feat: check:* 防线注册表 + ADR-0012——ADR-0011 遗留项清零（配套 .github#16）

[randypanding]

解决什么

ADR-0011(team-collaboration) 的两项遗留全部清零，不留到后面：

1. team.schema（L0）destroy_condition + re-check-sample → 跨仓 Cloudbird-Software/.github#16（v1→v2；jsonschema 实测：v1 下三实例 13 处不符，v2 全 PASS）
2. check: CI 名注册表化* → 本 PR

变更

check:* 注册表（standards/checks.yaml 新建）

登记 9 项 check（gate / intent-ratified / test-tree-freeze / pr-identity-path-matrix / adr-required / rollback-plan-required / flag-enable-owner-only / retro-debt-aging / precedent-non-normative），每项 status: active|planned + where（实现或计划位置）。

validate.py 两向校验（fail-closed，与词表/ct-coverage 同模式）

• 正向：standards/ 与 registry/ 一切 check:<id> 引用必须 ∈ 注册表——未登记 = 悬空防线 = CI 拒绝。文本级扫描（引用嵌在 description/enforced_by/post_conditions 自由文本中）
• 反向：登记但无消费方 = 注册表漂移（consumed_externally 标记平台仓消费项如 gate）
• 负向测试：注入 check:nonexistent-guard → FAIL exit=1（悬空防线拦截生效）

摸底证实了悬空风险是真实的

adr-required 被三处引用（profiles enforced_by、curator post_conditions、CT-CUR-003 expected），但无任何 CI job 实装——CT-CUR-003 声称的防线行为当前不可执行。处置：登记 planned + ADR-0012 记录实装待办（validate.yml 增 job：PR 触及 C1 路径且无 ADR-\d{4} 引用则 fail——C1 流程机器化）。现行防线仍是 CODEOWNERS owner-only（CT-CUR-002）。

附带发现：ADR 编号冲突

main 现存两个 ADR-0011（runtime-egress 供应链线 PR#6 / team-collaboration 团队协作线 PR#7），均已合并、授权凭证完整。ADR-0012 记录消歧约定：引用 ADR-0011 必须带主题限定；不重编号（本仓 30+ 处引用 vs 0 处，重编号成本不对称）。新 ADR 自 0012 顺延。

验证

• python3 scripts/validate.py → OK（tools=5 skills=2 agents=9 teams=3 models=5 ct=29）
• python3 scripts/simulate-wave.py → 12 场景全通
• AGENTS.md 27 行（≤30，CG-1）

流程

C1（decisions/ + standards/ + scripts/ 变更）：PR + ADR-0012 + owner merge。ADR-0011 遗留段已改为处置记录。

[coderabbitai]

Warning

Review limit reached

@randypanding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 6 minutes

Limit details: You’ve used all 3 included reviews currently available under your plan.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5df6f3b0-2382-4d3e-971e-649556ffb06c

📥 Commits

Reviewing files that changed from the base of the PR and between 3a69ee2 and 54e5d4f.

📒 Files selected for processing (6)

• AGENTS.md
• decisions/ADR-0011-team-collaboration-v1.md
• decisions/ADR-0012-team-schema-v2-and-checks-registry.md
• registry/agents/curator-main.yaml
• scripts/validate.py
• standards/checks.yaml

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

建立 check:* 防线注册表与双向 fail-closed 校验

✨ Enhancement 📝 Documentation ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• 新增九项 check:* 防线注册表，标记生效状态与实现位置。
• 双向校验未注册引用和无消费登记，阻止悬空防线与注册表漂移。
• 以 ADR-0012 记录 schema v2 联动、实施待办及编号消歧。

Diagram

graph TD
  A["Standards YAML"] --> C["Reference Scan"] --> D{"ID Registered?"} -- Yes --> F{"Consumer Found?"} -- Yes --> G["Validation Pass"]
  B["Checks Registry"] --> D
  D -- No --> E["CI Failure"]
  B --> F
  F -- No --> E

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. 结构化 check 引用

• ➕ 可通过 YAML schema 精确校验 ID、状态和字段类型
• ➕ 避免文本扫描注释或描述产生误匹配
• ➕ 便于工具直接解析防线与控制测试关系
• ➖ 需要迁移现有 description、enforced_by 和 post_conditions 自由文本
• ➖ 变更范围更大，并可能要求同步修改跨仓 schema 与消费者

2. 从 CI 平台自动发现 checks

• ➕ 注册内容可直接反映实际 workflow 和 ruleset
• ➕ 减少 active 条目与真实 CI 实现不一致的风险
• ➖ 引入跨仓 API、权限、网络可用性及版本同步依赖
• ➖ 无法自然表达 planned 防线或非 CI 形态的机制门禁
• ➖ 会降低本地 validate 的确定性和可复跑性

Recommendation: 当前采用本地显式注册表和文本级双向扫描最适合作为增量治理方案：它覆盖现有自由文本引用，并保持验证离线、确定且 fail-closed。后续若 check 引用数量和自动化消费者继续增长，可逐步迁移为结构化引用；不建议目前直接依赖跨仓 CI 自动发现。

Files changed (6) +171 / -3

Enhancement (1) +26 / -0

validate.py增加 check:* 双向一致性校验 +26/-0

增加 check:* 双向一致性校验

• 扫描 standards 与 registry 的 YAML 文本，拒绝未注册的 check:* 引用。反向拒绝无消费方的注册项，同时允许 consumed_externally 标记的平台仓消费者。

scripts/validate.py

Bug fix (1) +1 / -1

curator-main.yaml规范化 curator 的 adr-required 引用 +1/-1

规范化 curator 的 adr-required 引用

• 将自然语言形式的 adr-required check 改为可被注册表扫描识别的 check:adr-required 引用。

registry/agents/curator-main.yaml

Documentation (3) +74 / -2

AGENTS.md增加 check:* 防线声明导航 +1/-0

增加 check:* 防线声明导航

• 在仓库索引中指向 standards/checks.yaml，并说明未登记引用会被 validate 拒绝。

AGENTS.md

ADR-0011-team-collaboration-v1.md关闭 ADR-0011 的两项遗留 +3/-2

关闭 ADR-0011 的两项遗留

• 将 team.schema v2 和 check:* 注册表从遗留项更新为已完成处置，并记录跨仓 schema 验证结果。

decisions/ADR-0011-team-collaboration-v1.md

ADR-0012-team-schema-v2-and-checks-registry.md记录 schema v2 与防线注册表决策 +70/-0

记录 schema v2 与防线注册表决策

• 新增 ADR-0012，说明跨仓 team.schema v2 对齐、check:* 注册与校验策略、adr-required 待办，以及重复 ADR-0011 的主题消歧约定。

decisions/ADR-0012-team-schema-v2-and-checks-registry.md

Other (1) +70 / -0

checks.yaml建立统一防线注册表 +70/-0

建立统一防线注册表

• 新增九项 check 定义，记录 active 或 planned 状态、实现或计划位置，以及外部消费例外。该文件成为声明层 check:* 标识符的单一真源。

standards/checks.yaml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Registry schema remains unchecked 🐞 Bug ≡ Correctness

Description

The validator extracts only each entry's id, so missing or invalid status/where values still
authorize references despite those fields defining whether and where a defense exists. Missing IDs
or non-mapping entries can additionally crash the reverse pass instead of producing a controlled
validation failure.

Code

scripts/validate.py[R392-394]

+CHECKS = {c.get("id") for c in CHECKS_REG.get("checks", []) if isinstance(c, dict)}
+if not CHECKS:
+    fail("standards/checks.yaml 注册表为空或缺失（ADR-0012）")

Relevance

●●● Strong

Recent validation precedent accepted tightening enum/schema checks and preventing malformed data
from bypassing validation.

PR-#5

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

ADR-0012 makes status (active|planned) and where mandatory for every registry entry, and the
registry comments assign operational meaning to both fields. The validator only extracts IDs, does
not validate those fields or uniqueness, and later calls c.get() without ensuring every entry is a
mapping.

decisions/ADR-0012-team-schema-v2-and-checks-registry.md[40-47]
standards/checks.yaml[9-18]
scripts/validate.py[391-412]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Validate the complete `checks.yaml` entry schema before using it. Each entry must be a mapping with a unique, grammar-compliant nonempty `id`, `status` limited to `active|planned`, a nonempty `where`, and an optional boolean `consumed_externally`; malformed entries must call `fail()` without crashing later set operations.

## Issue Context
ADR-0012 requires every check to expose its implementation state and location. The current ID-only extraction lets malformed metadata authorize references, while the reverse comprehension and sorting can raise on non-mappings or `None` IDs.

## Fix Focus Areas
- scripts/validate.py[391-412]
- standards/checks.yaml[9-18]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Malformed check names evade scanning ✗ Dismissed 🐞 Bug ≡ Correctness

Description

The regex accepts a valid prefix rather than validating the complete token, so check:gate_typo is
read as registered gate and uppercase or otherwise malformed references can be ignored entirely.
This makes the promised fail-closed check-reference validation bypassable by common naming typos.

Code

scripts/validate.py[R395-398]

+check_re = re.compile(r"check:([a-z][a-z0-9-]*)")
+for scope_root in (ROOT / "standards", REG):
+    for p in scope_root.rglob("*.yaml"):
+        for m in check_re.finditer(p.read_text(encoding="utf-8")):

Relevance

●●● Strong

This is a deterministic fail-closed parsing bug; recent validator hardening findings were accepted.

PR-#5

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The stated contract covers every check:<id> reference, but both forward and reverse validation
depend exclusively on a pattern that can match only a prefix. Because gate is registered,
check:gate_typo demonstrates a concrete false-negative path.

scripts/validate.py[388-409]
standards/checks.yaml[21-26]
decisions/ADR-0012-team-schema-v2-and-checks-registry.md[44-48]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Scan the complete token following every `check:` marker, reject tokens that do not satisfy the registry ID grammar, and only then test exact registry membership. Add negative tests for suffixes such as underscores, uppercase IDs, empty IDs, and other malformed forms.

## Issue Context
The current pattern stops at the first unsupported character. A reference such as `check:gate_typo` therefore becomes `gate`, which is registered, while the invalid suffix is never examined.

## Fix Focus Areas
- scripts/validate.py[395-409]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. adr-required references planned check ✗ Dismissed 📘 Rule violation ≡ Correctness

Description

The new agent post-condition references check:adr-required, whose registry status is planned
rather than active/approved. This permits an agent declaration to depend on a check explicitly
documented as not implemented.

Code

registry/agents/curator-main.yaml[34]

+    - "[ci] C1 变更必附 ADR（check:adr-required）"

Relevance

●● Moderate

Planned checks are intentionally referenceable per this PR; no close rejection precedent establishes
planned references as invalid.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed agent declaration references check:adr-required, while the new checks registry marks
that entry planned and states that no CI job currently implements it. The compliance rule
prohibits references to entries that are not approved or equivalently active.

Rule 2771006: Registry entries must only reference entries with approved status
registry/agents/curator-main.yaml[34-34]
standards/checks.yaml[43-50]
scripts/validate.py[391-401]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`curator-main` references `check:adr-required` while that check has `status: planned` and no CI implementation. The validator currently checks only whether an ID exists, so it accepts non-active checks.

## Issue Context
Compliance rule 2771006 requires referenced registry entries to have an approved or equivalent active status. Either implement and activate `adr-required` before referencing it, or make validation reject references to planned checks.

## Fix Focus Areas
- registry/agents/curator-main.yaml[34-34]
- standards/checks.yaml[43-50]
- scripts/validate.py[391-401]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

4. Cross-checkout errors lose diagnostics ✗ Dismissed 🐞 Bug ☼ Reliability

Description

For pure registry PRs, the base validator scans files under the separate head checkout, but
formatting an unregistered-reference error calls p.relative_to(ROOT) and raises ValueError. The
CI still rejects the PR, but emits a traceback instead of identifying the offending check and file.

Code

scripts/validate.py[R399-401]

+            if m.group(1) not in CHECKS:
+                fail(f"{p.relative_to(ROOT)} 引用未注册的 check:{m.group(1)}"
+                     f"（不在 standards/checks.yaml——悬空防线）")

Relevance

●● Moderate

The diagnostic failure is plausible and relevant, but no close historical precedent covers
separate-checkout path handling.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow explicitly runs std/scripts/validate.py with REGISTRY_DATA_ROOT pointing at the
sibling data checkout. In that mode, a registry file is outside ROOT, so the newly added
p.relative_to(ROOT) expression raises precisely when an unregistered reference is encountered.

.github/workflows/validate.yml[18-28]
.github/workflows/validate.yml[53-56]
scripts/validate.py[24-27]
scripts/validate.py[396-401]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Generate diagnostic paths relative to the correct checkout root rather than always using `ROOT`. Ensure an unregistered check in head registry data produces the intended `fail()` message during base-validator/head-data CI execution.

## Issue Context
CI sets `REGISTRY_DATA_ROOT` to the separate `data` checkout while the validator's `ROOT` is the `std` checkout. Registry paths therefore cannot be made relative to `ROOT`.

## Fix Focus Areas
- scripts/validate.py[396-401]
- .github/workflows/validate.yml[53-56]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 6 rules

Review mode: ⚖️ Balanced: This changes runtime validation behavior and a fail-closed registry across standards/registry, with cross-cutting contract implications and several independent edge cases; a careful single-pass review is warranted.

Tip of the day

💡 Did you know, you can keep summaries lean with Finding overflow, which tucks the rest behind 'View more'

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗