Strengthen workflow evidence contracts - #21
Conversation
Evidence: Case G
Exact promptIssue #20 Case G exact prompt你是 fresh-context、只读的 Case G 执行者。固定候选身份：
认知隔离：不得使用父会话历史、先前审查结论或任何预先给出的内部文件路径。只从仓库根开始， 按候选 SHA 中 只读边界：不得修改、stage、commit、push、评论或创建 PR。不得把记忆或猜测当作导航证据。 Raw recordIssue #20 Case G raw record1. 最终判定Case G：PASS（仅指本仓库入口可导航性）。 fresh-context 执行者仅从候选提交的根 这个 PASS 不得解释为完整维护验证 PASS。五类入口均已实际执行，其中 2. 固定身份与执行边界
3. Exact prompt4. 认知隔离与导航顺序未读取父会话历史、记忆文件或先前审查记录。执行顺序如下：
外部 exact prompt 自身写出了 5. 实际路径与职责5.1 README 与维护入口
5.2 九份双语下游模板中文
安装到下游时只剥离开头的 language prefix，所以 5.3 Skill、安装器、测试与决策
5.4 三类
|
| 项目 | Exact command | 结果 |
|---|---|---|
| 最短 pytest | PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q -p no:cacheprovider |
FAIL / exit 1；/opt/homebrew/opt/python@3.14/bin/python3.14: No module named pytest，未进入 collection |
py_compile |
PYTHONPYCACHEPREFIX=/tmp/coding-workflow-validation.laOCt1/pycache python3 -m py_compile zh/skills/workflow-docs-sync/scripts/sync_docs.py zh/scripts/install_skills.py |
PASS / exit 0；无 stdout/stderr；pycache 仅写外部临时目录并已清理 |
| Skill quick validation | PYTHONDONTWRITEBYTECODE=1 python3 "${CODEX_HOME:-$HOME/.codex}/skills/.system/skill-creator/scripts/quick_validate.py" zh/skills/workflow-docs-sync |
FAIL / exit 1；validator 第 10 行 import yaml 报 ModuleNotFoundError: No module named 'yaml'，未进入 Skill 校验 |
| whitespace | git diff --check |
PASS / exit 0；无输出 |
| CLI help | PYTHONDONTWRITEBYTECODE=1 python3 zh/skills/workflow-docs-sync/scripts/sync_docs.py --help |
PASS / exit 0；显示 {prepare,check}，无已移除命令 |
执行环境核验：
command -v python3
=> /opt/homebrew/bin/python3
python3 --version
=> Python 3.14.3
python3 -c 'import sys; print(sys.executable)'
=> /opt/homebrew/opt/python@3.14/bin/python3.14
python3 -m pip show pytest PyYAML
=> WARNING: Package(s) not found: PyYAML, pytest
=> exit 1
candidate tree 中未找到 pyproject.toml、requirements*.txt、Pipfile、uv.lock 或
poetry.lock。根 .github/workflows/test.yml 在 CI 中显式选择 Python 3.12 并安装 pytest；
它没有执行或为本地 Skill quick validation 安装 PyYAML。此处只记录环境事实，不在只读 Case G
中安装依赖或修改仓库。
8. Exact command ledger
C01：校验并读取 exact prompt
shasum -a 256 /Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-g-prompt.md && wc -l -c /Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-g-prompt.md && sed -n '1,240p' /Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-g-prompt.md结果：exit 0；SHA-256 精确匹配；prompt 为 21 行、1476 bytes。
C02：固定仓库并先读候选根入口
git rev-parse --show-toplevel
git rev-parse HEAD
git status --short --branch
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:AGENTS.md
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:README.md结果：exit 0；根路径正确，HEAD 等于 candidate，状态只显示分支行且无变更；根入口成功读取。
C03：记录 UTC 并沿根链接读取中文 maintainer map
date -u +%Y-%m-%dT%H:%M:%SZ
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/README.md结果：exit 0；时间 2026-08-03T10:07:20Z；成功读取 maintainer map 和完整验证序列。
C04：读取英文入口并列 canonical Skill tree
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:en/README.md
git ls-tree -r --name-only 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- zh/skills/workflow-docs-sync结果：exit 0；Skill tree 恰有 SKILL.md、agents/openai.yaml、evals/README.md、
scripts/sync_docs.py。
C05：读取 canonical Skill 与 Case G 权威
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/skills/workflow-docs-sync/SKILL.md
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/skills/workflow-docs-sync/evals/README.md结果：exit 0；成功读取，Case G 条件与本记录的判定范围一致。
C06：读取中文 development workflow 与 decisions
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/docs/development_workflow/README.md
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/docs/development_workflow/decisions.md结果：exit 0；找到 DEC-006、DEC-007 及 accepted 状态。
C07：列三类 GitHub tree、探测核心对象
git ls-tree -r --name-only 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- .github
git ls-tree -r --name-only 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- zh/.github
git ls-tree -r --name-only 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- en/.github
git ls-tree -r --name-only 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- zh en | sed -n '/^zh\/\(AGENTS.md\|architecture.md\|capability_contract.json\|interact.md\|TESTING.md\|PR_Checklist.md\|SOP.md\|docs\/business_user_guide.md\|\.github\/pull_request_template.md\)$/p; /^en\/\(AGENTS.md\|architecture.md\|capability_contract.json\|interact.md\|TESTING.md\|PR_Checklist.md\|SOP.md\|docs\/business_user_guide.md\|\.github\/pull_request_template.md\)$/p'
git cat-file -e 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/scripts/install_skills.py && echo 'FOUND zh/scripts/install_skills.py'
git cat-file -e 7f118fc8ec0ae36c5a196cc80953085ba215c47e:tests/test_workflow_docs_sync.py && echo 'FOUND tests/test_workflow_docs_sync.py'
git cat-file -e 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/docs/development_workflow/README.md && echo 'FOUND zh/docs/development_workflow/README.md'
git cat-file -e 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/docs/development_workflow/decisions.md && echo 'FOUND zh/docs/development_workflow/decisions.md'
git cat-file -e 7f118fc8ec0ae36c5a196cc80953085ba215c47e:en/docs/development_workflow/README.md && echo 'FOUND en/docs/development_workflow/README.md'结果：exit 0；GitHub tree 与五个核心对象均正确。该次 sed 过滤表达式在本机未打印 18 个模板
行，但不影响同一命令中的对象探测；C08 改用 rg 重做模板清单并得到完整结果。
C08：列 18 个模板并固定 candidate/base 关系
git ls-tree -r --name-only 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- zh en | rg '^(zh|en)/(AGENTS\.md|architecture\.md|capability_contract\.json|interact\.md|TESTING\.md|PR_Checklist\.md|SOP\.md|docs/business_user_guide\.md|\.github/pull_request_template\.md)$'
git cat-file -t 7f118fc8ec0ae36c5a196cc80953085ba215c47e
git cat-file -t 4c611743bea74278e61ce446eef5e7c7b2c14e43
git merge-base 4c611743bea74278e61ce446eef5e7c7b2c14e43 7f118fc8ec0ae36c5a196cc80953085ba215c47e
git diff --stat 4c611743bea74278e61ce446eef5e7c7b2c14e43..7f118fc8ec0ae36c5a196cc80953085ba215c47e结果：exit 0；18 个模板全部存在；两 SHA 均为 commit；merge-base 等于 base。候选相对 base 为
15 files changed、391 insertions、34 deletions。
C09：检查测试场景与 Case G 相关断言
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:tests/test_workflow_docs_sync.py | rg '^def test_|^class '
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:tests/test_workflow_docs_sync.py | rg -n 'README|link|maintainer|DEC-006|DEC-007|quick_validate|py_compile|diff --check|--help|\.github'
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:tests/test_workflow_docs_sync.py | sed -n '1060,1475p'结果：exit 0；测试有五个公共场景；场景 5 验证真实分发结构、双语模板、DEC-007、eval 合同与
CLI help。测试代码不替代本次独立路径核验。
C10：读取英文 development workflow
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:en/docs/development_workflow/README.md结果：exit 0；英文概览包含 DEC-007 摘要和回到中文权威/Skill/tests 的链接。
C11：尝试原样运行唯一完整验证块
set -euo pipefail
validation_tmp="$(mktemp -d /tmp/coding-workflow-validation.XXXXXX)"
trap 'rm -rf -- "$validation_tmp"' EXIT
before="$validation_tmp/status.before"
after="$validation_tmp/status.after"
git status --porcelain=v1 -z --untracked-files=all --ignored > "$before"
PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q -p no:cacheprovider
PYTHONPYCACHEPREFIX="$validation_tmp/pycache" python3 -m py_compile \
zh/skills/workflow-docs-sync/scripts/sync_docs.py zh/scripts/install_skills.py
PYTHONDONTWRITEBYTECODE=1 \
python3 "${CODEX_HOME:-$HOME/.codex}/skills/.system/skill-creator/scripts/quick_validate.py" \
zh/skills/workflow-docs-sync
git diff --check
PYTHONDONTWRITEBYTECODE=1 python3 zh/skills/workflow-docs-sync/scripts/sync_docs.py --help
git status --porcelain=v1 -z --untracked-files=all --ignored > "$after"
if ! cmp -s "$before" "$after"; then
diff -u <(tr '\0' '\n' < "$before") <(tr '\0' '\n' < "$after") || true
exit 1
fi结果：命令执行层因安全策略在 shell 启动前拒绝 rm -rf；脚本未执行、临时目录未创建、任何
gate 均未运行。随后使用 C12-C19 拆分执行相同 gate，并在清理前先解析精确临时路径。
C12：建立明确临时根并捕获初始状态
mktemp -d /tmp/coding-workflow-validation.XXXXXX
git status --porcelain=v1 -z --untracked-files=all --ignored > /tmp/coding-workflow-validation.laOCt1/status.before
wc -c /tmp/coding-workflow-validation.laOCt1/status.before结果：exit 0；临时根为 /tmp/coding-workflow-validation.laOCt1；初始状态文件 0 bytes。
C13：最短 pytest
PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q -p no:cacheprovider结果：exit 1；No module named pytest。
C14：py_compile
PYTHONPYCACHEPREFIX=/tmp/coding-workflow-validation.laOCt1/pycache python3 -m py_compile zh/skills/workflow-docs-sync/scripts/sync_docs.py zh/scripts/install_skills.py结果：exit 0；无输出。
C15：Skill quick validation
PYTHONDONTWRITEBYTECODE=1 python3 "${CODEX_HOME:-$HOME/.codex}/skills/.system/skill-creator/scripts/quick_validate.py" zh/skills/workflow-docs-sync结果：exit 1；ModuleNotFoundError: No module named 'yaml'。
C16：diff check
git diff --check结果：exit 0；无输出。
C17：CLI help
PYTHONDONTWRITEBYTECODE=1 python3 zh/skills/workflow-docs-sync/scripts/sync_docs.py --help结果：exit 0；原始输出：
usage: sync_docs.py [-h] {prepare,check} ...
准备并检查 Workflow Docs Sync。
positional arguments:
{prepare,check}
options:
-h, --help show this help message and exit
C18：前后状态对比
git status --porcelain=v1 -z --untracked-files=all --ignored > /tmp/coding-workflow-validation.laOCt1/status.after
wc -c /tmp/coding-workflow-validation.laOCt1/status.after
cmp -s /tmp/coding-workflow-validation.laOCt1/status.before /tmp/coding-workflow-validation.laOCt1/status.after结果：exit 0；after 为 0 bytes；before/after 完全相同。
C19：核对并清理临时目录
find /tmp/coding-workflow-validation.laOCt1 -print
find /tmp/coding-workflow-validation.laOCt1 -depth -delete
test ! -e /tmp/coding-workflow-validation.laOCt1结果：先确认目录仅含 status snapshots 与外部 pycache；安全清理后 exit 0，路径不存在。
C20：36 个链接目标闭合
set -e
candidate_sha=7f118fc8ec0ae36c5a196cc80953085ba215c47e
while IFS='|' read -r source_path link_text target_path; do
git cat-file -e "${candidate_sha}:${target_path}"
printf '%s | %s | %s\n' "$source_path" "$link_text" "$target_path"
done <<'EOF'
README.md|中文|zh/README.md
README.md|English|en/README.md
README.md|Chinese maintainer map|zh/README.md
README.md|English template and directory guidance|en/README.md
zh/README.md|English|en/README.md
zh/README.md|AGENTS.md|zh/AGENTS.md
zh/README.md|architecture.md|zh/architecture.md
zh/README.md|capability_contract.json|zh/capability_contract.json
zh/README.md|interact.md|zh/interact.md
zh/README.md|docs/business_user_guide.md|zh/docs/business_user_guide.md
zh/README.md|TESTING.md|zh/TESTING.md
zh/README.md|PR_Checklist.md|zh/PR_Checklist.md
zh/README.md|SOP.md|zh/SOP.md
zh/README.md|.github/pull_request_template.md|zh/.github/pull_request_template.md
zh/README.md|docs/development_workflow/README.md|zh/docs/development_workflow/README.md
zh/README.md|docs/development_workflow/decisions.md|zh/docs/development_workflow/decisions.md
zh/README.md|skills/workflow-docs-sync/|zh/skills/workflow-docs-sync
zh/README.md|scripts/install_skills.py|zh/scripts/install_skills.py
en/README.md|中文|zh/README.md
en/README.md|AGENTS.md|en/AGENTS.md
en/README.md|architecture.md|en/architecture.md
en/README.md|capability_contract.json|en/capability_contract.json
en/README.md|interact.md|en/interact.md
en/README.md|docs/business_user_guide.md|en/docs/business_user_guide.md
en/README.md|TESTING.md|en/TESTING.md
en/README.md|PR_Checklist.md|en/PR_Checklist.md
en/README.md|SOP.md|en/SOP.md
en/README.md|.github/pull_request_template.md|en/.github/pull_request_template.md
en/README.md|docs/development_workflow/README.md|en/docs/development_workflow/README.md
en/README.md|canonical Skill|zh/skills/workflow-docs-sync
en/docs/development_workflow/README.md|DEC-007|zh/docs/development_workflow/decisions.md
en/docs/development_workflow/README.md|SKILL.md|zh/skills/workflow-docs-sync/SKILL.md
en/docs/development_workflow/README.md|agents/openai.yaml|zh/skills/workflow-docs-sync/agents/openai.yaml
en/docs/development_workflow/README.md|evals/README.md|zh/skills/workflow-docs-sync/evals/README.md
en/docs/development_workflow/README.md|scripts/sync_docs.py|zh/skills/workflow-docs-sync/scripts/sync_docs.py
en/docs/development_workflow/README.md|tests/test_workflow_docs_sync.py|tests/test_workflow_docs_sync.py
EOF结果：exit 0；36 个 source/link/target 映射均打印且存在。
C21：定位命令权威、决策与维护职责
git grep -n -E '最短入口|python3 -m py_compile|quick_validate\.py|git diff --check|sync_docs\.py --help' 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- zh/README.md
git grep -n -E '^## DEC-006|^## DEC-007|^- 状态：accepted' 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- zh/docs/development_workflow/decisions.md
git grep -n -E '下游模板|canonical Skill|安装器|场景测试|GitHub 路径' 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- zh/README.md结果：exit 0；命令位于第 57、69、72、74、75 行；DEC-006/007 与职责路径行号如前述。
C22：确认 anchor 与 object digest
git grep -n '^## 维护者地图$' 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- zh/README.md
git grep -n '^## Maintainer Map$' 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- en/README.md
git rev-parse '7f118fc8ec0ae36c5a196cc80953085ba215c47e^{tree}'
git rev-parse 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh
git rev-parse 7f118fc8ec0ae36c5a196cc80953085ba215c47e:en
git rev-parse 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/skills/workflow-docs-sync结果：exit 0；两个 anchor 与四个 tree OID 均已记录。
C23：环境依赖事实
command -v python3
python3 --version
python3 -c 'import sys; print(sys.executable)'
python3 -m pip show pytest PyYAML结果：最后一项 exit 1；Python 3.14.3 中两包均不存在，具体输出见第 7 节。
git ls-tree -r --name-only 7f118fc8ec0ae36c5a196cc80953085ba215c47e | rg '(^|/)(pyproject\.toml|requirements[^/]*\.txt|Pipfile|uv\.lock|poetry\.lock)$'结果：exit 1、无输出，即 candidate 不含这些 dependency manifest。
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:.github/workflows/test.yml
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:.github/workflows/claude-merge-readiness.yml | sed -n '1,220p'结果：exit 0；根 CI 职责与 pytest 安装方式得到代码证据。
C24：最终只读状态
date -u +%Y-%m-%dT%H:%M:%SZ
git rev-parse HEAD
git status --short --branch
git status --porcelain=v1 --untracked-files=all --ignored
git diff --exit-code -- .
git diff --cached --exit-code -- .
test ! -e /tmp/coding-workflow-validation.laOCt1结果：exit 0；时间 2026-08-03T10:11:38Z；HEAD 未变；仅打印分支行；普通、暂存、
untracked、ignored 均无残留；临时路径不存在。
9. Finding ledger
| ID | Severity | Evidence | 风险 | 最小处理边界 | 状态 |
|---|---|---|---|---|---|
CG-ENV-001 |
WARN | 最短 pytest exit 1；当前 Python 3.14.3 无 pytest；未进入 collection |
本次不能把测试套件记为通过；若把 Case G PASS 误写成完整维护验证 PASS，会夸大证据 | 在有 pytest 的受控环境原样重跑最短命令；不要修改 candidate 来掩盖本机环境 |
OPEN（环境） |
CG-ENV-002 |
WARN | quick validator exit 1；quick_validate.py 导入 yaml 时失败；当前 Python 无 PyYAML |
本次没有得到 Skill quick validation 语义结果 | 在提供 PyYAML 的受控 Codex/Skill 验证环境原样重跑；不要把 import failure 写成 Skill invalid | OPEN（环境） |
CG-RUNNER-001 |
NOTE | 唯一完整 shell block 在进程创建前因 rm -rf 被执行层拒绝；无 gate 启动 |
不能声称“原完整 block 单次运行通过” | 已拆分逐项执行，并验证前后 repo 状态一致及临时目录清理；保留原始拒绝事实 | CLOSED（有替代证据） |
CG-PROMPT-001 |
NOTE | exact prompt 明示 eval 内部路径，同时要求不使用预给路径 | 可能削弱 blind navigation 的表观独立性 | 本次先从根导航并通过 Skill tree 独立发现该路径；未来 prompt 可只给 Case G 任务而不暴露内部路径 | CLOSED（执行规避） |
CG-TIME-001 |
NOTE | 首次 UTC 命令位于 prompt 校验和初始根读取之后 | raw record 不能证明第一条命令的精确 wall-clock 秒 | 如实标为 recorded start，不回填猜测时间 | OPEN（证据限制） |
10. 歧义与剩余风险
- Case G 的明确失败条件针对“可导航性”，没有规定五条维护命令必须在执行者本机全部通过；
因此本记录把 Case G 导航判为 PASS，同时把两条环境失败独立保留。不得将前者覆盖后者。 zh/README.md给出了命令权威，但没有仓库内 dependency manifest；根 CI 展示 pytest 安装，
而本地 quick validator 属于外部 Codex system Skill。fresh checkout 如何准备完整本地验证环境
不是 Case G 路径缺失，但仍是可复现性风险。- 本次没有安装任何依赖，因为只读授权不包含改变本机 Python 环境；也没有使用其他解释器或
改写 PATH 来把非 exact command 冒充为文档入口。 - raw record 位于仓库外，是本次唯一持久化写入。其 SHA-256 必须在文件写完后由外层记录，
不能自引用写入本文件而仍保持同一 digest。
11. Acceptance accounting
- candidate/base SHA 绑定并证明祖先关系
- executor
/root/issue20_case_g与 fresh-context 边界记录 - 从根
AGENTS.md、根 README 开始导航 - 双语九模板和中文语义源定位
- canonical Skill、安装器、测试、三份 README、development workflow 定位
- DEC-006、DEC-007 路径、标题与 accepted 状态定位
- 根与双语
.github/实际 tree 及职责区分 - 五类验证入口定位并实际执行、逐项记录真实结果
- 36 个相关链接 target 与两个 maintainer anchor 核验
- finding ledger 与歧义记录
- 执行前后 repository residue 相同且为 clean
- 临时验证目录清理并证明不存在
- 仓库外 raw record 持久化
最终结论保持：Case G PASS（入口可导航性）；完整维护验证未全绿。
Evidence: Case A initial round 1SHA-256:
PromptIssue #20 Case A round 1 exact prompt你是 fresh-context 的 Case A round 1 执行者。固定身份：
认知隔离：不得使用父会话历史或先前 SEC 审查结论。先从两个仓库各自根入口重建事实；完整读取 严格执行候选 SHA 中 只允许修改 disposable SEC worktree 中 workflow-docs-sync 管理的九份文档；不得修改 报告必须绑定两端 SHA、执行者身份 Raw recordIssue #20 — Case A Round 1 原始记录0. 结论
1. 固定身份与上下文边界
Prompt digest 的最终复核命令： /usr/bin/time -p shasum -a 256 '/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-a-round1-prompt.md'结果：exit 两端最终身份复核：coding-workflow 2. 入口读取与 prepare完整读取了：
Prepare exact command： python3 '/Users/lyuhongwang/Desktop/coding workflow/zh/skills/workflow-docs-sync/scripts/sync_docs.py' prepare --target-repo '/private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary' --upstream-dir '/Users/lyuhongwang/Desktop/coding workflow' --language zh原始 stdout： {"status":"prepared","target_repo":"/private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary","target_head":"c37cecdfe88344d78172dd9dc24bd4c445763901","upstream_dir":"/Users/lyuhongwang/Desktop/coding workflow","upstream_sha":"7f118fc8ec0ae36c5a196cc80953085ba215c47e","language":"zh","installed":[],"existing":["architecture.md","capability_contract.json","interact.md","docs/business_user_guide.md","TESTING.md","PR_Checklist.md","SOP.md","AGENTS.md",".github/pull_request_template.md"],"required_files":["architecture.md","capability_contract.json","interact.md","docs/business_user_guide.md","TESTING.md","PR_Checklist.md","SOP.md","AGENTS.md",".github/pull_request_template.md"]}结果：exit 初始 target 为 detached git ls-files -z | tr '\0' '\n'3. 编辑前 policy classification
4. Stage 10 / 11 / 12 数据流与副作用重建Stage 10
Stage 11
Stage 12
结论：Stage 10/11/12 都不是本次纯文档 round 的安全只读 gate；不能用 quick unittest、committed snapshot checker、light 或 Stage 11 exit 0 冒充完整场景。 5. Mandatory risk checks 与 finding ledger
“本次未观察到”仅绑定该固定 base、当前调查范围与候选 bytes，不声称所有未来或未知路径不存在缺陷。 6. 最终文档修改受管九文件中仅两文件变化：
其余七文件 bytes 不变： 完整 diff： 7. 验证命令、层级、结果与副作用7.1 编辑前 committed baseline只读 JSON 解析： python3 -m json.tool outputs/validation_run_manifest.json
python3 -m json.tool outputs/validation_snapshot_provenance.json
python3 -m json.tool evidence/requests_log_manifest.json结果均 exit /usr/bin/time -p python3 tools/check_capability_contract_alignment.py结果：exit /usr/bin/time -p python3 tools/check_validation_snapshot.py结果：exit 上述两条最早调用未设置 第一次提出 7.2 最终候选的项目真实测试Python 3.9 下限回归： /usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 /Users/lyuhongwang/opt/anaconda3/bin/python3.9 -m unittest discover -s tests -p 'test_*.py'
当前默认解释器回归： /usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 /opt/homebrew/bin/python3 -m unittest discover -s tests -p 'test_*.py'
JSON parse： /usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 /opt/homebrew/bin/python3 -m json.tool capability_contract.json >/dev/null结果：exit Whitespace/diff gate： /usr/bin/time -p git diff --check -- architecture.md capability_contract.json interact.md docs/business_user_guide.md TESTING.md AGENTS.md SOP.md PR_Checklist.md .github/pull_request_template.md结果：exit 7.3 未运行项
8. Independent review8.1 认知隔离与纠偏Reviewer blind-first 时禁止读取主执行 raw record 与当前 diff，先从 committed objects 建 ledger。它最初误把 target object database 中的无关评测 tip git merge-base --is-ancestor a85b1c0 c37cecdfe88344d78172dd9dc24bd4c445763901结果 exit 8.2 最终 reviewer ledger
8.3 Reviewer 实际验证命令Reviewer 的 shell 为默认 zsh。其 Python/Git 身份是结束时只读补录所得，而非每条命令启动时单独采样： 定向行为测试 exact command： PYTHONDONTWRITEBYTECODE=1 python3 -m unittest tests.test_sec_pipeline_validation.CapabilityContractAlignmentTest.test_malformed_anchor_ids_and_directives_fail_closed tests.test_sec_pipeline_validation.CapabilityContractAlignmentTest.test_missing_or_unknown_type_and_status_fail -vworkdir 为 target；exit Grammar/status matrix 与最终 scoped diff exact command： PYTHONDONTWRITEBYTECODE=1 python3 - <<'PY'
import importlib.util
import json
from pathlib import Path
root = Path.cwd()
json.loads((root / 'capability_contract.json').read_text(encoding='utf-8'))
spec = importlib.util.spec_from_file_location(
'contract_alignment',
root / 'tools' / 'check_capability_contract_alignment.py',
)
module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(module)
cases = {
'canonical': '<!-- capability-anchor: CAPABILITY.alpha -->',
'whitespace': '<!-- capability-anchor: CAPABILITY.alpha -->',
'case_alias': '<!-- Capability-Anchor: CAPABILITY.alpha -->',
'ref_alias': '<!-- capability-ref: CAPABILITY.alpha -->',
'invalid_id': '<!-- capability-anchor: CAPABILITY/alpha -->',
}
actual = {
name: module.ANCHOR_PATTERN.fullmatch(value) is not None
for name, value in cases.items()
}
expected = {
'canonical': True,
'whitespace': True,
'case_alias': False,
'ref_alias': False,
'invalid_id': False,
}
if actual != expected:
raise SystemExit(f'grammar mismatch: {actual}')
if module.ENTRY_STATUSES != {'active', 'deprecated'}:
raise SystemExit(f'status mismatch: {module.ENTRY_STATUSES}')
print('PASS: JSON, canonical grammar/alias boundary, and SEC entry statuses match')
PY
git diff --check -- architecture.md capability_contract.json
git diff --name-only -- architecture.md capability_contract.json interact.md docs/business_user_guide.md TESTING.md AGENTS.md SOP.md PR_Checklist.md .github/pull_request_template.mdworkdir 为 target；exit Reviewer 还执行了固定 SHA/tree/diff/code search 的十组只读命令；完整原文如下，全部 exit # target, 0.1s
git rev-parse HEAD; git diff --stat -- architecture.md capability_contract.json interact.md docs/business_user_guide.md TESTING.md AGENTS.md SOP.md PR_Checklist.md .github/pull_request_template.md; git diff -- architecture.md capability_contract.json interact.md docs/business_user_guide.md TESTING.md AGENTS.md SOP.md PR_Checklist.md .github/pull_request_template.md
# coding-workflow, 0.1s
git cat-file -t 7f118fc8ec0ae36c5a196cc80953085ba215c47e; git show --no-patch --format=fuller 7f118fc8ec0ae36c5a196cc80953085ba215c47e; git ls-tree -r --name-only 7f118fc8ec0ae36c5a196cc80953085ba215c47e | rg 'workflow-docs-sync|capability|publisher|grammar|test_workflow|README|AGENTS' | sed -n '1,260p'
# coding-workflow, 0.1s
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:AGENTS.md; git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/skills/workflow-docs-sync/SKILL.md
# coding-workflow, 0.1s
git grep -n -E 'anchor|alias|status|active|deprecated|canonical|marker|contract|wiki|grammar' 7f118fc8ec0ae36c5a196cc80953085ba215c47e -- zh/skills/workflow-docs-sync/scripts/sync_docs.py tests/test_workflow_docs_sync.py zh/capability_contract.json zh/AGENTS.md zh/PR_Checklist.md zh/SOP.md | sed -n '1,520p'
# coding-workflow, 0.1s
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/capability_contract.json | nl -ba | sed -n '1,112p'; git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:tests/test_workflow_docs_sync.py | nl -ba | sed -n '1125,1345p'; git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/skills/workflow-docs-sync/evals/README.md | nl -ba | sed -n '1,260p'; git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/skills/workflow-docs-sync/scripts/sync_docs.py | nl -ba | sed -n '250,430p'
# target, 0.1s
git ls-tree -r --name-only c37cecdfe88344d78172dd9dc24bd4c445763901 config; git grep -n -E 'CONFIG_PATH|COMPANY_REGISTRY_PATH|METRIC_APPLICABILITY_PATH|validation_source_policy|sec_config|company_registry|metric_applicability|vnext_release_plan' c37cecdfe88344d78172dd9dc24bd4c445763901 -- scripts tools tests architecture.md AGENTS.md TESTING.md capability_contract.json | sed -n '1,420p'
# target, 0.1s
rg -n 'capability-anchor:|ANCHOR_ID|anchor、ref|wiki link|ENTRY_STATUSES|active.*deprecated|experimental|future|proposed|anchor.*大小写|comment.*空白|contract-defined protocol' architecture.md capability_contract.json interact.md docs/business_user_guide.md TESTING.md AGENTS.md SOP.md PR_Checklist.md .github/pull_request_template.md tools/check_capability_contract_alignment.py tests/test_sec_pipeline_validation.py; nl -ba capability_contract.json | sed -n '1,32p'; nl -ba architecture.md | sed -n '24,35p'; git diff --check -- architecture.md capability_contract.json
# target, 0.1s
nl -ba tests/test_sec_pipeline_validation.py | sed -n '6450,6575p;7460,7545p'; rg -n '^class .*Capability|def test_current_contract|def test_malformed_anchor|def test_entry_status|ENTRY_STATUSES' tests/test_sec_pipeline_validation.py
# target, 0.1s
rg -n 'status must be one of|invalid.*status|unsupported.*status|ENTRY_STATUSES|entry status' tests/test_sec_pipeline_validation.py tools/check_capability_contract_alignment.py -C 6; nl -ba tests/test_sec_pipeline_validation.py | sed -n '6870,7005p'
# target metadata closure only, 0.1s
date -u '+%Y-%m-%dT%H:%M:%SZ'; command -v python3; python3 --version; zsh --version; git --version9. 固定 upstream 最终 checkExact command： PYTHONDONTWRITEBYTECODE=1 /usr/bin/time -p python3 '/Users/lyuhongwang/Desktop/coding workflow/zh/skills/workflow-docs-sync/scripts/sync_docs.py' check --target-repo '/private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary' --upstream-dir '/Users/lyuhongwang/Desktop/coding workflow' --upstream-sha 7f118fc8ec0ae36c5a196cc80953085ba215c47e --expected-target-head c37cecdfe88344d78172dd9dc24bd4c445763901 --language zh原始 final-check JSON（stdout，逐字保留）： {"status":"passed","target_repo":"/private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary","target_head":"c37cecdfe88344d78172dd9dc24bd4c445763901","upstream_sha":"7f118fc8ec0ae36c5a196cc80953085ba215c47e","language":"zh","files_checked":9,"dirty_paths":["architecture.md","capability_contract.json"]}结果：exit 10. 九文档冻结 SHA-256联合摘要编码为以下九条记录按表中顺序连接：
Final joint SHA-256： Digest command 使用 11. 最终 Git 状态与 residue在 git rev-parse HEAD
git status --porcelain=v1 --untracked-files=all
git status --porcelain=v1 --ignored --untracked-files=all
git diff --cached --name-only
git diff --name-only -- architecture.md capability_contract.json interact.md docs/business_user_guide.md TESTING.md PR_Checklist.md SOP.md AGENTS.md .github/pull_request_template.md
git diff --check -- architecture.md capability_contract.json interact.md docs/business_user_guide.md TESTING.md PR_Checklist.md SOP.md AGENTS.md .github/pull_request_template.md结果： 最终无 staged、untracked、ignored residue；只有预期的两份受管文档 unstaged 修改。未在 target 写 run state、ledger、receipt、scratch 或 PR body。仓库外只写本 raw record 与完整 docs diff。 12. Round 2 冻结输入Round 2 必须以以下 identity 原样开始完整重新调查：
Round 2 不能依赖本轮过程说明，必须重新读取权威入口、重建 stage 10/11/12、重新分类政策/强声明、重新选择测试和 reviewer、运行最终 Full nine-document diffdiff --git a/architecture.md b/architecture.md SEC_metrics 是一个本地 Python CLI 批处理研究项目，面向需要复核 SEC 申报数据的分析、财务方法和审计人员。它对 -输入包括三份配置、SEC 官方公开端点、前序阶段文件，以及测试 fixture。输出包括原始响应与请求审计、规范化 inventory、指标与证据矩阵、coverage、Golden、repair validation、分层审计、validation run manifest、成功终态的 snapshot provenance sidecar 和中文报告。 当前运行时不是 API、Web 前端、聊天系统、daily scheduler、报价模型、数据库服务或已切换的 vNext 发布系统。13 个阶段脚本每次只运行一个阶段；完整批次由操作者按照 diff --git a/capability_contract.json b/capability_contract.json
|
Evidence: Case A round 2 attempt 1 — EVIDENCE_INVALIDSHA-256:
Original promptIssue #20 Case A round 2 exact prompt你是新的 fresh-context Case A round 2 执行者。固定身份：
认知隔离：不得使用父会话历史，不得读取 Case A round 1 的 raw record、docs diff 或执行者消息， 严格执行候选 SHA 中 判定只能是：九文档 bytes 完全不变且无 staged/untracked/ignored residue时 报告必须绑定两端 SHA、执行者身份 Prompt addendumCase A round 2 prompt mechanical addendum原 exact prompt 固定了九文档 joint SHA-256，但遗漏 joint framing。只为验证已冻结输入，使用以下 顺序：
每条记录编码为： 按上述顺序连接九条记录后计算 SHA-256；预期仍为 Invalid raw recordIssue #20 Case A round 2 attempt 1 — invalid record1. Terminal status
2. Frozen identity
Both repository HEAD values and 3. Prompt identity and mechanical addendumOriginal exact prompt
Mechanical addendum
4. Cognitive-isolation breachWhat happenedAfter completing substantial read-only repository investigation, the executor The executor did not open either round-1 raw record or round-1 docs-diff file. When it happened
Disposition
5. Work completed before stopThe following work was performed read-only unless explicitly noted:
The following mandatory work was not completed because substantive review was
6. Command ledgerCommands were executed only in the two authorized repository roots, except for Key exact commands included: shasum -a 256 /Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-a-round2-prompt.md
sed -n '1,260p' /Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-a-round2-prompt.md
git rev-parse HEAD
git status --short --branch
git -C /private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary rev-parse HEAD
git -C /private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary status --short --branch
git -C /private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary status --porcelain=v1 --untracked-files=all --ignored
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/skills/workflow-docs-sync/evals/README.md
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/skills/workflow-docs-sync/SKILL.md
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/skills/workflow-docs-sync/scripts/sync_docs.py
python3 zh/skills/workflow-docs-sync/scripts/sync_docs.py prepare \
--target-repo /private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary \
--upstream-dir '/Users/lyuhongwang/Desktop/coding workflow' \
--language zh
shasum -a 256 /Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-a-round2-prompt-addendum.md
sed -n '1,220p' /Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-a-round2-prompt-addendum.md
git -C /private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary ls-files -zThe repository investigation also used read-only python3 - <<'PY'
from hashlib import sha256
from pathlib import Path
paths = (
'architecture.md',
'capability_contract.json',
'interact.md',
'docs/business_user_guide.md',
'TESTING.md',
'PR_Checklist.md',
'SOP.md',
'AGENTS.md',
'.github/pull_request_template.md',
)
hasher = sha256()
for relative_path in paths:
path_bytes = relative_path.encode('utf-8')
content = Path(relative_path).read_bytes()
hasher.update(len(path_bytes).to_bytes(8, byteorder='big'))
hasher.update(path_bytes)
hasher.update(len(content).to_bytes(8, byteorder='big'))
hasher.update(content)
print(hasher.hexdigest())
PY7. Initial and terminal nine-document identityNo target write occurred, so the initial and terminal identities are the same.
8. Initial and terminal diff comparison
Complete diff at both boundaries: diff --git a/architecture.md b/architecture.md
index f496949..8d1e79c 100644
--- a/architecture.md
+++ b/architecture.md
@@ -28,7 +28,7 @@
SEC_metrics 是一个本地 Python CLI 批处理研究项目，面向需要复核 SEC 申报数据的分析、财务方法和审计人员。它对 `config/company_registry.csv` 中配置的逻辑公司定位最新年度申报，计算适用的财务指标，并抽取治理、风险和财年窗口事件信号。
-输入包括三份配置、SEC 官方公开端点、前序阶段文件，以及测试 fixture。输出包括原始响应与请求审计、规范化 inventory、指标与证据矩阵、coverage、Golden、repair validation、分层审计、validation run manifest、成功终态的 snapshot provenance sidecar 和中文报告。
+输入包括四份配置、SEC 官方公开端点、前序阶段文件，以及测试 fixture。输出包括原始响应与请求审计、规范化 inventory、指标与证据矩阵、coverage、Golden、repair validation、分层审计、validation run manifest、成功终态的 snapshot provenance sidecar 和中文报告。
当前运行时不是 API、Web 前端、聊天系统、daily scheduler、报价模型、数据库服务或已切换的 vNext 发布系统。13 个阶段脚本每次只运行一个阶段；完整批次由操作者按照 `README_RUN.md` 的顺序执行。
diff --git a/capability_contract.json b/capability_contract.json
index 76d98bb..5f7400f 100644
--- a/capability_contract.json
+++ b/capability_contract.json
@@ -3,7 +3,8 @@
"status": "active",
"purpose": "SEC_metrics 当前 SEC-only 单财年批处理能力、限制、责任和用户可见行为的机器可读真相源。",
"rules": [
- "Markdown 文档只能引用稳定 anchor_id，不得引用 JSON path、数组下标或 schema 内部路径。",
+ "Markdown 文档只用 canonical `<!-- capability-anchor: <ANCHOR_ID> -->` 引用稳定 anchor_id；marker 名称与 ANCHOR_ID 大小写敏感，ANCHOR_ID 必须匹配 `[A-Za-z0-9_.-]+`，checker 只容忍 comment 内空白差异；其他 anchor、ref、contract 或 wiki link alias 不受支持，checker 也不保证穷举发现或拒绝未知 alias。",
+ "本项目 alignment checker 的 contract entry status 只接受 active 或 deprecated；这是 SEC_metrics 项目侧结构 gate，不代表通用 publisher 只能发布这两个生命周期状态。",
"废弃 anchor_id 必须保留登记，且不得复用于不同含义。",
"没有自动测试的契约必须使用 test_anchor: null，并明确 untested_reason 与 pending_since。",
"契约只描述当前代码、配置、测试和可复核产物，不把规划中的 vNext、前端、API、调度或数据库写成已实现能力。",9. Initial and terminal Git residueAt both boundaries, this command was used: git status --porcelain=v1 --untracked-files=all --ignoredOutput at both boundaries: Interpretation at both boundaries:
10. Non-adoption statementNo policy classification, descriptive-claim classification, stage finding, The only terminal status for this attempt is: |
Evidence: Case A round 2 attempt 2 — ROUND1_INCOMPLETESHA-256:
PromptIssue #20 Case A round 2 attempt 2 exact prompt你是新的 fresh-context Case A round 2 执行者。上一名执行者因认知隔离失效已被废弃；你不得读取 固定身份：
Round 1 最终九文档 bytes 用以下逐文件 SHA-256 固定：
Joint framing：按上列顺序，为每条连接 先验证两端 SHA、language、逐文件/joint digest 和 Git residue；不一致立即判证据失效。随后只从 严格执行候选 SHA 中 Case A round 2：完整重新调查 stage 10/11/12；重新选择至少三条真实 scoped 判定只能是：九文档 bytes 完全不变且无 staged/untracked/ignored residue时 报告绑定两端 SHA、执行者身份 Semantic failure raw recordIssue #20 Case A round 2 attempt 2 raw record1. Verdict
Round 1 的九文档 bytes 没有在本轮发生变化，但固定 target 中存在可复现反证：stage 10 G2 会把耗尽重试后的 HTTP 503 以及缺失的 A01/A02 指标行记为 2. Frozen identity and isolation
3. Before/after nine-document identityThe following SHA-256 values were identical before investigation and after reviewer completion:
Prompt-framed joint SHA-256 before and after:
The framing was, in the listed order, 4. Complete diff and residue comparison
5. Independent reconstructionStage 10/11/12
Re-selected scoped claims
Stale tracked document
6. Exact counterexamples and minimal repair boundaryBF-01: G2 false PASSExecuted exactly from the SEC target root: PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=scripts python3 - <<'PY'
"""以纯内存替身复现 G2 对失败 HTTP 与缺失指标行的错误 PASS。"""
from types import SimpleNamespace
from unittest import mock
import sec_pipeline
http = mock.Mock()
http.fetch.return_value = SimpleNamespace(status_code=503)
rows = sec_pipeline.run_g2_structural_golden(http=http)
http_row = next(
row
for row in rows
if row["assertion_id"] == sec_pipeline.G2_FINANCIAL_ASSETSCURRENT_ASSERTION_ID
)
print("http_503_counterexample=", http_row["actual"], http_row["status"])
assert "companyconcept_status=503" in http_row["actual"]
assert http_row["status"] == "PASS"
financial_company = str(
next(
company
for company in sec_pipeline.load_company_registry()
if sec_pipeline.has_extractor(
extractors=sec_pipeline.company_extractors(company_config=company),
extractor_name="BaselCapitalRatioExtractor",
)
)["company"]
)
original_metrics = sec_pipeline.load_metrics()
missing_rows_metrics = [
row
for row in original_metrics
if not (
row["company"] == financial_company
and row["metric_id"] in sec_pipeline.G2_FINANCIAL_NON_STD_METRIC_IDS
)
]
with mock.patch.object(
sec_pipeline,
"load_metrics",
return_value=missing_rows_metrics,
):
rows = sec_pipeline.run_g2_structural_golden(http=http)
missing_rows = [
row
for row in rows
if row["assertion_id"] in {
"G2_financial_a01_not_std",
"G2_financial_a02_not_std",
}
]
print(
"missing_metric_counterexample=",
[(row["assertion_id"], row["actual"], row["status"]) for row in missing_rows],
)
assert len(missing_rows) == 2
assert all(row["actual"] == "MISSING" and row["status"] == "PASS" for row in missing_rows)
PYOutput and exit: Minimal repair boundary, not executed:
BF-06: stale legacy schema presented as currentExecuted exactly from the SEC target root: PYTHONDONTWRITEBYTECODE=1 python3 - <<'PY'
"""对照旧交接文档声明、当前 ledger 表头与 source policy 分类。"""
import csv
import json
from pathlib import Path
old_doc_path = Path("SEC_metrics_Raw_Data_后端交接简版_v1.0.md")
old_text = old_doc_path.read_text(encoding="utf-8")
legacy_fields = (
"timestamp_utc\nmethod\nurl\nstatus_code\npurpose\nlocal_path\n"
"headers_path\ncontent_length\nsha256\nuser_agent\nretry_attempt\nerror"
)
with Path("evidence/requests_log.csv").open(
mode="r",
encoding="utf-8",
newline="",
) as handle:
current_fields = next(csv.reader(handle))
policy_text = json.dumps(
json.loads(Path("config/validation_source_policy.json").read_text(encoding="utf-8")),
ensure_ascii=False,
sort_keys=True,
)
print("old_doc_claims_current_legacy_schema=", "requests_log.csv` 当前字段为：" in old_text and legacy_fields in old_text)
print("current_header=", ",".join(current_fields))
print("old_doc_classified_by_policy=", old_doc_path.name in policy_text)
assert "requests_log.csv` 当前字段为：" in old_text and legacy_fields in old_text
assert "source_url" in current_fields and "repo_relative_path" in current_fields
assert "url" not in current_fields and "local_path" not in current_fields
assert old_doc_path.name not in policy_text
PYOutput and exit: 7. Tests, checkers, and reviewerNo passed test was repeated after reviewer completion.
Fresh independent reviewer conclusion: 8. Final frozen state for derived validation
|
Evidence: Case A clean restart round 1SHA-256:
PromptIssue #20 Case A clean restart — round 1 exact prompt你是新的 Case A round 1 执行者。上一组 round 1/2 已因 round 2 发现冻结 target 的既有反证而判 固定身份：
先验证 target 为 clean、两端 SHA 固定。完整读取两个仓库根入口、upstream Skill/eval，以及 SEC 的 必须保留并独立复现上一组失败暴露的两个真实 finding，作为已知回归焦点而非人工 fixture：
同时按候选 eval contract 完整执行：重建 stage 10/11/12 输入、写入、副作用、容错和 hard 只允许修改 disposable SEC worktree 中受 workflow-docs-sync 管理的九份文档；不得修改 SEC 代码、 报告必须保留上一组 Raw recordCase A Round 1 Retry 原始执行报告结论
本轮完成了固定身份下的独立调查、最小九文档修订、反例验证、双解释器测试、盲审—候选复核、一次最终机械检查和字节冻结。这个结论只表示 Round 1 文档同步候选可进入 Round 2；它不表示 SEC_metrics 的 G2 运行时缺陷已修复，也不表示重新执行了 live full validation。 先前的 固定身份与边界
允许修改仅限九份 workflow-docs-sync 文档。最终修改 7 份：
未修改 Prepare原样命令： /usr/bin/time -p python3 '/Users/lyuhongwang/Desktop/coding workflow/zh/skills/workflow-docs-sync/scripts/sync_docs.py' prepare --target-repo '/private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary-retry' --upstream-dir '/Users/lyuhongwang/Desktop/coding workflow' --language zh结果：exit 调查结论与 finding ledger
可复现反例使用真实 /usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=scripts python3 - <<'PY'
# inline harness：在 TemporaryDirectory 中实例化 SecHttpClient，transport 连续返回 503，
# time.sleep 被 mock；把最终 observation 和缺 A01/A02 的 metrics rows 传入
# run_g2_structural_golden()，打印 attempts 与四条 G2 结果。
PY结果：exit 这证明的是当前 escaped failure path，不是修复。另一个纯内存 final-result 最小 mock 也得到相同三项假 PASS（exit Request ledger/schema 实证当前 当前 sibling manifest 为 政策与描述性事实分类
测试、失败与修复记录既有 snapshot 只读基线/usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 python3 tools/check_validation_snapshot.pyexit /usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 python3 tools/check_capability_contract_alignment.pyexit 首次候选及捕获到的失败/usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p 'test_*.py'首次结果：exit /usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 python3 -m unittest tests.test_sec_pipeline_validation.CapabilityContractAlignmentTest.test_live_contract_alignment修复后首次 direct：exit /usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p 'test_*.py'修复后首次全量：exit /usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 /Users/lyuhongwang/opt/anaconda3/bin/python3.9 -m unittest discover -s tests -p 'test_*.py'Python 3.9 首次全量：exit Independent review 修复后的重跑候选新增 no-test-diff 与 manifest 边界后，受影响静态断言 PASS（exit /usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 python3 -m unittest tests.test_sec_pipeline_validation.CapabilityContractAlignmentTest.test_live_contract_alignmentexit /usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p 'test_*.py'
/usr/bin/time -p env PYTHONDONTWRITEBYTECODE=1 /Users/lyuhongwang/opt/anaconda3/bin/python3.9 -m unittest discover -s tests -p 'test_*.py'两命令并行执行；默认 Python exit Independent review
未运行项与原因
唯一最终 workflow-docs-sync check原样命令： /usr/bin/time -p python3 '/Users/lyuhongwang/Desktop/coding workflow/zh/skills/workflow-docs-sync/scripts/sync_docs.py' check --target-repo '/private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary-retry' --upstream-dir '/Users/lyuhongwang/Desktop/coding workflow' --upstream-sha 7f118fc8ec0ae36c5a196cc80953085ba215c47e --expected-target-head c37cecdfe88344d78172dd9dc24bd4c445763901 --language zhexit {"status":"passed","target_repo":"/private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary-retry","target_head":"c37cecdfe88344d78172dd9dc24bd4c445763901","upstream_sha":"7f118fc8ec0ae36c5a196cc80953085ba215c47e","language":"zh","files_checked":9,"dirty_paths":["AGENTS.md","PR_Checklist.md","TESTING.md","architecture.md","capability_contract.json","docs/business_user_guide.md","interact.md"]}这个 check 只机械证明固定 upstream/target 身份与最终九文件状态，不替代前述调查、测试和审查。 Round 2 冻结字节身份联合摘要算法：按 UTF-8 path 升序，对每份文件生成
Round 2 必须从同一 target HEAD、同一 upstream SHA、同一 最终 residue
Full nine-document diffdiff --git a/AGENTS.md b/AGENTS.md
@@ -27,9 +28,9 @@ light 模式只做随包 snapshot integrity，不能被记录成 full Golden 重算。 +已知 G2 缺口： 7.3 Repair gate阶段 12 在任何 validation 写入前创建 12. 已知高价值缺口+- G2 structural Golden 未把 companyconcept 重试耗尽后的非 404 非 200 终态转为 FAIL，
SEC_metrics 是一个本地 Python CLI 批处理研究项目，面向需要复核 SEC 申报数据的分析、财务方法和审计人员。它对 -输入包括三份配置、SEC 官方公开端点、前序阶段文件，以及测试 fixture。输出包括原始响应与请求审计、规范化 inventory、指标与证据矩阵、coverage、Golden、repair validation、分层审计、validation run manifest、成功终态的 snapshot provenance sidecar 和中文报告。 当前运行时不是 API、Web 前端、聊天系统、daily scheduler、报价模型、数据库服务或已切换的 vNext 发布系统。13 个阶段脚本每次只运行一个阶段；完整批次由操作者按照 @@ -96,7 +96,7 @@ SEC_metrics 是一个本地 Python CLI 批处理研究项目，面向需要复 @@ -156,7 +156,7 @@ flowchart LR
@@ -204,7 +206,7 @@
@@ -236,7 +238,7 @@
diff --git a/docs/business_user_guide.md b/docs/business_user_guide.md +已知 Golden 边界：当前 G2 可以在 companyconcept 最终返回 503 时仍使 B08 断言 PASS，也可以在 A01/A02 指标行缺失时把 5. 指标行怎么看优先关注这些字段：
-验收断言：Golden 必须是配置/generator/fixture 推导的 exact assertion set 且唯一；stratified audit 必须与当前 metrics 推导的五层样本 exact set 一致且唯一；request log 必须与整表 row-count/hash manifest、Git HEAD/base 已审核有序前缀、下游 locator 和已存 response sidecar 一致；full snapshot provenance 的 source closure、核心 artifact digest key set 与 5. 失败与受限验证行为-非法配置、未知阶段、关键 SEC 请求失败、未声明的不完整 workspace、dirty source closure、最终 gate 或 provenance publication/self-check 失败时，相关 CLI 必须明确报错并非零退出；不得用旧产物、旧 provenance 或空集合伪装成功。 repair validation 的 status 只允许 |
Evidence: Case A clean restart round 2 — PASS_NOOPSHA-256:
PromptIssue #20 Case A clean restart — round 2 exact prompt你是新的 fresh-context Case A round 2 执行者。不得读取父会话、任何先前 agent/reviewer 消息、 固定身份：
Round 1 最终九文档按 UTF-8 path 升序固定：
Joint manifest：按表中顺序为每份文件生成 开始时验证两端 SHA、language、逐文件/joint digest 和 Git residue；不一致立即判证据失效。随后只 必须完成而非只运行 no-op：
唯一判定：九文档 bytes 完全不变且无 staged/untracked/ignored 新残留为 报告绑定执行者 PASS_NOOP raw recordCase A Round 2 Retry — Fresh-context 完整审查原始记录1. 最终结论
2. 审查约束与上下文隔离
3. 冻结输入身份3.1 仓库身份
3.2 九份冻结文档
3.3 HEAD-relative 候选差异身份
首次预检时间为 4. 审查覆盖面4.1 上游规范与实现完整阅读并交叉核对：
结论：候选修改遵循上游 Skill 的 prepare/check、锚点、能力契约与发布授权边界；没有把准备或检查动作表述成自动 commit/push/PR。 4.2 目标仓库完整阅读并交叉核对：
同时检查 tracked tree 中是否存在 CI、scheduler、API、数据库/Databricks 生产实现。未发现 5. 关键事实审查5.1 Stage 10/11/12 的真实语义
候选文档对这些层次的表述与代码一致，没有把局部、recorded、shadow、报告生成或包装器退出码夸大成完整验收。 5.2 G2 缺口的代码级和阶段级验证真实缺口：B08 assertion 不消费 companyconcept 的返回状态；A01/A02 缺失时映射为 在禁止网络和禁止落盘的约束下，使用真实 Stage 10 dispatcher、内存 mock 与内存写入捕获执行阶段级反例：
补充探针中， 命令使用 候选文档的表述是“当前只拒绝 5.3 capability anchor 与 alignment checker
静态核对脚本退出 0，墙钟 0.83 秒；独立审查者的同类独立运行退出 0，墙钟约 0.03 秒。 5.4 请求证据与 source policy
旧 handoff 文档把历史 12 字段格式称作“当前”，并提出 per-attempt delivery manifest；候选 5.5 发布与能力边界
6. Policy / Description 判断表
7. 实际验证命令与结果7.1 完整仓库快速回归
独立审查者也分别运行了相同两套回归：默认 Python 为 189 tests、OK、约 9.77 秒；Python 3.9 为 189 tests、OK、约 19.67 秒。 这些结果只代表仓库快速回归通过，不代表 SEC live validation、Golden、Stage 11、Stage 12 或 snapshot acceptance 已运行。 7.2 格式与差异检查
7.3 primary checker 的预期 commit-binding 失败运行： 结果：退出 1，墙钟 1.18 秒；唯一失败原因是七份候选文件相对 committed HEAD 发生变化。该失败是未创建候选 commit 时 commit-binding 的预期结果，不是候选文档缺陷，也不能被报告为 PASS。独立审查者的正确工作目录复核得到同样结果（退出 1，约 1.19 秒）。其更早一次从上游工作目录用绝对脚本路径运行的错误工作目录探针，不作为 gate 证据。 7.4 上游 final check运行： 结果：退出 0，墙钟 0.31 秒。原始 JSON： {"status":"passed","target_repo":"/private/tmp/coding-workflow-issue20-eval.E5DqyX/sec-primary-retry","target_head":"c37cecdfe88344d78172dd9dc24bd4c445763901","upstream_sha":"7f118fc8ec0ae36c5a196cc80953085ba215c47e","language":"zh","files_checked":9,"dirty_paths":["AGENTS.md","PR_Checklist.md","TESTING.md","architecture.md","capability_contract.json","docs/business_user_guide.md","interact.md"]}8. 明确未运行的验证由于本轮禁止网络、禁止修改目标仓库，且配置中的
这些项目的状态是 UNRUN，不能从快速单元回归、内存 mock、静态 alignment 或上游 final check 推导为 PASS。 9. 独立 fresh-context 审查结果独立审查者给出：
独立审查者复核了相同的冻结 HEAD、上游 SHA、九文件 hash、联合 manifest、7 路径 diff、无额外残留、两套 189-test 回归与 final check。其结论与主审一致。 10. Derived validation 冻结交接本轮没有创建 commit，也不冒充 primary/formal publication。外层若要执行 derived commit-bound validation，必须：
Derived validation 必须绑定以下联合身份：
11. 最终裁决复述在冻结身份、完整阅读、两套回归、阶段级 G2 反例、静态锚点检查、上游 final check、工作树终检与独立 fresh-context 审查共同约束下，本轮结论为：
候选九文件不需要再次修改。正式 commit-bound derived validation 仍须由外层按第 10 节的独立 checkout 流程执行；本轮明确没有创建、发布或宣称完成该 commit。 |
Evidence: Derived SEC alignmentSHA-256:
PromptIssue #20 derived SEC alignment exact prompt执行一次只用于测试的 commit-bound consumer validation。固定身份：
步骤：
最终回复返回 PASS/FAIL、derived commit SHA、raw record SHA-256 和 cleanup 结果。执行者身份记录为 Raw recordIssue #20 derived SEC alignment raw record1. Verdict and authority
2. Frozen identities and preflight
SEC main checkout preflight:
Primary preflight:
Before worktree creation, all-ref count was 3. Exact nine-document identityJoint algorithm: sort by UTF-8 path and concatenate
4. Detached test-only commit
5. Unique formal checker commandExact command, run once from the derived worktree:
Exact stdout: Exact stderr is empty. The command left the derived worktree clean with no ignored residue. Recording note: BSD 6. Grammar, consumer, and project tightening review
7. Meaning of PASSPASS proves the checker's actual structural boundary: canonical anchor grammar, legal and unique IDs, non-dangling canonical references, allowed status/type values, required null-test metadata, committed evidence/document paths and HEAD bytes, Python symbol existence as structural evidence, and base-relative deprecated/tombstone constraints (plus the other deterministic repository checks implemented by this checker). PASS does not prove sentence-level anchor binding, business semantics, that symbol behavior proves the claim, repair of the known G2 runtime defect, live/full validation, Cutover, or release readiness. 8. Cleanup verification
|
Evidence: Final independent reviewSHA-256:
Review promptIssue #20 final independent review exact prompt你是 final fresh-context、只读 reviewer。目标是判断 coding-workflow 候选能否推送并创建 Draft PR， 固定身份：
完整读取 Issue #20、仓库 AGENTS/README/maintainer map、候选 diff、修改后的 Skill/eval/DEC/templates/tests 逐文件读取并核验以下 evidence 的实际 SHA-256、身份、结论、失败保留与 cleanup；不得只相信 PR
确认：早期 invalid、 检查 PR body 是否包含 Issue #20 第 10 节要求的 base/head/tree、五 finding、DEC、范围/no-update、policy 实际重跑足以证明候选未变的 coding-workflow 机械门：固定解释器全仓 pytest、Skill quick validation、 报告执行者 Initial BLOCKED reviewIssue #20 final independent review raw recordVerdict
候选实现、Git 身份、raw evidence 链和指定机械门没有发现代码级 BLOCKER 或 actionable WARN； Review identity and isolation
Frozen candidate and Git boundary
15-file scope 与 Issue 一致； Implementation review ledger
Evidence verification实际磁盘 SHA-256 与 PR body 中已填 digest 全部一致：
失败保留真实：attempt 1 保持 Primary 九文件复算为 794-byte manifest，joint SHA-256 Mechanical gates rerun on final head
Temporary test/pycache root contained 5,119 entries, was removed with exact PR body blockers
|
Evidence: strict fresh-context Case G rerun
Exact prompt你是 fresh-context、只读的仓库导航评估者。 评估对象固定为当前检出的候选提交： 请只从仓库根的维护入口开始，自行判断这个仓库发布什么、中文和英文内容如何组织、 不要使用父会话历史、旧 review、旧 eval 或任何预先给出的内部路径。 最终输出一个自包含 raw record，至少包含：
Raw recordFresh-context raw record
1. 身份与工作树
运行前后均未修改、stage、commit、push、评论或创建 PR。 2. 从根入口开始的导航链
导航与组织判断：PASS。 3. 测试与公开完整验证维护者地图公开的唯一完整序列是： set -euo pipefail
validation_tmp="$(mktemp -d /tmp/coding-workflow-validation.XXXXXX)"
trap 'rm -rf -- "$validation_tmp"' EXIT
before="$validation_tmp/status.before"
after="$validation_tmp/status.after"
git status --porcelain=v1 -z --untracked-files=all --ignored > "$before"
PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q -p no:cacheprovider
PYTHONPYCACHEPREFIX="$validation_tmp/pycache" python3 -m py_compile \
zh/skills/workflow-docs-sync/scripts/sync_docs.py zh/scripts/install_skills.py
PYTHONDONTWRITEBYTECODE=1 \
python3 "${CODEX_HOME:-$HOME/.codex}/skills/.system/skill-creator/scripts/quick_validate.py" \
zh/skills/workflow-docs-sync
git diff --check
PYTHONDONTWRITEBYTECODE=1 python3 zh/skills/workflow-docs-sync/scripts/sync_docs.py --help
git status --porcelain=v1 -z --untracked-files=all --ignored > "$after"
if ! cmp -s "$before" "$after"; then
diff -u <(tr '\0' '\n' < "$before") <(tr '\0' '\n' < "$after") || true
exit 1
fi实际结果：
PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q -p no:cacheprovider退出码 因为权威序列使用 4. 环境限制与补充诊断默认环境：
本机已有非默认 Anaconda Python
补充诊断整体：PASS，但不能把它提升为公开默认完整验证 PASS；权威 5. 分项判定
严格 fresh-context 判断依据：未读取记忆、父会话历史、旧 review 或旧 eval；除候选 SHA 外未采用预给内部路径；先核对 HEAD，随后第一份仓库内容是根目录和根 README，所有后续内部路径均由当前候选中的根 README → 中文维护者地图链导出。 |
Evidence: lifecycle normalization
Evidence normalization: finding lifecycleRecorded at UTC: 本 comment 是对既有记录的增量索引，不修改、删除或追溯改写旧 raw comments。旧 raw record
Clean-restart material findings权威旧记录：#21 (comment)
Non-ancestor reviewer historical set权威旧记录：#21 (comment) Record-quality gap：当时只保存了“三条 finding = 1 BLOCKER + 2 WARN”的聚合结果，没有保存三条
这三条 finding 没有驱动候选修改。 |
Evidence: 2026-08-04 body/evidence-only narrow recheck
Exact review prompt你是 PR #21 的原 final independent reviewer 候选身份必须保持：
禁止修改仓库、amend、commit、push、评论、修改 PR 或标记 Ready；禁止重跑 pytest、py_compile、 必须复核：
最终输出一个自包含 raw recheck record，列出实际只读命令/证据、每项 PASS/BLOCKER/WARN，确认
Raw recheck recordPR #21 body/evidence-only narrow recheck raw record1. Review identity and scope
This run inspected only PR metadata/body/comments, immutable evidence bytes and digests, candidate 2. Actual read-only calls and commandsGitHub connector calls: Relevant shell commands actually run: rg --files /Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence
shasum -a 256 \
/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-g-strict-prompt.md \
/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-g-strict-raw.md \
/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/lifecycle-normalization.md \
/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/PR_BODY.md
wc -c \
/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-g-strict-prompt.md \
/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-g-strict-raw.md \
/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/lifecycle-normalization.md \
/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/PR_BODY.md
shasum -a 256 \
/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-g-prompt.md \
/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-g-raw.md
rg -n '/Users/|AGENTS\.md|README\.md|zh/|en/|tests/|\.github/|evals/README\.md|SKILL\.md|TESTING\.md|PR_Checklist\.md|decisions\.md' \
/Users/lyuhongwang/Desktop/coding-workflow-issue20-evidence/case-g-strict-prompt.md
git rev-parse HEAD HEAD^{tree}
git status --porcelain=v1 --untracked-files=all
git show --no-patch --format='commit=%H%nparents=%P%ntree=%T%nsubject=%s' \
7f118fc8ec0ae36c5a196cc80953085ba215c47e
git diff --name-only \
4c611743bea74278e61ce446eef5e7c7b2c14e43...7f118fc8ec0ae36c5a196cc80953085ba215c47e \
| wc -l
git show 7f118fc8ec0ae36c5a196cc80953085ba215c47e:zh/skills/workflow-docs-sync/evals/README.md \
| nl -ba | sed -n '1,90p'For byte equality, the connector-returned PR/comment strings were compared in memory with the exact 3. PR and candidate identityGitHub returned:
Local read-back returned the same candidate SHA, tree 4. Published byte and digest binding
The strict prompt internal-path/file-name scan returned exit 5. Strict Case G adjudicationEvidence URL: The comment was created and last updated at The raw record establishes:
Candidate contract lines 19-21 define formal Case G failure as a missing path, broken link, confusing Adjudication:
6. Superseded contaminated Case G evidenceOld evidence URL:
Result: PASS. The old comment remains unchanged and preserved; the strict rerun, rather than an edit 7. Lifecycle normalizationEvidence URL: The comment was created and last updated at The additive index separates finding state, event, candidate/evidence state, and disposition:
The non-ancestor historical reviewer output is honestly grouped as All eight pre-existing evidence comments ( Result: PASS. 8. PR body consistency and known limitsThe local body source and GitHub body are exact full-string matches. The body contains the correct new Known Limits correctly states:
The body still says the narrow recheck is Result: PASS. 9. Finding ledger and prohibited-gate attestation
No BLOCKER was found. This review did not rerun pytest, py_compile, quick validation, Case A, derived SEC alignment, 10. Unique verdictGO Meaning: the requested body/evidence-only narrow recheck passes. This verdict does not rewrite the |
1 participant
Closes #20
1. Background and Goal
PR #18 正确把下游模板收窄为 evidence-first、跨项目、直接风险覆盖，但仍留下五个有真实消费者
或失败路径的合同缺口：事实/政策可能互相洗白、Anchor publisher 未正式定义、最低测试决策为空、
finding 与 candidate/evidence 生命周期混用，以及 Case A 第二轮可替第一轮补漏。
本 PR 只关闭这五个缺口，不恢复旧万能规范，不扩张生产同步器，也不把 supplemental/XDG、SOP、
Mermaid 或外部 eval runner 搭车进来。
2. Implementation and Tradeoffs
与 owner 持久化边界，禁止事实→政策和政策→实现事实的双向洗白。
capability_contract.json.rules单点发布 canonical Anchor authoring protocol；TESTING.md、Checklist 和 Skill 只消费协议，不复制 token。协议明确大小写、ID grammar、comment空白、unknown alias 非保证以及结构 alignment 不等于句子级/能力语义证明。
test_anchor: null同时要求非空untested_reason与pending_since；schema_version保持0.1.0，因为本 PR 没改变 JSON shape 或机器必需字段。TESTING.md §4固定 escaped bug、无法先红测、公开合同、no-test-diff、纯重构和 docs-only六类最低证据规则，并由 Checklist 执行。
OPEN/CLOSED/DEFERRED；REOPENED是事件，CURRENT/SUPERSEDED只描述候选/证据。Case A round 2 只接受完整重查后的PASS_NOOP。拒绝方案：不新增 Anchor alias parser/黑名单、claim-level binding、第三种 marker、ledger、receipt、
run state、migration registry 或 wrapper；没有真实缺口时保持零 diff。
3. Actual Change Scope
4c611743bea74278e61ce446eef5e7c7b2c14e437f118fc8ec0ae36c5a196cc80953085ba215c47eeb44eb02e336684a60da0262153be1d324a71d5d096cb1cc7d18a125ecae595ffb60533307cb19c64c18803bfe5a58a26c1a8a17实际变更分为：
token absence、生命周期标识和英文摘要。
明确零 diff：
sync_docs.py、zh/scripts/install_skills.py、CLI schema、生产 parser。CLI 仍只有{prepare,check}。4. Documentation Impact
accepted，接受日期2026-08-03UTC；refine DEC-006，不重写其历史。interact.md、business guide、architecture 与 SOP 无更新：本 PR 改变 authoring/review/evalgovernance，不改变已发布运行能力、用户旅程、生产数据流或故障处置。
AGENTS.md、PR_Checklist.md、TESTING.md、architecture.md、capability_contract.json、business guide 与interact.md。早期 2-file 候选已被ROUND1_INCOMPLETEsupersede；两组候选都不属于本 PR，也未写入 SEC 主工作目录或远端。5. User-visible and Architecture Impact
用户可见影响：安装中文或英文模板后，Agent 会以更诚实的政策证据、Anchor、测试决策和 finding
生命周期生成/维护文档；没有新增 CLI、运行时、网络、副作用或迁移要求。
架构影响：仅收敛 authoring authority 和 eval gate；
prepare/check的数据流、安装器、模板文件集合和 CLI contract 不变。
6. Testing Evidence
coding-workflow candidate
PYTHONDONTWRITEBYTECODE=1 /Users/lyuhongwang/opt/anaconda3/bin/python3 -m pytest -q -p no:cacheprovider5 passed in 47.58s，exit 0。py_compile：sync_docs.py、installer、测试文件，exit 0；临时 pycache 已清理。Skill is valid!；JSON parse、git diff --check、cached diff check 均 exit 0。{prepare,check}。python33.14.3 未安装 pytest；该 pre-collection 环境失败未冒充代码失败或 PASS。Case G
SUPERSEDED / PROMPT_CONTAMINATED。旧 prompt 泄漏了内部 eval 路径；旧 comment保持原样且未删除：Strengthen workflow evidence contracts #21 (comment)
（raw SHA-256：
fbb568ce57fa851adb8d941f100c3a6dbaee98e9fe35ea308f5e3ecc297cf4a3）。/root/issue20_case_g_strict使用fork_turns=none。9ee8d10eab5e23e17eb196fb3265409e1616b71afa93247f52d4850078bba3a20e8db31615844b83e748f55fac60ca52a51919d1b0c8cab6bbc2e0e3f4ca644c核验均
PASS；未使用父会话、旧 review/eval 或预给内部路径，运行前后仓库状态不变。FAIL：默认 Homebrew Python 3.14.3 缺 pytest，公开完整维护序列未闭合；Anaconda Python 3.9.12 补充诊断为
5 passed，其余 gate PASS。该命令失败与执行器拒绝 literal cleanup trap 的 WARN 均保留，不改写为 PASS。
PASS（严格入口可导航性），同时保留上述环境 gate FAIL/WARN，不用补充解释器 PASS 覆盖。SEC Case A round 1
c37cecdfe88344d78172dd9dc24bd4c445763901；upstream：本 PR head；language：zh。architecture.md与capability_contract.json。189 tests，均 exit 0；JSON、diff check 与最终 WDS check exit 0。status=passed、files_checked=9、dirty paths 为上述两文件。b81851b3bfbdbf2c4dfe5bd595342078596789dff1f4243633c46d4ed9c97a44。a24351c2c6e0397b5287313b851184c51cd1e58531768e083eaf32fed9b98348d46479a7235ed604b08372fec46cef5562c10231ffcb0b118b1a543b6f2f9adbSEC policy / fact classification
P-001AGENTS.md的 required 参数、具体异常、fail-fast；require_key与 stage wrappersP-002TESTING.md的 bug-first、no-test-diff 与PR_Checklist.md执行点P-003AGENTS.md文件地图与validation_source_policy.json的 authority rolesAGENTS.md标为历史/提案、非运行/验收权威，并指向当前 ledger/manifest consumerD-001D-002SEC Case A round 2
EVIDENCE_INVALID / SUPERSEDED。执行者调用 agent list 后意外读到 round 1 摘要，主动停止且未给语义 verdict；target bytes 未变。
8cd48db25496c808a0984d69daad0e9caf87a5eabff9354ed15af8fa230c9897ROUND1_INCOMPLETE。fresh reviewer 在冻结 target 中复现 G2 对 HTTP 503、A01/A02缺行的 false-PASS，并发现旧 Raw Data 交接材料仍把 legacy schema 写成当前事实。没有用第三轮
覆盖失败；九文档保持 first-round bytes。
0f609ae0a90b9cf4316e8e6abf57790e58ef39b9e7bef16b765f3243595afaeedefect 为 OPEN，补齐旧文档 authority、四配置、Anchor/status、bug-first/no-test-diff 与发布检查。
189/189 PASS；final WDS check PASS。f45104edfbb39c0df739df37be774a7ca71e01c7189316b23933b6de810f1fdf50ceafe597a5ba1547b22c2474e1360fc5990a20d5eae6cb28583e7a3ce09fdf5b3869cbea641264fea49312123eced5632aaf4430f0dfa6601de13df8bf5784。PASS_NOOP。新执行者和 blind reviewer 均完整重建事实、复现 G2 边界、检查旧文档/Anchor/no-test-diff、各自运行两套 189-test 回归；前后九文档、joint digest、binary
diff、staged/untracked/ignored 状态逐字节不变，
0 BLOCKER / 0 actionable WARN。72abe3aed710f54642ccf406e8aacc089181a5a9d1f4c52796853180905f8de9Derived SEC alignment
bytes，并创建 test-only commit
8c39e223918e53dc419a079558ac7305a4de2d81（tree8ec59b283fe9f148297ff7435298ea25876120bb）。PYTHONDONTWRITEBYTECODE=1 python3 tools/check_capability_contract_alignment.py --base-ref c37cecdfe88344d78172dd9dc24bd4c4457639011.188633s；输出明确 alignment 是结构证据，不证明 claim。1dac4e17951a302f311c646ea295fab9a6a35146a137931215a9abd0621b4ba4与 refs 指纹前后不变；未 push。
这些 Case 不运行会写生产 artifact 的 Stage 10–12 full/live 路径：固定 target 的
config/sec_config.json使用测试联系信息，且该路径会覆写 outputs/manifests 或联网；本次选择两套真实 189-test 快速回归、committed snapshot/alignment 检查、语义 review 和 disposable derived
consumer checkout，不把 quick/golden/repair 描述为 full validation。
7. Review / Fix Record
Issue findings
I20-G01I20-G02I20-G03I20-G04I20-G05Fresh implementation review
I20-FR-01 / BLOCKER / CLOSED：首版遗漏英文 development workflow 摘要；补充等价 DEC-007summary。漏检原因：
hypothesis— 初轮按五份显式模板同步，未把 4.10 的摘要单列为交付对象。I20-FR-02 / BLOCKER / CLOSED：首版 generic contract 把当前 SEC consumer 行为写成所有下游事实；改为通用协议不保证穷举 alias，SEC 当前事实只留 DEC/eval。漏检原因：evidence-backed —
文案把被验证的单一 consumer 外推到了 publisher。
I20-FR-03 / WARN / CLOSED：稳定生命周期 identifier 一度被翻译；双语统一保留REOPENED、CURRENT/SUPERSEDED。漏检原因：hypothesis— 首轮把自然语言等价误当成 identifier 等价。I20-FR-04 / WARN / CLOSED：初版测试未直接证明 Skill 不复制 token、两个 null 字段位于同一rule；已补直接 contract assertions。漏检原因：evidence-backed — 初版只覆盖文件集合计数。
中间候选曾因模板已切换
REOPENED、测试仍 pin 旧词而4 passed / 1 failed；该 evidence/candidate为
SUPERSEDED，最终候选重新运行5 passed。最终 PASS 没有覆盖该失败。Case A findings and evidence state
CA-R1-F01 / WARN / CLOSED：SEC architecture 的配置数量从“三份”最小修正为“四份”。CA-R1-F02 / WARN / CLOSED：SEC contract 补 publisher grammar、alias limitation 和 target statustightening；未新增 parser/blacklist。
a85b1c0提出三项 finding；其 findingstate 现规范为
CLOSED，误用 evidence 为SUPERSEDED，disposition 为RETRACTED / OUT_OF_SCOPE，未驱动文档修改。.pyc；已精确清理并在 raw record 保留，不把cleanup 后状态改写成“从未发生”。
EVIDENCE_INVALID / SUPERSEDED；attempt 2 的ROUND1_INCOMPLETE是有效 semantic failure，驱动 clean restart，未被最终
PASS_NOOP覆盖。TESTING.md复写 raw Anchor literal 触发 consumer malformed failure；修复后双解释器从头重跑。Blind review 随后打开 no-test-diff BLOCKER 和 aggregate/delivery manifest
WARN；两项 finding state 均为
CLOSED，触发 finding 的 candidate 为SUPERSEDED，disposition为
RESOLVED。能发现并诚实记录它，不声称修复 SEC 代码或完成 full validation。
Material findings 均已提升到上表对应权威；没有新增跨 PR 事故 ledger。
Lifecycle normalization
Strengthen workflow evidence contracts #21 (comment)
e811f7610ff91185a3511c8fbcda27960c8b67b6a804cf5a9c0b3fcb15d08696。OPEN / CLOSED / DEFERRED；REOPENED是 event；CURRENT / SUPERSEDED只描述candidate/evidence；
RESOLVED / RETRACTED / OUT_OF_SCOPE只描述 disposition。WDS-A-R1-003CLOSEDCURRENTRESOLVEDWDS-A-R1-004CLOSEDCURRENTRESOLVEDWDS-A-R1-005CLOSEDCURRENTRESOLVEDWDS-A-R1-006CLOSEDSUPERSEDED; final candidateCURRENTRESOLVEDWDS-A-R1-007CLOSEDSUPERSEDED; final candidateCURRENTRESOLVEDWDS-A-R1-008CLOSEDSUPERSEDED; final candidateCURRENTRESOLVEDRecord-quality gap：非祖先
a85b1c0reviewer set 当时只保存“1 BLOCKER + 2 WARN”聚合结果，未保存三条各自稳定 ID 或内容；不得追溯伪造。现以
CA-R1-HIST-NONANCESTOR-SET分组索引三个NOT_CAPTUREDmember：severity 分别为 BLOCKER、WARN、WARN；state 均为CLOSED；event 均为none；non-ancestor evidence 为
SUPERSEDED；disposition 均为RETRACTED / OUT_OF_SCOPE。理由是该 object 不是冻结 target 的祖先，且冻结 target/candidate 无对应声明。
WDS-A-R1-001/002runtime defects 仍OPEN，没有被 normalization 关闭。Final independent review
/root/issue20_final_review重新核验固定候选、全部 raw evidence、derived identity、Git/remote 边界与机械门；实现层
0 BLOCKER / 0 actionable WARN。BLOCKED，只因缺 SEC classification table 和仍引用 superseded 2-file scope；candidate commit 无需修改。
0f187e7419a0e5716dc960ccd1ca47cf41c4f3ae1b5b8f5ab63508f75218cd72PASS_TO_PUBLISH。8a2444eeac6c652ef9be775d45db26963c1d31418b25f2f42976a5499203e7415 passed in 45.92s、Skill valid、py_compile、双语 JSON、diff checks 与 CLI help 全部 PASS；临时目录已清理，仓库状态保持 clean。
GO。只复核严格 Case G、lifecyclenormalization、comment URL/digest 与 candidate SHA；未重跑代码、Case A 或 derived alignment。
000826959c05faf37b0522b1579848719f5fd06465bca8014f574982941c0c587c375c9529b9190fccfb81f9c50e9f42c8294c0cf28034c2dad843fc4fe3c2260 BLOCKER，Scenario 5 debt 为 deferred WARN。8. Known Limits, Open Decisions, and Rollback
Known limits / independent backlog：XDG default-attributes 负例、supplemental suite 长期登记、PR #19
执行 gate DEC、可复用 eval recorder、SEC 已认可但未发布文档修复、真实 Architecture Mermaid 指引、
SOP 膨胀诊断和用户个人代码哲学，均未搭车。
Anchor alignment 只证明 canonical ID、唯一性、非悬空等机械结构，不证明句子级绑定或能力语义；
unknown alias 不受支持，也不声称 consumer 穷举拒绝。严格 Case G 的默认解释器缺 pytest 与
literal cleanup trap 未启动仍保留为环境 FAIL/WARN；补充解释器 PASS 不覆盖它们。
SEC target
c37cecdfe88344d78172dd9dc24bd4c445763901在2026-08-03T10:18Z冻结时是 currentmain；固定身份 eval 期间 remote main 随后前进。Case A 结果只绑定该 frozen target，不绑定之后
合并的 SEC tree，也没有追逐移动的 remote HEAD。
Scenario 5 当前除 exact Anchor token 外还 pin 了若干中英文散文 fragment；这是非阻断维护债务。
后续 supplemental-suite 正式化应以稳定 contract ID 取代继续增加自然语言 fragment。
Rollback：revert head commit 即可；没有 schema migration、生产数据或运行时 artifact 需要回滚。
9. Final Self-check
origin/main...HEAD一致。sync_docs.py、installer 和 CLI schema 零功能变化。main。