perf: streamline spec-superflow execution and test runtime

changes/fix-full-flow-friction/.spec-superflow.yaml

@@ -0,0 +1,46 @@
+# .spec-superflow.yaml — lightweight state machine
+# Derived data. Always rebuildable from artifacts. Lost/corrupt → fall back to content-level detection.
+
+# === Core state ===
+state: closing
+workflow: full
+revision: 3
+
+# === Hashes (fast staleness detection) ===
+artifacts_hash: sha256:7693e010ec1f533dec4e3af108674c2785f2cb7ded9b089132a45842100834af
+contract_hash: sha256:9381f13b937436653782bc59950653367500be839b92ef9b87a217591fc2f04e
+
+# === Execution progress ===
+execution_mode: sdd
+execution_plan_hash: sha256:e6c2ad664930f4769e76d2fa0319fb1cd5b556a65a46970f41ad7d0b53ff07cf
+execution_plan_revision: 3
+batches_completed: 0
+test_result: pass
+spec_merged: true
+spec_publication_receipt: eyJ2ZXJzaW9uIjoxLCJzb3VyY2VfaGFzaCI6InNoYTI1Njo1ZDI0NmUwNTYzYjViM2FkYWE0ODk1ODRiY2UzYTE4Y2QxOGYzZjM2MDZlODMwMDA5OGEzOGRmZWRhNDA2ZGMwIiwiYmFzZWxpbmVfYmVmb3JlX2hhc2giOiJzaGEyNTY6ODIxM2Q2NTMwZGUxNTQ0ZDJkNTBiNTA4OGJjMzg4YTNiZWMwMjUzYmUzOTU1MDYzNTQ4MjBmZTkxMTlkNTNiNCIsImJhc2VsaW5lX2FmdGVyX2hhc2giOiJzaGEyNTY6OTBkOTljNDhhZmI4ZDM5MGFmN2I0NTk1NzcyNDQ0MGY1NWVjN2JkNWJmZDM3MTFlMzQyMzFkYTRhMjlkMWRiNCIsImNhcGFiaWxpdGllcyI6WyJzZGQtZXhlY3V0aW9uLWNvbnRyb2wiLCJzcGVjLXB1YmxpY2F0aW9uIiwidGVzdC1kaXNjaXBsaW5lIiwid29ya2Zsb3ctcm91dGluZyIsIndvcmt0cmVlLWlzb2xhdGlvbiJdfQ
+
+# === Metadata ===
+change_name: fix-full-flow-friction
+last_transition: 2026-07-31T15:37:13.796Z
+last_transition_from: executing
+last_transition_to: closing
+
+# === Decision points ===
+dp_0_decisions: scope=修复隔离 worktree、审查回执初始化、Delta 基线预检、状态哈希同步与默认测试并发；constraints=兼容现有 CLI、多平台与 Node 20；artifact_language=zh-CN；workflow_path=full；recommended=full；communication=自动推进并报告门禁
+dp_0_result: confirmed
+dp_0_confirmed: true
+dp_0_timestamp: 2026-07-31T13:42:35Z
+dp_1_result: null
+dp_1_timestamp: null
+dp_2_result: approved: user confirmed adding npm test concurrent-stall diagnosis and repair to this change
+dp_2_timestamp: 2026-07-31T15:05:00Z
+dp_3_result: approved: user confirmed the updated contract including controlled default test concurrency
+dp_3_timestamp: 2026-07-31T15:05:00Z
+dp_4_result: sdd: plan revision 3; user-confirmed-revision; 完成任务记录补充全量验证证据；范围和实现不变，刷新当前执行计划哈希
+dp_4_timestamp: 2026-07-31T15:24:36.454Z
+dp_5_result: null
+dp_5_timestamp: null
+dp_6_result: pass: post-sync npm test completed 630/630 with --test-concurrency=2 in 388 seconds
+dp_6_timestamp: 2026-07-31T15:35:00Z
+dp_7_result: confirmed: delta specs published, wave-1 review passed, and post-sync full regression passed
+dp_7_timestamp: 2026-07-31T15:35:00Z

changes/fix-full-flow-friction/.superpowers/sdd/execution-plan.json

@@ -0,0 +1,97 @@
+{
+  "mode": "sdd",
+  "source": "user-confirmed-revision",
+  "rationale": "完成任务记录补充全量验证证据；范围和实现不变，刷新当前执行计划哈希",
+  "waves": [
+    {
+      "id": "wave-1",
+      "strategy": "serial",
+      "tasks": [
+        "1.1",
+        "1.2",
+        "2.1",
+        "2.2",
+        "2.3",
+        "3.1",
+        "3.2"
+      ],
+      "depends_on": []
+    }
+  ],
+  "artifacts_hash": "sha256:7693e010ec1f533dec4e3af108674c2785f2cb7ded9b089132a45842100834af",
+  "contract_hash": "sha256:9381f13b937436653782bc59950653367500be839b92ef9b87a217591fc2f04e",
+  "workflow": "full",
+  "revision": 3,
+  "recommendation": {
+    "available_modes": [
+      "inline",
+      "batch-inline",
+      "sdd"
+    ],
+    "recommendation": {
+      "mode": "sdd",
+      "reasons": [
+        "The 7 tasks exceed the configured inline threshold of 3."
+      ]
+    },
+    "facts": {
+      "workflow": "full",
+      "documented_task_count": 7,
+      "planned_task_count": 7,
+      "planned_wave_count": 1,
+      "has_parallel_wave": false,
+      "inline_threshold": 3
+    }
+  },
+  "recommendation_receipt": {
+    "recommendation": {
+      "available_modes": [
+        "inline",
+        "batch-inline",
+        "sdd"
+      ],
+      "recommendation": {
+        "mode": "sdd",
+        "reasons": [
+          "The 7 tasks exceed the configured inline threshold of 3."
+        ]
+      },
+      "facts": {
+        "workflow": "full",
+        "documented_task_count": 7,
+        "planned_task_count": 7,
+        "planned_wave_count": 1,
+        "has_parallel_wave": false,
+        "inline_threshold": 3
+      }
+    },
+    "waves": [
+      {
+        "id": "wave-1",
+        "strategy": "serial",
+        "tasks": [
+          "1.1",
+          "1.2",
+          "2.1",
+          "2.2",
+          "2.3",
+          "3.1",
+          "3.2"
+        ],
+        "depends_on": []
+      }
+    ],
+    "artifacts_hash": "sha256:7693e010ec1f533dec4e3af108674c2785f2cb7ded9b089132a45842100834af",
+    "contract_hash": "sha256:9381f13b937436653782bc59950653367500be839b92ef9b87a217591fc2f04e",
+    "workflow": "full",
+    "execution_plan_revision_at_recommendation": 2,
+    "created_at": "2026-07-31T15:24:36.256Z",
+    "hash": "sha256:64f1ce0bb9c6bc9049e7ca08742bd3b27797c2e75505045f2e02c489e2b07580"
+  },
+  "selection": {
+    "confirmed": true,
+    "followed_recommendation": true,
+    "acknowledged_non_recommendation": false
+  },
+  "hash": "sha256:e6c2ad664930f4769e76d2fa0319fb1cd5b556a65a46970f41ad7d0b53ff07cf"
+}

changes/fix-full-flow-friction/.superpowers/sdd/execution-recommendation.json

@@ -0,0 +1,45 @@
+{
+  "recommendation": {
+    "available_modes": [
+      "inline",
+      "batch-inline",
+      "sdd"
+    ],
+    "recommendation": {
+      "mode": "sdd",
+      "reasons": [
+        "The 7 tasks exceed the configured inline threshold of 3."
+      ]
+    },
+    "facts": {
+      "workflow": "full",
+      "documented_task_count": 7,
+      "planned_task_count": 7,
+      "planned_wave_count": 1,
+      "has_parallel_wave": false,
+      "inline_threshold": 3
+    }
+  },
+  "waves": [
+    {
+      "id": "wave-1",
+      "strategy": "serial",
+      "tasks": [
+        "1.1",
+        "1.2",
+        "2.1",
+        "2.2",
+        "2.3",
+        "3.1",
+        "3.2"
+      ],
+      "depends_on": []
+    }
+  ],
+  "artifacts_hash": "sha256:7693e010ec1f533dec4e3af108674c2785f2cb7ded9b089132a45842100834af",
+  "contract_hash": "sha256:9381f13b937436653782bc59950653367500be839b92ef9b87a217591fc2f04e",
+  "workflow": "full",
+  "execution_plan_revision_at_recommendation": 2,
+  "created_at": "2026-07-31T15:24:36.256Z",
+  "hash": "sha256:64f1ce0bb9c6bc9049e7ca08742bd3b27797c2e75505045f2e02c489e2b07580"
+}

changes/fix-full-flow-friction/.superpowers/sdd/plans/r1-c60fb2e941c76d37c98dfcd724e7dba7b60417307685a922d176303b951e96ce/repair-state/d2F2ZS0x.json

@@ -0,0 +1,24 @@
+{
+  "plan_hash": "sha256:c60fb2e941c76d37c98dfcd724e7dba7b60417307685a922d176303b951e96ce",
+  "plan_revision": 1,
+  "wave_id": "wave-1",
+  "status": "resolved",
+  "failure_count": 1,
+  "previous_head": "5df08a5ea28a81f190d9242663c83f1f7af3ef0e",
+  "previous_report": ".superpowers/sdd/reviews/wave-1.md",
+  "failures": [
+    {
+      "base": "91050984126a87821faee887e5ee612337498233",
+      "head": "08f67cf810c1ea2c50b77cbbe504a1ac4430d803",
+      "report": ".superpowers/sdd/reviews/wave-1.md",
+      "recorded_at": "2026-07-31T14:02:35.613Z"
+    }
+  ],
+  "resolution": {
+    "base": "08f67cf810c1ea2c50b77cbbe504a1ac4430d803",
+    "head": "5df08a5ea28a81f190d9242663c83f1f7af3ef0e",
+    "report": ".superpowers/sdd/reviews/wave-1-rereview.md",
+    "recorded_at": "2026-07-31T14:03:56.532Z"
+  },
+  "updated_at": "2026-07-31T14:03:56.535Z"
+}

changes/fix-full-flow-friction/.superpowers/sdd/plans/r1-c60fb2e941c76d37c98dfcd724e7dba7b60417307685a922d176303b951e96ce/reviews/d2F2ZS0x.json

@@ -0,0 +1,10 @@
+{
+  "status": "pass",
+  "base": "08f67cf810c1ea2c50b77cbbe504a1ac4430d803",
+  "head": "5df08a5ea28a81f190d9242663c83f1f7af3ef0e",
+  "report": ".superpowers/sdd/reviews/wave-1-rereview.md",
+  "report_sha256": "sha256:f5ab4820492d9d9f1d59297153a494872f0eea02c5a36e688ba83950426a2e5c",
+  "plan_hash": "sha256:c60fb2e941c76d37c98dfcd724e7dba7b60417307685a922d176303b951e96ce",
+  "plan_revision": 1,
+  "recorded_at": "2026-07-31T14:03:56.532Z"
+}

changes/fix-full-flow-friction/.superpowers/sdd/reviews/d2F2ZS0x.json

@@ -0,0 +1,10 @@
+{
+  "status": "pass",
+  "base": "bd6d2848785538e1f4159bc7dbc724ba0ed0a615",
+  "head": "2e47381342371e9dbf1f56c1e175d88c7683d426",
+  "report": ".superpowers/sdd/reviews/wave-1-final-review.md",
+  "report_sha256": "sha256:4321285c563404c0da5cc90a44eb407d13eaed136cbc9b29b8ed9775c35cedb5",
+  "plan_hash": "sha256:e6c2ad664930f4769e76d2fa0319fb1cd5b556a65a46970f41ad7d0b53ff07cf",
+  "plan_revision": 3,
+  "recorded_at": "2026-07-31T15:28:59.246Z"
+}

changes/fix-full-flow-friction/.superpowers/sdd/reviews/wave-1-final-review.md

@@ -0,0 +1,32 @@
+# Wave 1 最终审查报告
+
+- wave：`wave-1`
+- base：`bd6d284`
+- head：`2e47381`
+- verdict：`pass`
+
+## 范围
+
+复核默认 `npm test` 的受控并发、Node 20 入口测试、guard 夹具、审查报告位置/回执合同，以及 `fix-full-flow-friction` 的执行合同和 Delta 规格。
+
+## 结论
+
+此前发现的 Important 已关闭：`changes/fix-full-flow-friction/specs/test-discipline/spec.md` 已由提交 `2e47381` 追踪，明确要求保留既有 E2E 与库测试集合并固定 `--test-concurrency=2`。`package.json` 与入口测试落实该要求；执行计划为当前 revision 3，旧 revision 的回执不会被当作当前回执。未发现 Critical、Important 或 Minor 问题。
+
+## 验证
+
+- `node --test tests/lib/node20-test-entry.test.mjs`：1/1 通过。
+- `node --test tests/lib/execution-plan.test.mjs --test-name-pattern='review|receipt|overlay'`：27/27 通过。
+- `node --test tests/lib/guard.test.mjs`：37/37 通过。
+- `node scripts/spec-superflow.mjs validate changes/fix-full-flow-friction`：通过。
+- `node scripts/spec-superflow.mjs execution show changes/fix-full-flow-friction --json`：当前 revision 3 计划有效，wave-1 等待本次回执。
+
+## 分级发现
+
+- Critical：无。
+- Important：无。
+- Minor：无。
+
+```bash
+ssf execution review changes/fix-full-flow-friction --wave wave-1 --base bd6d284 --head 2e47381 --report .superpowers/sdd/reviews/wave-1-final-review.md --verdict pass
+```

changes/fix-full-flow-friction/.superpowers/sdd/reviews/wave-1-rereview.md

@@ -0,0 +1,38 @@
+# Wave 1 聚焦复审报告
+
+- wave：`wave-1`
+- 范围：`08f67cf..5df08a5`
+- verdict: pass
+
+## 复审结论
+
+先前的 Important 问题已修复。`isSafePathSegment` 拒绝空值、`.`、`..`、路径分隔符和控制字符，且在生成 `worktreePath` 前执行（`scripts/ensure-branch.mjs:34-40, 73-76`）。因此 `../../outside` 不会再经 `join()` 规范化后逃逸仓库旁的目标命名空间。
+
+正常场景仍保持：安全名称 `planned-change` 继续创建同级 worktree，并将 active change 工件复制到相同仓库相对路径（`scripts/ensure-branch.mjs:77-96`）。
+
+## 分级发现
+
+### Critical
+
+无。
+
+### Important
+
+无。
+
+### Minor
+
+无。
+
+## 测试证据
+
+- 通过：`node --test tests/lib/ensure-branch.test.mjs`（4/4）。
+- 覆盖正常同级 worktree 与 active change 复制：`tests/lib/ensure-branch.test.mjs:59-75`。
+- 覆盖此前的路径逃逸输入：`tests/lib/ensure-branch.test.mjs:77-86`。
+- 通过：`git diff --check 08f67cf..5df08a5`。
+
+**Ready to merge?** Yes。
+
+```bash
+ssf execution review changes/fix-full-flow-friction --wave wave-1 --base 08f67cf --head 5df08a5 --report .superpowers/sdd/reviews/wave-1-rereview.md --verdict pass
+```

changes/fix-full-flow-friction/.superpowers/sdd/reviews/wave-1.md

@@ -0,0 +1,45 @@
+# Wave 1 审查报告
+
+- wave：`wave-1`
+- 范围：`9105098..08f67cf`
+- 合同：[execution-contract.md](../../../execution-contract.md)
+- verdict: fail
+
+## Strengths
+
+- 隔离工作树现在从 Git 仓库根目录计算相邻路径，并只复制 active change；实测已提交目录上有未提交工件时，目标工作树得到更新后的工件内容，未复制无关文件（`scripts/ensure-branch.mjs:50-83`）。
+- `writePlan` 与 `recordReview` 均会初始化 review overlay，避免第一次写回执需要人工建目录（`scripts/lib/execution-plan.mjs:40-56, 129-133`）。
+- Delta 预检复用发布实现，且仅对标准 `changes/<name>` 布局启用，保留独立夹具的验证兼容性（`scripts/lib/cmd-validate.mjs:26-42, 87-103`）。
+- 状态转换在写入前刷新 artifact 与 contract hash，修复了转换后立即 `state check` 不一致的问题（`scripts/lib/cmd-state.mjs:173-179`）。
+
+## Issues
+
+### Critical
+
+无。
+
+### Important
+
+1. `scripts/ensure-branch.mjs:65-66` — `changeName` 被直接拼接进 worktree 路径，未拒绝路径分隔符或 `..`。例如 `join('/tmp', 'repo-../../outside')` 的结果为 `/tmp/outside`，因此 `node scripts/ensure-branch.mjs changes/x ../../outside` 可把 worktree 放到并非仓库相邻命名空间的位置，违背合同中“位于仓库旁”的保证，也可能与用户已有目录冲突。
+   - 修复：将 name 限制为单个安全路径段（拒绝 `.`、`..`、`/`、`\\`、NUL），或对路径解析后校验 `dirname(worktreePath) === dirname(repoRoot)`；同时为 `../../outside` 增加拒绝型回归测试。
+
+### Minor
+
+无。
+
+## Test Evidence
+
+- 通过：`node --test tests/lib/ensure-branch.test.mjs tests/lib/execution-plan.test.mjs tests/lib/cmd-validate-paths.test.mjs tests/lib/cmd-state.test.mjs`
+- 通过：`npm run build && npm test`（由本轮前的独立审查执行；本次快速复审未重复运行）。
+- 通过：`git diff --check 9105098..08f67cf`。
+- 手工复现：已提交 active change 加未提交覆盖内容后执行 isolate，目标 worktree 的同路径文件内容为未提交版本；验证了正常复制路径。
+
+## Assessment
+
+**Ready to merge?** No。
+
+唯一 Important 问题位于此次 P0 隔离路径修复的核心边界；需先限制 `changeName`，并以专项测试证明不能逃逸目标父目录，再记录通过回执。
+
+```bash
+ssf execution review changes/fix-full-flow-friction --wave wave-1 --base 9105098 --head 08f67cf --report .superpowers/sdd/reviews/wave-1.md --verdict fail
+```