fix(workflow): count a step's declared OUTPUT as delivery evidence - #2666

Verdict: PASS at 0410da0
Written-by: Reviewer
Attestation: 0410da0 role=Reviewer

Ran at this tip:

$ cd plugins/workflow && TZ=UTC DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness node --import ./test/resolve.mjs --test test/step-artifacts.test.js test/graph.test.js test/assign.test.js
# tests 35  # pass 35  # fail 0
$ cp graph.base.js tip/plugins/workflow/src/graph.js   # base blob d02f292ff7d8 plugins/workflow/src/graph.js, new test kept
$ cd tip/plugins/workflow && TZ=UTC DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness node --import ./test/resolve.mjs --test test/step-artifacts.test.js
# tests 5  # pass 0  # fail 5
$ cp graph.tip.js tip/plugins/workflow/src/graph.js
$ cd tip/plugins/workflow && TZ=UTC DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness node --import ./test/resolve.mjs --test test/step-artifacts.test.js test/graph.test.js test/assign.test.js
# tests 35  # pass 35  # fail 0
$ cd tip/plugins/workflow && TZ=UTC DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness node --import ./test/resolve.mjs --test test/missing-output-state.test.js
# tests 8  # pass 8  # fail 0
$ node --experimental-import-meta-resolve probe.mjs   # stepArtifacts shape probes
$ cd tip && node .github/scripts/changelog.mjs check
# 20 fragment(s) are well formed

Review notes (tip 0410da0d844d, base d02f292ff7d8, 5 files / 143+ / 3-):

Red first — hard requirement met. With plugins/workflow/src/graph.js swapped back to the base blob and the new test kept, test/step-artifacts.test.js is 0/5 passing (5 fail: the i2656 reply still settles commitAdvance as failed, and stepArtifacts returns {pull:null,claimed:false}). Restored to the tip it is 35/35 green across the three affected suites. No old test assertion was edited to get there: the diff touches only graph.js, service.js, the new test file, the subsystem doc and one changelog fragment.

Evidence shapes are tight (plugins/workflow/src/graph.js:116-146). Only PULL_OUTPUTS = {pr, pull} (first integer via /\d+/) and MERGE_OUTPUTS = {merged, merge-commit} (exactly /\b[0-9a-f]{40}\b/i) count; everything else is ignored. Probed directly: pr: "2657 (verified)" → 2657; pull: "12" → 12; pr: "none" → null; issue: "99" → null; merged: "not yet" / "f840979143b5" (39) / "deadbeef" → no merged; merged/merge-commit with a 40-hex sha → merged: true; tip: <sha> → null. There is no "any number in any OUTPUT is a PR" widening.

missingVerdicts is unchanged (fail-closed kept). service.js:1218 still computes missing the same way and stepArtifacts is only consulted when missing is exactly ['state']; every other missing gate-read output still becomes Missing OUTPUT <names>. test/missing-output-state.test.js (the #2583/#1773 fail-closed suite) is 8/8 green.

service.js change is one branch only. The single source edit is stands = artifact.pull != null || artifact.claimed || artifact.merged === true; run/node state-machine branches elsewhere are untouched. The new test drives the real fast line: i2656's reply (prose "已修复并合入" + PR #2657 with no creation verb, OUTPUT pr: 2657 (verified), OUTPUT merged: not yet) leaves run.status = running, triage = done, claim = running, escalate = skipped, producedPull = 2657; a merged: <sha>-only reply also keeps the run alive.

Scope. Only the declared evidence shapes and the one stands branch changed. The runner's edge-OUTPUT pre-announcement, partial settlement and other evidence shapes stay out, as the brief lists. docs/subsystems/workflow.md §5 records the widened evidence and changelog.d/2658-step-artifacts-output.fixed.md is a well-formed fragment.

CI at this tip. All check-runs green/skipped (tests-ok, Node 24 · DSH 0.2.0-rc.2, plugins (workflow/tree/social/timeline), package, policy-sign, merge-gate, reviewed tip, risk tier), the only red being enqueue-guard (no Verifier report names the tip 0410da0d), which this report clears.

Tier: T3 (plugins/workflow/**, not T0/T1) — this PASS at the tip is the review gate for it.