2026-06-27 M4C-H5 能力契约收口

用户目标

领取统一台账中的 m4c 侧 M4C-H5-08，基于 MD-H5-05 canonical capability contract，完成 m4c capability payload consumer / contract guard，并把产物、验证、QA 结论、剩余风险和下一步归属回写总台账。

已完成事项

新增 /Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C3.tools/scripts/m4c-h5-capability-contract-guard.mjs。
更新 /Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/C3.tools/scripts/m4c-h5-transport-client-adapter.mjs，支持 canonical / transport capability surface 与报告 redaction。
生成 H5-08 QA 报告、check 文档、contract fixture 输出和 m4c 联调 QA 清单。
更新 m4c CODEGRAPH.md、C3.tools/README.md、m4c INDEX.md 与根 INDEX.md。
m4c 03-O 正式输出区已提交：d1e712a5396011bdd035468f1fae612c2ade585f。
统一台账 M4C-H5-08 已标记完成，PM-H5-CAPABILITY-CONTRACT-GATE 保持 PM 待判定。

关键决策

canonical capability consumer 的解析优先级为 canonical / transport / root；legacy-only read-only payload 仍会被视为 blocker。
legacy 顶层与 nested transport 语义冲突时输出 warning / blocker，不静默吞掉。
token / authorization 字段在所有报告和检查文件中 redaction。
H5-08 live 复核只读 /health、/capabilities 和 JSON-RPC capability，不执行 controlled commit。

QA 证据

/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/02-P/Round05-MCPAlpha/qa/round05-h5-capability-contract-guard.json
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/02-P/Round05-MCPAlpha/qa/round05-h5-capability-contract-guard-check.md
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/02-P/Round05-MCPAlpha/qa/round05-h5-transport-client-adapter-h5-08-regression.json
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/02-P/Round05-MCPAlpha/qa/round05-h5-transport-client-adapter-h5-08-regression-check.md
/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O/K2.项目管理/联调QA/2026-06-27-M4C-H5-08CapabilityContractGuard-m4c.md

验证命令

node --check p.mindrawforcodex/03-O/C3.tools/scripts/m4c-h5-capability-contract-guard.mjs
node --check p.mindrawforcodex/03-O/C3.tools/scripts/m4c-h5-transport-client-adapter.mjs
node p.mindrawforcodex/03-O/C3.tools/scripts/m4c-h5-capability-contract-guard.mjs contract
node p.mindrawforcodex/03-O/C3.tools/scripts/m4c-h5-capability-contract-guard.mjs smoke
node p.mindrawforcodex/03-O/C3.tools/scripts/m4c-h5-transport-client-adapter.mjs smoke --live ...
token redaction 检查
git -C p.mindrawforcodex/03-O diff --check
codebase-memory-mcp cli index_repository '{"repo_path":"/Users/ar/Projects/ExcalidrawX/p.mindrawforcodex/03-O"}'

未决问题

endpoint/token 仍是运行态临时能力文件；App 退出后必须重新读取 capability，不得复用旧 PID / 旧端口 / 旧 token。
PM-H5-CAPABILITY-CONTRACT-GATE 等 PM 判定，m4c worker 不自行关闭 Gate。

后续建议

PM 可基于 MD-H5-05 和 M4C-H5-08 证据收敛 PM-H5-CAPABILITY-CONTRACT-GATE，再决定是否派发下一段 H5 hardening 或轻量联合复核。