fix: harden review and verifier governance

scripts/generate_daily_report.go

@@ -1,4 +1,4 @@
-//go:build llm_script
+//go:build llm_script && !scripts_pkg
 
 // generate_daily_report.go v3.0 - 日报生成器(现代化UI版)
 // 支持:国家分类、运营商分类、信息图风格HTML
@@ -122,34 +122,39 @@ func run() error {
 		return fmt.Errorf("生成报告数据失败: %w", err)
 	}
 
-	// 2. 创建目录
-	outDir := os.Getenv("REPORT_OUTPUT_DIR")
-	if outDir == "" {
-		outDir = "reports/daily"
+	// 2. 创建目录与输出路径
+	outputPaths, err := resolveReportOutputPaths(date, runContext)
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(outputPaths.OutputDir, 0755); err != nil {
+		return err
+	}
+	if err := os.MkdirAll(outputPaths.HTMLDir, 0755); err != nil {
+		return err
 	}
-	os.MkdirAll(outDir, 0755)
-	os.MkdirAll(outDir+"/html", 0755)
 
 	// 3. 生成 Markdown
-	mdPath := filepath.Join(outDir, fmt.Sprintf("daily_report_%s.md", date))
+	mdPath := outputPaths.MarkdownPath
 	if err := generateMarkdownV3(report, mdPath); err != nil {
 		return err
 	}
 
 	// 4. 生成 HTML(现代化UI)
-	htmlPath := filepath.Join(outDir, "html", fmt.Sprintf("daily_report_%s.html", date))
+	htmlPath := outputPaths.HTMLPath
 	if err := generateHTMLV3(report, htmlPath); err != nil {
 		return err
 	}
-	appendixExportPath, err := writeAppendixExport(report, outDir)
+	appendixExportPath, err := writeAppendixExport(report, outputPaths.OutputDir)
 	if err != nil {
 		return fmt.Errorf("导出附录数据失败: %w", err)
 	}
 
-
-	// 5. 归档主产物，确保运行脚本和门禁使用统一路径约定
-	if err := archiveReportArtifacts(date, mdPath, htmlPath); err != nil {
-		return fmt.Errorf("归档日报失败: %w", err)
+	// 5. 仅正式日报归档到统一产物路径
+	if runContext.IsOfficialDaily {
+		if err := archiveReportArtifacts(date, mdPath, htmlPath); err != nil {
+			return fmt.Errorf("归档日报失败: %w", err)
+		}
 	}
 
 	// 6. 同步写入日报状态与运行轨迹
@@ -225,6 +230,57 @@ func resolveReportRunContext(reportDate string, now time.Time, envRunKind, envTr
 	}
 }
 
+type ReportOutputPaths struct {
+	OutputDir    string
+	HTMLDir      string
+	MarkdownPath string
+	HTMLPath     string
+}
+
+func resolveReportOutputPaths(reportDate string, runContext ReportRunContext) (ReportOutputPaths, error) {
+	baseDir := strings.TrimSpace(os.Getenv("REPORT_OUTPUT_DIR"))
+	if baseDir == "" {
+		baseDir = "reports/daily"
+	}
+	baseDir = filepath.Clean(baseDir)
+
+	outputDir := baseDir
+	if !runContext.IsOfficialDaily {
+		outputDir = filepath.Join("reports", "ad_hoc", reportDate, sanitizeReportPathSegment(runContext.RunKind), sanitizeReportPathSegment(runContext.TriggerSource))
+	}
+	htmlDir := filepath.Join(outputDir, "html")
+
+	return ReportOutputPaths{
+		OutputDir:    outputDir,
+		HTMLDir:      htmlDir,
+		MarkdownPath: filepath.Join(outputDir, fmt.Sprintf("daily_report_%s.md", reportDate)),
+		HTMLPath:     filepath.Join(htmlDir, fmt.Sprintf("daily_report_%s.html", reportDate)),
+	}, nil
+}
+
+func sanitizeReportPathSegment(value string) string {
+	value = strings.TrimSpace(strings.ToLower(value))
+	if value == "" {
+		return "unknown"
+	}
+	var b strings.Builder
+	for _, r := range value {
+		switch {
+		case r >= 'a' && r <= 'z', r >= '0' && r <= '9':
+			b.WriteRune(r)
+		case r == '-' || r == '_':
+			b.WriteRune(r)
+		default:
+			b.WriteRune('-')
+		}
+	}
+	result := strings.Trim(b.String(), "-")
+	if result == "" {
+		return "unknown"
+	}
+	return result
+}
+
 func resolveSignatureAuditReportConfig() SignatureAuditReportConfig {
 	return SignatureAuditReportConfig{
 		Window:               positiveEnvIntOrDefault("REPORT_SIGNATURE_AUDIT_WINDOW", 5),