V10.509 接入 Webcrumbs 同源資產代理與 writer preflight gate

.env.example

@@ -52,16 +52,18 @@ NGROK_AUTH_TOKEN=your_ngrok_auth_token
 # ==========================================
 # [預設 true] 啟用 momo-pro 全站 shell 載入自架 Webcrumbs runtime
 WEBCRUMBS_ENABLED=true
-# [預設] 110 Gateway / Nginx 上的共用 Webcrumbs 入口
+# [預設] 共用 Webcrumbs/Open Design 工具入口；正式頁面載入不直接依賴此跨域 TLS
 WEBCRUMBS_BASE_URL=https://webcrumbs.wooo.work
-# [預設 @v0.1.5] 生產環境必須固定版本，不使用官方 @latest
-WEBCRUMBS_RUNTIME_VERSION=@v0.1.5
-# [預設 /runtime/@v0.1.5] 若部署成 CDN 相容根路徑，可改為 /@v0.1.5
-WEBCRUMBS_RUNTIME_PATH=/runtime/@v0.1.5
-# [選填] 若實際 runtime URL 與 BASE_URL + RUNTIME_PATH 不同，用此欄位直接覆寫
+# [預設 shared-ui-poc-0.1.0] 生產環境必須固定版本，不使用官方 @latest
+WEBCRUMBS_RUNTIME_VERSION=shared-ui-poc-0.1.0
+# [預設] momo-pro 同源 asset proxy，避免跨域憑證/Basic Auth 影響正式頁面
+WEBCRUMBS_RUNTIME_PATH=/webcrumbs-assets/loader/webcrumbs-compatible-loader.js
+# [選填] 若實際 runtime URL 與 RUNTIME_PATH 不同，用此欄位直接覆寫
 WEBCRUMBS_RUNTIME_URL=
-# [預設] momo-pro 專用 plugin namespace；各 plugin 應使用版本化子目錄
-WEBCRUMBS_PLUGIN_BASE_URL=https://webcrumbs.wooo.work/plugins/momo-pro
+# [預設] 共用 plugin base；各 plugin 應使用版本化子目錄
+WEBCRUMBS_PLUGIN_BASE_URL=/webcrumbs-assets/plugins
+# [預設] 188 user-space Shared UI Hub，只允許 proxy loader/plugins/demo
+WEBCRUMBS_ASSET_UPSTREAM_URL=http://192.168.0.188:18088
 
 # ==========================================
 # Image / Release Tag（docker-compose*.yml）

TODO_NEXT_STEPS.txt

@@ -4,6 +4,8 @@
 ================================================================================
 
 【已完成】
+   - V10.509 新增市場情報 MCP Fetch Candidate Queue Writer Review Decision Approval Writer Preflight 安全預覽 gate：只審核 human approval 通過後由操作員貼回的 writer preflight 摘要，確認 approval identity、writer_preflight_id、row count、dedupe keys、approved decision 到 target review_state 的逐列映射、decision/approval/preflight evidence refs、exact identity / variant / overwrite guard 與 operator boundary；API 不讀 token、不執行 CLI、不開 DB、不寫 preflight/approval/decision/match、不更新 review_state、不補 queue、不掛 scheduler，只放行到後續 CLI review / run package 設計。
+   - V10.508 Webcrumbs 轉為 momo-pro 同源 asset proxy：`WEBCRUMBS_RUNTIME_URL` 預設改為 `/webcrumbs-assets/loader/webcrumbs-compatible-loader.js`，新增 allowlist proxy 只代理 188 Shared UI Hub 的 `loader/`、`plugins/`、`demo/`，避免 `webcrumbs.wooo.work` 公網 TLS / Basic Auth 尚未收斂時影響正式頁面載入；`/webcrumbs` 診斷頁同步顯示 asset upstream。
    - V10.507 接入 Webcrumbs 共用 UI Runtime：新增 `WEBCRUMBS_*` 環境設定與 `/webcrumbs` 診斷入口，`ewoooc_base.html` 會在 runtime 啟用且 URL 有效時載入自架 Webcrumbs script；側欄新增 Webcrumbs 入口，並補 `docs/guides/webcrumbs_shared_runtime.md` 作為跨專案接入手冊。生產仍需固定版本與自架 plugin URI，不使用官方 `@latest`。
    - V10.506 新增市場情報 MCP Fetch Candidate Queue Writer Review Decision Approval 安全預覽 gate：只審核 review decision 通過後由操作員貼回的人工 approval 摘要，確認 approval identity、row count、dedupe keys、approved decision、evidence refs、exact identity / variant / overwrite guard 與 operator boundary；API 不讀 token、不執行 CLI、不開 DB、不寫 approval/decision/match、不更新 review_state、不補 queue、不掛 scheduler，只放行到後續人工 approval writer preflight 設計。
    - V10.505 新增市場情報 MCP Fetch Candidate Queue Writer Review Decision 安全預覽 gate：只審核 review inventory 通過後由操作員貼回的人工 candidate queue review decision 摘要，確認 decision identity、target table、row count、dedupe keys、`needs_review` 現態、允許決策集合、evidence refs、matched row exact-identity/variant/overwrite guard、operator confirmation 與 forbidden API actions；API 不讀 token、不執行 CLI、不開 DB、不寫 decision record、不更新 review_state、不寫 match result、不補 queue、不掛 scheduler。UI 同步新增 Decision gates / Inventory link / Decision summary / Decision rows / Boundary next 預覽區。

app.py

@@ -62,6 +62,7 @@ from config import (
     SYSTEM_VERSION,
     WEBCRUMBS_BASE_URL,
     WEBCRUMBS_ENABLED,
+    WEBCRUMBS_ASSET_UPSTREAM_URL,
     WEBCRUMBS_PLUGIN_BASE_URL,
     WEBCRUMBS_RUNTIME_URL,
     WEBCRUMBS_RUNTIME_VERSION,
@@ -448,6 +449,7 @@ def inject_global_vars():
             'runtime_url': WEBCRUMBS_RUNTIME_URL,
             'runtime_version': WEBCRUMBS_RUNTIME_VERSION,
             'plugin_base_url': WEBCRUMBS_PLUGIN_BASE_URL,
+            'asset_upstream_url': WEBCRUMBS_ASSET_UPSTREAM_URL,
         },
     }
 

config.py

@@ -118,7 +118,7 @@ def _env_bool(name: str, default: str = 'false') -> bool:
 
 
 def _safe_public_http_url(value: str) -> str:
-    """只接受公開 http(s) URL，避免模板把 javascript/data URI 輸出成 script src。"""
+    """只接受 http(s) URL，避免模板把 javascript/data URI 輸出成 script src。"""
     candidate = (value or '').strip().rstrip('/')
     if not candidate:
         return ''
@@ -128,29 +128,40 @@ def _safe_public_http_url(value: str) -> str:
     return candidate
 
 
+def _safe_webcrumbs_reference(value: str) -> str:
+    """允許 http(s) URL 或 momo-pro 同源絕對路徑，供 script/plugin URL 使用。"""
+    candidate = (value or '').strip().rstrip('/')
+    if not candidate:
+        return ''
+    if candidate.startswith('/') and not candidate.startswith('//') and '\\' not in candidate:
+        return candidate
+    return _safe_public_http_url(candidate)
+
+
 # Webcrumbs 共用 microfrontend runtime。
-# 預設接 110 Gateway 上的內部部署；實際路徑不同時可用 WEBCRUMBS_RUNTIME_URL 直接覆寫。
+# 預設透過 momo-pro 同源 proxy 讀 188 Shared UI Hub，避免正式頁面被跨域 TLS 狀態卡住。
 WEBCRUMBS_ENABLED = _env_bool('WEBCRUMBS_ENABLED', 'true')
 WEBCRUMBS_BASE_URL = _safe_public_http_url(
     os.getenv('WEBCRUMBS_BASE_URL', 'https://webcrumbs.wooo.work')
 )
-WEBCRUMBS_RUNTIME_VERSION = os.getenv('WEBCRUMBS_RUNTIME_VERSION', '@v0.1.5').strip().strip('/')
+WEBCRUMBS_RUNTIME_VERSION = os.getenv('WEBCRUMBS_RUNTIME_VERSION', 'shared-ui-poc-0.1.0').strip().strip('/')
 WEBCRUMBS_RUNTIME_PATH = os.getenv(
     'WEBCRUMBS_RUNTIME_PATH',
-    f'/runtime/{WEBCRUMBS_RUNTIME_VERSION}' if WEBCRUMBS_RUNTIME_VERSION else '/runtime/@v0.1.5',
+    '/webcrumbs-assets/loader/webcrumbs-compatible-loader.js',
 ).strip()
 _webcrumbs_runtime_url = os.getenv('WEBCRUMBS_RUNTIME_URL', '').strip()
-WEBCRUMBS_RUNTIME_URL = _safe_public_http_url(_webcrumbs_runtime_url)
-if not WEBCRUMBS_RUNTIME_URL and WEBCRUMBS_BASE_URL:
-    WEBCRUMBS_RUNTIME_URL = _safe_public_http_url(
-        f"{WEBCRUMBS_BASE_URL}/{WEBCRUMBS_RUNTIME_PATH.lstrip('/')}"
-    )
-WEBCRUMBS_PLUGIN_BASE_URL = _safe_public_http_url(
+WEBCRUMBS_RUNTIME_URL = _safe_webcrumbs_reference(_webcrumbs_runtime_url)
+if not WEBCRUMBS_RUNTIME_URL:
+    WEBCRUMBS_RUNTIME_URL = _safe_webcrumbs_reference(WEBCRUMBS_RUNTIME_PATH)
+WEBCRUMBS_PLUGIN_BASE_URL = _safe_webcrumbs_reference(
     os.getenv(
         'WEBCRUMBS_PLUGIN_BASE_URL',
-        f'{WEBCRUMBS_BASE_URL}/plugins/momo-pro' if WEBCRUMBS_BASE_URL else '',
+        '/webcrumbs-assets/plugins',
     )
 )
+WEBCRUMBS_ASSET_UPSTREAM_URL = _safe_public_http_url(
+    os.getenv('WEBCRUMBS_ASSET_UPSTREAM_URL', 'http://192.168.0.188:18088')
+)
 
 # ==========================================
 # 市場情報模組設定（預設全部關閉）
@@ -391,7 +402,7 @@ YOUTUBE_API_KEY = os.getenv('YOUTUBE_API_KEY', '')
 # ==========================================
 # 系統版本與路徑
 # ==========================================
-SYSTEM_VERSION = "V10.507"
+SYSTEM_VERSION = "V10.509"
 LOG_FILE_PATH = os.path.join(BASE_DIR, 'logs/system.log')
 public_url = PUBLIC_URL  # 用於模板顯示
 
@@ -404,4 +415,6 @@ def validate_critical_config():
             warnings.append(f"[Config] 選用設定 {var} 未設，部分功能可能停用")
     if WEBCRUMBS_ENABLED and not WEBCRUMBS_RUNTIME_URL:
         warnings.append("[Config] WEBCRUMBS_ENABLED=true 但 WEBCRUMBS_RUNTIME_URL 無效，Webcrumbs runtime 將不會載入")
+    if WEBCRUMBS_ENABLED and WEBCRUMBS_RUNTIME_URL.startswith('/webcrumbs-assets/') and not WEBCRUMBS_ASSET_UPSTREAM_URL:
+        warnings.append("[Config] Webcrumbs 使用同源 asset proxy，但 WEBCRUMBS_ASSET_UPSTREAM_URL 無效")
     return warnings

docs/adr/ADR-035-cross-platform-market-campaign-intelligence.md

@@ -177,6 +177,7 @@ EwoooC 目前已有 MOMO EDM / 節慶活動資料、`promo_products`、PChome
 - 2026-05-31 追加 MCP fetch candidate queue writer review inventory gate：`services.market_intel.mcp_fetch_candidate_queue_writer_review_inventory`、`services.market_intel.mcp_fetch_candidate_queue_writer_review_inventory_gates`、`services.market_intel.mcp_fetch_candidate_queue_writer_review_inventory_sample` 與 `/api/market_intel/mcp_fetch_candidate_queue_writer_review_inventory` 在 writer review handoff 通過後審核 operator read-only candidate queue inventory 摘要，檢查 handoff identity、target table、row count、dedupe keys、review_state、artifact paths、read-only query result、missing/duplicate rows 與 operator confirmations；API/UI 不讀 approval token、不執行 CLI、不開 DB、不寫 queue、不更新 review_state、不做 inventory query、不掛 scheduler，只放行到後續人工 candidate queue review。
 - 2026-05-31 追加 MCP fetch candidate queue writer review decision gate：`services.market_intel.mcp_fetch_candidate_queue_writer_review_decision`、`services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_gates`、`services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_sample` 與 `/api/market_intel/mcp_fetch_candidate_queue_writer_review_decision` 在 review inventory 通過後審核 operator candidate queue review decision 摘要，檢查 decision identity、target table、row count、dedupe keys、`needs_review` 現態、允許決策集合、evidence refs、matched row exact-identity/variant/overwrite guard、operator confirmations 與 forbidden API actions；API/UI 不讀 approval token、不執行 CLI、不開 DB、不寫 decision record、不更新 review_state、不寫 match result、不補 queue、不掛 scheduler，只放行到 decision approval / writer preflight 設計。
 - 2026-05-31 追加 MCP fetch candidate queue writer review decision approval gate：`services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval`、`services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval_gates`、`services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval_sample` 與 `/api/market_intel/mcp_fetch_candidate_queue_writer_review_decision_approval` 在 review decision 通過後只審核 operator human approval 摘要，確認 decision linkage、approval identity、target table、row count、dedupe keys、`approved_for_writer_preflight` approval result、decision/approval evidence refs、artifact paths、matched row exact-identity/variant/overwrite guard、operator confirmations 與 forbidden API actions；API/UI 不讀 approval token、不執行 CLI、不開 DB、不寫 approval record、不寫 decision record、不更新 review_state、不寫 match result、不補 queue、不掛 scheduler，只放行到後續 writer preflight 設計。此 endpoint 已拆入 `routes.market_intel_mcp_review_routes`，避免 `routes.market_intel_mcp_run_routes` 超過 800 行治理門檻。
+- 2026-05-31 追加 MCP fetch candidate queue writer review decision approval writer preflight gate：`services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight`、對應 gates/sample 與 `/api/market_intel/mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight` 在 human approval 通過後只審核 operator writer preflight 摘要，確認 approval linkage、writer_preflight_id、target operation、row count、dedupe keys、approved decision 到 target review_state 的逐列映射、decision/approval/preflight evidence refs、matched row exact-identity/variant/overwrite guard 與 operator boundary；API/UI 不讀 approval token、不執行 CLI、不開 DB、不寫 preflight/approval/decision/match、不更新 review_state、不補 queue、不掛 scheduler，只放行到後續 CLI review / run package 設計。
 - 2026-05-18 追加 scheduler attach plan preview：`services.market_intel.scheduler_plan` 與 `/api/market_intel/scheduler_plan` 描述未來 `campaign_discovery_daily`、`campaign_product_probe`、`product_match_review_seed` 三個 job 的 cadence、gate、fallback 與安全邊界。此階段不註冊 scheduler job、不啟動 crawler、不連外、不寫 DB；排程掛載必須等 migration、seed、MCP fetch gate、manual sample 與人工批准全過。
 - 2026-05-18 追加 match review plan preview：`services.market_intel.match_review_plan` 與 `/api/market_intel/match_review_plan` 定義商品比對訊號、分數門檻、`needs_review → confirmed/rejected` HITL 流程與安全邊界。此階段不建立 review queue、不自動 confirmed、不寫 `market_product_matches`、不呼叫 MCP；價格只能作為輔助訊號，不能單獨決定同品比對。
 - 2026-05-18 追加 opportunity plan preview：`services.market_intel.opportunity_plan` 與 `/api/market_intel/opportunity_plan` 定義競品低價威脅、促銷缺口、深折重疊、活動即將結束四類規則與分級策略。此階段不建立 opportunity queue、不派送 Telegram、不產生 AI 摘要、不寫 DB；高風險項必須先有 confirmed match 與 DB evidence 才能升級。

docs/adr/ADR-037-webcrumbs-shared-ui-runtime.md

@@ -15,12 +15,13 @@ Webcrumbs 在 momo-pro 中只作為「自架、固定版本、可診斷」的共
 
 採用以下規則：
 
-1. runtime 由 `WEBCRUMBS_*` 環境變數設定，預設指向 `https://webcrumbs.wooo.work/runtime/@v0.1.5`。
-2. `ewoooc_base.html` 只在 `WEBCRUMBS_ENABLED=true` 且 runtime URL 通過 http(s) 檢查時輸出 script。
-3. 新增 `/webcrumbs` 診斷入口，只顯示 runtime URL、版本與 plugin base 狀態，不連到外部官方站作為正式入口。
-4. Webcrumbs plugin 必須使用自架且版本化 URI，例如 `https://webcrumbs.wooo.work/plugins/momo-pro/<plugin>/<version>/`。
-5. 禁止在生產使用官方 `@latest`、`app.webcrumbs.ai` 或未固定版本的官方 CDN。
-6. 不把 Webcrumbs 上游 repo 整包納入 momo-pro 主服務；若修改 runtime 本體，需另外處理 AGPL-3.0 授權義務。
+1. runtime 由 `WEBCRUMBS_*` 環境變數設定，正式頁面預設指向 momo-pro 同源 `/webcrumbs-assets/loader/webcrumbs-compatible-loader.js`。
+2. `/webcrumbs-assets/` 只代理 allowlist prefix：`loader/`、`plugins/`、`demo/`，上游預設為 188 user-space Shared UI Hub `http://192.168.0.188:18088`。
+3. `ewoooc_base.html` 只在 `WEBCRUMBS_ENABLED=true` 且 runtime URL 通過 http(s) 或同源絕對路徑檢查時輸出 script。
+4. 新增 `/webcrumbs` 診斷入口，顯示 runtime URL、版本、plugin base 與 asset upstream 狀態。
+5. Webcrumbs plugin 必須使用自架且版本化 URI，例如 `/webcrumbs-assets/plugins/<namespace>/<version>/`。
+6. 禁止在生產使用官方 `@latest`、`app.webcrumbs.ai` 或未固定版本的官方 CDN。
+7. 不把 Webcrumbs 上游 repo 整包納入 momo-pro 主服務；若修改 runtime 本體，需另外處理 AGPL-3.0 授權義務。
 
 ## Alternatives Considered
 
@@ -39,6 +40,6 @@ Webcrumbs 在 momo-pro 中只作為「自架、固定版本、可診斷」的共
 ## Consequences
 
 - momo-pro 可在不替換 Flask/Jinja 的前提下，逐步嵌入自架 UI plugin。
-- 生產部署需同步管理 `WEBCRUMBS_*` 變數與 110 Gateway runtime 路徑。
+- 生產部署需同步管理 `WEBCRUMBS_*` 變數與 Shared UI Hub asset upstream。
 - 後續任何 Webcrumbs plugin 上線前，仍需通過真實資料、權限、RWD、效能與 fallback 檢查。
 - 若 runtime URL 無效，系統只會跳過 script 載入並在 config warning / `/webcrumbs` 顯示狀態，不應阻斷主站。

docs/guides/webcrumbs_shared_runtime.md

@@ -16,22 +16,24 @@
 ```env
 WEBCRUMBS_ENABLED=true
 WEBCRUMBS_BASE_URL=https://webcrumbs.wooo.work
-WEBCRUMBS_RUNTIME_VERSION=@v0.1.5
-WEBCRUMBS_RUNTIME_PATH=/runtime/@v0.1.5
+WEBCRUMBS_RUNTIME_VERSION=shared-ui-poc-0.1.0
+WEBCRUMBS_RUNTIME_PATH=/webcrumbs-assets/loader/webcrumbs-compatible-loader.js
 WEBCRUMBS_RUNTIME_URL=
-WEBCRUMBS_PLUGIN_BASE_URL=https://webcrumbs.wooo.work/plugins/momo-pro
+WEBCRUMBS_PLUGIN_BASE_URL=/webcrumbs-assets/plugins
+WEBCRUMBS_ASSET_UPSTREAM_URL=http://192.168.0.188:18088
 ```
 
-若實際部署成 CDN 相容路徑，例如 `https://webcrumbs.wooo.work/@v0.1.5`，請改用：
+目前正式頁面預設走 momo-pro 同源 asset proxy：
+
+- `/webcrumbs-assets/loader/...`
+- `/webcrumbs-assets/plugins/...`
+- `/webcrumbs-assets/demo/...`
+
+這樣即使 `webcrumbs.wooo.work` 的公網 TLS 或 Basic Auth 尚未完全收斂，momo-pro 頁面仍可用 `mo.wooo.work` 同源載入 loader 與 plugin。若日後要改回獨立 Webcrumbs CDN，直接設定：
 
 ```env
-WEBCRUMBS_RUNTIME_PATH=/@v0.1.5
-```
-
-若部署路徑完全不同，直接設定：
-
-```env
-WEBCRUMBS_RUNTIME_URL=https://webcrumbs.wooo.work/custom/runtime.js
+WEBCRUMBS_RUNTIME_URL=https://webcrumbs.wooo.work/shared-ui/loader/webcrumbs-compatible-loader.js
+WEBCRUMBS_PLUGIN_BASE_URL=https://webcrumbs.wooo.work/shared-ui/plugins
 ```
 
 ## 頁面嵌入方式
@@ -39,7 +41,7 @@ WEBCRUMBS_RUNTIME_URL=https://webcrumbs.wooo.work/custom/runtime.js
 全站 runtime 由 `templates/ewoooc_base.html` 載入。頁面只需要放 plugin tag：
 
 ```html
-<webcrumbs-plugin uri="https://webcrumbs.wooo.work/plugins/momo-pro/price-card/v2026.05.31/"></webcrumbs-plugin>
+<stock-platform-plugin uri="/webcrumbs-assets/plugins/finance.market-ticker-strip/0.1.0"></stock-platform-plugin>
 ```
 
 Plugin 目錄至少應提供：
@@ -52,6 +54,7 @@ style.css
 ## 治理規則
 
 - Plugin URI 必須使用自架 domain。
+- 在 momo-pro 正式頁面，優先使用同源 `/webcrumbs-assets/` URI。
 - Plugin 目錄必須版本化，不使用浮動 `latest`。
 - Plugin 不得包含 secret、token、內部 API key。
 - Plugin 若需要正式資料，必須讀 momo-pro 既有 API，不得自行打 DB。
@@ -60,5 +63,6 @@ style.css
 ## 驗收
 
 - `/webcrumbs` 顯示 runtime URL、版本與 plugin base。
+- `/webcrumbs-assets/loader/webcrumbs-compatible-loader.js` 回 200 且 content type 是 JavaScript。
 - `ewoooc_base.html` 在 `WEBCRUMBS_ENABLED=true` 且 runtime URL 有效時輸出 `<script data-webcrumbs-runtime=...>`。
 - 任一試點頁嵌入 plugin 後，瀏覽器 console 不應有 `MISSING_URI`、`STYLE_LOAD_ERROR`、`SCRIPT_LOAD_ERROR`。

docs/memory/current_execution_queue_20260524.md

@@ -102,6 +102,7 @@
 - 2026-05-31 起，`V10.504` 新增市場情報 MCP Fetch Candidate Queue Writer Review Inventory gate：在 writer review handoff 通過後只審核 operator read-only candidate queue inventory 摘要，要求 handoff identity、target table、row count、dedupe keys、review_state、artifact paths、read-only query result、missing/duplicate rows 與 operator confirmation 對齊；仍不讀 token、不執行 CLI、不開 DB、不寫 queue、不更新 review_state、不做 inventory query、不掛 scheduler，只放行到後續人工 candidate queue review。
 - 2026-05-31 起，`V10.505` 新增市場情報 MCP Fetch Candidate Queue Writer Review Decision gate：在 review inventory 通過後只審核 operator candidate queue review decision 摘要，要求 decision identity、target table、row count、dedupe keys、`needs_review` 現態、允許決策、evidence refs、matched row exact-identity/variant/overwrite guard 與 operator confirmation 對齊；仍不讀 token、不執行 CLI、不開 DB、不寫 decision record、不更新 review_state、不寫 match result、不補 queue、不掛 scheduler，只放行到 decision approval / writer preflight 設計。
 - 2026-05-31 起，`V10.506` 新增市場情報 MCP Fetch Candidate Queue Writer Review Decision Approval gate：在 review decision 通過後只審核 operator human approval 摘要，要求 decision linkage、approval identity、target table、row count、dedupe keys、`approved_for_writer_preflight` approval result、decision/approval evidence refs、artifact paths、matched row exact-identity/variant/overwrite guard 與 operator confirmation 對齊；仍不讀 token、不執行 CLI、不開 DB、不寫 approval record、不寫 decision record、不更新 review_state、不寫 match result、不補 queue、不掛 scheduler，只放行到後續 writer preflight 設計。
+- 2026-05-31 起，`V10.509` 新增市場情報 MCP Fetch Candidate Queue Writer Review Decision Approval Writer Preflight gate：在 human approval 通過後只審核 operator writer preflight 摘要，要求 approval linkage、writer_preflight_id、target operation、row count、dedupe keys、approved decision 到 target review_state 的逐列映射、decision/approval/preflight evidence refs、matched row exact-identity/variant/overwrite guard 與 operator boundary；仍不讀 token、不執行 CLI、不開 DB、不寫 preflight/approval/decision/match、不更新 review_state、不補 queue、不掛 scheduler，只放行到後續 CLI review / run package 設計。
 
 ## 3. 12 Agent 決策信封整合
 

docs/memory/history_logs.md

@@ -13,6 +13,8 @@
 ## 📅 詳細更新日誌 (考古存檔)
 
 ### 2026-05-31：Webcrumbs 共用 UI Runtime 與市場情報 writer approval
+- **V10.509 市場情報 MCP Fetch Candidate Queue Writer Review Decision Approval Writer Preflight gate**: 新增 `/api/market_intel/mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight` 與 UI preview，只審核 human approval 通過後的 operator writer preflight 摘要；要求 approval linkage、writer_preflight_id、target operation、row count、dedupe keys、approved decision 到 target review_state 的逐列映射、decision/approval/preflight evidence refs、artifact paths、matched row exact-identity/variant/overwrite guard 與 operator confirmation 對齊，且 API 不讀 token、不執行 CLI、不開 DB、不寫 preflight/approval/decision/match、不更新 review_state、不補 queue、不掛 scheduler，只放行到後續 CLI review / run package 設計。
+- **V10.508 Webcrumbs 同源 asset proxy 收斂**: 正式頁面 runtime 預設改走 `/webcrumbs-assets/loader/webcrumbs-compatible-loader.js`，由 momo-pro 代理 188 Shared UI Hub 的 allowlist asset path（`loader/`、`plugins/`、`demo/`），避免 `webcrumbs.wooo.work` 公網 TLS、Basic Auth 或入口轉發尚未完成時造成頁面 script 載入失敗；`/webcrumbs` 診斷頁同步顯示 asset upstream，`WEBCRUMBS_PLUGIN_BASE_URL` 預設改為同源 `/webcrumbs-assets/plugins`。
 - **V10.507 Webcrumbs 共用 UI Runtime 接入**: 新增 `WEBCRUMBS_*` 設定、`/webcrumbs` 診斷頁、全站 `ewoooc_base.html` runtime script 載入守門與側欄入口；runtime 僅允許自架固定版本 URL，禁止正式環境使用官方 `@latest`，並新增 `docs/guides/webcrumbs_shared_runtime.md` 與 ADR-037 記錄共用 microfrontend/plugin loader 邊界。
 - **V10.506 市場情報 MCP Fetch Candidate Queue Writer Review Decision Approval gate**: 新增 `/api/market_intel/mcp_fetch_candidate_queue_writer_review_decision_approval` 與 UI preview，只審核 review decision 通過後的 operator human approval 摘要；要求 decision linkage、approval identity、target table、row count、dedupe keys、`approved_for_writer_preflight` approval result、decision/approval evidence refs、artifact paths、matched row exact-identity/variant/overwrite guard 與 operator confirmation 對齊，且 API 不讀 token、不執行 CLI、不開 DB、不寫 approval record、不寫 decision record、不更新 review_state、不寫 match result、不補 queue、不掛 scheduler，只放行到後續 writer preflight 設計。新 endpoint 拆到 `routes/market_intel_mcp_review_routes.py`，避免既有 MCP run route 繼續膨脹。
 

routes/market_intel_mcp_review_routes.py

@@ -10,6 +10,9 @@ from services.market_intel import MarketIntelService
 from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval import (
     build_mcp_fetch_candidate_queue_writer_review_decision_approval_preview,
 )
+from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight import (
+    build_mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_preview,
+)
 
 
 @market_intel_bp.route(
@@ -62,3 +65,67 @@ def market_intel_mcp_fetch_candidate_queue_writer_review_decision_approval():
             phase=service.phase,
         )
     )
+
+
+@market_intel_bp.route(
+    "/api/market_intel/mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight",
+    methods=["GET", "POST"],
+)
+@login_required
+def market_intel_mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight():
+    writer_review_decision_approval_package = {}
+    writer_review_decision_approval_result = None
+    operator_writer_preflight = None
+    if request.method == "POST":
+        payload = request.get_json(silent=True) or {}
+        package = (
+            payload.get("writer_review_decision_approval_writer_preflight_package")
+            or payload.get(
+                "candidate_queue_writer_review_decision_approval_writer_preflight"
+            )
+            or payload.get("review_decision_approval_writer_preflight")
+            or payload.get("operator_writer_preflight")
+            or payload.get("operator_review_decision_approval_writer_preflight")
+            or payload
+        )
+        writer_review_decision_approval_package = (
+            package.get("writer_review_decision_approval_package")
+            or package.get("candidate_queue_writer_review_decision_approval")
+            or package.get("writer_review_decision_approval")
+            or package.get("review_decision_approval_package")
+            or package.get("review_decision_approval")
+            or {}
+        )
+        writer_review_decision_approval_result = (
+            package.get("writer_review_decision_approval_result")
+            or package.get(
+                "mcp_fetch_candidate_queue_writer_review_decision_approval"
+            )
+        )
+        operator_writer_preflight = (
+            package.get("operator_writer_preflight")
+            or package.get("operator_review_decision_approval_writer_preflight")
+            or package.get(
+                "candidate_queue_review_decision_approval_writer_preflight"
+            )
+            or package.get("writer_review_decision_approval_writer_preflight")
+            or package.get("writer_preflight_payload")
+            or package.get("preflight_payload")
+            or package.get("preflight")
+        )
+
+    service = MarketIntelService()
+    return jsonify(
+        build_mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_preview(
+            writer_review_decision_approval_package=(
+                writer_review_decision_approval_package
+            ),
+            writer_review_decision_approval_result=(
+                writer_review_decision_approval_result
+            ),
+            operator_review_decision_approval_writer_preflight=(
+                operator_writer_preflight
+            ),
+            phase=service.phase,
+        )
+    )

routes/system_public_routes.py

@@ -6,11 +6,14 @@
 """
 
 import os
+import mimetypes
+import posixpath
 import zipfile
 from datetime import datetime, timezone, timedelta
-from urllib.parse import urlparse
+from urllib.parse import quote, urlparse
 
 from flask import Blueprint, Response, jsonify, render_template, send_from_directory, url_for
+import requests
 from sqlalchemy import text
 
 from auth import login_required
@@ -20,6 +23,7 @@ from config import (
     GRIST_URL,
     METABASE_URL,
     SYSTEM_VERSION,
+    WEBCRUMBS_ASSET_UPSTREAM_URL,
     WEBCRUMBS_BASE_URL,
     WEBCRUMBS_ENABLED,
     WEBCRUMBS_PLUGIN_BASE_URL,
@@ -40,6 +44,7 @@ TAIPEI_TZ = timezone(timedelta(hours=8))
 LOG_FILE_PATH = os.path.join(BASE_DIR, 'logs/system.log')
 public_url = os.getenv('PUBLIC_URL', '服務啟動中...')
 STATIC_DIR = os.path.join(BASE_DIR, 'web/static')
+WEBCRUMBS_ASSET_ALLOWED_PREFIXES = ('loader/', 'plugins/', 'demo/')
 
 
 def _safe_launch_url(configured_url, bridge_path):
@@ -109,8 +114,8 @@ def _external_tool_payload(kind):
             'eyebrow': 'Shared UI Runtime',
             'title': 'Webcrumbs 共用 UI Runtime',
             'status_label': 'Runtime 已接入' if runtime_ready else 'Runtime 未啟用',
-            'summary': 'Webcrumbs 已接到 momo-pro 全站 shell，後續頁面可用共用 microfrontend runtime 嵌入跨專案 UI 外掛。',
-            'detail': '本入口只顯示共用 runtime 的部署與設定狀態；正式頁面要嵌入外掛時，請使用自架 plugin URI，並將版本固定在已驗收路徑，不使用官方 @latest。',
+            'summary': 'Webcrumbs 已接到 momo-pro 全站 shell，正式頁面透過同源 asset proxy 載入 shared-ui loader 與版本化外掛。',
+            'detail': '工具入口可開啟 Webcrumbs/Open Design；正式頁面載入則走 /webcrumbs-assets/，避免跨域憑證或官方 @latest 造成生產頁面不穩。',
             'launch_href': launch_url,
             'launch_label': '開啟 Webcrumbs',
             'configured_label': WEBCRUMBS_RUNTIME_URL or '未設定',
@@ -119,6 +124,7 @@ def _external_tool_payload(kind):
                 {'label': 'Runtime', 'value': '已載入全站 shell' if runtime_ready else '未啟用或 URL 無效', 'state': 'ok' if runtime_ready else 'warn'},
                 {'label': '版本', 'value': WEBCRUMBS_RUNTIME_VERSION or '未指定', 'state': 'ok' if WEBCRUMBS_RUNTIME_VERSION else 'warn'},
                 {'label': 'Plugin Base', 'value': WEBCRUMBS_PLUGIN_BASE_URL or '未設定', 'state': 'ok' if WEBCRUMBS_PLUGIN_BASE_URL else 'warn'},
+                {'label': 'Asset Proxy', 'value': WEBCRUMBS_ASSET_UPSTREAM_URL or '未設定', 'state': 'ok' if WEBCRUMBS_ASSET_UPSTREAM_URL else 'warn'},
             ],
             'actions': [
                 {'label': '商品看板', 'href': '/', 'icon': 'fas fa-border-all'},
@@ -218,6 +224,45 @@ def webcrumbs_status():
     )
 
 
+def _normalize_webcrumbs_asset_path(asset_path):
+    candidate = (asset_path or '').strip().replace('\\', '/')
+    normalized = posixpath.normpath(candidate).lstrip('/')
+    if normalized in {'', '.'} or normalized != candidate.lstrip('/'):
+        return ''
+    if not normalized.startswith(WEBCRUMBS_ASSET_ALLOWED_PREFIXES):
+        return ''
+    return normalized
+
+
+@system_public_bp.route('/webcrumbs-assets/<path:asset_path>')
+def webcrumbs_asset_proxy(asset_path):
+    """Serve allowlisted shared-ui assets through momo-pro's own origin."""
+    normalized_path = _normalize_webcrumbs_asset_path(asset_path)
+    if not WEBCRUMBS_ENABLED or not WEBCRUMBS_ASSET_UPSTREAM_URL or not normalized_path:
+        return Response('Webcrumbs asset not available', status=404, mimetype='text/plain')
+
+    upstream_url = f"{WEBCRUMBS_ASSET_UPSTREAM_URL}/{quote(normalized_path, safe='/@._-')}"
+    try:
+        upstream_response = requests.get(upstream_url, timeout=(2, 8))
+    except requests.RequestException as exc:
+        sys_log.warning(f"[Webcrumbs] Asset proxy failed: {normalized_path} -> {exc}")
+        return Response('Webcrumbs asset upstream unavailable', status=502, mimetype='text/plain')
+
+    if upstream_response.status_code >= 400:
+        sys_log.warning(f"[Webcrumbs] Asset proxy returned {upstream_response.status_code}: {normalized_path}")
+        return Response('Webcrumbs asset upstream returned error', status=upstream_response.status_code, mimetype='text/plain')
+
+    content_type = upstream_response.headers.get('Content-Type')
+    if not content_type:
+        content_type = mimetypes.guess_type(normalized_path)[0] or 'application/octet-stream'
+    response = Response(upstream_response.content, status=upstream_response.status_code)
+    response.headers['Content-Type'] = content_type
+    response.headers['Cache-Control'] = 'public, max-age=300'
+    response.headers['X-Content-Type-Options'] = 'nosniff'
+    response.headers['Referrer-Policy'] = 'no-referrer'
+    return response
+
+
 @system_public_bp.route('/metrics')
 def prometheus_metrics():
     """Prometheus 指標端點 - 供 Prometheus 抓取監控資料"""

services/market_intel/deployment_readiness.py

@@ -114,6 +114,9 @@ from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision impo
 from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval import (
     build_mcp_fetch_candidate_queue_writer_review_decision_approval_preview,
 )
+from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight import (
+    build_mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_preview,
+)
 from services.market_intel.mcp_manual_fetch_handoff import (
     build_mcp_manual_fetch_handoff_preview,
 )
@@ -303,6 +306,13 @@ PRODUCTION_SMOKE_TARGETS = (
     + ("/api/market_intel/mcp_fetch_candidate_queue_writer_review_decision_approval",)
     + PRODUCTION_SMOKE_TARGETS[-1:]
 )
+PRODUCTION_SMOKE_TARGETS = (
+    PRODUCTION_SMOKE_TARGETS[:-1]
+    + (
+        "/api/market_intel/mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight",
+    )
+    + PRODUCTION_SMOKE_TARGETS[-1:]
+)
 
 
 def _run_review_preview_safe(payload, mode):
@@ -411,6 +421,11 @@ def build_deployment_readiness_preview(*, service, market_intel_tables, schema_s
             phase=service.phase,
         )
     )
+    mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight = (
+        build_mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_preview(
+            phase=service.phase,
+        )
+    )
     scheduler_plan = service.build_scheduler_plan()
     manual_sample_plan = service.build_manual_sample_plan()
     manual_sample_acceptance = service.build_manual_sample_acceptance()
@@ -1507,6 +1522,10 @@ def build_deployment_readiness_preview(*, service, market_intel_tables, schema_s
                 "candidate_review_state_updated"
             ]
         ),
+        "mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_preview_safe": _run_review_preview_safe(
+            mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight,
+            "mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_preview",
+        ),
         "candidate_queue_writer_postwrite_smoke_planned_safe": bool(
             candidate_queue_writer_postwrite_smoke["mode"]
             == "candidate_queue_writer_postwrite_smoke_planned"
@@ -1837,6 +1856,7 @@ def build_deployment_readiness_preview(*, service, market_intel_tables, schema_s
         "mcp_fetch_candidate_queue_writer_review_inventory": mcp_fetch_candidate_queue_writer_review_inventory,
         "mcp_fetch_candidate_queue_writer_review_decision": mcp_fetch_candidate_queue_writer_review_decision,
         "mcp_fetch_candidate_queue_writer_review_decision_approval": mcp_fetch_candidate_queue_writer_review_decision_approval,
+        "mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight": mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight,
         "scheduler_plan": scheduler_plan,
         "manual_sample_plan": manual_sample_plan,
         "manual_sample_acceptance": manual_sample_acceptance,

services/market_intel/mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight.py

@@ -0,0 +1,575 @@
+"""市場情報 MCP review decision approval writer preflight。
+
+本模組只審核人工 approval 後的 writer preflight 摘要；
+API/UI 不讀 approval token、不執行 CLI、不開 DB、不寫 preflight record、
+不更新 review_state、不寫 decision/match、不補 queue、不掛 scheduler。
+"""
+
+from services.market_intel.mcp_fetch_candidate_queue_writer_preflight import TARGET_TABLE
+from services.market_intel.mcp_fetch_candidate_queue_writer_run_readiness import (
+    ARTIFACT_PREFIX,
+)
+from services.market_intel.mcp_fetch_candidate_queue_writer_post_closeout_inventory_review import (
+    FORBIDDEN_SECRET_KEYS,
+    SAFE_SECRET_METADATA_KEYS,
+    _as_dict,
+    _as_list,
+    _blocked_side_effects,
+    _contains_forbidden_key,
+    _safe_int,
+    _safe_path,
+    _safe_text,
+)
+from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval import (
+    build_mcp_fetch_candidate_queue_writer_review_decision_approval_preview,
+)
+from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_gates import (
+    ALLOWED_PREFLIGHT_MODES,
+    ALLOWED_PREFLIGHT_SCOPES,
+    TARGET_OPERATION,
+    build_approval_writer_preflight_gates,
+)
+from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_sample import (
+    build_sample_writer_review_decision_approval_writer_preflight_package,
+)
+from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_gates import (
+    ALLOWED_REVIEW_DECISIONS,
+)
+
+
+_PREFLIGHT_BLOCKED_SIDE_EFFECT_KEYS = (
+    "allow_api_candidate_review_update",
+    "allow_api_execution",
+    "allow_api_file_write",
+    "allow_api_match_write",
+    "allow_api_queue_insert",
+    "allow_api_queue_write",
+    "allow_cli_execution",
+    "allow_database_write",
+    "api_candidate_review_update_executed",
+    "api_created_writer_preflight_file",
+    "api_executes_review_state_writer",
+    "api_review_state_update_executed",
+    "api_updates_review_state",
+    "api_write_allowed",
+    "api_writes_approval_record",
+    "api_writes_decision_record",
+    "api_writes_match_result",
+    "api_writes_preflight_record",
+    "candidate_queue_review_decision_approval_writer_preflight_file_written",
+    "candidate_queue_review_decision_approval_writer_preflight_persisted",
+    "decision_record_written",
+    "market_product_match_written",
+    "match_result_written",
+    "preflight_record_written",
+    "review_state_update_executed",
+    "writer_preflight_file_written",
+    "writer_preflight_persisted",
+)
+
+
+def _blocked_preflight_side_effects(payload):
+    found = list(_blocked_side_effects(payload))
+
+    def visit(value, path):
+        if isinstance(value, dict):
+            for key, item in value.items():
+                normalized_key = str(key).lower()
+                key_path = f"{path}.{key}" if path else key
+                if (
+                    normalized_key in _PREFLIGHT_BLOCKED_SIDE_EFFECT_KEYS
+                    and bool(item)
+                ):
+                    found.append(key_path)
+                visit(item, key_path)
+        elif isinstance(value, list):
+            for index, item in enumerate(value):
+                visit(item, f"{path}[{index}]")
+
+    visit(payload, "")
+    return sorted(set(found))
+
+
+def _approval_from_inputs(approval_package, approval_result, phase):
+    if isinstance(approval_result, dict) and approval_result:
+        return approval_result
+
+    approval_package = _as_dict(approval_package)
+    return build_mcp_fetch_candidate_queue_writer_review_decision_approval_preview(
+        writer_review_decision_package=(
+            approval_package.get("writer_review_decision_package")
+            or approval_package.get("candidate_queue_writer_review_decision")
+            or approval_package.get("writer_review_decision")
+            or approval_package.get("review_decision_package")
+            or approval_package.get("review_decision")
+            or {}
+        ),
+        writer_review_decision_result=(
+            approval_package.get("writer_review_decision_result")
+            or approval_package.get(
+                "mcp_fetch_candidate_queue_writer_review_decision"
+            )
+        ),
+        operator_review_decision_approval=(
+            approval_package.get("operator_review_decision_approval")
+            or approval_package.get("operator_review_approval")
+            or approval_package.get("candidate_queue_review_decision_approval")
+            or approval_package.get("writer_review_decision_approval")
+            or approval_package.get("approval_payload")
+            or approval_package.get("approval")
+        ),
+        phase=phase,
+    )
+
+
+def _approval_summary(approval_result):
+    approval_result = _as_dict(approval_result)
+    approval = _as_dict(
+        approval_result.get("operator_review_decision_approval_summary")
+        or approval_result.get("operator_review_approval_summary")
+    )
+    side_effects_clear = bool(
+        not approval_result.get("payload_persisted")
+        and not approval_result.get("review_decision_approval_persisted")
+        and not approval_result.get("candidate_queue_review_decision_approval_persisted")
+        and not approval_result.get("candidate_queue_review_decision_approval_file_written")
+        and not approval_result.get("approval_record_written")
+        and not approval_result.get("decision_record_written")
+        and not approval_result.get("match_result_written")
+        and not approval_result.get("api_executes_cli")
+        and not approval_result.get("api_reads_approval_token")
+        and not approval_result.get("api_opens_database_connection")
+        and not approval_result.get("api_writes_database")
+        and not approval_result.get("api_writes_file")
+        and not approval_result.get("api_updates_review_state")
+        and not approval_result.get("api_writes_approval_record")
+        and not approval_result.get("api_writes_decision_record")
+        and not approval_result.get("api_writes_match_result")
+        and not approval_result.get("database_write_executed")
+        and not approval_result.get("database_commit_executed")
+        and not approval_result.get("cli_executed")
+        and not approval_result.get("file_written")
+        and not approval_result.get("scheduler_attached")
+        and not approval_result.get("candidate_queue_persisted")
+        and not approval_result.get("candidate_review_state_updated")
+    )
+    return {
+        "mode": approval_result.get("mode"),
+        "accepted": bool(
+            approval_result.get(
+                "mcp_fetch_candidate_queue_writer_review_decision_approval_accepted"
+            )
+        ),
+        "ready_for_candidate_queue_review_decision_writer_preflight": bool(
+            approval_result.get(
+                "ready_for_candidate_queue_review_decision_writer_preflight"
+            )
+        ),
+        "approval_id": _safe_text(approval.get("approval_id"), 160),
+        "review_decision_id": _safe_text(approval.get("review_decision_id"), 160),
+        "review_inventory_id": _safe_text(approval.get("review_inventory_id"), 160),
+        "handoff_id": _safe_text(approval.get("handoff_id"), 160),
+        "inventory_review_id": _safe_text(approval.get("inventory_review_id"), 160),
+        "closeout_id": _safe_text(approval.get("closeout_id"), 160),
+        "run_package_id": _safe_text(approval.get("run_package_id"), 160),
+        "receipt_id": _safe_text(approval.get("receipt_id"), 160),
+        "target_table": _safe_text(approval.get("target_table"), 160),
+        "approved_row_count": _safe_int(
+            approval.get("approved_row_count") or approval.get("approval_row_count")
+        ),
+        "expected_dedupe_keys": [
+            _safe_text(item, 160)
+            for item in _as_list(approval.get("expected_dedupe_keys"))
+            if _safe_text(item, 160)
+        ],
+        "approval_rows": _as_list(
+            approval.get("approved_rows") or approval.get("approval_rows")
+        ),
+        "review_queue_artifact_path": _safe_text(
+            approval.get("review_queue_artifact_path")
+        ),
+        "review_inventory_artifact_path": _safe_text(
+            approval.get("review_inventory_artifact_path")
+        ),
+        "review_decision_artifact_path": _safe_text(
+            approval.get("review_decision_artifact_path")
+        ),
+        "approval_artifact_path": _safe_text(
+            approval.get("approval_artifact_path")
+            or approval.get("review_decision_approval_artifact_path")
+        ),
+        "side_effects_clear": side_effects_clear,
+        "blocked_reasons": approval_result.get("blocked_reasons", []),
+    }
+
+
+def _preflight_row_summary(row):
+    row = _as_dict(row)
+    decision_evidence_ref = _safe_text(row.get("decision_evidence_ref"))
+    approval_evidence_ref = _safe_text(row.get("approval_evidence_ref"))
+    preflight_evidence_ref = _safe_text(
+        row.get("preflight_evidence_ref") or row.get("evidence_ref")
+    )
+    return {
+        "dedupe_key": _safe_text(row.get("dedupe_key"), 160),
+        "current_review_state": _safe_text(row.get("current_review_state"), 80),
+        "approved_review_decision": _safe_text(
+            row.get("approved_review_decision"), 80
+        ),
+        "target_review_state": _safe_text(row.get("target_review_state"), 80),
+        "statement_type": _safe_text(row.get("statement_type"), 80),
+        "operation": _safe_text(row.get("operation"), 80),
+        "writer_action": _safe_text(row.get("writer_action"), 120),
+        "evidence_lane": _safe_text(row.get("evidence_lane"), 120),
+        "decision_evidence_ref": decision_evidence_ref,
+        "approval_evidence_ref": approval_evidence_ref,
+        "preflight_evidence_ref": preflight_evidence_ref,
+        "decision_evidence_ref_safe": _safe_path(
+            decision_evidence_ref,
+            prefixes=(ARTIFACT_PREFIX,),
+            suffixes=(".json",),
+        ),
+        "approval_evidence_ref_safe": _safe_path(
+            approval_evidence_ref,
+            prefixes=(ARTIFACT_PREFIX,),
+            suffixes=(".json",),
+        ),
+        "preflight_evidence_ref_safe": _safe_path(
+            preflight_evidence_ref,
+            prefixes=(ARTIFACT_PREFIX,),
+            suffixes=(".json",),
+        ),
+        "preflight_notes_present": bool(_safe_text(row.get("preflight_notes"))),
+        "hard_veto_present": bool(row.get("hard_veto_present")),
+        "stronger_existing_match_conflict": bool(
+            row.get("stronger_existing_match_conflict")
+        ),
+        "false_positive_guard_passed": bool(row.get("false_positive_guard_passed")),
+        "variant_conflict_checked": bool(row.get("variant_conflict_checked")),
+        "overwrite_protection_checked": bool(row.get("overwrite_protection_checked")),
+        "exact_identity_confirmed": bool(row.get("exact_identity_confirmed")),
+    }
+
+
+def _operator_preflight_summary(operator_preflight):
+    operator_preflight = _as_dict(operator_preflight)
+    confirmations = _as_dict(operator_preflight.get("operator_confirmations"))
+    rows = [
+        _preflight_row_summary(row)
+        for row in _as_list(operator_preflight.get("preflight_rows"))
+    ]
+    expected_dedupe_keys = [
+        _safe_text(item, 160)
+        for item in _as_list(operator_preflight.get("expected_dedupe_keys"))
+        if _safe_text(item, 160)
+    ]
+    return {
+        "provided_keys": sorted(operator_preflight.keys()),
+        "writer_preflight_id": _safe_text(
+            operator_preflight.get("writer_preflight_id")
+            or operator_preflight.get("preflight_id"),
+            160,
+        ),
+        "approval_id": _safe_text(operator_preflight.get("approval_id"), 160),
+        "review_decision_id": _safe_text(
+            operator_preflight.get("review_decision_id"), 160
+        ),
+        "review_inventory_id": _safe_text(
+            operator_preflight.get("review_inventory_id"), 160
+        ),
+        "handoff_id": _safe_text(operator_preflight.get("handoff_id"), 160),
+        "inventory_review_id": _safe_text(
+            operator_preflight.get("inventory_review_id"), 160
+        ),
+        "closeout_id": _safe_text(operator_preflight.get("closeout_id"), 160),
+        "run_package_id": _safe_text(operator_preflight.get("run_package_id"), 160),
+        "receipt_id": _safe_text(operator_preflight.get("receipt_id"), 160),
+        "target_table": _safe_text(operator_preflight.get("target_table"), 160),
+        "target_operation": _safe_text(
+            operator_preflight.get("target_operation"), 160
+        ),
+        "preflight_scope": _safe_text(
+            operator_preflight.get("preflight_scope"), 160
+        ),
+        "preflight_mode": _safe_text(
+            operator_preflight.get("preflight_mode"), 160
+        ),
+        "expected_current_review_state": _safe_text(
+            operator_preflight.get("expected_current_review_state"), 80
+        ),
+        "preflight_row_count": _safe_int(
+            operator_preflight.get("preflight_row_count")
+        ),
+        "expected_preflight_row_count": _safe_int(
+            operator_preflight.get("expected_preflight_row_count")
+            or operator_preflight.get("preflight_row_count")
+        ),
+        "expected_dedupe_keys": expected_dedupe_keys,
+        "preflight_rows": rows,
+        "review_queue_artifact_path": _safe_text(
+            operator_preflight.get("review_queue_artifact_path")
+        ),
+        "review_inventory_artifact_path": _safe_text(
+            operator_preflight.get("review_inventory_artifact_path")
+        ),
+        "review_decision_artifact_path": _safe_text(
+            operator_preflight.get("review_decision_artifact_path")
+        ),
+        "approval_artifact_path": _safe_text(
+            operator_preflight.get("approval_artifact_path")
+            or operator_preflight.get("review_decision_approval_artifact_path")
+        ),
+        "writer_preflight_artifact_path": _safe_text(
+            operator_preflight.get("writer_preflight_artifact_path")
+            or operator_preflight.get("preflight_artifact_path")
+        ),
+        "review_queue_artifact_path_safe": _safe_path(
+            operator_preflight.get("review_queue_artifact_path"),
+            prefixes=(ARTIFACT_PREFIX,),
+            suffixes=(".json",),
+        ),
+        "review_inventory_artifact_path_safe": _safe_path(
+            operator_preflight.get("review_inventory_artifact_path"),
+            prefixes=(ARTIFACT_PREFIX,),
+            suffixes=(".json",),
+        ),
+        "review_decision_artifact_path_safe": _safe_path(
+            operator_preflight.get("review_decision_artifact_path"),
+            prefixes=(ARTIFACT_PREFIX,),
+            suffixes=(".json",),
+        ),
+        "approval_artifact_path_safe": _safe_path(
+            operator_preflight.get("approval_artifact_path")
+            or operator_preflight.get("review_decision_approval_artifact_path"),
+            prefixes=(ARTIFACT_PREFIX,),
+            suffixes=(".json",),
+        ),
+        "writer_preflight_artifact_path_safe": _safe_path(
+            operator_preflight.get("writer_preflight_artifact_path")
+            or operator_preflight.get("preflight_artifact_path"),
+            prefixes=(ARTIFACT_PREFIX,),
+            suffixes=(".json",),
+        ),
+        "approval_checked": bool(confirmations.get("approval_checked")),
+        "writer_preflight_is_cli_only": bool(
+            confirmations.get("writer_preflight_is_cli_only")
+        ),
+        "manual_record_required": bool(confirmations.get("manual_record_required")),
+        "no_approval_token_payload": bool(
+            confirmations.get("no_approval_token_payload")
+        ),
+        "no_api_cli_execution": bool(confirmations.get("no_api_cli_execution")),
+        "no_api_database_write": bool(confirmations.get("no_api_database_write")),
+        "no_api_review_state_update": bool(
+            confirmations.get("no_api_review_state_update")
+        ),
+        "no_api_decision_record_write": bool(
+            confirmations.get("no_api_decision_record_write")
+        ),
+        "no_api_match_write": bool(confirmations.get("no_api_match_write")),
+        "no_api_queue_insert": bool(confirmations.get("no_api_queue_insert")),
+        "no_api_file_write": bool(confirmations.get("no_api_file_write")),
+        "no_scheduler_attach": bool(confirmations.get("no_scheduler_attach")),
+        "rows_match_approval": bool(confirmations.get("rows_match_approval")),
+        "schema_preflight_required": bool(
+            confirmations.get("schema_preflight_required")
+        ),
+        "status_transition_reviewed": bool(
+            confirmations.get("status_transition_reviewed")
+        ),
+        "stronger_existing_match_guard_preserved": bool(
+            confirmations.get("stronger_existing_match_guard_preserved")
+        ),
+        "false_positive_guard_completed": bool(
+            confirmations.get("false_positive_guard_completed")
+        ),
+        "variant_sensitive_review_completed": bool(
+            confirmations.get("variant_sensitive_review_completed")
+        ),
+        "hard_veto_respected": bool(confirmations.get("hard_veto_respected")),
+        "api_execution_allowed": bool(operator_preflight.get("api_execution_allowed")),
+        "real_write_allowed_by_api": bool(
+            operator_preflight.get("real_write_allowed_by_api")
+        ),
+        "api_candidate_review_allowed": bool(
+            operator_preflight.get("api_candidate_review_allowed")
+        ),
+        "api_updates_review_state": bool(
+            operator_preflight.get("api_updates_review_state")
+        ),
+        "api_writes_preflight_record": bool(
+            operator_preflight.get("api_writes_preflight_record")
+        ),
+        "api_writes_approval_record": bool(
+            operator_preflight.get("api_writes_approval_record")
+        ),
+        "api_writes_decision_record": bool(
+            operator_preflight.get("api_writes_decision_record")
+        ),
+        "api_writes_match_result": bool(
+            operator_preflight.get("api_writes_match_result")
+        ),
+        "secret_or_token_submitted_to_api": _contains_forbidden_key(
+            operator_preflight,
+            FORBIDDEN_SECRET_KEYS,
+            safe_keys=SAFE_SECRET_METADATA_KEYS,
+        ),
+        "blocked_side_effects": _blocked_preflight_side_effects(operator_preflight),
+    }
+
+
+def build_mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_preview(
+    *,
+    writer_review_decision_approval_package=None,
+    writer_review_decision_approval_result=None,
+    operator_review_decision_approval_writer_preflight=None,
+    operator_writer_preflight=None,
+    phase=None,
+):
+    """建立 approval writer preflight；不執行查詢、寫檔或寫入。"""
+    if operator_review_decision_approval_writer_preflight is None:
+        operator_review_decision_approval_writer_preflight = operator_writer_preflight
+    writer_review_decision_approval_package = _as_dict(
+        writer_review_decision_approval_package
+    )
+    approval_result_received = bool(
+        isinstance(writer_review_decision_approval_result, dict)
+        and writer_review_decision_approval_result
+    )
+    preflight_valid_object = (
+        isinstance(operator_review_decision_approval_writer_preflight, dict)
+        if operator_review_decision_approval_writer_preflight is not None
+        else True
+    )
+    preflight_payload = _as_dict(
+        operator_review_decision_approval_writer_preflight
+    )
+    approval_received = bool(
+        writer_review_decision_approval_package or approval_result_received
+    )
+    approval_result = (
+        _approval_from_inputs(
+            writer_review_decision_approval_package,
+            writer_review_decision_approval_result,
+            phase,
+        )
+        if approval_received
+        else {}
+    )
+    payload_received = bool(
+        approval_received
+        or preflight_payload
+        or operator_review_decision_approval_writer_preflight is not None
+    )
+    preflight_received = bool(preflight_payload)
+    approval = _approval_summary(approval_result)
+    preflight = _operator_preflight_summary(preflight_payload)
+    gates = build_approval_writer_preflight_gates(
+        approval_received=approval_received,
+        preflight_received=preflight_received and preflight_valid_object,
+        approval=approval,
+        preflight=preflight,
+    )
+    blocked_reasons = [gate["key"] for gate in gates if not gate["passed"]]
+    if not preflight_valid_object:
+        blocked_reasons.append(
+            "operator_review_decision_approval_writer_preflight_valid_object"
+        )
+    accepted = bool(payload_received and not blocked_reasons)
+
+    return {
+        "mode": (
+            "mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight"
+            if payload_received
+            else "mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_preview"
+        ),
+        "phase": phase,
+        "writer_review_decision_approval_writer_preflight_payload_received": (
+            payload_received
+        ),
+        "writer_review_decision_approval_received": approval_received,
+        "operator_writer_preflight_received": preflight_received,
+        "operator_writer_preflight_valid_object": preflight_valid_object,
+        "writer_review_decision_approval_accepted": approval["accepted"],
+        "mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_accepted": accepted,
+        "candidate_queue_writer_review_decision_approval_writer_preflight_ready": accepted,
+        "ready_for_candidate_queue_review_decision_writer_cli_review": accepted,
+        "ready_for_candidate_queue_review_state_writer": False,
+        "ready_for_api_review_state_update": False,
+        "ready_for_api_database_write": False,
+        "ready_for_api_decision_record_write": False,
+        "ready_for_api_match_write": False,
+        "ready_for_real_write": False,
+        "ready_for_scheduler_attach": False,
+        "network_request_allowed": False,
+        "api_executes_cli": False,
+        "api_reads_approval_token": False,
+        "api_opens_database_connection": False,
+        "api_writes_database": False,
+        "api_writes_file": False,
+        "api_uses_external_network": False,
+        "api_updates_review_state": False,
+        "api_writes_preflight_record": False,
+        "api_writes_approval_record": False,
+        "api_writes_decision_record": False,
+        "api_writes_match_result": False,
+        "payload_row_count": preflight["preflight_row_count"],
+        "gate_count": len(gates),
+        "passed_gate_count": sum(1 for gate in gates if gate["passed"]),
+        "blocked_reasons": blocked_reasons,
+        "gates": gates,
+        "writer_review_decision_approval_summary": approval,
+        "operator_writer_preflight_summary": preflight,
+        "preflight_rows": preflight["preflight_rows"],
+        "writer_preflight_contract": {
+            "target_table": TARGET_TABLE,
+            "target_operation": TARGET_OPERATION,
+            "expected_current_state": "needs_review",
+            "allowed_next_states": list(ALLOWED_REVIEW_DECISIONS),
+            "allowed_preflight_modes": list(ALLOWED_PREFLIGHT_MODES),
+            "allowed_preflight_scopes": list(ALLOWED_PREFLIGHT_SCOPES),
+            "manual_cli_writer_required": True,
+            "next_gate": "candidate_queue_review_decision_writer_cli_review",
+            "forbidden_api_actions": [
+                "update_review_state",
+                "write_preflight_record",
+                "write_approval_record",
+                "write_decision_record",
+                "write_match_result",
+                "insert_missing_queue_row",
+                "attach_scheduler",
+            ],
+        },
+        "sample_writer_review_decision_approval_writer_preflight_package": (
+            build_sample_writer_review_decision_approval_writer_preflight_package()
+        ),
+        "next_operator_steps": [
+            "Writer preflight 通過後，只代表可進入 CLI review / run package 設計",
+            "API/UI 仍不得自動寫 review_state、decision record、approval record 或 match result",
+            "正式寫入仍必須走 shell-only token、read-only preflight、receipt 與 post-write smoke",
+        ],
+        "payload_persisted": False,
+        "writer_preflight_persisted": False,
+        "candidate_queue_review_decision_approval_writer_preflight_persisted": False,
+        "candidate_queue_review_decision_approval_writer_preflight_file_written": False,
+        "preflight_record_written": False,
+        "preflight_record_file_written": False,
+        "approval_record_written": False,
+        "decision_record_written": False,
+        "match_result_written": False,
+        "market_product_match_written": False,
+        "package_artifact_created": False,
+        "database_connection_opened": False,
+        "database_session_created": False,
+        "database_commit_executed": False,
+        "database_write_executed": False,
+        "external_network_executed": False,
+        "cli_executed": False,
+        "file_written": False,
+        "writes_executed": False,
+        "would_write_database": False,
+        "scheduler_attached": False,
+        "candidate_queue_created": False,
+        "candidate_queue_persisted": False,
+        "candidate_review_state_updated": False,
+    }

services/market_intel/mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_gates.py

@@ -0,0 +1,272 @@
+"""Gate checks for review decision approval writer preflight."""
+
+from services.market_intel.mcp_fetch_candidate_queue_writer_preflight import TARGET_TABLE
+from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_gates import (
+    ALLOWED_REVIEW_DECISIONS,
+)
+
+ALLOWED_PREFLIGHT_MODES = ("cli_only_writer_preflight_preview",)
+ALLOWED_PREFLIGHT_SCOPES = (
+    "candidate_queue_review_decision_approval_writer_preflight",
+)
+TARGET_OPERATION = "update_review_state_from_approved_decision"
+
+
+def _row_keys_match_expected(preflight):
+    row_keys = [row["dedupe_key"] for row in preflight["preflight_rows"]]
+    expected_keys = preflight["expected_dedupe_keys"]
+    return bool(
+        row_keys
+        and len(row_keys) == len(set(row_keys))
+        and set(row_keys) == set(expected_keys)
+    )
+
+
+def _preflight_rows_match_approval(approval, preflight):
+    approval_rows = {
+        row["dedupe_key"]: row for row in approval["approval_rows"]
+    }
+    if not approval_rows or not preflight["preflight_rows"]:
+        return False
+    for row in preflight["preflight_rows"]:
+        source = approval_rows.get(row["dedupe_key"])
+        if not source:
+            return False
+        if row["current_review_state"] != source["current_review_state"]:
+            return False
+        if row["approved_review_decision"] != source["approved_review_decision"]:
+            return False
+        if row["target_review_state"] != source["approved_review_decision"]:
+            return False
+        if row["decision_evidence_ref"] != source["decision_evidence_ref"]:
+            return False
+        if row["approval_evidence_ref"] != source["approval_evidence_ref"]:
+            return False
+    return True
+
+
+def _all_rows_have_allowed_transitions(preflight):
+    return bool(
+        preflight["preflight_rows"]
+        and all(
+            row["current_review_state"] == "needs_review"
+            and row["approved_review_decision"] in ALLOWED_REVIEW_DECISIONS
+            and row["target_review_state"] in ALLOWED_REVIEW_DECISIONS
+            and row["approved_review_decision"] == row["target_review_state"]
+            and row["statement_type"] == "update_review_state"
+            and row["operation"] == "update"
+            for row in preflight["preflight_rows"]
+        )
+    )
+
+
+def _all_rows_have_preflight_evidence(preflight):
+    return bool(
+        preflight["preflight_rows"]
+        and all(
+            row["preflight_notes_present"]
+            and row["decision_evidence_ref_safe"]
+            and row["approval_evidence_ref_safe"]
+            and row["preflight_evidence_ref_safe"]
+            for row in preflight["preflight_rows"]
+        )
+    )
+
+
+def _matched_rows_keep_identity_guards(preflight):
+    matched_rows = [
+        row
+        for row in preflight["preflight_rows"]
+        if row["target_review_state"] == "matched"
+    ]
+    if not matched_rows:
+        return True
+    return all(
+        row["evidence_lane"] == "exact_identity"
+        and row["exact_identity_confirmed"]
+        and not row["hard_veto_present"]
+        and not row["stronger_existing_match_conflict"]
+        and row["false_positive_guard_passed"]
+        and row["variant_conflict_checked"]
+        and row["overwrite_protection_checked"]
+        for row in matched_rows
+    )
+
+
+def build_approval_writer_preflight_gates(
+    *, approval_received, preflight_received, approval, preflight
+):
+    operator_confirmed_boundaries = bool(
+        preflight["approval_checked"]
+        and preflight["writer_preflight_is_cli_only"]
+        and preflight["manual_record_required"]
+        and preflight["no_approval_token_payload"]
+        and preflight["no_api_cli_execution"]
+        and preflight["no_api_database_write"]
+        and preflight["no_api_review_state_update"]
+        and preflight["no_api_decision_record_write"]
+        and preflight["no_api_match_write"]
+        and preflight["no_api_queue_insert"]
+        and preflight["no_api_file_write"]
+        and preflight["no_scheduler_attach"]
+        and preflight["rows_match_approval"]
+        and preflight["schema_preflight_required"]
+        and preflight["status_transition_reviewed"]
+        and preflight["stronger_existing_match_guard_preserved"]
+        and preflight["false_positive_guard_completed"]
+        and preflight["variant_sensitive_review_completed"]
+        and preflight["hard_veto_respected"]
+    )
+    return [
+        {
+            "key": "candidate_queue_review_decision_approval_payload_or_result_received",
+            "label": "已提供 review decision approval package 或已審核結果",
+            "passed": approval_received,
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_accepted",
+            "label": "review decision approval gate 必須已通過",
+            "passed": approval["accepted"],
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_ready_for_preflight",
+            "label": "approval 必須只放行到 writer preflight",
+            "passed": approval["ready_for_candidate_queue_review_decision_writer_preflight"],
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_side_effect_free",
+            "label": "approval 未顯示 API 寫 DB、寫 approval、寫 decision、寫 match 或更新 review_state",
+            "passed": approval["side_effects_clear"],
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_payload_received",
+            "label": "已提供 operator writer preflight 摘要",
+            "passed": preflight_received,
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_identity_recorded",
+            "label": "writer preflight 必須記錄 preflight_id 與上游 identity",
+            "passed": bool(
+                preflight["writer_preflight_id"]
+                and preflight["approval_id"]
+                and preflight["review_decision_id"]
+                and preflight["review_inventory_id"]
+                and preflight["handoff_id"]
+                and preflight["inventory_review_id"]
+                and preflight["closeout_id"]
+                and preflight["run_package_id"]
+                and preflight["receipt_id"]
+            ),
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_identity_matches_approval",
+            "label": "writer preflight identity 必須對齊 approval",
+            "passed": bool(
+                preflight["approval_id"] == approval["approval_id"]
+                and preflight["review_decision_id"] == approval["review_decision_id"]
+                and preflight["review_inventory_id"] == approval["review_inventory_id"]
+                and preflight["handoff_id"] == approval["handoff_id"]
+                and preflight["inventory_review_id"] == approval["inventory_review_id"]
+                and preflight["closeout_id"] == approval["closeout_id"]
+                and preflight["run_package_id"] == approval["run_package_id"]
+                and preflight["receipt_id"] == approval["receipt_id"]
+            ),
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_target_table_safe",
+            "label": "target table 必須是 market_alert_review_queue",
+            "passed": preflight["target_table"] == TARGET_TABLE,
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_scope_safe",
+            "label": "writer preflight 僅能是 CLI-only preview",
+            "passed": bool(
+                preflight["preflight_scope"] in ALLOWED_PREFLIGHT_SCOPES
+                and preflight["preflight_mode"] in ALLOWED_PREFLIGHT_MODES
+                and preflight["target_operation"] == TARGET_OPERATION
+                and preflight["expected_current_review_state"] == "needs_review"
+            ),
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_row_count_matches_approval",
+            "label": "writer preflight row count 必須對齊 approval row count",
+            "passed": bool(
+                preflight["expected_preflight_row_count"]
+                and preflight["preflight_row_count"]
+                == preflight["expected_preflight_row_count"]
+                == approval["approved_row_count"]
+                and len(preflight["preflight_rows"]) == approval["approved_row_count"]
+            ),
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_rows_match_approval",
+            "label": "writer preflight rows 必須逐列對齊 approval rows",
+            "passed": bool(
+                _row_keys_match_expected(preflight)
+                and _preflight_rows_match_approval(approval, preflight)
+            ),
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_transitions_allowed",
+            "label": "writer preflight 只能產生允許的 review_state update preview",
+            "passed": _all_rows_have_allowed_transitions(preflight),
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_row_evidence_complete",
+            "label": "每列 writer preflight 必須保留 decision、approval 與 preflight evidence",
+            "passed": _all_rows_have_preflight_evidence(preflight),
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_matched_rows_keep_identity_guards",
+            "label": "matched preflight rows 必須保留 exact identity、variant 與 overwrite guard",
+            "passed": _matched_rows_keep_identity_guards(preflight),
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_artifact_paths_safe",
+            "label": "review queue、inventory、decision、approval 與 preflight artifact paths 必須安全並對齊",
+            "passed": bool(
+                preflight["review_queue_artifact_path_safe"]
+                and preflight["review_inventory_artifact_path_safe"]
+                and preflight["review_decision_artifact_path_safe"]
+                and preflight["approval_artifact_path_safe"]
+                and preflight["writer_preflight_artifact_path_safe"]
+                and preflight["review_queue_artifact_path"]
+                == approval["review_queue_artifact_path"]
+                and preflight["review_inventory_artifact_path"]
+                == approval["review_inventory_artifact_path"]
+                and preflight["review_decision_artifact_path"]
+                == approval["review_decision_artifact_path"]
+                and preflight["approval_artifact_path"]
+                == approval["approval_artifact_path"]
+            ),
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_operator_boundaries_confirmed",
+            "label": "操作員確認 API 未執行 CLI/DB/file/review_state/decision/match/scheduler",
+            "passed": operator_confirmed_boundaries,
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_no_api_execution_or_real_write",
+            "label": "writer preflight payload 不得允許 API execution、real write、review update、decision write 或 match write",
+            "passed": bool(
+                not preflight["api_execution_allowed"]
+                and not preflight["real_write_allowed_by_api"]
+                and not preflight["api_candidate_review_allowed"]
+                and not preflight["api_updates_review_state"]
+                and not preflight["api_writes_preflight_record"]
+                and not preflight["api_writes_approval_record"]
+                and not preflight["api_writes_decision_record"]
+                and not preflight["api_writes_match_result"]
+            ),
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_no_secret_or_token_key",
+            "label": "writer preflight payload 不得包含 secret、cookie、password 或 token key",
+            "passed": not preflight["secret_or_token_submitted_to_api"],
+        },
+        {
+            "key": "candidate_queue_review_decision_approval_writer_preflight_side_effect_free",
+            "label": "writer preflight payload 不得要求 API 寫檔、執行、寫 DB、補 queue、寫 match 或掛 scheduler",
+            "passed": not preflight["blocked_side_effects"],
+        },
+    ]

services/market_intel/mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_sample.py

@@ -0,0 +1,149 @@
+"""Sample payload for the review decision approval writer preflight gate."""
+
+from copy import deepcopy
+
+from services.market_intel.mcp_fetch_candidate_queue_writer_preflight import TARGET_TABLE
+from services.market_intel.mcp_fetch_candidate_queue_writer_run_readiness import (
+    ARTIFACT_PREFIX,
+)
+from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval import (
+    build_mcp_fetch_candidate_queue_writer_review_decision_approval_preview,
+)
+from services.market_intel.mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_gates import (
+    TARGET_OPERATION,
+)
+
+
+_SAMPLE_APPROVAL_WRITER_PREFLIGHT_PACKAGE = None
+
+
+def build_sample_writer_review_decision_approval_writer_preflight_package():
+    global _SAMPLE_APPROVAL_WRITER_PREFLIGHT_PACKAGE
+    if _SAMPLE_APPROVAL_WRITER_PREFLIGHT_PACKAGE is not None:
+        return deepcopy(_SAMPLE_APPROVAL_WRITER_PREFLIGHT_PACKAGE)
+
+    approval_preview = (
+        build_mcp_fetch_candidate_queue_writer_review_decision_approval_preview()
+    )
+    approval_package = approval_preview["sample_writer_review_decision_approval_package"]
+    approval_result = (
+        build_mcp_fetch_candidate_queue_writer_review_decision_approval_preview(
+            writer_review_decision_package=approval_package[
+                "writer_review_decision_package"
+            ],
+            writer_review_decision_result=approval_package[
+                "writer_review_decision_result"
+            ],
+            operator_review_decision_approval=approval_package[
+                "operator_review_decision_approval"
+            ],
+        )
+    )
+    approval = approval_result["operator_review_decision_approval_summary"]
+    preflight_rows = []
+    for row in approval["approved_rows"]:
+        preflight_rows.append(
+            {
+                "dedupe_key": row["dedupe_key"],
+                "current_review_state": row["current_review_state"],
+                "approved_review_decision": row["approved_review_decision"],
+                "target_review_state": row["approved_review_decision"],
+                "statement_type": "update_review_state",
+                "operation": "update",
+                "writer_action": "prepare_cli_review_state_update",
+                "evidence_lane": row["evidence_lane"],
+                "decision_evidence_ref": row["decision_evidence_ref"],
+                "approval_evidence_ref": row["approval_evidence_ref"],
+                "preflight_evidence_ref": (
+                    ARTIFACT_PREFIX
+                    + "candidate-queue-review-decision-approval-writer-preflight-"
+                    + f"{row['dedupe_key']}.json"
+                ),
+                "preflight_notes": (
+                    "approved review decision mapped to CLI-only writer preflight"
+                ),
+                "hard_veto_present": row["hard_veto_present"],
+                "stronger_existing_match_conflict": row[
+                    "stronger_existing_match_conflict"
+                ],
+                "false_positive_guard_passed": row["false_positive_guard_passed"],
+                "variant_conflict_checked": row["variant_conflict_checked"],
+                "overwrite_protection_checked": row[
+                    "overwrite_protection_checked"
+                ],
+                "exact_identity_confirmed": row["exact_identity_confirmed"],
+            }
+        )
+
+    operator_writer_preflight = {
+        "writer_preflight_id": (
+            "market-intel-candidate-writer-review-decision-approval-preflight-sample"
+        ),
+        "approval_id": approval["approval_id"],
+        "review_decision_id": approval["review_decision_id"],
+        "review_inventory_id": approval["review_inventory_id"],
+        "handoff_id": approval["handoff_id"],
+        "inventory_review_id": approval["inventory_review_id"],
+        "closeout_id": approval["closeout_id"],
+        "run_package_id": approval["run_package_id"],
+        "receipt_id": approval["receipt_id"],
+        "target_table": TARGET_TABLE,
+        "target_operation": TARGET_OPERATION,
+        "preflight_scope": (
+            "candidate_queue_review_decision_approval_writer_preflight"
+        ),
+        "preflight_mode": "cli_only_writer_preflight_preview",
+        "expected_current_review_state": "needs_review",
+        "preflight_row_count": len(preflight_rows),
+        "expected_preflight_row_count": approval["approved_row_count"],
+        "expected_dedupe_keys": approval["expected_dedupe_keys"],
+        "review_queue_artifact_path": approval["review_queue_artifact_path"],
+        "review_inventory_artifact_path": approval[
+            "review_inventory_artifact_path"
+        ],
+        "review_decision_artifact_path": approval["review_decision_artifact_path"],
+        "approval_artifact_path": approval["approval_artifact_path"],
+        "writer_preflight_artifact_path": (
+            ARTIFACT_PREFIX
+            + "candidate-queue-review-decision-approval-writer-preflight-sample.json"
+        ),
+        "preflight_rows": preflight_rows,
+        "operator_confirmations": {
+            "approval_checked": True,
+            "writer_preflight_is_cli_only": True,
+            "manual_record_required": True,
+            "no_approval_token_payload": True,
+            "no_api_cli_execution": True,
+            "no_api_database_write": True,
+            "no_api_review_state_update": True,
+            "no_api_decision_record_write": True,
+            "no_api_match_write": True,
+            "no_api_queue_insert": True,
+            "no_api_file_write": True,
+            "no_scheduler_attach": True,
+            "rows_match_approval": True,
+            "schema_preflight_required": True,
+            "status_transition_reviewed": True,
+            "stronger_existing_match_guard_preserved": True,
+            "false_positive_guard_completed": True,
+            "variant_sensitive_review_completed": True,
+            "hard_veto_respected": True,
+        },
+        "api_execution_allowed": False,
+        "real_write_allowed_by_api": False,
+        "api_candidate_review_allowed": False,
+        "api_updates_review_state": False,
+        "api_writes_preflight_record": False,
+        "api_writes_approval_record": False,
+        "api_writes_decision_record": False,
+        "api_writes_match_result": False,
+    }
+    _SAMPLE_APPROVAL_WRITER_PREFLIGHT_PACKAGE = {
+        "writer_review_decision_approval_package": approval_package,
+        "writer_review_decision_approval_result": approval_result,
+        "operator_writer_preflight": operator_writer_preflight,
+        "operator_review_decision_approval_writer_preflight": (
+            operator_writer_preflight
+        ),
+    }
+    return deepcopy(_SAMPLE_APPROVAL_WRITER_PREFLIGHT_PACKAGE)

services/market_intel/phase.py

@@ -1,3 +1,3 @@
 """市場情報 rollout phase 單一來源。"""
 
-MARKET_INTEL_PHASE = "phase_138_market_intel_mcp_fetch_candidate_queue_writer_review_decision_approval"
+MARKET_INTEL_PHASE = "phase_139_market_intel_mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight"

templates/market_intel/disabled.html

@@ -1124,6 +1124,32 @@
         </div>
     </div>
 
+    <div class="market-intel-panel" data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight>
+        <div class="market-intel-preview-head">
+            <div>
+                <p class="market-intel-muted momo-mono mb-1">MCP / APPROVAL PREFLIGHT</p>
+                <h2 class="market-intel-preview-title">MCP Decision Approval Writer Preflight</h2>
+            </div>
+            <button class="market-intel-icon-button" type="button" title="重新整理 MCP Decision Approval Writer Preflight" data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-refresh>
+                <i class="fas fa-rotate-right" aria-hidden="true"></i>
+            </button>
+        </div>
+        <div class="market-intel-preview-meta" data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-meta>
+            <span class="market-intel-pill">loading</span>
+        </div>
+        <div data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-body>
+            <div class="market-intel-empty">讀取 MCP Decision Approval Writer Preflight 中...</div>
+        </div>
+        <div class="market-intel-control-row mt-3">
+            <textarea class="market-intel-json-input" rows="9" spellcheck="false" data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-input placeholder="approval result and writer preflight JSON"></textarea>
+            <div class="market-intel-control-actions">
+                <button class="market-intel-icon-button" type="button" title="審核 MCP Decision Approval Writer Preflight JSON" data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-review>
+                    <i class="fas fa-check" aria-hidden="true"></i>
+                </button>
+            </div>
+        </div>
+    </div>
+
     <div class="market-intel-panel" data-market-intel-manual-sample>
         <div class="market-intel-preview-head">
             <div>
@@ -1650,6 +1676,7 @@
         const mcpFetchCandidateQueueWriterReviewInventoryRoot = document.querySelector('[data-market-intel-mcp-fetch-candidate-queue-writer-review-inventory]');
         const mcpFetchCandidateQueueWriterReviewDecisionRoot = document.querySelector('[data-market-intel-mcp-fetch-candidate-queue-writer-review-decision]');
         const mcpFetchCandidateQueueWriterReviewDecisionApprovalRoot = document.querySelector('[data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval]');
+        const mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot = document.querySelector('[data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight]');
         const manualSampleRoot = document.querySelector('[data-market-intel-manual-sample]');
         const sampleAcceptanceRoot = document.querySelector('[data-market-intel-sample-acceptance]');
         const sampleReviewRoot = document.querySelector('[data-market-intel-sample-review]');
@@ -1666,7 +1693,7 @@
         const liveInventoryRoot = document.querySelector('[data-market-intel-live-inventory]');
         const approvalRoot = document.querySelector('[data-market-intel-approval]');
         const deployRoot = document.querySelector('[data-market-intel-deploy]');
-        if (!root && !writerRoot && !cliRoot && !dbProbeRoot && !seedDiffRoot && !legacyBridgeRoot && !mcpReadinessRoot && !mcpPreflightRoot && !mcpActivationRoot && !mcpFetchGateRoot && !mcpCompletionRoot && !mcpActivationEvidenceRoot && !mcpRuntimeSmokeRoot && !mcpRuntimePromotionRoot && !mcpManualFetchHandoffRoot && !mcpFetchTargetReviewRoot && !mcpFetchRunPackageRoot && !mcpFetchRunReadinessRoot && !mcpFetchRunReceiptRoot && !mcpFetchResultParserReviewRoot && !mcpFetchCandidateHandoffReviewRoot && !mcpFetchCandidateQueueReviewRoot && !mcpFetchCandidateQueueWriterPreflightRoot && !mcpFetchCandidateQueueWriterCliReviewRoot && !mcpFetchCandidateQueueWriterRunPackageReviewRoot && !mcpFetchCandidateQueueWriterRunReadinessRoot && !mcpFetchCandidateQueueWriterRunReceiptReviewRoot && !mcpFetchCandidateQueueWriterRunCloseoutReviewRoot && !mcpFetchCandidateQueueWriterPostCloseoutInventoryReviewRoot && !mcpFetchCandidateQueueWriterReviewHandoffRoot && !mcpFetchCandidateQueueWriterReviewInventoryRoot && !mcpFetchCandidateQueueWriterReviewDecisionRoot && !mcpFetchCandidateQueueWriterReviewDecisionApprovalRoot && !manualSampleRoot && !sampleAcceptanceRoot && !sampleReviewRoot && !schedulerRoot && !matchReviewRoot && !opportunityRoot && !opportunityScoringRoot && !opportunityEvidenceRoot && !opportunityAlertRoot && !migrationRoot && !migrationDrillRoot && !catalogReviewRoot && !liveSmokeRoot && !liveInventoryRoot && !approvalRoot && !deployRoot) return;
+        if (!root && !writerRoot && !cliRoot && !dbProbeRoot && !seedDiffRoot && !legacyBridgeRoot && !mcpReadinessRoot && !mcpPreflightRoot && !mcpActivationRoot && !mcpFetchGateRoot && !mcpCompletionRoot && !mcpActivationEvidenceRoot && !mcpRuntimeSmokeRoot && !mcpRuntimePromotionRoot && !mcpManualFetchHandoffRoot && !mcpFetchTargetReviewRoot && !mcpFetchRunPackageRoot && !mcpFetchRunReadinessRoot && !mcpFetchRunReceiptRoot && !mcpFetchResultParserReviewRoot && !mcpFetchCandidateHandoffReviewRoot && !mcpFetchCandidateQueueReviewRoot && !mcpFetchCandidateQueueWriterPreflightRoot && !mcpFetchCandidateQueueWriterCliReviewRoot && !mcpFetchCandidateQueueWriterRunPackageReviewRoot && !mcpFetchCandidateQueueWriterRunReadinessRoot && !mcpFetchCandidateQueueWriterRunReceiptReviewRoot && !mcpFetchCandidateQueueWriterRunCloseoutReviewRoot && !mcpFetchCandidateQueueWriterPostCloseoutInventoryReviewRoot && !mcpFetchCandidateQueueWriterReviewHandoffRoot && !mcpFetchCandidateQueueWriterReviewInventoryRoot && !mcpFetchCandidateQueueWriterReviewDecisionRoot && !mcpFetchCandidateQueueWriterReviewDecisionApprovalRoot && !mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot && !manualSampleRoot && !sampleAcceptanceRoot && !sampleReviewRoot && !schedulerRoot && !matchReviewRoot && !opportunityRoot && !opportunityScoringRoot && !opportunityEvidenceRoot && !opportunityAlertRoot && !migrationRoot && !migrationDrillRoot && !catalogReviewRoot && !liveSmokeRoot && !liveInventoryRoot && !approvalRoot && !deployRoot) return;
 
         const meta = root ? root.querySelector('[data-market-intel-preview-meta]') : null;
         const body = root ? root.querySelector('[data-market-intel-preview-body]') : null;
@@ -1845,6 +1872,12 @@
         const mcpFetchCandidateQueueWriterReviewDecisionApprovalReview = mcpFetchCandidateQueueWriterReviewDecisionApprovalRoot ? mcpFetchCandidateQueueWriterReviewDecisionApprovalRoot.querySelector('[data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-review]') : null;
         const mcpFetchCandidateQueueWriterReviewDecisionApprovalRefresh = mcpFetchCandidateQueueWriterReviewDecisionApprovalRoot ? mcpFetchCandidateQueueWriterReviewDecisionApprovalRoot.querySelector('[data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-refresh]') : null;
         const mcpFetchCandidateQueueWriterReviewDecisionApprovalEndpoint = "{{ url_for('market_intel.market_intel_mcp_fetch_candidate_queue_writer_review_decision_approval') }}";
+        const mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightMeta = mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot ? mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot.querySelector('[data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-meta]') : null;
+        const mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody = mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot ? mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot.querySelector('[data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-body]') : null;
+        const mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightInput = mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot ? mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot.querySelector('[data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-input]') : null;
+        const mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightReview = mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot ? mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot.querySelector('[data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-review]') : null;
+        const mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRefresh = mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot ? mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRoot.querySelector('[data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-refresh]') : null;
+        const mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightEndpoint = "{{ url_for('market_intel.market_intel_mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight') }}";
         const manualSampleMeta = manualSampleRoot ? manualSampleRoot.querySelector('[data-market-intel-manual-sample-meta]') : null;
         const manualSampleBody = manualSampleRoot ? manualSampleRoot.querySelector('[data-market-intel-manual-sample-body]') : null;
         const manualSampleRefresh = manualSampleRoot ? manualSampleRoot.querySelector('[data-market-intel-manual-sample-refresh]') : null;
@@ -5599,6 +5632,141 @@
             }
         };
 
+        const renderMcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightMeta = data => {
+            const rows = data.preflight_rows || data.operator_writer_preflight_summary?.preflight_rows || [];
+            mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightMeta.innerHTML = [
+                `mode=${data.mode || 'unknown'}`,
+                `accepted=${data.mcp_fetch_candidate_queue_writer_review_decision_approval_writer_preflight_accepted ? 'yes' : 'no'}`,
+                `gates=${data.passed_gate_count || 0}/${data.gate_count || 0}`,
+                `rows=${data.payload_row_count || data.operator_writer_preflight_summary?.preflight_row_count || rows.length || 0}`,
+                `cli=${data.ready_for_candidate_queue_review_decision_writer_cli_review ? 'ready' : 'blocked'}`,
+                `write=${data.api_updates_review_state || data.api_writes_database ? 'api' : 'blocked'}`
+            ].map(item => `<span class="market-intel-pill">${escapeHtml(item)}</span>`).join('');
+        };
+
+        const renderMcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody = data => {
+            const blockers = (data.blocked_reasons || []).join(' / ');
+            const gates = data.gates || [];
+            const approval = data.writer_review_decision_approval_summary || {};
+            const preflight = data.operator_writer_preflight_summary || {};
+            const rows = data.preflight_rows || preflight.preflight_rows || [];
+            const contract = data.writer_preflight_contract || {};
+            const allowedStates = contract.allowed_next_states || [];
+            const steps = data.next_operator_steps || [];
+            const renderCheck = (key, label, status) => `
+                <div class="market-intel-check">
+                    <div>
+                        <strong>${escapeHtml(key)}</strong>
+                        <small>${escapeHtml(label || '')}</small>
+                    </div>
+                    <span>${escapeHtml(status)}</span>
+                </div>
+            `;
+            mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody.innerHTML = `
+                <div class="market-intel-empty mb-3">此 writer preflight 只審核人工 approval 後的 CLI-only 更新草案；API 不寫 preflight、approval、decision、match、不更新 review_state、不讀 token、不執行 CLI、不開 DB、不掛 scheduler。${blockers ? `阻擋：${escapeHtml(blockers)}` : ''}</div>
+                <div class="market-intel-deploy-grid">
+                    <div data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-gates>
+                        <p class="market-intel-deploy-section-title">PREFLIGHT GATES</p>
+                        <div class="market-intel-check-list">${
+                            gates.length
+                                ? gates.map(item => renderCheck(item.key, item.label, item.passed ? 'PASS' : 'BLOCK')).join('')
+                                : '<div class="market-intel-empty">尚未提供 preflight gates。</div>'
+                        }</div>
+                    </div>
+                    <div data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-approval>
+                        <p class="market-intel-deploy-section-title">APPROVAL LINK</p>
+                        <div class="market-intel-check-list">
+                            ${renderCheck('approval', `${approval.accepted ? 'accepted' : 'pending'} / rows=${approval.approved_row_count || 0}`, approval.accepted ? 'ACCEPTED' : 'PENDING')}
+                            ${renderCheck('approval_id', approval.approval_id || 'missing', approval.approval_id ? 'LINKED' : 'BLOCK')}
+                            ${renderCheck('target_table', approval.target_table || 'missing', approval.target_table === 'market_alert_review_queue' ? 'SAFE' : 'BLOCK')}
+                            ${renderCheck('api_boundary', 'no DB / no approval write / no decision write / no match write / no review_state update / no scheduler', approval.side_effects_clear ? 'CLOSED' : 'BLOCK')}
+                        </div>
+                    </div>
+                    <div data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-summary>
+                        <p class="market-intel-deploy-section-title">WRITER PREFLIGHT</p>
+                        <div class="market-intel-check-list">
+                            ${renderCheck('writer_preflight_id', preflight.writer_preflight_id || 'missing', preflight.writer_preflight_id ? 'RECORDED' : 'BLOCK')}
+                            ${renderCheck('scope', preflight.preflight_scope || 'missing', preflight.preflight_scope === 'candidate_queue_review_decision_approval_writer_preflight' ? 'SAFE' : 'BLOCK')}
+                            ${renderCheck('mode', preflight.preflight_mode || 'missing', preflight.preflight_mode === 'cli_only_writer_preflight_preview' ? 'CLI ONLY' : 'BLOCK')}
+                            ${renderCheck('row_count', `${preflight.preflight_row_count || 0}/${approval.approved_row_count || 0}`, preflight.preflight_row_count === approval.approved_row_count ? 'MATCH' : 'BLOCK')}
+                            ${renderCheck('artifact_path', preflight.writer_preflight_artifact_path || 'missing', preflight.writer_preflight_artifact_path_safe ? 'SAFE' : 'BLOCK')}
+                            ${renderCheck('operator_boundaries', 'approval checked / no API DB write/file/CLI/review_state/match/scheduler', preflight.approval_checked && preflight.writer_preflight_is_cli_only && preflight.no_api_cli_execution && preflight.no_api_database_write && preflight.no_api_review_state_update && preflight.no_api_match_write && preflight.no_api_queue_insert && preflight.no_api_file_write && preflight.no_scheduler_attach ? 'CONFIRMED' : 'BLOCK')}
+                        </div>
+                    </div>
+                    <div data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-rows>
+                        <p class="market-intel-deploy-section-title">PREFLIGHT ROWS</p>
+                        <div class="market-intel-check-list">${
+                            rows.length
+                                ? rows.map((row, index) => renderCheck(
+                                    row.dedupe_key || `row_${index + 1}`,
+                                    `${row.current_review_state || 'missing'} -> ${row.target_review_state || 'missing'} / ${row.evidence_lane || 'missing'}`,
+                                    allowedStates.includes(row.target_review_state) && row.preflight_evidence_ref_safe && row.preflight_notes_present && row.false_positive_guard_passed && row.variant_conflict_checked && row.overwrite_protection_checked ? 'READY' : 'BLOCK'
+                                )).join('')
+                                : '<div class="market-intel-empty">尚未提供 preflight rows。</div>'
+                        }</div>
+                    </div>
+                    <div data-market-intel-mcp-fetch-candidate-queue-writer-review-decision-approval-writer-preflight-next>
+                        <p class="market-intel-deploy-section-title">BOUNDARY / NEXT</p>
+                        <div class="market-intel-check-list">
+                            ${renderCheck('allowed_states', allowedStates.join(' / ') || 'missing', allowedStates.length ? 'LOCKED' : 'BLOCK')}
+                            ${renderCheck('next_gate', contract.next_gate || 'missing', contract.next_gate === 'candidate_queue_review_decision_writer_cli_review' ? 'CLI REVIEW' : 'BLOCK')}
+                            ${renderCheck('api_side_effects', 'no preflight record / no approval record / no decision record / no match write / no review_state update / no scheduler', data.api_writes_preflight_record || data.api_writes_approval_record || data.api_writes_decision_record || data.api_writes_match_result || data.api_updates_review_state || data.api_writes_database || data.scheduler_attached ? 'BLOCK' : 'CLOSED')}
+                            ${steps.map((item, index) => renderCheck(`step_${index + 1}`, item, 'NEXT')).join('')}
+                        </div>
+                    </div>
+                </div>
+            `;
+            if (mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightInput && !mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightInput.value.trim() && data.sample_writer_review_decision_approval_writer_preflight_package) {
+                mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightInput.value = JSON.stringify(data.sample_writer_review_decision_approval_writer_preflight_package, null, 2);
+            }
+        };
+
+        const loadMcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflight = async () => {
+            if (!mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightMeta || !mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody) return;
+            mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody.innerHTML = '<div class="market-intel-empty">讀取 MCP Decision Approval Writer Preflight 中...</div>';
+            try {
+                const response = await fetch(mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightEndpoint, { credentials: 'same-origin' });
+                if (!response.ok) throw new Error(`HTTP ${response.status}`);
+                const data = await response.json();
+                renderMcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightMeta(data);
+                renderMcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody(data);
+            } catch (error) {
+                mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightMeta.innerHTML = '<span class="market-intel-pill">error</span>';
+                mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody.innerHTML = `<div class="market-intel-empty">MCP Decision Approval Writer Preflight 讀取失敗：${escapeHtml(error.message)}</div>`;
+            }
+        };
+
+        const reviewMcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflight = async () => {
+            if (!mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightMeta || !mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody || !mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightInput) return;
+            let parsed;
+            try {
+                parsed = JSON.parse(mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightInput.value || '{}');
+            } catch (error) {
+                mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightMeta.innerHTML = '<span class="market-intel-pill">json_error</span>';
+                mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody.innerHTML = `<div class="market-intel-empty">JSON 格式錯誤：${escapeHtml(error.message)}</div>`;
+                return;
+            }
+            mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody.innerHTML = '<div class="market-intel-empty">審核 MCP Decision Approval Writer Preflight 中...</div>';
+            try {
+                const response = await fetch(mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightEndpoint, {
+                    method: 'POST',
+                    credentials: 'same-origin',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'X-CSRFToken': csrfToken
+                    },
+                    body: JSON.stringify({ writer_review_decision_approval_writer_preflight_package: parsed })
+                });
+                const data = await response.json();
+                if (!response.ok && !data.mode) throw new Error(`HTTP ${response.status}`);
+                renderMcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightMeta(data);
+                renderMcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody(data);
+            } catch (error) {
+                mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightMeta.innerHTML = '<span class="market-intel-pill">error</span>';
+                mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightBody.innerHTML = `<div class="market-intel-empty">MCP Decision Approval Writer Preflight 審核失敗：${escapeHtml(error.message)}</div>`;
+            }
+        };
+
         const renderManualSampleMeta = data => {
             manualSampleMeta.innerHTML = [
                 `mode=${data.mode || 'unknown'}`,
@@ -15134,6 +15302,12 @@
         if (mcpFetchCandidateQueueWriterReviewDecisionApprovalReview) {
             mcpFetchCandidateQueueWriterReviewDecisionApprovalReview.addEventListener('click', reviewMcpFetchCandidateQueueWriterReviewDecisionApproval);
         }
+        if (mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRefresh) {
+            mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightRefresh.addEventListener('click', loadMcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflight);
+        }
+        if (mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightReview) {
+            mcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflightReview.addEventListener('click', reviewMcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflight);
+        }
         if (manualSampleRefresh) {
             manualSampleRefresh.addEventListener('click', loadManualSample);
         }
@@ -15410,6 +15584,7 @@
         loadMcpFetchCandidateQueueWriterReviewInventory();
         loadMcpFetchCandidateQueueWriterReviewDecision();
         loadMcpFetchCandidateQueueWriterReviewDecisionApproval();
+        loadMcpFetchCandidateQueueWriterReviewDecisionApprovalWriterPreflight();
         loadManualSample();
         loadSampleAcceptance();
         loadSampleReview();

tests/test_external_tool_entrypoints.py

@@ -37,6 +37,8 @@ def test_external_tool_bridge_pages_are_diagnostic_not_blank():
     assert "external-tool-diagnostics" in template
     assert "external-tool-action-grid" in template
     assert "def webcrumbs_status()" in route_source
+    assert "def webcrumbs_asset_proxy(asset_path)" in route_source
+    assert "WEBCRUMBS_ASSET_ALLOWED_PREFIXES" in route_source
     assert "Webcrumbs 共用 UI Runtime" in route_source
     assert "尚未接入 proxy" in route_source
     assert "已由入口攔截" in route_source

tests/test_frontend_v2_assets.py

@@ -31,6 +31,8 @@ def test_frontend_v2_shell_uses_real_runtime_context():
     assert "components/_ewoooc_shell.html" in base
     assert "'webcrumbs_config': {" in app_source
     assert "WEBCRUMBS_RUNTIME_URL" in config_source
+    assert "/webcrumbs-assets/loader/webcrumbs-compatible-loader.js" in config_source
+    assert "WEBCRUMBS_ASSET_UPSTREAM_URL" in config_source
     assert "data-webcrumbs-runtime" in base
     assert 'name="ui" value="v2"' not in base