feat(flow): R11 高风险声明门禁 — flow_control 新增 risk 参数

- stage-start/stage-complete 支持 risk: high|low 声明：声明 high 时即使
  Issue 无 cabbage:risk:high 标签同样触发 R11 用户确认门禁
- 确认通过后持久化 RISK_LABEL（修复该标签无写入方、门禁形同虚设的问题）
- 未声明 risk 行为不变（保持向后兼容）；响应透传 highRisk
- 新增 4 个测试：声明 high 无确认拒绝/确认通过并打标签/声明 low 放行/标签不误写

测试：705 passed（+4）

Author: devcxl

src/kernel/flow.ts

@@ -543,13 +543,16 @@ async function readIssueLabels(parentIssueNumber: number): Promise<string[]> {
 /**
  * stage-start / stage-complete：
  * 门禁（checkStageGate）→ stage-complete 更新 body checklist（乐观锁）→ setStageLabel。
+ * declaredRisk：模型显式声明高风险（"high"）时即使 Issue 无 cabbage:risk:high 标签，
+ * 同样触发 R11 确认门禁；确认通过后持久化 RISK_LABEL（后续环节可见）。
  */
 export async function applyStageOp(
   _projectDir: string,
   parentIssueNumber: number,
   op: StageOp,
   stage: FlowStage,
   userConfirmed: boolean,
+  declaredRisk?: "high" | "low",
 ): Promise<ApplyStageResult> {
   const record = await readFlowRecord(parentIssueNumber)
   if (!record.ok) {
@@ -558,7 +561,7 @@ export async function applyStageOp(
 
   const completed = getCompletedStages(record.body)
   const labels = await readIssueLabels(parentIssueNumber)
-  const highRisk = labels.includes(RISK_LABEL)
+  const highRisk = labels.includes(RISK_LABEL) || declaredRisk === "high"
 
   const gate = checkStageGate(op, stage, completed, highRisk, userConfirmed)
   if (!gate.ok) {
@@ -572,6 +575,14 @@ export async function applyStageOp(
     }
   }
 
+  // 模型声明高风险且已确认：持久化 RISK_LABEL（R11 状态真实化，后续环节可见）
+  if (declaredRisk === "high" && !labels.includes(RISK_LABEL)) {
+    const riskLabel = await addRiskLabel(parentIssueNumber)
+    if (!riskLabel.ok) {
+      return { ok: false, code: "LABEL_UPDATE_FAILED", message: riskLabel.error ?? "risk label update failed" }
+    }
+  }
+
   const labelResult = await setStageLabel(parentIssueNumber, stage)
   if (!labelResult.ok) {
     return { ok: false, code: "LABEL_UPDATE_FAILED", message: labelResult.error ?? "label update failed" }
@@ -580,3 +591,13 @@ export async function applyStageOp(
   const newCompleted = op === "stage-complete" ? [...completed, stage] : completed
   return { ok: true, stage, completedStages: newCompleted, highRisk }
 }
+
+/** 给 Parent Issue 打高风险标签（模型声明 + 用户确认后持久化） */
+async function addRiskLabel(parentIssueNumber: number): Promise<{ ok: boolean; error?: string }> {
+  try {
+    await flowGh(`issue edit ${parentIssueNumber} --add-label '${escapeShellArg(RISK_LABEL)}'`)
+    return { ok: true }
+  } catch (err) {
+    return { ok: false, error: String(err) }
+  }
+}

src/plugin/flow-control.ts

@@ -79,6 +79,10 @@ Caller: primary for all ops except complete-flow (goal-verify only).`,
         .enum(["requirements", "design", "tasks", "code", "review"])
         .optional()
         .describe("Stage name (for stage-start/stage-complete)"),
+      risk: tool.schema
+        .enum(["high", "low"])
+        .optional()
+        .describe("Risk declaration for stage-start/stage-complete tasks handoff: high triggers the R11 user-confirmation gate (user_confirmed) and persists the cabbage:risk:high label"),
       user_confirmed: tool.schema.boolean().optional().describe("User confirmation (required for cancel-flow/takeover and high-risk gates)"),
     },
     async execute(args, ctx) {
@@ -202,11 +206,20 @@ async function handleStage(
     return errorResponse("POLICY_INVALID", "stage is required for stage ops: requirements|design|tasks|code|review")
   }
 
-  const result = await applyStageOp(deps.projectDir, n, op as "stage-start" | "stage-complete", stage, args.user_confirmed === true)
+  const risk = args.risk as "high" | "low" | undefined
+  if (risk !== undefined && risk !== "high" && risk !== "low") {
+    return errorResponse("POLICY_INVALID", "risk must be \"high\" or \"low\"")
+  }
+
+  const result = await applyStageOp(deps.projectDir, n, op as "stage-start" | "stage-complete", stage, args.user_confirmed === true, risk)
   if (!result.ok) {
     return errorResponse(result.code, result.message)
   }
-  return okResponse({ stage: result.stage, completedStages: result.completedStages })
+  return okResponse({
+    stage: result.stage,
+    completedStages: result.completedStages,
+    ...(result.highRisk ? { highRisk: true } : {}),
+  })
 }
 
 async function handleCompleteFlow(

test/plugin/flow-control.test.ts

@@ -727,6 +727,91 @@ describe("createFlowControlTool (spec §2.3 flow_control)", () => {
     })
   })
 
+  it("stage-start tasks with declared risk=high requires user confirmation (R11)", async () => {
+    await withProjectDir(async dir => {
+      const body = "## Stages\n\n- [x] requirements\n- [x] design\n- [ ] tasks"
+      setRecordsGhExecutor(async args => {
+        if (args.includes("--jq .body")) return { stdout: body, stderr: "" }
+        if (args.includes('join(" ")')) return { stdout: "", stderr: "" }
+        if (args.includes("issue edit")) return { stdout: "", stderr: "" }
+        throw new Error(`unexpected gh: ${args}`)
+      })
+      const flowCalls: string[] = []
+      setFlowGhExecutor(async args => {
+        flowCalls.push(args)
+        if (args.includes("issue view")) return { stdout: '["cabbage:flow", "cabbage:stage:requirements", "cabbage:stage:design"]', stderr: "" }
+        if (args.includes("issue edit")) return { stdout: "", stderr: "" }
+        throw new Error(`unexpected gh: ${args}`)
+      })
+
+      const denied = await executeOp(dir, makeSessionClient(), "stage-start", {
+        parent_issue_number: 12,
+        stage: "tasks",
+        risk: "high",
+      })
+      expect(denied.ok).toBe(false)
+      expect(denied.error.code).toBe("RISK_CONFIRMATION_REQUIRED")
+      // 未确认 → 不得打 RISK_LABEL
+      expect(flowCalls.some(c => c.includes("cabbage:risk:high"))).toBe(false)
+    })
+  })
+
+  it("stage-start tasks with declared risk=high and confirmation passes and persists the RISK_LABEL", async () => {
+    await withProjectDir(async dir => {
+      const body = "## Stages\n\n- [x] requirements\n- [x] design\n- [ ] tasks"
+      setRecordsGhExecutor(async args => {
+        if (args.includes("--jq .body")) return { stdout: body, stderr: "" }
+        if (args.includes('join(" ")')) return { stdout: "", stderr: "" }
+        if (args.includes("issue edit")) return { stdout: "", stderr: "" }
+        throw new Error(`unexpected gh: ${args}`)
+      })
+      const flowCalls: string[] = []
+      setFlowGhExecutor(async args => {
+        flowCalls.push(args)
+        if (args.includes("issue view")) return { stdout: '["cabbage:flow", "cabbage:stage:requirements", "cabbage:stage:design"]', stderr: "" }
+        if (args.includes("issue edit")) return { stdout: "", stderr: "" }
+        throw new Error(`unexpected gh: ${args}`)
+      })
+
+      const resp = await executeOp(dir, makeSessionClient(), "stage-start", {
+        parent_issue_number: 12,
+        stage: "tasks",
+        risk: "high",
+        user_confirmed: true,
+      })
+      expect(resp.ok).toBe(true)
+      expect(resp.highRisk).toBe(true)
+      expect(flowCalls.some(c => c.includes("--add-label 'cabbage:risk:high'"))).toBe(true)
+    })
+  })
+
+  it("stage-start tasks with declared risk=low passes without confirmation (no label)", async () => {
+    await withProjectDir(async dir => {
+      const body = "## Stages\n\n- [x] requirements\n- [x] design\n- [ ] tasks"
+      setRecordsGhExecutor(async args => {
+        if (args.includes("--jq .body")) return { stdout: body, stderr: "" }
+        if (args.includes('join(" ")')) return { stdout: "", stderr: "" }
+        if (args.includes("issue edit")) return { stdout: "", stderr: "" }
+        throw new Error(`unexpected gh: ${args}`)
+      })
+      const flowCalls: string[] = []
+      setFlowGhExecutor(async args => {
+        flowCalls.push(args)
+        if (args.includes("issue view")) return { stdout: '["cabbage:flow", "cabbage:stage:requirements", "cabbage:stage:design"]', stderr: "" }
+        if (args.includes("issue edit")) return { stdout: "", stderr: "" }
+        throw new Error(`unexpected gh: ${args}`)
+      })
+
+      const resp = await executeOp(dir, makeSessionClient(), "stage-start", {
+        parent_issue_number: 12,
+        stage: "tasks",
+        risk: "low",
+      })
+      expect(resp.ok).toBe(true)
+      expect(flowCalls.some(c => c.includes("cabbage:risk:high"))).toBe(false)
+    })
+  })
+
   it("complete-flow rejects callers other than goal-verify", async () => {
     await withProjectDir(async dir => {
       const resp = await executeOp(dir, makeSessionClient(), "complete-flow", { parent_issue_number: 12 }, "dev-lifecycle")