soloforge 1.4.16 → 2.0.0

package/dist/engine/contracts/capability_registry.js

@@ -0,0 +1,778 @@
+/**
+ * 能力状态登记表 — 声明每个治理能力的当前等级，防止文档和实现过度承诺。
+ *
+ * P1-4 范围: 状态登记 + policy_id + 交叉引用 + 晋级/降级条件与证据要求（只读）。
+ * 不做自动晋级/降级，不接抽检池，不改状态。
+ *
+ * 状态等级:
+ * - enforced: 强制执行，违规即 hard fail，阻断流程
+ * - advisory: 建议执行，违规仅产生 advisory 警告，不阻断流程
+ * - experimental: 实验性，接口和行为可能变更，仅供内部评估
+ * - removed: 已移除，保留登记用于追溯
+ */
+const BUILTIN_CAPABILITIES = [
+    {
+        id: "task_context_lifecycle",
+        name: "任务上下文生命周期",
+        state: "enforced",
+        owner_module: "engine/task_context",
+        evidence: "VALID_TRANSITIONS 状态机 + updateStatus 校验",
+        policy_id: "CAP-001",
+        code_files: ["src/engine/pipeline/task_context.ts"],
+        test_files: ["tests/engine/task_context.test.ts"],
+        lifecycle_test_files: ["tests/engine/task_context.test.ts"],
+        knowledge_docs: ["templates/internal/patterns/任务上下文生命周期.md"],
+        prompt_files: ["src/server/tools/index.ts"],
+        promotion_conditions: [
+            "生命周期测试覆盖所有状态转移",
+            "并发场景下无竞态条件",
+        ],
+        demotion_conditions: [
+            "核心状态转移出现逃逸（任务绕过状态机）",
+            "状态机变更未同步测试",
+        ],
+        evidence_requirements: [
+            "全量状态转移测试通过",
+            "handler 生命周期测试通过",
+            "无已知逃逸缺陷",
+        ],
+        reason: "核心状态机，所有 handler 依赖此约束",
+    },
+    {
+        id: "verify_command_generation",
+        name: "验证命令生成",
+        state: "enforced",
+        owner_module: "engine/verifier",
+        evidence: "generateVerifyCommands 覆盖 config/doc-only/repo 匹配三个分支",
+        policy_id: "CAP-002",
+        code_files: ["src/engine/release/verifier.ts"],
+        test_files: ["tests/engine/verifier_phase25.test.ts"],
+        lifecycle_test_files: ["tests/engine/verifier_phase25.test.ts"],
+        knowledge_docs: ["templates/internal/patterns/验证命令生成.md"],
+        prompt_files: ["src/server/tools/index.ts"],
+        promotion_conditions: [
+            "覆盖所有项目类型（monorepo/polyrepo）",
+            "自定义命令模板验证通过",
+        ],
+        demotion_conditions: [
+            "生成的命令在标准项目上失败",
+            "新项目类型未覆盖且无 fallback",
+        ],
+        evidence_requirements: [
+            "config/doc-only/repo 三分支测试通过",
+            "边界项目（无 package.json）验证通过",
+        ],
+        reason: "编译和测试命令是质量门禁的基础",
+    },
+    {
+        id: "scope_hook",
+        name: "作用域与密钥拦截",
+        state: "enforced",
+        owner_module: "engine/scope_controller",
+        evidence: "checkScope() 路径校验 + detectSecrets() 密钥扫描 + gitleaks 集成",
+        policy_id: "CAP-003",
+        code_files: ["src/engine/pipeline/scope_controller.ts"],
+        test_files: ["tests/engine/scope_controller.test.ts"],
+        lifecycle_test_files: ["tests/engine/scope_controller.test.ts"],
+        knowledge_docs: ["templates/internal/patterns/作用域与密钥拦截.md"],
+        prompt_files: ["src/server/tools/index.ts"],
+        promotion_conditions: [
+            "symlink 解析覆盖所有 OS",
+            "密钥检测误报率 < 1%",
+        ],
+        demotion_conditions: [
+            "合法路径被误判为越权",
+            "密钥检测出现 3+ 次逃逸",
+        ],
+        evidence_requirements: [
+            "路径匹配 + symlink 测试通过",
+            "密钥扫描 golden set 通过",
+            "无已知越权逃逸",
+        ],
+        reason: "文件范围和安全是强制门禁",
+    },
+    {
+        id: "secret_scan",
+        name: "敏感信息扫描",
+        state: "enforced",
+        owner_module: "engine/scope_controller",
+        evidence: "detectSecrets() 正则 + gitleaks 回退链，severity=blocked 阻断写入",
+        policy_id: "CAP-004",
+        code_files: ["src/engine/pipeline/scope_controller.ts"],
+        test_files: ["tests/engine/scope_controller.test.ts"],
+        lifecycle_test_files: ["tests/engine/scope_controller.test.ts"],
+        knowledge_docs: ["templates/internal/patterns/敏感信息扫描.md"],
+        prompt_files: ["src/server/tools/index.ts"],
+        promotion_conditions: [
+            "误报率 < 0.5%",
+            "覆盖所有主流密钥格式（AWS/GCP/Azure/API key）",
+        ],
+        demotion_conditions: [
+            "密钥泄露逃逸（写入含密钥文件未被拦截）",
+            "误报率 > 5% 影响正常工作流",
+        ],
+        evidence_requirements: [
+            "golden set 密钥检测通过",
+            "误报率测试通过",
+            "无已知密钥泄露事件",
+        ],
+        reason: "密钥泄露是最高风险，必须 hard fail",
+    },
+    {
+        id: "resume_workspace",
+        name: "工作区状态唤醒",
+        state: "advisory",
+        owner_module: "engine/workspace_resumer",
+        evidence: "scanAndResume() 扫描 state 目录恢复中断任务，无 hard fail 逻辑",
+        policy_id: "CAP-005",
+        code_files: ["src/engine/pipeline/workspace_resumer.ts"],
+        test_files: ["tests/engine/workspace_resumer.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/工作区唤醒.md"],
+        prompt_files: ["src/server/tools/index.ts"],
+        promotion_conditions: [
+            "恢复后任务可无缝继续",
+            "corrupt state 文件降级处理（advisory 报告）",
+        ],
+        demotion_conditions: [
+            "恢复逻辑导致新任务状态异常",
+            "state 目录膨胀无清理机制",
+        ],
+        evidence_requirements: [
+            "中断恢复测试通过",
+            "corrupt state 处理测试通过",
+        ],
+        reason: "advisory: 恢复是最佳实践但非强制，新会话可忽略恢复直接新建任务",
+    },
+    {
+        id: "llm_gateway",
+        name: "LLM Token 预算网关",
+        state: "advisory",
+        owner_module: "engine/llm_gateway",
+        evidence: "H1 handler 返回 h1_advisory warning，任务仍继续进入 executing",
+        policy_id: "CAP-006",
+        code_files: ["src/engine/core/llm_gateway.ts"],
+        test_files: ["tests/engine/llm_gateway.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/LLM预算网关.md", "templates/internal/patterns/决策网关.md", "templates/internal/patterns/流式心跳.md"],
+        prompt_files: ["src/server/tools/index.ts"],
+        promotion_conditions: [
+            "预算耗尽时建议降级到更便宜的模型（advisory 报告）",
+            "预算使用率可观测",
+        ],
+        demotion_conditions: [
+            "gateway 误判导致正常任务被阻断",
+            "预算计算逻辑出现严重偏差",
+        ],
+        evidence_requirements: [
+            "H1/H4 handler 测试通过",
+            "heartbeat 测试通过",
+        ],
+        reason: "advisory: 预算耗尽是 warning 不是 hard fail，不应阻断任务",
+    },
+    {
+        id: "io_lock",
+        name: "工作区互斥锁",
+        state: "advisory",
+        owner_module: "engine/io_controller",
+        evidence: "P0 已移除持久锁 acquire/release，仅保留 isLocked() 查询",
+        policy_id: "CAP-007",
+        code_files: ["src/engine/core/io_controller.ts"],
+        test_files: ["tests/engine/io_controller.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/工作区互斥锁.md"],
+        prompt_files: ["src/server/tools/index.ts"],
+        promotion_conditions: [
+            "跨进程互斥锁实现并通过并发测试",
+            "deadlock 检测与人工确认恢复",
+        ],
+        demotion_conditions: [
+            "互斥检查导致正常操作频繁失败",
+            "锁状态与实际不一致",
+        ],
+        evidence_requirements: [
+            "isLocked() 查询测试通过",
+            "写入前冲突检测测试通过",
+        ],
+        reason: "advisory: 锁机制为 advisory check，不强制阻断",
+    },
+    {
+        id: "mutation_audit",
+        name: "变异审计",
+        state: "advisory",
+        owner_module: "engine/mutation_audit",
+        evidence: "extractMutationPoints + computeMutationAudit + 评分中变异覆盖率是建议维度，不阻断",
+        policy_id: "CAP-008",
+        code_files: ["src/engine/audit/mutation_audit.ts"],
+        test_files: ["tests/engine/mutation_audit.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/变异审计.md"],
+        prompt_files: [],
+        promotion_conditions: [
+            "变异覆盖率 > 80%",
+            "变异算子覆盖所有主流模式",
+        ],
+        demotion_conditions: [
+            "变异评分算法出现严重偏差",
+            "变异测试执行时间导致开发者跳过",
+        ],
+        evidence_requirements: [
+            "变异算子测试通过",
+            "评分一致性测试通过",
+        ],
+        reason: "advisory: 变异测试是质量建议，非强制要求",
+    },
+    {
+        id: "knowledge_sovereignty",
+        name: "知识主权",
+        state: "advisory",
+        owner_module: "engine/knowledge_sovereignty",
+        evidence: "quarantineGate + promoteToQuarantine + promoteToCore + 三级生命周期，severity=critical 但不 hard fail",
+        policy_id: "CAP-009",
+        code_files: ["src/engine/knowledge/knowledge_sovereignty.ts"],
+        test_files: ["tests/engine/knowledge_sovereignty.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/知识主权.md"],
+        prompt_files: [],
+        promotion_conditions: [
+            "知识模板覆盖所有审查规则",
+            "知识-代码漂移检测接入",
+        ],
+        demotion_conditions: [
+            "知识规则与代码实现严重不一致",
+            "知识模板格式频繁变更无兼容",
+        ],
+        evidence_requirements: [
+            "知识模板格式验证测试通过",
+            "中文语义化路径测试通过",
+        ],
+        reason: "advisory: 知识治理是建议性的，尚未接入强制门禁",
+    },
+    {
+        id: "governance_runtime_loop",
+        name: "治理运行时循环",
+        state: "advisory",
+        owner_module: "engine/audit_sampler+escape_report+governance_report+capability_action_advisor",
+        evidence: "抽检(18)+逃逸报告(23)+治理报告(37)+能力状态(37)+集成(6)+handler(28)=149 cases, 只读不改状态",
+        policy_id: "CAP-010",
+        code_files: [
+            "src/engine/audit/audit_sampler.ts",
+            "src/engine/contracts/escape_report.ts",
+            "src/engine/audit/governance_report.ts",
+            "src/engine/contracts/capability_state_store.ts",
+            "src/engine/contracts/capability_action_advisor.ts",
+        ],
+        test_files: [
+            "tests/engine/audit_sampler.test.ts",
+            "tests/engine/escape_report.test.ts",
+            "tests/engine/governance_report.test.ts",
+            "tests/engine/capability_state_store.test.ts",
+        ],
+        lifecycle_test_files: ["tests/engine/governance_report.test.ts"],
+        knowledge_docs: ["templates/internal/patterns/治理运行时循环.md"],
+        prompt_files: ["src/server/tools/index.ts"],
+        promotion_conditions: [
+            "所有治理闭环 handler 生命周期测试通过",
+            "跨工具闭环（sample→escape→report→update）无逃逸",
+        ],
+        demotion_conditions: [
+            "治理闭环工具产生误判导致正常能力被降级",
+            "report 数据与实际 escape 不一致",
+        ],
+        evidence_requirements: [
+            "抽检→逃逸→报告→显式更新闭环测试通过",
+            "MCP handler 闭环测试通过",
+            "无自动降级行为",
+        ],
+        reason: "advisory: 治理闭环只读不改，状态更新必须经人工确认",
+    },
+    {
+        id: "diff_ownership",
+        name: "Diff 归属追踪",
+        state: "experimental",
+        owner_module: "engine/diff_ownership",
+        evidence: "diff_ownership 状态模型 + DiffOwnershipStore 持久化 + CAS 校验 + scope 目录展开排除 + 84 cases",
+        policy_id: "CAP-011",
+        code_files: ["src/engine/pipeline/diff_ownership.ts", "src/engine/pipeline/diff_ownership_store.ts"],
+        test_files: ["tests/engine/diff_ownership.test.ts", "tests/engine/diff_ownership_store.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/Diff归属追踪.md"],
+        prompt_files: [],
+        promotion_conditions: [
+            "归属追踪实现并通过集成测试",
+            "跨任务 diff 关联正确",
+        ],
+        demotion_conditions: [
+            "30 天内无进一步实现",
+        ],
+        evidence_requirements: [
+            "Diff 归属分类测试通过",
+            "CAS 校验生命周期测试通过",
+            "冲突检测测试通过",
+        ],
+        reason: "experimental: 只做状态模型和 CAS 校验，不替换现有写入流程，不新增 hard block",
+    },
+    {
+        id: "scope_lease",
+        name: "作用域租约",
+        state: "advisory",
+        owner_module: "engine/scope_lease",
+        evidence: "ScopeLeaseStore acquire/release/queryLease/getActiveLeases + 过期自动清理",
+        policy_id: "CAP-012",
+        code_files: ["src/engine/pipeline/scope_lease.ts"],
+        test_files: ["tests/engine/scope_lease.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/作用域租约.md", "templates/internal/patterns/并发锁.md"],
+        prompt_files: [],
+        promotion_conditions: [
+            "跨进程租约测试通过",
+            "高并发 acquire 无竞态",
+        ],
+        demotion_conditions: [
+            "租约泄漏导致文件永久锁定",
+            "过期清理失效",
+        ],
+        evidence_requirements: [
+            "acquire/release 测试通过",
+            "过期清理测试通过",
+        ],
+        reason: "advisory: 租约是写入前建议检查，不强制阻断",
+    },
+    {
+        id: "conflict_gate",
+        name: "冲突门禁",
+        state: "advisory",
+        owner_module: "engine/conflict_gate",
+        evidence: "ConflictGate preWriteGate CAS 校验 + markConfirmed + 统一冲突报告",
+        policy_id: "CAP-013",
+        code_files: ["src/engine/pipeline/conflict_gate.ts"],
+        test_files: ["tests/engine/conflict_gate.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/冲突门禁.md"],
+        prompt_files: [],
+        promotion_conditions: [
+            "CAS 校验覆盖所有文件类型",
+            "冲突报告自动合并",
+        ],
+        demotion_conditions: [
+            "CAS 误判率高导致频繁冲突",
+            "markConfirmed 后仍阻断",
+        ],
+        evidence_requirements: [
+            "CAS 校验测试通过",
+            "冲突报告测试通过",
+        ],
+        reason: "advisory: 冲突检测是建议性的，开发者可选择覆盖",
+    },
+    {
+        id: "semantic_evidence",
+        name: "语义证据",
+        state: "advisory",
+        owner_module: "engine/semantic_evidence",
+        evidence: "computeSemanticEvidence + buildDeliveryEvidenceChain + SHA256 hash chain",
+        policy_id: "CAP-014",
+        code_files: ["src/engine/audit/semantic_evidence.ts"],
+        test_files: ["tests/engine/semantic_evidence.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/语义证据.md"],
+        prompt_files: [],
+        promotion_conditions: [
+            "所有需求点自动关联代码变更",
+            "证据链接入交付流程",
+        ],
+        demotion_conditions: [
+            "需求覆盖计算严重不准确",
+            "hash chain 校验失败",
+        ],
+        evidence_requirements: [
+            "语义证据计算测试通过",
+            "证据链完整性测试通过",
+        ],
+        reason: "advisory: 需求覆盖是质量建议，uncovered 不阻断交付",
+    },
+    {
+        id: "developer_sovereignty",
+        name: "开发者主权",
+        state: "advisory",
+        owner_module: "engine/developer_sovereignty",
+        evidence: "preDeliveryReview + delivery veto + rollback 绑定 commit_hash",
+        policy_id: "CAP-015",
+        code_files: ["src/engine/audit/developer_sovereignty.ts"],
+        test_files: ["tests/engine/developer_sovereignty.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/开发者宪法.md"],
+        prompt_files: [],
+        promotion_conditions: [
+            "preDeliveryReview 接入真实 git diff",
+            "delivery veto 结果传递到 sf_stage_advance",
+        ],
+        demotion_conditions: [
+            "veto 误判阻断正常交付",
+            "rollback 命令不可执行",
+        ],
+        evidence_requirements: [
+            "preDeliveryReview 测试通过",
+            "veto 逻辑测试通过",
+        ],
+        reason: "advisory: 开发者主权的审查建议不 hard block 交付",
+    },
+    {
+        id: "job_manager",
+        name: "任务管理器",
+        state: "advisory",
+        owner_module: "engine/job_manager",
+        evidence: "JobManager createJob/updateCheckpoint/heartbeat/resumeFromCheckpoint + CognitiveAnchor",
+        policy_id: "CAP-016",
+        code_files: ["src/engine/pipeline/job_manager.ts"],
+        test_files: ["tests/engine/job_manager.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/任务管理器.md"],
+        prompt_files: [],
+        promotion_conditions: [
+            "checkpoint 持久化并支持跨进程恢复",
+            "CognitiveAnchor 自动提取关键决策",
+        ],
+        demotion_conditions: [
+            "checkpoint 数据丢失",
+            "listActiveJobs 包含大量过期任务",
+        ],
+        evidence_requirements: [
+            "checkpoint 更新测试通过",
+            "恢复测试通过",
+        ],
+        reason: "advisory: 任务管理是辅助工具，不强制要求使用",
+    },
+    // ── zero_config_init（已移除：detector/fingerprint + resolver 替代）──
+    {
+        id: "java_quality_guard",
+        name: "Java 质量门禁",
+        state: "advisory",
+        owner_module: "engine/java_quality_guard",
+        evidence: "checkJavaQuality hard gate（空catch/raw type/System.out/Thread.sleep）+ advisory + 项目规则覆盖",
+        policy_id: "CAP-018",
+        code_files: ["src/engine/audit/java_quality_guard.ts"],
+        test_files: ["tests/engine/java_quality_guard.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/Java质量门禁.md"],
+        prompt_files: [],
+        promotion_conditions: [
+            "覆盖所有 Java 代码异味",
+            "IDE 插件集成",
+        ],
+        demotion_conditions: [
+            "hard gate 误报率高",
+            "项目规则覆盖失效",
+        ],
+        evidence_requirements: [
+            "hard gate 测试通过",
+            "项目规则覆盖测试通过",
+        ],
+        reason: "advisory: Java 质量门禁中只有 hard gate 阻断，其余为建议",
+    },
+    {
+        id: "runtime_safety",
+        name: "运行安全包",
+        state: "advisory",
+        owner_module: "engine/runtime_safety",
+        evidence: "证据 hash chain + 命令副作用分级 + 供应链治理 + 迁移回滚契约",
+        policy_id: "CAP-019",
+        code_files: ["src/engine/audit/runtime_safety.ts"],
+        test_files: ["tests/engine/runtime_safety.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/运行安全包.md"],
+        prompt_files: [],
+        promotion_conditions: [
+            "证据链接入所有交付流程",
+            "命令分级接入 verifier/deliver",
+        ],
+        demotion_conditions: [
+            "证据链 hash 校验失败",
+            "destructive 命令漏检",
+        ],
+        evidence_requirements: [
+            "证据链构建/验证测试通过",
+            "命令分级测试通过",
+            "供应链检查测试通过",
+        ],
+        reason: "advisory: 只有 destructive 命令需人工确认，其余为 advisory 警告",
+    },
+    {
+        id: "regression_matrix",
+        name: "回归矩阵",
+        state: "advisory",
+        owner_module: "engine/regression_matrix",
+        evidence: "6 fixtures（Spring Boot/React/Go/Node-TS/monorepo/docs-only）+ E2E pipeline（fingerprint→classify→expand→verify→learn→governance report）+ 复杂度预算",
+        policy_id: "CAP-020",
+        code_files: ["src/engine/config/regression_matrix.ts"],
+        test_files: ["tests/engine/regression_matrix.test.ts"],
+        lifecycle_test_files: [],
+        knowledge_docs: ["templates/internal/patterns/回归矩阵.md"],
+        prompt_files: [],
+        promotion_conditions: [
+            "fixture 落盘成临时 repo + 真实 detectFingerprint",
+            "覆盖所有项目类型兼容性",
+        ],
+        demotion_conditions: [
+            "fixture 模板过时",
+            "复杂度预算严重低估",
+        ],
+        evidence_requirements: [
+            "回归矩阵测试通过",
+            "复杂度预算报告正确",
+        ],
+        reason: "advisory: 回归矩阵是质量保证工具，复杂度超预算不阻断",
+    },
+    {
+        id: "workflow_contract",
+        name: "工作流契约",
+        state: "enforced",
+        owner_module: "engine/workflow_contract",
+        evidence: "10 stage contracts + getAllWorkflowMechanismIds mechanism coverage",
+        policy_id: "CAP-021",
+        code_files: ["src/engine/workflow/workflow_contract_registry.ts"],
+        test_files: ["tests/engine/workflow_contract_registry.test.ts"],
+        lifecycle_test_files: ["tests/engine/workflow_contract_registry.test.ts"],
+        knowledge_docs: ["templates/internal/rules/工作流契约规则.md"],
+        prompt_files: [],
+        promotion_conditions: ["所有 workflow 有集成测试"],
+        demotion_conditions: ["workflow regression check 漏检"],
+        evidence_requirements: ["getAllWorkflowMechanismIds mechanism coverage valid"],
+        reason: "enforced: workflow contract 是主链路核心机制",
+    },
+    {
+        id: "tool_invocation_contract",
+        name: "工具调用契约",
+        state: "enforced",
+        owner_module: "engine/tool_invocation_contract",
+        evidence: "32 tool contracts + validateToolInvocation runtime checks",
+        policy_id: "CAP-022",
+        code_files: ["src/engine/contracts/tool_invocation_contract_registry.ts"],
+        test_files: ["tests/engine/tool_invocation_contract_registry.test.ts"],
+        lifecycle_test_files: ["tests/engine/tool_invocation_contract_registry.test.ts"],
+        knowledge_docs: ["templates/internal/rules/工具调用规则.md"],
+        prompt_files: [],
+        promotion_conditions: ["所有 MCP tool 有 invocation test"],
+        demotion_conditions: ["tool invocation regression 漏检"],
+        evidence_requirements: ["validateToolInvocation 无 hard_fail"],
+        reason: "enforced: tool invocation contract 是工具链安全核心",
+    },
+    {
+        id: "main_path_integration",
+        name: "主链路接入防孤岛",
+        state: "enforced",
+        owner_module: "engine/main_path_integration",
+        evidence: "orphanGate + auditIntegration + reachability scan + delivery template",
+        policy_id: "CAP-023",
+        code_files: ["src/engine/audit/main_path_integration_contract.ts"],
+        test_files: ["tests/adapters/main_path_integration_gate.test.ts"],
+        lifecycle_test_files: ["tests/adapters/main_path_integration_gate.test.ts"],
+        knowledge_docs: ["templates/internal/rules/防孤岛实现规则.md"],
+        prompt_files: [],
+        promotion_conditions: ["所有 enforced 模块有 entry trace"],
+        demotion_conditions: ["orphan scan 产生大量误报"],
+        evidence_requirements: ["validateMainPathIntegration 无 hard_fail"],
+        reason: "enforced: 主链路接入是防孤岛核心机制",
+    },
+    {
+        id: "privacy_secret",
+        name: "隐私/敏感信息",
+        state: "enforced",
+        owner_module: "engine/privacy_secret",
+        evidence: "secret scanner + redaction policy + DataAccessGrant",
+        policy_id: "CAP-024",
+        code_files: ["src/engine/audit/privacy_secret_contract.ts"],
+        test_files: ["tests/engine/privacy_secret_contract.test.ts"],
+        lifecycle_test_files: ["tests/engine/privacy_secret_contract.test.ts"],
+        knowledge_docs: ["templates/internal/rules/敏感信息处理规则.md"],
+        prompt_files: [],
+        promotion_conditions: ["覆盖所有 PII 类型"],
+        demotion_conditions: ["secret scanner 产生大量误报"],
+        evidence_requirements: ["RedactionRecord 测试通过"],
+        reason: "enforced: 隐私/敏感信息是安全核心机制",
+    },
+    {
+        id: "command_execution",
+        name: "命令执行契约",
+        state: "enforced",
+        owner_module: "engine/command_execution",
+        evidence: "classifyCommand + validateCommandExecution + command lifecycle",
+        policy_id: "CAP-025",
+        code_files: ["src/engine/contracts/command_execution_contract.ts"],
+        test_files: ["tests/engine/command_execution_contract.test.ts"],
+        lifecycle_test_files: ["tests/engine/command_execution_contract.test.ts"],
+        knowledge_docs: ["templates/internal/rules/命令执行规则.md"],
+        prompt_files: [],
+        promotion_conditions: ["覆盖所有 destructive 命令模式"],
+        demotion_conditions: ["destructive 命令漏检"],
+        evidence_requirements: ["命令分级测试通过"],
+        reason: "enforced: 命令执行是安全核心机制",
+    },
+    {
+        id: "artifact_schema_registry",
+        name: "产物 Schema 注册中心",
+        state: "enforced",
+        owner_module: "engine/contracts",
+        evidence: "19 ArtifactKind 的完整 Schema 注册 + 查询 + prompt 格式化",
+        policy_id: "CAP-026",
+        code_files: [
+            "src/engine/contracts/artifact_schema_registry.ts",
+            "src/engine/templates/standard_asset_contract.ts",
+        ],
+        test_files: ["tests/engine/artifact_schema_registry.test.ts"],
+        lifecycle_test_files: ["tests/engine/artifact_schema_registry.test.ts"],
+        knowledge_docs: ["templates/internal/patterns/产物Schema注册中心.md"],
+        prompt_files: [],
+        promotion_conditions: ["所有 19 种产物类型的 Schema 与模板 frontmatter 双向同步"],
+        demotion_conditions: ["Schema 注册中心导致编译性能退化"],
+        evidence_requirements: ["19 种 ArtifactKind 全量注册测试通过"],
+        reason: "enforced: 产物结构契约是三分离架构的核心，缺少则 AI 输出无结构约束",
+    },
+    {
+        id: "artifact_process_rules",
+        name: "分场景过程规则",
+        state: "enforced",
+        owner_module: "engine/contracts",
+        evidence: "18 种结构产物类型的 extract/review/fix/iterate 四操作规则",
+        policy_id: "CAP-027",
+        code_files: ["src/engine/contracts/artifact_process_rules.ts"],
+        test_files: ["tests/engine/artifact_process_rules.test.ts"],
+        lifecycle_test_files: ["tests/engine/artifact_process_rules.test.ts"],
+        knowledge_docs: ["templates/internal/patterns/分场景过程规则.md"],
+        prompt_files: [],
+        promotion_conditions: ["所有 18 种产物类型的自定义规则覆盖率达 100%"],
+        demotion_conditions: ["过程规则导致 AI 输出僵化无法灵活调整"],
+        evidence_requirements: ["P0 类型自定义规则 + 通用规则 fallback 测试通过"],
+        reason: "enforced: 过程规则按操作类型选择注入内容，是 Schema 独立注入通道的必要组件",
+    },
+    {
+        id: "template_schema_loader",
+        name: "模板 frontmatter 解析加载器",
+        state: "advisory",
+        owner_module: "engine/contracts",
+        evidence: "YAML frontmatter 解析 + artifact_schema/process_rules 提取 + registry 注册",
+        policy_id: "CAP-028",
+        code_files: ["src/engine/contracts/template_schema_loader.ts"],
+        test_files: ["tests/engine/template_schema_loader.test.ts"],
+        lifecycle_test_files: ["tests/engine/template_schema_loader.test.ts"],
+        knowledge_docs: ["templates/internal/patterns/模版Frontmatter解析.md"],
+        prompt_files: [],
+        promotion_conditions: ["所有模板文件包含完整的 frontmatter schema 定义"],
+        demotion_conditions: ["frontmatter 解析器产生大量误报或漏报"],
+        evidence_requirements: ["4 个 P0 模板 frontmatter 解析测试通过"],
+        reason: "advisory: 模板 frontmatter 提供运行时可覆盖的 Schema 定义，是开发态便利功能",
+    },
+    {
+        id: "write_artifact_validator",
+        name: "Hook 层产物结构校验",
+        state: "advisory",
+        owner_module: "bin/commands",
+        evidence: "check_write/check_bash L4 校验 — 缺失章节/表格检测 + warning/blocked 分级",
+        policy_id: "CAP-029",
+        code_files: [
+            "src/bin/commands/check_write.ts",
+            "src/bin/commands/check_bash.ts",
+        ],
+        test_files: ["tests/bin/check_write_artifact_l4.test.ts"],
+        lifecycle_test_files: ["tests/bin/check_write_artifact_l4.test.ts"],
+        knowledge_docs: ["templates/internal/patterns/Hook层产物结构校验.md"],
+        prompt_files: [],
+        promotion_conditions: ["L4 校验误报率 < 5% 且阻断准确率 > 95%"],
+        demotion_conditions: ["L4 校验频繁误阻断正常流程"],
+        evidence_requirements: ["路径推断 + 内容校验 + severity 分级测试通过"],
+        reason: "advisory: Hook 层 L4 校验为产物质量提供写入时保障，初始为 advisory 避免干扰正常流程",
+    },
+];
+function cloneEntry(e) {
+    return {
+        ...e,
+        code_files: [...e.code_files],
+        test_files: [...e.test_files],
+        lifecycle_test_files: [...e.lifecycle_test_files],
+        knowledge_docs: [...e.knowledge_docs],
+        prompt_files: [...e.prompt_files],
+        promotion_conditions: [...e.promotion_conditions],
+        demotion_conditions: [...e.demotion_conditions],
+        evidence_requirements: [...e.evidence_requirements],
+    };
+}
+/**
+ * 执行 getAllCapabilities 操作
+ */
+export function getAllCapabilities() {
+    return BUILTIN_CAPABILITIES.map(cloneEntry);
+}
+/**
+ * 执行 getCapability 操作
+ */
+export function getCapability(id) {
+    const found = BUILTIN_CAPABILITIES.find((c) => c.id === id);
+    return found ? cloneEntry(found) : undefined;
+}
+/**
+ * 执行 getCapsByState 操作
+ */
+export function getCapsByState(state) {
+    return BUILTIN_CAPABILITIES.filter((c) => c.state === state).map(cloneEntry);
+}
+/**
+ * 执行 canHardFail 操作
+ */
+export function canHardFail(id) {
+    const cap = BUILTIN_CAPABILITIES.find((c) => c.id === id);
+    return cap?.state === "enforced";
+}
+/**
+ * 执行 getSummary 操作
+ */
+export function getSummary() {
+    const enforced = BUILTIN_CAPABILITIES.filter((c) => c.state === "enforced");
+    const advisory = BUILTIN_CAPABILITIES.filter((c) => c.state === "advisory");
+    const experimental = BUILTIN_CAPABILITIES.filter((c) => c.state === "experimental");
+    const removed = BUILTIN_CAPABILITIES.filter((c) => c.state === "removed");
+    return {
+        enforced: enforced.map((c) => c.id),
+        advisory: advisory.map((c) => c.id),
+        experimental: experimental.map((c) => c.id),
+        removed: removed.map((c) => c.id),
+        can_hard_fail: enforced.map((c) => c.id),
+        cannot_hard_fail: [...advisory, ...experimental, ...removed].map((c) => c.id),
+    };
+}
+/**
+ * 执行 getAllPolicyRefs 操作
+ */
+export function getAllPolicyRefs() {
+    return BUILTIN_CAPABILITIES.map((c) => ({
+        policy_id: c.policy_id,
+        capability_id: c.id,
+        state: c.state,
+        code_files: [...c.code_files],
+        test_files: [...c.test_files],
+        lifecycle_test_files: [...c.lifecycle_test_files],
+        knowledge_docs: [...c.knowledge_docs],
+        prompt_files: [...c.prompt_files],
+    }));
+}
+function isPlannedOnly(c) {
+    return (c.code_files.length === 0 &&
+        c.test_files.length === 0 &&
+        c.knowledge_docs.length === 0);
+}
+/**
+ * 执行 getDriftPolicyRefs 操作
+ */
+export function getDriftPolicyRefs() {
+    return BUILTIN_CAPABILITIES
+        .filter((c) => !isPlannedOnly(c))
+        .map((c) => ({
+        policy_id: c.policy_id,
+        capability_id: c.id,
+        state: c.state,
+        code_files: [...c.code_files],
+        test_files: [...c.test_files],
+        lifecycle_test_files: [...c.lifecycle_test_files],
+        knowledge_docs: [...c.knowledge_docs],
+        prompt_files: [...c.prompt_files],
+    }));
+}
+//# sourceMappingURL=capability_registry.js.map