持久化占位复检失败诊断并撤回历史修复权限

Author: loong10k

crates/codeguard-cli/src/c_family_placeholder_task_recheck.rs

@@ -15,6 +15,8 @@ const EXTRA: &[&str] = &[
     "task_rule",
     "original_ref",
     "input_stable",
+    "placeholder_observation_status",
+    "placeholder_observation_reason",
 ];
 
 fn reference(brief: &Value) -> Value {
@@ -184,11 +186,23 @@ pub(crate) fn run(root: &Path, brief: &Value, deadline: Instant) -> Result<Value
         structure["reason"] = json!("clang_execution_incomplete");
         structure["observation"] = Value::Null;
     }
-    if !complete || structure["status"] != "observed" || placeholders["status"] != "observed" {
-        return Err("clang_placeholder_recheck_incomplete");
-    }
     let mut r = first.clone();
-    r["placeholders"] = placeholders["observation"].clone();
+    let observed =
+        complete && structure["status"] == "observed" && placeholders["status"] == "observed";
+    r["schema_version"] = json!("0.2.0");
+    r["placeholder_observation_status"] = json!(if observed { "observed" } else { "incomplete" });
+    r["placeholder_observation_reason"] = if observed {
+        json!("clang_placeholder_observed")
+    } else if !complete {
+        json!("clang_execution_incomplete")
+    } else {
+        placeholders["reason"].clone()
+    };
+    r["placeholders"] = if observed {
+        placeholders["observation"].clone()
+    } else {
+        Value::Null
+    };
     r["report_type"] = json!("clang_documentation_placeholder_task_recheck");
     r["run_id"] = json!(format!(
         "clangdocplaceholder-{}-{}-{}",
@@ -206,7 +220,7 @@ pub(crate) fn run(root: &Path, brief: &Value, deadline: Instant) -> Result<Value
     r["task_kind"] = json!("finding");
     r["task_rule"] = json!(contract::RULE);
     r["original_ref"] = reference(brief);
-    r["input_stable"] = json!(contract::current(root, &normal(&r)) && tool_current(&first));
+    r["input_stable"] = json!(normal_inputs_current(root, &normal(&r)) && tool_current(&first));
     if !valid_shape(root, &r) {
         return Err("clang_placeholder_recheck_invalid");
     }
@@ -219,23 +233,74 @@ pub(crate) fn normal(r: &Value) -> Value {
         for k in EXTRA {
             o.remove(*k);
         }
+        o.insert("schema_version".into(), json!("0.1.0"));
         o.insert(
             "report_type".into(),
             json!("clang_documentation_placeholder_workbench_observation"),
         );
     }
     n
 }
+/// 校验规范化的当前观察；失败只能携带空占位数据，不会成为干净候选。
+pub(crate) fn valid_normal_shape(r: &Value) -> bool {
+    if r["placeholders"].is_null() {
+        r.is_object()
+            && r["report_type"] == "clang_documentation_placeholder_workbench_observation"
+            && r["profile"] == "clang-documentation-placeholder-v1"
+            && r["run_id"]
+                .as_str()
+                .is_some_and(|s| s.starts_with("clangdocplaceholder-"))
+            && crate::work_sync::c_family_structure_report::valid_shape(
+                &contract::structure_packet(r),
+            )
+    } else {
+        contract::valid_shape(r)
+    }
+}
+/// 检查失败观察的源码与底层结构关联；没有占位数据时不验证任何旧占位位置。
+pub(crate) fn normal_inputs_current(root: &Path, r: &Value) -> bool {
+    valid_normal_shape(r)
+        && if r["placeholders"].is_null() {
+            crate::work_sync::c_family_structure_report::current(
+                root,
+                &contract::structure_packet(r),
+            )
+        } else {
+            contract::current(root, r)
+        }
+}
 /// 绑定首次报告、原策略及开放任务；拒绝额外字段与身份篡改。
 pub(crate) fn valid_shape(root: &Path, r: &Value) -> bool {
-    if !r
-        .as_object()
-        .is_some_and(|o| o.len() == 23 && EXTRA.iter().all(|k| o.contains_key(*k)))
-        || r["report_type"] != "clang_documentation_placeholder_task_recheck"
+    if !r.as_object().is_some_and(|o| {
+        if r["schema_version"] == "0.1.0" {
+            o.len() == 23 && EXTRA[..5].iter().all(|k| o.contains_key(*k))
+        } else {
+            r["schema_version"] == "0.2.0"
+                && o.len() == 25
+                && EXTRA.iter().all(|k| o.contains_key(*k))
+        }
+    }) || r["report_type"] != "clang_documentation_placeholder_task_recheck"
         || r["task_kind"] != "finding"
         || r["task_rule"] != contract::RULE
         || !r["input_stable"].is_boolean()
-        || !contract::valid_shape(&normal(r))
+        || (r["schema_version"] == "0.1.0" && !contract::valid_shape(&normal(r)))
+        || !valid_normal_shape(&normal(r))
+        || (r["schema_version"] == "0.2.0"
+            && !((r["placeholder_observation_status"] == "observed"
+                && r["placeholder_observation_reason"] == "clang_placeholder_observed"
+                && contract::valid_shape(&normal(r)))
+                || (r["placeholder_observation_status"] == "incomplete"
+                    && r["placeholders"].is_null()
+                    && matches!(
+                        r["placeholder_observation_reason"].as_str(),
+                        Some(
+                            "clang_placeholder_unavailable"
+                                | "clang_placeholder_report_invalid"
+                                | "clang_source_changed"
+                                | "request_cancelled"
+                                | "clang_execution_incomplete"
+                        )
+                    ))))
     {
         return false;
     }
@@ -270,16 +335,17 @@ pub(crate) fn valid_shape(root: &Path, r: &Value) -> bool {
 /// 持久化前重新核对当前源码和原工具，防止竞态变成完整复检。
 pub(crate) fn inputs_current(root: &Path, r: &Value) -> bool {
     valid_shape(root, r)
-        && contract::current(root, &normal(r))
+        && normal_inputs_current(root, &normal(r))
         && original(root, &r["original_ref"]).is_ok_and(|first| tool_current(&first))
-        && tool_current(r)
+        && (r["native"]["tool_sha256"].is_null() || tool_current(r))
 }
 /// 分类占位组件局部结果，未知或失稳不得变成消失或可信关闭。
 pub(crate) fn classify(brief: &Value, r: &Value) -> &'static str {
     if r["task_id"] != brief["task_id"]
         || r["input_stable"] != true
         || r["local_scan_complete"] != true
         || r["structure"]["status"] != "observed"
+        || r["placeholders"].is_null()
     {
         "incomplete"
     } else if contract::positions(&normal(r)).is_empty() {

crates/codeguard-cli/src/next_command.rs

@@ -2445,7 +2445,7 @@ fn run_sequence(run_id: &str) -> Option<u128> {
 
 fn view(disposition: &str, reason: &str, brief: Value, actions: Value) -> Value {
     json!({
-        "schema_version":if brief["schema_version"] == "0.35.0" {json!("0.35.0")}else if brief["schema_version"] == "0.34.0" {json!("0.34.0")}else if brief["schema_version"] == "0.33.0" {json!("0.33.0")}else if brief["schema_version"] == "0.32.0" {json!("0.32.0")}else if brief["schema_version"] == "0.31.0" {json!("0.31.0")}else if brief["schema_version"] == "0.30.0" {json!("0.30.0")}else if brief["schema_version"] == "0.29.0" {json!("0.29.0")}else if brief["schema_version"] == "0.28.0" {json!("0.28.0")}else if brief["schema_version"] == "0.27.0" {json!("0.27.0")}else if brief["schema_version"] == "0.26.0" {json!("0.26.0")}else if brief["schema_version"] == "0.25.0" {json!("0.25.0")}else if brief["schema_version"] == "0.24.0" {json!("0.24.0")}else if brief["schema_version"] == "0.23.0" {json!("0.23.0")}else if brief["schema_version"] == "0.22.0" {json!("0.22.0")}else if brief["schema_version"] == "0.21.0" {json!("0.21.0")}else if brief["schema_version"] == "0.20.0" {json!("0.20.0")}else if brief["checker_id"] == "shell.shellcheck" {json!("0.17.0")} else if brief["checker_id"] == "go.vet" {json!("0.13.0")} else if brief["checker_id"] == "syntax.native_confirmation" {brief["schema_version"].clone()} else {json!("0.1.0")}, "report_type":"repair_brief_preview",
+        "schema_version":if brief["schema_version"] == "0.36.0" {json!("0.36.0")}else if brief["schema_version"] == "0.35.0" {json!("0.35.0")}else if brief["schema_version"] == "0.34.0" {json!("0.34.0")}else if brief["schema_version"] == "0.33.0" {json!("0.33.0")}else if brief["schema_version"] == "0.32.0" {json!("0.32.0")}else if brief["schema_version"] == "0.31.0" {json!("0.31.0")}else if brief["schema_version"] == "0.30.0" {json!("0.30.0")}else if brief["schema_version"] == "0.29.0" {json!("0.29.0")}else if brief["schema_version"] == "0.28.0" {json!("0.28.0")}else if brief["schema_version"] == "0.27.0" {json!("0.27.0")}else if brief["schema_version"] == "0.26.0" {json!("0.26.0")}else if brief["schema_version"] == "0.25.0" {json!("0.25.0")}else if brief["schema_version"] == "0.24.0" {json!("0.24.0")}else if brief["schema_version"] == "0.23.0" {json!("0.23.0")}else if brief["schema_version"] == "0.22.0" {json!("0.22.0")}else if brief["schema_version"] == "0.21.0" {json!("0.21.0")}else if brief["schema_version"] == "0.20.0" {json!("0.20.0")}else if brief["checker_id"] == "shell.shellcheck" {json!("0.17.0")} else if brief["checker_id"] == "go.vet" {json!("0.13.0")} else if brief["checker_id"] == "syntax.native_confirmation" {brief["schema_version"].clone()} else {json!("0.1.0")}, "report_type":"repair_brief_preview",
         "operation":"next", "command_status":"complete", "exit_code":0,
         "disposition":disposition, "reason":reason,
         "repair_brief":brief, "next_actions":actions,

crates/codeguard-cli/src/next_command/c_family_placeholder_candidate.rs

@@ -1,7 +1,7 @@
 //! 占位文件任务绑定首次报告、收据、当前输入及受控尝试；局部复检不授予可信关闭。
 use super::Candidate;
 use crate::work_sync::c_family_placeholder_report::{
-    checker, current, fingerprint, positions, valid_shape, RULE,
+    checker, fingerprint, positions, valid_shape, RULE,
 };
 use serde_json::{Value, json};
 use sha2::{Digest, Sha256};
@@ -21,13 +21,19 @@ fn read(root: &Path, run: &str, digest: Option<&str>) -> Result<Value, &'static
     }
     let mut r = codeguard_adapters::parse_unique_json(&bytes)
         .map_err(|_| "clang_placeholder_origin_invalid")?;
-    if r["report_type"] == "clang_documentation_placeholder_task_recheck" {
+    let recheck = r["report_type"] == "clang_documentation_placeholder_task_recheck";
+    if recheck {
         if !crate::c_family_placeholder_task_recheck::valid_shape(root, &r) {
             return Err("clang_placeholder_recheck_invalid");
         }
         r = crate::c_family_placeholder_task_recheck::normal(&r);
     }
-    if !valid_shape(&r) || r["run_id"] != run {
+    if !(if recheck {
+        crate::c_family_placeholder_task_recheck::valid_normal_shape(&r)
+    } else {
+        valid_shape(&r)
+    }) || r["run_id"] != run
+    {
         return Err("clang_placeholder_origin_invalid");
     }
     let expected=serde_json::to_vec_pretty(&json!({"schema_version":"0.1.0","workspace_id":r["workspace_id"],"run_id":run,"report_sha256":hash})).map_err(|_|"clang_placeholder_marker_invalid")?;
@@ -107,11 +113,16 @@ pub(super) fn candidate(root: &Path, id: &str, fact: &Value) -> Result<Candidate
         .is_some_and(|b| first["native"]["tool_sha256"] == format!("{:x}", Sha256::digest(b)));
     let context = latest["selected_tool"] == first["selected_tool"]
         && latest["standard"] == first["standard"]
-        && latest["native"]["tool_sha256"] == first["native"]["tool_sha256"];
+        && (latest["native"]["tool_sha256"] == first["native"]["tool_sha256"]
+            || (latest["placeholders"].is_null() && latest["native"]["tool_sha256"].is_null()));
     let status = if !context {
         "original_context_changed"
-    } else if !tool_current || !current(root, &latest) {
+    } else if !tool_current
+        || !crate::c_family_placeholder_task_recheck::normal_inputs_current(root, &latest)
+    {
         "input_changed"
+    } else if latest["placeholders"].is_null() {
+        "native_placeholder_incomplete"
     } else if positions(&latest).is_empty() {
         "candidate_absent_unverified_policy"
     } else {
@@ -128,7 +139,13 @@ pub(super) fn candidate(root: &Path, id: &str, fact: &Value) -> Result<Candidate
         first["selected_tool"],
         "--format=json"
     ]);
-    let mut brief = json!({"schema_version":"0.35.0","task_id":id,"kind":"finding","checker_id":checker(&first),"scope":first["path"],"source_sha256":latest["source_sha256"],"placeholder_rule_id":RULE,"rule_source":"codeguard_structural_policy","evidence_ref":{"first_run_id":run,"first_report_sha256":digest},"current_run_id":latest["run_id"],"observation_status":status,"placeholder_positions":if actionable {positions(&latest)}else{Vec::new()},"rule_basis":"整个用途、参数或适用返回说明仅为明确占位标记，不等于API契约说明；本规则不是Clang警告或完整语义准确性证明。","constraints":["仅修改当前文件文档注释，保留API及行为","以当前字节位置核对各占位组件，不按函数名字单独匹配","不关闭检查器、不以占位文本或白名单自批代替修复"],"allowed_paths":if actionable {json!([first["path"]])}else{json!([])},"affected_paths":[first["path"]],"disposition":if actionable {"actionable"}else{"needs_decision"},"reason_code":status,"step":["按所有当前函数字节/行列证据，依据真实声明和行为替换占位组件为真实用途、契约和行为说明。","使用绑定原工具、标准与工作区的task verify复检；未知或失稳时先诊断，不按旧位置改源码。"],"recheck_argv":argv,"closure_condition":"原命令局部复扫不关闭；专用task verify记录局部观察；仍须跨输入语义无进展、完整详细准确性/项目覆盖与可信关闭/复发验收。","authority":"local_unverified","delivery_decision":"not_evaluated"});
+    let mut brief = json!({"schema_version":"0.36.0","task_id":id,"kind":"finding","checker_id":checker(&first),"scope":first["path"],"source_sha256":latest["source_sha256"],"placeholder_rule_id":RULE,"rule_source":"codeguard_structural_policy","evidence_ref":{"first_run_id":run,"first_report_sha256":digest},"current_run_id":latest["run_id"],"observation_status":status,"placeholder_positions":if actionable {positions(&latest)}else{Vec::new()},"rule_basis":"整个用途、参数或适用返回说明仅为明确占位标记，不等于API契约说明；本规则不是Clang警告或完整语义准确性证明。","constraints":["仅修改当前文件文档注释，保留API及行为","以当前字节位置核对各占位组件，不按函数名字单独匹配","不关闭检查器、不以占位文本或白名单自批代替修复"],"allowed_paths":if actionable {json!([first["path"]])}else{json!([])},"affected_paths":[first["path"]],"disposition":if actionable {"actionable"}else{"needs_decision"},"reason_code":status,"step":["按所有当前函数字节/行列证据，依据真实声明和行为替换占位组件为真实用途、契约和行为说明。","使用绑定原工具、标准与工作区的task verify复检；未知或失稳时先诊断，不按旧位置改源码。"],"recheck_argv":argv,"closure_condition":"原命令局部复扫不关闭；专用task verify记录局部观察；仍须跨输入语义无进展、完整详细准确性/项目覆盖与可信关闭/复发验收。","authority":"local_unverified","delivery_decision":"not_evaluated"});
+    if status == "native_placeholder_incomplete" {
+        brief["step"] = json!([
+            "读取current_run_id绑定的native诊断和占位失败原因，先处理具体检查阻塞；语法诊断使用对应语法修复流程。",
+            "恢复原工具检查条件并执行task verify；不得按历史占位定位修改源码，不得关闭检查器或自批白名单。"
+        ]);
+    }
     brief["action_id"] = json!(super::canonical_action_id(&brief)?);
     let history = crate::task_attempt_command::attempt_history(root, id, &brief)?;
     let mut priority = if actionable { 1 } else { 0 };

crates/codeguard-cli/src/task_verify_command.rs

@@ -971,7 +971,7 @@ pub fn run(args: &[String]) -> ExitCode {
         });
     }
     if c_placeholder_task {
-        report["schema_version"] = json!("0.38.0");
+        report["schema_version"] = json!("0.39.0");
     }
     if c_structure_task {
         report["schema_version"] = json!("0.37.0");
@@ -1038,7 +1038,11 @@ pub fn run(args: &[String]) -> ExitCode {
     }
     let persist = if codeguard_runtime::sigint_cancellation_requested() {
         Err("request_cancelled")
-    } else if Instant::now() >= deadline {
+    } else if Instant::now() >= deadline
+        && !(c_placeholder_task
+            && scan["schema_version"] == "0.2.0"
+            && scan["placeholder_observation_status"] == "incomplete")
+    {
         Err("request_deadline_exceeded")
     } else {
         match lock_verification(&root, &parsed.task_id, &lease) {

crates/codeguard-cli/src/work_sync.rs

@@ -635,6 +635,23 @@ fn parse_report(
         if !crate::c_family_placeholder_task_recheck::valid_shape(root, report) {
             return Err("clang_placeholder_recheck_invalid");
         }
+        if report["placeholders"].is_null() {
+            let run = report["run_id"].as_str().ok_or("report_run_id_invalid")?;
+            if report["workspace_id"] != workspace_id
+                || path.file_stem().and_then(|s| s.to_str()) != Some(run)
+            {
+                return Err("clang_placeholder_recheck_invalid");
+            }
+            // 不完整复检只消费脱敏诊断和事件，不制造结构/占位违规，也不关闭原事实。
+            return Ok(ReportInput {
+                workspace_id: workspace_id.into(),
+                run_id: run.into(),
+                digest,
+                findings: Vec::new(),
+                blockers: Vec::new(),
+                historical_findings: 0,
+            });
+        }
         return c_family_placeholder_report::parse(
             root,
             workspace_id,

crates/codeguard-cli/src/work_sync/c_family_placeholder_report.rs

@@ -7,7 +7,7 @@ use std::path::{Path, PathBuf};
 /// 占位描述自有规则，与原生警告及缺失组件策略保持不同身份。
 pub(crate) const RULE: &str = "codeguard.documentation.placeholder_description";
 
-fn structure_packet(report: &Value) -> Value {
+pub(crate) fn structure_packet(report: &Value) -> Value {
     let mut packet = report.clone();
     if let Some(object) = packet.as_object_mut() {
         object.remove("placeholders");

crates/codeguard-cli/src/workspace_view_command.rs

@@ -165,7 +165,7 @@ pub fn run_show(args: &[String]) -> ExitCode {
         Some("c.clang.documentation" | "cpp.clang.documentation")
     );
     // 首次原生确认必须保留简报绑定的工具选择参数，避免外层动作丢失必要输入。
-    let next_actions = if brief["schema_version"] == "0.35.0"
+    let next_actions = if matches!(brief["schema_version"].as_str(), Some("0.35.0" | "0.36.0"))
         || c_structure
         || c_documentation
         || brief["checker_id"] == "shell.shellcheck"
@@ -178,7 +178,7 @@ pub fn run_show(args: &[String]) -> ExitCode {
         json!([["codeguard", "task", "verify", id, "."]])
     };
     let report = json!({
-        "schema_version":if brief["schema_version"] == "0.35.0" {"0.8.0"}else if c_structure {"0.7.0"}else if c_documentation {"0.4.0"}else if brief["checker_id"] == "shell.shellcheck" {"0.3.0"}else if brief["schema_version"] == "0.12.0" {"0.2.0"}else{"0.1.0"},"report_type":"task_show_preview",
+        "schema_version":if brief["schema_version"] == "0.36.0" {"0.9.0"}else if brief["schema_version"] == "0.35.0" {"0.8.0"}else if c_structure {"0.7.0"}else if c_documentation {"0.4.0"}else if brief["checker_id"] == "shell.shellcheck" {"0.3.0"}else if brief["schema_version"] == "0.12.0" {"0.2.0"}else{"0.1.0"},"report_type":"task_show_preview",
         "operation":"task_show","request_id":request_id(),"command_status":"complete","exit_code":0,
         "task_id":id,"task":brief,"state":"open",
         "evidence_freshness":"unverified","event_chain_status":"unverified",