pomaster 0.3.0 → 0.5.0

package/catalog/policies/policy.sec.authn_policy_unified.json

@@ -0,0 +1,91 @@
+{
+  "x-vocab-pr": {
+    "status": "vocab_pr_candidate",
+    "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
+    "proposal": "词汇表 PR 登记 policy kind 及新域段；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（与前批 45+25 条同因同请，合并进同一 vocab PR）",
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
+  },
+  "x-spec-d-materialization": {
+    "status": "PROPOSAL",
+    "package": "B6b-I FE 播种移植（SPEC-D 池卡复用；分母=MASTer 池卡 + vendor 播种字节双锚）",
+    "human_review_required": true,
+    "evidence": "PLANNED",
+    "provenance": "POMaster_VNext/corpus/spec-knowledge/candidates/consolidated-pool.yaml",
+    "group": "FE-G1",
+    "candidate_id": "POLICY.SEC.AUTHN_POLICY_UNIFIED",
+    "density_rank": null,
+    "density_score": 32.62,
+    "pool_statement_sha16": "f7a9b557c2b6de87",
+    "curated_rule": "B6b-I 分母（FE 01-23）required 池（ELIGIBLE 未物化）按池密度序取前 22 + advisory 池（SHOULD 源 backlog policy 卡）按同公式密度序取前 3 = 25（D5 上限）；UNIVERSAL + UNIVERSAL_POLICY + 无 uncertainty + 非 project_scope + 非重复",
+    "denominator": "MASTer（池卡 source_protocol 锚）"
+  },
+  "x-b6-porting": {
+    "status": "PROPOSAL",
+    "batch": "B6B-1",
+    "human_review_required": true,
+    "enforcement_axis": {
+      "source_sections": [
+        "MUST"
+      ],
+      "rule": "SHOULD/Change Policy 源条目 enforcement 必须 advisory（禁升 required）；MUST/MUST NOT 源条目 enforcement 必须 required_when_applicable（降级合法）",
+      "asserted_by": "packages/cli/tests/catalog-b6-porting.spec.ts"
+    },
+    "extra_master_sections": [],
+    "denominator": "vendor",
+    "vendor_pin": {
+      "path": "pomaster/components/frontend-hard-spec/assets/universal/04-security-protocol.md",
+      "sha256": "4d9bb6bd34a64fcc3e362c969492bc326533e16ef4c6d2284dc01442733504e6",
+      "bytes": 21948
+    },
+    "seeded_spec": ".pomaster/specs/hard/themes/security.md",
+    "seed_manifest": "packages/cli/seeds/manifest.json"
+  },
+  "id": "POLICY.SEC.AUTHN_POLICY_UNIFIED",
+  "kind": "policy",
+  "axis_profile": "policy_default",
+  "classification": "UNIVERSAL_POLICY",
+  "axes": {
+    "lifecycle": "PROPOSED",
+    "confidence": "UNRESOLVED",
+    "evidence": "PLANNED",
+    "change": "STABLE"
+  },
+  "title_zh": "认证凭据策略统一定义",
+  "statement_zh": "令牌、会话凭据、防伪令牌、登出与刷新机制必须在单一策略中统一定义，不得各处自行其是。",
+  "statement_en_keywords": [
+    "unified authn policy",
+    "single token lifecycle",
+    "no scattered session handling"
+  ],
+  "applies_when": {
+    "lane": "any",
+    "condition": "设计或修改认证会话体系时",
+    "applicability_note": "设计或修改认证会话体系时"
+  },
+  "enforcement": "required_when_applicable",
+  "authority": {
+    "owner": "HUMAN_OWNER",
+    "delegates": [],
+    "write_policy": "EVOLUTION_CHANNEL",
+    "escalation_hint": "catalog-spec-decomposition"
+  },
+  "origin": "ingested",
+  "origin_note": "B6b-I FE 播种移植物化；statement 沿用 SPEC-D 候选卡独立措辞（clean-room），零逐字拷贝上游源文本；播种分母=vendor 字节（x-b6-porting.vendor_pin），分解分母=MASTer 池卡（x-spec-d-materialization）",
+  "sources": [
+    {
+      "type": "design_seed",
+      "ref": "POMaster_VNext/corpus/spec-knowledge/candidates/FE-G1.yaml",
+      "captured_by": "agent:claude/spec-d-consolidation",
+      "locator": {
+        "candidate": "POLICY.SEC.AUTHN_POLICY_UNIFIED",
+        "source_protocol": ".trellis/spec/frontend/04-security-protocol.md",
+        "lines": "L21"
+      },
+      "clean_room_note": "independently rewritten from SPEC-D decomposition candidate cards; zero verbatim copy"
+    }
+  ],
+  "review_notes": [
+    "认证策略单一来源在既有 143 条中无对应条目（POLICY.WEB.API.SESSION_RECOVERY_SPLIT 管会话恢复与权限拒绝拆分，不管凭据机制统一定义），零语义重复。"
+  ]
+}

package/catalog/policies/policy.sec.no_client_side_trust.json

@@ -0,0 +1,95 @@
+{
+  "x-spec-d-materialization": {
+    "status": "PROPOSAL",
+    "package": "裁定批 F/D3-R1 排除卡逐卡复核物化（SPEC-D 池卡复用；分母=MASTer 池卡 + vendor 播种字节双锚）",
+    "human_review_required": true,
+    "evidence": "PLANNED",
+    "provenance": "POMaster_VNext/corpus/spec-knowledge/candidates/consolidated-pool.yaml",
+    "group": "BE-G2",
+    "candidate_id": "POLICY.SEC.NO_CLIENT_SIDE_TRUST",
+    "pool_statement_sha16": "fc887b4bd6cf9086",
+    "curated_rule": "D3 逐卡复核批（Owner 2026-09-05 裁定 D3=逐卡复核；72 张保守排除卡逐卡核锚）：required 9（D3b source=null 补锚落 MUST/MUST NOT 且与 MASTer 行锚交叉验证）+ advisory 16（Change Policy 锚 14 张降 advisory[行内容含「必须」行为规范、强度只降不升] + 池密度序前 2）= 25（D6 合并上限 policy+TP 合计 25/批内执行；超出 17 张 advisory 留 D3-R2 轮次台账）；维持排除 30（Ownership 归属说明族）",
+    "denominator": "MASTer（池卡锚）"
+  },
+  "x-b6-porting": {
+    "status": "PROPOSAL",
+    "batch": "D3-R1",
+    "human_review_required": true,
+    "classification_face": "policy",
+    "enforcement_axis": {
+      "source_sections": [
+        "MUST NOT"
+      ],
+      "rule": "SHOULD/Change Policy 源条目 enforcement 必须 advisory（禁升 required）；MUST/MUST NOT 源条目 enforcement 必须 required_when_applicable（降级合法）",
+      "asserted_by": "packages/cli/tests/catalog-b6-porting.spec.ts"
+    },
+    "extra_master_sections": [],
+    "denominator": "vendor",
+    "vendor_pin": {
+      "path": "pomaster/components/backend-hard-spec/assets/universal/10-security-protocol.md",
+      "sha256": "56387f03edd35df50a5a701f4daab174b744d490663393f43331cf5401149f67",
+      "bytes": 1385
+    },
+    "seeded_spec": ".pomaster/specs/hard/themes/security.md",
+    "seed_manifest": "packages/cli/seeds/manifest.json",
+    "d3_review": {
+      "excluded_from_batch": "B6C",
+      "exclusion_reason_at_seed": "卡层 source=null（锚证据不足），保守排除待复核",
+      "adjudication": "D3 逐卡复核（Owner 2026-09-05 裁定 D3=逐卡复核，裁定批 F 落地 2026-09-05）：本卡原属 B6C 保守排除留池（排除理由：卡层 source=null（锚证据不足），保守排除待复核）；复核补锚回 vendor/MASTer 源取得行级证据，锚段=MUST NOT，按强度入册（MUST/MUST NOT 行锚 required 原样）",
+      "anchor_evidence": "MASTer 10-security-protocol.md 29「- 不得信任前端隐藏、客户端校验、代理头或用户提供的资源归属。」",
+      "pool_enforcement_at_seed": "required_when_applicable"
+    }
+  },
+  "id": "POLICY.SEC.NO_CLIENT_SIDE_TRUST",
+  "kind": "policy",
+  "axis_profile": "policy_default",
+  "classification": "UNIVERSAL_POLICY",
+  "axes": {
+    "lifecycle": "PROPOSED",
+    "confidence": "UNRESOLVED",
+    "evidence": "PLANNED",
+    "change": "STABLE"
+  },
+  "title_zh": "客户端信号不作授权依据",
+  "statement_zh": "客户端侧的任何信号——隐藏字段、前端校验结论、代理附加头、调用方自述的资源归属——一律不得作为服务端授权判定或数据归属认定的依据。",
+  "statement_en_keywords": [
+    "no client-side trust",
+    "hidden fields",
+    "proxy headers",
+    "self-declared ownership"
+  ],
+  "applies_when": {
+    "capabilities": [
+      "CAPABILITY.API_CONTRACT"
+    ],
+    "lane": "backend",
+    "condition": "服务端处理任何携带客户端来源信息的请求",
+    "applicability_note": "服务端处理任何携带客户端来源信息的请求"
+  },
+  "enforcement": "required_when_applicable",
+  "authority": {
+    "owner": "HUMAN_OWNER",
+    "delegates": [],
+    "write_policy": "EVOLUTION_CHANNEL",
+    "escalation_hint": "catalog-spec-decomposition"
+  },
+  "origin": "ingested",
+  "origin_note": "裁定批 F/D3-R1 D3 逐卡复核物化（原 B6C 保守排除卡补锚收编）；statement 沿用 SPEC-D 候选卡独立措辞（clean-room），零逐字拷贝上游源文本；播种分母=vendor 字节（x-b6-porting.vendor_pin），分解分母=MASTer 池卡（x-spec-d-materialization）",
+  "sources": [
+    {
+      "type": "design_seed",
+      "ref": "POMaster_VNext/corpus/spec-knowledge/candidates/BE-G2.yaml",
+      "captured_by": "agent:claude/spec-d-consolidation",
+      "locator": {
+        "candidate": "POLICY.SEC.NO_CLIENT_SIDE_TRUST",
+        "source_protocol": ".trellis/spec/backend/10-security-protocol.md",
+        "lines": "29"
+      },
+      "clean_room_note": "independently rewritten from SPEC-D decomposition candidate cards; zero verbatim copy"
+    }
+  ],
+  "review_notes": [
+    "客户端信号不可作授权依据在既有 228 条中无对应条目（B6b-I SEC 族管秘密可见面与凭据介质）；与同批 AUTHZ.NO_GATING_PROXY_TRUST 同域相邻——彼管门禁表象（路由/按钮），本管数据归属判定依据面，互引不合并。",
+    "D3b 补锚：MASTer 10-security-protocol.md L29（MUST NOT 段），required 入册。"
+  ]
+}

package/catalog/policies/policy.sec.no_longterm_security_disable.json

@@ -0,0 +1,91 @@
+{
+  "x-vocab-pr": {
+    "status": "vocab_pr_candidate",
+    "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
+    "proposal": "词汇表 PR 登记 policy kind 及新域段；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（与前批 45+25 条同因同请，合并进同一 vocab PR）",
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
+  },
+  "x-spec-d-materialization": {
+    "status": "PROPOSAL",
+    "package": "B6b-I FE 播种移植（SPEC-D 池卡复用；分母=MASTer 池卡 + vendor 播种字节双锚）",
+    "human_review_required": true,
+    "evidence": "PLANNED",
+    "provenance": "POMaster_VNext/corpus/spec-knowledge/candidates/consolidated-pool.yaml",
+    "group": "FE-G1",
+    "candidate_id": "POLICY.SEC.NO_LONGTERM_SECURITY_DISABLE",
+    "density_rank": null,
+    "density_score": 32.94,
+    "pool_statement_sha16": "112ac9235a6d8ab2",
+    "curated_rule": "B6b-I 分母（FE 01-23）required 池（ELIGIBLE 未物化）按池密度序取前 22 + advisory 池（SHOULD 源 backlog policy 卡）按同公式密度序取前 3 = 25（D5 上限）；UNIVERSAL + UNIVERSAL_POLICY + 无 uncertainty + 非 project_scope + 非重复",
+    "denominator": "MASTer（池卡 source_protocol 锚）"
+  },
+  "x-b6-porting": {
+    "status": "PROPOSAL",
+    "batch": "B6B-1",
+    "human_review_required": true,
+    "enforcement_axis": {
+      "source_sections": [
+        "MUST NOT"
+      ],
+      "rule": "SHOULD/Change Policy 源条目 enforcement 必须 advisory（禁升 required）；MUST/MUST NOT 源条目 enforcement 必须 required_when_applicable（降级合法）",
+      "asserted_by": "packages/cli/tests/catalog-b6-porting.spec.ts"
+    },
+    "extra_master_sections": [],
+    "denominator": "vendor",
+    "vendor_pin": {
+      "path": "pomaster/components/frontend-hard-spec/assets/universal/04-security-protocol.md",
+      "sha256": "4d9bb6bd34a64fcc3e362c969492bc326533e16ef4c6d2284dc01442733504e6",
+      "bytes": 21948
+    },
+    "seeded_spec": ".pomaster/specs/hard/themes/security.md",
+    "seed_manifest": "packages/cli/seeds/manifest.json"
+  },
+  "id": "POLICY.SEC.NO_LONGTERM_SECURITY_DISABLE",
+  "kind": "policy",
+  "axis_profile": "policy_default",
+  "classification": "UNIVERSAL_POLICY",
+  "axes": {
+    "lifecycle": "PROPOSED",
+    "confidence": "UNRESOLVED",
+    "evidence": "PLANNED",
+    "change": "STABLE"
+  },
+  "title_zh": "安全机制关闭须有期限",
+  "statement_zh": "关闭内容安全策略、防伪校验、证书校验或输入校验只能作为有期限的临时联调手段，禁止成为长期方案。",
+  "statement_en_keywords": [
+    "no permanent security disable",
+    "timeboxed debug exception",
+    "csp and cert validation"
+  ],
+  "applies_when": {
+    "lane": "any",
+    "condition": "联调期安全策略调整",
+    "applicability_note": "联调期安全策略调整"
+  },
+  "enforcement": "required_when_applicable",
+  "authority": {
+    "owner": "HUMAN_OWNER",
+    "delegates": [],
+    "write_policy": "EVOLUTION_CHANNEL",
+    "escalation_hint": "catalog-spec-decomposition"
+  },
+  "origin": "ingested",
+  "origin_note": "B6b-I FE 播种移植物化；statement 沿用 SPEC-D 候选卡独立措辞（clean-room），零逐字拷贝上游源文本；播种分母=vendor 字节（x-b6-porting.vendor_pin），分解分母=MASTer 池卡（x-spec-d-materialization）",
+  "sources": [
+    {
+      "type": "design_seed",
+      "ref": "POMaster_VNext/corpus/spec-knowledge/candidates/FE-G1.yaml",
+      "captured_by": "agent:claude/spec-d-consolidation",
+      "locator": {
+        "candidate": "POLICY.SEC.NO_LONGTERM_SECURITY_DISABLE",
+        "source_protocol": ".trellis/spec/frontend/04-security-protocol.md",
+        "lines": "L41"
+      },
+      "clean_room_note": "independently rewritten from SPEC-D decomposition candidate cards; zero verbatim copy"
+    }
+  ],
+  "review_notes": [
+    "安全机制临时关闭的期限治理在既有 143 条中无对应条目，零语义重复。"
+  ]
+}

package/catalog/policies/policy.sec.no_script_readable_credentials.json

@@ -0,0 +1,91 @@
+{
+  "x-vocab-pr": {
+    "status": "vocab_pr_candidate",
+    "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
+    "proposal": "词汇表 PR 登记 policy kind 及新域段；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（与前批 45+25 条同因同请，合并进同一 vocab PR）",
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
+  },
+  "x-spec-d-materialization": {
+    "status": "PROPOSAL",
+    "package": "B6b-I FE 播种移植（SPEC-D 池卡复用；分母=MASTer 池卡 + vendor 播种字节双锚）",
+    "human_review_required": true,
+    "evidence": "PLANNED",
+    "provenance": "POMaster_VNext/corpus/spec-knowledge/candidates/consolidated-pool.yaml",
+    "group": "FE-G1",
+    "candidate_id": "POLICY.SEC.NO_SCRIPT_READABLE_CREDENTIALS",
+    "density_rank": null,
+    "density_score": 32.88,
+    "pool_statement_sha16": "09ace83e6dbdf1e1",
+    "curated_rule": "B6b-I 分母（FE 01-23）required 池（ELIGIBLE 未物化）按池密度序取前 22 + advisory 池（SHOULD 源 backlog policy 卡）按同公式密度序取前 3 = 25（D5 上限）；UNIVERSAL + UNIVERSAL_POLICY + 无 uncertainty + 非 project_scope + 非重复",
+    "denominator": "MASTer（池卡 source_protocol 锚）"
+  },
+  "x-b6-porting": {
+    "status": "PROPOSAL",
+    "batch": "B6B-1",
+    "human_review_required": true,
+    "enforcement_axis": {
+      "source_sections": [
+        "MUST NOT"
+      ],
+      "rule": "SHOULD/Change Policy 源条目 enforcement 必须 advisory（禁升 required）；MUST/MUST NOT 源条目 enforcement 必须 required_when_applicable（降级合法）",
+      "asserted_by": "packages/cli/tests/catalog-b6-porting.spec.ts"
+    },
+    "extra_master_sections": [],
+    "denominator": "vendor",
+    "vendor_pin": {
+      "path": "pomaster/components/frontend-hard-spec/assets/universal/04-security-protocol.md",
+      "sha256": "4d9bb6bd34a64fcc3e362c969492bc326533e16ef4c6d2284dc01442733504e6",
+      "bytes": 21948
+    },
+    "seeded_spec": ".pomaster/specs/hard/themes/security.md",
+    "seed_manifest": "packages/cli/seeds/manifest.json"
+  },
+  "id": "POLICY.SEC.NO_SCRIPT_READABLE_CREDENTIALS",
+  "kind": "policy",
+  "axis_profile": "policy_default",
+  "classification": "UNIVERSAL_POLICY",
+  "axes": {
+    "lifecycle": "PROPOSED",
+    "confidence": "UNRESOLVED",
+    "evidence": "PLANNED",
+    "change": "STABLE"
+  },
+  "title_zh": "凭据不落脚本可读存储",
+  "statement_zh": "登录态凭据与刷新令牌不得持久化到脚本可读取的存储；如必须，须有安全责任人批准并带期限的例外。",
+  "statement_en_keywords": [
+    "no script readable credentials",
+    "refresh token storage",
+    "approved timeboxed exception"
+  ],
+  "applies_when": {
+    "lane": "any",
+    "condition": "凭据持久化决策",
+    "applicability_note": "凭据持久化决策"
+  },
+  "enforcement": "required_when_applicable",
+  "authority": {
+    "owner": "HUMAN_OWNER",
+    "delegates": [],
+    "write_policy": "EVOLUTION_CHANNEL",
+    "escalation_hint": "catalog-spec-decomposition"
+  },
+  "origin": "ingested",
+  "origin_note": "B6b-I FE 播种移植物化；statement 沿用 SPEC-D 候选卡独立措辞（clean-room），零逐字拷贝上游源文本；播种分母=vendor 字节（x-b6-porting.vendor_pin），分解分母=MASTer 池卡（x-spec-d-materialization）",
+  "sources": [
+    {
+      "type": "design_seed",
+      "ref": "POMaster_VNext/corpus/spec-knowledge/candidates/FE-G1.yaml",
+      "captured_by": "agent:claude/spec-d-consolidation",
+      "locator": {
+        "candidate": "POLICY.SEC.NO_SCRIPT_READABLE_CREDENTIALS",
+        "source_protocol": ".trellis/spec/frontend/04-security-protocol.md",
+        "lines": "L37"
+      },
+      "clean_room_note": "independently rewritten from SPEC-D decomposition candidate cards; zero verbatim copy"
+    }
+  ],
+  "review_notes": [
+    "与 POLICY.SEC.NO_SECRETS_IN_CLIENT_SURFACE 同批相邻：彼管秘密不进可见产物面，本管登录态凭据的存储介质边界（脚本可读性），互引不合并。"
+  ]
+}

package/catalog/policies/policy.sec.no_secrets_in_client_surface.json

@@ -0,0 +1,91 @@
+{
+  "x-vocab-pr": {
+    "status": "vocab_pr_candidate",
+    "finding": "kind='policy' 不在 vocab-lock kinds_registry.truth_bodies（POLICY. 前缀已冻结注册，closed-world）",
+    "proposal": "词汇表 PR 登记 policy kind 及新域段；或 Owner 裁决 policy 条目住 catalog/ 而非 truth/objects 正文层（与前批 45+25 条同因同请，合并进同一 vocab PR）",
+    "locked_vocab_untouched": true,
+    "resolution": "2026-09-05 vocab PR-0009 收编落地（vocab-lock@v0.8-resolved，三镜像同 commit；Owner 裁定 D4=(a) 2026-09-05）：kind='policy' 是 catalog 物料分类词形（catalog_layer_vocab.catalog_kind 在册——PR-0006，不受 kinds_registry.truth_bodies 闭包管辖），POLICY. 前缀为 governed 闭包既有前缀，id 域段词形随 catalog_layer_vocab.policy_id_domains / policy_web_domains 收编；本 pending 注记就此转正（finding/proposal/locked_vocab_untouched 为创建时点历史记录原样保留——mcp_eyes 先例）"
+  },
+  "x-spec-d-materialization": {
+    "status": "PROPOSAL",
+    "package": "B6b-I FE 播种移植（SPEC-D 池卡复用；分母=MASTer 池卡 + vendor 播种字节双锚）",
+    "human_review_required": true,
+    "evidence": "PLANNED",
+    "provenance": "POMaster_VNext/corpus/spec-knowledge/candidates/consolidated-pool.yaml",
+    "group": "FE-G1",
+    "candidate_id": "POLICY.SEC.NO_SECRETS_IN_CLIENT_SURFACE",
+    "density_rank": null,
+    "density_score": 33,
+    "pool_statement_sha16": "cd65cc8d8776e7ee",
+    "curated_rule": "B6b-I 分母（FE 01-23）required 池（ELIGIBLE 未物化）按池密度序取前 22 + advisory 池（SHOULD 源 backlog policy 卡）按同公式密度序取前 3 = 25（D5 上限）；UNIVERSAL + UNIVERSAL_POLICY + 无 uncertainty + 非 project_scope + 非重复",
+    "denominator": "MASTer（池卡 source_protocol 锚）"
+  },
+  "x-b6-porting": {
+    "status": "PROPOSAL",
+    "batch": "B6B-1",
+    "human_review_required": true,
+    "enforcement_axis": {
+      "source_sections": [
+        "MUST NOT"
+      ],
+      "rule": "SHOULD/Change Policy 源条目 enforcement 必须 advisory（禁升 required）；MUST/MUST NOT 源条目 enforcement 必须 required_when_applicable（降级合法）",
+      "asserted_by": "packages/cli/tests/catalog-b6-porting.spec.ts"
+    },
+    "extra_master_sections": [],
+    "denominator": "vendor",
+    "vendor_pin": {
+      "path": "pomaster/components/frontend-hard-spec/assets/universal/04-security-protocol.md",
+      "sha256": "4d9bb6bd34a64fcc3e362c969492bc326533e16ef4c6d2284dc01442733504e6",
+      "bytes": 21948
+    },
+    "seeded_spec": ".pomaster/specs/hard/themes/security.md",
+    "seed_manifest": "packages/cli/seeds/manifest.json"
+  },
+  "id": "POLICY.SEC.NO_SECRETS_IN_CLIENT_SURFACE",
+  "kind": "policy",
+  "axis_profile": "policy_default",
+  "classification": "UNIVERSAL_POLICY",
+  "axes": {
+    "lifecycle": "PROPOSED",
+    "confidence": "UNRESOLVED",
+    "evidence": "PLANNED",
+    "change": "STABLE"
+  },
+  "title_zh": "秘密不落客户端可见面",
+  "statement_zh": "凭据类秘密不得出现在源码、地址栏、日志或任何公开可见的客户端产物中；环境文件不作为秘密的存放地。",
+  "statement_en_keywords": [
+    "no secrets in client",
+    "no credentials in logs",
+    "env file is not a vault"
+  ],
+  "applies_when": {
+    "lane": "any",
+    "condition": "秘密值的存放与传播",
+    "applicability_note": "秘密值的存放与传播"
+  },
+  "enforcement": "required_when_applicable",
+  "authority": {
+    "owner": "HUMAN_OWNER",
+    "delegates": [],
+    "write_policy": "EVOLUTION_CHANNEL",
+    "escalation_hint": "catalog-spec-decomposition"
+  },
+  "origin": "ingested",
+  "origin_note": "B6b-I FE 播种移植物化；statement 沿用 SPEC-D 候选卡独立措辞（clean-room），零逐字拷贝上游源文本；播种分母=vendor 字节（x-b6-porting.vendor_pin），分解分母=MASTer 池卡（x-spec-d-materialization）",
+  "sources": [
+    {
+      "type": "design_seed",
+      "ref": "POMaster_VNext/corpus/spec-knowledge/candidates/FE-G1.yaml",
+      "captured_by": "agent:claude/spec-d-consolidation",
+      "locator": {
+        "candidate": "POLICY.SEC.NO_SECRETS_IN_CLIENT_SURFACE",
+        "source_protocol": ".trellis/spec/frontend/04-security-protocol.md",
+        "lines": "L36"
+      },
+      "clean_room_note": "independently rewritten from SPEC-D decomposition candidate cards; zero verbatim copy"
+    }
+  ],
+  "review_notes": [
+    "秘密面治理在既有 143 条中无对应条目，零语义重复；多锚卡（04 L36 + 05 L28/L31 环境配置侧），05 文件不重复立卡。"
+  ]
+}

package/catalog/policies/policy.sec.relaxation_approval.json

@@ -0,0 +1,92 @@
+{
+  "x-spec-d-materialization": {
+    "status": "PROPOSAL",
+    "package": "裁定批 F/D3-R1 排除卡逐卡复核物化（SPEC-D 池卡复用；分母=MASTer 池卡 + vendor 播种字节双锚）",
+    "human_review_required": true,
+    "evidence": "PLANNED",
+    "provenance": "POMaster_VNext/corpus/spec-knowledge/candidates/consolidated-pool.yaml",
+    "group": "FE-G1",
+    "candidate_id": "POLICY.SEC.RELAXATION_APPROVAL",
+    "pool_statement_sha16": "8d6ba2a3a1ba1c58",
+    "curated_rule": "D3 逐卡复核批（Owner 2026-09-05 裁定 D3=逐卡复核；72 张保守排除卡逐卡核锚）：required 9（D3b source=null 补锚落 MUST/MUST NOT 且与 MASTer 行锚交叉验证）+ advisory 16（Change Policy 锚 14 张降 advisory[行内容含「必须」行为规范、强度只降不升] + 池密度序前 2）= 25（D6 合并上限 policy+TP 合计 25/批内执行；超出 17 张 advisory 留 D3-R2 轮次台账）；维持排除 30（Ownership 归属说明族）",
+    "denominator": "MASTer（池卡锚）"
+  },
+  "x-b6-porting": {
+    "status": "PROPOSAL",
+    "batch": "D3-R1",
+    "human_review_required": true,
+    "classification_face": "policy",
+    "enforcement_axis": {
+      "source_sections": [
+        "Change Policy"
+      ],
+      "rule": "SHOULD/Change Policy 源条目 enforcement 必须 advisory（禁升 required）；MUST/MUST NOT 源条目 enforcement 必须 required_when_applicable（降级合法）",
+      "asserted_by": "packages/cli/tests/catalog-b6-porting.spec.ts"
+    },
+    "extra_master_sections": [],
+    "denominator": "vendor",
+    "vendor_pin": {
+      "path": "pomaster/components/frontend-hard-spec/assets/universal/04-security-protocol.md",
+      "sha256": "4d9bb6bd34a64fcc3e362c969492bc326533e16ef4c6d2284dc01442733504e6",
+      "bytes": 21948
+    },
+    "seeded_spec": ".pomaster/specs/hard/themes/security.md",
+    "seed_manifest": "packages/cli/seeds/manifest.json",
+    "d3_review": {
+      "excluded_from_batch": "B6B-1",
+      "exclusion_reason_at_seed": "行锚段映射非 MUST/MUST NOT（池 enforcement 判定矛盾，保守排除待复核）",
+      "adjudication": "D3 逐卡复核（Owner 2026-09-05 裁定 D3=逐卡复核，裁定批 F 落地 2026-09-05）：本卡原属 B6B-1 保守排除留池（排除理由：行锚段映射非 MUST/MUST NOT（池 enforcement 判定矛盾，保守排除待复核））；复核按锚行内容裁定 advisory 入册（行内容含「必须」行为规范、Change Policy 段 advisory 落点（强度只降不升））",
+      "anchor_evidence": "MASTer 04-security-protocol.md L84「任何安全放宽必须经过风险评估、批准和期限；高危问题修复优先于交互便利性。」",
+      "pool_enforcement_at_seed": "required_when_applicable"
+    }
+  },
+  "id": "POLICY.SEC.RELAXATION_APPROVAL",
+  "kind": "policy",
+  "axis_profile": "policy_default",
+  "classification": "UNIVERSAL_POLICY",
+  "axes": {
+    "lifecycle": "PROPOSED",
+    "confidence": "UNRESOLVED",
+    "evidence": "PLANNED",
+    "change": "STABLE"
+  },
+  "title_zh": "安全放宽三要素与优先级",
+  "statement_zh": "任何安全放宽必须附带风险评估、批准人与有效期；高危漏洞修复优先于交互便利。",
+  "statement_en_keywords": [
+    "security relaxation approval",
+    "risk assessment",
+    "approver and expiry",
+    "fix over convenience"
+  ],
+  "applies_when": {
+    "lane": "any",
+    "condition": "安全约束放宽决策",
+    "applicability_note": "安全约束放宽决策"
+  },
+  "enforcement": "advisory",
+  "authority": {
+    "owner": "HUMAN_OWNER",
+    "delegates": [],
+    "write_policy": "EVOLUTION_CHANNEL",
+    "escalation_hint": "catalog-spec-decomposition"
+  },
+  "origin": "ingested",
+  "origin_note": "裁定批 F/D3-R1 D3 逐卡复核物化（原 B6B-1 保守排除卡补锚收编）；statement 沿用 SPEC-D 候选卡独立措辞（clean-room），零逐字拷贝上游源文本；播种分母=vendor 字节（x-b6-porting.vendor_pin），分解分母=MASTer 池卡（x-spec-d-materialization）",
+  "sources": [
+    {
+      "type": "design_seed",
+      "ref": "POMaster_VNext/corpus/spec-knowledge/candidates/FE-G1.yaml",
+      "captured_by": "agent:claude/spec-d-consolidation",
+      "locator": {
+        "candidate": "POLICY.SEC.RELAXATION_APPROVAL",
+        "source_protocol": ".trellis/spec/frontend/04-security-protocol.md",
+        "lines": "L84"
+      },
+      "clean_room_note": "independently rewritten from SPEC-D decomposition candidate cards; zero verbatim copy"
+    }
+  ],
+  "review_notes": [
+    "前端安全放宽三要素在既有 228 条中无对应条目；与 B6b-I AI.RULE_RELAXATION_APPROVAL、本批 SECURITY_RELAXATION_GATE（BE）放宽批准三域族互引不合并。",
+    "Change Policy 锚（FE04 L84，行内容含「必须」）——advisory 落点（池密度序 32.31 为 advisory 补位第 2）。"
+  ]
+}