pactkit 4.2.0__tar.gz → 4.3.0__tar.gz

{pactkit-4.2.0 → pactkit-4.3.0}/.secrets.baseline

@@ -220,14 +220,14 @@
       {
         "type": "Hex High Entropy String",
         "filename": "tests/fixtures/host_artifact_paths.json",
-        "hashed_secret": "4d7d94709716393400baa77bc1bcd8dca88649d5",
+        "hashed_secret": "1d057df610548efdc86435e853428d8d8d67d037",
         "is_verified": false,
         "line_number": 8
       },
       {
         "type": "Hex High Entropy String",
         "filename": "tests/fixtures/host_artifact_paths.json",
-        "hashed_secret": "f154d0d8ddca34c13651cb7ef38eaa7c331b2935",
+        "hashed_secret": "05d1af7eac44c97f45df925c6e0a6fe91a79b319",
         "is_verified": false,
         "line_number": 9
       },
@@ -780,7 +780,7 @@
       {
         "type": "Hex High Entropy String",
         "filename": "tests/fixtures/host_artifact_paths.json",
-        "hashed_secret": "061e6f0285ea7cf9bc211b3d9b953f1e5bf06205",
+        "hashed_secret": "659bb215e545aaffe599e96c663d6d4fb1d4369b",
         "is_verified": false,
         "line_number": 386
       },
@@ -990,7 +990,7 @@
       {
         "type": "Hex High Entropy String",
         "filename": "tests/fixtures/host_artifact_paths.json",
-        "hashed_secret": "93b3dae06f1151ef67a92ac4c552a236e0ee4651",
+        "hashed_secret": "8b36b7e0ee4fe4ef4898919103b9679176b2ea09",
         "is_verified": false,
         "line_number": 562
       },
@@ -1106,13 +1106,6 @@
         "is_verified": false,
         "line_number": 593
       },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "tests/fixtures/host_artifact_paths.json",
-        "hashed_secret": "6c0ea915720c7e8da48feaa241db468fd003d8b0",
-        "is_verified": false,
-        "line_number": 649
-      },
       {
         "type": "Hex High Entropy String",
         "filename": "tests/fixtures/host_artifact_paths.json",
@@ -1279,14 +1272,14 @@
       {
         "type": "Hex High Entropy String",
         "filename": "tests/fixtures/host_prompt_snapshots/classic.json",
-        "hashed_secret": "c60d7b73372ffc82dc1a12184538c0fc81d8a654",
+        "hashed_secret": "1e110044da44017fd5ff5540e99c91dc998c89aa",
         "is_verified": false,
         "line_number": 92
       },
       {
         "type": "Hex High Entropy String",
         "filename": "tests/fixtures/host_prompt_snapshots/classic.json",
-        "hashed_secret": "9394795f8172be8e163e8dd33026f11ebc366e3c",
+        "hashed_secret": "e1c31ced51e6bbf388989f1735fc57bb346c6874",
         "is_verified": false,
         "line_number": 93
       },
@@ -1883,14 +1876,14 @@
       {
         "type": "Hex High Entropy String",
         "filename": "tests/fixtures/host_prompt_snapshots/codex.json",
-        "hashed_secret": "b182ec01f213cba2365b1ef2f78309f14dfe76e1",
+        "hashed_secret": "b2ce8c4c571997bb6b6f07ec5b71b615c74aa680",
         "is_verified": false,
         "line_number": 78
       },
       {
         "type": "Hex High Entropy String",
         "filename": "tests/fixtures/host_prompt_snapshots/codex.json",
-        "hashed_secret": "2b6104ba4d45f9448e81ef589b0d8ca3f4bbb71b",
+        "hashed_secret": "089410872852a14d5f9360fe25ff69c16c7b0de1",
         "is_verified": false,
         "line_number": 79
       },
@@ -2333,14 +2326,14 @@
       {
         "type": "Hex High Entropy String",
         "filename": "tests/fixtures/host_prompt_snapshots/opencode.json",
-        "hashed_secret": "c2dc0837a063d5333c519e012cd58b3fc2017c1a",
+        "hashed_secret": "c4e130441773b95601d3b006b234cbb43ba0d8b8",
         "is_verified": false,
         "line_number": 90
       },
       {
         "type": "Hex High Entropy String",
         "filename": "tests/fixtures/host_prompt_snapshots/opencode.json",
-        "hashed_secret": "6b45cc1fa5c583e5a284b72cbbc4f1061a7a54ae",
+        "hashed_secret": "3a28cb8275448b427c83e9990c82c74645b07d38",
         "is_verified": false,
         "line_number": 91
       },
@@ -3046,5 +3039,5 @@
       }
     ]
   },
-  "generated_at": "2026-10-10T07:27:53Z"
+  "generated_at": "2026-10-20T10:42:27Z"
 }

{pactkit-4.2.0 → pactkit-4.3.0}/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## [4.3.0] - 2026-10-20
+
+**漂移 run 的审计终态；义务判定与门禁降级修复；CI cwd 引用安全。**
+
+### Added
+
+- **`pactkit workflow supersede <run-id>`（ADR-0013）**：在审计、权限与证据约束下，
+  把发生 `artifact_drift` 的非健康 run 标记为 `superseded` 终态并释放 Story 绑定，
+  使新的完整验证可以启动。新旧两个 run store（`.pactkit/workflow-runs/` 与
+  `.pactkit/continuations/runs/`）共用一个终态写入器 + 两个 schema 适配器。
+  - 新增最小权限授权 scope `work-unit`；无有效窗口拒绝且零写入。
+  - 执行前重算 drift 与证据覆盖率；不完整覆盖需显式 `--accept-incomplete`，
+    空指纹清单 fail closed；generic 可 revalidate 的漂移会被拒绝并指回
+    `revalidate-artifacts`。
+  - append-only：保留 run 文件与历史，写入 `status=superseded`、`superseded_by`、
+    原因、前后指纹、覆盖率、actor 与 authorization，并追加 `run_superseded` 事件。
+  - 可选 `--successor` 建立双向链接；幂等，不同 payload 冲突失败。
+  - 消费方把 `superseded` 当作终态：`finish_guard` 返回 `superseded`（exit 2），
+    `bind_story` / `_find` / `_generic_act_resolution` 不再视为活跃或 ambiguous；
+    两个引擎都拒绝再次修改已 superseded 的 run。
+
+### Fixed
+
+- **done-verify 义务判定**：表格行不再把 Action 列的动词绑到 File 列路径；示例语境
+  优先于整行回退；否定式删除映射为 `keep` 而非 `delete`；路径 token 不再自供动词；
+  `Batch` 只匹配延后形态；`『』` 与多引号按外层片段逐个绑定；无 heading-MUST 时
+  仍执行义务检查；git 不可观测与空基线改为披露而非 PASS。
+- **commit gate**：无 plan 时先读声明问题（`ci.test_cmd` 空值不再被泛化消息掩盖）；
+  resolved cwd 与未 resolve root 不再因 `relative_to` 抛错而静默放行。
+- **deployer**：GitLab test job 遵守 `ci.cwd`；部分 `custom` 声明不再以 traceback
+  逃出部署。
+- **coverage gate**：pytest stderr 末行在持久化前经 `secrets_gate.redact_command`
+  脱敏。
+- **CI 渲染器**：`ci.cwd` 在 GitLab 中以 shell 参数引用、在 GitHub 中以 YAML 安全
+  标量输出；简单值保持原有渲染。
+
 ## [4.2.0] - 2026-10-19
 
 **判定与交付解耦；任务定义单一源；Done 的证据跨语言且说得出自己的边界；测试套件本地 −121s。**

{pactkit-4.2.0 → pactkit-4.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pactkit
-Version: 4.2.0
+Version: 4.3.0
 Summary: Spec-driven agentic DevOps toolkit for AI coding assistants
 Project-URL: Homepage, https://pactkit.dev
 Project-URL: Repository, https://github.com/pactkit/pactkit-public
@@ -25,19 +25,19 @@ Requires-Dist: detect-secrets>=1.5.0
 Requires-Dist: pre-commit>=4.6.1
 Requires-Dist: pyyaml>=6.0
 Provides-Extra: all
-Requires-Dist: pactkit-codex<4.3.0,>=4.2.0; extra == 'all'
-Requires-Dist: pactkit-opencode<4.3.0,>=4.2.0; extra == 'all'
+Requires-Dist: pactkit-codex<4.4.0,>=4.3.0; extra == 'all'
+Requires-Dist: pactkit-opencode<4.4.0,>=4.3.0; extra == 'all'
 Requires-Dist: ruff>=0.4; extra == 'all'
 Requires-Dist: tree-sitter-go>=0.25; extra == 'all'
 Requires-Dist: tree-sitter-java>=0.23; extra == 'all'
 Requires-Dist: tree-sitter-typescript>=0.23; extra == 'all'
 Requires-Dist: tree-sitter>=0.25; extra == 'all'
 Provides-Extra: codex
-Requires-Dist: pactkit-codex<4.3.0,>=4.2.0; extra == 'codex'
+Requires-Dist: pactkit-codex<4.4.0,>=4.3.0; extra == 'codex'
 Provides-Extra: lint
 Requires-Dist: ruff>=0.4; extra == 'lint'
 Provides-Extra: opencode
-Requires-Dist: pactkit-opencode<4.3.0,>=4.2.0; extra == 'opencode'
+Requires-Dist: pactkit-opencode<4.4.0,>=4.3.0; extra == 'opencode'
 Provides-Extra: test
 Requires-Dist: pytest>=7; extra == 'test'
 Requires-Dist: tomli>=1.1.0; (python_version < '3.11') and extra == 'test'

{pactkit-4.2.0 → pactkit-4.3.0}/SECURITY.md

@@ -4,10 +4,10 @@
 
 | Version | Supported          |
 |---------|--------------------|
+| 4.3.x   | :white_check_mark: |
 | 4.2.x   | :white_check_mark: |
 | 4.1.x   | :white_check_mark: |
-| 4.0.x   | :white_check_mark: |
-| < 4.0   | :x:                |
+| < 4.1   | :x:                |
 
 We provide security fixes for the current and previous minor release. Users on
 older versions should upgrade — the version is reported by `pactkit version`,

pactkit-4.3.0/docs/architecture/governance/adr/ADR-0013-drifted-workflow-runs-are-superseded-never-delet.md

@@ -0,0 +1,31 @@
+# ADR-0013-drifted-workflow-runs-are-superseded-never-delet: Drifted workflow runs are superseded, never deleted
+
+| Field | Value |
+|-------|-------|
+| ID | ADR-0013-drifted-workflow-runs-are-superseded-never-delet |
+| Status | accepted |
+| Date | 2026-10-20 |
+| Supersedes | None |
+| Superseded-by | None |
+
+## Context
+
+A completed WorkUnit execution can become non-completable when a later delivery-scope change invalidates its artifact fingerprints. The legacy engine keeps such a run at `status=running` (`legacy/workflow_engine.py:_active_runs_for_story` treats only `running` as active), so `start()` refuses a new run for the same Story with `story_already_has_active_workflow_run`. The generic engine's `revalidate_artifacts` requires `in_progress` and a validator that accepts the drift. Neither engine has a terminal transition for an unrecoverable run. The run file is audit evidence — deleting or overwriting it would erase the reason the Story cannot complete. The repository already treats supersession as append-only for ADRs (`Status: superseded` + `Superseded-by`) and run events.
+
+## Options Considered
+
+- **Option A — delete or rewrite the run file.** Unblocks the Story immediately, but destroys the audit trail and the drift evidence; rejected.
+- **Option B — force the run to `completed`.** Unblocks the Story but records a verification that never happened; rejected.
+- **Option C — append-only `superseded` terminal state.** Keep the run and its events; add `status=superseded`, `superseded_at`, `superseded_by`, reason, and evidence (drift keys, fingerprints, coverage, actor, authorization); release the Story binding; require an authorization window and explicit disclosure of incomplete evidence. Accepted.
+
+## Decision
+
+Adopt Option C. `pactkit workflow supersede <run-id>` operates on both run stores (legacy `.pactkit/workflow-runs/` and generic `.pactkit/continuations/runs/`) through one shared record writer and two schema adapters. Supersession requires: a recomputed non-empty drift; a run that is not a healthy completed run; a `work-unit` authorization window; a reason; and an evidence-coverage record (incomplete coverage allowed only with `--accept-incomplete`). The operation is append-only and idempotent. Consumers (`_active_runs_for_story`, `bind_story`, `resolve_host_run`, `_generic_act_resolution`, `finish_guard`) treat `superseded` as inactive and terminal.
+
+## Consequences
+
+- A drifted run no longer occupies its Story; a fresh run can start without deleting evidence.
+- The drift, coverage (e.g. 8/17), actor, and authorization remain queryable forever.
+- New status value must be accepted by both engines' validators and every consumer; unknown-status handling must not degrade superseded runs into "ambiguous".
+- Operators must supply a reason and, for incomplete evidence, an explicit flag; a healthy or validly completed run is refused.
+- Follow-up: surface `superseded` in `status` output and run-event consumers; document the authorization scope in the CLI help.

pactkit-4.3.0/docs/architecture/governance/lessons/LESSON-20261020093508-4b33cc09cb.md

@@ -0,0 +1,10 @@
+---
+schema_version: 1
+id: LESSON-20261020093508-4b33cc09cb
+date: '2026-10-20'
+story_id: STORY-slim-202610209c7ba9343e09
+context: src/pactkit/done_verify.py:_obligation_of
+tags: []
+---
+
+done_verify.py:_obligation_of 的表格行不得跨单元格回退：File 列路径由列头判 create，Action 列的删除/移除动词只对非表格裸从句生效；语料守卫 STORY-slim-20261016ed88c74cb3c1 复现了把「执行删除」判成文件删除的假阳性。

pactkit-4.3.0/docs/architecture/governance/lessons/LESSON-20261020103822-e8985c46ee.md

@@ -0,0 +1,10 @@
+---
+schema_version: 1
+id: LESSON-20261020103822-e8985c46ee
+date: '2026-10-20'
+story_id: STORY-slim-20261020a35cc1ea241e
+context: src/pactkit/run_supersede.py:_measure
+tags: []
+---
+
+run_supersede.py:_measure 的证据覆盖率必须从 run 自己的 fingerprints 重算：observed = 当前摘要非 missing 的键数，drift = 摘要不等的键；空指纹清单不能用 --accept-incomplete 绕过，必须 fail closed。双引擎共用一个终态写入器，schema 适配器只负责读取/校验。

pactkit-4.3.0/docs/architecture/governance/postmortems/HOTFIX-slim-202610201de6fd5cd46b.md

@@ -0,0 +1,28 @@
+# Postmortem: HOTFIX-slim-202610201de6fd5cd46b — ci.cwd 跨语法边界未引用
+
+## Timeline
+
+- 2026-10-20：QA（`/project-check`）在 `_gitlab_cwd_lines` 与 `_emit_working_directory` 发现 `ci.cwd` 原样插值；同日以 hotfix 修复并补语法级回归。
+
+## Root cause
+
+渲染器把 `ci.cwd` 当作字面文本写进两种它不拥有的语法：GitLab 的 shell 脚本（`cd {cwd}`）与 GitHub 的 YAML 标量（`working-directory: {cwd}`）。缺陷的机制不是“忘了转义某一个字符”，而是**配置值与目标语法之间没有单一引用边界**：路径合法性（`resolve_cwd` 的越界检查）与渲染安全被当成了同一件事。
+
+## Blast radius
+
+- GitLab lint job（4.2.0 已发布路径）
+- GitLab test job（STORY-slim-202610209c7ba9343e09 扩展到该 job 的同一前缀）
+- GitHub 的 install/lint/test 三个 `working-directory`
+- 仅当 `ci.cwd` 含空格、shell 元字符或 YAML 敏感序列（`: `、` #`、制表/换行）时触发；普通路径无影响
+
+## Why defenses missed it
+
+既有测试比较渲染结果的子串（`cd backend`、`working-directory: backend`），从未用**目标语法**解析产物：shell 用 `shlex.split`/实际执行、YAML 用 `yaml.safe_load`。字符串包含关系无法区分“一个参数”与“一个参数加一条命令”。
+
+## Recurrence prevention
+
+- 已在两个 live 站点加入引用边界：GitLab 用 `shlex.quote`，GitHub 用 JSON 双引号作为 YAML 安全标量；简单值保持 plain 形式，golden 不漂移。
+- 回归测试以目标语法解析产物，并实际执行反引号注入用例（`test_gitlab_command_substitution_does_not_execute`）。
+- 同类扫描（`grep` shell/YAML 插值）确认没有其他 live 站点；`commit_gate.py` 的 `${cwd}` 属退役 MCP 模板，不在该类。
+
+**Open action items**: 无（两项预防措施随本 hotfix 交付）。

{pactkit-4.2.0 → pactkit-4.3.0}/docs/architecture/governance/rules.md

@@ -15,7 +15,7 @@
 
 ## Invariants
 
-1. All 7917+ tests must pass before any commit to `main`.
+1. All 7968+ tests must pass before any commit to `main`.
 2. Specs (`docs/specs/`) are the source of truth — code conforms to specs, not the reverse.
 3. CLI entry point is `pactkit` via `src/pactkit/cli.py:main`.
 4. No runtime dependencies beyond `pyyaml`.

{pactkit-4.2.0 → pactkit-4.3.0}/docs/architecture/governance/ut-inventory.md

@@ -18,8 +18,8 @@
 
 | 项 | 值 |
 |---|---|
-| 源模块（不含 `__init__.py`） | **126** |
-| 被测试**导入** | **123** |
+| 源模块（不含 `__init__.py`） | **127** |
+| 被测试**导入** | **124** |
 | 未被任何测试导入 | **3** |
 | 闸门类模块 | **7** |
 | 已 accepted 的 ADR | **11** |
@@ -43,7 +43,7 @@
 
 | 闸门模块 | 导入它的测试文件数 | 契约 |
 |---|---|---|
-| `src/pactkit/auth_gate.py` | 6 | — |
+| `src/pactkit/auth_gate.py` | 7 | — |
 | `src/pactkit/commit_gate.py` | 43 | — |
 | `src/pactkit/enforcement.py` | 9 | — |
 | `src/pactkit/gate_migration.py` | 4 | — |
@@ -74,8 +74,8 @@
   "version": 1,
   "method": "ast-reverse-import",
   "totals": {
-    "modules": 126,
-    "imported": 123,
+    "modules": 127,
+    "imported": 124,
     "not_imported": 3,
     "gates": 7
   },
@@ -144,7 +144,7 @@
     },
     {
       "module": "src/pactkit/auth_gate.py",
-      "test_files": 6,
+      "test_files": 7,
       "contracts": [],
       "is_gate": true
     },
@@ -201,7 +201,7 @@
     },
     {
       "module": "src/pactkit/commit_gate.py",
-      "test_files": 46,
+      "test_files": 47,
       "contracts": [],
       "is_gate": true
     },
@@ -227,7 +227,7 @@
     },
     {
       "module": "src/pactkit/continuation.py",
-      "test_files": 14,
+      "test_files": 15,
       "contracts": [],
       "is_gate": false
     },
@@ -269,7 +269,7 @@
     },
     {
       "module": "src/pactkit/coverage_gate.py",
-      "test_files": 4,
+      "test_files": 5,
       "contracts": [],
       "is_gate": false
     },
@@ -307,7 +307,7 @@
     },
     {
       "module": "src/pactkit/done_verify.py",
-      "test_files": 8,
+      "test_files": 9,
       "contracts": [],
       "is_gate": false
     },
@@ -379,7 +379,7 @@
     },
     {
       "module": "src/pactkit/generators/deployer.py",
-      "test_files": 92,
+      "test_files": 94,
       "contracts": [
         "deployed-copies-match-source"
       ],
@@ -477,7 +477,7 @@
     },
     {
       "module": "src/pactkit/legacy/workflow_engine.py",
-      "test_files": 1,
+      "test_files": 2,
       "contracts": [],
       "is_gate": false
     },
@@ -629,7 +629,7 @@
     },
     {
       "module": "src/pactkit/prompts/workflows.py",
-      "test_files": 28,
+      "test_files": 30,
       "contracts": [
         "prompt-budget"
       ],
@@ -695,6 +695,12 @@
       "contracts": [],
       "is_gate": false
     },
+    {
+      "module": "src/pactkit/run_supersede.py",
+      "test_files": 1,
+      "contracts": [],
+      "is_gate": false
+    },
     {
       "module": "src/pactkit/schemas.py",
       "test_files": 18,
@@ -853,7 +859,7 @@
     },
     {
       "module": "src/pactkit/utils.py",
-      "test_files": 12,
+      "test_files": 13,
       "contracts": [],
       "is_gate": false
     },
@@ -877,7 +883,7 @@
     },
     {
       "module": "src/pactkit/workflow_validators.py",
-      "test_files": 1,
+      "test_files": 2,
       "contracts": [],
       "is_gate": false
     }

{pactkit-4.2.0 → pactkit-4.3.0}/docs/product/sprint_board.md

@@ -248,6 +248,11 @@
 
 ## 🧪 Verifying
 
+### [HOTFIX-slim-202610201de6fd5cd46b] Quote ci.cwd in CI renderers
+> Spec: docs/specs/HOTFIX-slim-202610201de6fd5cd46b.md
+
+- [x] Add shell/YAML-safe quoting for ci.cwd in GitLab and GitHub renderers with regression tests
+
 ## ✅ Done
 
 ### [BUG-slim-20260922031fccf35af5] report.py 的 --overlay docstring 声称接受 blast_radius，实际静默丢弃（形状不兼容）
@@ -1544,3 +1549,27 @@
 - [x] 提交后重签回执并核对五条 VERIFIED + head_matches=True
 - [x] 覆盖率披露更正：撤回旧 74% 比例，改记执行行数，正式覆盖率标为未知
 - [x] 登记 coverage-gate 仪器失败为独立 BUG 项
+
+### [STORY-slim-202610209c7ba9343e09] Review 修复：义务判定精度与门禁降级诚实性
+> Spec: docs/specs/STORY-slim-202610209c7ba9343e09.md
+
+- [x] 实现义务判定修复（R1-R7）
+- [x] 实现 cwd 归一化（R8）
+- [x] 实现 commit-gate 诊断顺序（R9）
+- [x] 实现 GitLab cwd 与 deploy 异常边界（R10-R11）
+- [x] 实现 coverage 持久化脱敏（R12）
+- [x] 补逐谓词回归测试与真实语料守卫（R13）
+- [x] 运行聚焦与全量验收并记录证据
+
+### [STORY-slim-20261020a35cc1ea241e] Workflow run supersede: audited terminal state for drifted runs
+> Spec: docs/specs/STORY-slim-20261020a35cc1ea241e.md
+
+- [x] 实现共享 supersede 记录写入器与双 schema 适配器（R1）
+- [x] 实现漂移/健康边界与 revalidate 拒绝（R2）
+- [x] 增加 work-unit 授权 scope 与前置校验（R3）
+- [x] 实现证据覆盖率计算与 --accept-incomplete（R4）
+- [x] 实现 append-only 终态记录、事件与幂等（R5）
+- [x] 实现 Story 释放与 successor 双向链接（R6）
+- [x] 更新消费方终态语义（R7）
+- [x] 接入 workflow supersede CLI 与 help golden（R8）
+- [x] 补两种 schema 与消费方回归测试（R9）

pactkit-4.3.0/docs/product/stories/HOTFIX-slim-202610201de6fd5cd46b.yaml

@@ -0,0 +1,12 @@
+schema_version: 1
+id: HOTFIX-slim-202610201de6fd5cd46b
+title: Quote ci.cwd in CI renderers
+spec_path: docs/specs/HOTFIX-slim-202610201de6fd5cd46b.md
+status: verifying
+tasks:
+- id: task-37e85b45cb
+  title: Add shell/YAML-safe quoting for ci.cwd in GitLab and GitHub renderers with
+    regression tests
+  completed: true
+created_at: '2026-10-20T09:40:50+00:00'
+updated_at: '2026-10-20T09:43:17+00:00'

pactkit-4.3.0/docs/product/stories/STORY-slim-202610209c7ba9343e09.yaml

@@ -0,0 +1,30 @@
+schema_version: 1
+id: STORY-slim-202610209c7ba9343e09
+title: Review 修复：义务判定精度与门禁降级诚实性
+spec_path: docs/specs/STORY-slim-202610209c7ba9343e09.md
+status: archived
+tasks:
+- id: task-f31b89d6c7
+  title: 实现义务判定修复（R1-R7）
+  completed: true
+- id: task-d019780335
+  title: 实现 cwd 归一化（R8）
+  completed: true
+- id: task-76f5af1263
+  title: 实现 commit-gate 诊断顺序（R9）
+  completed: true
+- id: task-5ae80fb592
+  title: 实现 GitLab cwd 与 deploy 异常边界（R10-R11）
+  completed: true
+- id: task-1b870d0126
+  title: 实现 coverage 持久化脱敏（R12）
+  completed: true
+- id: task-d1dad7abb8
+  title: 补逐谓词回归测试与真实语料守卫（R13）
+  completed: true
+- id: task-32ecfc07f9
+  title: 运行聚焦与全量验收并记录证据
+  completed: true
+created_at: '2026-10-20T09:08:53+00:00'
+updated_at: '2026-10-20T09:35:19+00:00'
+archived_at: '2026-10-20T09:35:19+00:00'

pactkit-4.3.0/docs/product/stories/STORY-slim-20261020a35cc1ea241e.yaml

@@ -0,0 +1,36 @@
+schema_version: 1
+id: STORY-slim-20261020a35cc1ea241e
+title: 'Workflow run supersede: audited terminal state for drifted runs'
+spec_path: docs/specs/STORY-slim-20261020a35cc1ea241e.md
+status: archived
+tasks:
+- id: task-9ce4e3bed0
+  title: 实现共享 supersede 记录写入器与双 schema 适配器（R1）
+  completed: true
+- id: task-1ece952ac9
+  title: 实现漂移/健康边界与 revalidate 拒绝（R2）
+  completed: true
+- id: task-17e027938f
+  title: 增加 work-unit 授权 scope 与前置校验（R3）
+  completed: true
+- id: task-340b9006d8
+  title: 实现证据覆盖率计算与 --accept-incomplete（R4）
+  completed: true
+- id: task-f8db20f767
+  title: 实现 append-only 终态记录、事件与幂等（R5）
+  completed: true
+- id: task-8f4637de43
+  title: 实现 Story 释放与 successor 双向链接（R6）
+  completed: true
+- id: task-a3075a1adf
+  title: 更新消费方终态语义（R7）
+  completed: true
+- id: task-fff68d9d7e
+  title: 接入 workflow supersede CLI 与 help golden（R8）
+  completed: true
+- id: task-cb3451d205
+  title: 补两种 schema 与消费方回归测试（R9）
+  completed: true
+created_at: '2026-10-20T10:17:11+00:00'
+updated_at: '2026-10-20T10:38:38+00:00'
+archived_at: '2026-10-20T10:38:38+00:00'

{pactkit-4.2.0 → pactkit-4.3.0}/docs/specs/BUG-slim-20260922031fccf35af5.md

@@ -5,7 +5,7 @@
 | ID | BUG-slim-20260922031fccf35af5 |
 | Status | Done |
 | Priority | P2 — owner 2026-09-23：能力不存在却伪装成功 |
-| Release | Unreleased |
+| Release | 4.3.0 |
 
 > 前六节是**分诊记录与事实剖面**；`## Requirements` 之后是裁定后补的**修复规格**。
 

{pactkit-4.2.0 → pactkit-4.3.0}/docs/specs/BUG-slim-2026092296f6ab6005f4.md

@@ -5,7 +5,7 @@
 | ID | BUG-slim-2026092296f6ab6005f4 |
 | Status | Done |
 | Priority | P1 — owner 2026-09-23：未来 impact/evidence API 的基础返回契约 |
-| Release | Unreleased |
+| Release | 4.3.0 |
 
 > 前六节是**分诊记录与事实剖面**；`## Requirements` 之后是 owner 裁定后补的**修复规格**。
 > 状态 7（模糊匹配静默替换）已单列，见 `BUG-slim-2026092384946b894b94`。

{pactkit-4.2.0 → pactkit-4.3.0}/docs/specs/BUG-slim-20260922afbc8ddf5252.md

@@ -5,7 +5,7 @@
 | ID | BUG-slim-20260922afbc8ddf5252 |
 | Status | Done |
 | Priority | P1 — owner 2026-09-23：生产代码漏扫，直接污染 `blast_radius` 的事实基础 |
-| Release | Unreleased |
+| Release | 4.3.0 |
 
 > 前四节是**分诊记录**（复现、期望/实际、影响、裁定）；`## Requirements` 之后是
 > owner 裁定后补的**修复规格**与实现记录。

{pactkit-4.2.0 → pactkit-4.3.0}/docs/specs/BUG-slim-2026092384946b894b94.md

@@ -5,7 +5,7 @@
 | ID | BUG-slim-2026092384946b894b94 |
 | Status | Done |
 | Priority | P1 — owner 2026-09-23：静默替换给出关于错误对象的、看起来可信的答案 |
-| Release | Unreleased |
+| Release | 4.3.0 |
 
 > 前六节是**分诊记录与事实剖面**；`## Requirements` 之后是裁定后补的**修复规格**。
 >

{pactkit-4.2.0 → pactkit-4.3.0}/docs/specs/BUG-slim-20260923919e4022ec24.md

@@ -5,7 +5,7 @@
 | ID | BUG-slim-20260923919e4022ec24 |
 | Status | Done |
 | Priority | **Blocking**（已闭合）— owner 2026-09-23：只要该维度仍是 unknown，`blast_radius` 的 `absence_verified` 就永远不能为 true |
-| Release | Unreleased |
+| Release | 4.3.0 |
 
 > **为什么是 blocking**：`BUG-slim-2026092296f6ab6005f4` 的 R2 规定
 > `absence_verified` 只在**所有 coverage 维度均已证明**时为真。

{pactkit-4.2.0 → pactkit-4.3.0}/docs/specs/BUG-slim-20260923aeb5e4807a2b.md

@@ -5,7 +5,7 @@
 | ID | BUG-slim-20260923aeb5e4807a2b |
 | Status | In Progress |
 | Priority | P1 — owner 2026-09-23：行为错误档，adapter residual 重构的 Phase 1 |
-| Release | Unreleased |
+| Release | 4.3.0 |
 
 > 前七节是**分诊记录与事实剖面**；`## 裁定` 之后是 owner 拍板后的**修复规格**。
 

{pactkit-4.2.0 → pactkit-4.3.0}/docs/specs/BUG-slim-202610198958534f3b82.md

@@ -6,7 +6,7 @@
 | Type | Bug |
 | Priority | P1（下一项优先修复） |
 | Status | Done |
-| Release | Unreleased |
+| Release | 4.3.0 |
 
 - **Source**: `STORY-slim-20261019bfc38a2382ee` 的 Done 期实测（2026-10-19，本机无 pytest-cov）
 - **登记人**: `STORY-slim-20261019f8958d0a1d46`（该 Story 只登记、不修）

pactkit-4.3.0/docs/specs/HOTFIX-slim-202610201de6fd5cd46b.md

@@ -0,0 +1,22 @@
+# HOTFIX-slim-202610201de6fd5cd46b: CI 渲染器的 ci.cwd 引用安全
+
+| Field | Value |
+|-------|-------|
+| ID | HOTFIX-slim-202610201de6fd5cd46b |
+| Status | In Progress |
+| Priority | P2 |
+
+## Background
+
+`ci.cwd` 在两个 CI 渲染器中被原样插入：GitLab 的 `cd {cwd}` 未做 shell 引号，含空格或元字符即破坏/注入脚本；GitHub 的 `working-directory: {cwd}` 未做 YAML 标量保护，含 `: `、` #` 或换行即改变或破坏 YAML。
+
+## Target
+
+- `src/pactkit/generators/deployer.py:_gitlab_cwd_lines`（`cd` 行）
+- `src/pactkit/generators/deployer.py:_emit_working_directory`（`working-directory` 行）
+
+## Fix
+
+- GitLab：用 `shlex.quote` 引用 cwd；简单值保持无引号输出。
+- GitHub：仅当值不是安全 plain scalar 时用 JSON 双引号形式；简单值保持原样（golden 不漂移）。
+- 回归测试：shell 元字符经 `shlex.split` 还原为单个参数；GitHub 输出经 `yaml.safe_load` 还原为原始 cwd。

{pactkit-4.2.0 → pactkit-4.3.0}/docs/specs/STORY-slim-20260929139c36507663.md

@@ -5,7 +5,7 @@
 | ID | STORY-slim-20260929139c36507663 |
 | Status | Done |
 | Priority | P1 |
-| Release | Unreleased |
+| Release | 4.3.0 |
 
 - **Program**: PactKit repository governance consolidation
 - **Design source**: `STORY-slim-20260929ca871a978a8e` 的 R7（被推迟的五处）与 `STORY-slim-20260929e69ebc3c8fe7` 的 R7（顺序门）

{pactkit-4.2.0 → pactkit-4.3.0}/docs/specs/STORY-slim-202609291e67ae08ec97.md

@@ -5,7 +5,7 @@
 | ID | STORY-slim-202609291e67ae08ec97 |
 | Status | Draft |
 | Priority | P1 |
-| Release | Unreleased |
+| Release | 4.3.0 |
 
 - **Program**: PactKit repository governance consolidation（不是新 feature，见 §为什么现在）
 - **Design source**: `~/pactkit-lifecycle-design.md`（417 行，2026-09-29）。设计稿是**推理**，本文是**判据**；分歧以本文为准，本文实测推翻设计稿的地方逐条标注