fix: converge profile truth validation entrypoints

Author: rockyshi1993

RULES.md

@@ -35,7 +35,7 @@ DevCodex 同时支持六宿主的用户级加载路径，规则语义保持一
 
 ## 正式需求与执行模板边界
 
-- **正式需求信源**：当前项目内的正式需求写在 `website/docs/versions/v1/<active-version>/requirements/`。
+- **正式需求信源**：当前执行中的 dev/fix/audit 任务以 workspace active-root 下的 `.devcodex/<project>/{requirements,bugs,optimizations,scenario-tests}/...` 产物为准；维护者本地完整 `website/docs/versions/v1/<active-version>/requirements/` 存在时可作为版本化需求源站/历史文档，不存在时不得把 `website` 缺省误判为需求缺失。
 - **执行模板职责**：`prompts/*.prompt.md` 负责约束 CP1 / CP2 / CP3 产物结构，是默认执行模板，不替代当前项目的正式 requirement 入口。
 - **项目规则优先**：如果项目已经定义自定义 requirement 规范，则项目规范优先，prompt 只提供通用骨架。
 - **阶段边界**：CP1 看需求目标、用户交互与业务结果；CP2 看实现流程、公共契约、兼容性与边界问题；CP3 看实施顺序、验证、风险与回滚。

package.json

@@ -13,7 +13,7 @@
     "global-adapters:remove": "node index.js global-adapters remove --apply",
     "global-adapters:remove:dry-run": "node index.js global-adapters remove --dry-run",
     "test:global-adapters-cli": "node scripts/test-global-adapters-cli.js",
-    "test": "node scripts/run-validation.js --route changed",
+    "test": "node scripts/run-validation.js --route changed --actor human-cli --plan",
     "test:fast": "node scripts/run-validation.js --route fast",
     "test:full": "node scripts/run-validation.js --route full",
     "test:all": "npm run test:full",
@@ -148,7 +148,8 @@
     "test:ci-validation-plan": "node scripts/test-ci-validation-plan.js",
     "test:validation-authority": "node scripts/test-validation-execution-authority.js && node scripts/test-validation-budget-control.js && node scripts/test-validation-convergence.js",
     "test:artifact-authority": "node scripts/test-artifact-mutation-authority.js && npm run test:artifact-slot-template-coverage",
-    "test:changed": "node scripts/run-validation.js --route changed",
+    "test:changed": "node scripts/run-validation.js --route changed --actor human-cli --plan",
+    "test:changed:ai": "node scripts/run-validation.js --route changed --actor ai-hook",
     "test:delivery": "node scripts/run-validation.js --route delivery",
     "test:boundary": "node scripts/run-validation.js --route boundary",
     "test:profile-deploy": "node scripts/run-validation.js --route profile-deploy",

scripts/run-validation.js

@@ -241,6 +241,7 @@ function printHelp() {
     '  --release-authorized        Compatibility request flag; never grants execution authority',
     '  --approve-plan <digest>     Confirm the exact BudgetCardV1 digest',
     '  --actor <type>              ai-hook|human-cli|trusted-ci|release-pipeline',
+    '                              With --plan, human-cli may be requested from an AI host for zero-execution local planning.',
     '  --authority-source <ref>    Current message, TTY attestation, CI policy or release policy reference',
     '  --source-message-digest <d> Required for ai-hook authority',
     '  --policy-digest <digest>    Required for trusted-ci and release-pipeline authority',
@@ -443,8 +444,11 @@ function detectedActorType(env = process.env) {
   return 'human-cli'
 }
 
-function resolveActorType(requested, env = process.env) {
+function resolveActorType(requested, env = process.env, options = {}) {
   const detected = detectedActorType(env)
+  if (options.allowPlanOnlyDowngrade && requested === 'human-cli' && detected === 'ai-hook') {
+    return 'human-cli'
+  }
   if (requested && requested !== detected) {
     throw new ValidationDagError(
       'VALIDATION_ACTOR_SPOOF_REJECTED',
@@ -2106,7 +2110,9 @@ async function main(argv = process.argv.slice(2)) {
       return 0
     }
     const manifest = readValidationManifest(options.manifestPath)
-    const actorType = resolveActorType(options.actorType)
+    const actorType = resolveActorType(options.actorType, process.env, {
+      allowPlanOnlyDowngrade: options.planOnly
+    })
     const activeRoot = process.env.DEVCODEX_VALIDATION_ACTIVE_ROOT
       ? path.resolve(process.env.DEVCODEX_VALIDATION_ACTIVE_ROOT)
       : resolveActiveRuntimeRoot(ROOT)

scripts/test-validation-dag.js

@@ -2166,11 +2166,13 @@ function run() {
     assert(!aggregateInvocations.includes('aggregate-dependent'))
 
     const packageJson = require('../package.json')
-    assert.strictEqual(packageJson.scripts.test, 'node scripts/run-validation.js --route changed')
+    assert.strictEqual(packageJson.scripts.test, 'node scripts/run-validation.js --route changed --actor human-cli --plan')
     assert.strictEqual(packageJson.scripts['test:fast'], 'node scripts/run-validation.js --route fast')
     assert.strictEqual(packageJson.scripts['test:full'], 'node scripts/run-validation.js --route full')
     assert.strictEqual(packageJson.scripts['test:delivery'], 'node scripts/run-validation.js --route delivery')
     assert.strictEqual(packageJson.scripts['test:boundary'], 'node scripts/run-validation.js --route boundary')
+    assert.strictEqual(packageJson.scripts['test:changed'], 'node scripts/run-validation.js --route changed --actor human-cli --plan')
+    assert.strictEqual(packageJson.scripts['test:changed:ai'], 'node scripts/run-validation.js --route changed --actor ai-hook')
     assert.strictEqual(packageJson.scripts['test:actual-candidate-evidence'], 'node scripts/test-actual-candidate-evidence.js')
     assert.strictEqual(packageJson.scripts['test:dangerous-command-context'], 'node scripts/test-dangerous-command-context.js')
     assert.strictEqual(packageJson.scripts['test:session-route-consumers'], 'node scripts/test-session-route-consumers.js')
@@ -2243,6 +2245,33 @@ function run() {
     assert.strictEqual(planEnvelope.data.plan.javascriptCommandCount, 0)
     assert.strictEqual(planEnvelope.data.plan.fullFallback, null)
 
+    const aiPlanOnlyEnv = {
+      ...cliHumanEnv,
+      CODEX_THREAD_ID: 'fixture-ai-thread'
+    }
+    const aiHostHumanPlan = spawnSync(process.execPath, [
+      'scripts/run-validation.js',
+      '--route', 'changed',
+      '--changed', 'README.md',
+      '--actor', 'human-cli',
+      '--plan',
+      '--json'
+    ], { cwd: ROOT, encoding: 'utf8', windowsHide: true, env: aiPlanOnlyEnv })
+    assert.strictEqual(aiHostHumanPlan.status, 0, aiHostHumanPlan.stderr)
+    const aiHostHumanPlanEnvelope = JSON.parse(aiHostHumanPlan.stdout)
+    assert.strictEqual(aiHostHumanPlanEnvelope.ok, true)
+    assert.strictEqual(aiHostHumanPlanEnvelope.data.plan.routeResolved, 'changed')
+
+    const aiHostHumanExecute = spawnSync(process.execPath, [
+      'scripts/run-validation.js',
+      '--route', 'changed',
+      '--actor', 'human-cli',
+      '--json'
+    ], { cwd: ROOT, encoding: 'utf8', windowsHide: true, env: aiPlanOnlyEnv })
+    assert.strictEqual(aiHostHumanExecute.status, 2)
+    const aiHostHumanExecuteEnvelope = JSON.parse(aiHostHumanExecute.stdout)
+    assert.strictEqual(aiHostHumanExecuteEnvelope.error.code, 'VALIDATION_ACTOR_SPOOF_REJECTED')
+
     const highHookPlan = spawnSync(process.execPath, [
       'scripts/run-validation.js',
       '--route', 'changed',

scripts/validate-all-profiles.js

@@ -101,26 +101,48 @@ if (!targets.length) {
   process.exit(0)
 }
 
-let errorCount = 0
-let warningCount = 0
 const results = targets.map(runTarget)
+const sourceNamespace = path.basename(ROOT)
 
-for (const result of results) {
+function resultKind(result) {
+  if (result.status === 1) return 'error'
+  if (result.status === 2) return 'warning'
+  return 'ok'
+}
+
+function countKinds(items) {
+  return items.reduce((acc, result) => {
+    acc[resultKind(result)] += 1
+    return acc
+  }, { ok: 0, warning: 0, error: 0 })
+}
+
+function printResult(result, prefix = '[profile-all]') {
   if (result.status === 1) {
-    errorCount += 1
-    console.error(`[profile-all] ${result.namespace}: error`)
+    console.log(`${prefix} ${result.namespace}: error`)
     const detail = indent(result.output)
-    if (detail) console.error(detail)
+    if (detail) console.log(detail)
   } else if (result.status === 2) {
-    warningCount += 1
-    console.warn(`[profile-all] ${result.namespace}: warning`)
+    console.log(`${prefix} ${result.namespace}: warning`)
     const detail = indent(result.output)
-    if (detail) console.warn(detail)
+    if (detail) console.log(detail)
   } else {
-    console.log(`[profile-all] ${result.namespace}: ok`)
+    console.log(`${prefix} ${result.namespace}: ok`)
   }
 }
 
-console.log(`[profile-all] checked=${results.length} errors=${errorCount} warnings=${warningCount} strictWarnings=${strictWarnings}`)
-if (errorCount || (strictWarnings && warningCount)) process.exit(1)
+const currentProject = results.filter(result => result.namespace === sourceNamespace)
+const workspaceDebt = results.filter(result => result.namespace !== sourceNamespace)
+const currentCounts = countKinds(currentProject)
+const workspaceCounts = countKinds(workspaceDebt)
+const allCounts = countKinds(results)
+
+console.log(`[profile-all] current-project=${sourceNamespace} checked=${currentProject.length} errors=${currentCounts.error} warnings=${currentCounts.warning}`)
+for (const result of currentProject) printResult(result, '[profile-all][current-project]')
+
+console.log(`[profile-all] workspace-debt checked=${workspaceDebt.length} errors=${workspaceCounts.error} warnings=${workspaceCounts.warning}`)
+for (const result of workspaceDebt) printResult(result, '[profile-all][workspace-debt]')
+
+console.log(`[profile-all] checked=${results.length} errors=${allCounts.error} warnings=${allCounts.warning} strictWarnings=${strictWarnings}`)
+if (allCounts.error || (strictWarnings && allCounts.warning)) process.exit(1)
 process.exit(0)

website/README.md

@@ -0,0 +1,7 @@
+# DevCodex maintainer website pointer
+
+`website/` 是维护者本地可选的完整文档源站目录，不进入公开仓和 npm 包。
+
+当前公开用户文档位于 `public-site/`，当前执行中的需求、修复、优化和审查任务以 workspace active-root 下的 `.devcodex/<project>/` 产物为准。
+
+当维护者本地存在完整 `website/docs` 时，它可以作为版本化需求源站和历史文档源；当公开 checkout 中只有本指针文件时，验证器和工作流不得把缺省 `website/docs` 解释为当前需求缺失。