chore(WP7-06): 合并Resend发布门禁基线

# Conflicts:
#	package.json

package.json

@@ -109,7 +109,9 @@
     "review:wp7-01": "node scripts/record-wp7-01-manual-review.mjs",
     "test:wp7-02": "node scripts/run-wp7-02-validation.mjs",
     "test:wp7-02:controlled": "node scripts/run-wp7-02-validation.mjs --controlled-real",
-    "review:wp7-02": "node scripts/record-wp7-02-manual-review.mjs"
+    "review:wp7-02": "node scripts/record-wp7-02-manual-review.mjs",
+    "test:wp7-03": "node scripts/run-wp7-03-validation.mjs --phase green",
+    "test:wp7-03:red": "node scripts/run-wp7-03-validation.mjs --phase red"
   },
   "devDependencies": {
     "@playwright/test": "1.62.0",

packages/asset-compiler/src/index.ts

@@ -228,7 +228,13 @@ function readCsv(tracker: SourceTracker, path: string, label: string): CsvRow[]
 
 function itemDirectoryFor(collection: CollectionConfig, catalogPath: string, row: CsvRow): { directory: string; metadataPath: string } {
   if (collection.id === "font_panel") {
-    const resourceDir = requireString(row.resource_dir, "font resource_dir");
+    const configuredResourceDir = requireString(row.resource_dir, "font resource_dir");
+    const normalizedResourceDir = configuredResourceDir.replaceAll("\\", "/");
+    const relocationMarker = "/resources/font_packages/";
+    const markerIndex = normalizedResourceDir.lastIndexOf(relocationMarker);
+    const resourceDir = isAbsolute(configuredResourceDir) && !inside(configuredResourceDir, collection.root.path) && markerIndex >= 0
+      ? relativeReference(normalizedResourceDir.slice(markerIndex + 1), "font resource_dir relocation")
+      : configuredResourceDir;
     const directory = resolveSourcePath(resourceDir, collection.root.path, collection.root.path, "font resource_dir");
     return { directory, metadataPath: resolveSourcePath("metadata.json", directory, collection.root.path, "font metadata") };
   }

scripts/compile-wp5-03-assets.mjs

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 
 import { compileAssetArchive, compileStaticStickerCatalog } from "../packages/asset-compiler/dist/index.js";
 import { createP0aColorCardRenderPlans } from "../packages/asset-renderer/dist/index.js";
@@ -18,18 +18,38 @@ import {
 const runDirectory = resolve(process.env.DADA_WP5_03_RUN_DIRECTORY ?? "artifacts/tdd/wp5-03-local");
 const whiteDirectory = resolve(process.env.DADA_WP5_03_WHITE_EVIDENCE_DIR ?? join(runDirectory, "cases", "TDD-WP5-WHITE-001-p0a-allowlist"));
 const colorDirectory = resolve(process.env.DADA_WP5_03_COLOR_EVIDENCE_DIR ?? join(runDirectory, "cases", "TDD-WP5-COL-001-four-layouts"));
-const handoffManifest = resolve(process.env.DADA_COMPLEX_ASSET_MANIFEST ?? join(homedir(), "Desktop", "sticker_web_handoff", "sticker_web_catalog_manifest.json"));
+const replicationRoot = resolve(process.env.DADA_REPLICATION_ASSET_ROOT ?? join(homedir(), "Desktop", "sticker_web_replication_assets"));
-const stickerRoot = resolve(process.env.DADA_STATIC_STICKER_ROOT ?? join(homedir(), "Desktop", "贴纸素材"));
+const handoffManifest = resolve(process.env.DADA_COMPLEX_ASSET_MANIFEST ?? join(replicationRoot, "sticker_web_handoff", "sticker_web_catalog_manifest.json"));
+const stickerRoot = resolve(process.env.DADA_STATIC_STICKER_ROOT ?? join(replicationRoot, "sticker_normal"));
 if (!existsSync(handoffManifest)) throw new Error("normalized complex asset handoff is unavailable");
 if (!existsSync(stickerRoot)) throw new Error("static sticker source is unavailable");
 
 const complexDirectory = resolve(runDirectory, "inputs", "complex");
 const staticDirectory = resolve(runDirectory, "inputs", "static");
+const normalizedHandoffDirectory = resolve(runDirectory, "inputs", "normalized-handoff");
 mkdirSync(whiteDirectory, { recursive: true });
 mkdirSync(colorDirectory, { recursive: true });
 
+const sourceHandoff = JSON.parse(readFileSync(handoffManifest, "utf8"));
+const normalizedHandoff = {
+  ...sourceHandoff,
+  web_handoff: "STICKER_WEB_REPLICATION_HANDOFF.md",
+  validation: "sticker_archive_validation_20260722.json",
+  collections: sourceHandoff.collections
+    .filter((collection) => collection.id !== "normal_stickers")
+    .map((collection) => ({
+      ...collection,
+      root: resolve(dirname(handoffManifest), collection.root),
+    })),
+};
+const normalizedHandoffPath = resolve(normalizedHandoffDirectory, "sticker_web_catalog_manifest.normalized.json");
+mkdirSync(normalizedHandoffDirectory, { recursive: true });
+copyFileSync(resolve(dirname(handoffManifest), sourceHandoff.web_handoff), resolve(normalizedHandoffDirectory, normalizedHandoff.web_handoff));
+copyFileSync(resolve(dirname(handoffManifest), sourceHandoff.validation), resolve(normalizedHandoffDirectory, normalizedHandoff.validation));
+writeFileSync(normalizedHandoffPath, `${JSON.stringify(normalizedHandoff, null, 2)}\n`);
+
 const complex = compileAssetArchive({
-  manifestPath: handoffManifest,
+  manifestPath: normalizedHandoffPath,
   outputDirectory: complexDirectory,
   releaseVersion: P0A_COMPLEX_RELEASE_VERSION,
 });

scripts/lib/resend-release-gate.mjs

@@ -0,0 +1,145 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+
+import { validateReleaseCandidateRecord } from "./release-candidate.mjs";
+
+export const RESEND_DAILY_LIMIT = 80;
+export const RESEND_MONTHLY_LIMIT = 2_400;
+export const DELIVERY_CATEGORIES = Object.freeze(["qq", "163", "enterprise"]);
+export const DELIVERY_SAMPLE_SIZE = 20;
+export const DELIVERY_MINIMUM_WITHIN_TWO_MINUTES = 19;
+export const DELIVERY_WINDOW_SECONDS = 120;
+export const EXPECTED_WP7_01_COMMIT = "623cad25b2a2a9a003502c9a92ebd318dad06248";
+
+const emailPattern = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i;
+const absolutePathPattern = /(?:[A-Z]:[\\/]|\\\\|\/Users\/|\/home\/)/i;
+const sensitiveKeyPattern = /"(?:api[_ -]?key|secret|password|authorization|bearer|cookie|session[_ -]?token|verification[_ -]?code|private[_ -]?content|prompt|image)"\s*:/i;
+
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+
+function errorList(...values) {
+  return [...new Set(values.flat().filter((value) => typeof value === "string" && value.length > 0))];
+}
+
+export function validateDomainCheck(value) {
+  const item = object(value);
+  const freeRules = object(item?.free_rules);
+  const spf = object(item?.spf);
+  const dkim = object(item?.dkim);
+  const errors = [];
+  if (item?.schema_version !== "1.0") errors.push("schema_version");
+  if (item?.service !== "resend") errors.push("service");
+  if (item?.source !== "human_controlled_real") errors.push("source");
+  if (item?.status !== "verified") errors.push("status");
+  if (item?.domain_controlled !== true) errors.push("domain_controlled");
+  if (spf?.status !== "pass") errors.push("spf");
+  if (dkim?.status !== "pass") errors.push("dkim");
+  if (freeRules?.status !== "verified") errors.push("free_rules.status");
+  if (freeRules?.daily_limit !== RESEND_DAILY_LIMIT) errors.push("free_rules.daily_limit");
+  if (freeRules?.monthly_limit !== RESEND_MONTHLY_LIMIT) errors.push("free_rules.monthly_limit");
+  if (freeRules?.paid_fallback_enabled !== false) errors.push("free_rules.paid_fallback_enabled");
+  return errorList(errors);
+}
+
+export function validateDeliverySummary(value) {
+  const item = object(value);
+  const errors = [];
+  if (item?.schema_version !== "1.0") errors.push("schema_version");
+  if (item?.service !== "resend") errors.push("service");
+  if (item?.source !== "human_controlled_real") errors.push("source");
+  if (item?.status !== "verified") errors.push("status");
+  if (!Array.isArray(item?.categories) || item.categories.length !== DELIVERY_CATEGORIES.length) {
+    errors.push("categories");
+  } else {
+    const categories = item.categories.map((entry) => entry?.category).sort();
+    if (categories.join("|") !== DELIVERY_CATEGORIES.slice().sort().join("|")) errors.push("categories.names");
+    for (const entry of item.categories) {
+      if (!Number.isInteger(entry?.sent_count) || entry.sent_count !== DELIVERY_SAMPLE_SIZE) errors.push(`${entry?.category ?? "unknown"}.sent_count`);
+      if (!Number.isInteger(entry?.delivered_within_120_seconds)
+        || entry.delivered_within_120_seconds < DELIVERY_MINIMUM_WITHIN_TWO_MINUTES
+        || entry.delivered_within_120_seconds > DELIVERY_SAMPLE_SIZE) {
+        errors.push(`${entry?.category ?? "unknown"}.delivered_within_120_seconds`);
+      }
+      if (!Number.isFinite(entry?.max_latency_seconds) || entry.max_latency_seconds > DELIVERY_WINDOW_SECONDS) errors.push(`${entry?.category ?? "unknown"}.max_latency_seconds`);
+      if (entry?.mock_used !== false) errors.push(`${entry?.category ?? "unknown"}.mock_used`);
+      if (entry?.preseeded_account_used !== false) errors.push(`${entry?.category ?? "unknown"}.preseeded_account_used`);
+    }
+  }
+  return errorList(errors);
+}
+
+export function validateAuthResult(value) {
+  const item = object(value);
+  const ordinary = object(item?.ordinary);
+  const admin = object(item?.admin);
+  const errors = [];
+  if (item?.schema_version !== "1.0") errors.push("schema_version");
+  if (item?.service !== "resend") errors.push("service");
+  if (item?.source !== "human_controlled_real") errors.push("source");
+  if (item?.status !== "verified") errors.push("status");
+  if (item?.mock_used !== false) errors.push("mock_used");
+  if (item?.preseeded_account_used !== false) errors.push("preseeded_account_used");
+  for (const [name, auth] of [["ordinary", ordinary], ["admin", admin]]) {
+    if (auth?.status !== "passed") errors.push(`${name}.status`);
+    if (auth?.chain !== "formal") errors.push(`${name}.chain`);
+    if (auth?.verification_code_source !== "real_delivery") errors.push(`${name}.verification_code_source`);
+  }
+  return errorList(errors);
+}
+
+export function validateRedaction(value, serializedEvidence = "") {
+  const item = object(value);
+  const errors = [];
+  if (item?.schema_version !== "1.0") errors.push("schema_version");
+  if (item?.status !== "passed") errors.push("status");
+  if (item?.forbidden_matches !== 0) errors.push("forbidden_matches");
+  if (item?.credentials_in_evidence !== false) errors.push("credentials_in_evidence");
+  if (item?.mailboxes_in_evidence !== false) errors.push("mailboxes_in_evidence");
+  if (item?.private_content_in_evidence !== false) errors.push("private_content_in_evidence");
+  if (item?.absolute_paths_in_evidence !== false) errors.push("absolute_paths_in_evidence");
+  if (emailPattern.test(serializedEvidence)) errors.push("email_value");
+  if (absolutePathPattern.test(serializedEvidence)) errors.push("absolute_path");
+  if (sensitiveKeyPattern.test(serializedEvidence)) errors.push("sensitive_value");
+  return errorList(errors);
+}
+
+export function validateCandidateReference(record) {
+  try {
+    validateReleaseCandidateRecord(record);
+  } catch (error) {
+    return [error instanceof Error ? "candidate_record_invalid" : "candidate_record_invalid"];
+  }
+  const errors = [];
+  if (record.build_commit !== EXPECTED_WP7_01_COMMIT) errors.push("candidate_build_commit");
+  const versions = new Map((record.browsers ?? []).map((browser) => [browser.brand, browser.full_version]));
+  if (versions.get("Google Chrome") !== "150.0.7871.187") errors.push("chrome_full_version");
+  if (versions.get("Microsoft Edge") !== "151.0.4129.59") errors.push("edge_full_version");
+  return errorList(errors);
+}
+
+export function readJson(path) {
+  if (!path || !existsSync(path)) return undefined;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return undefined;
+  }
+}
+
+export function fileSha256(path) {
+  return createHash("sha256").update(readFileSync(path)).digest("hex").toUpperCase();
+}
+
+export function validateResendEvidence({ candidate, domainCheck, deliverySummary, authResult, redaction }) {
+  const serializedEvidence = JSON.stringify({ domainCheck, deliverySummary, authResult });
+  const errors = [
+    ...validateCandidateReference(candidate),
+    ...validateDomainCheck(domainCheck),
+    ...validateDeliverySummary(deliverySummary),
+    ...validateAuthResult(authResult),
+    ...validateRedaction(redaction, serializedEvidence),
+  ];
+  return errorList(errors);
+}

scripts/run-wp6-04-validation.mjs

@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
 
 const phaseIndex = process.argv.indexOf("--phase");
 const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "green";
@@ -10,6 +11,7 @@ if (!new Set(["red", "green"]).has(phase)) throw new Error(`Unsupported phase: $
 const runId = process.env.DADA_TDD_RUN_ID ?? `wp6-04-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
 const runDirectory = resolve("artifacts", "tdd", runId);
 const caseDirectory = resolve(runDirectory, "cases", "TDD-WP6-AUD-001-sensitive-operations");
+const replicationRoot = resolve(process.env.DADA_REPLICATION_ASSET_ROOT ?? join(homedir(), "Desktop", "sticker_web_replication_assets"));
 if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
 mkdirSync(caseDirectory, { recursive: true });
 
@@ -17,6 +19,9 @@ const environment = {
   ...process.env,
   DADA_EVIDENCE_DIR_WP6_AUD: caseDirectory,
   DADA_PLAYWRIGHT_OUTPUT_DIR: resolve(runDirectory, "playwright-output"),
+  DADA_STATIC_STICKER_ROOT: process.env.DADA_STATIC_STICKER_ROOT ?? join(replicationRoot, "sticker_normal"),
+  DADA_DYNAMIC_ASSET_ROOT: process.env.DADA_DYNAMIC_ASSET_ROOT ?? join(replicationRoot, "sticker_interactive", "单模板归档", "templates"),
+  DADA_TEXT_ASSET_ROOT: process.env.DADA_TEXT_ASSET_ROOT ?? join(replicationRoot, "sticker_text"),
 };
 const commands = phase === "red"
   ? [
@@ -25,8 +30,8 @@ const commands = phase === "red"
       ["e2e-red", ".\\node_modules\\.bin\\playwright.CMD test tests/e2e/wp6-04-audit.spec.ts --config playwright.config.ts"],
     ]
   : [
-      ["integration", "pnpm.cmd test:integration"],
+      ["integration", "pnpm.cmd exec vitest run tests/integration --testTimeout=20000"],
-      ["api", "pnpm.cmd test:api"],
+      ["api", "pnpm.cmd check:openapi && pnpm.cmd exec vitest run tests/api --testTimeout=20000"],
       ["worker", "pnpm.cmd test:worker"],
       ["e2e", "pnpm.cmd test:e2e"],
       ["tdd-trace", "pnpm.cmd validate:tdd-trace"],

scripts/run-wp7-03-validation.mjs

@@ -0,0 +1,175 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+import {
+  fileSha256,
+  readJson,
+  validateCandidateReference,
+  validateResendEvidence,
+} from "./lib/resend-release-gate.mjs";
+
+const phaseIndex = process.argv.indexOf("--phase");
+const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "green";
+if (!new Set(["red", "green"]).has(phase)) throw new Error(`Unsupported phase: ${phase}`);
+
+const candidateRunId = process.env.DADA_WP7_01_RUN_ID ?? "wp7-01-candidate-20260804052447717";
+const runId = process.env.DADA_TDD_RUN_ID ?? `wp7-03-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
+const runDirectory = resolve("artifacts", "tdd", runId);
+const caseId = "TDD-WP7-EXT-002-real-resend";
+const caseDirectory = resolve(runDirectory, "cases", caseId);
+if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
+mkdirSync(caseDirectory, { recursive: true });
+
+function writeJson(path, value) {
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function runCommand(name, command) {
+  const startedAt = new Date().toISOString();
+  const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
+    encoding: "utf8",
+    env: process.env,
+    maxBuffer: 40 * 1024 * 1024,
+    stdio: "inherit",
+  });
+  return {
+    command,
+    exit_code: result.status ?? 1,
+    finished_at: new Date().toISOString(),
+    name,
+    started_at: startedAt,
+  };
+}
+
+const candidateEvidenceRoot = resolve(
+  process.env.DADA_WP7_01_EVIDENCE_DIR ?? join("artifacts", "tdd", candidateRunId),
+);
+const candidate = readJson(join(candidateEvidenceRoot, "release-candidate.json"));
+const candidateErrors = candidate ? validateCandidateReference(candidate) : ["candidate_record_missing"];
+writeJson(resolve(caseDirectory, "candidate-reference.json"), candidate ? {
+  browsers: candidate.browsers.map(({ brand, full_version: fullVersion, major }) => ({ brand, full_version: fullVersion, major })),
+  build_commit: candidate.build_commit,
+  candidate_status: candidate.status,
+  final_release: candidate.final_release,
+  fixed_port: candidate.fixed_port,
+  run_id: candidateRunId,
+  schema_version: "1.0",
+} : {
+  candidate_status: "not_available",
+  reason: "candidate_record_missing",
+  run_id: candidateRunId,
+  schema_version: "1.0",
+});
+
+const commands = phase === "red" ? [] : [
+  ["workspace-build", "pnpm build:workspace-packages"],
+  ["integration", "pnpm test:integration"],
+  ["api", "pnpm check:openapi && pnpm exec vitest run tests/api --maxWorkers=1"],
+  ["security", "pnpm test:security"],
+  ["tdd-trace", "pnpm validate:tdd-trace"],
+].map(([name, command]) => runCommand(name, command));
+const localGatePassed = phase === "red" || commands.length > 0 && commands.every(({ exit_code }) => exit_code === 0);
+
+const redaction = {
+  absolute_paths_in_evidence: false,
+  credentials_in_evidence: false,
+  forbidden_matches: 0,
+  mailboxes_in_evidence: false,
+  private_content_in_evidence: false,
+  schema_version: "1.0",
+  status: "passed",
+};
+const externalRoot = process.env.DADA_RESEND_EVIDENCE_DIR ? resolve(process.env.DADA_RESEND_EVIDENCE_DIR) : undefined;
+const realAuthorized = process.env.DADA_RESEND_REAL_AUTHORIZED === "1";
+const externalFiles = ["domain-check.json", "delivery-summary.json", "auth-result.json", "redaction.json"];
+const externalEvidence = externalRoot
+  ? Object.fromEntries(externalFiles.map((file) => [file, readJson(join(externalRoot, file))]))
+  : {};
+const externalEvidenceMissing = externalRoot ? externalFiles.filter((file) => !externalEvidence[file]) : externalFiles;
+const externalErrors = externalRoot && externalEvidenceMissing.length === 0 && candidate
+  ? validateResendEvidence({
+      authResult: externalEvidence["auth-result.json"],
+      candidate,
+      deliverySummary: externalEvidence["delivery-summary.json"],
+      domainCheck: externalEvidence["domain-check.json"],
+      redaction: externalEvidence["redaction.json"],
+    })
+  : [];
+
+const externalBlockers = [];
+if (candidateErrors.length > 0) externalBlockers.push("candidate_record_unavailable_or_drifted");
+if (!realAuthorized) externalBlockers.push("controlled_domain_or_real_mailbox_authorization_absent");
+if (!externalRoot) externalBlockers.push("real_resend_evidence_not_supplied");
+if (externalRoot && externalEvidenceMissing.length > 0) externalBlockers.push("real_resend_evidence_incomplete");
+if (externalErrors.length > 0) externalBlockers.push("real_resend_evidence_invalid");
+
+if (phase === "red") {
+  writeJson(resolve(caseDirectory, "red-observation.json"), {
+    expected_failure: "Resend SPF/DKIM, free-rule, delivery, and formal authentication evidence is absent before TASK-WP7-03.",
+    observed_commands: ["pnpm test:wp7-03:red"],
+    red_reason: "TDD-WP7-EXT-002 requires controlled real domain/mailbox evidence; mock or pre-seeded accounts are not release evidence.",
+    status: "red_confirmed",
+  });
+} else if (externalRoot && externalEvidenceMissing.length === 0 && candidateErrors.length === 0 && realAuthorized && externalErrors.length === 0) {
+  for (const file of externalFiles) writeJson(resolve(caseDirectory, file), externalEvidence[file]);
+  writeJson(resolve(caseDirectory, "source-hashes.json"), {
+    files: Object.fromEntries(externalFiles.map((file) => [file, fileSha256(join(externalRoot, file))])),
+    schema_version: "1.0",
+  });
+} else {
+  writeJson(resolve(caseDirectory, "blocker.json"), {
+    blockers: externalErrors.length > 0 ? ["real_resend_evidence_invalid"] : externalBlockers,
+    mock_accepted_as_evidence: false,
+    paid_fallback_enabled: false,
+    preseeded_accounts_accepted_as_evidence: false,
+    real_calls_started: false,
+    schema_version: "1.0",
+    status: "externally_blocked",
+  });
+  writeJson(resolve(caseDirectory, "redaction.json"), redaction);
+  writeJson(resolve(caseDirectory, "source-hashes.json"), { files: {}, schema_version: "1.0" });
+}
+
+const expectedEvidence = phase === "red"
+  ? ["candidate-reference.json", "red-observation.json"]
+  : externalRoot && externalEvidenceMissing.length === 0 && candidateErrors.length === 0 && realAuthorized && externalErrors.length === 0
+    ? ["candidate-reference.json", "domain-check.json", "delivery-summary.json", "auth-result.json", "redaction.json", "source-hashes.json"]
+    : ["candidate-reference.json", "blocker.json", "redaction.json", "source-hashes.json"];
+const missingEvidence = expectedEvidence.filter((file) => !existsSync(resolve(caseDirectory, file)));
+const status = phase === "red"
+  ? localGatePassed && missingEvidence.length === 0 ? "red_confirmed" : "failed"
+  : !localGatePassed || missingEvidence.length > 0 ? "failed"
+    : realAuthorized && (!externalRoot || externalEvidenceMissing.length > 0 || externalErrors.length > 0) ? "failed"
+    : externalRoot && externalEvidenceMissing.length === 0 && candidateErrors.length === 0 && realAuthorized && externalErrors.length === 0 ? "passed"
+      : "externally_blocked";
+const manifest = {
+  path: "tasks.manifest.json",
+  sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase(),
+};
+const result = {
+  acceptance_criteria: ["AC-01", "AC-33", "AC-41", "AC-47", "AC-49"],
+  automation: ["controlled_real", "manual_review"],
+  candidate_run_id: candidateRunId,
+  commit: spawnSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).stdout.trim(),
+  evidence_refs: expectedEvidence,
+  external_blockers: phase === "green" && status === "externally_blocked" ? externalBlockers : [],
+  finished_at: new Date().toISOString(),
+  layer: ["EXT-REAL", "MANUAL"],
+  manifest,
+  missing_evidence: missingEvidence,
+  phase,
+  requirements: ["AUTH-01", "AUTH-02", "AUTH-07"],
+  run_id: runId,
+  schema_version: "1.0",
+  status,
+  task_id: "TASK-WP7-03",
+  test_id: caseId,
+  work_package: "WP-7",
+};
+writeJson(resolve(caseDirectory, "commands.json"), { commands, phase, run_id: runId, schema_version: "1.0" });
+writeJson(resolve(caseDirectory, "result.json"), result);
+writeJson(resolve(runDirectory, "evidence.json"), { cases: [{ external_blockers: result.external_blockers, missing_evidence: missingEvidence, status, test_id: caseId }], phase, run_id: runId, status });
+console.log(JSON.stringify({ external_blockers: result.external_blockers, phase, run_id: runId, status }, null, 2));
+if (status === "failed") process.exit(1);

tests/package/wp7-03-resend-gate.test.mjs

@@ -0,0 +1,76 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  validateAuthResult,
+  validateDeliverySummary,
+  validateDomainCheck,
+  validateRedaction,
+} from "../../scripts/lib/resend-release-gate.mjs";
+
+const realEvidence = {
+  source: "human_controlled_real",
+  service: "resend",
+  status: "verified",
+  schema_version: "1.0",
+};
+
+test("requires SPF, DKIM, exact free limits, and no paid fallback", () => {
+  assert.deepEqual(validateDomainCheck({
+    ...realEvidence,
+    dkim: { status: "pass" },
+    domain_controlled: true,
+    free_rules: { daily_limit: 80, monthly_limit: 2400, paid_fallback_enabled: false, status: "verified" },
+    spf: { status: "pass" },
+  }), []);
+  assert.ok(validateDomainCheck({ ...realEvidence, domain_controlled: true, spf: { status: "pass" }, dkim: { status: "fail" }, free_rules: { status: "unknown" } }).includes("dkim"));
+});
+
+test("requires exactly three 20-message delivery cohorts with 19 within 120 seconds", () => {
+  const summary = {
+    ...realEvidence,
+    categories: ["qq", "163", "enterprise"].map((category) => ({
+      category,
+      delivered_within_120_seconds: 19,
+      max_latency_seconds: 120,
+      mock_used: false,
+      preseeded_account_used: false,
+      sent_count: 20,
+    })),
+  };
+  assert.deepEqual(validateDeliverySummary(summary), []);
+  assert.ok(validateDeliverySummary({ ...summary, categories: summary.categories.map((item) => item.category === "163" ? { ...item, delivered_within_120_seconds: 18 } : item) }).some((error) => error.includes("163")));
+  assert.ok(validateDeliverySummary({ ...summary, categories: summary.categories.map((item) => item.category === "enterprise" ? { ...item, max_latency_seconds: undefined } : item) }).some((error) => error.includes("enterprise")));
+});
+
+test("requires formal ordinary and admin authentication chains", () => {
+  assert.deepEqual(validateAuthResult({
+    ...realEvidence,
+    admin: { chain: "formal", status: "passed", verification_code_source: "real_delivery" },
+    mock_used: false,
+    ordinary: { chain: "formal", status: "passed", verification_code_source: "real_delivery" },
+    preseeded_account_used: false,
+  }), []);
+  assert.ok(validateAuthResult({ ...realEvidence, admin: { chain: "mock", status: "passed", verification_code_source: "fixture" }, ordinary: { status: "failed" } }).length > 0);
+});
+
+test("rejects credentials, mailboxes, private values, and paths from evidence", () => {
+  assert.deepEqual(validateRedaction({
+    absolute_paths_in_evidence: false,
+    credentials_in_evidence: false,
+    forbidden_matches: 0,
+    mailboxes_in_evidence: false,
+    private_content_in_evidence: false,
+    schema_version: "1.0",
+    status: "passed",
+  }, JSON.stringify({ category: "qq", delivered_within_120_seconds: 20 })), []);
+  assert.ok(validateRedaction({
+    absolute_paths_in_evidence: false,
+    credentials_in_evidence: false,
+    forbidden_matches: 0,
+    mailboxes_in_evidence: false,
+    private_content_in_evidence: false,
+    schema_version: "1.0",
+    status: "passed",
+  }, JSON.stringify({ mailbox: "recipient@example.invalid" })).includes("email_value"));
+});

tests/unit/wp5-01-asset-compiler.test.ts

@@ -190,6 +190,27 @@ describe("TDD-WP5-MAN-001 readonly asset compiler", () => {
     expect(repeated.report.derived_files).toEqual({ created: 0, reused: 4, total: 4 });
   });
 
+  it("safely relocates legacy absolute font package paths after an archive move", () => {
+    const fixture = createFixture();
+    const catalogPath = join(fixture.sourceRoot, "fonts", "reports", "font_panel_catalog.csv");
+    const metadata = JSON.parse(readFileSync(join(fixture.sourceRoot, "fonts", "resources", "font_packages", "FONT001_Test", "metadata.json"), "utf8")) as { local_sha256: string };
+    csv(catalogPath, [{
+      candidate_id: "FONT001",
+      display_name: "Test Font",
+      font_family: "Dada Test",
+      local_sha256: metadata.local_sha256,
+      panel_order: "1",
+      resource_dir: "C:/Users/legacy/Desktop/sticker_text/fonts/resources/font_packages/FONT001_Test",
+      resource_status: "verified_extracted",
+    }]);
+
+    expect(() => compileAssetArchive({
+      manifestPath: fixture.manifestPath,
+      outputDirectory: fixture.outputRoot,
+      releaseVersion: "fixture-v1",
+    })).not.toThrow();
+  });
+
   it("rejects evidence collections, traversal and output inside a source root", () => {
     const fixture = createFixture();
     const manifest = JSON.parse(readFileSync(fixture.manifestPath, "utf8")) as { collections: unknown[] };

tests/visual-performance/wp4-07-real-assets.mjs

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 
 import { WP4_07_REAL_RESOURCE_VERSIONS } from "./wp4-07-fixture.mjs";
 
@@ -74,15 +74,16 @@ function assetRecord(assetId, path, sourceReference, expectedSha256) {
 export function loadWp407RealAssets() {
   const manifestPath = resolve(process.env.DADA_WP4_07_FINAL_ASSET_MANIFEST ?? "");
   if (!process.env.DADA_WP4_07_FINAL_ASSET_MANIFEST || !existsSync(manifestPath)) throw new Error("WP4_07_FINAL_ASSET_MANIFEST_REQUIRED");
-  const handoffPath = resolve(process.env.DADA_COMPLEX_ASSET_MANIFEST ?? join(homedir(), "Desktop", "sticker_web_handoff", "sticker_web_catalog_manifest.json"));
+  const replicationRoot = resolve(process.env.DADA_REPLICATION_ASSET_ROOT ?? join(homedir(), "Desktop", "sticker_web_replication_assets"));
-  const staticRoot = resolve(process.env.DADA_STATIC_STICKER_ROOT ?? join(homedir(), "Desktop", "贴纸素材"));
+  const handoffPath = resolve(process.env.DADA_COMPLEX_ASSET_MANIFEST ?? join(replicationRoot, "sticker_web_handoff", "sticker_web_catalog_manifest.json"));
+  const staticRoot = resolve(process.env.DADA_STATIC_STICKER_ROOT ?? join(replicationRoot, "sticker_normal"));
   const backgroundPath = resolve(process.env.DADA_WP4_07_BACKGROUND_PATH ?? join(homedir(), "Documents", "贴纸脚本", "time_01_input_20260716.png"));
   if (!existsSync(handoffPath) || !existsSync(staticRoot)) throw new Error("WP4_07_REAL_ARCHIVE_ROOT_REQUIRED");
 
   const manifestRaw = readFileSync(manifestPath, "utf8");
   const manifest = JSON.parse(manifestRaw);
   const handoff = JSON.parse(readFileSync(handoffPath, "utf8"));
-  const collectionRoots = Object.fromEntries(handoff.collections.map((collection) => [collection.id, resolve(collection.root)]));
+  const collectionRoots = Object.fromEntries(handoff.collections.map((collection) => [collection.id, resolve(dirname(handoffPath), collection.root)]));
   const fontRoot = collectionRoots.font_panel;
   const dynamicRoot = collectionRoots.interactive_stickers;
   if (!fontRoot || !dynamicRoot) throw new Error("WP4_07_REAL_ARCHIVE_COLLECTION_REQUIRED");