fix: catch post-commit profile current drift

Author: rockyshi1993

changelogs/unreleased.md

@@ -12,6 +12,7 @@
 - **恢复与验证**：未结算操作的 Stop 保留诊断，owner 转换传播本次提交 fence，正式终止后仅收缩会话投影而保留完整任务历史。新增隔离自然任务入口，业务结果以实际文件与计算核验，未完成观察保持 UNVERIFIED；实际发布和安装状态以发行证据为准。
 
 - **本地候选修复 — 派生资产新鲜度与默认验证漏检**：刷新 `content/skills/portfolio.json`，并将 `skill-portfolio-current` 纳入 changed/iterative 默认验证不变量，使 clean-tree `npm test` 计划覆盖 portfolio freshness；同步 validation DAG 断言与 Windows 中文文件名负向测试夹具，避免默认验证对派生资产 stale false-green。本项仅为本地源码候选，未 tag、未 publish、未刷新 MCP。
+- **本地候选修复 — 提交后 Profile current truth 与 changed-route 防漏检**：新增轻量 `profile-current` validation node，并将其纳入 changed/iterative 默认验证不变量，使 clean-tree post-commit replay 也会检查 active Profile `ProfileCurrentTruthV1` 是否对齐当前源码 HEAD/source candidate；`profile-governance` 保持边界/综合验证，不被每次 clean changed-route 强制拉起。本项仅为本地源码候选，未 tag、未 publish、未刷新 MCP。
 - **本地候选修复 — 验证入口、产物状态投影与 Profile 当前真相刷新**：收紧 active-root 产物 stale CP 状态检测，避免把“待用户确认是否提交”等非 CP 文案误判为 CP1/CP2 阻断；默认 `test:fast/full/delivery/boundary/profile-deploy/package-release` 改为 `human-cli --plan` 入口并补充 `:ai` 严格变体，避免 Codex/AI 环境缺 `contextEpoch` 时本地 plan 命令误红；新增 `profile-current:refresh` 标准命令，用于更新 active Profile `ProfileCurrentTruthV1` 的当前源码 HEAD 与 source candidate 身份。本项仅为本地源码候选，未 tag、未 publish、未刷新 MCP。
 - **本地候选修复 — 验证入口派生资产与 Profile 边界**：将默认 `test` / `test:changed` / scoped route 入口恢复为执行型验证，新增显式 `test:plan` / `test:*:plan` 作为零执行预览入口，避免 plan-only 被误读为测试已执行；把 `scripts/refresh-profile-current-truth.js` 纳入 profile boundary 与 `profile-governance` 输入闭包，确保修改 Profile current truth refresh 脚本时触发 profile 验证；刷新 `content/skills/portfolio.json`。本项仅为本地源码候选，未 tag、未 publish、未刷新 MCP。
 - **本地候选修复 — 运行态可观测性与历史债务收敛**：`validate.js` 现在对每个 V 探针输出 start/done heartbeat，V7 改为有界 fast-path smoke，避免聚合校验无界卡死；visible reply evidence 绑定当前 promptCount，无 payload 时不再继承旧 precheck；`memory_status` 增加 `summaryCurrentProjection`，显式区分 append-only SUMMARY 历史与当前折叠状态；artifact checker 新增 digest-bound `HistoricalArtifactIssueDispositionV1`，用于精确处置历史 unknown/stale/conflict 产物噪声。本项仅为本地源码候选，未 tag、未 publish、未刷新 MCP。

scripts/test-validation-dag.js

@@ -256,7 +256,7 @@ function run() {
     assert.ok(manifest.criticalInputs.includes('content/**'))
     assert.ok(manifest.criticalInputs.includes('hooks/_runtime/evidence/*.json'))
     assert.ok(!manifest.criticalInputs.includes('content-source/**'))
-    assert.deepStrictEqual(manifest.iterativeInvariantNodes, ['validation-dag', 'skill-portfolio-current'])
+    assert.deepStrictEqual(manifest.iterativeInvariantNodes, ['validation-dag', 'skill-portfolio-current', 'profile-current'])
     assert.ok(manifest.iterativeEscalationInputs.includes('scripts/lib/validation-dag.js'))
     assert.ok(!manifest.iterativeEscalationInputs.includes('content/**'))
     assert.deepStrictEqual(Object.keys(manifest.verificationBoundaries).sort(),
@@ -2235,6 +2235,24 @@ function run() {
       'profile boundary must include profile current truth refresh script')
     assert(manifest.nodes.find(node => node.id === 'profile-governance').inputs.includes('scripts/refresh-profile-current-truth.js'),
       'profile-governance must include profile current truth refresh script')
+    const profileCurrentNode = manifest.nodes.find(node => node.id === 'profile-current')
+    assert(profileCurrentNode, 'manifest must expose lightweight profile-current node')
+    assert.deepStrictEqual(profileCurrentNode.args, ['scripts/validate-all-profiles.js', '--current-only'])
+    assert.strictEqual(profileCurrentNode.riskClass, 'normal')
+    assert.deepStrictEqual(profileCurrentNode.writeScopes, [])
+    assert(manifest.iterativeInvariantNodes.includes('profile-current'),
+      'clean-tree changed-route must include the lightweight Profile current truth invariant')
+    const cleanChangedPlan = planValidation({
+      manifest,
+      route: 'changed',
+      changedFiles: [],
+      changedSource: 'git-clean',
+      candidateId: 'fixture-clean-post-commit'
+    })
+    assert(cleanChangedPlan.selectedNodes.some(node => node.id === 'profile-current'),
+      'clean changed-route must select profile-current to catch post-commit active Profile drift')
+    assert(!cleanChangedPlan.selectedNodes.some(node => node.id === 'profile-governance'),
+      'clean changed-route must not promote every post-commit replay to the heavier profile-governance suite')
     const refreshProfilePlan = planValidation({
       manifest,
       route: 'changed',

scripts/validation-manifest.json

@@ -511,7 +511,8 @@
   ],
   "iterativeInvariantNodes": [
     "validation-dag",
-    "skill-portfolio-current"
+    "skill-portfolio-current",
+    "profile-current"
   ],
   "routes": {
     "fast": {
@@ -4424,6 +4425,48 @@
         "ProfileCurrentTruthV1"
       ]
     },
+    {
+      "schemaVersion": "ValidationNodeV1",
+      "id": "profile-current",
+      "owner": "profile-governance",
+      "command": "node",
+      "args": [
+        "scripts/validate-all-profiles.js",
+        "--current-only"
+      ],
+      "dependencies": [],
+      "inputs": [
+        "scripts/validate-profile.js",
+        "scripts/validate-all-profiles.js",
+        "scripts/lib/profile-current-truth.js",
+        "scripts/refresh-profile-current-truth.js",
+        ".github/workflows/ci.yml",
+        "package.json",
+        "data/templates/profile/**"
+      ],
+      "consumers": [
+        "profile-governance"
+      ],
+      "invariants": [
+        "profile-current-truth-clean-tree-post-commit",
+        "profile-current-truth-single-record"
+      ],
+      "riskClass": "normal",
+      "cachePolicy": "never",
+      "writeScopes": [],
+      "timeoutMs": 60000,
+      "exitMap": {
+        "success": [
+          0
+        ],
+        "failure": "nonzero-or-signal",
+        "timeout": "ETIMEDOUT"
+      },
+      "evidenceArtifacts": [
+        "ValidationExecutionReceiptV1",
+        "ProfileCurrentTruthV1"
+      ]
+    },
     {
       "schemaVersion": "ValidationNodeV1",
       "id": "public-product-expression",