soloforge 1.1.37 → 1.1.40

package/templates/gates/shared/gate-/344/272/244/344/273/230.yaml

@@ -1,14 +1,32 @@
 # 交付门禁配置
-# 交付阶段校验主链路集成与完备性
+# 对照方案 6.1 门禁层 — 3 项检查 + severity + evidence + decision_model
 
 stage: "交付"
-description: "主链路集成与交付完备性校验"
+description: "主链路集成、交付完备性与部署决策审批校验"
 
 checks:
-  - name: "主链路集成"
-    required_artifact: ""
-    rule: "主链路集成 0 hard_fail，所有集成检查通过"
+  - id: DP-G01
+    name: "主链路集成"
+    severity: error
+    check_type: deterministic
+    evidence_required: "0 implemented_not_integrated + 无孤岛模块"
+    rule: "主链路集成检查：所有模块为 integrated 状态，无 implemented_not_integrated 或孤岛模块"
 
-  - name: "交付完备性审查"
-    required_artifact: ""
-    rule: "交付完备性审查规则全部通过，产物清单完整无遗漏"
+  - id: DP-G02
+    name: "交付完备性审查"
+    severity: error
+    check_type: deterministic
+    evidence_required: "DEL-* 执行结果 + 产物清单完整"
+    rule: "交付完备性审查规则（DEL-*）全部通过，产物清单完整无遗漏"
+
+  - id: DP-G03
+    name: "部署决策人类审批"
+    severity: error
+    check_type: deterministic
+    evidence_required: "人类审批记录（审批人/时间/决策）"
+    rule: "部署发布决策必须经人类审批（control-plane），AI 可建议但不可自主决定部署"
+
+decision_model:
+  PROMOTE: "所有 error 通过"
+  HOLD: "error 通过但 warning 未处理"
+  ROLLBACK: "任何 error 失败或 AI 越权操作（未经审批执行 control-plane 操作）"

package/templates/gates/shared/gate-/344/273/243/347/240/201/345/256/241/346/237/245.yaml

@@ -1,14 +1,53 @@
 # 代码审查门禁配置
-# 代码审查阶段校验审查产物完备性
+# 对照方案 6.6 门禁层 — 6 项检查 + severity + evidence_required + decision_model
 
 stage: "代码审查"
-description: "代码审查产物完备性校验"
+description: "代码审查产物完备性、维度覆盖与设计交叉验证校验"
 
 checks:
-  - name: "代码审查报告"
-    required_artifact: "代码审查报告模版"
-    rule: "代码审查报告必须包含审查发现、风险评估和改进建议"
+  - id: CR-G01
+    name: "代码审查报告完备"
+    severity: error
+    check_type: deterministic
+    evidence_required: "报告路径 + 章节标题列表"
+    rule: "代码审查报告必须包含全部 10 维度覆盖矩阵、发现列表、审查结果汇总"
 
-  - name: "审查摘要"
-    required_artifact: "审查摘要"
-    rule: "每个审查周期必须产出结构化的审查摘要"
+  - id: CR-G02
+    name: "审查摘要完备"
+    severity: error
+    check_type: deterministic
+    evidence_required: "摘要路径 + 信任分级统计"
+    rule: "审查摘要必须包含维度覆盖标注（10 维度 emoji）+ AI 盲区维度 + 信任分级汇总"
+
+  - id: CR-G03
+    name: "维度覆盖完整"
+    severity: error
+    check_type: deterministic
+    evidence_required: "已覆盖维度数 ≥ 10"
+    rule: "审查报告必须覆盖全部 10 维度（SEC/PER/CON/ARC/SOLID/MNT/DEL/DEC/UCV-REV/接口契约）"
+
+  - id: CR-G04
+    name: "上游设计覆盖"
+    severity: error
+    check_type: semantic
+    evidence_required: "UCV-REV-* 执行结果"
+    rule: "代码审查必须验证实现与详细设计文档的接口和逻辑一致性（UCV-REV-01~04）"
+
+  - id: CR-G05
+    name: "审查 Agent 独立性"
+    severity: warning
+    check_type: deterministic
+    evidence_required: "隔离字段 = 是"
+    rule: "代码审查报告 frontmatter 中 Agent 隔离字段必须为 true"
+
+  - id: CR-G06
+    name: "黑盒项人类签署"
+    severity: error
+    check_type: deterministic
+    evidence_required: "黑盒项数 = 已签署数"
+    rule: "所有信任分级为黑盒的审查项必须有人类签署确认"
+
+decision_model:
+  PROMOTE: "所有 error 通过 + warning 通过或标注已知取舍"
+  HOLD: "error 全通过但 warning 未处理"
+  ROLLBACK: "任何 error 失败或证据缺失"

package/templates/gates/shared/gate-/344/273/273/345/212/241/350/247/204/345/210/222.yaml

@@ -1,18 +1,144 @@
 # 任务规划门禁配置
-# 切片计划必须与设计产物通过一致性校验
+# 对照方案 6.1 — 8 项 shared + 3 项 existing-system = 11 项检查
 
 stage: "任务规划"
 description: "切片计划与设计产物一致性校验"
 
 checks:
-  - name: "切片与接口一致性"
+  - id: TP-G01
+    name: "切片计划完备"
+    category: "output_check"
+    severity: error
+    check_type: deterministic
+    required_artifact: "切片计划模版"
+    rule: "切片计划文档必须包含所有必要章节（任务列表/依赖关系/文件分配/分解策略/上下文边界）"
+    evidence_required:
+      - "切片计划文件路径"
+      - "章节标题列表"
+      - "章节覆盖率（须 100%）"
+
+  - id: TP-G02
+    name: "切片与接口一致性"
+    category: "cross_validation"
+    severity: error
+    check_type: deterministic
     required_artifact: "API接口规格文档模版"
     rule: "每个切片必须关联到接口规格中定义的接口"
+    evidence_required:
+      - "切片计划中上游引用的接口编号列表"
+      - "API 接口规格中对应接口存在确认"
 
-  - name: "切片与数据库一致性"
+  - id: TP-G03
+    name: "切片与数据库一致性"
+    category: "cross_validation"
+    severity: error
+    check_type: deterministic
     required_artifact: "数据库设计文档模版"
     rule: "切片涉及的表操作必须在数据库设计中有定义"
+    evidence_required:
+      - "切片引用的表名列表"
+      - "数据库设计中对应表存在确认"
+
+  - id: TP-G04
+    name: "切片覆盖完整性"
+    category: "output_check"
+    severity: error
+    check_type: semantic
+    required_artifact: "切片计划模版"
+    rule: "所有设计文档中定义的功能点必须被切片覆盖，不得遗漏"
+    evidence_required:
+      - "设计文档功能点总数"
+      - "切片覆盖功能点数"
+      - "覆盖率（须 100%）"
+
+  - id: TP-G05
+    name: "ID 绑定完整性"
+    category: "output_check"
+    severity: error
+    check_type: deterministic
+    required_artifact: "切片计划模版"
+    rule: "每个切片必须有 SLC-ID，每个验收标准必须有 AC-ID，ID 不得重复或缺失；每个 SLC 至少 3 条 AC"
+    evidence_required:
+      - "SLC-ID 列表（须唯一）"
+      - "AC-ID 列表（须唯一且每 SLC≥3 条）"
+
+  - id: TP-G06
+    name: "上游交叉验证"
+    category: "cross_validation"
+    severity: error
+    check_type: deterministic
+    required_artifact: "设计一致性验收报告模版"
+    rule: "切片计划中的文件路径和模块引用必须与上游设计产物一致"
+    evidence_required:
+      - "切片涉及文件列表"
+      - "上游设计产物模块路径对比结果"
+
+  - id: TP-G07
+    name: "分解策略已声明"
+    category: "output_check"
+    severity: warning
+    check_type: deterministic
+    required_artifact: "切片计划模版"
+    rule: "每个切片的分解策略（sequential/parallel/hierarchical）和测试策略（test_first/verification_first/manual_acceptance）必须非空"
+    evidence_required:
+      - "切片计划中每个 SLC 的分解策略字段值"
+      - "切片计划中每个 SLC 的测试策略字段值"
+
+  - id: TP-G08
+    name: "上下文边界已分类"
+    category: "output_check"
+    severity: warning
+    check_type: deterministic
+    required_artifact: "切片计划模版"
+    rule: "每个切片的涉及文件必须有上下文边界分类（must_read/optional_read/default_skip），且至少 1 个 must_read"
+    evidence_required:
+      - "切片计划中每个 SLC 的涉及文件分类"
+      - "每个 SLC 的 must_read 文件数（须≥1）"
+
+  # 老系统扩展检查
+  - id: TP-ES01
+    name: "排查缓冲完整性（老系统）"
+    condition: "scope == existing-system"
+    category: "output_check"
+    severity: "warning"
+    check_type: "deterministic"
+    required_artifact: "切片计划模版"
+    rule: "每个切片的排查缓冲表格中，缓冲活动数 ≥ 2，且每项有预估时间"
+    evidence_required:
+      - "切片计划文件路径"
+      - "每切片排查缓冲活动数（须 ≥ 2）"
+
+  - id: TP-ES02
+    name: "阶段输入声明完整性（老系统）"
+    condition: "scope == existing-system"
+    category: "input_check"
+    severity: "error"
+    check_type: "deterministic"
+    required_artifact: "切片计划模版"
+    rule: "切片计划 §1.5 中所有输入产物标注为已读取"
+    evidence_required:
+      - "切片计划文件路径"
+      - "阶段输入声明表格中所有行状态（须全部 ☑）"
 
-  - name: "切片完整性"
+  - id: TP-ES03
+    name: "清洗脚本关联完整性（老系统）"
+    condition: "scope == existing-system"
+    category: "output_check"
+    severity: "error"
+    check_type: "deterministic"
     required_artifact: "切片计划模版"
-    rule: "所有设计文档中定义的功能点必须被切片覆盖"
+    rule: "涉及 DB 迁移的切片（缓冲 ≥ 35%）在 §5 中有关联的清洗脚本记录"
+    evidence_required:
+      - "切片计划 §5 中涉及 DB 迁移的切片行"
+      - "对应清洗脚本文件存在且非空"
+
+decision_model:
+  promote:
+    condition: "所有 error 项通过，warning 项已处理或标注"
+    action: "推进到编码准备阶段"
+  hold:
+    condition: "warning 项未处理"
+    action: "标注 warning 项，由用户决定是否继续"
+  rollback:
+    condition: "任何 error 项未通过"
+    action: "回退到任务规划重新执行"

package/templates/gates/shared/gate-/345/210/207/347/211/207/345/256/241/346/237/245.yaml

@@ -0,0 +1,50 @@
+# 切片审查门禁配置
+# 对照方案 6.7 — 3 项检查
+
+stage: "编码与单元测试"
+description: "独立审查合规性门禁"
+
+checks:
+  - id: SLICE-R01
+    name: "审查测试充分"
+    category: "quality_check"
+    severity: error
+    check_type: deterministic
+    required_artifact: ""
+    rule: "独立审查新增测试场景 ≥9 个，覆盖全部接口和逻辑路径"
+    evidence_required:
+      - "独立审查测试用例列表"
+      - "覆盖维度统计（接口/逻辑/边界/错误）"
+
+  - id: SLICE-R02
+    name: "无 hard_fail"
+    category: "quality_check"
+    severity: error
+    check_type: deterministic
+    required_artifact: ""
+    rule: "所有检查项无 hard_fail 级别问题，代码质量检查全部通过"
+    evidence_required:
+      - "代码质量检查结果"
+      - "hard_fail 列表（须为空）"
+
+  - id: SLICE-R03
+    name: "无遗留问题"
+    category: "quality_check"
+    severity: warning
+    check_type: semantic
+    required_artifact: ""
+    rule: "审查发现的所有问题已修复或有明确的处理计划，无未处理的遗留问题"
+    evidence_required:
+      - "审查问题列表"
+      - "每项处理状态（已修复/有计划/待处理）"
+
+decision_model:
+  promote:
+    condition: "SLICE-R01 和 SLICE-R02 通过"
+    action: "切片审查通过"
+  hold:
+    condition: "SLICE-R03 有未处理遗留问题"
+    action: "标注遗留问题，由用户决定是否继续"
+  rollback:
+    condition: "SLICE-R01 或 SLICE-R02 未通过"
+    action: "回退修复后重新审查"

package/templates/gates/shared/gate-/345/210/207/347/211/207/346/211/247/350/241/214.yaml

@@ -0,0 +1,51 @@
+# 切片执行门禁配置
+# 对照方案 6.6 — 3 项检查
+
+stage: "编码与单元测试"
+description: "执行纪律合规性门禁"
+
+checks:
+  - id: SLICE-E01
+    name: "扫描记录存在"
+    category: "input_check"
+    severity: error
+    check_type: deterministic
+    required_artifact: ""
+    rule: "编码前必须完成文件扫描，扫描记录包含文件/行号/变更类型"
+    evidence_required:
+      - "扫描记录文件路径"
+      - "扫描记录摘要"
+
+  - id: SLICE-E02
+    name: "测试覆盖充分"
+    category: "quality_check"
+    severity: error
+    check_type: deterministic
+    required_artifact: ""
+    rule: "新增测试场景 ≥9 个，覆盖正常路径×2、边界条件×3、错误路径×2、集成场景×2"
+    evidence_required:
+      - "新增测试场景数（须≥9）"
+      - "覆盖维度统计（正常/边界/错误/集成）"
+
+  - id: SLICE-E03
+    name: "涉及文件一致"
+    category: "output_check"
+    severity: error
+    check_type: deterministic
+    required_artifact: ""
+    rule: "实际变更文件列表与计划的涉及文件列表一致，无计划外变更"
+    evidence_required:
+      - "git diff --name-only 输出"
+      - "切片计划涉及文件列表"
+      - "对比结果（须一致）"
+
+decision_model:
+  promote:
+    condition: "所有 error 项通过"
+    action: "切片执行通过"
+  hold:
+    condition: "无 warning 项"
+    action: "无 hold 场景"
+  rollback:
+    condition: "任何 error 项未通过"
+    action: "切片回退修复后重新执行"

package/templates/gates/shared/gate-/345/217/221/345/270/203/345/220/216/350/247/202/345/257/237.yaml

@@ -1,14 +1,46 @@
 # 发布后观察门禁配置
-# 发布后校验监控指标与回滚预案
+# 对照方案 6.2 门禁层 — 5 项检查 + 阈值 + evidence + decision_model
 
 stage: "发布后观察"
-description: "监控指标正常性与回滚预案完备性校验"
+description: "监控指标正常性、回滚预案与数据一致性校验"
 
 checks:
-  - name: "监控指标正常"
-    required_artifact: ""
-    rule: "关键监控指标在正常阈值内，无异常告警"
+  - id: PO-G01
+    name: "错误率正常"
+    severity: error
+    check_type: deterministic
+    evidence_required: "基线错误率 / 发布后错误率 / 偏差百分比（±20% 内）"
+    rule: "发布后 5xx 错误率在基线 ±20% 范围内，无突增趋势"
 
-  - name: "回滚预案"
-    required_artifact: ""
-    rule: "回滚预案已验证，回滚操作可在 5 分钟内完成"
+  - id: PO-G02
+    name: "延迟正常"
+    severity: error
+    check_type: deterministic
+    evidence_required: "P99 基线 / 发布后 P99 / 比值（≤ 1.5×）"
+    rule: "发布后 P99 延迟不超过基线的 1.5 倍"
+
+  - id: PO-G03
+    name: "无新增告警"
+    severity: warning
+    check_type: deterministic
+    evidence_required: "新错误模式列表（须为空）"
+    rule: "日志中不应出现部署前不存在的错误模式，如有须标注已知原因"
+
+  - id: PO-G04
+    name: "回滚预案已验证"
+    severity: error
+    check_type: deterministic
+    evidence_required: "回滚演练记录 + 总耗时（≤ 5 分钟）"
+    rule: "回滚预案已在预发环境演练验证，总耗时不超过 5 分钟"
+
+  - id: PO-G05
+    name: "数据一致性确认"
+    severity: error
+    check_type: deterministic
+    evidence_required: "校验 SQL 结果 + 覆盖表/记录数"
+    rule: "发布后数据一致性校验 SQL 全部通过，覆盖所有变更涉及的表"
+
+decision_model:
+  PROMOTE: "所有 error 通过 + warning 通过或标注已知取舍"
+  HOLD: "error 全通过但 warning 未处理或监控指标波动（暂停观察）"
+  ROLLBACK: "任何 error 失败 → 执行自动回滚触发器"

package/templates/gates/shared/gate-/345/256/211/345/205/250/345/256/241/350/256/241.yaml

@@ -0,0 +1,77 @@
+# 安全审计门禁配置
+# 从安全审计模版提取的 17 条检查项
+
+stage: "编码与单元测试"
+description: "安全审计门禁 — 认证授权/数据安全/依赖安全检查"
+
+checks:
+  # 认证授权检查（7 项）
+  - name: "写接口权限校验"
+    category: "security_check"
+    rule: "所有写接口必须有权限校验，不得有未鉴权的写操作"
+
+  - name: "Token 过期机制"
+    category: "security_check"
+    rule: "认证 Token 必须有过期机制，不得使用永不过期的 Token"
+
+  - name: "密码加密存储"
+    category: "security_check"
+    rule: "密码必须使用 BCrypt 等强哈希算法存储，禁止明文或弱哈希"
+
+  - name: "无硬编码密钥"
+    category: "security_check"
+    rule: "代码中不得硬编码密钥、密码或敏感配置，必须使用环境变量或密钥管理服务"
+
+  - name: "敏感操作二次验证"
+    category: "security_check"
+    rule: "删除、转账等敏感操作必须有二次验证机制"
+
+  - name: "API 认证授权保护"
+    category: "security_check"
+    rule: "所有 API 接口必须有认证和授权保护，公开接口需显式标注"
+
+  - name: "速率限制"
+    category: "security_check"
+    rule: "登录、注册等接口必须有速率限制防止暴力攻击"
+
+  # 数据安全检查（8 项）
+  - name: "PII 数据脱敏"
+    category: "data_check"
+    rule: "PII 数据（手机号、身份证、邮箱）在展示时必须脱敏"
+
+  - name: "敏感字段加密存储"
+    category: "data_check"
+    rule: "敏感字段（身份证、银行卡号）必须加密存储"
+
+  - name: "日志不含敏感信息"
+    category: "data_check"
+    rule: "日志中不得包含密码、Token、身份证号等敏感信息"
+
+  - name: "数据导出权限控制"
+    category: "data_check"
+    rule: "数据导出功能必须有权限控制和审计日志"
+
+  - name: "HTTPS 传输加密"
+    category: "data_check"
+    rule: "敏感数据传输必须使用 HTTPS 加密"
+
+  - name: "敏感数据存储加密"
+    category: "data_check"
+    rule: "密码使用 BCrypt，身份证等使用 AES 加密存储"
+
+  - name: "错误信息屏蔽技术细节"
+    category: "data_check"
+    rule: "面向用户的错误信息不得泄露技术细节（堆栈、SQL、内部路径）"
+
+  - name: "操作审计日志"
+    category: "data_check"
+    rule: "关键操作（增删改、权限变更）必须有审计日志"
+
+  # 依赖安全检查（2 项）
+  - name: "依赖漏洞扫描"
+    category: "dependency_check"
+    rule: "第三方依赖必须经过已知漏洞扫描（npm audit / Snyk）"
+
+  - name: "注入防护"
+    category: "dependency_check"
+    rule: "必须有 SQL 注入、XSS、SSRF 防护措施"

package/templates/gates/shared/gate-/346/236/266/346/236/204/350/256/276/350/256/241.yaml

@@ -1,18 +1,145 @@
 # 架构设计门禁配置
-# 架构设计阶段完成后校验设计产物一致性
+# 对照方案 §六 G-01 — 15 项检查 + PROMOTE/HOLD/ROLLBACK 决策模型
+# AI Agent 门禁原则：独立验证 > AI 自查；确定性检查优先；证据驱动决策
 
 stage: "架构设计"
 description: "架构设计产物完备性与一致性校验"
 
+decision_model:
+  PROMOTE: "所有 error 项通过（证据完备），warning 项通过或已标注取舍"
+  HOLD: "error 项全部通过但 warning 项未处理（需用户确认是否接受）"
+  ROLLBACK: "任何 error 项失败或证据缺失 → 回退到需求阶段补充"
+
 checks:
-  - name: "架构设计文档"
+  # === 产物完整性检查（5 项）===
+
+  - name: "架构设计文档 14 章结构完整"
+    category: "output_check"
+    severity: "error"
+    check_type: "deterministic"
     required_artifact: "架构设计模版"
-    rule: "架构设计文档必须包含系统分层、模块划分和关键接口定义"
+    rule: "Ch1~Ch14 均存在且非空（Ch4a/Ch12 可选）"
+    evidence_required:
+      - "架构设计文档全文"
+      - "章节数计数结果（必须 = 14）"
+
+  - name: "ADR 至少 1 条且状态为 Accepted"
+    category: "output_check"
+    severity: "error"
+    check_type: "deterministic"
+    required_artifact: "ADR模版"
+    rule: "00-架构决策记录.md 中有 ≥1 条 Accepted ADR"
+    evidence_required:
+      - "ADR 文件路径"
+      - "ADR 状态列表"
+
+  - name: "条件产物标注明确"
+    category: "output_check"
+    severity: "warning"
+    check_type: "deterministic"
+    rule: "数据库变更方案和接口对接方案标注为'有'或'无'，'无'时有判断依据"
+    evidence_required:
+      - "产物包清单"
+
+  - name: "子产物（若有）章节完整"
+    category: "output_check"
+    severity: "warning"
+    check_type: "deterministic"
+    rule: "数据库变更方案 5 章 / 接口对接方案 9 章 / 老系统产物各章完整"
+    evidence_required:
+      - "对应产物全文"
+
+  - name: "追踪矩阵更新"
+    category: "output_check"
+    severity: "warning"
+    check_type: "deterministic"
+    rule: "追踪矩阵包含 ADR-REF + MOD 列，且所有 REQ-ID 有对应架构设计决策"
+    evidence_required:
+      - "追踪矩阵"
+
+  # === 内容质量检查（5 项）===
+
+  - name: "Ch3a 约束条件覆盖 4 类"
+    category: "quality_check"
+    severity: "warning"
+    check_type: "deterministic"
+    rule: "技术/组织/法规/预算约束各 ≥1 条"
+    evidence_required:
+      - "架构设计文档 Ch3a"
+
+  - name: "Ch6 核心业务流程时序图存在"
+    category: "quality_check"
+    severity: "error"
+    check_type: "deterministic"
+    rule: "Ch6.2 中每个核心业务流程有 ≥1 张 Mermaid sequenceDiagram"
+    evidence_required:
+      - "架构设计文档 Ch6.2"
+      - "sequenceDiagram 数量"
+
+  - name: "Ch10 NFR 有量化目标值"
+    category: "quality_check"
+    severity: "warning"
+    check_type: "deterministic"
+    rule: "Ch10.1 每个 NFR 行有数值型目标值 + 验证方式"
+    evidence_required:
+      - "架构设计文档 Ch10.1"
+
+  - name: "数据库变更方案风险分级"
+    category: "quality_check"
+    severity: "error"
+    check_type: "deterministic"
+    rule: "变更风险等级已标注 + 回滚触发条件已定义"
+    evidence_required:
+      - "数据库变更方案 Ch1 + Ch5"
+
+  - name: "接口对接方案容错参数完整"
+    category: "quality_check"
+    severity: "warning"
+    check_type: "deterministic"
+    rule: "Ch6 超时/重试/熔断参数均为数值（非描述）"
+    evidence_required:
+      - "接口对接方案 Ch6"
+
+  # === 一致性检查（3 项）===
+
+  - name: "REQ-ID 引用闭环"
+    category: "cross_validation"
+    severity: "error"
+    check_type: "deterministic"
+    rule: "架构设计文档引用的 REQ-ID 全部在需求分析文档中存在，且无遗漏"
+    evidence_required:
+      - "架构设计文档 + 需求分析文档"
+
+  - name: "子产物与主产物引用一致"
+    category: "cross_validation"
+    severity: "warning"
+    check_type: "deterministic"
+    rule: "数据库变更方案引用的表名/接口对接方案引用的接口名在主产物中存在"
+    evidence_required:
+      - "全产物交叉检查"
+
+  - name: "Mermaid 图类型正确"
+    category: "quality_check"
+    severity: "warning"
+    check_type: "deterministic"
+    rule: "系统上下文=C4Context/deployment，模块交互=graph/component，时序=sequence，状态=state"
+    evidence_required:
+      - "架构设计文档所有 Mermaid 代码块"
+
+  # === 安全与风险检查（2 项）===
 
-  - name: "接口规格完备性"
-    required_artifact: "API接口规格文档模版"
-    rule: "所有外部接口和跨模块接口必须在接口规格中有定义"
+  - name: "安全架构覆盖认证/授权/加密"
+    category: "quality_check"
+    severity: "error"
+    check_type: "deterministic"
+    rule: "Ch6.4 包含认证方案 + 授权方案 + 数据加密策略"
+    evidence_required:
+      - "架构设计文档 Ch6.4"
 
-  - name: "数据库设计完整性"
-    required_artifact: "数据库设计文档模版"
-    rule: "数据库设计文档必须包含表结构、索引和关系定义"
+  - name: "风险登记有应对方案"
+    category: "quality_check"
+    severity: "warning"
+    check_type: "deterministic"
+    rule: "Ch10.2 每个 RISK-ID 有应对方案列非空"
+    evidence_required:
+      - "架构设计文档 Ch10.2"