@ccoalm/ccl-skills 0.14.0 → 0.15.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_init_policy_matrix.sh

@@ -146,8 +146,8 @@ register_mutation() {
 # SPECIFIC rejection reason in its stderr.
 self_check_stderr="$tmp_dir/guard_self_check.err"
 if mutate_and_expect_mismatch guard-self-check-broken-mutant \
-  'def is_bare_host_identifier(identifier: str) -> bool:' \
-  'def is_bare_host_identifier(identifier: str) -> bool  # deliberately broken' \
+  'def is_authority_name(name: str) -> bool:' \
+  'def is_authority_name(name: str) -> bool  # deliberately broken' \
   >/dev/null 2>"$self_check_stderr"
 then
   printf 'the walk accepted a BROKEN mutant as sensitivity; its own guard does not work, so every result below is meaningless\n' >&2
@@ -178,104 +178,39 @@ register_mutation drop-field-name-sanitizer \
   '    text = name if isinstance(name, str) else repr(name)' \
   '    return name if isinstance(name, str) else repr(name)'
 
-# The two directions of the host-vocabulary class. Both must be detectable, and
-# they fail for opposite reasons: widening it launders a proven customization
-# into the cascadable class, while removing it restores the total-outage
-# behaviour this class exists to prevent.
-register_mutation widen-host-vocabulary-to-any-entry \
-  '    return bool(BARE_HOST_IDENTIFIER.fullmatch(identifier))' \
-  '    return True'
+# The MCP list is the one customization surface still required to be empty;
+# dropping that requirement must flip every declared-mcp row.
+register_mutation drop-mcp-empty-requirement \
+  'REQUIRED_EMPTY_INIT_FIELDS = (
+    "mcp_servers",
+)' \
+  'REQUIRED_EMPTY_INIT_FIELDS = ()'
 
-register_mutation terminalize-host-vocabulary \
-  '    return bool(BARE_HOST_IDENTIFIER.fullmatch(identifier))' \
-  '    return False'
-
-# Dynamic host command vocabulary is useful only if both halves are enforced:
-# the baseline must affect the allow decision, and its CLI version must bind the
-# formal init. Baseline skills are deliberately not authority because a leaked
-# user skill would otherwise become callable in the formal run.
-register_mutation drop-host-baseline-vocabulary \
-  '                        if customization_entry_allowed(
-                            field,
-                            entry,
-                            expected_native_skills,
-                            baseline_commands,
-                            baseline_skills,
-                        ):' \
-  '                        if customization_entry_allowed(
-                            field,
-                            entry,
-                            expected_native_skills,
-                            set(),
-                            set(),
-                        ):'
-
-register_mutation authorize-host-baseline-skill \
-  '            identifier in KNOWN_SAFE_BUILTIN_SKILLS
-            or identifier in selected_names' \
-  '            identifier in KNOWN_SAFE_BUILTIN_SKILLS
-            or identifier in baseline_skills
-            or identifier in selected_names'
-
-register_mutation drop-host-baseline-required-empty-check \
-  '        if field not in HOST_VOCABULARY_FIELDS and init_event.get(field) != []:' \
-  '        if field not in HOST_VOCABULARY_FIELDS and False:'
-
-register_mutation widen-host-baseline-to-namespaced-entries \
-  '            or any(
-                identifier not in known_host_identifiers
-                and not is_bare_host_identifier(identifier)
-                for identifier in identifiers
-            )' \
-  '            or any(identifier == "<unidentified>" for identifier in identifiers)'
-
-register_mutation drop-host-baseline-version-binding \
-  '        if baseline_version is not None and ev.get("claude_code_version") != baseline_version:
-            # The two invocations no longer prove one same-version host
-            # vocabulary snapshot. Refuse this lane, but treat the mismatch as
-            # capability drift rather than a proven tool/authority breach so a
-            # different reviewer may continue.
-            unknown_fields.add("claude_code_version:host-baseline-mismatch")' \
-  '        if False:
-            unknown_fields.add("claude_code_version:host-baseline-mismatch")'
+# Vocabulary must stay data. Reading a populated skill/command/plugin list as a
+# breach is exactly the outage class policy G removed -- a new host built-in or
+# an installed plugin took the reviewer lane down while proving nothing -- so
+# the oracle must see the class come back.
+register_mutation judge-vocabulary-as-capability \
+  '            elif field in KNOWN_VOCABULARY_INIT_FIELDS:
+                # Vocabulary, not capability: any value, any shape. Whatever a
+                # CLI release or an installed plugin lists here cannot be
+                # invoked past the pinned `tools` set.
+                continue' \
+  '            elif field in KNOWN_VOCABULARY_INIT_FIELDS:
+                if isinstance(value, (list, dict)) and value:
+                    nonempty.add(field)'
 
-# The shape gate. Dropping it lets a structured entry be judged on its `name`
-# alone, which reaches TOLERATED when that name is an allowed built-in -- the
-# most severe class in this file, so it needs its own mutant rather than riding
-# on the bare-identifier one.
-register_mutation drop-whole-value-gate \
-  '                        if field in HOST_VOCABULARY_FIELDS and (
-                            not host_entry_is_whole(entry, identifier)
-                        ):' \
-  '                        if False:'
-
-# ...and the weaker version of the same gate: checking only the SHAPE (a plain
-# string) while still judging a truncated token. This is what the gate looked
-# like before the third finding, so it must be detectable on its own.
-register_mutation weaken-whole-value-gate-to-shape-only \
-  '    normalized = entry.lower()
-    if normalized.startswith("/"):
-        normalized = normalized[1:]
-    return normalized == identifier' \
-  '    return True'
-
-# The regression a round-9 review found in the gate itself: stripping before the
-# comparison re-introduces the lossiness the gate exists to reject, and wrapping
-# an ALLOWLISTED name in whitespace then reaches TOLERATED.
-register_mutation strip-before-the-whole-value-comparison \
-  '    normalized = entry.lower()' \
-  '    normalized = entry.strip().lower()'
-
-register_mutation drop-host-vocabulary-breach-guard \
-  '        if unclassifiable_vocabulary and not surface_breached:' \
-  '        if unclassifiable_vocabulary:'
-
-# The two parse paths implement the class separately, so each needs its own
-# mutant: dropping it from the main-invocation predicate leaves the probe path
-# correct, which is exactly the shape of divergence this oracle exists to catch.
-register_mutation drop-host-vocabulary-from-main-path \
-  'runtime_drift_only = bool(unknown or unverifiable or vocabulary) and not (' \
-  'runtime_drift_only = bool(unknown or unverifiable) and not ('
+# ...and the softer misreading: vocabulary as schema drift. Same outage, one
+# client switch cheaper, still wrong.
+register_mutation drift-on-vocabulary \
+  '            elif field in KNOWN_VOCABULARY_INIT_FIELDS:
+                # Vocabulary, not capability: any value, any shape. Whatever a
+                # CLI release or an installed plugin lists here cannot be
+                # invoked past the pinned `tools` set.
+                continue' \
+  '            elif field in KNOWN_VOCABULARY_INIT_FIELDS:
+                if isinstance(value, (list, dict)) and value:
+                    unknown_fields.add(field)'
 
 # Dispatch the registered walk with bounded concurrency. The mutants are
 # independent by construction: each writes its own `mutant_<name>.py` copy under

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_parse_probe_result.sh

@@ -111,37 +111,9 @@ run_ok_runtime_surface() {
     --require-empty-init --expected-tools "$expected_tools" --allow-expected-tool-use --runtime-surface-only >/dev/null
 }
 
-run_ok_expected_native_skills() {
-  local expected_native_skills="$1" required_native_skills="$2" rc="$3" stdout="$4"
-  local stderr="${5:-}"
-  printf '%s' "$stdout" > "$tmp_dir/stdout"
-  printf '%s' "$stderr" > "$tmp_dir/stderr"
-  python3 "$parser" "$rc" "$tmp_dir/stdout" "$tmp_dir/stderr" \
-    --require-empty-init \
-    --expected-native-skills "$expected_native_skills" \
-    --required-native-skills "$required_native_skills" >/dev/null
-}
-
-run_reason_expected_native_skills() {
-  local expected_native_skills="$1" required_native_skills="$2" rc="$3" stdout="$4"
-  local expected="$5" stderr="${6:-}" out
-  printf '%s' "$stdout" > "$tmp_dir/stdout"
-  printf '%s' "$stderr" > "$tmp_dir/stderr"
-  if out="$(python3 "$parser" "$rc" "$tmp_dir/stdout" "$tmp_dir/stderr" \
-    --require-empty-init \
-    --expected-native-skills "$expected_native_skills" \
-    --required-native-skills "$required_native_skills")"; then
-    printf 'expected native-skill probe parser failure\n' >&2
-    return 1
-  fi
-  printf '%s' "$out" | grep -F "$expected" >/dev/null
-}
-
-# Runtime-surface variants used to pin the main-invocation drift guard. The
-# first omits --allow-expected-tool-use (the wrapper always passes it, so this
-# is the guard's defence-in-depth leg); the second exercises the owner-aware
-# path, where a permitted-looking customization list can still carry an
-# unexpected identifier.
+# Runtime-surface variant used to pin the main-invocation drift guard: it
+# omits --allow-expected-tool-use (the wrapper always passes it, so this is the
+# guard's defence-in-depth leg).
 run_reason_runtime_surface_no_tool_use_allowance() {
   local expected_tools="$1" rc="$2" stdout="$3" expected="$4" stderr="${5:-}" out
   printf '%s' "$stdout" > "$tmp_dir/stdout"
@@ -158,24 +130,6 @@ run_reason_runtime_surface_no_tool_use_allowance() {
   printf '%s' "$out" | grep -F "$expected" >/dev/null
 }
 
-run_reason_runtime_surface_native() {
-  local expected_native_skills="$1" rc="$2" stdout="$3" expected="$4" stderr="${5:-}" out
-  printf '%s' "$stdout" > "$tmp_dir/stdout"
-  printf '%s' "$stderr" > "$tmp_dir/stderr"
-  if out="$(python3 "$parser" "$rc" "$tmp_dir/stdout" "$tmp_dir/stderr" \
-    --require-empty-init --expected-tools "" --allow-expected-tool-use --runtime-surface-only \
-    --expected-native-skills "$expected_native_skills" \
-    --required-native-skills "$expected_native_skills")"; then
-    printf 'expected owner-aware runtime-surface parser failure\n' >&2
-    return 1
-  fi
-  if printf '%s' "$out" | grep -F 'unrecognized surface-shaped init field' >/dev/null; then
-    printf 'drift reason must not launder an unexpected identifier: %s\n' "$out" >&2
-    return 1
-  fi
-  printf '%s' "$out" | grep -F "$expected" >/dev/null
-}
-
 run_reason_runtime_surface_implicit_strict() {
   local stdout="$1" expected="$2" out
   printf '%s' "$stdout" > "$tmp_dir/stdout"
@@ -292,34 +246,25 @@ run_ok_strict 0 "$empty_init"$'\n{"type":"result","subtype":"success","is_error"
 read_init='{"type":"system","subtype":"init","permissionMode":"default","tools":["Read","Grep","Glob"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[]}'
 run_ok_expected_tools 'Read,Grep,Glob' 0 "$read_init"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
 run_ok_expected_tool_use 'Read,Grep,Glob' 0 "$read_init"$'\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Read","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
-# Claude Code 2.1.218 exposes these exact host built-ins whenever an explicit
-# plugin enables the command registry. They are not plugin-owned commands or
-# model tools, so a selected native skill remains valid.
-run_ok_expected_native_skills 'testing-strategy' 'testing-strategy' 0 \
-  $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview"],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
-# The same owner-aware path remains value-exact: an arbitrary command cannot
-# hide beside the two registered host built-ins.
-run_reason_expected_native_skills 'testing-strategy' 'testing-strategy' 0 \
-  $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview","unrelated:danger"],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' \
-  'runtime capability surface is not empty'
-# A dict-shaped entry is never whole, however allowed its `name` reads. The
-# entry hides a sibling key the identifier helper discards, so clearing it on
-# the truncated name would accept a customization whose proof was in the part
-# that was thrown away. host_entry_is_whole must reject the shape BEFORE the
-# allowlist reads it; flipping its non-string branch to True makes this case
-# pass, which is exactly the regression this asserts.
-run_reason_expected_native_skills 'testing-strategy' 'testing-strategy' 0 \
-  $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec",{"name":"ultrareview","path":"hidden-sibling-value"}],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' \
-  'runtime capability surface is not empty'
-
-# A matching name in either executable surface is still terminal. Built-in UI
-# registration never authorizes a tool declaration or invocation.
-run_reason_expected_native_skills 'testing-strategy' 'testing-strategy' 0 \
+# Claude Code 2.1.261 lists its own built-in commands and skills, plus every
+# installed plugin entry, whenever an explicit plugin enables the command
+# registry. They are vocabulary, not model tools: any entry is tolerated on
+# both parse paths, including names the host adds tomorrow, namespaced or
+# structured entries, and the selected owner's own namespaced command.
+vocab_init='{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview","workflow-authoring","unrelated:danger",{"name":"ultrareview","path":"hidden-sibling-value"}],"terminal_slash_commands":["doctor"],"skills":["testing-strategy","workflow-authoring","brand-new-skill"],"plugins":["ccl-skills",{"name":"other","path":"/p"}]}'
+run_ok_strict 0 "$vocab_init"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+run_ok_runtime_surface '' 0 "$vocab_init"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+# A matching name in either executable surface is still terminal. Vocabulary
+# never authorizes a tool declaration, a tool invocation, or an MCP server.
+run_reason_strict 0 \
   $'{"type":"system","subtype":"init","permissionMode":"default","tools":["workflow-launch-exec"],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview"],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' \
   'runtime capability surface is not empty'
-run_reason_expected_native_skills 'testing-strategy' 'testing-strategy' 0 \
+run_reason_strict 0 \
   $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview"],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"workflow-launch-exec","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' \
   'runtime capability surface is not empty'
+run_reason_strict 0 \
+  $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":["inherited"],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview"],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' \
+  'runtime capability surface is not empty'
 run_reason_expected_tools_implicit_strict 'Read,Grep,Glob' 0 'ok' \
   'missing the required stream-json init evidence'
 run_reason_runtime_surface '' 0 "$empty_init"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'auth-path false negative' 'Not logged in · Please run /login'
@@ -422,42 +367,31 @@ run_reason_strict 0 $'{"type":"system","subtype":"init","permissionMode":"defaul
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":["Bash"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"capabilities":["interrupt_cancel_queued_v1"],"fast_mode_disabled_reason":"sdk_opt_in_required"}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'the no-tool sandbox is not enforced'
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":["Write"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"capabilities":["interrupt_cancel_queued_v1"],"fast_mode_disabled_reason":"sdk_opt_in_required"}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"fast_mode_disabled_reason":"sdk_opt_in_required"}\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Write","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
-# Drift + a real breach in the same init must report as the BREACH. Review round
-# 4 suspected `unexpected_customization_identifiers` was missing from the
-# main-path `runtime_drift_only` guard; it stays out because every identifier it
-# reports lands in a set that IS in the guard, and these fixtures pin that so the
-# soft drift reason can never launder a combined case. Note which set: an
-# identifier that is provably a customization marks its field non-empty, while a
-# bare host-vocabulary name lands in the unclassifiable set instead — so the
-# fixtures below use a NAMESPACED foreign identifier, which is the one that is
-# still a proven breach.
-run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["some-skill"],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'runtime isolation surface is invalid'
-run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["some-skill"],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'unexpected_customizations=skills'
-# ...and the main-path guard must match the probe path's breach set exactly.
-# A tool_use with no allowance, and an unexpected identifier under an owner-aware
-# run, are the two legs where the two guards could silently diverge again.
+# Drift + a real breach in the same init must report as the BREACH, and these
+# fixtures pin that so the soft drift reason can never launder a combined case.
+# The breach here is an inherited MCP server -- the one customization list that
+# is still a capability surface.
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":["some-server"],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'runtime isolation surface is invalid'
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":["some-server"],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'unexpected_customizations=mcp_servers'
+# ...and the main-path guard must match the probe path's breach set exactly:
+# a tool_use with no allowance is the leg where the two guards could silently
+# diverge again.
 run_reason_runtime_surface_no_tool_use_allowance 'Write' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":["Write"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Write","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'runtime isolation surface is invalid'
-run_reason_runtime_surface_native 'testing-strategy' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy"],"skills":["testing-strategy","other-plugin:unrelated-skill"],"plugins":["ccl-skills"],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'unexpected_customization_identifiers=skills:other-plugin:unrelated-skill'
-# The same fixture with a BARE unknown skill is deliberately the other verdict:
-# it reports the soft class, because a bare name outside the built-in snapshot is
-# not proof of a customization. Pinned explicitly so the split above is asserted
-# rather than merely allowed by the fixture's choice of identifier. `future_surface`
-# is dropped here on purpose — with schema drift also present the reason is the
-# broader drift phrase, which this helper forbids by design; that combined case is
-# pinned in the policy matrix instead.
-run_reason_runtime_surface_native 'testing-strategy' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy"],"skills":["testing-strategy","unrelated-skill"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'unclassifiable_host_vocabulary=skills:unrelated-skill'
+# Vocabulary beside schema drift is still only drift: the populated lists add
+# nothing to the verdict, so the reason stays the fallback-eligible drift phrase.
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","brand-new-builtin"],"skills":["testing-strategy","other-plugin:unrelated-skill"],"plugins":["ccl-skills"],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'unrecognized surface-shaped init field'
 # Same rule on the probe path: drift alongside a declared surface, an unexpected
 # tool, or a tool_use must report the BREACH. The drift phrase routes to
 # fallback, so reaching it first would launder a real breach.
-combo_drift_breach=$'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["some-skill"],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+combo_drift_breach=$'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":["some-server"],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
 run_reason 0 "$combo_drift_breach" 'runtime capability surface is not empty'
 run_reason_excludes 0 "$combo_drift_breach" 'unrecognized surface-shaped init field'
 combo_drift_tool=$'{"type":"system","subtype":"init","permissionMode":"default","tools":["Write"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
 run_reason_excludes 0 "$combo_drift_tool" 'unrecognized surface-shaped init field'
 combo_drift_use=$'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Write","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
 run_reason_excludes 0 "$combo_drift_use" 'unrecognized surface-shaped init field'
-# A declared CCL skill/plugin surface is still rejected under drift tolerance.
-run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["some-skill"],"plugins":[],"fast_mode_disabled_reason":"sdk_opt_in_required"}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
+# An inherited MCP server is still rejected under drift tolerance.
+run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":["some-server"],"slash_commands":[],"skills":[],"plugins":[],"fast_mode_disabled_reason":"sdk_opt_in_required"}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
 # THE flakiness fix: model hallucinates TOOL_ENABLED but every runtime surface is empty -> pass.
 run_ok 0 "$empty_init"$'\n{"type":"result","subtype":"success","is_error":false,"num_turns":1,"permission_denials":[],"result":"TOOL_ENABLED"}'
 # clean ok via stream -> pass.
@@ -470,9 +404,10 @@ run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","too
 # declared set; unknown/non-string elements make init ground truth invalid.
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[{"name":"Bash"}],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'missing required isolation fields'
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[{"name":"x"}],"slash_commands":[],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
-run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["review"],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
-run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["review"],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
-run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":["x"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
+# Skill, command and plugin lists are vocabulary: populated is not a breach.
+run_ok 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["review"],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+run_ok 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["review"],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+run_ok 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":["x"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
 # closes the latent false-negative: Bash DECLARED in init.tools, reply says ok -> fail.
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":["Bash","Read"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'Bash tool is available'
 # Bash actually INVOKED via tool_use block -> fail (sandbox not enforced).
@@ -509,76 +444,25 @@ run_reason 0 "$empty_init"$'\n{"type":"system","subtype":"init","permissionMode"
 # pretty-printed single envelope (bare-brace lines) must still pass via the text fallback.
 run_ok 0 $'{\n  "type": "result",\n  "subtype": "success",\n  "is_error": false,\n  "result": "ok"\n}'
 
-# --- host vocabulary is unverifiable, not a proven breach -------------------
-# The review-skill invocation is the only shape whose customization lists are
-# populated by the host's own built-ins, so a name this repo's snapshot does not
-# know cannot be shown to be a user customization. It must refuse WITHOUT
-# terminating the lane; anything that IS provably a customization must not
-# inherit that softer class. `product-rd-workflow` is used as the selected skill
-# because a name that is also a built-in skill trips the ambiguous-owner guard
-# and would mask the verdict under test.
-native_vocab_result=$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
-native_vocab_init() {
-  printf '{"type":"system","subtype":"init","permissionMode":"default","tools":%s,"mcp_servers":[],"slash_commands":%s,"skills":%s,"plugins":[{"name":"ccl-skills"}]}' \
-    "${1:-[]}" "${2:-[\"init\",\"agents\"]}" "${3:-[\"ccl-skills:product-rd-workflow\",\"dataviz\"]}"
-}
-run_reason_native_excludes() {
-  local stdout="$1" forbidden="$2" expected="$3" out
-  printf '%s' "$stdout" > "$tmp_dir/stdout"
-  : > "$tmp_dir/stderr"
-  if out="$(python3 "$parser" 0 "$tmp_dir/stdout" "$tmp_dir/stderr" \
-    --require-empty-init \
-    --expected-native-skills product-rd-workflow \
-    --required-native-skills product-rd-workflow)"; then
-    printf 'expected native-skill parser failure for stdout: %s\n' "$stdout" >&2
-    return 1
-  fi
-  if printf '%s' "$out" | grep -F "$forbidden" >/dev/null; then
-    printf 'a proven customization must not report as %q: %s\n' "$forbidden" "$out" >&2
-    return 1
-  fi
-  printf '%s' "$out" | grep -F "$expected" >/dev/null
-}
-# the base itself is accepted, or none of the rows below prove anything
-run_ok_expected_native_skills product-rd-workflow product-rd-workflow 0 \
-  "$(native_vocab_init)$native_vocab_result"
-# a built-in the snapshot has not caught up with, in either host-vocabulary field
-run_reason_expected_native_skills product-rd-workflow product-rd-workflow 0 \
-  "$(native_vocab_init '[]' '["init","agents","brand-new-builtin"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary entry'
-run_reason_expected_native_skills product-rd-workflow product-rd-workflow 0 \
-  "$(native_vocab_init '[]' '["init"]' '["ccl-skills:product-rd-workflow","brand-new-skill"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary entry'
-# ...and the identifier is named, so the follow-up is a one-liner
-run_reason_expected_native_skills product-rd-workflow product-rd-workflow 0 \
-  "$(native_vocab_init '[]' '["init","brand-new-builtin"]')$native_vocab_result" \
-  'slash_commands:brand-new-builtin'
-# A NAMESPACED entry proves a surface beyond the one expected plugin; a
-# path-shaped or unparseable identifier proves nothing about host origin; a
-# duplicate is a spoofing signal. All four stay terminal.
-run_reason_native_excludes \
-  "$(native_vocab_init '[]' '["init","evil-plugin:pwn"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary' 'runtime capability surface is not empty'
-run_reason_native_excludes \
-  "$(native_vocab_init '[]' '["init","dir/cmd"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary' 'runtime capability surface is not empty'
-run_reason_native_excludes \
-  "$(native_vocab_init '[]' '["init","ev!l"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary' 'runtime capability surface is not empty'
-run_reason_native_excludes \
-  "$(native_vocab_init '[]' '["init","init"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary' 'runtime capability surface is not empty'
-# The softer class must never absorb a real breach that happens alongside it.
-run_reason_native_excludes \
-  "$(native_vocab_init '["Write"]' '["init","brand-new-builtin"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary' 'runtime capability surface is not empty'
-# Same policy on the main-invocation path, with the identifier in the detail
-# fields so an operator can see which name drifted.
-run_reason_runtime_surface_native product-rd-workflow 0 \
-  "$(native_vocab_init '[]' '["init","brand-new-builtin"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary entry'
-run_reason_runtime_surface_native product-rd-workflow 0 \
-  "$(native_vocab_init '[]' '["init","brand-new-builtin"]')$native_vocab_result" \
-  'unclassifiable_host_vocabulary=slash_commands:brand-new-builtin'
+# --- vocabulary is data, not a verdict --------------------------------------
+# Any value in slash_commands / terminal_slash_commands / skills / plugins is
+# tolerated on both parse paths; only tools, tool_use, the MCP list and
+# permissionMode decide. Pinned so the class can never be tightened back into a
+# snapshot of the host's own names: that snapshot made every CLI release that
+# shipped a new built-in a reviewer-lane outage while proving nothing.
+vocab_any='{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["init","brand-new-builtin","evil-plugin:pwn","dir/cmd","ev!l","init"," import","brand-new runtime isolation"],"terminal_slash_commands":[{"name":"init"},"not-declared"],"skills":["brand-new-skill",{"name":"verify","command":"/x/y"},"evil-plugin:pwn"],"plugins":[{"name":"ccl-skills"},{"name":"other","path":"/p"},"x"]}'
+run_ok_strict 0 "$vocab_any"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+run_ok_runtime_surface '' 0 "$vocab_any"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+# absent or oddly typed vocabulary fields are not "missing isolation fields"
+run_ok_strict 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+run_ok_strict 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":{"a":1},"skills":"none","plugins":null,"terminal_slash_commands":"doctor"}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+# ...while the MCP list, the one customization list that is capability, must
+# still be present and empty.
+run_reason_strict 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"slash_commands":[],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'missing required isolation fields'
+# ...and every breach class keeps its strength beside vocabulary.
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":["Write"],"mcp_servers":[],"slash_commands":["init","brand-new-builtin"],"skills":["brand-new-skill"],"plugins":[{"name":"ccl-skills"}]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime isolation surface is invalid'
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"bypassPermissions","tools":[],"mcp_servers":[],"slash_commands":["init","brand-new-builtin"],"skills":["brand-new-skill"],"plugins":[{"name":"ccl-skills"}]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'unsafe_values=permissionMode'
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[{"name":"x"}],"slash_commands":["init","brand-new-builtin"],"skills":["brand-new-skill"],"plugins":[{"name":"ccl-skills"}]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'unexpected_customizations=mcp_servers'
+run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["init","brand-new-builtin"],"skills":["brand-new-skill"],"plugins":[{"name":"ccl-skills"}]}\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Write","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
 
 printf 'parse_probe_result_tests_ok\n'

package/dist/assets/marketplace/plugins/ccl-skills/skills/defect-diagnosis/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: defect-diagnosis
-description: bug / 报错 / test 挂了 / 线上问题 / 复现 / 找根因 / debug → diagnose first-hand failure evidence, isolate cause, verify before fixing, add regression proof, and route prevention. Also use for AI-proposed causes or fixes.
+description: bug / 报错 / test 挂了 / 线上问题 / 接口变慢·性能退化 / 复现 / 找根因 / debug → diagnose first-hand failure evidence, isolate cause, verify before fixing, add regression proof, and route prevention. Also use for AI-proposed causes or fixes.
 ---
 
 # Defect Diagnosis

package/dist/assets/marketplace/plugins/ccl-skills/skills/grill-me/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: grill-me
-description: grill-me / 访谈 / 拷问 / 压力测试方案 / stress-test a plan — lightweight one-question-at-a-time interview to challenge a plan, design, API shape, data model, or feature direction before implementation. Skip code-level YAGNI/delete/adversarial review of written code → `product-rd-workflow`'s independent-review gate; full delivery/spec/plan authoring → product-rd-workflow; tests → testing-strategy; implementation → stack/dev skill; process lesson extraction → skill-extraction-workflow.
+description: grill-me / 访谈 / 一问一答拷问（一次问一个）/ 压力测试方案 / stress-test a plan — lightweight one-question-at-a-time interview to challenge a plan, design, API shape, data model, or feature direction before implementation. Skip 拷问用的问题池·推荐默认值等材料，以及拷问后的结论整理（不是逐问过程）→ requirement-intent；code-level YAGNI/delete/adversarial review of written code → `product-rd-workflow`'s independent-review gate; full delivery/spec/plan authoring → product-rd-workflow; tests → testing-strategy; implementation → stack/dev skill; process lesson extraction → skill-extraction-workflow.
 ---
 
 # grill-me — 轻量方案拷问

package/dist/assets/marketplace/plugins/ccl-skills/skills/miniapp-product-dev/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: miniapp-product-dev
-description: "小程序 / Taro / 微信小程序 / 支付宝小程序 / 抖音小程序 / 小程序上线审核 → implement, debug, test, and ship mini-program client features: pages, state, API integration, auth, sharing, platform capabilities, review, and device verification. Triggers also include \"重构这个小程序页面/组件(局部)\", \"refactor a mini-program page/component\"."
+description: "小程序 / Taro / 微信小程序 / 支付宝小程序 / 抖音小程序 / 小程序上线审核 / 微信开发者工具编译·构建·真机调试 → implement, debug, test, and ship mini-program client features: pages, state, API integration, auth, sharing, platform capabilities, review, and device verification. Triggers also include \"重构这个小程序页面/组件(局部)\", \"refactor a mini-program page/component\"."
 ---
 
 # Miniapp Product Dev

package/dist/assets/marketplace/plugins/ccl-skills/skills/platform-observability/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: platform-observability
-description: Use when designing, reviewing, debugging, or shipping observability — service logs, metrics, distributed tracing, log/trace correlation, dashboards, alerts, on-call routing（值班/排班 SOP、P0/P1 打断；发布值班/回滚除外）, SLI/SLO, error budgets — for a backend product. Owns the cross-cutting evidence layer — what signals must exist, what fields must propagate, what middleware must auto-wire, what verification proves a change is observable in production. Hand off mesh/routing/mTLS to `platform-service-connectivity`, release gates and rollback evidence to `platform-release-engineering`, service-internal architecture (HTTP/RPC/DB/queue) to `python-service-architecture` / `go-microservice-architecture`. Product-agnostic; do not depend on specific repository names, service names, hostnames, or business domains.
+description: Use when designing, reviewing, debugging, or shipping observability — service logs, metrics, distributed tracing, log/trace correlation, 给接口·服务加结构化日志与 trace 透传, dashboards, alerts, on-call routing（值班/排班 SOP、P0/P1 打断；发布值班/回滚除外）, SLI/SLO, error budgets, 线上是否已启用（开关·配置在生产的实际生效状态）— for a backend product. Owns the cross-cutting evidence layer — what signals must exist, what fields must propagate, what middleware must auto-wire, what verification proves a change is observable in production. Hand off mesh/routing/mTLS to `platform-service-connectivity`, release gates and rollback evidence to `platform-release-engineering`, service-internal architecture (HTTP/RPC/DB/queue) to `python-service-architecture` / `go-microservice-architecture`. Product-agnostic.
 ---
 
 # Platform Observability

package/dist/assets/marketplace/plugins/ccl-skills/skills/platform-release-engineering/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: platform-release-engineering
-description: 发布 / 灰度 / canary / rollback / rollout / 环境泳道 / promotion gate → design or review how a change moves from build to traffic and back safely, including rollout strategy, approval, rollback, secrets, config, and deploy control planes. Skip when the ask is the production release lifecycle — 上线范围确认 / 合并 main / 打 tag / 生产构建 / 发布后 reset → release-coordination; release document substance → release-doc-writer.
+description: 发布 / 灰度 / canary / rollback / rollout / 环境泳道 / promotion gate / 发布值班 SOP（P0·P1 打断排班、是否回滚）→ design or review how a change moves from build to traffic and back safely, including rollout strategy, approval, rollback, secrets, config, and deploy control planes. Skip when the ask is the production release lifecycle — 上线范围确认 / 合并 main / 打 tag / 生产构建 / 发布后 reset → release-coordination; release document substance → release-doc-writer.
 ---
 
 # Platform Release Engineering

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: product-rd-workflow
-description: 加功能 / 新需求 / 技术方案 / 方案评估 / 技术选型 / 可行性评估 / 工作量评估 / 多阶段重构 / 推倒重来 / 重新开发 / 完全重新开始 / 清除代码重新开发 / redo-from-scratch / 项目分析 / spec·PRD·需求文档实质内容写错要改对（substance 修正） / 方案评审通过开始实现 / 进入实现阶段 → end-to-end product R&D router for requirement shaping, spec/plan, implementation gates, assessment, redo/refactor, and multi-stack standards.
+description: 加功能/新需求/技术方案/方案评估/技术选型/可行性评估/工作量评估/多阶段重构/推倒重来/重新开发/完全重新开始/清除代码重新开发/redo-from-scratch/继续之前的重构·开发/resume-in-flight-delivery/项目分析/无架构兄弟栈的服务边界·数据归属/service-boundary-data-ownership/spec·PRD·需求文档实质内容写错要改对（substance 修正）/方案评审通过·进入实现阶段 → end-to-end product R&D router for requirement shaping, spec/plan, implementation gates, assessment, redo/refactor, and multi-stack standards.
 ---
 
 # Product R&D Workflow
@@ -43,7 +43,7 @@ Use this skill as the top-level workflow for new product development, feature de
 - Skill/process extraction: when asked to summarize delivery experience, preserve a workflow lesson, update a reusable skill, or decide where a lesson belongs, route to `skill-extraction-workflow` first. Update this skill only when the lesson changes product R&D routing, gates, ownership, or lifecycle policy.
 - Upstream decision propagation: when architecture, design, testing strategy, release, observability, security, or product workflow guidance changes, treat the next R&D slice as incomplete until the downstream execution owners are named. Confirm which implementation skill, test/review skill, and release or docs owner must apply the decision, or route the gap through `skill-extraction-workflow`.
 - Text artifact quality: when this workflow creates or updates a SOP, template, checklist, report, Feishu/Lark doc, task card, launch material, or other deliverable text, run `tighten-doc` before sharing, syncing, committing, or publishing. Do not ask the user for a separate optimization confirmation unless substantive decisions may change or collaborative-comment safety is at risk.
-- Product R&D standards docs: when creating or updating team development standards, stack guidelines, testing standards, engineering norms, or a multi-doc handbook that belongs to the R&D lifecycle, use the R&D standards checklist in Workflow. Cross-stack or cross-service product Specs live in one authority surface; stack/service repositories keep execution slices and links back to that authority instead of redefining product goals. A multi-stack standards family must include a testing standard owned by `testing-strategy`; stack docs specialize commands and harness mechanics but do not replace the shared test-layer and CI-gate policy. For standalone wording, editing, or polishing requests with no R&D routing decision, use `tighten-doc` directly. Authority/sync-gate and testing-standard detail: `references/rd-standards-doc-family-checklist.md`.
+- Product R&D standards docs: when creating or updating team development standards, stack guidelines, testing standards, engineering norms, or a multi-doc handbook that belongs to the R&D lifecycle, you must use the R&D standards checklist in Workflow. For standalone wording, editing, or polishing requests with no R&D routing decision, use `tighten-doc` directly. Authority/sync-gate and testing-standard detail: `references/rd-standards-doc-family-checklist.md`.
 - Standards-to-health-gate propagation: when a standards family is intended to check project compliance later, split each norm into deterministic checks and agent review checks, route the executable invariant model to `testing-strategy` fitness functions and the stack-specific mechanics to the owning dev/architecture skills, and do not leave conformance as a human-only checklist (mapping detail in `references/rd-standards-doc-family-checklist.md`).
 - High-risk resilience gating: when a feature touches money, billing, quota, permissions, tenant/user data isolation, privacy, high-impact AI answers, write-finality risk, repeated submission, async job finality, or incident explanation/compensation, require an explicit resilience gate before implementation or launch; do not escalate low-risk local edits only because they write files. Write-finality classification and gate detail: `references/high-risk-resilience-gates.md`.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/rd-standards-doc-family-checklist.md

@@ -8,8 +8,8 @@ Use this checklist for R&D standards, specs, guidelines, or Feishu/wiki doc fami
 2. If any child doc, second stack/service, or cross-doc product-goal reference exists, create or update a parent overview/index first and link child docs.
 3. Scope evidence must name the parent node(s) or repo scope searched, include the product Spec surface checked, list candidate child locations, and attach concrete enumeration evidence: command/output, node list, or two independent manual passes listing parent index URL plus each checked child node title/link when no programmatic tool exists. If scoped evidence is absent, mark `blocked: family enumeration unverified`, with no sign-off.
 4. Only when step 3 evidence shows zero child docs may a single existing doc be treated as its own overview/index; cite that evidence and record its path/link and authority statement.
-5. Multi-doc families require an authority statement plus sync-gate rule before child docs are marked done.
-6. If the family defines any implementation, stack, service, client, CI, harness, release, or QA norm, include or update a testing standard child doc. It must cover test deliverables, unit/contract/integration/E2E/manual layers, harness, CI gates, high-risk coverage, evidence format, and stack handoff; route the template to `testing-strategy`.
+5. Multi-doc families require an authority statement plus sync-gate rule before child docs are marked done. A cross-stack or cross-service product Spec lives in exactly ONE authority surface; stack and service repositories carry execution slices that link back to it and **must not** redefine the product goals it owns.
+6. If the family defines any implementation, stack, service, client, CI, harness, release, or QA norm, include or update a testing standard child doc. It must cover test deliverables, unit/contract/integration/E2E/manual layers, harness, CI gates, high-risk coverage, evidence format, and stack handoff; route the template to `testing-strategy`. That testing standard, and the shared test-layer and CI-gate policy it carries, is **owned by `testing-strategy`** — not by whichever document holds the template. Stack documents specialize commands and harness mechanics only: they **must not** replace or approve that shared policy.
 7. If the family will drive project health checks, add a conformance appendix or sibling checklist that maps each rule to `deterministic`, `agent_review`, `manual`, or `not_automatable_yet`, with severity, evidence, command/prompt owner, and CI behavior. Route architecture fitness functions to `testing-strategy`; route directory-contract coverage to `agents-file-coverage-gate`; route stack mechanics to the owning stack skills.
 8. Before invoking `tighten-doc`, record `owner-ready` with the authority statement, doc-family layer, enumeration evidence, and conformance mapping evidence when applicable, or `blocked: family enumeration unverified`.
 9. Re-confirm the doc-set enumeration at completion/sign-off, or add the sync gate if the family has grown.

package/dist/assets/marketplace/plugins/ccl-skills/skills/requirement-baseline/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: requirement-baseline
-description: 现状盘点 / 当前能力梳理 / 现有流程、页面、API、数据、运营规则盘点 / as-is audit / current state inventory —— 交付物是**现状清单本身**：现在怎么运作、已有哪些能力与例外、事实来源与 freshness、缺口和冲突，含按 commit 固定的代码现状取证。Skip 要的是意图、用户故事、验收标准、问题池（「到底要什么」）→ requirement-intent；要的是本轮改哪些、不改哪些、切几版（变更边界）→ requirement-scope；问线上是否已启用 → platform-observability；代码/项目质量评估 → product-rd-workflow；bug 根因 → defect-diagnosis。
+description: 现状盘点 / 当前能力梳理 / 按当前代码说明现状（某状态·数据怎么产生和消费）/ 现有流程、页面、API、数据、运营规则盘点 / as-is audit / current state inventory —— 交付物是**现状清单本身**：现在怎么运作、已有哪些能力与例外、事实来源与 freshness、缺口和冲突，含按 commit 固定的代码现状取证。Skip 要的是意图、用户故事、验收标准、问题池（「到底要什么」）→ requirement-intent；要的是本轮改哪些、不改哪些、切几版（变更边界）→ requirement-scope；问线上是否已启用 → platform-observability；代码/项目质量评估 → product-rd-workflow；bug 根因 → defect-diagnosis。
 ---
 
 # Requirement Baseline

package/dist/assets/marketplace/plugins/ccl-skills/skills/requirement-doc-writer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: requirement-doc-writer
-description: 写 PRD / 需求文档 / 产品需求文档 / 需求说明 / user story 文档 / 验收标准文档 / 产品需求正文 —— 在 lifecycle 判定 PRD Ready 之后，把已关闭的需求组装成人读的 PRD。Skip 需求实质不清 → requirement-intent；缺现状事实 → requirement-baseline；范围/版本切片/开放决策未关闭 → requirement-scope；Agent/Machine 技术规格 → llm-inference-integration；其评测与测试层 → testing-strategy；只是润色措辞 → tighten-doc。
+description: 写 PRD / 需求文档 / 产品需求文档 / 需求说明 / user story 文档 / 验收标准文档 / 产品需求正文 —— 在 lifecycle 判定 PRD Ready 之后，把已关闭的需求组装成人读的 PRD。Skip 需求实质不清 → requirement-intent；缺现状事实 → requirement-baseline；范围/版本切片/开放决策未关闭 → requirement-scope；Agent/Machine 技术规格 → llm-inference-integration；其评测与测试层 → testing-strategy；只是润色措辞 → tighten-doc；写完 PRD 还要接着往下做的多阶段研发交付·实现/发布计划 → product-rd-workflow。
 ---
 
 # Requirement Doc Writer