@bovinphang/frontend-craft 2.8.0 → 3.0.0

package/localized/zh-CN/skills/fec-security-review/references/common/engineering-practices.sources.json

@@ -0,0 +1,377 @@
+{
+  "schemaVersion": 1,
+  "sources": [
+    {
+      "id": "google-review",
+      "publisher": "Google",
+      "title": "Code review standard",
+      "url": "https://google.github.io/eng-practices/review/reviewer/standard.html",
+      "section": "Engineering principles and code health",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living public guidance; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Use evidence and project standards; personal preference alone is not a blocker."
+    },
+    {
+      "id": "ms-playbook",
+      "publisher": "Microsoft ISE",
+      "title": "Test planning",
+      "url": "https://microsoft.github.io/code-with-engineering-playbook/automated-testing/test-planning/",
+      "section": "Risk, test scope and responsibilities",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living ISE playbook; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Team practice, not a company-wide mandate; retain existing tools."
+    },
+    {
+      "id": "ms-faults",
+      "publisher": "Microsoft ISE",
+      "title": "Fault injection testing",
+      "url": "https://microsoft.github.io/code-with-engineering-playbook/automated-testing/fault-injection-testing/",
+      "section": "Controlled failure and observations",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living ISE playbook; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Run scoped, controlled failures; do not infer production reliability from a small example."
+    },
+    {
+      "id": "google-ts",
+      "publisher": "Google",
+      "title": "TS/JS style guide",
+      "url": "https://google.github.io/styleguide/tsguide.html",
+      "section": "Environment caveat; types and exceptions",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Public guide; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Google explicitly notes internal constraints differ; no blanket ban overriding a justified project convention."
+    },
+    {
+      "id": "typescript-publishing",
+      "publisher": "TypeScript",
+      "title": "Publishing declaration files",
+      "url": "https://www.typescriptlang.org/docs/handbook/declaration-files/publishing.html",
+      "section": "Types and declaration dependencies",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living handbook; check installed compiler/module resolution",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Validate the actual packed consumer; do not upgrade compiler or module mode on this basis."
+    },
+    {
+      "id": "rust-api",
+      "publisher": "Rust library team",
+      "title": "Rust API Guidelines",
+      "url": "https://rust-lang.github.io/api-guidelines/",
+      "section": "Type safety, dependability and future proofing",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living recommendations; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Guidance rather than language law; preserve edition and MSRV."
+    },
+    {
+      "id": "tokio-join",
+      "publisher": "Tokio project",
+      "title": "JoinHandle",
+      "url": "https://docs.rs/tokio/latest/tokio/task/struct.JoinHandle.html",
+      "section": "Drop, abort and completion",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page observed 1.54.1; project runtime/version determines applicability",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Tokio-specific mechanics only when Tokio is already used; no new runtime dependency."
+    },
+    {
+      "id": "uber-go",
+      "publisher": "Uber",
+      "title": "Go Style Guide",
+      "url": "https://github.com/uber-go/guide/blob/master/style.md",
+      "section": "Errors, interfaces and goroutine lifetime",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living master; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Do not import Uber dependencies or turn buffer-size style into a correctness theorem."
+    },
+    {
+      "id": "go-context",
+      "publisher": "Go project",
+      "title": "context package",
+      "url": "https://pkg.go.dev/context",
+      "section": "Cancellation propagation and ownership",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Standard library; check owning go.mod/toolchain",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "A cancellation signal alone does not confirm worker exit."
+    },
+    {
+      "id": "google-java",
+      "publisher": "Google",
+      "title": "Java Style Guide",
+      "url": "https://google.github.io/styleguide/javaguide.html",
+      "section": "Source structure and exception handling",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living public style; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Naming/layout follows local standard; style is distinct from runtime correctness."
+    },
+    {
+      "id": "oracle-resources",
+      "publisher": "Oracle",
+      "title": "Try-with-resources",
+      "url": "https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html",
+      "section": "Closing resources and suppressed exceptions",
+      "checkedAt": "2026-11-08",
+      "versionScope": "JDK8 tutorial; not a source for newer runtime features",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Preserve primary cause and borrowed-resource ownership; check actual API contract."
+    },
+    {
+      "id": "java-executor",
+      "publisher": "Oracle",
+      "title": "ExecutorService",
+      "url": "https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/concurrent/ExecutorService.html",
+      "section": "Shutdown, termination and awaitTermination",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Java SE17 documentation",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Check target JDK; no automatic virtual-thread or JDK migration."
+    },
+    {
+      "id": "google-python",
+      "publisher": "Google",
+      "title": "Python Style Guide",
+      "url": "https://google.github.io/styleguide/pyguide.html",
+      "section": "Imports, exceptions and mutable state",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living public guide; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Keep current formatter/type checker and library responsibilities."
+    },
+    {
+      "id": "python-asyncio",
+      "publisher": "Python project",
+      "title": "Coroutines and tasks",
+      "url": "https://docs.python.org/3/library/asyncio-task.html",
+      "section": "Cancellation and task ownership",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page observed 3.15.2; feature availability follows project Python",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Newer TaskGroup/timeout features require a supported project version; no upgrade implied."
+    },
+    {
+      "id": "cert-c",
+      "publisher": "CMU SEI",
+      "title": "MEM00-C allocation and release",
+      "url": "https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/recommendations/memory-management-mem/mem00-c/",
+      "section": "MEM00-C memory responsibility",
+      "checkedAt": "2026-11-08",
+      "versionScope": "2016-edition standard family; MEM00-C is a recommendation",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Do not label recommendations as mandatory CERT rules or apply C++ ownership machinery to pure C."
+    },
+    {
+      "id": "cpp-core",
+      "publisher": "C++ Core Guidelines editors",
+      "title": "C++ Core Guidelines",
+      "url": "https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines",
+      "section": "Resource and lifetime interfaces",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page dated 2026-06-14, living release0.8",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Adapt to existing exception policy and compiler; borrowing does not imply ownership."
+    },
+    {
+      "id": "google-cpp",
+      "publisher": "Google",
+      "title": "C++ Style Guide",
+      "url": "https://google.github.io/styleguide/cppguide.html",
+      "section": "Exceptions and project consistency",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living public guide; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Its exception/standard policy is not universal; preserve the owning project policy and C ABI."
+    },
+    {
+      "id": "ms-sal",
+      "publisher": "Microsoft",
+      "title": "Understanding SAL",
+      "url": "https://learn.microsoft.com/en-us/cpp/code-quality/understanding-sal?view=msvc-170",
+      "section": "Parameter preconditions and output guarantees",
+      "checkedAt": "2026-11-08",
+      "versionScope": "MSVC170 documentation view",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "SAL is an optional toolchain-specific expression, not a portable mandatory annotation."
+    },
+    {
+      "id": "aws-retry",
+      "publisher": "AWS",
+      "title": "Timeouts, retries and backoff with jitter",
+      "url": "https://aws.amazon.com/builders-library/timeouts-retries-and-backoff-with-jitter/",
+      "section": "Timeouts, bounded retries and retry amplification",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Article dated 2019-12-05; official Builder Center redirect",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Retry only semantically safe operations within a total budget; failure classes alone do not grant write replay."
+    },
+    {
+      "id": "aws-idempotency",
+      "publisher": "AWS",
+      "title": "Making retries safe with idempotent APIs",
+      "url": "https://aws.amazon.com/builders-library/making-retries-safe-with-idempotent-APIs/",
+      "section": "Caller intent, duplicate requests and atomic recording",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Builders Library; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "A process-local example does not establish database/multi-process exactly-once."
+    },
+    {
+      "id": "react-effects",
+      "publisher": "React project",
+      "title": "useEffect",
+      "url": "https://react.dev/reference/react/useEffect",
+      "section": "Cleanup and fetching race conditions",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page observed React19.3; use installed project API",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Abort and stale-result checks complement each other; no React upgrade implied."
+    },
+    {
+      "id": "react-act",
+      "publisher": "React project",
+      "title": "act",
+      "url": "https://react.dev/reference/react/act",
+      "section": "Applying updates before assertions",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page observed React19.3; verify sample versions",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "DOM simulation is not browser E2E or native desktop execution."
+    },
+    {
+      "id": "vue-watchers",
+      "publisher": "Vue project",
+      "title": "Watchers",
+      "url": "https://vuejs.org/guide/essentials/watchers.html",
+      "section": "Side-effect cleanup",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Vue3; onWatcherCleanup requires3.5+ and synchronous registration",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Use supported callback cleanup on older Vue3; no framework migration."
+    },
+    {
+      "id": "tauri-permissions",
+      "publisher": "Tauri project",
+      "title": "Permissions",
+      "url": "https://v2.tauri.app/security/permissions/",
+      "section": "Command allow/deny and capability scope",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Tauri2 docs; check installed version/configuration",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Rust command-unit tests do not activate webview permissions or prove packaged GUI security."
+    },
+    {
+      "id": "electron-security",
+      "publisher": "Electron project",
+      "title": "Security",
+      "url": "https://www.electronjs.org/docs/latest/tutorial/security",
+      "section": "IPC sender checks and renderer trust",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living docs; match installed Electron",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Handler tests do not prove sandbox/context isolation is active in a packaged app."
+    },
+    {
+      "id": "spring-tests",
+      "publisher": "Spring project",
+      "title": "Testing Spring Boot applications",
+      "url": "https://docs.spring.io/spring-boot/3.5/reference/testing/spring-boot-applications.html",
+      "section": "Test slices and application tests",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Boot3.5 docs observed3.5.16; preserve sample/project versions",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Test scope matters; MVC tests do not establish live DB/transaction or deployment behavior."
+    },
+    {
+      "id": "fastapi-lifespan",
+      "publisher": "FastAPI project",
+      "title": "Lifespan events",
+      "url": "https://fastapi.tiangolo.com/advanced/events/",
+      "section": "Acquire and release application resources",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living FastAPI documentation; match pinned dependencies",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Use actual lifespan execution in tests; import does not own a live connection."
+    },
+    {
+      "id": "gin-binding",
+      "publisher": "Gin project",
+      "title": "Binding",
+      "url": "https://gin-gonic.com/en/docs/binding/",
+      "section": "Binding errors and validation",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living Gin documentation; match pinned module",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Writing/aborting a response does not replace explicit control-flow return in the current handler."
+    },
+    {
+      "id": "axum-extractors",
+      "publisher": "Axum project",
+      "title": "Extractors",
+      "url": "https://docs.rs/axum/latest/axum/extract/",
+      "section": "Extractor order and rejections",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Latest route observed0.8.9; fixed0.8.9 route unavailable via browser tool",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Pinned existing example is authoritative for compilation; do not assume source signatures across releases."
+    },
+    {
+      "id": "drogon-filters",
+      "publisher": "Drogon project",
+      "title": "Middleware and Filter",
+      "url": "https://github.com/drogonframework/drogon/wiki/ENG-05-Middleware-and-Filter",
+      "section": "Filter callbacks and continuation",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living wiki; match compiled example version",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Synthetic role headers are not authentication; callback lifetime must follow actual ownership."
+    },
+    {
+      "id": "node-typescript",
+      "publisher": "Node.js project",
+      "title": "Modules: TypeScript",
+      "url": "https://nodejs.org/api/typescript.html",
+      "section": "Type-stripping history, enabling, and separate type checking",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page observed26.13.0; sample>=22.18, actual24.14.1 tested; product Node>=22 unchanged",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Native stripping is not type checking and ignores tsconfig. Missing sample capability is MISSING, not a product runtime upgrade."
+    }
+  ]
+}

package/localized/zh-CN/skills/fec-security-review/references/engineering-practices.md

@@ -0,0 +1,73 @@
+---
+practiceCards:
+  - id: "fec-security-review:input-trust"
+    level: "required"
+    sourceIds: ["electron-security","tauri-permissions"]
+    caseIds: ["EP-IPC-01","EP-TS-01"]
+    evidence: "review-only"
+  - id: "fec-security-review:secret-boundary"
+    level: "required"
+    sourceIds: ["electron-security","google-review"]
+    caseIds: ["EP-IPC-01"]
+    evidence: "review-only"
+---
+
+# 本入口工程决策
+
+先定位项目角色、工具链及已有约定，再按需读取[公共原则](common/engineering-practices.md)。下列条件仅约束当前语言/场景；结构检查不证明全部语义或实际运行。
+
+<a id="fec-security-review:input-trust"></a>
+## UI不是特权操作授权方
+
+级别: required
+
+### 风险
+隐藏控件或渲染端自报角色可能掩盖缺失的可信授权边界。
+
+### 适用
+API/IPC/外部数据影响特权行为时适用，按真实应用角色和平台。
+
+### 决策
+定位权威身份/权限拥有者，副作用前校验操作输入，仅暴露所需能力；UI可见性与可信执行分开。
+
+### 例外
+受限本地工具不凭空加入网络认证；Electron/Tauri具体授权机制不同，读取相应平台入口。
+
+### 正反示意
+正例：可信main/server在副作用前检查调用方及范围。反例：handler信任渲染端admin=true。
+
+### 验证
+检查允许/拒绝/畸形输入及拒绝零副作用；handler/输入样例不证明所有项目认证。
+
+### 来源
+electron-security, tauri-permissions — [来源与适用限制](common/engineering-practices.sources.json).
+
+证据标识: EP-IPC-01, EP-TS-01; review-only.  执行状态及覆盖范围见实际记录；关联ID不证明该卡全部语义。
+
+<a id="fec-security-review:secret-boundary"></a>
+## 仅获准公开数据进入客户端
+
+级别: required
+
+### 风险
+过宽bridge、bundle或错误可能泄露仅server/main可见的数据。
+
+### 适用
+适用于客户端/renderer配置、诊断及载荷，保留项目已有敏感数据政策。
+
+### 决策
+评审获准配置名称、构建归档和边界DTO，不打印凭据；私钥、原始环境及内部异常细节不进入公开载荷/日志。
+
+### 例外
+变量前缀或隐藏UI不形成保密边界；仅获准任务真实需要时读取敏感值，不贴入评审输出。
+
+### 正反示意
+正例：main返回受限公开结果。反例：bridge暴露process.env或完整内部堆栈。
+
+### 验证
+用合成数据检查真实获准归档/边界及脱敏路径；这是参考边界思想的项目政策，不冒称全部企业指南同一秘密规则。
+
+### 来源
+electron-security, google-review — [来源与适用限制](common/engineering-practices.sources.json).
+
+证据标识: EP-IPC-01; review-only.  执行状态及覆盖范围见实际记录；关联ID不证明该卡全部语义。

package/localized/zh-CN/skills/fec-security-review/references/report-template.md

@@ -6,6 +6,14 @@
 > 生成时间: YYYY-MM-DD HH:mm
 > 评审工具: frontend-craft
 
+> 审核模式：改动审核 / 指定范围审核 / 全项目审核
+> 目标范围：路径或 PR/提交
+> 已审核：文件或模块清单
+> 排除项：路径及原因
+> 未覆盖：剩余文件或模块清单（无则注明）
+> 完成状态：完成 / 部分完成
+> 验证结果：命令、结果及未执行原因
+
 ## CRITICAL / 高危 (N项)
 - **[文件:行号]** 风险描述 -> 修复建议
 
@@ -25,3 +33,5 @@
 ```
 
 审查完成后，将报告保存到 `reports/security-review-YYYY-MM-DD-HHmmss.md`，并告知用户报告路径。
+
+改动审核保留合并建议；指定范围和全项目审核输出风险评估。部分完成时，结论仅适用于已审核范围，不构成全项目通过结论。

package/localized/zh-CN/skills/fec-tdd-workflow/SKILL.md

@@ -3,50 +3,22 @@ name: fec-tdd-workflow
 description: 用于实现新前端行为、修复 bug 或重构可先由测试描述预期行为的逻辑。适用于组件、hooks/composables、工具函数、API clients、路由守卫或用户工作流；中文触发词包括 TDD、测试驱动、先写测试、红绿重构、回归测试。
 ---
 
-# 前端 TDD 工作流
+# 前端测试驱动开发
 
-## 用途
+遵循[公共 TDD 方法](references/common/tdd.md)。新增行为使用 RED → GREEN → REFACTOR；纯重构使用 GREEN → REFACTOR → GREEN。
 
-用“先写失败测试，再实现最小代码，再重构”的节奏交付前端功能，避免只在实现后补覆盖率。
+## 前端可观察契约
 
-## 流程
+用户看到的 UI、组件 props/emits、hook/composable 返回值、路由守卫结果、API client 输出与错误状态，以及事件、副作用和异步状态。
 
-1. 识别可观察行为：用户能看到的 UI、组件契约、hook/composable 返回值、路由守卫结果、API client 输出或错误状态。
-2. 先写一个最小失败测试：
-   - 纯逻辑优先单元测试。
-   - 组件交互优先 Testing Library / Vue Test Utils。
-   - 跨页关键流程优先 Playwright / Cypress。
-3. 运行该测试并确认失败原因正确，失败应来自行为尚未实现，而不是语法、导入或测试环境错误。
-4. 写刚好能通过测试的最小实现，不顺手扩大范围。
-5. 重新运行测试，确认变绿。
-6. 在测试保持通过的前提下重构命名、边界和重复逻辑。
-7. 对 bug 修复，保留能复现问题的回归测试。
-8. 每轮只扩大一个可观察行为；新需求、新边界和新异常路径各自进入下一轮。
+## 前端测试选型
 
-## 证明式测试模式
-
-修复缺陷时先让测试失败，再让它通过。若无法先失败，说明测试没有覆盖原始问题，需要收窄输入、断言或测试层级。
-
-## 前端测试选择
-
-| Risk | Preferred Test |
-| ---- | -------------- |
+| 风险 | 优先验证 |
+| --- | --- |
 | utils、schema、状态计算 | 单元测试 |
-| hooks / composables | 单元或轻量集成测试 |
-| 组件 props、emits、交互、状态 | 组件测试 |
-| Router、Provider、Store 协作 | 轻量集成测试 |
-| 登录、支付、权限、关键 CRUD | E2E 测试 |
-
-## 约束
-
-- 不为了 TDD 引入项目没有使用且收益不清晰的新测试框架。
-- 不测试实现细节、私有状态或脆弱 DOM 结构。
-- 不把 E2E 当作所有风险的默认答案；优先选择离风险最近的测试层。
-- 如果现有仓库没有测试基础设施，先输出最小测试落地建议，再请求用户确认是否引入。
-- 不在红灯阶段同时重构；先证明问题，再最小修复，再整理结构。
-
-## 预期输出
+| hooks/composables | 单元或轻量集成 |
+| 组件 props、emits、交互及状态 | Testing Library / Vue Test Utils 组件测试 |
+| Router、Provider、Store 协同 | 轻量集成 |
+| 跨页面登录、支付、权限与 CRUD 旅程 | 已有 Playwright/Cypress E2E |
 
-- 至少一个先失败后通过的测试覆盖新增或修复行为。
-- 实现保持最小范围，重构只在测试通过后进行。
-- 总结运行过的测试命令、覆盖的行为和未覆盖风险。
+选择贴近实际风险的最小有效层，权限纯逻辑不因为名称而强制 E2E；不引入项目未采用的测试框架。报告按公共方法记录实际红绿证据和覆盖边界。

package/localized/zh-CN/skills/fec-tdd-workflow/references/common/tdd.md

@@ -0,0 +1,13 @@
+# 测试驱动开发
+
+新增行为和改变行为的缺陷修复使用 RED → GREEN → REFACTOR，测试描述可观察契约，不锁死内部实现结构。
+
+1. 确定一个行为：输入、输出/错误、状态变换或外部可观察副作用。沿用项目现有工具，选择最接近风险且有效的测试层。
+2. 先写能区分缺失或错误行为的最小测试并运行，观察预期行为导致的失败，不将语法、导入或环境错误当成红灯。缺陷测试必须在原缺陷存在时失败。
+3. 只实现足以通过测试的最少代码。红灯阶段不重构，不增加无关功能。
+4. 重跑测试及相关周边测试，再在保持绿色的前提下整理命名和结构；新需求进入下一轮。
+5. 报告实际红绿命令、覆盖行为和未测边界，不根据差异或未执行的测试推断成功。
+
+纯结构重构使用另一条契约：以已有测试或特征覆盖建立当前行为，保持 GREEN → REFACTOR → GREEN，不为流程形式制造失败。
+
+逻辑就近测试；真实边界用集成测试，需要完整旅程时才用端到端测试。不默认上 E2E，不断言脆弱私有状态，不仅为 TDD 引入新框架。项目缺少测试设施时先说明最小搭建方案，并在获得决定后引入；按实际技术栈选择工具，不要求前端测试工具。

package/localized/zh-CN/skills/fec-testing-strategy/SKILL.md

@@ -43,3 +43,7 @@ description: 用于规划或审查前端测试策略，按风险选择正确测
 ## 预期输出
 
 输出测试分层建议、风险到测试层的映射、优先级、建议命令、需新增或调整的测试文件范围，以及明确分流到哪些专项 skill 或 agent。
+
+## 工程实践
+
+按当前任务读取[本入口工程细则](references/engineering-practices.md)，再按链接选择公共原则。规则级别与例外以实际项目契约为准；不因产品前后端标签限制语言或职责。