CHANGED Viewed

@@ -131,6 +131,10 @@ instead of a database-column error.
 React SPA workspaces publish their frontend with `openxiangda runtime deploy`. Every finalized Runtime release is built from a clean, committed Git `HEAD`; the CLI freezes `sourceRevision`, the current active release, and its source revision before any build/upload. Deploy fails with `RUNTIME_SOURCE_BASE_DIVERGED` when its `HEAD` does not descend from the online Runtime source, including with `--no-activate`, so an old isolated worktree cannot stage and later activate a silent rollback. `.openxiangda/`, `openspec/`, `dist/`, and other pure generated/governance/state paths do not make the source dirty, but `--no-build` cannot bypass the lineage gate. An intentional rollback requires `--allow-runtime-rollback --reason "<at least 8 characters>"`, which is persisted for audit and never bypasses dirty/non-Git checks.
+Environment-managed `release ship`, recovery `release deploy`, and `release promote` accept the same audited Runtime rollback pair. It is forwarded only to `runtime-stage`, never to resource stages or `app-finalize`. Ship freezes the intent in its private journal so production confirmation can inherit it automatically; without the explicit pair, lineage divergence remains blocked.
+Before publishing the OpenXiangda npm package, run `npm run test:release` once on the final clean version commit. It writes hash-bound evidence under `.openxiangda/evidence/tests/<HEAD>/release.json`. `npm publish` validates that evidence against the exact Git commit, package version, Node version, and complete passing result, then runs the mainline guard; it does not execute the full release suite a second time. Any commit, version, runtime, result, or evidence-hash drift remains fail closed.
 Parallel tasks develop and test in isolated worktrees, but feature worktrees do not publish. After approved commits are merged and pushed, `sdd bundle <release-change> --changes ...` unions their exact structured scope and preserves the source changes' common Git baseline instead of adopting the post-merge `HEAD`. Old imported changes that predate source-base metadata must pass `--source-base-ref <commit>` explicitly. Commit/push the bundle, then run `release publish --change <release-change> --profile <name>` from a clean local main/master whose commit exactly equals the authoritative remote tip. It verifies without rewriting reviewed SDD files, waits for the app lease, freezes one authoritative App capture, executes exact Form/Backend/Runtime staged steps, atomically finalizes the Root App release, and records a resumable local execution journal. Runtime checks use the narrow head endpoint; immutable Git-base artifact hashes are reused across plans.
 Because promotion starts from an already-pushed authoritative mainline commit, `openxiangda release integration-status --change <change> --profile <name>` should pass immediately after activation. After a managed ship has ended, `--change` recovers lineage directly from the private `ship.json` or follows its production/preproduction deployment IDs to the matching `execution.json`; a recovery failure names the missing file or field. Run it and `release end`; there is no post-release merge step.

package/lib/application-environments.js CHANGED Viewed

@@ -1012,6 +1012,14 @@ function releaseExecutionPath(changeId, deploymentId, cwd = process.cwd()) {
 function withManagedReleaseForwardedFlags(stepId, args = [], flags = {}) {
   const forwarded = [...args];
+  if (stepId === 'runtime-stage' && flags['allow-runtime-rollback']) {
+    forwarded.push('--allow-runtime-rollback');
+    const rollbackReason = String(flags.reason || '').trim();
+    if (rollbackReason) {
+      forwarded.push('--reason', rollbackReason);
+    }
+    return forwarded;
+  }
   const immutableResourceStages = new Set([
     'backend-stage',
     'workflow-stage',

package/lib/cli.js CHANGED Viewed

@@ -336,7 +336,7 @@ Usage:
   openxiangda retry <runId> [--environment preproduction|production] [--json]
   openxiangda rollback <preproduction|production> --to <appReleaseId> [--json]
   openxiangda release publish|begin|status|integration-status|renew|end [--change id] [--profile name] [--watch] [--json]
-  openxiangda release ship|candidate|deploy|test|promote|rollback [--candidate id] [--environment target] [--replace-manifest --reason text] [--adopt-online-baseline --adoption-reason text] [--json]
+  openxiangda release ship|candidate|deploy|test|promote|rollback [--candidate id] [--environment target] [--replace-manifest] [--allow-runtime-rollback --reason text] [--adopt-online-baseline --adoption-reason text] [--json]
   openxiangda task status --change <id> [--profile name] [--watch] [--json]
   openxiangda release backend-head|backend-list|backend-detail|backend-diff|backend-rollback|backend-abort|backend-retry [releaseId] [--profile name] [--json]
   openxiangda release app-capture|app-head|app-list|app-detail|app-diff|app-prepare|app-verify|app-activate|app-finalize|app-rollback|app-abort [releaseId] [--staged-resources-json <JSON|file>] [--activate-staged-children] [--break-glass-adopt-verified-root --reason text] [--force-activate-without-validation] [--profile name] [--json]
@@ -1177,9 +1177,12 @@ function writeManagedShip(changeId, value) {
 }
 function normalizeManagedShipIntent(value = {}) {
+  const enabled = Boolean(value.enabled);
   return {
-    enabled: Boolean(value.enabled),
-    reason: String(value.reason || '').trim() || null,
+    enabled,
+    reason: enabled
+      ? String(value.reason || '').trim() || null
+      : null,
   };
 }
@@ -1201,8 +1204,13 @@ function resolveManagedShipIntents(flags = {}, existingShip = null) {
     enabled: flags['adopt-online-baseline'],
     reason: flags['adoption-reason'],
   });
+  const requestedRuntimeRollback = normalizeManagedShipIntent({
+    enabled: flags['allow-runtime-rollback'],
+    reason: flags.reason,
+  });
   const hasFrozenCandidate = Boolean(existingShip?.candidateId);
   let baselineAdoption = requestedBaselineAdoption;
+  let runtimeRollback = requestedRuntimeRollback;
   if (hasFrozenCandidate) {
     const recordedReplacement = normalizeManagedShipIntent(
@@ -1239,6 +1247,34 @@ function resolveManagedShipIntents(flags = {}, existingShip = null) {
     baselineAdoption = adoptionExplicitlySupplied
       ? requestedBaselineAdoption
       : recordedAdoption;
+    const hasRecordedRuntimeRollback = Object.prototype.hasOwnProperty.call(
+      existingShip,
+      'runtimeRollback'
+    );
+    const recordedRuntimeRollback = normalizeManagedShipIntent(
+      existingShip.runtimeRollback
+    );
+    const runtimeRollbackExplicitlySupplied =
+      Object.prototype.hasOwnProperty.call(
+        flags,
+        'allow-runtime-rollback'
+      );
+    if (
+      hasRecordedRuntimeRollback &&
+      runtimeRollbackExplicitlySupplied &&
+      !managedShipIntentMatches(
+        recordedRuntimeRollback,
+        requestedRuntimeRollback
+      )
+    ) {
+      fail(
+        'RELEASE_SHIP_RUNTIME_ROLLBACK_INTENT_MISMATCH: --allow-runtime-rollback/--reason 与该 candidate 的预发 Runtime 发布意图不一致；省略这两个参数可自动复用 ship.json 中的已冻结意图'
+      );
+    }
+    runtimeRollback = runtimeRollbackExplicitlySupplied
+      ? requestedRuntimeRollback
+      : recordedRuntimeRollback;
   }
   const effectiveFlags = { ...flags };
@@ -1249,10 +1285,23 @@ function resolveManagedShipIntents(flags = {}, existingShip = null) {
     delete effectiveFlags['adopt-online-baseline'];
     delete effectiveFlags['adoption-reason'];
   }
+  if (runtimeRollback.enabled) {
+    const existingReason = String(effectiveFlags.reason || '').trim();
+    if (existingReason && existingReason !== runtimeRollback.reason) {
+      fail(
+        'RELEASE_SHIP_RUNTIME_ROLLBACK_REASON_CONFLICT: Runtime rollback 与 manifest replacement 共用 --reason 时必须使用同一审计原因'
+      );
+    }
+    effectiveFlags['allow-runtime-rollback'] = true;
+    effectiveFlags.reason = runtimeRollback.reason;
+  } else {
+    delete effectiveFlags['allow-runtime-rollback'];
+  }
   return {
     manifestReplacement,
     baselineAdoption,
+    runtimeRollback,
     effectiveFlags,
   };
 }
@@ -1271,12 +1320,17 @@ function buildManagedShipCommand(
     JSON.stringify(profileName),
   ];
   if (options.confirmProduction) args.push('--confirm-production');
+  let sharedReason = null;
   if (intents.manifestReplacement.enabled) {
-    args.push(
-      '--replace-manifest',
-      '--reason',
-      JSON.stringify(intents.manifestReplacement.reason)
-    );
+    args.push('--replace-manifest');
+    sharedReason = intents.manifestReplacement.reason;
+  }
+  if (intents.runtimeRollback.enabled) {
+    args.push('--allow-runtime-rollback');
+    sharedReason = intents.runtimeRollback.reason;
+  }
+  if (sharedReason) {
+    args.push('--reason', JSON.stringify(sharedReason));
   }
   if (intents.baselineAdoption.enabled) {
     args.push(
@@ -1972,6 +2026,7 @@ async function publishWorkspaceRelease(config, target, flags = {}) {
   if (!changeId) {
     fail('用法: openxiangda release publish --change <id> --profile <name>');
   }
+  assertManagedRuntimeRollbackFlags(flags);
   const releaseCandidate = flags.__verifiedCandidate
     ? assertLocalCandidate(flags.__verifiedCandidate)
     : readReleaseCandidate(candidateId);
@@ -4028,6 +4083,281 @@ async function readManagedDeployment(
   return deployment;
 }
+function inspectSucceededPreproductionDeployment(
+  deployment,
+  context,
+  now = Date.now()
+) {
+  const candidate = context?.candidate || {};
+  const target = context?.target || {};
+  const currentAppReleaseId = String(
+    context?.currentAppReleaseId || ''
+  ).trim();
+  const evidence = deployment?.evidenceSummary;
+  const reasons = [];
+  if (deployment?.status !== 'succeeded') {
+    reasons.push('status_not_succeeded');
+  }
+  if (deployment?.kind !== 'deploy') {
+    reasons.push('kind_not_preproduction_deploy');
+  }
+  if (deployment?.candidateId !== candidate.id) {
+    reasons.push('candidate_mismatch');
+  }
+  if (deployment?.targetEnvironmentId !== target.environmentId) {
+    reasons.push('target_environment_mismatch');
+  }
+  if (!currentAppReleaseId) reasons.push('current_app_release_missing');
+  if (deployment?.targetAppReleaseId !== currentAppReleaseId) {
+    reasons.push('active_app_release_mismatch');
+  }
+  if (!deployment?.evidenceHash) reasons.push('evidence_hash_missing');
+  if (!evidence || typeof evidence !== 'object' || Array.isArray(evidence)) {
+    reasons.push('evidence_summary_missing');
+  } else {
+    if (sha256Canonical(evidence) !== deployment.evidenceHash) {
+      reasons.push('evidence_hash_mismatch');
+    }
+    if (evidence.outcome !== 'passed') reasons.push('evidence_not_passed');
+    if (evidence.deploymentId !== deployment.id) {
+      reasons.push('evidence_deployment_mismatch');
+    }
+    if (evidence.candidateId !== candidate.id) {
+      reasons.push('evidence_candidate_mismatch');
+    }
+    if (evidence.candidateHash !== candidate.candidateHash) {
+      reasons.push('evidence_candidate_hash_mismatch');
+    }
+    if ((evidence.testPlanHash || null) !== (candidate.testPlanHash || null)) {
+      reasons.push('evidence_test_plan_hash_mismatch');
+    }
+    if (evidence.environmentId !== target.environmentId) {
+      reasons.push('evidence_environment_mismatch');
+    }
+    if (evidence.environmentKind !== 'preproduction') {
+      reasons.push('evidence_environment_kind_mismatch');
+    }
+    if (evidence.appType !== target.appType) {
+      reasons.push('evidence_app_type_mismatch');
+    }
+    if (evidence.appReleaseId !== deployment.targetAppReleaseId) {
+      reasons.push('evidence_app_release_mismatch');
+    }
+    const validUntil = Date.parse(evidence.validUntil || '');
+    if (!Number.isFinite(validUntil) || validUntil <= now) {
+      reasons.push('evidence_expired');
+    }
+  }
+  return { accepted: reasons.length === 0, reasons };
+}
+function selectSucceededPreproductionDeployment(
+  deployments,
+  context,
+  now = Date.now()
+) {
+  const ordered = [...(deployments || [])].sort((left, right) => {
+    const rightCreated =
+      Date.parse(right?.createdAt || right?.finishedAt || '') || 0;
+    const leftCreated =
+      Date.parse(left?.createdAt || left?.finishedAt || '') || 0;
+    return rightCreated - leftCreated;
+  });
+  for (const deployment of ordered) {
+    const validation = inspectSucceededPreproductionDeployment(
+      deployment,
+      context,
+      now
+    );
+    if (validation.accepted) return deployment;
+  }
+  return null;
+}
+function managedPreproductionEvidenceLineage(
+  deployment,
+  candidate,
+  target
+) {
+  return {
+    deploymentId: deployment.id,
+    candidateId: candidate.id,
+    candidateHash: candidate.candidateHash,
+    testPlanHash: candidate.testPlanHash || null,
+    environmentId: target.environmentId,
+    environmentKind: target.environmentKind,
+    appType: target.appType,
+    appReleaseId: deployment.targetAppReleaseId,
+    evidenceHash: deployment.evidenceHash || null,
+  };
+}
+function recoveredPreproductionShipPatch(
+  resolution,
+  candidate,
+  target,
+  recoveredAt = new Date().toISOString()
+) {
+  const deployment = resolution.deployment;
+  return {
+    status: 'awaiting_production_confirmation',
+    preproductionDeploymentId: deployment.id,
+    preproductionAppReleaseId: deployment.targetAppReleaseId,
+    preproductionStatus: deployment.status,
+    preproductionEvidenceHash: deployment.evidenceHash,
+    preproductionEvidenceLineage: managedPreproductionEvidenceLineage(
+      deployment,
+      candidate,
+      target
+    ),
+    preproductionRecovery: {
+      status: 'recovered_from_candidate_history',
+      replacedDeploymentId: resolution.replacedDeploymentId,
+      replacedDeploymentStatus: resolution.replacedDeploymentStatus,
+      selectedDeploymentId: deployment.id,
+      recoveredAt,
+    },
+    failure: null,
+  };
+}
+async function resolvePreproductionDeploymentForAcceptance(
+  config,
+  target,
+  logicalAppCode,
+  originalDeploymentId,
+  candidate
+) {
+  await assertRemoteCandidateMatches(
+    config,
+    target,
+    logicalAppCode,
+    candidate
+  );
+  const status = await requestWithAuth(
+    config,
+    target.profileName,
+    environmentSetApiPath(logicalAppCode, '/status')
+  );
+  const targetStatus = (status?.environments || []).find(
+    environment =>
+      environment?.id === target.environmentId &&
+      environment?.kind === 'preproduction' &&
+      environment?.appType === target.appType
+  );
+  const currentAppReleaseId = String(
+    targetStatus?.heads?.appReleaseId || ''
+  ).trim();
+  if (!targetStatus || !currentAppReleaseId) {
+    fail(
+      `PREPRODUCTION_ACTIVE_HEAD_REQUIRED: 预发环境 ${target.environmentId} 缺少可验证的当前 AppRelease head`
+    );
+  }
+  let originalDeployment = null;
+  let originalReadError = null;
+  try {
+    originalDeployment = await readManagedDeployment(
+      config,
+      target,
+      logicalAppCode,
+      originalDeploymentId,
+      { full: true }
+    );
+  } catch (error) {
+    originalReadError = error;
+  }
+  const context = { candidate, target, currentAppReleaseId };
+  if (originalDeployment?.status === 'deployed') {
+    const identityMatches =
+      originalDeployment.kind === 'deploy' &&
+      originalDeployment.candidateId === candidate.id &&
+      originalDeployment.targetEnvironmentId === target.environmentId &&
+      originalDeployment.targetAppReleaseId === currentAppReleaseId;
+    if (identityMatches) {
+      return {
+        deployment: originalDeployment,
+        recovered: false,
+        currentAppReleaseId,
+      };
+    }
+  }
+  if (originalDeployment?.status === 'succeeded') {
+    const validation = inspectSucceededPreproductionDeployment(
+      originalDeployment,
+      context
+    );
+    if (validation.accepted) {
+      return {
+        deployment: originalDeployment,
+        recovered: false,
+        currentAppReleaseId,
+      };
+    }
+  }
+  const history = await requestWithAuth(
+    config,
+    target.profileName,
+    `${applicationDeploymentApiPath(logicalAppCode)}?limit=200`
+  );
+  const summaries = (Array.isArray(history) ? history : [])
+    .filter(
+      deployment =>
+        deployment?.id !== originalDeploymentId &&
+        deployment?.status === 'succeeded' &&
+        deployment?.kind === 'deploy' &&
+        deployment?.candidateId === candidate.id &&
+        deployment?.targetEnvironmentId === target.environmentId &&
+        deployment?.targetAppReleaseId === currentAppReleaseId
+    )
+    .sort((left, right) => {
+      const rightCreated = Date.parse(right?.createdAt || '') || 0;
+      const leftCreated = Date.parse(left?.createdAt || '') || 0;
+      return rightCreated - leftCreated;
+    });
+  const details = [];
+  for (const summary of summaries) {
+    const detail = await requestWithAuth(
+      config,
+      target.profileName,
+      `${applicationDeploymentApiPath(
+        logicalAppCode,
+        summary.id
+      )}?full=true`
+    );
+    details.push(detail);
+  }
+  const replacement = selectSucceededPreproductionDeployment(
+    details,
+    context
+  );
+  if (!replacement) {
+    const originalStatus = originalDeployment?.status || 'unreadable';
+    const error = new Error(
+      `PREPRODUCTION_NOT_READY_FOR_ACCEPTANCE: 预发 deployment ${originalDeploymentId} 当前状态为 ${originalStatus}，且未找到同 candidate、同环境、当前 AppRelease 和有效测试证据完全一致的 succeeded replacement`
+    );
+    error.code = 'PREPRODUCTION_NOT_READY_FOR_ACCEPTANCE';
+    error.data = {
+      originalDeploymentId,
+      originalStatus,
+      originalReadErrorCode: originalReadError?.code || null,
+      candidateId: candidate.id,
+      targetEnvironmentId: target.environmentId,
+      currentAppReleaseId,
+    };
+    throw error;
+  }
+  rememberTargetDeployment(target, replacement);
+  return {
+    deployment: replacement,
+    recovered: true,
+    replacedDeploymentId: originalDeploymentId,
+    replacedDeploymentStatus: originalDeployment?.status || 'unreadable',
+    currentAppReleaseId,
+  };
+}
 async function completeManagedDeployment(
   config,
   target,
@@ -4115,6 +4445,7 @@ const RELEASE_SHIP_SUPPORTED_FLAGS = new Set([
   'since',
   'expand-dependencies',
   'replace-manifest',
+  'allow-runtime-rollback',
   'reason',
   'adopt-online-baseline',
   'adoption-reason',
@@ -4139,12 +4470,19 @@ function assertReleaseShipFlags(flags = {}) {
     throw error;
   }
   const replacementRequested = Boolean(flags['replace-manifest']);
+  const runtimeRollbackRequested = Boolean(
+    flags['allow-runtime-rollback']
+  );
   const replacementReason = String(flags.reason || '').trim();
-  if (!replacementRequested && replacementReason) {
+  if (
+    !replacementRequested &&
+    !runtimeRollbackRequested &&
+    replacementReason
+  ) {
     const error = new Error(
-      'RELEASE_SHIP_REPLACE_MANIFEST_FLAG_REQUIRED: --reason 必须与 --replace-manifest 一起使用；命令已在任何 candidate/deployment 写入前终止'
+      'RELEASE_SHIP_SCOPED_REASON_FLAG_REQUIRED: --reason 必须与 --replace-manifest 或 --allow-runtime-rollback 一起使用；命令已在任何 candidate/deployment 写入前终止'
     );
-    error.code = 'RELEASE_SHIP_REPLACE_MANIFEST_FLAG_REQUIRED';
+    error.code = 'RELEASE_SHIP_SCOPED_REASON_FLAG_REQUIRED';
     throw error;
   }
   if (replacementRequested && replacementReason.length < 8) {
@@ -4154,6 +4492,13 @@ function assertReleaseShipFlags(flags = {}) {
     error.code = 'RELEASE_SHIP_REPLACE_MANIFEST_REASON_REQUIRED';
     throw error;
   }
+  if (runtimeRollbackRequested && replacementReason.length < 8) {
+    const error = new Error(
+      'RELEASE_SHIP_RUNTIME_ROLLBACK_REASON_REQUIRED: --allow-runtime-rollback 必须提供至少 8 个字符的 --reason；命令已在任何 candidate/deployment 写入前终止'
+    );
+    error.code = 'RELEASE_SHIP_RUNTIME_ROLLBACK_REASON_REQUIRED';
+    throw error;
+  }
   const adoptionRequested = Boolean(flags['adopt-online-baseline']);
   const adoptionReason = String(flags['adoption-reason'] || '').trim();
   if (!adoptionRequested && adoptionReason) {
@@ -4172,6 +4517,13 @@ function assertReleaseShipFlags(flags = {}) {
   }
 }
+function assertManagedRuntimeRollbackFlags(flags = {}) {
+  return resolveRuntimeRollbackBypass({
+    allowRollback: flags['allow-runtime-rollback'],
+    reason: flags.reason,
+  });
+}
 async function runApplicationShipCommand(
   config,
   initialTarget,
@@ -4183,7 +4535,7 @@ async function runApplicationShipCommand(
     readStringFlag(flags, 'change') || positional[0];
   if (!changeId) {
     fail(
-      '用法: openxiangda release ship --change <id> [--replace-manifest --reason "..."] [--adopt-online-baseline --adoption-reason "..."] [--confirm-production] [--acceptance-note "..."]'
+      '用法: openxiangda release ship --change <id> [--replace-manifest] [--allow-runtime-rollback] [--reason "..."] [--adopt-online-baseline --adoption-reason "..."] [--confirm-production] [--acceptance-note "..."]'
     );
   }
   const logicalApp = requireLogicalApplication(initialTarget);
@@ -4203,6 +4555,7 @@ async function runApplicationShipCommand(
   const {
     manifestReplacement,
     baselineAdoption,
+    runtimeRollback,
     effectiveFlags,
   } = intents;
@@ -4251,6 +4604,7 @@ async function runApplicationShipCommand(
         candidateFile: created.candidateFile,
         manifestReplacement,
         baselineAdoption,
+        runtimeRollback,
       });
     } else {
       assertLocalCandidate(candidate);
@@ -4288,6 +4642,7 @@ async function runApplicationShipCommand(
           preproductionStatus: failure.deploymentStatus,
           manifestReplacement,
           baselineAdoption,
+          runtimeRollback,
           failure,
           nextCommand: buildManagedShipCommand(
             changeId,
@@ -4310,6 +4665,7 @@ async function runApplicationShipCommand(
       preproductionStatus: deployment.status,
       manifestReplacement,
       baselineAdoption,
+      runtimeRollback,
       failure: null,
       preparedAt:
         existingShip?.preparedAt ||
@@ -4340,21 +4696,25 @@ async function runApplicationShipCommand(
   );
   const candidate = readCandidate(existingShip.candidateId);
   assertLocalCandidate(candidate);
-  let preproductionDeployment = await readManagedDeployment(
+  const preproductionResolution = await resolvePreproductionDeploymentForAcceptance(
     config,
     preproduction,
     logicalApp.code,
     existingShip.preproductionDeploymentId,
-    { full: true }
+    candidate
   );
-  if (
-    !['deployed', 'succeeded'].includes(
-      preproductionDeployment.status
-    ) ||
-    !preproductionDeployment.targetAppReleaseId
-  ) {
-    fail(
-      `PREPRODUCTION_NOT_READY_FOR_ACCEPTANCE: 预发 deployment ${preproductionDeployment.id} 当前状态为 ${preproductionDeployment.status}`
+  let preproductionDeployment = preproductionResolution.deployment;
+  if (preproductionResolution.recovered) {
+    writeManagedShip(
+      changeId,
+      recoveredPreproductionShipPatch(
+        preproductionResolution,
+        candidate,
+        preproduction
+      )
+    );
+    warn(
+      `预发验收已从同 candidate 的成功部署恢复: ${preproductionResolution.replacedDeploymentId} -> ${preproductionDeployment.id}`
     );
   }
@@ -4427,6 +4787,15 @@ async function runApplicationShipCommand(
   const promotionStartedAt = new Date().toISOString();
   writeManagedShip(changeId, {
     status: 'confirmed_for_production',
+    preproductionDeploymentId: preproductionDeployment.id,
+    preproductionAppReleaseId: preproductionDeployment.targetAppReleaseId,
+    preproductionStatus: preproductionDeployment.status,
+    preproductionEvidenceHash: preproductionDeployment.evidenceHash,
+    preproductionEvidenceLineage: managedPreproductionEvidenceLineage(
+      preproductionDeployment,
+      candidate,
+      preproduction
+    ),
     productionConfirmation: {
       status: 'confirmed',
       confirmedAt,
@@ -4464,6 +4833,7 @@ async function runApplicationShipCommand(
       productionStatus: failure.deploymentStatus,
       manifestReplacement,
       baselineAdoption,
+      runtimeRollback,
       failure,
       productionPromotion: {
         status: 'failed',
@@ -4528,6 +4898,7 @@ async function runApplicationShipCommand(
       productionStatus: promoted.deployment.status,
       manifestReplacement,
       baselineAdoption,
+      runtimeRollback,
       failure,
       productionPromotion: {
         status: 'evidence_failed',
@@ -4635,6 +5006,10 @@ async function runApplicationEnvironmentReleaseCommand(
     return { deployment: reconciled, reconciled: true };
   }
+  if (['deploy', 'promote'].includes(subcommand)) {
+    assertManagedRuntimeRollbackFlags(flags);
+  }
   const candidateId =
     readStringFlag(flags, 'candidate') ||
     readStringFlag(flags, 'candidate-id') ||
@@ -4756,13 +5131,14 @@ async function release(args) {
   if (wantsSubcommandHelp(subcommand, flags)) {
     print([
       '用法: openxiangda release publish|begin|status|explain|integration-status|renew|end [--change id] [--profile name] [--json]',
-      '      openxiangda release ship|candidate|deploy|reconcile|test|promote|rollback [--candidate id] [--environment target] [--replace-manifest --reason text] [--adopt-online-baseline --adoption-reason text] [--confirm-production] [--json]',
+      '      openxiangda release ship|candidate|deploy|reconcile|test|promote|rollback [--candidate id] [--environment target] [--replace-manifest] [--allow-runtime-rollback --reason text] [--adopt-online-baseline --adoption-reason text] [--confirm-production] [--json]',
       '      openxiangda release backend-head|backend-list|backend-detail|backend-diff|backend-rollback|backend-abort|backend-retry [releaseId] [--profile name] [--json]',
       '      openxiangda release app-capture|app-head|app-list|app-detail|app-diff|app-post-commit|app-retry|app-prepare|app-verify|app-activate|app-finalize|app-rollback|app-abort [releaseId] [--staged-resources-json <JSON|file>] [--activate-staged-children] [--break-glass-adopt-verified-root --reason text] [--force-activate-without-validation] [--profile name] [--json]',
       '常用流程:',
       '  openxiangda release ship --change <id> --profile <name>',
       '  openxiangda release ship --change <id> --profile <name> --adopt-online-baseline --adoption-reason "已审计目标来自多次历史发布"',
       '  openxiangda release ship --change <id> --profile <name> --replace-manifest --reason "已审查精确 Function manifest"',
+      '  openxiangda release ship --change <id> --profile <name> --allow-runtime-rollback --reason "已审计并批准 Runtime 源码基线回退"',
       '  # 确认预发结果后；可选 --acceptance-note 留下人工验收记录：',
       '  openxiangda release ship --change <id> --profile <name> --confirm-production',
       '  openxiangda release publish --change <id> --profile <name>',
@@ -4780,6 +5156,7 @@ async function release(args) {
       '  - candidate 封存环境/资源绑定和两目标 Runtime 哈希产物；预发与正式部署均不现场重建，并以 deployment succeeded 闭环。',
       '  - 已合入主线但线上来自多次历史 lineage 的精确非删除恢复可显式使用 --adopt-online-baseline 与 --adoption-reason；预发冻结后，正式确认会从 ship.json 自动复用同一意图，仍保留冻结 Head、CAS、租约、staged children 和单次 App finalize。',
       '  - ship 的 --replace-manifest 与 --reason 必须成对，只透传给精确 Backend Function/Automation stage；正式确认必须复用与预发完全相同的参数。',
+      '  - --allow-runtime-rollback 与 --reason 必须成对，只透传给 runtime-stage；ship 会冻结并在正式确认自动复用该审计意图，app-finalize 不会收到这些参数。',
       '  - ship 当前不支持 --dry-run；任何未声明参数都会在 candidate/deployment 写入前 fail-closed。需要只读检查时使用 environment status/diff 与 release status。',
       '  - publish 默认等待租约并按私有执行日志恢复；上次写结果不确定时必须只读核对后显式 --resume-after-review。',
       '  - app-head 默认只输出紧凑 head 摘要；需要完整 manifest 时显式追加 --full。',
@@ -30146,8 +30523,11 @@ module.exports = {
   buildScopeGrantSourceSyncDecision,
   deploymentEvidencePendingError,
   deploymentQueueWaitDecision,
+  inspectSucceededPreproductionDeployment,
   main,
+  recoveredPreproductionShipPatch,
   resolveReleaseCommandScopedFiles,
+  selectSucceededPreproductionDeployment,
   resolveDeliveryV2BackendManifestReplacementIntent,
   resolveDataViewSourceFormCodes,
   satisfiedFormCodesFromContext,

package/openxiangda-skills/SKILL.md CHANGED Viewed

@@ -135,6 +135,8 @@ For an audited catch-up whose exact non-delete targets are already merged but wh
 When an environment-managed release intentionally replaces complete Function/Automation manifests, `release ship` may add the inseparable `--replace-manifest --reason "..."` pair. The reason must be at least 8 characters; only an exact Backend selector receives it, and the production confirmation must repeat the exact preproduction pair. It never widens Form, Workflow, Runtime, configuration, wildcard, or app-wide stages.
+When the sealed Runtime source intentionally does not descend from the active Runtime lineage, managed `release ship`, recovery `release deploy`, and `release promote` may add `--allow-runtime-rollback --reason "..."`. The reason must be at least 8 characters. The CLI forwards the pair only to `runtime-stage`, never to Backend/Form/Workflow/configuration or `app-finalize`; ship freezes the pair in `ship.json`, and production confirmation automatically inherits it. Without the explicit pair, Runtime lineage remains fail closed.
 `resource plan` and publish dry-runs are strictly GET/HEAD-only. `READ_ONLY_AUTH_REQUIRED` means the access token expired; run `openxiangda auth refresh --profile <name>` or log in again before retrying. Never add an automatic refresh POST inside a plan.
 `release publish` is the default promotion entrypoint only for legacy unmanaged workspaces. It verifies without rewriting reviewed `change.json`/`release.json`, waits for the app lease, freezes the App capture after ownership is acquired, executes deterministic exact staged steps, resumes from `.openxiangda/releases/<change>/execution.json`, atomically finalizes, verifies mainline integration, and releases the lease. Environment-managed applications use the two-phase `release ship`; candidate/deploy/test/promote, `release begin`, and child commands remain recovery/diagnostic primitives.

package/openxiangda-skills/skills/openxiangda-core/SKILL.md CHANGED Viewed

@@ -138,6 +138,8 @@ When a reviewed catch-up contains exact non-delete targets that are already on a
 An environment-managed release may intentionally replace complete Function/Automation manifests with `release ship --replace-manifest --reason "..."`. The two flags are inseparable, the reason is at least 8 characters, only an exact Backend stage receives them, and production confirmation must repeat the exact preproduction intent. They never widen Form, Workflow, Runtime, configuration, wildcard, or app-wide stages.
+For an audited Runtime source rollback, managed `release ship`, recovery `release deploy`, and `release promote` accept `--allow-runtime-rollback --reason "..."` with a reason of at least 8 characters. This pair is scoped only to `runtime-stage` and never reaches resource stages or `app-finalize`. Ship freezes it in `ship.json`; production confirmation inherits it automatically. The default remains fail closed.
 `release publish` is the normal whole-app entrypoint for legacy unmanaged workspaces: it verifies SDD without mutating reviewed files, waits for the promotion lease, freezes one App capture, stages the exact Form/Backend/Runtime children, resumes from a private execution journal, finalizes once, and releases the lease. Managed applications use two-phase `release ship` and its deployment-scoped journal. Individual candidate/deploy/test/promote commands are recovery/diagnostic primitives.
 Reviewed bundle commands may retain `<profile>` as a template. The explicit real `release publish --profile <name>` value is bound to actual child argv without rewriting tracked SDD. React SPA page codes remain logical coverage targets and activate through the single Runtime child; they do not require PageRelease. If local lease state disappears, `release end --change <id>` reconciles a self-owned remote lease from the private execution journal and never reports inactive while a remote lease is active.

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.242",
+  "version": "1.0.244",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {
@@ -80,7 +80,7 @@
     "test:dependency-capsule": "node scripts/dependency-capsule-smoke.mjs",
     "test:typed-resource-plan": "node scripts/typed-resource-plan-smoke.mjs",
     "test:integration-bundle": "node scripts/integration-bundle-smoke.mjs",
-    "prepublishOnly": "npm run test:critical && node scripts/release-mainline-guard.mjs",
+    "prepublishOnly": "npm run release:evidence:verify && node scripts/release-mainline-guard.mjs",
     "prepack": "npm run source:admin-list && npm run build:sdk",
     "test:profile-isolation": "bash scripts/profile-isolation-smoke.sh",
     "test:resource-plan": "node scripts/resource-plan-smoke.mjs",
@@ -108,6 +108,8 @@
     "test:release-telemetry": "node scripts/release-telemetry-smoke.mjs",
     "test:release-explain": "node scripts/release-explain-smoke.mjs",
     "test:release-error-classification": "node scripts/release-error-classification-smoke.mjs",
+    "test:release-evidence": "node scripts/release-evidence-guard-smoke.mjs",
+    "release:evidence:verify": "node scripts/release-evidence-guard.mjs",
     "test:delivery-v2-package": "node scripts/delivery-v2-package-smoke.mjs",
     "test:delivery-v2-executor": "node scripts/delivery-v2-executor-smoke.mjs",
     "test:task-status": "node scripts/task-status-smoke.mjs",

package/templates/openxiangda-react-spa/AGENTS.md CHANGED Viewed

@@ -66,6 +66,8 @@ openxiangda commands --json
 环境托管发布需要完整替换 Function/Automation manifest 时，`release ship` 可成对增加 `--replace-manifest --reason "..."`；reason 至少 8 字符，只会进入精确 Backend selector，正式确认必须复用与预发完全相同的参数，绝不扩散到表单、流程、Runtime、配置资源或全量范围。
+环境托管发布确需审计式 Runtime 源码血缘回退时，`release ship`、恢复命令 `release deploy` 和 `release promote` 可成对增加 `--allow-runtime-rollback --reason "..."`；reason 至少 8 字符，只进入 `runtime-stage`，不进入资源阶段或 `app-finalize`。ship 会冻结该意图，正式确认自动复用；省略时继续失败关闭。
 受支持的配置资源（如 `publicAccessPolicies`）以精确 `resourceSelectors` 为发布边界；历史 `resources=true` 类别标记会被精确 selector 收窄。缺失 selector、未知类型、通配符 `*`、删除和真正全量资源仍必须 fail closed。
 `resource plan` 与 publish dry-run 严格只允许 GET/HEAD。遇到 `READ_ONLY_AUTH_REQUIRED` 时，先执行 `openxiangda auth refresh --profile <name>` 或重新登录再重试；不得在 plan 内自动 POST 刷新 token。

package/templates/sy-lowcode-app-workspace/AGENTS.md CHANGED Viewed

@@ -68,6 +68,7 @@ Delivery V2 自动从期望状态计算精确资源范围，封存内容寻址 A
 - ✅ 托管发布完成后运行 `release integration-status --change <change> --profile <name> --check`。CLI 会从私有 `ship.json` 恢复血缘，必要时自动沿 production/preproduction deployment ID 查找对应 `execution.json`；失败信息必须指出实际缺失的日志或字段。
 - ✅ 只有已审计目标早已进入权威主线、线上却由多次历史 lineage 组成且无法对应单一 Git 基线时，第一次 `release ship` 才可增加 `--adopt-online-baseline --adoption-reason "..."`；该意图冻结进私有 `ship.json` 并由后续 `--confirm-production` 自动复用。仅允许精确非删除 selectors，冻结 Head、change/lease、服务端 CAS、staged children 与单次 App finalize 仍是硬门禁。
 - ✅ 环境托管发布需要完整替换 Function/Automation manifest 时，`release ship` 可成对增加 `--replace-manifest --reason "..."`；reason 至少 8 字符，只透传精确 Backend selector，正式确认必须复用同一对参数，不扩散到 Form/Workflow/Runtime/配置或全量范围。
+- ✅ 环境托管发布确需审计式 Runtime 源码血缘回退时，`release ship`、恢复命令 `release deploy` 和 `release promote` 可成对增加 `--allow-runtime-rollback --reason "..."`；reason 至少 8 字符，只透传 `runtime-stage`，不进入资源阶段或 `app-finalize`。ship 冻结该意图并由正式确认自动复用；默认仍失败关闭。
 - ✅ 受支持的配置资源（如 `publicAccessPolicies`）以精确 `resourceSelectors` 为边界；历史 `resources=true` 类别标记会被精确 selector 收窄。缺失 selector、未知类型、通配符 `*`、删除和真正全量资源仍 fail closed。
 - ✅ 本地开发者可运行 `openxiangda studio` 查看两套环境、差异、候选、部署和测试证据；该页面只监听回环地址且只暴露注册动作，生产操作仍需显式确认。