soloforge 1.4.16 → 2.0.0

package/dist/engine/audit/privacy_types.d.ts

@@ -0,0 +1,48 @@
+/**
+ * 隐私/机密/数据主权合约 — 类型定义
+ *
+ * 将敏感信息读取、prompt 注入、TaskContext/evidence/artifact 存储、
+ * 外发、用户授权、脱敏和用户反馈统一建模。
+ *
+ * 核心原则:
+ * - secret/credential 默认 forbidden
+ * - PII/customer_data/production_data 默认 require_human 或 summarize_only
+ * - .env、私钥、cookie、token store 默认禁止读取内容
+ * - 外部发送前必须做 redaction check
+ */
+export type SensitivityLabel = "public" | "internal" | "confidential" | "secret" | "credential" | "pii" | "customer_data" | "production_data" | "unknown";
+export type HandlingMode = "allow" | "redact" | "summarize_only" | "require_human" | "forbidden";
+export type RedactionType = "secret_mask" | "credential_removed" | "pii_mask" | "customer_data_summary" | "production_data_summary" | "path_only" | "hash_only";
+export type AllowedOperation = "read" | "summarize" | "redact" | "prompt_inject" | "store_private" | "external_send";
+export type CheckContext = "prompt_injection" | "task_context_store" | "artifact_store" | "evidence_store" | "external_send" | "read_operation";
+export interface DataSensitivityLabel {
+    label: SensitivityLabel;
+    source_ref: string;
+    detected_by: string[];
+    confidence: number;
+    handling: HandlingMode;
+}
+export interface DataAccessGrant {
+    grant_id: string;
+    granted_by: string;
+    scope_refs: string[];
+    sensitivity_allowed: SensitivityLabel[];
+    allowed_operations: AllowedOperation[];
+    purpose: string;
+    expires_at: string;
+    revocable: boolean;
+}
+export interface RedactionRecord {
+    source_ref: string;
+    redaction_type: RedactionType;
+    before_hash?: string;
+    after_hash: string;
+    fields_redacted: string[];
+}
+export interface PrivacyGovernanceFinding {
+    severity: "hard_fail" | "advisory";
+    rule: string;
+    source_ref?: string;
+    message: string;
+}
+//# sourceMappingURL=privacy_types.d.ts.map

package/dist/engine/audit/privacy_types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy_types.d.ts","sourceRoot":"","sources":["../../../src/engine/audit/privacy_types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,MAAM,gBAAgB,GACxB,QAAQ,GACR,UAAU,GACV,cAAc,GACd,QAAQ,GACR,YAAY,GACZ,KAAK,GACL,eAAe,GACf,iBAAiB,GACjB,SAAS,CAAC;AAEd,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,QAAQ,GACR,gBAAgB,GAChB,eAAe,GACf,WAAW,CAAC;AAEhB,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,oBAAoB,GACpB,UAAU,GACV,uBAAuB,GACvB,yBAAyB,GACzB,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,gBAAgB,GACxB,MAAM,GACN,WAAW,GACX,QAAQ,GACR,eAAe,GACf,eAAe,GACf,eAAe,CAAC;AAEpB,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,eAAe,GACf,gBAAgB,CAAC;AAErB,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,gBAAgB,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mBAAmB,EAAE,gBAAgB,EAAE,CAAC;IACxC,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,aAAa,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,WAAW,GAAG,UAAU,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/dist/engine/audit/privacy_types.js

@@ -0,0 +1,14 @@
+/**
+ * 隐私/机密/数据主权合约 — 类型定义
+ *
+ * 将敏感信息读取、prompt 注入、TaskContext/evidence/artifact 存储、
+ * 外发、用户授权、脱敏和用户反馈统一建模。
+ *
+ * 核心原则:
+ * - secret/credential 默认 forbidden
+ * - PII/customer_data/production_data 默认 require_human 或 summarize_only
+ * - .env、私钥、cookie、token store 默认禁止读取内容
+ * - 外部发送前必须做 redaction check
+ */
+export {};
+//# sourceMappingURL=privacy_types.js.map

package/dist/engine/audit/privacy_types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy_types.js","sourceRoot":"","sources":["../../../src/engine/audit/privacy_types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/engine/audit/risk_sampler.d.ts

@@ -0,0 +1,45 @@
+/**
+ * 风险加权抽样决策模块 — 无运行时消费方，保留供未来抽样策略实现。
+ *
+ * 风险加权抽样决策 — 基于 audit pool 中的 AuditItem 决定是否抽检。
+ * P2-2 范围: 只输出抽样决策，不生成逃逸报告，不改能力状态。
+ *
+ * 抽样率:
+ * - low:      20% baseline
+ * - medium:   50%
+ * - high:     80%
+ * - critical: 100%
+ *
+ * 可复现: 同 seed + 同 task_id → 同决策。
+ */
+import type { RiskLevel } from "./audit_pool.js";
+export interface SamplingDecision {
+    item_task_id: string;
+    item_risk: RiskLevel;
+    should_sample: boolean;
+    seed: number;
+    threshold_pct: number;
+    hash_value: number;
+    risk_factors: RiskFactor[];
+    reason: string;
+}
+export interface RiskFactor {
+    factor: string;
+    detail: string;
+    impact: "increases" | "decreases" | "neutral";
+}
+export interface SampleableItem {
+    task_id: string;
+    risk: RiskLevel;
+    changed_files: string[];
+    capability_refs: string[];
+}
+/**
+ * 执行 shouldSample 操作
+ */
+export declare function shouldSample(item: SampleableItem, seed?: number): SamplingDecision;
+/**
+ * 执行 getThreshold 操作
+ */
+export declare function getThreshold(risk: RiskLevel): number;
+//# sourceMappingURL=risk_sampler.d.ts.map

package/dist/engine/audit/risk_sampler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk_sampler.d.ts","sourceRoot":"","sources":["../../../src/engine/audit/risk_sampler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,SAAS,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC;CAC/C;AA8CD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,cAAc,EACpB,IAAI,GAAE,MAAU,GACf,gBAAgB,CA2BlB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAGpD"}

package/dist/engine/audit/risk_sampler.js

@@ -0,0 +1,81 @@
+/**
+ * 风险加权抽样决策模块 — 无运行时消费方，保留供未来抽样策略实现。
+ *
+ * 风险加权抽样决策 — 基于 audit pool 中的 AuditItem 决定是否抽检。
+ * P2-2 范围: 只输出抽样决策，不生成逃逸报告，不改能力状态。
+ *
+ * 抽样率:
+ * - low:      20% baseline
+ * - medium:   50%
+ * - high:     80%
+ * - critical: 100%
+ *
+ * 可复现: 同 seed + 同 task_id → 同决策。
+ */
+import { createHash } from "node:crypto";
+import { debug } from "../core/logger.js";
+const RISK_THRESHOLDS = {
+    low: 20,
+    medium: 50,
+    high: 80,
+    critical: 100,
+};
+function computeHash(taskId, seed) {
+    const h = createHash("sha256").update(`${taskId}:${seed}`).digest();
+    return h.readUInt32BE(0) % 100;
+}
+function collectRiskFactors(risk, changedFileCount, hasCapabilityRefs) {
+    const factors = [];
+    factors.push({
+        factor: "risk_level",
+        detail: `task risk is ${risk}, threshold ${RISK_THRESHOLDS[risk]}%`,
+        impact: risk === "low" ? "decreases" : risk === "critical" ? "increases" : "neutral",
+    });
+    if (changedFileCount > 10) {
+        factors.push({
+            factor: "large_change_set",
+            detail: `${changedFileCount} files changed (>10)`,
+            impact: "increases",
+        });
+    }
+    if (hasCapabilityRefs) {
+        factors.push({
+            factor: "capability_coverage",
+            detail: "task touches registered capabilities",
+            impact: "increases",
+        });
+    }
+    return factors;
+}
+/**
+ * 执行 shouldSample 操作
+ */
+export function shouldSample(item, seed = 0) {
+    debug("风险采样", "shouldSample() 开始, task_id=${item.task_id}, risk=${item.risk}");
+    const threshold = RISK_THRESHOLDS[item.risk];
+    const hashValue = computeHash(item.task_id, seed);
+    const shouldSample = hashValue < threshold;
+    const riskFactors = collectRiskFactors(item.risk, item.changed_files.length, item.capability_refs.length > 0);
+    debug("风险采样", "hash=${hashValue}, threshold=${threshold}, should_sample=${shouldSample}");
+    const reason = shouldSample
+        ? `sampled: hash ${hashValue} < threshold ${threshold} (risk=${item.risk})`
+        : `skipped: hash ${hashValue} >= threshold ${threshold} (risk=${item.risk})`;
+    return {
+        item_task_id: item.task_id,
+        item_risk: item.risk,
+        should_sample: shouldSample,
+        seed,
+        threshold_pct: threshold,
+        hash_value: hashValue,
+        risk_factors: riskFactors,
+        reason,
+    };
+}
+/**
+ * 执行 getThreshold 操作
+ */
+export function getThreshold(risk) {
+    debug("风险采样", "getThreshold() risk=${risk}, threshold=${RISK_THRESHOLDS[risk]}");
+    return RISK_THRESHOLDS[risk];
+}
+//# sourceMappingURL=risk_sampler.js.map

package/dist/engine/audit/risk_sampler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk_sampler.js","sourceRoot":"","sources":["../../../src/engine/audit/risk_sampler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAmB1C,MAAM,eAAe,GAA8B;IACjD,GAAG,EAAE,EAAE;IACP,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,GAAG;CACd,CAAC;AAEF,SAAS,WAAW,CAAC,MAAc,EAAE,IAAY;IAC/C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;AACjC,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAe,EACf,gBAAwB,EACxB,iBAA0B;IAE1B,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,OAAO,CAAC,IAAI,CAAC;QACX,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,gBAAgB,IAAI,eAAe,eAAe,CAAC,IAAI,CAAC,GAAG;QACnE,MAAM,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC,CAAC;IAEH,IAAI,gBAAgB,GAAG,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,GAAG,gBAAgB,sBAAsB;YACjD,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,sCAAsC;YAC9C,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AASD;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAoB,EACpB,OAAe,CAAC;IAEd,KAAK,CAAC,MAAM,EAAE,+DAA+D,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;IAE3C,MAAM,WAAW,GAAG,kBAAkB,CACpC,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,aAAa,CAAC,MAAM,EACzB,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAChC,CAAC;IAEF,KAAK,CAAC,MAAM,EAAE,0EAA0E,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,YAAY;QACzB,CAAC,CAAC,iBAAiB,SAAS,gBAAgB,SAAS,UAAU,IAAI,CAAC,IAAI,GAAG;QAC3E,CAAC,CAAC,iBAAiB,SAAS,iBAAiB,SAAS,UAAU,IAAI,CAAC,IAAI,GAAG,CAAC;IAE/E,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,OAAO;QAC1B,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,aAAa,EAAE,YAAY;QAC3B,IAAI;QACJ,aAAa,EAAE,SAAS;QACxB,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAe;IAC1C,KAAK,CAAC,MAAM,EAAE,iEAAiE,CAAC,CAAC;IACjF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/engine/audit/runtime_safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime_safety.d.ts","sourceRoot":"","sources":["../../../src/engine/audit/runtime_safety.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAClE,aAAa,EAAE,CAiCjB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAoDA;AAID,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAEnE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAuBD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CA8BlE;AAID,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,iBAAiB,GAC3B,oBAAoB,CAsBtB;AAID,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAUD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EAAE,EACtB,YAAY,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GACrD,iBAAiB,CA2BnB"}

package/dist/engine/audit/runtime_safety.js

@@ -0,0 +1,200 @@
+/**
+ * 运行安全包 — 证据 hash chain、命令副作用分级、供应链治理、迁移回滚契约。
+ * advisory: 不 hard block（除 destructive 命令需人工确认）。
+ */
+import crypto from "node:crypto";
+import { debug } from "../core/logger.js";
+/**
+ * 构建证据链 — 每个步骤产出带 hash 的证据块，与前一个块链式连接。
+ */
+export function buildEvidenceChain(steps) {
+    const chain = [];
+    let prevHash = null;
+    for (const s of steps) {
+        const timestamp = s.timestamp ?? new Date().toISOString();
+        const dataHash = crypto
+            .createHash("sha256")
+            .update(s.payload)
+            .digest("hex")
+            .slice(0, 16);
+        const chainInput = `${s.step}:${timestamp}:${dataHash}:${prevHash ?? "genesis"}`;
+        const chainHash = crypto
+            .createHash("sha256")
+            .update(chainInput)
+            .digest("hex")
+            .slice(0, 16);
+        const block = {
+            step: s.step,
+            timestamp,
+            data_hash: dataHash,
+            prev_hash: prevHash,
+            chain_hash: chainHash,
+            payload: s.payload,
+        };
+        chain.push(block);
+        prevHash = chainHash;
+    }
+    return chain;
+}
+/**
+ * 验证证据链完整性 — 检查每个块的 chain_hash 是否与重算结果一致。
+ */
+export function verifyEvidenceChain(chain) {
+    if (chain.length > 0)
+        debug("运行安全", "验证证据链，块数:", chain.length);
+    if (chain.length === 0) {
+        return { valid: true, broken_at: null, advisory: "证据链为空，无需校验" };
+    }
+    for (let i = 0; i < chain.length; i++) {
+        const block = chain[i];
+        const expectedPrev = i === 0 ? null : chain[i - 1].chain_hash;
+        if (block.prev_hash !== expectedPrev) {
+            return {
+                valid: false,
+                broken_at: i,
+                advisory: `证据链在第 ${i} 步断裂: prev_hash 不匹配，请检查步骤顺序是否被篡改`,
+            };
+        }
+        // 从 payload 重算 data_hash 以检测篡改
+        const expectedDataHash = crypto
+            .createHash("sha256")
+            .update(block.payload)
+            .digest("hex")
+            .slice(0, 16);
+        if (block.data_hash !== expectedDataHash) {
+            return {
+                valid: false,
+                broken_at: i,
+                advisory: `证据链在第 ${i} 步断裂: data_hash 不匹配（payload 被篡改），请恢复原始执行记录`,
+            };
+        }
+        const chainInput = `${block.step}:${block.timestamp}:${block.data_hash}:${block.prev_hash ?? "genesis"}`;
+        const expectedHash = crypto
+            .createHash("sha256")
+            .update(chainInput)
+            .digest("hex")
+            .slice(0, 16);
+        if (block.chain_hash !== expectedHash) {
+            return {
+                valid: false,
+                broken_at: i,
+                advisory: `证据链在第 ${i} 步断裂: chain_hash 不匹配，请重新执行并生成完整证据链`,
+            };
+        }
+    }
+    return {
+        valid: true,
+        broken_at: null,
+        advisory: `证据链完整: ${chain.length} 个步骤已验证通过`,
+    };
+}
+const DESTRUCTIVE_PATTERNS = [
+    { pattern: /\brm\s+(-[rf]+\s+|--no-preserve-root)/, example: "rm -rf" },
+    { pattern: /\bgit\s+(push\s+--force|reset\s+--hard|clean\s+-fd)/, example: "git push --force" },
+    { pattern: /\bdd\s+if=/, example: "dd" },
+    { pattern: /\b(format|mkfs)\b/, example: "format" },
+    { pattern: /\bdrop\s+(table|database|schema)\b/i, example: "DROP TABLE" },
+    { pattern: /\bTRUNCATE\b/i, example: "TRUNCATE" },
+    { pattern: /\bDELETE\s+FROM\b/i, example: "DELETE FROM" },
+    { pattern: /\b(npm\s+publish|yarn\s+publish|pnpm\s+publish)\b/, example: "npm publish" },
+];
+const MUTATING_PATTERNS = [
+    { pattern: /\bgit\s+(add|commit|push|merge|rebase|checkout)\b/, example: "git commit" },
+    { pattern: /\b(npm\s+install|yarn\s+add|pnpm\s+add)\b/, example: "npm install" },
+    { pattern: /\bmv\s+/, example: "mv" },
+    { pattern: /\bcp\s+/, example: "cp" },
+    { pattern: /\bmkdir\s+/, example: "mkdir" },
+    { pattern: /\bdocker\s+(run|build|push|rmi|rm)\b/, example: "docker run" },
+    { pattern: /\b(INSERT|UPDATE|ALTER|CREATE)\b/i, example: "INSERT" },
+];
+/**
+ * 分类命令的副作用级别。
+ */
+export function classifyCommand(command) {
+    for (const dp of DESTRUCTIVE_PATTERNS) {
+        if (dp.pattern.test(command)) {
+            debug("运行安全", "检测到破坏性命令:", command);
+            return {
+                command,
+                risk: "destructive",
+                advisory: `检测到破坏性命令: ${dp.example} — 需要人工确认后方可执行`,
+                requires_human_confirm: true,
+            };
+        }
+    }
+    for (const mp of MUTATING_PATTERNS) {
+        if (mp.pattern.test(command)) {
+            return {
+                command,
+                risk: "mutating",
+                advisory: `变更类命令: ${mp.example}`,
+                requires_human_confirm: false,
+            };
+        }
+    }
+    return {
+        command,
+        risk: "read_only",
+        advisory: "只读命令",
+        requires_human_confirm: false,
+    };
+}
+/**
+ * 检查迁移契约 — 确保 schema 变更有回滚路径。
+ */
+export function checkMigrationContract(migration) {
+    const forwardClassified = classifyCommand(migration.forward_command);
+    const rollbackClassified = classifyCommand(migration.rollback_command);
+    if (!migration.rollback_command || migration.rollback_command.trim().length === 0) {
+        return {
+            migration_id: migration.migration_id,
+            has_rollback: false,
+            rollback_valid: false,
+            advisory: `迁移 "${migration.migration_id}" 缺少回滚命令 — 如果迁移失败需要手动恢复，建议补充 rollback_command`,
+        };
+    }
+    // 回滚命令应是正向操作的反向操作
+    const rollbackValid = migration.rollback_command.length > 0;
+    return {
+        migration_id: migration.migration_id,
+        has_rollback: true,
+        rollback_valid: rollbackValid,
+        advisory: `迁移 "${migration.migration_id}": 正向风险=${forwardClassified.risk}, 回滚风险=${rollbackClassified.risk}`,
+    };
+}
+const LOCKFILE_NAMES = [
+    "package-lock.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "go.sum",
+    "Cargo.lock",
+];
+/**
+ * 检查供应链安全 — 验证依赖有 lockfile 和完整性 hash。
+ * 此为轻量级检查，不读取实际文件内容。
+ */
+export function checkSupplyChain(rootDirFiles, dependencies) {
+    const hasLockfile = LOCKFILE_NAMES.some((lf) => rootDirFiles.includes(lf));
+    debug("运行安全", "检查供应链安全，依赖数:", dependencies.length, "lockfile:", hasLockfile);
+    const checks = dependencies.map((dep) => ({
+        package_name: dep.name,
+        version: dep.version,
+        has_lockfile: hasLockfile,
+        has_integrity_hash: hasLockfile, // lockfile 意味着存在完整性哈希
+        advisory: hasLockfile
+            ? "已通过 lockfile 锁定，含完整性哈希"
+            : `${dep.name}@${dep.version} 未锁定 — 存在供应链风险，建议添加 lockfile`,
+    }));
+    const locked = checks.filter((c) => c.has_lockfile).length;
+    const unlocked = checks.length - locked;
+    return {
+        total_dependencies: dependencies.length,
+        locked_dependencies: locked,
+        unlocked_dependencies: unlocked,
+        checks,
+        advisory: unlocked > 0
+            ? `${unlocked}/${dependencies.length} 个依赖未锁定 — 建议添加 lockfile 以保障供应链安全`
+            : `全部 ${dependencies.length} 个依赖已锁定`,
+    };
+}
+//# sourceMappingURL=runtime_safety.js.map

package/dist/engine/audit/runtime_safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime_safety.js","sourceRoot":"","sources":["../../../src/engine/audit/runtime_safety.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAa1C;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAmE;IAEnE,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IAEnC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM;aACpB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;aACjB,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhB,MAAM,UAAU,GAAW,GAAG,CAAC,CAAC,IAAI,IAAI,SAAS,IAAI,QAAQ,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;QACzF,MAAM,SAAS,GAAW,MAAM;aAC7B,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhB,MAAM,KAAK,GAAkB;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS;YACT,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,SAAS;YACrB,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC;QAEF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IAKxD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAClE,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;QAC9D,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;YACrC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,SAAS,EAAE,CAAC;gBACZ,QAAQ,EAAE,SAAS,CAAC,kCAAkC;aACvD,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,MAAM,gBAAgB,GAAG,MAAM;aAC5B,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;aACrB,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,IAAI,KAAK,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;YACzC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,SAAS,EAAE,CAAC;gBACZ,QAAQ,EAAE,SAAS,CAAC,4CAA4C;aACjE,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;QACzG,MAAM,YAAY,GAAG,MAAM;aACxB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhB,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YACtC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,SAAS,EAAE,CAAC;gBACZ,QAAQ,EAAE,SAAS,CAAC,oCAAoC;aACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,UAAU,KAAK,CAAC,MAAM,WAAW;KAC5C,CAAC;AACJ,CAAC;AAaD,MAAM,oBAAoB,GAAgD;IACxE,EAAE,OAAO,EAAE,uCAAuC,EAAE,OAAO,EAAE,QAAQ,EAAE;IACvE,EAAE,OAAO,EAAE,qDAAqD,EAAE,OAAO,EAAE,kBAAkB,EAAE;IAC/F,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE;IACxC,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACnD,EAAE,OAAO,EAAE,qCAAqC,EAAE,OAAO,EAAE,YAAY,EAAE;IACzE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE;IACjD,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,aAAa,EAAE;IACzD,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,aAAa,EAAE;CACzF,CAAC;AAEF,MAAM,iBAAiB,GAAgD;IACrE,EAAE,OAAO,EAAE,mDAAmD,EAAE,OAAO,EAAE,YAAY,EAAE;IACvF,EAAE,OAAO,EAAE,2CAA2C,EAAE,OAAO,EAAE,aAAa,EAAE;IAChF,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;IACrC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;IACrC,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE;IAC3C,EAAE,OAAO,EAAE,sCAAsC,EAAE,OAAO,EAAE,YAAY,EAAE;IAC1E,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,QAAQ,EAAE;CACpE,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,KAAK,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;QACtC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO;gBACL,OAAO;gBACP,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,aAAa,EAAE,CAAC,OAAO,gBAAgB;gBACjD,sBAAsB,EAAE,IAAI;aAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,UAAU,EAAE,CAAC,OAAO,EAAE;gBAChC,sBAAsB,EAAE,KAAK;aAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,MAAM;QAChB,sBAAsB,EAAE,KAAK;KAC9B,CAAC;AACJ,CAAC;AAoBD;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAA4B;IAE5B,MAAM,iBAAiB,GAAG,eAAe,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,kBAAkB,GAAG,eAAe,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAEvE,IAAI,CAAC,SAAS,CAAC,gBAAgB,IAAI,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,OAAO;YACL,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,YAAY,EAAE,KAAK;YACnB,cAAc,EAAE,KAAK;YACrB,QAAQ,EAAE,OAAO,SAAS,CAAC,YAAY,+CAA+C;SACvF,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,MAAM,aAAa,GAAG,SAAS,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAE5D,OAAO;QACL,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,aAAa;QAC7B,QAAQ,EAAE,OAAO,SAAS,CAAC,YAAY,WAAW,iBAAiB,CAAC,IAAI,UAAU,kBAAkB,CAAC,IAAI,EAAE;KAC5G,CAAC;AACJ,CAAC;AAoBD,MAAM,cAAc,GAAG;IACrB,mBAAmB;IACnB,gBAAgB;IAChB,WAAW;IACX,QAAQ;IACR,YAAY;CACb,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,YAAsB,EACtB,YAAsD;IAEtD,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAsB,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,YAAY,EAAE,GAAG,CAAC,IAAI;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,YAAY,EAAE,WAAW;QACzB,kBAAkB,EAAE,WAAW,EAAE,sBAAsB;QACvD,QAAQ,EAAE,WAAW;YACnB,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,8BAA8B;KAC7D,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAExC,OAAO;QACL,kBAAkB,EAAE,YAAY,CAAC,MAAM;QACvC,mBAAmB,EAAE,MAAM;QAC3B,qBAAqB,EAAE,QAAQ;QAC/B,MAAM;QACN,QAAQ,EACN,QAAQ,GAAG,CAAC;YACV,CAAC,CAAC,GAAG,QAAQ,IAAI,YAAY,CAAC,MAAM,kCAAkC;YACtE,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,SAAS;KACzC,CAAC;AACJ,CAAC"}

package/dist/engine/audit/semantic_evidence.d.ts

@@ -0,0 +1,33 @@
+/**
+ * 语义交付证据模块 — 被 developer_sovereignty.ts 和 delivery.ts 消费，待重构。
+ *
+ * 语义交付证据 — R9 需求→语义 diff→断言→变异证据链。
+ * CAP-011 advisory: 不 hard block，只产出 advisory 报告。
+ *
+ * 职责:
+ * - computeSemanticEvidence: 从变更文件 + 需求点计算语义证据
+ * - buildDeliveryEvidenceChain: 从任务上下文构建完整交付证据链
+ */
+import type { TaskContext } from "../../types/task.js";
+import type { RequirementPoint, SemanticEvidence } from "../../types/pipeline.js";
+import type { DeliveryEvidenceChain } from "../../types/delivery.js";
+/**
+ * 从任务上下文计算语义证据。
+ * 基于变更文件和需求点，推断变更行为和需求覆盖状态。
+ * @param changedFiles - 变更文件路径列表
+ * @param requirementPoints - 需求点列表
+ * @param acceptanceResults - 可选的验收测试结果列表
+ * @returns 语义证据对象
+ */
+export declare function computeSemanticEvidence(changedFiles: string[], requirementPoints: RequirementPoint[], acceptanceResults?: Array<{
+    id: string;
+    passed: boolean;
+}>): SemanticEvidence;
+/**
+ * 从任务上下文构建完整交付证据链。
+ * 聚合 expand 的需求点、verify 的语义证据、execution 的变更文件。
+ * @param taskContext - 任务上下文
+ * @returns 完整交付证据链，无需求点且无变更文件时返回 null
+ */
+export declare function buildDeliveryEvidenceChain(taskContext: TaskContext): DeliveryEvidenceChain | null;
+//# sourceMappingURL=semantic_evidence.d.ts.map

package/dist/engine/audit/semantic_evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic_evidence.d.ts","sourceRoot":"","sources":["../../../src/engine/audit/semantic_evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EAAE,EACtB,iBAAiB,EAAE,gBAAgB,EAAE,EACrC,iBAAiB,CAAC,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,GACzD,gBAAgB,CA4ClB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,WAAW,GACvB,qBAAqB,GAAG,IAAI,CAiD9B"}

package/dist/engine/audit/semantic_evidence.js

@@ -0,0 +1,93 @@
+/**
+ * 语义交付证据模块 — 被 developer_sovereignty.ts 和 delivery.ts 消费，待重构。
+ *
+ * 语义交付证据 — R9 需求→语义 diff→断言→变异证据链。
+ * CAP-011 advisory: 不 hard block，只产出 advisory 报告。
+ *
+ * 职责:
+ * - computeSemanticEvidence: 从变更文件 + 需求点计算语义证据
+ * - buildDeliveryEvidenceChain: 从任务上下文构建完整交付证据链
+ */
+import { debug } from "../core/logger.js";
+/**
+ * 从任务上下文计算语义证据。
+ * 基于变更文件和需求点，推断变更行为和需求覆盖状态。
+ * @param changedFiles - 变更文件路径列表
+ * @param requirementPoints - 需求点列表
+ * @param acceptanceResults - 可选的验收测试结果列表
+ * @returns 语义证据对象
+ */
+export function computeSemanticEvidence(changedFiles, requirementPoints, acceptanceResults) {
+    debug("SemanticEvidence", "计算语义证据", "文件数:", changedFiles.length, "需求点:", requirementPoints.length);
+    const changedBehaviors = changedFiles.map((f) => {
+        const matchedReq = requirementPoints.find((rp) => rp.acceptance_test_ids?.some((tid) => f.toLowerCase().includes(tid.toLowerCase().replace(/[^a-z0-9]/g, ""))));
+        return {
+            file_path: f,
+            description: `modified: ${f}`,
+            requirement_point_id: matchedReq?.id,
+        };
+    });
+    const requirementCoverage = requirementPoints.map((rp) => {
+        const hasMatchingFile = changedBehaviors.some((cb) => cb.requirement_point_id === rp.id);
+        const acceptancePassed = acceptanceResults?.filter((ar) => rp.acceptance_test_ids?.includes(ar.id));
+        const allAcceptancePassed = acceptancePassed
+            ? acceptancePassed.length > 0 && acceptancePassed.every((a) => a.passed)
+            : false;
+        const covered = hasMatchingFile || allAcceptancePassed;
+        return {
+            requirement_point_id: rp.id,
+            covered,
+            evidence: covered
+                ? hasMatchingFile
+                    ? "file change matched"
+                    : "acceptance tests passed"
+                : "no matching evidence",
+        };
+    });
+    return {
+        changed_behaviors: changedBehaviors,
+        unchanged_assertions: [],
+        requirement_coverage: requirementCoverage,
+    };
+}
+/**
+ * 从任务上下文构建完整交付证据链。
+ * 聚合 expand 的需求点、verify 的语义证据、execution 的变更文件。
+ * @param taskContext - 任务上下文
+ * @returns 完整交付证据链，无需求点且无变更文件时返回 null
+ */
+export function buildDeliveryEvidenceChain(taskContext) {
+    debug("SemanticEvidence", "构建交付证据链");
+    const requirementPoints = taskContext.expansion?.requirement_points ?? [];
+    const semanticEvidence = taskContext.verification?.semantic_evidence;
+    const changedFiles = taskContext.execution?.changed_files ?? [];
+    if (requirementPoints.length === 0 && changedFiles.length === 0) {
+        debug("SemanticEvidence", "无需求点且无变更文件，无法构建证据链");
+        return null;
+    }
+    const fileToRequirements = changedFiles.map((f) => ({
+        file_path: f,
+        requirement_point_ids: requirementPoints
+            .filter((rp) => semanticEvidence?.changed_behaviors.some((cb) => cb.file_path === f && cb.requirement_point_id === rp.id))
+            .map((rp) => rp.id),
+    }));
+    const uncoveredPoints = requirementPoints
+        .filter((rp) => {
+        const coverage = semanticEvidence?.requirement_coverage?.find((rc) => rc.requirement_point_id === rp.id);
+        return !coverage?.covered;
+    })
+        .map((rp) => rp.id);
+    return {
+        requirement_points: requirementPoints,
+        semantic_evidence: semanticEvidence ?? undefined,
+        file_to_requirements: fileToRequirements,
+        completeness: {
+            all_requirements_covered: uncoveredPoints.length === 0,
+            uncovered_points: uncoveredPoints,
+            advisory: uncoveredPoints.length > 0
+                ? `advisory: ${uncoveredPoints.length} requirement point(s) not covered by evidence: ${uncoveredPoints.join(", ")}`
+                : "all requirement points covered",
+        },
+    };
+}
+//# sourceMappingURL=semantic_evidence.js.map

package/dist/engine/audit/semantic_evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic_evidence.js","sourceRoot":"","sources":["../../../src/engine/audit/semantic_evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAK1C;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,YAAsB,EACtB,iBAAqC,EACrC,iBAA0D;IAE1D,KAAK,CAAC,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAEnG,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAC/C,EAAE,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACnC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CACtE,CACF,CAAC;QACF,OAAO;YACL,SAAS,EAAE,CAAC;YACZ,WAAW,EAAE,aAAa,CAAC,EAAE;YAC7B,oBAAoB,EAAE,UAAU,EAAE,EAAE;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACvD,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAC3C,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,oBAAoB,KAAK,EAAE,CAAC,EAAE,CAC1C,CAAC;QACF,MAAM,gBAAgB,GAAG,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CACxD,EAAE,CAAC,mBAAmB,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CACxC,CAAC;QACF,MAAM,mBAAmB,GAAG,gBAAgB;YAC1C,CAAC,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACxE,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,OAAO,GAAG,eAAe,IAAI,mBAAmB,CAAC;QACvD,OAAO;YACL,oBAAoB,EAAE,EAAE,CAAC,EAAE;YAC3B,OAAO;YACP,QAAQ,EAAE,OAAO;gBACf,CAAC,CAAC,eAAe;oBACf,CAAC,CAAC,qBAAqB;oBACvB,CAAC,CAAC,yBAAyB;gBAC7B,CAAC,CAAC,sBAAsB;SAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,iBAAiB,EAAE,gBAAgB;QACnC,oBAAoB,EAAE,EAAE;QACxB,oBAAoB,EAAE,mBAAmB;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAwB;IAExB,KAAK,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;IAErC,MAAM,iBAAiB,GACrB,WAAW,CAAC,SAAS,EAAE,kBAAkB,IAAI,EAAE,CAAC;IAClD,MAAM,gBAAgB,GACpB,WAAW,CAAC,YAAY,EAAE,iBAAiB,CAAC;IAC9C,MAAM,YAAY,GAChB,WAAW,CAAC,SAAS,EAAE,aAAa,IAAI,EAAE,CAAC;IAE7C,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,SAAS,EAAE,CAAC;QACZ,qBAAqB,EAAE,iBAAiB;aACrC,MAAM,CACL,CAAC,EAAE,EAAE,EAAE,CACL,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CACtC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,oBAAoB,KAAK,EAAE,CAAC,EAAE,CAChE,CACJ;aACA,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;KACtB,CAAC,CAAC,CAAC;IAEJ,MAAM,eAAe,GAAG,iBAAiB;SACtC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,gBAAgB,EAAE,oBAAoB,EAAE,IAAI,CAC3D,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,oBAAoB,KAAK,EAAE,CAAC,EAAE,CAC1C,CAAC;QACF,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC5B,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAEtB,OAAO;QACL,kBAAkB,EAAE,iBAAiB;QACrC,iBAAiB,EAAE,gBAAgB,IAAI,SAAS;QAChD,oBAAoB,EAAE,kBAAkB;QACxC,YAAY,EAAE;YACZ,wBAAwB,EAAE,eAAe,CAAC,MAAM,KAAK,CAAC;YACtD,gBAAgB,EAAE,eAAe;YACjC,QAAQ,EACN,eAAe,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC,aAAa,eAAe,CAAC,MAAM,kDAAkD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACnH,CAAC,CAAC,gCAAgC;SACvC;KACF,CAAC;AACJ,CAAC"}

package/dist/engine/audit/test_generator.d.ts

@@ -0,0 +1,10 @@
+import type { TestGenGuide, ProjectConfig } from "../../types/index.js";
+/**
+ * 为变更文件生成测试引导 — 根据文件类型匹配测试策略，叠加知识驱动场景。
+ * @param changedFiles - 变更文件路径列表
+ * @param knowledgePatterns - 从知识库提取的关键词模式列表
+ * @param _config - 项目配置（预留，当前未使用）
+ * @returns 测试引导数组，每项包含测试类型、测试文件建议路径、场景列表和 Mock 要点
+ */
+export declare function generateTestGuide(changedFiles: string[], knowledgePatterns: string[], _config: ProjectConfig): TestGenGuide[];
+//# sourceMappingURL=test_generator.d.ts.map

package/dist/engine/audit/test_generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test_generator.d.ts","sourceRoot":"","sources":["../../../src/engine/audit/test_generator.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAgB,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAqMtF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EAAE,EACtB,iBAAiB,EAAE,MAAM,EAAE,EAC3B,OAAO,EAAE,aAAa,GACrB,YAAY,EAAE,CAqChB"}