朱子纯 / erp-workflow-plugin

标准列：每表 7 列（新增 iOrder/sMemo；sId/sBrandsId/sSubsidiaryId 改 varchar(50) NOT NULL），从表额外 +sParentId 共 8 列。docs-03 模板 + A3 渲染规则 + A4 DDL 默认值翻译（CURRENT_TIMESTAMP / DEFAULT '1111111111' / iOrder app-assigned）。

去外键：A3 不再推导 FK 约束（改语义引用关系，无 ON DELETE/ON UPDATE，应用层维护一致性）；A4 DDL 不生成 ALTER ADD FOREIGN KEY；validate-ddl 移除外键维度 5→4 维（表/列/类型/索引），单测 45 pass/0 fail；coding.mjs 种子/sentinel「FK 有序」→「按语义引用有序」（保留先被引用方后引用方/不可悬空）。

注：db-design-gen 的 docs/06 读取清单/步骤B 两条 bullet 与本区域改动同处一个 diff hunk，随本提交落入（实属 docs/06 feature 的 A3 接入）。

- A2 skeleton-gen 末尾新增 step F：创建空白 docs/06-实现策略.md，QA 闸循环至用户确认填完才进 A3（原 F 进入 A3 顺延为 G）
- A3 db-design-gen 读取清单 + 步骤B + 参考接入 docs/06
- A5 downstream-gen docs/02 构建顺序 / docs/05 端点 + 参考接入 docs/06
- coding.mjs deriveSpecPrompt（前端+后端）把 docs/06 作为 spec 收集上下文

- 子模块代码：大写短码(USR/ROLE) → 大驼峰英文名、不限长度(UserInfo/Role)
- 功能名：英文大写 [A-Z0-9_]/下划线(PWD_RESET) → 大驼峰 [A-Za-z0-9]/直接拼接(PwdReset)
- 模块代码不变(大写短码 USR)；结构仍 <模块代码>-<子模块代码>-<功能名> 恒 3 段
- 规范示例统一 USR-USR-LOGIN → USR-UserInfo-Login；docs-01 五列示例行同步
- 同步 7 文件：README/coding.mjs/scope-lock/docs-01/CLAUDE/plan-start/docs-04

- index 模板：三列 → 五列（模块代码/模块名称/子模块代码/子模块名称/核心功能点），一行一个子模块
- 卡片文件名：REQ-XXX-NNN.md → <req_id>.md，req_id 恒 3 段（如 USR-USR-LOGIN），功能名由 CC 据核心功能点推断（英文大写、[A-Z0-9_]、多词下划线、子模块内唯一），保持文件名==req_id 不变量
- scope-lock：五列解析 + 按模块代码聚合建目录 + req_id 生成规则；E.1 glob 改 */*.md 跳过 _module.md
- db-design-gen/downstream-gen：REQ-*.md glob 同步；docs/05 结构检查锚点 ### REQ- → 三级标题端点段
- CLAUDE/docs-04 模板 commit 后缀、plan-start 示例、coding.mjs 提示词文案（238/1322）、README 同步
- docs-08 checkbox 文本与 scope-lock Edit 锚点逐字节同步；流程/闸门/tag 机制零改动

行为门 v3（docs/design/2026-06-05-frontend-behavior-stage-gate.md）：
- 行为验收从 per-FE review approve 子门迁回阶段末尾一次（phase Behavior，
  featureLoop 后、testGate 前），保留 fix 循环（BEHAVIOR_STAGE_MAX=3 轮，
  fix 后全量前端单测复验再重跑门）
- req-done/<FE> 语义降为「仅静态 review 过」；行为绿改由 reportPrompt 校验
  阶段级证据（module-reports/frontend-phase-behavior-r*-a*.md 最后一份非 RED）
- build-failed 取消「兄弟未实现」短路（阶段末尾全 FE 已实现）；断言作用域 =
  全部 FE spec「行为验收作用域」小节并集，缺小节记 scope-missing 阻断 green
- 新增样式层 styleIssues（颜色 token 比对 + layout sanity 共 6 kind），
  降维并入 behaviorHard 与交互硬问题同口径 fix；环境仲裁透传 riders 计数

前端测试目录隔离（对齐后端 src/main↔src/test 物理分离）：
- 锁定约定：单测 frontend/tests/** 镜像 src/（smoke 归 tests/__smoke__/ 且
  以 .test.* 结尾），e2e 在 frontend/e2e/，frontend/src/ 禁任何测试产物；
  vitest include 统一限定 tests/**/*.test.*
- 五层防线：docs-04 模板 §2.1 锁定约定 / planPrompt+tddPrompt 硬护栏 /
  fe-skeleton 单测基线 / code-reviewer 新增第 8 维「测试文件隔离」
- legacy 守卫：frontend/src/ 内已存在 colocated 测试时绝不收窄 include
  （防旧单测静默停跑），骨架幂等检测同步豁免，留人工迁移

经两轮多代理对抗审计（34 agents），确认项均已修复。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- coding.mjs: per-module Seed stage after backend testGate (generate
  sql/seed/NN__<module>.sql, cold-stack verify with PK-range COUNT
  reconciliation); behavior gate step2 -> 5-step ordering (demo seed
  before sentinel, sentinel fixed >=100000 range); fe-skeleton adds
  Playwright globalSetup e2e baseline (seed + admin storageState);
  fe tdd e2e assertion constraints
- skeleton-gen: new scripts-seed-demo-data-template.mjs (mysql CLI,
  _demo_seed_history idempotency ledger, offline-validatable, atomic
  apply+ledger batch) + lib offline tests (93/93 green)
- db-init: B.3 re-clean DB after DDL smoke apply (hand schema back to
  Flyway, avoid missing-history-table error); fix step-D typo
- docs-04/CLAUDE templates: data baseline & demo-seed conventions
  (PK ranges 1-999 init / 1000-9999 seed / >=100000 sentinel)

…rd, coverage reconciliation, testdb halt)

Post-implementation multi-agent review (6 dims + per-finding adversarial verify) found the control-flow sound and the goal mostly-achieved; this lands the three deterministic, low-risk fixes among the confirmed findings.

- build-failed short-circuit (must-fix): behaviorSubGate now validates the LLM's classification before green-by-skip — requires non-empty rootCausePath AND no interaction/sentinel hard issues riding along; a "dirty" build-failed goes through adjudicate(allowContinue:false) retry/halt instead of silently approving. The skeleton (lazy router + FeStub) makes legit sibling-unimpl build breaks rare, so a build-failed is more likely a real in-FE shared-code regression — the boundary comment §107-108 claimed load-bearing but had zero JS enforcement.

- coverage reconciliation backstop (§3.6): empty-coverage only guarded ==0; now 0<routesReached<routesPlanned with the shortfall unexplained by route-level coverageGaps -> adjudicate(allowContinue:false). Closes the partial-coverage false-green. Counts route-level reasons only; over-counting can only suppress the gate, never false-halt.

- test-DB guard direct-halt now implemented: TESTDB_GUARD_MARK in envError.detail + behaviorTestDbGuardTripped -> immediate HALT on the first result, honoring step2's "no retry, no adjudication" promise (previously prompt-only; a guard trip wrongly entered the generic stack-not-ready retry path, ~5 redundant setup-test-db.mjs runs).

Left as accepted design trade-offs (documented in design §12): self-attested whitelist/route scope, soft-by-source non-data text, disabled-control should-work recovery limited to submit buttons.

Verified: SYNTAX_OK (wrapped check), 87/87 lib tests pass, no time/random builtins. v2 design doc updated (§3/5/6.2/6.3 + new §12).

Replaces the phase-level read-only behavior-gate with a per-FE acceptance dimension: each FE is approved only when the code-reviewer approves AND runtime behavior verification is green. Behavior defects (dead control / sentinel text mismatch) become fixable must-fix that drive verify->fix->re-verify, not halts.

- reviewWithFixLoop (frontend only, via if(fe)): at the approve gate, behaviorSubGate boots this FE's full stack + seeds sentinels, enumerates this FE's routes, two-tier asserts. Hard issues with a locator -> fixPrompt -> functional reverify -> next behaviorRound; soft text (i18n/literal/semantic) -> adjudicate(continue); behaviorRound bounded by BEHAVIOR_FE_MAX=3, env race by BEHAVIOR_ATTEMPT_MAX=2. Backend featureLoop branch unchanged.

- New runFrontendSkeleton stage (before featureLoop(frontend)): App shell + full lazy router + FeStub placeholders + shared nav, so the app is buildable at every mid-phase point; tdd swaps FeStub->real component per FE. Idempotent via fe-skeleton-done tag.

- BEHAVIOR_GATE_SCHEMA gains build-failed envError kind (sibling-FE-unimpl short-circuit, not a bug) + locator-not-resolvable coverage reason; deriveSpec emits a per-FE route-scope section, reviewer validates it.

- Removed phase-level runBehaviorGate + 'Behavior' phase; kept phase-level testGate (regression). REVIEW_HARD_ROUNDS 8->10.

- Safety: test-DB naming guard pushed into scripts-setup-test-db.mjs template (fail-closed unless name contains test/_dev/_local or ALLOW_NONTEST_DROP=1) + 3 tests.

- agentType stays erp-workflow:code-reviewer. v1 design doc marked SUPERSEDED; v2 design at docs/design/2026-06-02-frontend-behavior-in-review-loop.md.

Verified: wrapped syntax check SYNTAX_OK, 87/87 lib tests pass, no orphan refs, no time/random builtins, top-level return intact. Not yet run end-to-end against a real ERP project.

New 'Behavior' stage between Gate and Milestone, frontend-phase only, after testGate green and before report/milestone. Verifies every interactive control actually works and every text region shows the right content, independent of the tests the tdd agent wrote.

- BEHAVIOR_GATE_SCHEMA / behaviorGateContract() / behaviorGatePrompt() / runBehaviorGate(); reportPrompt now gates the milestone on behavior-gate evidence (frontend-phase-behavior-gate-r*.md, last attempt must be non-RED).

- Two-tier failure: interaction defects (incl. binding-garbage) flake-retry once then hard-halt via adjudicate(allowContinue:false); text issues split by source (sentinel=objective -> no continue; i18n/literal/semantic=adjudicable). Convergence loop re-runs the env + interaction hard gates after any text-layer retry so a refreshed result can't slip a green past the hard gates.

- Full-stack seeded run: test-DB name guard (deterministic halt, not adjudicated), strict 4-phase ordering (empty DB -> boot backend so Flyway builds schema -> seed -> boot frontend), auth bootstrap via storageState, router-config-driven route discovery, ephemeral .tmp/behavior-gate runner with finally teardown, type-legal per-field-unique sentinels.

- agentType uses the plugin-namespaced 'erp-workflow:code-reviewer' (a bare 'code-reviewer' is ambiguous with feature-dev:code-reviewer); README + agents/code-reviewer.md aligned (frontmatter name: stays bare).

- Design: docs/design/2026-06-02-frontend-behavior-gate.md. README + coding-start banner updated.

缺值类(A)改为 stage 自主决策继续并登记 decisions[]；结构违约/重试耗尽(B/C)经新增 adjudicate() 仲裁
retry/continue/halt（runStage/runAction 包装，ADJUDICATE_MAX=3）；dirty 工作树自主恢复（带分支护栏，
非功能分支/越界改动仍 halt）。review 软5/硬8 轮；docs/08 checkbox 降级为纯可视化（req-done tag 为真值）。

硬边界保持: merge 冲突 / invalid-projectRoot / assertSafeId 注入护栏 / 红色测试绝不 continue 跳过
（verify/reverify/tdd/report allowContinue:false）。JS HALT throw 37->26。

- docs-04 template: remove § 2.5 样式与主题 (tokens live in src/styles/tokens.css) + § 3.5 配置与安全 (config in config-vars.yaml, rules in docs/07→now config-vars header)
- styles-tokens-template.css: fix 3 stale docs/06 refs missed in the earlier docs/06 removal (greps had excluded *.css) → self-contained '色值单一来源 / SSoT'
- coding.mjs: frontend ref §一 前端架构 → §二 前端规范 (§一 is 后端); backend drop frontend §2.1 → §1.2 分层; 样式/色值 → tokens.css; remove docs/07 from value-lookup order

- delete docs-09-structure-template.md (its § 二/§ 三 dir layout duplicated docs/04 § 1.2/2.1; § 四 docs-tree was a self-referential maintenance trap; § 五 overlapped docs/04)
- skeleton-gen B.1 now generates only docs/07; B.2 captures backend/frontend dir layout into docs/04 § 1.2/2.1; frontmatter/checkbox/参考 drop docs/09
- coding.mjs (6 refs): file placement -> docs/04 § 1.2/2.1; frontend root -> frontend/ convention; cross-module path->module -> docs/08 § 二 路径: field
- CLAUDE-template rule #2 -> docs/04 § 1.2/2.1; docs-08 checkbox + README A2/template-table drop docs/09

- C.1: stop generating sql/migrations/.gitkeep (A4 db-init's Write V1 creates the dir); README A2 drops 'create empty migrations dir'
- precedence rule: on color conflict, tokens.css wins over prototype (prototype = structure/layout/interaction; tokens.css = color) — encoded in skeleton-gen note, coding.mjs frontend stage, code-reviewer § Design Tokens

- delete frontend-scope-lock skill + docs/06 templates (static + module-pagelist)
- A5 downstream-gen gains prototype/ gate + FE-list derivation -> docs/08 § 三
- plan-start: drop A6 dispatch row, gate 5->4 items; coding-start A0~A6 -> A0~A5
- Design Tokens single source = src/styles/tokens.css (code-reviewer, coding.mjs)
- plugin.json skills 9->8; docs-09 tree drops 06-UI; docs-08 drops A6 section

The TAG_REPORT_FRESHNESS_SCHEMA + checkTagReportFreshPromptM + the
post-`tag.exists` freshness branch in runMilestone existed to detect
"tag points at a commit whose § ⑫ is still {{milestone_tag}}". Per the
original comments, this only catches historical leftovers from the
pre-fix tag → § ⑫ ordering; the same fix reversed the order so the
runtime guard is no longer load-bearing. ~25 lines of branchy
defensive code that the source-level fix already prevents.

If a pre-fix repo has stale milestone tags, delete them with
`git tag -d milestone/<id>` and re-run coding-start.

Independent Claude + Codex review of the working-tree diff surfaced
23 issues; all applied in-place across three domains.

workflows/coding.mjs (9):
- spec/plan/verify/review prompts now git-commit their artifacts
  (closes milestone-dirty-worktree halt risk)
- CHECKBOX_STATE_SCHEMA requires `state` + defensive guard in reviewWithFixLoop
- writeDocs08FieldPromptM scopes edits to module via line anchor
- assertSafeId guards Router output (module/REQ/FE ids)
- featureLoop captures reviewWithFixLoop's return value
- dateFromArtifactPath rejects impossible dates (9999-99-99 etc.)
- terminal HALT review-unresolved message disambiguated
- updated comment on top-level `return` (ESM vs node --check)

lib/validate-ddl.mjs + tests (10):
- extractType preserves unsigned/signed modifiers
- KEY/INDEX fallthrough no longer creates spurious 'KEY' columns
- FOREIGN KEY REFERENCES accepts schema-qualified `db.table`
- index keys normalized to name:kind:cols (UNIQUE-aware)
- FK keys include ON DELETE action (defaults to RESTRICT)
- CREATE TEMPORARY TABLE parsed
- parseForeignKeyBullet/parseIndexBullet reject prose bullets
- +10 regression tests (62 total, all pass)
- merge-gitignore.mjs docstring synced to implementation

skills/ (4):
- docs-06 template header: § 一~二 → § 一~三
- downstream-gen §A steps renumbered 1-7 (was 1,3,4,5,6,7,8)
- docs-08 initial template adds tokens.css checkbox
- coding-start drops "已在后台启动" wording (Workflow is synchronous)

- 新增 scope-lock/templates/config-vars-template.yaml：非敏感项目级配置
  （包名/端口/前端包名/初始账号）+ secrets_ref 键名引用 .env.local；
  A1 E.2 锁定。docs/07 改为只记规则/约定不记具体值。
- 连带更新 skeleton-gen / plan-start 闸门 2 / frontend-scope-lock /
  CLAUDE-template / README / docs-06·07 模板对齐新的配置分层与 docs/06 小节编号。
- lib 修复（含回归测试）：
  - apply-ddl: 抽出 resolveDbConfig，DB_SCHEMA 为契约 schema 键，缺库名 fail-closed (M1)
  - render: 用 Object.hasOwn 拒绝原型链继承键，guard process.argv[1]
  - validate-ddl: 解析 ### 索引/### 外键 bullet (C2)、剥 SQL 注释防幽灵表 (L4)、PRIMARY 归一化
- coding.mjs: Router 把全部前端 FE 聚合为单一末尾 frontend-phase 模块；
  新增 branchSetupPrompt 功能分支生命周期 (C1)；diff 区间改三点 diff；fix 后复跑 verify。

The autonomous build changed it to `export default` to satisfy `node --check`,
but Workflow scripts run in an async wrapper where top-level `return` is the
result contract (alongside `export const meta`). `export default` would be a
dead module export and the per-module result summary would be lost.