feat(hooks): delivery honesty gaps for stage report and overclaim

Add stage-report-missing and progress-overclaim classifiers, Stop wiring,
PreTool block when plan exists without 05, delivery-honesty tests on
stop-gate/control-plane chains, and DeliveryHonestyMatrix progress template.

Author: rockyshi1993

changelogs/unreleased.md

@@ -5,6 +5,7 @@
 
 ## 当前未发布实现候选
 
+- **Agent 交付诚实门（delivery-honesty）**：`classifyDeliveryHonesty` → gap `stage-report-missing` / `progress-overclaim`；Stop 接线；PreTool 有 04 无 05 时禁控制面写；`npm run test:delivery-honesty` 挂 stop-gate 与 control-plane；进度模板 DeliveryHonestyMatrix。需求：`Agent交付诚实与过程产物强制修复`。
 - **维护者站点×完整功能清单对账门（docs-surface-inventory）**：新增 `scripts/lib/docs-surface-inventory.js` + `npm run test:docs-surface-inventory`；校验 Skills84/plugin 双向、workflows×8（含 other）、MCP15、Hooks5/runtime、prompts30、instructions15、website≥156、process-enforcement 文件与 script；挂入 `test:control-plane` 与 validation-manifest 节点 `docs-surface-inventory` / `process-enforcement-e2e`（fast/full）。public-text-surfaces 扩展 guide/index 与 host-parity-grok。intro 增加能力证据三列表。
 - **全宿主流程强制 + 产物路径准确（process-enforcement）**：新增 `scripts/lib/process-enforcement.js`（MutationCpGate 受保护路径 hard-deny、ArtifactPathGate、复审清单/过程包齐套判定）与 `host-enforcement-matrix.js`（五宿主策略真相源）；`lifecycle.cjs` PreTool 接线；`lifecycle-stop-gate.cjs` 追加 `review-checklist-missing` / `process-artifact-incomplete` / `progress-artifact-missing`；`npm run test:process-enforcement-e2e` 并入 `test:stop-gate` 与 `test:control-plane`。文档：`02-output-paths` ArtifactPathGate 行、README 流程强制条；配套 PI-REQ-ASSESS 需求模板评估字段。
 - **需求模板强制项目实况评估（PI-REQ-ASSESS-20260726）**：`requirement-overview.prompt.md` 新增 §10（AI 填写：CodeTruth 锚点 + 合理性/可实施性/收益/验证状态/影响范围 + 推荐）；`requirement.prompt.md` 新增 §2.6 同构字段；与 compliance 五项验证对齐；禁止空表过关。台账 PI-REQ-ASSESS / PI-REQ-NO-SPLIT。需求：`全宿主流程强制与产物路径准确` 概况 v0.4。

hooks/_runtime/lifecycle-stop-gate.cjs

@@ -21,14 +21,17 @@ try {
 
 let classifyReviewChecklistCompletion
 let classifyProcessArtifactCompleteness
+let classifyDeliveryHonesty
 try {
   ;({
     classifyReviewChecklistCompletion,
-    classifyProcessArtifactCompleteness
+    classifyProcessArtifactCompleteness,
+    classifyDeliveryHonesty
   } = require('../../scripts/lib/process-enforcement.js'))
 } catch {
   classifyReviewChecklistCompletion = () => ({ ok: true, code: null, gap: null })
   classifyProcessArtifactCompleteness = () => ({ ok: true, code: null, gap: null, missing: [] })
+  classifyDeliveryHonesty = () => ({ ok: true, gaps: [], code: null, gap: null })
 }
 
 function extractLastAssistantMessage (payload) {
@@ -267,6 +270,22 @@ function evaluateStopCompletionGate (input = {}) {
     gaps.push(processPkg.gap)
   }
 
+  // Delivery honesty (A/B): strong closure claim + report path / over-claim
+  // Note: do not pass completionClaimed=true from mere 完成检查 block — classifier uses strong phrases.
+  if (typeof classifyDeliveryHonesty === 'function') {
+    const honestyGaps = classifyDeliveryHonesty({
+      text,
+      mode: modeL || mode,
+      workflow: wf || workflow,
+      mutated
+    })
+    if (!honestyGaps.ok && Array.isArray(honestyGaps.gaps)) {
+      for (const g of honestyGaps.gaps) {
+        if (g && !gaps.includes(g)) gaps.push(g)
+      }
+    }
+  }
+
   const uniqueGaps = [...new Set(gaps)]
   honesty.processGaps = uniqueGaps
 

hooks/_runtime/lifecycle.cjs

@@ -1502,6 +1502,36 @@ async function main() {
       }
     }
 
+    // 2.7 E: plan without progress forbids control-plane source mutation (delivery honesty H1)
+    if (
+      isSourceCodeMutation(payload, platform, state) &&
+      !(state.simpleTaskFastPath === true || state.taskPathMode === 'simple')
+    ) {
+      const toolPaths = extractToolPaths(payload)
+      const hitsProtected = toolPaths.some(p => isStrictProtectedPath(p))
+      if (hitsProtected) {
+        const task = (typeof findIncompleteTaskForPaths === 'function')
+          ? findIncompleteTaskForPaths(payload, state)
+          : null
+        const bound = task || (typeof findIncompleteTask === 'function' ? findIncompleteTask(state) : null)
+        if (bound && bound.fullPath && hasTaskArtifact(bound, 'CP3')) {
+          const progressPath = path.join(bound.fullPath, '05-实施进度.md')
+          if (!fs.existsSync(progressPath)) {
+            state.lastReason = PROCESS_ENFORCEMENT_CODES.PROGRESS_ARTIFACT_MISSING || 'progress-artifact-missing'
+            saveState(state)
+            writeStdout(buildInterceptionOutput(
+              state, platform, eventName, INTERCEPTION_ACTION.REQUIRE_COMPLETION,
+              'progress-artifact-missing',
+              'Progress artifact required',
+              `控制面 mutation 需要任务目录 05-实施进度.md（已有 04 实施计划）：${bound.name || bound.fullPath}`,
+              'Create 05-实施进度.md under the active requirement before mutating control-plane sources.'
+            ))
+            return
+          }
+        }
+      }
+    }
+
     // 3. CP gate — block source code mutations until checkpoints confirmed
     //    PF-process-enforcement: hard-deny for strict-protected paths even under safety-only (D1)
     //    Non-protected paths: legacy safety-only warning + Honesty cp2-unconfirmed-write

package.json

@@ -88,7 +88,7 @@
     "test:package-release": "node scripts/run-validation.js --route package-release",
     "test:control-plane-module-contracts": "node scripts/test-control-plane-module-contracts.js",
     "test:closure-evidence": "node scripts/test-closure-evidence-controls.js",
-    "test:control-plane": "npm run test:probe-registry && npm run test:cli-command-registry && npm run test:cli-json-contract && npm run test:governance-status-summary && npm run test:always-on-governance && npm run test:intent-consistency && npm run test:local-probe && npm run test:context-read && npm run test:context-binding && npm run test:context-read-controls && npm run test:tenant-selection && npm run test:workflow-capabilities && npm run test:api-verification-contracts && npm run test:git-index-isolation && npm run test:control-plane-contracts && npm run test:markdown-structure && npm run test:control-plane-module-contracts && npm run test:consumer-evolution-controls && npm run test:residual-absorption-controls && npm run test:brand-visual-quality && npm run test:turn-liveness && npm run test:closure-evidence && npm run test:workflow-completion && npm run test:public-text-integrity && npm run test:external-review-claim && npm run test:candidate-review-bundle && npm run test:capability-surface-decision && npm run test:host-capability-routing && npm run test:requirement-parallel-orchestration && npm run test:evidence-freshness && npm run test:optimization-backlog-evidence && npm run test:discipline-execution && npm run test:skill-resolve && npm run test:process-enforcement-e2e && npm run test:docs-surface-inventory",
+    "test:control-plane": "npm run test:probe-registry && npm run test:cli-command-registry && npm run test:cli-json-contract && npm run test:governance-status-summary && npm run test:always-on-governance && npm run test:intent-consistency && npm run test:local-probe && npm run test:context-read && npm run test:context-binding && npm run test:context-read-controls && npm run test:tenant-selection && npm run test:workflow-capabilities && npm run test:api-verification-contracts && npm run test:git-index-isolation && npm run test:control-plane-contracts && npm run test:markdown-structure && npm run test:control-plane-module-contracts && npm run test:consumer-evolution-controls && npm run test:residual-absorption-controls && npm run test:brand-visual-quality && npm run test:turn-liveness && npm run test:closure-evidence && npm run test:workflow-completion && npm run test:public-text-integrity && npm run test:external-review-claim && npm run test:candidate-review-bundle && npm run test:capability-surface-decision && npm run test:host-capability-routing && npm run test:requirement-parallel-orchestration && npm run test:evidence-freshness && npm run test:optimization-backlog-evidence && npm run test:discipline-execution && npm run test:skill-resolve && npm run test:process-enforcement-e2e && npm run test:docs-surface-inventory && npm run test:delivery-honesty",
     "test:tenant-selection": "node scripts/test-tenant-selection.js",
     "test:workflow-capabilities": "node scripts/test-workflow-capabilities.js",
     "test:api-verification-contracts": "node scripts/test-api-verification-contracts.js",
@@ -113,9 +113,10 @@
     "prepublishOnly": "npm run test:all:with-audit",
     "test:executable-absorption-gates": "node scripts/test-executable-absorption-gates.js",
     "test:skill-resolve": "node scripts/test-skill-resolve.js && node scripts/test-skill-resolution-hook-paths.js && node scripts/test-workspace-skill-auto-match.js",
-    "test:stop-gate": "node scripts/test-lifecycle-stop-gate.js && node scripts/test-r10-control-plane-honesty.js && node scripts/replay-stop-gate-hook-matrix.js && node scripts/test-process-enforcement-e2e.js",
+    "test:stop-gate": "node scripts/test-lifecycle-stop-gate.js && node scripts/test-r10-control-plane-honesty.js && node scripts/replay-stop-gate-hook-matrix.js && node scripts/test-process-enforcement-e2e.js && node scripts/test-delivery-honesty.js",
     "test:process-enforcement-e2e": "node scripts/test-process-enforcement-e2e.js",
     "test:docs-surface-inventory": "node scripts/test-docs-surface-inventory.js",
+    "test:delivery-honesty": "node scripts/test-delivery-honesty.js",
     "test:skill-automatch-accept": "node scripts/replay-skill-automatch-accept.cjs"
   },
   "keywords": [
@@ -231,6 +232,7 @@
     "scripts/test-r10-control-plane-honesty.js",
     "scripts/test-process-enforcement-e2e.js",
     "scripts/test-docs-surface-inventory.js",
+    "scripts/test-delivery-honesty.js",
     "scripts/lib/docs-surface-inventory.js",
     "scripts/lib/process-enforcement.js",
     "scripts/lib/host-enforcement-matrix.js",

prompts/implementation-progress.prompt.md

@@ -38,6 +38,18 @@ applyTo: .devcodex/**/{requirements,bugs}/**; .devcodex/**/fix/**
 - [变更记录](#变更记录)
 ```
 
+## DeliveryHonestyMatrix（强制 · 防过报）
+
+> 进度只能写 **有证据 / 未做 / partial**；禁止「全 ✅ / 5/6 / 只差验收」而无验证表。  
+> 强完成宣称须带阶段报告路径（`reports/...`）。机器 gap：`progress-overclaim` · `stage-report-missing`。
+
+| 字段 | 值 |
+|------|-----|
+| stageReportPath | 有路径 / 无 / N/A+skipReason |
+| progressHonest | 是（每行有证据）/ 否 |
+| checklistVisible | 03-复审清单 或 review-checklists 路径 |
+| validationEvidence | 命令 + exitCode |
+
 ## 进度总览
 
 > 只记录执行推进情况，不重复需求背景、技术方案正文或实施计划的完整任务定义。

scripts/lib/process-enforcement.js

@@ -17,7 +17,11 @@ const ERROR_CODES = Object.freeze({
   /** Control-plane / multi-batch completion without 05 progress file path evidence */
   PROGRESS_ARTIFACT_MISSING: 'progress-artifact-missing',
   /** Formal R3 process package incomplete (04/05/checklist triad) */
-  PROCESS_ARTIFACT_INCOMPLETE: 'process-artifact-incomplete'
+  PROCESS_ARTIFACT_INCOMPLETE: 'process-artifact-incomplete',
+  /** Completion claim without discoverable stage report path */
+  STAGE_REPORT_MISSING: 'stage-report-missing',
+  /** Over-claim progress without validation evidence rows */
+  PROGRESS_OVERCLAIM: 'progress-overclaim'
 })
 
 /** Paths that use hard-deny for unconfirmed CP even under default safety-only (D1). */
@@ -228,6 +232,99 @@ function simpleTaskForbidsPath(filePath) {
   return false
 }
 
+function isDeliveryHonestyExempt (text) {
+  return /SimpleTaskFastPath|报告\s*[：:]\s*N\/A|report\s*[：:=]\s*N\/A|skipReason\s*[：:=]\s*(?:simple-task|simple_task|probe|chat)|mode\s*[=:]\s*chat/i.test(
+    String(text || '')
+  )
+}
+
+function hasStageReportPath (text) {
+  return /reports[/\\]|requirements[/\\][^\n]+[/\\]reports[/\\]|阶段.*报告|\d{8}--.+\.md/i.test(
+    String(text || '')
+  )
+}
+
+function hasValidationEvidence (text) {
+  const t = String(text || '')
+  return (
+    /exitCode\s*[:=]?\s*0|验证摘要|FinalValidationSummary|npm run test:/i.test(t) &&
+    /exitCode|exit\s*0|PASS|passed/i.test(t)
+  )
+}
+
+function looksLikeOverclaim (text) {
+  return /5\s*\/\s*6|全部完成|全部✅|全绿|Fix-[0-9A-F].*全\s*✅|只差验收|可关闭需求|需求已完成|100%\s*完成/i.test(
+    String(text || '')
+  )
+}
+
+/**
+ * Delivery honesty: stage report path + progress over-claim (A/B/H).
+ * @param {{ completionClaimed?: boolean, text?: string, mode?: string, workflow?: string, mutated?: boolean }} input
+ */
+function classifyDeliveryHonesty (input = {}) {
+  const text = String(input.text || '')
+  const mode = String(input.mode || '').toLowerCase()
+  const wf = String(input.workflow || mode || '').toLowerCase()
+  // Strong closure claims only — do not treat mere 「完成检查」block as stage-report duty
+  const strongClaim =
+    input.completionClaimed === true ||
+    /已完成|任务完成|all work is complete|宣告完成|可关闭需求|本需求.*闭环|DoD.*闭环|只差验收/i.test(text)
+
+  if (!strongClaim) return { ok: true, gaps: [], code: null, gap: null }
+  if (mode === 'chat' || wf === 'chat') return { ok: true, gaps: [], code: null, gap: null }
+  if (isDeliveryHonestyExempt(text)) return { ok: true, gaps: [], code: null, gap: null }
+
+  const gaps = []
+  const nonChatWork =
+    input.mutated === true ||
+    ['dev', 'fix', 'self-fix'].includes(mode) ||
+    ['dev', 'fix', 'self-fix'].includes(wf) ||
+    /控制面|ECR|实施|Fix-|Phase-|多文件|website\/docs/i.test(text)
+
+  if (nonChatWork && !hasStageReportPath(text)) {
+    gaps.push(ERROR_CODES.STAGE_REPORT_MISSING)
+  }
+  if (looksLikeOverclaim(text) && !hasValidationEvidence(text)) {
+    gaps.push(ERROR_CODES.PROGRESS_OVERCLAIM)
+  }
+
+  if (gaps.length) {
+    return {
+      ok: false,
+      gaps,
+      code: gaps[0],
+      gap: gaps[0]
+    }
+  }
+  return { ok: true, gaps: [], code: null, gap: null }
+}
+
+/**
+ * Requirement-dir review checklist discoverability (C).
+ * @param {{ taskRoot?: string|null, fs?: { readdirSync?: Function }, text?: string }} input
+ */
+function classifyReviewChecklistDiscoverability (input = {}) {
+  const text = String(input.text || '')
+  if (/03-复审清单|review-checklists[/\\]/i.test(text)) {
+    return { ok: true, gap: null }
+  }
+  const root = input.taskRoot
+  const fsys = input.fs
+  if (root && fsys && typeof fsys.readdirSync === 'function') {
+    try {
+      const names = fsys.readdirSync(root)
+      if (names.some((n) => /复审清单|review-checklist/i.test(String(n)))) {
+        return { ok: true, gap: null }
+      }
+    } catch {
+      /* ignore */
+    }
+  }
+  // Only fail when completion claimed + R3 (caller combines with classifyReviewChecklistCompletion)
+  return { ok: true, gap: null, note: 'use-with-checklist-classifier' }
+}
+
 module.exports = {
   ERROR_CODES,
   STRICT_PROTECTED_PATH_RE,
@@ -238,6 +335,11 @@ module.exports = {
   classifyPathsForArtifacts,
   classifyReviewChecklistCompletion,
   classifyProcessArtifactCompleteness,
+  classifyDeliveryHonesty,
+  classifyReviewChecklistDiscoverability,
   simpleTaskForbidsPath,
-  normalizePath
+  normalizePath,
+  hasStageReportPath,
+  looksLikeOverclaim,
+  hasValidationEvidence
 }

scripts/replay-stop-gate-hook-matrix.js

@@ -62,6 +62,7 @@ const COMPLETE_BODY = [
   'Release actions: push/tag/release/publish 未执行',
   '`DevCodexVisibleEnvelopeV1 · completion-check · PASS · ' + 'c'.repeat(64) + '`',
   '',
+  '阶段报告: reports/requirements/grok/20260723/01--stop-gate-replay.md',
   '工作已完成并收口。'
 ].join('\n')