@ccoalm/ccl-skills 0.14.0 → 0.15.1

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_init_policy_matrix.sh

@@ -146,8 +146,8 @@ register_mutation() {
 # SPECIFIC rejection reason in its stderr.
 self_check_stderr="$tmp_dir/guard_self_check.err"
 if mutate_and_expect_mismatch guard-self-check-broken-mutant \
-  'def is_bare_host_identifier(identifier: str) -> bool:' \
-  'def is_bare_host_identifier(identifier: str) -> bool  # deliberately broken' \
+  'def is_authority_name(name: str) -> bool:' \
+  'def is_authority_name(name: str) -> bool  # deliberately broken' \
   >/dev/null 2>"$self_check_stderr"
 then
   printf 'the walk accepted a BROKEN mutant as sensitivity; its own guard does not work, so every result below is meaningless\n' >&2
@@ -178,104 +178,39 @@ register_mutation drop-field-name-sanitizer \
   '    text = name if isinstance(name, str) else repr(name)' \
   '    return name if isinstance(name, str) else repr(name)'
 
-# The two directions of the host-vocabulary class. Both must be detectable, and
-# they fail for opposite reasons: widening it launders a proven customization
-# into the cascadable class, while removing it restores the total-outage
-# behaviour this class exists to prevent.
-register_mutation widen-host-vocabulary-to-any-entry \
-  '    return bool(BARE_HOST_IDENTIFIER.fullmatch(identifier))' \
-  '    return True'
+# The MCP list is the one customization surface still required to be empty;
+# dropping that requirement must flip every declared-mcp row.
+register_mutation drop-mcp-empty-requirement \
+  'REQUIRED_EMPTY_INIT_FIELDS = (
+    "mcp_servers",
+)' \
+  'REQUIRED_EMPTY_INIT_FIELDS = ()'
 
-register_mutation terminalize-host-vocabulary \
-  '    return bool(BARE_HOST_IDENTIFIER.fullmatch(identifier))' \
-  '    return False'
-
-# Dynamic host command vocabulary is useful only if both halves are enforced:
-# the baseline must affect the allow decision, and its CLI version must bind the
-# formal init. Baseline skills are deliberately not authority because a leaked
-# user skill would otherwise become callable in the formal run.
-register_mutation drop-host-baseline-vocabulary \
-  '                        if customization_entry_allowed(
-                            field,
-                            entry,
-                            expected_native_skills,
-                            baseline_commands,
-                            baseline_skills,
-                        ):' \
-  '                        if customization_entry_allowed(
-                            field,
-                            entry,
-                            expected_native_skills,
-                            set(),
-                            set(),
-                        ):'
-
-register_mutation authorize-host-baseline-skill \
-  '            identifier in KNOWN_SAFE_BUILTIN_SKILLS
-            or identifier in selected_names' \
-  '            identifier in KNOWN_SAFE_BUILTIN_SKILLS
-            or identifier in baseline_skills
-            or identifier in selected_names'
-
-register_mutation drop-host-baseline-required-empty-check \
-  '        if field not in HOST_VOCABULARY_FIELDS and init_event.get(field) != []:' \
-  '        if field not in HOST_VOCABULARY_FIELDS and False:'
-
-register_mutation widen-host-baseline-to-namespaced-entries \
-  '            or any(
-                identifier not in known_host_identifiers
-                and not is_bare_host_identifier(identifier)
-                for identifier in identifiers
-            )' \
-  '            or any(identifier == "<unidentified>" for identifier in identifiers)'
-
-register_mutation drop-host-baseline-version-binding \
-  '        if baseline_version is not None and ev.get("claude_code_version") != baseline_version:
-            # The two invocations no longer prove one same-version host
-            # vocabulary snapshot. Refuse this lane, but treat the mismatch as
-            # capability drift rather than a proven tool/authority breach so a
-            # different reviewer may continue.
-            unknown_fields.add("claude_code_version:host-baseline-mismatch")' \
-  '        if False:
-            unknown_fields.add("claude_code_version:host-baseline-mismatch")'
+# Vocabulary must stay data. Reading a populated skill/command/plugin list as a
+# breach is exactly the outage class policy G removed -- a new host built-in or
+# an installed plugin took the reviewer lane down while proving nothing -- so
+# the oracle must see the class come back.
+register_mutation judge-vocabulary-as-capability \
+  '            elif field in KNOWN_VOCABULARY_INIT_FIELDS:
+                # Vocabulary, not capability: any value, any shape. Whatever a
+                # CLI release or an installed plugin lists here cannot be
+                # invoked past the pinned `tools` set.
+                continue' \
+  '            elif field in KNOWN_VOCABULARY_INIT_FIELDS:
+                if isinstance(value, (list, dict)) and value:
+                    nonempty.add(field)'
 
-# The shape gate. Dropping it lets a structured entry be judged on its `name`
-# alone, which reaches TOLERATED when that name is an allowed built-in -- the
-# most severe class in this file, so it needs its own mutant rather than riding
-# on the bare-identifier one.
-register_mutation drop-whole-value-gate \
-  '                        if field in HOST_VOCABULARY_FIELDS and (
-                            not host_entry_is_whole(entry, identifier)
-                        ):' \
-  '                        if False:'
-
-# ...and the weaker version of the same gate: checking only the SHAPE (a plain
-# string) while still judging a truncated token. This is what the gate looked
-# like before the third finding, so it must be detectable on its own.
-register_mutation weaken-whole-value-gate-to-shape-only \
-  '    normalized = entry.lower()
-    if normalized.startswith("/"):
-        normalized = normalized[1:]
-    return normalized == identifier' \
-  '    return True'
-
-# The regression a round-9 review found in the gate itself: stripping before the
-# comparison re-introduces the lossiness the gate exists to reject, and wrapping
-# an ALLOWLISTED name in whitespace then reaches TOLERATED.
-register_mutation strip-before-the-whole-value-comparison \
-  '    normalized = entry.lower()' \
-  '    normalized = entry.strip().lower()'
-
-register_mutation drop-host-vocabulary-breach-guard \
-  '        if unclassifiable_vocabulary and not surface_breached:' \
-  '        if unclassifiable_vocabulary:'
-
-# The two parse paths implement the class separately, so each needs its own
-# mutant: dropping it from the main-invocation predicate leaves the probe path
-# correct, which is exactly the shape of divergence this oracle exists to catch.
-register_mutation drop-host-vocabulary-from-main-path \
-  'runtime_drift_only = bool(unknown or unverifiable or vocabulary) and not (' \
-  'runtime_drift_only = bool(unknown or unverifiable) and not ('
+# ...and the softer misreading: vocabulary as schema drift. Same outage, one
+# client switch cheaper, still wrong.
+register_mutation drift-on-vocabulary \
+  '            elif field in KNOWN_VOCABULARY_INIT_FIELDS:
+                # Vocabulary, not capability: any value, any shape. Whatever a
+                # CLI release or an installed plugin lists here cannot be
+                # invoked past the pinned `tools` set.
+                continue' \
+  '            elif field in KNOWN_VOCABULARY_INIT_FIELDS:
+                if isinstance(value, (list, dict)) and value:
+                    unknown_fields.add(field)'
 
 # Dispatch the registered walk with bounded concurrency. The mutants are
 # independent by construction: each writes its own `mutant_<name>.py` copy under

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_parse_probe_result.sh

@@ -111,37 +111,9 @@ run_ok_runtime_surface() {
     --require-empty-init --expected-tools "$expected_tools" --allow-expected-tool-use --runtime-surface-only >/dev/null
 }
 
-run_ok_expected_native_skills() {
-  local expected_native_skills="$1" required_native_skills="$2" rc="$3" stdout="$4"
-  local stderr="${5:-}"
-  printf '%s' "$stdout" > "$tmp_dir/stdout"
-  printf '%s' "$stderr" > "$tmp_dir/stderr"
-  python3 "$parser" "$rc" "$tmp_dir/stdout" "$tmp_dir/stderr" \
-    --require-empty-init \
-    --expected-native-skills "$expected_native_skills" \
-    --required-native-skills "$required_native_skills" >/dev/null
-}
-
-run_reason_expected_native_skills() {
-  local expected_native_skills="$1" required_native_skills="$2" rc="$3" stdout="$4"
-  local expected="$5" stderr="${6:-}" out
-  printf '%s' "$stdout" > "$tmp_dir/stdout"
-  printf '%s' "$stderr" > "$tmp_dir/stderr"
-  if out="$(python3 "$parser" "$rc" "$tmp_dir/stdout" "$tmp_dir/stderr" \
-    --require-empty-init \
-    --expected-native-skills "$expected_native_skills" \
-    --required-native-skills "$required_native_skills")"; then
-    printf 'expected native-skill probe parser failure\n' >&2
-    return 1
-  fi
-  printf '%s' "$out" | grep -F "$expected" >/dev/null
-}
-
-# Runtime-surface variants used to pin the main-invocation drift guard. The
-# first omits --allow-expected-tool-use (the wrapper always passes it, so this
-# is the guard's defence-in-depth leg); the second exercises the owner-aware
-# path, where a permitted-looking customization list can still carry an
-# unexpected identifier.
+# Runtime-surface variant used to pin the main-invocation drift guard: it
+# omits --allow-expected-tool-use (the wrapper always passes it, so this is the
+# guard's defence-in-depth leg).
 run_reason_runtime_surface_no_tool_use_allowance() {
   local expected_tools="$1" rc="$2" stdout="$3" expected="$4" stderr="${5:-}" out
   printf '%s' "$stdout" > "$tmp_dir/stdout"
@@ -158,24 +130,6 @@ run_reason_runtime_surface_no_tool_use_allowance() {
   printf '%s' "$out" | grep -F "$expected" >/dev/null
 }
 
-run_reason_runtime_surface_native() {
-  local expected_native_skills="$1" rc="$2" stdout="$3" expected="$4" stderr="${5:-}" out
-  printf '%s' "$stdout" > "$tmp_dir/stdout"
-  printf '%s' "$stderr" > "$tmp_dir/stderr"
-  if out="$(python3 "$parser" "$rc" "$tmp_dir/stdout" "$tmp_dir/stderr" \
-    --require-empty-init --expected-tools "" --allow-expected-tool-use --runtime-surface-only \
-    --expected-native-skills "$expected_native_skills" \
-    --required-native-skills "$expected_native_skills")"; then
-    printf 'expected owner-aware runtime-surface parser failure\n' >&2
-    return 1
-  fi
-  if printf '%s' "$out" | grep -F 'unrecognized surface-shaped init field' >/dev/null; then
-    printf 'drift reason must not launder an unexpected identifier: %s\n' "$out" >&2
-    return 1
-  fi
-  printf '%s' "$out" | grep -F "$expected" >/dev/null
-}
-
 run_reason_runtime_surface_implicit_strict() {
   local stdout="$1" expected="$2" out
   printf '%s' "$stdout" > "$tmp_dir/stdout"
@@ -292,34 +246,25 @@ run_ok_strict 0 "$empty_init"$'\n{"type":"result","subtype":"success","is_error"
 read_init='{"type":"system","subtype":"init","permissionMode":"default","tools":["Read","Grep","Glob"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[]}'
 run_ok_expected_tools 'Read,Grep,Glob' 0 "$read_init"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
 run_ok_expected_tool_use 'Read,Grep,Glob' 0 "$read_init"$'\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Read","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
-# Claude Code 2.1.218 exposes these exact host built-ins whenever an explicit
-# plugin enables the command registry. They are not plugin-owned commands or
-# model tools, so a selected native skill remains valid.
-run_ok_expected_native_skills 'testing-strategy' 'testing-strategy' 0 \
-  $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview"],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
-# The same owner-aware path remains value-exact: an arbitrary command cannot
-# hide beside the two registered host built-ins.
-run_reason_expected_native_skills 'testing-strategy' 'testing-strategy' 0 \
-  $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview","unrelated:danger"],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' \
-  'runtime capability surface is not empty'
-# A dict-shaped entry is never whole, however allowed its `name` reads. The
-# entry hides a sibling key the identifier helper discards, so clearing it on
-# the truncated name would accept a customization whose proof was in the part
-# that was thrown away. host_entry_is_whole must reject the shape BEFORE the
-# allowlist reads it; flipping its non-string branch to True makes this case
-# pass, which is exactly the regression this asserts.
-run_reason_expected_native_skills 'testing-strategy' 'testing-strategy' 0 \
-  $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec",{"name":"ultrareview","path":"hidden-sibling-value"}],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' \
-  'runtime capability surface is not empty'
-
-# A matching name in either executable surface is still terminal. Built-in UI
-# registration never authorizes a tool declaration or invocation.
-run_reason_expected_native_skills 'testing-strategy' 'testing-strategy' 0 \
+# Claude Code 2.1.261 lists its own built-in commands and skills, plus every
+# installed plugin entry, whenever an explicit plugin enables the command
+# registry. They are vocabulary, not model tools: any entry is tolerated on
+# both parse paths, including names the host adds tomorrow, namespaced or
+# structured entries, and the selected owner's own namespaced command.
+vocab_init='{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview","workflow-authoring","unrelated:danger",{"name":"ultrareview","path":"hidden-sibling-value"}],"terminal_slash_commands":["doctor"],"skills":["testing-strategy","workflow-authoring","brand-new-skill"],"plugins":["ccl-skills",{"name":"other","path":"/p"}]}'
+run_ok_strict 0 "$vocab_init"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+run_ok_runtime_surface '' 0 "$vocab_init"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+# A matching name in either executable surface is still terminal. Vocabulary
+# never authorizes a tool declaration, a tool invocation, or an MCP server.
+run_reason_strict 0 \
   $'{"type":"system","subtype":"init","permissionMode":"default","tools":["workflow-launch-exec"],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview"],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' \
   'runtime capability surface is not empty'
-run_reason_expected_native_skills 'testing-strategy' 'testing-strategy' 0 \
+run_reason_strict 0 \
   $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview"],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"workflow-launch-exec","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' \
   'runtime capability surface is not empty'
+run_reason_strict 0 \
+  $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":["inherited"],"slash_commands":["ccl-skills:testing-strategy","workflow-launch-exec","ultrareview"],"skills":["testing-strategy"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' \
+  'runtime capability surface is not empty'
 run_reason_expected_tools_implicit_strict 'Read,Grep,Glob' 0 'ok' \
   'missing the required stream-json init evidence'
 run_reason_runtime_surface '' 0 "$empty_init"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'auth-path false negative' 'Not logged in · Please run /login'
@@ -422,42 +367,31 @@ run_reason_strict 0 $'{"type":"system","subtype":"init","permissionMode":"defaul
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":["Bash"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"capabilities":["interrupt_cancel_queued_v1"],"fast_mode_disabled_reason":"sdk_opt_in_required"}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'the no-tool sandbox is not enforced'
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":["Write"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"capabilities":["interrupt_cancel_queued_v1"],"fast_mode_disabled_reason":"sdk_opt_in_required"}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"fast_mode_disabled_reason":"sdk_opt_in_required"}\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Write","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
-# Drift + a real breach in the same init must report as the BREACH. Review round
-# 4 suspected `unexpected_customization_identifiers` was missing from the
-# main-path `runtime_drift_only` guard; it stays out because every identifier it
-# reports lands in a set that IS in the guard, and these fixtures pin that so the
-# soft drift reason can never launder a combined case. Note which set: an
-# identifier that is provably a customization marks its field non-empty, while a
-# bare host-vocabulary name lands in the unclassifiable set instead — so the
-# fixtures below use a NAMESPACED foreign identifier, which is the one that is
-# still a proven breach.
-run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["some-skill"],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'runtime isolation surface is invalid'
-run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["some-skill"],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'unexpected_customizations=skills'
-# ...and the main-path guard must match the probe path's breach set exactly.
-# A tool_use with no allowance, and an unexpected identifier under an owner-aware
-# run, are the two legs where the two guards could silently diverge again.
+# Drift + a real breach in the same init must report as the BREACH, and these
+# fixtures pin that so the soft drift reason can never launder a combined case.
+# The breach here is an inherited MCP server -- the one customization list that
+# is still a capability surface.
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":["some-server"],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'runtime isolation surface is invalid'
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":["some-server"],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'unexpected_customizations=mcp_servers'
+# ...and the main-path guard must match the probe path's breach set exactly:
+# a tool_use with no allowance is the leg where the two guards could silently
+# diverge again.
 run_reason_runtime_surface_no_tool_use_allowance 'Write' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":["Write"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Write","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'runtime isolation surface is invalid'
-run_reason_runtime_surface_native 'testing-strategy' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy"],"skills":["testing-strategy","other-plugin:unrelated-skill"],"plugins":["ccl-skills"],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'unexpected_customization_identifiers=skills:other-plugin:unrelated-skill'
-# The same fixture with a BARE unknown skill is deliberately the other verdict:
-# it reports the soft class, because a bare name outside the built-in snapshot is
-# not proof of a customization. Pinned explicitly so the split above is asserted
-# rather than merely allowed by the fixture's choice of identifier. `future_surface`
-# is dropped here on purpose — with schema drift also present the reason is the
-# broader drift phrase, which this helper forbids by design; that combined case is
-# pinned in the policy matrix instead.
-run_reason_runtime_surface_native 'testing-strategy' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy"],"skills":["testing-strategy","unrelated-skill"],"plugins":["ccl-skills"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'unclassifiable_host_vocabulary=skills:unrelated-skill'
+# Vocabulary beside schema drift is still only drift: the populated lists add
+# nothing to the verdict, so the reason stays the fallback-eligible drift phrase.
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["ccl-skills:testing-strategy","brand-new-builtin"],"skills":["testing-strategy","other-plugin:unrelated-skill"],"plugins":["ccl-skills"],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}' 'unrecognized surface-shaped init field'
 # Same rule on the probe path: drift alongside a declared surface, an unexpected
 # tool, or a tool_use must report the BREACH. The drift phrase routes to
 # fallback, so reaching it first would launder a real breach.
-combo_drift_breach=$'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["some-skill"],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+combo_drift_breach=$'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":["some-server"],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
 run_reason 0 "$combo_drift_breach" 'runtime capability surface is not empty'
 run_reason_excludes 0 "$combo_drift_breach" 'unrecognized surface-shaped init field'
 combo_drift_tool=$'{"type":"system","subtype":"init","permissionMode":"default","tools":["Write"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
 run_reason_excludes 0 "$combo_drift_tool" 'unrecognized surface-shaped init field'
 combo_drift_use=$'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[],"future_surface":["x"]}\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Write","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
 run_reason_excludes 0 "$combo_drift_use" 'unrecognized surface-shaped init field'
-# A declared CCL skill/plugin surface is still rejected under drift tolerance.
-run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["some-skill"],"plugins":[],"fast_mode_disabled_reason":"sdk_opt_in_required"}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
+# An inherited MCP server is still rejected under drift tolerance.
+run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":["some-server"],"slash_commands":[],"skills":[],"plugins":[],"fast_mode_disabled_reason":"sdk_opt_in_required"}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
 # THE flakiness fix: model hallucinates TOOL_ENABLED but every runtime surface is empty -> pass.
 run_ok 0 "$empty_init"$'\n{"type":"result","subtype":"success","is_error":false,"num_turns":1,"permission_denials":[],"result":"TOOL_ENABLED"}'
 # clean ok via stream -> pass.
@@ -470,9 +404,10 @@ run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","too
 # declared set; unknown/non-string elements make init ground truth invalid.
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[{"name":"Bash"}],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'missing required isolation fields'
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[{"name":"x"}],"slash_commands":[],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
-run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["review"],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
-run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["review"],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
-run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":["x"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
+# Skill, command and plugin lists are vocabulary: populated is not a breach.
+run_ok 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["review"],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+run_ok 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":["review"],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+run_ok 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":["x"]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
 # closes the latent false-negative: Bash DECLARED in init.tools, reply says ok -> fail.
 run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":["Bash","Read"],"mcp_servers":[],"slash_commands":[],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'Bash tool is available'
 # Bash actually INVOKED via tool_use block -> fail (sandbox not enforced).
@@ -509,76 +444,25 @@ run_reason 0 "$empty_init"$'\n{"type":"system","subtype":"init","permissionMode"
 # pretty-printed single envelope (bare-brace lines) must still pass via the text fallback.
 run_ok 0 $'{\n  "type": "result",\n  "subtype": "success",\n  "is_error": false,\n  "result": "ok"\n}'
 
-# --- host vocabulary is unverifiable, not a proven breach -------------------
-# The review-skill invocation is the only shape whose customization lists are
-# populated by the host's own built-ins, so a name this repo's snapshot does not
-# know cannot be shown to be a user customization. It must refuse WITHOUT
-# terminating the lane; anything that IS provably a customization must not
-# inherit that softer class. `product-rd-workflow` is used as the selected skill
-# because a name that is also a built-in skill trips the ambiguous-owner guard
-# and would mask the verdict under test.
-native_vocab_result=$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
-native_vocab_init() {
-  printf '{"type":"system","subtype":"init","permissionMode":"default","tools":%s,"mcp_servers":[],"slash_commands":%s,"skills":%s,"plugins":[{"name":"ccl-skills"}]}' \
-    "${1:-[]}" "${2:-[\"init\",\"agents\"]}" "${3:-[\"ccl-skills:product-rd-workflow\",\"dataviz\"]}"
-}
-run_reason_native_excludes() {
-  local stdout="$1" forbidden="$2" expected="$3" out
-  printf '%s' "$stdout" > "$tmp_dir/stdout"
-  : > "$tmp_dir/stderr"
-  if out="$(python3 "$parser" 0 "$tmp_dir/stdout" "$tmp_dir/stderr" \
-    --require-empty-init \
-    --expected-native-skills product-rd-workflow \
-    --required-native-skills product-rd-workflow)"; then
-    printf 'expected native-skill parser failure for stdout: %s\n' "$stdout" >&2
-    return 1
-  fi
-  if printf '%s' "$out" | grep -F "$forbidden" >/dev/null; then
-    printf 'a proven customization must not report as %q: %s\n' "$forbidden" "$out" >&2
-    return 1
-  fi
-  printf '%s' "$out" | grep -F "$expected" >/dev/null
-}
-# the base itself is accepted, or none of the rows below prove anything
-run_ok_expected_native_skills product-rd-workflow product-rd-workflow 0 \
-  "$(native_vocab_init)$native_vocab_result"
-# a built-in the snapshot has not caught up with, in either host-vocabulary field
-run_reason_expected_native_skills product-rd-workflow product-rd-workflow 0 \
-  "$(native_vocab_init '[]' '["init","agents","brand-new-builtin"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary entry'
-run_reason_expected_native_skills product-rd-workflow product-rd-workflow 0 \
-  "$(native_vocab_init '[]' '["init"]' '["ccl-skills:product-rd-workflow","brand-new-skill"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary entry'
-# ...and the identifier is named, so the follow-up is a one-liner
-run_reason_expected_native_skills product-rd-workflow product-rd-workflow 0 \
-  "$(native_vocab_init '[]' '["init","brand-new-builtin"]')$native_vocab_result" \
-  'slash_commands:brand-new-builtin'
-# A NAMESPACED entry proves a surface beyond the one expected plugin; a
-# path-shaped or unparseable identifier proves nothing about host origin; a
-# duplicate is a spoofing signal. All four stay terminal.
-run_reason_native_excludes \
-  "$(native_vocab_init '[]' '["init","evil-plugin:pwn"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary' 'runtime capability surface is not empty'
-run_reason_native_excludes \
-  "$(native_vocab_init '[]' '["init","dir/cmd"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary' 'runtime capability surface is not empty'
-run_reason_native_excludes \
-  "$(native_vocab_init '[]' '["init","ev!l"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary' 'runtime capability surface is not empty'
-run_reason_native_excludes \
-  "$(native_vocab_init '[]' '["init","init"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary' 'runtime capability surface is not empty'
-# The softer class must never absorb a real breach that happens alongside it.
-run_reason_native_excludes \
-  "$(native_vocab_init '["Write"]' '["init","brand-new-builtin"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary' 'runtime capability surface is not empty'
-# Same policy on the main-invocation path, with the identifier in the detail
-# fields so an operator can see which name drifted.
-run_reason_runtime_surface_native product-rd-workflow 0 \
-  "$(native_vocab_init '[]' '["init","brand-new-builtin"]')$native_vocab_result" \
-  'unclassifiable host-vocabulary entry'
-run_reason_runtime_surface_native product-rd-workflow 0 \
-  "$(native_vocab_init '[]' '["init","brand-new-builtin"]')$native_vocab_result" \
-  'unclassifiable_host_vocabulary=slash_commands:brand-new-builtin'
+# --- vocabulary is data, not a verdict --------------------------------------
+# Any value in slash_commands / terminal_slash_commands / skills / plugins is
+# tolerated on both parse paths; only tools, tool_use, the MCP list and
+# permissionMode decide. Pinned so the class can never be tightened back into a
+# snapshot of the host's own names: that snapshot made every CLI release that
+# shipped a new built-in a reviewer-lane outage while proving nothing.
+vocab_any='{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["init","brand-new-builtin","evil-plugin:pwn","dir/cmd","ev!l","init"," import","brand-new runtime isolation"],"terminal_slash_commands":[{"name":"init"},"not-declared"],"skills":["brand-new-skill",{"name":"verify","command":"/x/y"},"evil-plugin:pwn"],"plugins":[{"name":"ccl-skills"},{"name":"other","path":"/p"},"x"]}'
+run_ok_strict 0 "$vocab_any"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+run_ok_runtime_surface '' 0 "$vocab_any"$'\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+# absent or oddly typed vocabulary fields are not "missing isolation fields"
+run_ok_strict 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+run_ok_strict 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":{"a":1},"skills":"none","plugins":null,"terminal_slash_commands":"doctor"}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}'
+# ...while the MCP list, the one customization list that is capability, must
+# still be present and empty.
+run_reason_strict 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"slash_commands":[],"skills":[],"plugins":[]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'missing required isolation fields'
+# ...and every breach class keeps its strength beside vocabulary.
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":["Write"],"mcp_servers":[],"slash_commands":["init","brand-new-builtin"],"skills":["brand-new-skill"],"plugins":[{"name":"ccl-skills"}]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime isolation surface is invalid'
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"bypassPermissions","tools":[],"mcp_servers":[],"slash_commands":["init","brand-new-builtin"],"skills":["brand-new-skill"],"plugins":[{"name":"ccl-skills"}]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'unsafe_values=permissionMode'
+run_reason_runtime_surface '' 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[{"name":"x"}],"slash_commands":["init","brand-new-builtin"],"skills":["brand-new-skill"],"plugins":[{"name":"ccl-skills"}]}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'unexpected_customizations=mcp_servers'
+run_reason 0 $'{"type":"system","subtype":"init","permissionMode":"default","tools":[],"mcp_servers":[],"slash_commands":["init","brand-new-builtin"],"skills":["brand-new-skill"],"plugins":[{"name":"ccl-skills"}]}\n{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Write","input":{}}]}}\n{"type":"result","subtype":"success","is_error":false,"result":"ok"}' 'runtime capability surface is not empty'
 
 printf 'parse_probe_result_tests_ok\n'

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_gate.sh

@@ -1233,6 +1233,71 @@ out="$(run_gate --review-plan-file "$WORK/owner-review-plan.json" --allow-fallba
 check "owner-aware success without a wrapper binding receipt fails closed" \
   '[ "$rc" = 2 ] && json_fields "$out" reason_code=binding_mismatch next_action=stop_reviewer_lane && [ "$(printf "%s" "$out" | python3 -c "import json,sys; print(len(json.load(sys.stdin).get(\"reviewed_skills\", [])))")" = 0 ]'
 
+# Owner count is independent of concern count: a cross-skill candidate can have
+# more owners than the eight known concerns without changing the review scope.
+python3 - "$WORK" <<'PY'
+import copy
+import json
+from pathlib import Path
+import sys
+
+work = Path(sys.argv[1])
+owners = (
+    "requirement-scope", "product-rd-workflow", "platform-service-connectivity",
+    "platform-observability", "skill-extraction-workflow", "python-service-dev",
+    "web-react-dev", "testing-strategy", "terminal-cli-dev",
+)
+plan = json.loads((work / "review-plan.json").read_text())
+patches = []
+for owner in owners:
+    root = work / owner
+    root.mkdir(exist_ok=True)
+    entrypoint = root / "SKILL.md"
+    if not entrypoint.exists():
+        entrypoint.write_text(f"# Synthetic {owner} owner\n")
+    plan["self_review"].append({
+        "concern": "correctness", "skill": owner,
+        "conclusion": f"The {owner} boundary preserves its stated acceptance behavior.",
+        "evidence_refs": ["e1"],
+    })
+    path = f"skills/{owner}/SKILL.md"
+    patches.append(f"diff --git a/{path} b/{path}\n--- a/{path}\n+++ b/{path}\n@@ -1 +1 @@\n-old\n+new\n")
+(work / "many-owner-diff.patch").write_text("".join(patches))
+plans = {"many-owner": plan}
+missing_owner = copy.deepcopy(plan)
+missing_owner["self_review"].pop()
+plans["many-owner-missing-owner"] = missing_owner
+missing_concern = copy.deepcopy(plan)
+missing_concern["self_review"] = [row for row in missing_concern["self_review"] if row["concern"] != "safety"]
+plans["many-owner-missing-concern"] = missing_concern
+duplicate = copy.deepcopy(plan)
+duplicate["self_review"].append(copy.deepcopy(duplicate["self_review"][-1]))
+plans["many-owner-duplicate"] = duplicate
+default_duplicate = copy.deepcopy(plan)
+default_duplicate["self_review"].append({**default_duplicate["self_review"][0], "skill": "code-review"})
+plans["many-owner-default-duplicate"] = default_duplicate
+for name, value in plans.items():
+    (work / f"{name}-plan.json").write_text(json.dumps(value))
+PY
+
+reset_case passed unavailable unavailable
+out="$(run_gate --diff-file "$WORK/many-owner-diff.patch" --review-plan-file "$WORK/many-owner-plan.json")"; rc=$?
+check "nine derived owners can assess shared concerns in one explicit plan" \
+  '[ "$rc" = 0 ] && json_fields "$out" status=passed review_plan_source=implementer-supplied owner_selection_source=controller-derived+implementer-declared && [ "$(printf %s "$out" | python3 -c "import json,sys; p=json.load(sys.stdin); print(len(p[\"selected_skills\"]), len(p[\"reviewed_skills\"]))")" = "10 9" ]'
+printf '%s\n' "$out" >"$WORK/many-owner-review.json"
+
+reset_case passed unavailable unavailable
+out="$(run_completion_gate --diff-file "$WORK/many-owner-diff.patch" --review-plan-file "$WORK/many-owner-plan.json" --completion-review-result-file "$WORK/many-owner-review.json")"; rc=$?
+check "nine-owner explicit self-review closes the exact-candidate completion checkpoint" \
+  '[ "$rc" = 0 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" mode=complete status=passed completion_gated=false next_action=complete'
+
+for invalid_plan in missing-owner missing-concern duplicate default-duplicate; do
+  reset_case passed unavailable unavailable
+  out="$(run_gate --diff-file "$WORK/many-owner-diff.patch" --review-plan-file "$WORK/many-owner-$invalid_plan-plan.json")"; rc=$?
+  check "shared-concern owner plans reject $invalid_plan before provider execution" \
+    '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=self_review_incomplete next_action=deep_self_review'
+done
+
 printf 'diff --git a/skills/testing-strategy/SKILL.md b/skills/testing-strategy/SKILL.md\n--- a/skills/testing-strategy/SKILL.md\n+++ b/skills/testing-strategy/SKILL.md\n@@ -1 +1 @@\n-old\n+new\n' >"$WORK/diff.patch"
 reset_case passed unavailable unavailable
 out="$(run_gate --allow-fallback-egress)"; rc=$?

package/dist/assets/marketplace/plugins/ccl-skills/skills/defect-diagnosis/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: defect-diagnosis
-description: bug / 报错 / test 挂了 / 线上问题 / 复现 / 找根因 / debug → diagnose first-hand failure evidence, isolate cause, verify before fixing, add regression proof, and route prevention. Also use for AI-proposed causes or fixes.
+description: bug / 报错 / test 挂了 / 线上问题 / 接口变慢·性能退化 / 复现 / 找根因 / debug → diagnose first-hand failure evidence, isolate cause, verify before fixing, add regression proof, and route prevention. Also use for AI-proposed causes or fixes.
 ---
 
 # Defect Diagnosis

package/dist/assets/marketplace/plugins/ccl-skills/skills/grill-me/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: grill-me
-description: grill-me / 访谈 / 拷问 / 压力测试方案 / stress-test a plan — lightweight one-question-at-a-time interview to challenge a plan, design, API shape, data model, or feature direction before implementation. Skip code-level YAGNI/delete/adversarial review of written code → `product-rd-workflow`'s independent-review gate; full delivery/spec/plan authoring → product-rd-workflow; tests → testing-strategy; implementation → stack/dev skill; process lesson extraction → skill-extraction-workflow.
+description: grill-me / 访谈 / 一问一答拷问（一次问一个）/ 压力测试方案 / stress-test a plan — lightweight one-question-at-a-time interview to challenge a plan, design, API shape, data model, or feature direction before implementation. Skip 拷问用的问题池·推荐默认值等材料，以及拷问后的结论整理（不是逐问过程）→ requirement-intent；code-level YAGNI/delete/adversarial review of written code → `product-rd-workflow`'s independent-review gate; full delivery/spec/plan authoring → product-rd-workflow; tests → testing-strategy; implementation → stack/dev skill; process lesson extraction → skill-extraction-workflow.
 ---
 
 # grill-me — 轻量方案拷问

package/dist/assets/marketplace/plugins/ccl-skills/skills/miniapp-product-dev/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: miniapp-product-dev
-description: "小程序 / Taro / 微信小程序 / 支付宝小程序 / 抖音小程序 / 小程序上线审核 → implement, debug, test, and ship mini-program client features: pages, state, API integration, auth, sharing, platform capabilities, review, and device verification. Triggers also include \"重构这个小程序页面/组件(局部)\", \"refactor a mini-program page/component\"."
+description: "小程序 / Taro / 微信小程序 / 支付宝小程序 / 抖音小程序 / 小程序上线审核 / 微信开发者工具编译·构建·真机调试 → implement, debug, test, and ship mini-program client features: pages, state, API integration, auth, sharing, platform capabilities, review, and device verification. Triggers also include \"重构这个小程序页面/组件(局部)\", \"refactor a mini-program page/component\"."
 ---
 
 # Miniapp Product Dev