pomaster 0.3.0 → 0.4.0

package/catalog/policies/policy.sec.third_party_execution_register.json

@@ -3,7 +3,8 @@
     "status": "vocab_pr_candidate",
     "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）；新 id 域段待登记：SEC",
     "proposal": "词汇表 PR 登记 policy kind 及新域段；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（与前批 45+9 条同因同请，合并进同一 vocab PR）",
-    "locked_vocab_untouched": true
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
   },
   "x-spec-d-materialization": {
     "status": "PROPOSAL",

package/catalog/policies/policy.sec.trust_boundary_enforcement.json

@@ -0,0 +1,93 @@
+{
+  "x-spec-d-materialization": {
+    "status": "PROPOSAL",
+    "package": "裁定批 F/D3-R1 排除卡逐卡复核物化（SPEC-D 池卡复用；分母=MASTer 池卡 + vendor 播种字节双锚）",
+    "human_review_required": true,
+    "evidence": "PLANNED",
+    "provenance": "POMaster_VNext/corpus/spec-knowledge/candidates/consolidated-pool.yaml",
+    "group": "BE-G2",
+    "candidate_id": "POLICY.SEC.TRUST_BOUNDARY_ENFORCEMENT",
+    "pool_statement_sha16": "f951cc095101d9e6",
+    "curated_rule": "D3 逐卡复核批（Owner 2026-09-05 裁定 D3=逐卡复核；72 张保守排除卡逐卡核锚）：required 9（D3b source=null 补锚落 MUST/MUST NOT 且与 MASTer 行锚交叉验证）+ advisory 16（Change Policy 锚 14 张降 advisory[行内容含「必须」行为规范、强度只降不升] + 池密度序前 2）= 25（D6 合并上限 policy+TP 合计 25/批内执行；超出 17 张 advisory 留 D3-R2 轮次台账）；维持排除 30（Ownership 归属说明族）",
+    "denominator": "MASTer（池卡锚）"
+  },
+  "x-b6-porting": {
+    "status": "PROPOSAL",
+    "batch": "D3-R1",
+    "human_review_required": true,
+    "classification_face": "policy",
+    "enforcement_axis": {
+      "source_sections": [
+        "MUST"
+      ],
+      "rule": "SHOULD/Change Policy 源条目 enforcement 必须 advisory（禁升 required）；MUST/MUST NOT 源条目 enforcement 必须 required_when_applicable（降级合法）",
+      "asserted_by": "packages/cli/tests/catalog-b6-porting.spec.ts"
+    },
+    "extra_master_sections": [],
+    "denominator": "vendor",
+    "vendor_pin": {
+      "path": "pomaster/components/backend-hard-spec/assets/universal/10-security-protocol.md",
+      "sha256": "56387f03edd35df50a5a701f4daab174b744d490663393f43331cf5401149f67",
+      "bytes": 1385
+    },
+    "seeded_spec": ".pomaster/specs/hard/backend/10-security-protocol.md",
+    "seed_manifest": "packages/cli/seeds/manifest.json",
+    "d3_review": {
+      "excluded_from_batch": "B6C",
+      "exclusion_reason_at_seed": "卡层 source=null（锚证据不足），保守排除待复核",
+      "adjudication": "D3 逐卡复核（Owner 2026-09-05 裁定 D3=逐卡复核，裁定批 F 落地 2026-09-05）：本卡原属 B6C 保守排除留池（排除理由：卡层 source=null（锚证据不足），保守排除待复核）；复核补锚回 vendor/MASTer 源取得行级证据，锚段=MUST，按强度入册（MUST/MUST NOT 行锚 required 原样）",
+      "anchor_evidence": "MASTer 10-security-protocol.md 25「- 所有信任边界必须执行服务端校验、最小权限、失败关闭和安全审计。」",
+      "pool_enforcement_at_seed": "required_when_applicable"
+    }
+  },
+  "id": "POLICY.SEC.TRUST_BOUNDARY_ENFORCEMENT",
+  "kind": "policy",
+  "axis_profile": "policy_default",
+  "classification": "UNIVERSAL_POLICY",
+  "axes": {
+    "lifecycle": "PROPOSED",
+    "confidence": "UNRESOLVED",
+    "evidence": "PLANNED",
+    "change": "STABLE"
+  },
+  "title_zh": "信任边界服务端四动作",
+  "statement_zh": "数据或调用每次从较低信任域进入较高权限域时，必须由服务端一侧完成四项动作——输入校验、最小权限授予、默认拒绝（fail-closed）与审计留痕——任何一项不可省略。",
+  "statement_en_keywords": [
+    "trust boundary",
+    "server-side validation",
+    "least privilege",
+    "fail-closed",
+    "audit trail"
+  ],
+  "applies_when": {
+    "lane": "backend",
+    "condition": "任何跨信任域的数据流或调用入口",
+    "applicability_note": "任何跨信任域的数据流或调用入口"
+  },
+  "enforcement": "required_when_applicable",
+  "authority": {
+    "owner": "HUMAN_OWNER",
+    "delegates": [],
+    "write_policy": "EVOLUTION_CHANNEL",
+    "escalation_hint": "catalog-spec-decomposition"
+  },
+  "origin": "ingested",
+  "origin_note": "裁定批 F/D3-R1 D3 逐卡复核物化（原 B6C 保守排除卡补锚收编）；statement 沿用 SPEC-D 候选卡独立措辞（clean-room），零逐字拷贝上游源文本；播种分母=vendor 字节（x-b6-porting.vendor_pin），分解分母=MASTer 池卡（x-spec-d-materialization）",
+  "sources": [
+    {
+      "type": "design_seed",
+      "ref": "POMaster_VNext/corpus/spec-knowledge/candidates/BE-G2.yaml",
+      "captured_by": "agent:claude/spec-d-consolidation",
+      "locator": {
+        "candidate": "POLICY.SEC.TRUST_BOUNDARY_ENFORCEMENT",
+        "source_protocol": ".trellis/spec/backend/10-security-protocol.md",
+        "lines": "25"
+      },
+      "clean_room_note": "independently rewritten from SPEC-D decomposition candidate cards; zero verbatim copy"
+    }
+  ],
+  "review_notes": [
+    "信任边界四动作义务在既有 228 条中无对应条目（B6b-I BOUNDARY.VALIDATE_IN_ENCODE_OUT 管数据入口校验/出口编码通则，本管跨信任域提权的四动作闭环），零语义重复；与 BOUNDARY.VALIDATE_IN_ENCODE_OUT 互引（通则/专项）。",
+    "D3b 补锚：卡层 source=null，复核回 MASTer 10-security-protocol.md L25（MUST 段）取得行级证据，required 入册（强度沿池判原样）。"
+  ]
+}

package/catalog/policies/policy.sec.upload_download_server_recheck.json

@@ -0,0 +1,91 @@
+{
+  "x-vocab-pr": {
+    "status": "vocab_pr_candidate",
+    "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
+    "proposal": "词汇表 PR 登记 policy kind 及新域段；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（与前批 45+25 条同因同请，合并进同一 vocab PR）",
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
+  },
+  "x-spec-d-materialization": {
+    "status": "PROPOSAL",
+    "package": "B6b-I FE 播种移植（SPEC-D 池卡复用；分母=MASTer 池卡 + vendor 播种字节双锚）",
+    "human_review_required": true,
+    "evidence": "PLANNED",
+    "provenance": "POMaster_VNext/corpus/spec-knowledge/candidates/consolidated-pool.yaml",
+    "group": "FE-G1",
+    "candidate_id": "POLICY.SEC.UPLOAD_DOWNLOAD_SERVER_RECHECK",
+    "density_rank": null,
+    "density_score": 32.38,
+    "pool_statement_sha16": "b8f4c26bf76cf533",
+    "curated_rule": "B6b-I 分母（FE 01-23）required 池（ELIGIBLE 未物化）按池密度序取前 22 + advisory 池（SHOULD 源 backlog policy 卡）按同公式密度序取前 3 = 25（D5 上限）；UNIVERSAL + UNIVERSAL_POLICY + 无 uncertainty + 非 project_scope + 非重复",
+    "denominator": "MASTer（池卡 source_protocol 锚）"
+  },
+  "x-b6-porting": {
+    "status": "PROPOSAL",
+    "batch": "B6B-1",
+    "human_review_required": true,
+    "enforcement_axis": {
+      "source_sections": [
+        "MUST"
+      ],
+      "rule": "SHOULD/Change Policy 源条目 enforcement 必须 advisory（禁升 required）；MUST/MUST NOT 源条目 enforcement 必须 required_when_applicable（降级合法）",
+      "asserted_by": "packages/cli/tests/catalog-b6-porting.spec.ts"
+    },
+    "extra_master_sections": [],
+    "denominator": "vendor",
+    "vendor_pin": {
+      "path": "pomaster/components/frontend-hard-spec/assets/universal/04-security-protocol.md",
+      "sha256": "4d9bb6bd34a64fcc3e362c969492bc326533e16ef4c6d2284dc01442733504e6",
+      "bytes": 21948
+    },
+    "seeded_spec": ".pomaster/specs/hard/frontend/04-security-protocol.md",
+    "seed_manifest": "packages/cli/seeds/manifest.json"
+  },
+  "id": "POLICY.SEC.UPLOAD_DOWNLOAD_SERVER_RECHECK",
+  "kind": "policy",
+  "axis_profile": "policy_default",
+  "classification": "UNIVERSAL_POLICY",
+  "axes": {
+    "lifecycle": "PROPOSED",
+    "confidence": "UNRESOLVED",
+    "evidence": "PLANNED",
+    "change": "STABLE"
+  },
+  "title_zh": "上传下载服务端复验",
+  "statement_zh": "文件上传与下载的权限、类型与范围必须由服务端再次校验，客户端检查不作为边界。",
+  "statement_en_keywords": [
+    "server side recheck",
+    "upload download boundary",
+    "client checks are not the boundary"
+  ],
+  "applies_when": {
+    "lane": "any",
+    "condition": "文件上传下载链路",
+    "applicability_note": "文件上传下载链路"
+  },
+  "enforcement": "required_when_applicable",
+  "authority": {
+    "owner": "HUMAN_OWNER",
+    "delegates": [],
+    "write_policy": "EVOLUTION_CHANNEL",
+    "escalation_hint": "catalog-spec-decomposition"
+  },
+  "origin": "ingested",
+  "origin_note": "B6b-I FE 播种移植物化；statement 沿用 SPEC-D 候选卡独立措辞（clean-room），零逐字拷贝上游源文本；播种分母=vendor 字节（x-b6-porting.vendor_pin），分解分母=MASTer 池卡（x-spec-d-materialization）",
+  "sources": [
+    {
+      "type": "design_seed",
+      "ref": "POMaster_VNext/corpus/spec-knowledge/candidates/FE-G1.yaml",
+      "captured_by": "agent:claude/spec-d-consolidation",
+      "locator": {
+        "candidate": "POLICY.SEC.UPLOAD_DOWNLOAD_SERVER_RECHECK",
+        "source_protocol": ".trellis/spec/frontend/04-security-protocol.md",
+        "lines": "L25"
+      },
+      "clean_room_note": "independently rewritten from SPEC-D decomposition candidate cards; zero verbatim copy"
+    }
+  ],
+  "review_notes": [
+    "文件传输服务端复验在既有 143 条中无对应条目，零语义重复；与 BOUNDARY.VALIDATE_IN_ENCODE_OUT 为通则与特例关系（数据边界通则 vs 上传下载专项），互引。"
+  ]
+}

package/catalog/policies/policy.sec.url_source_allowlist.json

@@ -0,0 +1,91 @@
+{
+  "x-vocab-pr": {
+    "status": "vocab_pr_candidate",
+    "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
+    "proposal": "词汇表 PR 登记 policy kind 及新域段；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（与前批 45+25 条同因同请，合并进同一 vocab PR）",
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
+  },
+  "x-spec-d-materialization": {
+    "status": "PROPOSAL",
+    "package": "B6b-I FE 播种移植（SPEC-D 池卡复用；分母=MASTer 池卡 + vendor 播种字节双锚）",
+    "human_review_required": true,
+    "evidence": "PLANNED",
+    "provenance": "POMaster_VNext/corpus/spec-knowledge/candidates/consolidated-pool.yaml",
+    "group": "FE-G1",
+    "candidate_id": "POLICY.SEC.URL_SOURCE_ALLOWLIST",
+    "density_rank": null,
+    "density_score": 32.62,
+    "pool_statement_sha16": "c6c8009c65f759dc",
+    "curated_rule": "B6b-I 分母（FE 01-23）required 池（ELIGIBLE 未物化）按池密度序取前 22 + advisory 池（SHOULD 源 backlog policy 卡）按同公式密度序取前 3 = 25（D5 上限）；UNIVERSAL + UNIVERSAL_POLICY + 无 uncertainty + 非 project_scope + 非重复",
+    "denominator": "MASTer（池卡 source_protocol 锚）"
+  },
+  "x-b6-porting": {
+    "status": "PROPOSAL",
+    "batch": "B6B-1",
+    "human_review_required": true,
+    "enforcement_axis": {
+      "source_sections": [
+        "MUST"
+      ],
+      "rule": "SHOULD/Change Policy 源条目 enforcement 必须 advisory（禁升 required）；MUST/MUST NOT 源条目 enforcement 必须 required_when_applicable（降级合法）",
+      "asserted_by": "packages/cli/tests/catalog-b6-porting.spec.ts"
+    },
+    "extra_master_sections": [],
+    "denominator": "vendor",
+    "vendor_pin": {
+      "path": "pomaster/components/frontend-hard-spec/assets/universal/04-security-protocol.md",
+      "sha256": "4d9bb6bd34a64fcc3e362c969492bc326533e16ef4c6d2284dc01442733504e6",
+      "bytes": 21948
+    },
+    "seeded_spec": ".pomaster/specs/hard/frontend/04-security-protocol.md",
+    "seed_manifest": "packages/cli/seeds/manifest.json"
+  },
+  "id": "POLICY.SEC.URL_SOURCE_ALLOWLIST",
+  "kind": "policy",
+  "axis_profile": "policy_default",
+  "classification": "UNIVERSAL_POLICY",
+  "axes": {
+    "lifecycle": "PROPOSED",
+    "confidence": "UNRESOLVED",
+    "evidence": "PLANNED",
+    "change": "STABLE"
+  },
+  "title_zh": "跳转与资源地址限定受信来源",
+  "statement_zh": "跳转地址、外链、下载与资源地址必须限定安全协议与受信来源，禁止由不可信参数直接决定。",
+  "statement_en_keywords": [
+    "url source allowlist",
+    "safe protocols only",
+    "no untrusted redirect"
+  ],
+  "applies_when": {
+    "lane": "any",
+    "condition": "构造或接受任何跳转/加载地址",
+    "applicability_note": "构造或接受任何跳转/加载地址"
+  },
+  "enforcement": "required_when_applicable",
+  "authority": {
+    "owner": "HUMAN_OWNER",
+    "delegates": [],
+    "write_policy": "EVOLUTION_CHANNEL",
+    "escalation_hint": "catalog-spec-decomposition"
+  },
+  "origin": "ingested",
+  "origin_note": "B6b-I FE 播种移植物化；statement 沿用 SPEC-D 候选卡独立措辞（clean-room），零逐字拷贝上游源文本；播种分母=vendor 字节（x-b6-porting.vendor_pin），分解分母=MASTer 池卡（x-spec-d-materialization）",
+  "sources": [
+    {
+      "type": "design_seed",
+      "ref": "POMaster_VNext/corpus/spec-knowledge/candidates/FE-G1.yaml",
+      "captured_by": "agent:claude/spec-d-consolidation",
+      "locator": {
+        "candidate": "POLICY.SEC.URL_SOURCE_ALLOWLIST",
+        "source_protocol": ".trellis/spec/frontend/04-security-protocol.md",
+        "lines": "L29"
+      },
+      "clean_room_note": "independently rewritten from SPEC-D decomposition candidate cards; zero verbatim copy"
+    }
+  ],
+  "review_notes": [
+    "URL 来源受信治理在既有 143 条中无对应条目，零语义重复。"
+  ]
+}

package/catalog/policies/policy.spec.admission_criteria.json

@@ -3,7 +3,8 @@
     "status": "vocab_pr_candidate",
     "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
     "proposal": "词汇表 PR 登记 policy kind 及新域段；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（与前批 45+9 条同因同请，合并进同一 vocab PR）",
-    "locked_vocab_untouched": true
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
   },
   "x-spec-d-materialization": {
     "status": "PROPOSAL",

package/catalog/policies/policy.spec.derived_view_regeneration.json

@@ -3,7 +3,8 @@
     "status": "vocab_pr_candidate",
     "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
     "proposal": "词汇表 PR 登记 policy kind 及新域段；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（与前批 45+9 条同因同请，合并进同一 vocab PR）",
-    "locked_vocab_untouched": true
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
   },
   "x-spec-d-materialization": {
     "status": "PROPOSAL",

package/catalog/policies/policy.spec.draft_not_baseline.json

@@ -3,7 +3,8 @@
     "status": "vocab_pr_candidate",
     "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
     "proposal": "词汇表 PR 登记 policy kind；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（两种落法待裁决，见 candidates-draft.json meta.vocab_findings[0]，affected=45）",
-    "locked_vocab_untouched": true
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
   },
   "x-pilot-proposal": {
     "status": "PROPOSAL",

package/catalog/policies/policy.spec.family_conflict_precedence.json

@@ -0,0 +1,93 @@
+{
+  "x-spec-d-materialization": {
+    "status": "PROPOSAL",
+    "package": "裁定批 G/D3-R2 排除卡逐卡复核物化·R2 轮（SPEC-D 池卡复用；分母=MASTer 池卡 + vendor 播种字节双锚）",
+    "human_review_required": true,
+    "evidence": "PLANNED",
+    "provenance": "POMaster_VNext/corpus/spec-knowledge/candidates/consolidated-pool.yaml",
+    "group": "BE-G1",
+    "candidate_id": "POLICY.SPEC.FAMILY_CONFLICT_PRECEDENCE",
+    "pool_statement_sha16": "7d4d4c31acfe1509",
+    "curated_rule": "D3 逐卡复核批 R2 轮（Owner 2026-09-05 裁定 D3=逐卡复核；裁定批 G 收尾批）：R1 入册 25（required 9 + advisory 16）后余量 17 张 advisory 全量入册——SHOULD 锚 13（卡层行锚缺席，复核回 MASTer 源取得行级证据：B6c BE-G4 六 + BE-G3 七）+ 非 12 段锚 4（B6b-II FE index 2 / B6c BE index 冲突优先序 1 / B6b-I FE20 Change Policy 锚 1，extra_master_sections 如实登记）；全部 advisory（池判 required 卡强度只降不升）；D6 合并口径 ≤25/批满足（17 ≤ 25）；72 张总账=R1 25 + R2 17 + 维持排除 30",
+    "denominator": "MASTer（池卡锚）"
+  },
+  "x-b6-porting": {
+    "status": "PROPOSAL",
+    "batch": "D3-R2",
+    "human_review_required": true,
+    "classification_face": "policy",
+    "enforcement_axis": {
+      "source_sections": [
+        "冲突与责任边界"
+      ],
+      "rule": "SHOULD/Change Policy 源条目 enforcement 必须 advisory（禁升 required）；MUST/MUST NOT 源条目 enforcement 必须 required_when_applicable（降级合法）",
+      "asserted_by": "packages/cli/tests/catalog-b6-porting.spec.ts"
+    },
+    "extra_master_sections": [
+      "冲突与责任边界"
+    ],
+    "denominator": "vendor",
+    "vendor_pin": {
+      "path": "pomaster/components/backend-hard-spec/assets/universal/index.md",
+      "sha256": "b50c1fdcab5d1a3217a6e28059580195f681b6e68f465eb8e055bd8e5310c479",
+      "bytes": 14733
+    },
+    "seeded_spec": ".pomaster/specs/hard/backend/index.md",
+    "seed_manifest": "packages/cli/seeds/manifest.json",
+    "d3_review": {
+      "excluded_from_batch": "B6C",
+      "exclusion_reason_at_seed": "行锚段映射非纯建议段（池 advisory 判定矛盾，保守排除待复核）",
+      "adjudication": "D3 逐卡复核 R2 轮（Owner 2026-09-05 裁定 D3=逐卡复核，裁定批 G 落地 2026-09-05）：本卡原属 B6C 保守排除留池（排除理由：行锚段映射非纯建议段（池 advisory 判定矛盾，保守排除待复核））；复核补锚回 MASTer 源取得行级证据，锚段=冲突与责任边界，按强度入册（锚行行为规范成分、无段级强度词形 advisory 落点）",
+      "anchor_evidence": "MASTer index.md 158-163「- 安全规则优先于便利性；最终服务端授权优先于客户端展示。」",
+      "pool_enforcement_at_seed": "advisory"
+    }
+  },
+  "id": "POLICY.SPEC.FAMILY_CONFLICT_PRECEDENCE",
+  "kind": "policy",
+  "axis_profile": "policy_default",
+  "classification": "UNIVERSAL_POLICY",
+  "axes": {
+    "lifecycle": "PROPOSED",
+    "confidence": "UNRESOLVED",
+    "evidence": "PLANNED",
+    "change": "STABLE"
+  },
+  "title_zh": "协议冲突裁决优先序",
+  "statement_zh": "族内规则冲突按固定优先序裁决——安全优先于便利，服务端权威授权优先于客户端展示，正式契约优先于替代品、历史示例与会话记录，权威语义协议优先于边界转换协议。",
+  "statement_en_keywords": [
+    "conflict precedence",
+    "security over convenience",
+    "formal contract priority"
+  ],
+  "applies_when": {
+    "lane": "any",
+    "condition": "族内协议语义冲突裁决",
+    "applicability_note": "族内协议语义冲突裁决"
+  },
+  "enforcement": "advisory",
+  "authority": {
+    "owner": "HUMAN_OWNER",
+    "delegates": [],
+    "write_policy": "EVOLUTION_CHANNEL",
+    "escalation_hint": "catalog-spec-decomposition"
+  },
+  "origin": "ingested",
+  "origin_note": "裁定批 G/D3-R2 D3 逐卡复核物化·R2 轮（原 B6C 保守排除卡补锚收编）；statement 沿用 SPEC-D 候选卡独立措辞（clean-room），零逐字拷贝上游源文本；播种分母=vendor 字节（x-b6-porting.vendor_pin），分解分母=MASTer 池卡（x-spec-d-materialization）",
+  "sources": [
+    {
+      "type": "design_seed",
+      "ref": "POMaster_VNext/corpus/spec-knowledge/candidates/BE-G1.yaml",
+      "captured_by": "agent:claude/spec-d-consolidation",
+      "locator": {
+        "candidate": "POLICY.SPEC.FAMILY_CONFLICT_PRECEDENCE",
+        "source_protocol": ".trellis/spec/backend/index.md",
+        "lines": "158-163"
+      },
+      "clean_room_note": "independently rewritten from SPEC-D decomposition candidate cards; zero verbatim copy"
+    }
+  ],
+  "review_notes": [
+    "协议族冲突裁决优先序在既有 228 条中无对应条目（CONFLICT.PRIORITY_LADDER 管跨域冲突优先阶梯——本管协议族内语义冲突的整序裁决，互引不合并；「正式契约优先」子句与 API.NO_INFORMAL_CONTRACT 互补）；卡自带 uncertainty 注记「本卡价值在整序」如实承袭。",
+    "锚落 MASTer BE index 自有段「冲突与责任边界」（L158-163）——D3 复核按锚行内容 advisory 入册（池判 advisory 原样；定义性优先序声明无段级强度词形），extra_master_sections 如实登记。"
+  ]
+}

package/catalog/policies/policy.spec.file_structure_contract.json

@@ -3,7 +3,8 @@
     "status": "vocab_pr_candidate",
     "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
     "proposal": "词汇表 PR 登记 policy kind 及新域段；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（与前批 45+9 条同因同请，合并进同一 vocab PR）",
-    "locked_vocab_untouched": true
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
   },
   "x-spec-d-materialization": {
     "status": "PROPOSAL",

package/catalog/policies/policy.spec.freeze_before_use.json

@@ -0,0 +1,93 @@
+{
+  "x-spec-d-materialization": {
+    "status": "PROPOSAL",
+    "package": "裁定批 G/D3-R2 排除卡逐卡复核物化·R2 轮（SPEC-D 池卡复用；分母=MASTer 池卡 + vendor 播种字节双锚）",
+    "human_review_required": true,
+    "evidence": "PLANNED",
+    "provenance": "POMaster_VNext/corpus/spec-knowledge/candidates/consolidated-pool.yaml",
+    "group": "FE-G1",
+    "candidate_id": "POLICY.SPEC.FREEZE_BEFORE_USE",
+    "pool_statement_sha16": "5a23173d38de9041",
+    "curated_rule": "D3 逐卡复核批 R2 轮（Owner 2026-09-05 裁定 D3=逐卡复核；裁定批 G 收尾批）：R1 入册 25（required 9 + advisory 16）后余量 17 张 advisory 全量入册——SHOULD 锚 13（卡层行锚缺席，复核回 MASTer 源取得行级证据：B6c BE-G4 六 + BE-G3 七）+ 非 12 段锚 4（B6b-II FE index 2 / B6c BE index 冲突优先序 1 / B6b-I FE20 Change Policy 锚 1，extra_master_sections 如实登记）；全部 advisory（池判 required 卡强度只降不升）；D6 合并口径 ≤25/批满足（17 ≤ 25）；72 张总账=R1 25 + R2 17 + 维持排除 30",
+    "denominator": "MASTer（池卡锚）"
+  },
+  "x-b6-porting": {
+    "status": "PROPOSAL",
+    "batch": "D3-R2",
+    "human_review_required": true,
+    "classification_face": "policy",
+    "enforcement_axis": {
+      "source_sections": [
+        "Spec 生命周期"
+      ],
+      "rule": "SHOULD/Change Policy 源条目 enforcement 必须 advisory（禁升 required）；MUST/MUST NOT 源条目 enforcement 必须 required_when_applicable（降级合法）",
+      "asserted_by": "packages/cli/tests/catalog-b6-porting.spec.ts"
+    },
+    "extra_master_sections": [
+      "Spec 生命周期"
+    ],
+    "denominator": "vendor",
+    "vendor_pin": {
+      "path": "pomaster/components/frontend-hard-spec/assets/universal/index.md",
+      "sha256": "37fc443ce1f90eaa2584a82e12300d8281760332ec69d55a52b26cb22a2b2375",
+      "bytes": 22578
+    },
+    "seeded_spec": ".pomaster/specs/hard/frontend/index.md",
+    "seed_manifest": "packages/cli/seeds/manifest.json",
+    "d3_review": {
+      "excluded_from_batch": "B6B-2",
+      "exclusion_reason_at_seed": "行锚全落 MASTer 项目扩展段（12 段闭包外），无源段证据，保守排除待复核",
+      "adjudication": "D3 逐卡复核 R2 轮（Owner 2026-09-05 裁定 D3=逐卡复核，裁定批 G 落地 2026-09-05）：本卡原属 B6B-2 保守排除留池（排除理由：行锚全落 MASTer 项目扩展段（12 段闭包外），无源段证据，保守排除待复核）；复核按锚行内容裁定 advisory 入册（锚行行为规范成分、无段级强度词形 advisory 落点）",
+      "anchor_evidence": "MASTer index.md L63-L68「- Frozen/Baseline 表示“可以作为开发依据”，不是永远不能改。」",
+      "pool_enforcement_at_seed": "advisory"
+    }
+  },
+  "id": "POLICY.SPEC.FREEZE_BEFORE_USE",
+  "kind": "policy",
+  "axis_profile": "policy_default",
+  "classification": "UNIVERSAL_POLICY",
+  "axes": {
+    "lifecycle": "PROPOSED",
+    "confidence": "UNRESOLVED",
+    "evidence": "PLANNED",
+    "change": "STABLE"
+  },
+  "title_zh": "规格消费前冻结",
+  "statement_zh": "各类规格应在被消费前冻结：需求规格在进入开发前、接口规格在联调前、公共组件规格在首次公共复用前、整体基线在首个垂直切片完成后。",
+  "statement_en_keywords": [
+    "freeze before use",
+    "requirement spec frozen before development",
+    "baseline after first vertical slice"
+  ],
+  "applies_when": {
+    "lane": "any",
+    "condition": "规格冻结时点安排",
+    "applicability_note": "规格冻结时点安排"
+  },
+  "enforcement": "advisory",
+  "authority": {
+    "owner": "HUMAN_OWNER",
+    "delegates": [],
+    "write_policy": "EVOLUTION_CHANNEL",
+    "escalation_hint": "catalog-spec-decomposition"
+  },
+  "origin": "ingested",
+  "origin_note": "裁定批 G/D3-R2 D3 逐卡复核物化·R2 轮（原 B6B-2 保守排除卡补锚收编）；statement 沿用 SPEC-D 候选卡独立措辞（clean-room），零逐字拷贝上游源文本；播种分母=vendor 字节（x-b6-porting.vendor_pin），分解分母=MASTer 池卡（x-spec-d-materialization）",
+  "sources": [
+    {
+      "type": "design_seed",
+      "ref": "POMaster_VNext/corpus/spec-knowledge/candidates/FE-G1.yaml",
+      "captured_by": "agent:claude/spec-d-consolidation",
+      "locator": {
+        "candidate": "POLICY.SPEC.FREEZE_BEFORE_USE",
+        "source_protocol": ".trellis/spec/frontend/index.md",
+        "lines": "L63-L68"
+      },
+      "clean_room_note": "independently rewritten from SPEC-D decomposition candidate cards; zero verbatim copy"
+    }
+  ],
+  "review_notes": [
+    "规格消费前冻结时点在既有 228 条中无对应条目；与 POLICY.SPEC.DRAFT_NOT_BASELINE、SPEC.ADMISSION_CRITERIA（B6b-I：草稿非基线/准入判据）同族互引——彼管草稿状态判定与准入，本管逐类规格的冻结时点安排（「可作开发依据」非「永不修改」，修改走受控变更）。",
+    "锚落 MASTer FE index 自有段「Spec 生命周期」（L63-L68）——D3 复核按锚行内容 advisory 入册（池判 advisory 原样），extra_master_sections 如实登记。"
+  ]
+}

package/catalog/policies/policy.spec.metadata_required.json

@@ -3,7 +3,8 @@
     "status": "vocab_pr_candidate",
     "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
     "proposal": "词汇表 PR 登记 policy kind；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（两种落法待裁决，见 candidates-draft.json meta.vocab_findings[0]，affected=45）",
-    "locked_vocab_untouched": true
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
   },
   "x-pilot-proposal": {
     "status": "PROPOSAL",

package/catalog/policies/policy.spec.post_dev_backfill_classify.json

@@ -3,7 +3,8 @@
     "status": "vocab_pr_candidate",
     "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
     "proposal": "词汇表 PR 登记 policy kind；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（两种落法待裁决，见 candidates-draft.json meta.vocab_findings[0]，affected=45）",
-    "locked_vocab_untouched": true
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
   },
   "x-pilot-proposal": {
     "status": "PROPOSAL",