@ccoalm/ccl-skills 0.15.0 → 0.15.1

package/dist/assets/marketplace/plugins/ccl-skills/skills/platform-service-connectivity/references/grpc-authority-workaround.md

@@ -1,90 +1,47 @@
-# gRPC `:authority` and DNS-Label Hyphenation
-
-## The quirk
-
-HTTP/2's `:authority` pseudo-header (which carries the host of a gRPC request) is parsed strictly. RFC 1035 says DNS labels can contain letters, digits, and hyphens — but NOT underscores.
-
-Many platforms use PSM-style service names like `<owner>.<class>.<env>`. When any segment contains underscores (e.g. an env segment named `prod_v2` or a feature-flagged variant `payments.ledger.prod_2024`), the SDK puts that name into `:authority`. Envoy / strict gRPC implementations reject the request:
-
-```
-RST_STREAM with INTERNAL_ERROR
-```
-
-You lose the connection on every call. Frustrating to debug because it looks like network failure.
-
-## Two fixes
-
-### Fix 1 (clean, long-term): forbid underscores in service names
-
-- Naming policy: service name = lowercase, dot-separated segments, hyphens within segments allowed, underscores forbidden.
-- Enforce at registry registration (reject the registration).
-- Enforce at CI / lint when defining new services.
-- Migrate existing names by renaming + parallel registration during a deprecation window.
-
-### Fix 2 (live-system workaround): mesh-level rewrite
-
-When you can't break existing names, an Envoy Lua filter rewrites `:authority` on the fly:
-
-```yaml
-apiVersion: networking.istio.io/v1alpha3
-kind: EnvoyFilter
-metadata:
-  name: modify-grpc-authority
-  namespace: istio-system
-spec:
-  configPatches:
-    - applyTo: HTTP_FILTER
-      match:
-        context: ANY
-        listener:
-          filterChain:
-            filter:
-              name: "envoy.filters.network.http_connection_manager"
-      patch:
-        operation: INSERT_BEFORE
-        value:
-          name: envoy.filters.http.lua
-          typed_config:
-            "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
-            inlineCode: |
-              function envoy_on_request(request_handle)
-                local authority = request_handle:headers():get(":authority")
-                local content_type = request_handle:headers():get("content-type")
-                if authority and content_type and string.find(content_type, "application/grpc") then
-                  local modified_authority = string.gsub(authority, "_", "-")
-                  request_handle:headers():replace(":authority", modified_authority)
-                end
-              end
-```
-
-Effects:
-- Applies to gRPC traffic only (content-type check).
-- Rewrites `_` to `-` in `:authority`.
-- Callee's registry instance name must also use the `-` form so routing matches.
-
-## When to use which
-
-| Situation | Fix |
+# gRPC Authority Compatibility
+
+## Separate the names and constraints
+
+HTTP/2 `:authority` conveys the target URI's authority, as defined by [RFC 9113 §8.3.1](https://www.rfc-editor.org/rfc/rfc9113.html#section-8.3.1). [RFC 3986 §3.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2) permits a registered name containing unreserved characters, including `_`. This syntax does not guarantee DNS resolution, certificate identity matching, or acceptance by every SDK and proxy version.
+
+Keep these values distinct when diagnosing a request:
+
+- Service-registry identifier and resolved network endpoint.
+- HTTP/2 authority used for virtual-host routing.
+- TLS server name and the certificate identity expected on each TLS hop.
+- Platform naming, routing, and authorization policies.
+
+A platform can require DNS-compatible service names and enforce that choice at registration and CI. Existing identifiers do not require migration merely because they contain an underscore; first establish which constraint the actual path violates.
+
+## Locate the rejection before choosing a fix
+
+Record the runtime/SDK, proxy versions and relevant configuration, exact authority, and the failing run's error or trace. Use a synthetic payload and redact credentials from captured evidence.
+
+| Observed boundary | Next action |
 |---|---|
-| Greenfield platform | Fix 1 — naming policy from day one |
-| Mature platform, many existing names | Fix 2 — buy time, then schedule Fix 1 migration |
-| Mixed HTTP + gRPC for same service | Fix 2 — HTTP tolerates `_`, gRPC doesn't; rewrite only at gRPC layer |
-| Service-mesh-less (direct gRPC) | Fix 1 only — no Envoy to rewrite |
+| Authority syntax is malformed | Validate URI authority syntax, including brackets around an IPv6 literal, before changing service registration or routing. |
+| Client rejects before transmitting HTTP/2 headers | Check that client's authority validation and supported configuration. Fix the client-side mapping or naming contract; a downstream proxy cannot rewrite a request it never receives. |
+| DNS resolution fails | Check the resolved hostname and resolver's naming rules. Changing a later HTTP header does not repair failed resolution. |
+| TLS handshake or certificate identity check fails | Check that hop's endpoint, server name, trust chain, and certificate identities. Retain verification; changing authority is not evidence that TLS is fixed. |
+| Proxy/parser rejects before the HTTP filter runs | Fix the supported parser/input contract or an earlier owned mapping. A Lua filter after the rejection cannot intervene. |
+| Request reaches HTTP filters, then the intended virtual-host route does not match | Compare the received authority with the generated route configuration. A supported authority mapping may be appropriate after proving the mismatch. |
+| Existing path accepts the name and reaches the intended service | Preserve it unless a separate platform naming-policy migration is required. |
 
-## Verification
+`RST_STREAM` or `INTERNAL_ERROR` alone does not identify an underscore problem. Confirm the first rejecting layer rather than treating every transport failure as the same naming defect.
 
-Fix 1:
-- Registry rejects registration with `_` in name.
-- Linter / CI rejects PR adding such a name.
+## Choose a bounded compatibility change
 
-Fix 2:
-- Synthetic gRPC call to `<svc>_<env>` → inspect Envoy access log `:authority` field → expect `<svc>-<env>`.
-- Callee's access log `host` shows the rewritten form.
+**Naming policy or client mapping.** Where a DNS-compatible name is required, define the allowed form and the mapping from registry identity to endpoint/authority. Check uniqueness before migration: replacing `_` with `-` can collapse two distinct names. Migrate registrations, routes, and callers together with a compatibility window and rollback path. Use supported client options; do not bypass certificate or authorization checks to make a name work.
+
+**Proxy mapping.** Use only if the request reaches the chosen filter and the mapping addresses a reproduced failure. Prefer the platform's supported routing mechanism. If an EnvoyFilter is necessary, verify the installed Istio/Envoy API and generated configuration, and scope it to the affected workloads, listener/direction, route, and explicit old-to-new authority mapping. Do not install an all-workload, all-direction underscore replacement. The mapping must preserve the intended destination, tenant/lane routing, authorization, and TLS identity on each hop; rewriting a header does not itself update those contracts.
+
+## Verification
 
-## Common variants of the same bug
+Retain the original failing case and expected rejecting layer. After the change, verify:
 
-- HTTP/2 SETTINGS frame rejection on cert SAN mismatch (separate issue, but presents similarly — RST_STREAM with INTERNAL_ERROR).
-- gRPC `:scheme` set to `http` while upstream expects `https` (mTLS mismatch).
-- IPv6 literal in `:authority` not bracketed.
+1. The same request succeeds through the intended path and reaches the intended service; observe authority before/after any mapping and the selected route.
+2. Unrelated authorities and non-target traffic retain their behavior. Include potentially colliding names and unknown authorities as negative controls.
+3. Certificate identity and authorization failures still reject requests; the compatibility change has not disabled those checks.
+4. Registration/client/route changes can be rolled back together without sending traffic to another service.
 
-The Lua rewrite filter is the right tool for the underscore case; do not generalize it to all of the above. Each bug has its own fix.
+Static configuration validation proves only configuration properties. Claims about a deployed SDK/proxy path require execution evidence from that path.

package/dist/assets/marketplace/plugins/ccl-skills/skills/platform-service-connectivity/references/mesh-architecture.md

@@ -33,7 +33,7 @@ Reference topology and component rules. Istio is the recurring example; rules ge
 
 ## Istio Ambient Mode (GA Nov 2024, v1.24+)
 
-- **Istio Ambient Mode reached General Availability in Istio v1.24 (announced November 2024)** per `istio.io/latest/blog/2024/ambient-reaches-ga/` — `ztunnel` + `waypoint` architecture is the stable sidecar alternative for new production mesh deployments. **Two-layer split**: `ztunnel` (Rust-based DaemonSet, one per node, L4-only — mTLS + simple L4 authz + telemetry) handles every pod's transport-layer mesh participation without per-pod sidecar injection; `waypoint` proxies (Envoy-based, scaled independently from app workloads) handle L7 features when needed (rich authz, traffic routing, resilience). Per Istio's own reported numbers, the architecture can save 90%+ memory/CPU vs the sidecar model in dense-pod-per-node workloads (Istio's claim — re-measure on the team's actual workload before quoting savings). **Architecture choice for new mesh**: (a) **choose ambient** when memory/CPU per pod is the binding constraint, sidecar injection causes restart cycles the team wants to avoid, or a subset of namespaces don't need L7 features at all; (b) **stay on sidecar mode** when the team has deep sidecar-specific tooling (custom `EnvoyFilter`s injected per pod, sidecar-aware debugging recipes, app code that expects `localhost:15001` proxy conventions), or when ambient's narrower L7-feature coverage hits a gap the team relies on. **Mixed-mode in one cluster is officially supported** per the Istio docs: sidecar-mode namespaces and ambient-mode namespaces coexist; migration can be incremental namespace-by-namespace. **CRITICAL migration block: AuthorizationPolicy enforcement loss when flipping a namespace from sidecar to ambient without waypoint** — sidecar mode enforces full L7 `AuthorizationPolicy` rules (HTTP method, path, header, JWT claims) at the per-pod proxy. In ambient mode, ztunnel alone enforces only L4-level policy (workload identity, port); any L7-condition rule (`request.method`, `request.headers[...]`, `request.path`, `request.auth.claims[...]`) silently DOES NOT MATCH on ambient-mode pods until a waypoint proxy is deployed for the namespace/service and the policy is targeted at the waypoint. The failure shape: team flips `istio.io/dataplane-mode=ambient` label, sidecar comes down, ztunnel takes over L4, and every L7 authz policy stops gating traffic — without a visible error, because L4 policy still works. **Pre-flip gate**: inventory every `AuthorizationPolicy` targeting workloads in the namespace, identify the ones using L7 conditions, ensure a waypoint is deployed and the policy `targetRefs` is set to the waypoint (not the workload) BEFORE flipping the namespace label. Validate by re-running the authz integration tests against the ambient-mode namespace before completing the migration. **Observability shift**: ztunnel emits L4 metrics; waypoint emits L7 metrics; existing dashboards keyed on sidecar `istio_requests_total` need a ambient-mode equivalent for the L7-routed traffic — route this update through `platform-observability` rather than redesigning here.
+- **Istio Ambient Mode reached General Availability in Istio v1.24 (announced November 2024)** per `istio.io/latest/blog/2024/ambient-reaches-ga/` — `ztunnel` + `waypoint` architecture is the stable sidecar alternative for new production mesh deployments. **Two-layer split**: `ztunnel` (Rust-based DaemonSet, one per node, L4-only — mTLS + simple L4 authz + telemetry) handles every pod's transport-layer mesh participation without per-pod sidecar injection; `waypoint` proxies (Envoy-based, scaled independently from app workloads) handle L7 features when needed (rich authz, traffic routing, resilience). Per Istio's own reported numbers, the architecture can save 90%+ memory/CPU vs the sidecar model in dense-pod-per-node workloads (Istio's claim — re-measure on the team's actual workload before quoting savings). **Architecture choice for new mesh**: (a) **choose ambient** when memory/CPU per pod is the binding constraint, sidecar injection causes restart cycles the team wants to avoid, or a subset of namespaces don't need L7 features at all; (b) **stay on sidecar mode** when the team has deep sidecar-specific tooling (custom `EnvoyFilter`s injected per pod, sidecar-aware debugging recipes, app code that expects `localhost:15001` proxy conventions), or when ambient's narrower L7-feature coverage hits a gap the team relies on. **Mixed-mode in one cluster is officially supported** per the Istio docs: sidecar-mode namespaces and ambient-mode namespaces coexist; migration can be incremental namespace-by-namespace. **CRITICAL migration block: L7 policy enforcement changes when moving from sidecar to ambient.** Ztunnel enforces only L4 policy. A workload-selector policy containing L7 conditions that is picked up by ztunnel [fails safe as a DENY policy](https://istio.io/latest/docs/ambient/usage/l4-policy/#policies-with-layer-7-conditions), potentially blocking legitimate traffic. L7 enforcement requires a waypoint and `targetRefs` bound to the intended Service or waypoint Gateway; deploying a waypoint alone does not migrate selector-based policies. **Pre-flip gate**: inventory affected authorization policies, prepare the waypoint and correctly scoped bindings, and plan the old-policy/pod-restart transition using the deployed version's [migration guide](https://istio.io/latest/docs/ambient/migrate/migrate-policies/). Preserve mTLS and L4 authorization; do not remove a rejecting policy merely to restore connectivity. Verify allowed, denied, and waypoint-bypass paths before completing migration. If the transition cannot maintain required L7 protection, hold migration or use an approved maintenance window. **Observability shift**: ztunnel emits L4 metrics; waypoint emits L7 metrics; existing dashboards keyed on sidecar `istio_requests_total` need a ambient-mode equivalent for the L7-routed traffic — route this update through `platform-observability` rather than redesigning here.
 
 ## Sidecar injection rules
 
@@ -94,7 +94,7 @@ Egress gateway is OFF by default. Turn ON only when a workload needs controlled
 EnvoyFilter is the escape hatch. Use sparingly; each filter is hard to test and easy to break across Envoy upgrades.
 
 Acceptable uses:
-- Header rewrite for protocol quirks (e.g. gRPC `:authority` hyphenation — see `grpc-authority-workaround.md`).
+- Header mapping for a reproduced compatibility failure, scoped to the affected workloads and explicit names while preserving routing, TLS, and authorization (see `grpc-authority-workaround.md`).
 - Adding a Lua filter for one-off business handling that doesn't yet have a first-class WASM filter.
 - Custom rate-limit before the canonical RLS is rolled out.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/platform-service-connectivity/references/retry-timeout-circuit-breaker.md

@@ -1,48 +1,48 @@
 # Retry, Timeout, Circuit Breaker
 
-Where each policy lives, how they compose, and how to keep them from killing each other.
+Where each policy lives, how timeouts compose, and how to bound retry amplification. Istio field names below apply to Istio HTTP/gRPC paths; other transports keep their platform-owned equivalents.
 
 ## Layered policy
 
-For a single call A → B, four policies can fire:
+For a single call A → B, several independent timers can end the call:
 
-```
-App business deadline             ← ctx.Deadline; "this user can wait at most 800ms"
-   ⊇
-Framework client per-call budget   ← SDK option; "give this call 500ms"
-   ⊇
-Mesh transport timeout (ceiling)   ← DestinationRule; "any call to B caps at 2s"
-   ⊇
-TCP/HTTP2 connect + idle timeouts  ← Envoy defaults; rarely tuned
-```
+| Timer | Owner | Example |
+|---|---|---|
+| Caller deadline | App context | 800ms remaining |
+| Total client-call budget | Framework client | 500ms, including retries and backoff |
+| Mesh request timeout | VirtualService HTTP route `timeout` | 2s platform cap |
+| Per-attempt timeout | VirtualService HTTP route `retries.perTryTimeout`, or the retry-owning SDK | Must fit the remaining call budget |
+| Connection / idle timeout | DestinationRule connection pool / transport | Bounds connection setup or inactivity, not total business work |
 
-Each outer policy must be ≥ the next inner one. Inversions cause "request succeeded internally but caller already returned timeout" — a hard-to-debug class.
+The earliest applicable expiry wins. With the example values measured from call start, the client ends the call at 500ms; the 2s mesh cap can remain a platform backstop. These are not nested durations that must decrease from client to mesh. Propagate cancellation so downstream work stops when the caller's budget expires; a longer transport cap does not extend the caller's deadline.
+
+Istio's [HTTPRoute and HTTPRetry fields](https://istio.io/latest/docs/reference/config/networking/virtual-service/) own request/attempt timeout and request retries. [DestinationRule connection-pool settings](https://istio.io/latest/docs/reference/config/networking/destination-rule/) own connection timeouts and concurrent-retry limits; its traffic policy owns outlier detection.
 
 ## Timeout budget rule
 
 For a chain A → B → C:
 
 ```
-A.ctx.deadline = D
-A's client-to-B budget    ≤ D - margin                   (margin: 50-100ms for serialization)
-B's internal work         ≤ (B-budget - C-budget)
-B's client-to-C budget    ≤ B-budget - margin
+A's remaining duration = A.ctx.deadline - now
+A's client-to-B budget  ≤ remaining duration - margin   (e.g. 50-100ms for serialization)
+B's client-to-C budget  ≤ B's remaining duration - margin
+All sequential work, attempts, and backoff fit within that remaining budget
 ```
 
-A framework helper should compute "remaining ctx deadline" and pass `min(ctx.Deadline, my-budget)` to outbound calls.
+A framework helper computes `min(remaining_duration - margin, configured_call_budget, applicable_platform_cap)`. If no usable duration remains, fail without dispatching another attempt. Pass the resulting deadline downstream and recompute the remainder after work or backoff; do not compare an absolute deadline with a duration or restart the full budget at each hop.
 
 ## Retry placement
 
 | Layer | Retries WHAT | When |
 |---|---|---|
-| Mesh (DestinationRule) | network errors, gRPC `UNAVAILABLE`, certain 5xx | Always-safe-to-retry transports |
+| Mesh (VirtualService HTTP route) | Explicitly selected network errors or response statuses | Declared idempotent calls, or failures proven to precede server receipt |
 | Framework client | idempotent business RPCs | Per-method opt-in |
 | App handler | nothing | App level retry usually wrong |
 | App business logic | high-level workflows | Saga / orchestration patterns, not "I'll retry the call once" |
 
-Double retry = real bad. If mesh retries 2x and framework retries 2x, you get 4x amplification on every flapping backend.
+Retry layers multiply total attempts. If mesh and framework each make at most two total attempts, one logical call can reach the backend four times. Istio `retries.attempts` counts retries after the initial request: a value of 2 permits up to 3 total attempts, subject to time and retry budgets.
 
-**Rule**: when enabling framework-level retry, disable mesh retry for that callee (DestinationRule `retries.attempts: 0`).
+**Rule**: when enabling framework-level retry, set `retries.attempts: 0` on every matching VirtualService HTTP route used by that call and verify the effective generated route configuration. Keep DestinationRule connection limits and outlier detection; they do not replace the route-level retry switch.
 
 Mesh retries back off automatically (Istio/Envoy: jittered exponential backoff with a default 25ms *base* interval — fully jittered, so an actual delay can be shorter than the base; it is not a guaranteed minimum gap); framework-level retry gets no such freebie — it must implement its own jittered backoff that fits inside the caller's remaining deadline.
 
@@ -51,24 +51,24 @@ Mesh retries back off automatically (Istio/Envoy: jittered exponential backoff w
 Per-call retry counts bound retries *per request*; they do not bound a caller's total retry share during a partial outage — at high QPS, "2 retries each" is up to a 3× load multiplier at the exact moment the upstream is sickest. Envoy's cluster circuit breakers cap this per proxy:
 
 - `max_retries` — max **concurrent** retries to the cluster, per priority. Retries beyond it overflow (fail fast, counted in `upstream_rq_retry_overflow`). The raw Envoy default is 3, but the control plane above Envoy may override it: Istio's `connectionPool.http.maxRetries` defaults to **2^32-1 — effectively unlimited** — so in an Istio mesh "leave it unset and rely on the default cap" is a trap. Set the limit explicitly and verify the *generated* Envoy cluster config, not the assumption.
-- `retry_budget` — replaces the fixed cap with a load-proportional one: concurrent retries ≤ `budget_percent` (default 20%) of active + pending requests, with a `min_retry_concurrency` floor so low-traffic clusters can still retry. When set, it overrides `max_retries`. Reachability caveat: Istio's DestinationRule API exposes only `connectionPool.http.maxRetries`, NOT `retry_budget` — on plain Istio, set a finite `maxRetries` first; adopting `retry_budget` there means an EnvoyFilter, acceptable only with the *generated* cluster config verified.
+- `retry_budget` — replaces the fixed cap with a load-proportional one: in the default instantaneous mode, concurrent retries ≤ `budget_percent` (default 20%) of active + pending requests, with a `min_retry_concurrency` floor so low-traffic clusters can still retry. Versions exposing a non-zero `budget_interval` can count requests over that interval instead; verify the configured version and mode. When set, the budget overrides `max_retries`. Reachability caveat: Istio's DestinationRule API exposes only `connectionPool.http.maxRetries`, NOT `retry_budget` — on plain Istio, set a finite `maxRetries` first; adopting `retry_budget` there means an EnvoyFilter, acceptable only with the *generated* cluster config verified.
 - Know exactly what the budget bounds — and what it doesn't. It bounds **Envoy-originated, concurrent** retries, per proxy. It does NOT bound: retry attempt *rate*; **framework-level retries** (each framework attempt arrives at Envoy as a fresh request and bypasses `max_retries`/`retry_budget` entirely — a platform running framework retries needs a framework-side budget or strict per-call caps); or the **fleet aggregate** (circuit breaking is distributed, not coordinated — each sidecar enforces its own budget and floor, so aggregate retry load still scales with caller replica count). A true service-wide load bound requires callee-side protection (admission control / load shedding, owned by the service-architecture skills) on top.
 - When tuning for a flaky dependency, set a retry budget rather than raising per-call retry counts — but pick `budget_percent` AND `min_retry_concurrency` deliberately against the callee's capacity: on a very high-QPS caller, an unexamined 20% of active requests is far looser than `max_retries: 3`, and with many low-traffic sidecars the aggregate floor (≈ replicas × `min_retry_concurrency`) dominates instead. Alert on the overflow counter: a growing overflow stat means callers are shedding retries, which is the budget doing its job; do not "fix" it by raising the cap.
 
 ## Idempotency awareness
 
-Framework client retries MUST consider idempotency:
+Both mesh and framework client retries MUST consider idempotency:
 
 ```
 RPC method declares "idempotent: true" in IDL or annotation
    ↓
-SDK retry middleware reads this; only retries idempotent methods
+The retry-owning layer applies a policy only to methods covered by that declaration
    ↓
 Non-idempotent retry happens only if the network error proves the request didn't reach the server
 (connect refused, TLS handshake failure — yes; "request sent, no response" — no)
 ```
 
-Don't trust HTTP method (POST can be idempotent; GET can have side effects). Trust the declaration.
+Don't trust HTTP method (POST can be idempotent; GET can have side effects). Trust the declaration. A 5xx, gRPC `UNAVAILABLE`, timeout, or missing response alone does not prove that a write was not applied. If the mesh cannot distinguish safe methods, keep its request retries disabled and let the method-aware SDK own the policy.
 
 ## Circuit breaker / outlier detection
 
@@ -78,12 +78,12 @@ Mesh outlier-detection (Envoy):
 trafficPolicy:
   outlierDetection:
     consecutive5xxErrors: 5         # 5 consecutive 5xx → eject this pod
-    interval: 10s                   # check every 10s
+    interval: 10s                   # periodic ejection analysis / recovery sweep
     baseEjectionTime: 30s           # eject for 30s minimum
     maxEjectionPercent: 50          # never eject more than 50% of pool
 ```
 
-This is the right place for circuit breaking. Per-host, automatic, observable via Envoy stats.
+For a meshed path, this provides per-host ejection observable through Envoy stats. [Envoy's ejection algorithm](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier) checks consecutive-error thresholds inline; periodic analyses use `interval`. An ejection also depends on the configured threshold/enforcement and pool limits. Killing a pod once does not prove those conditions fired.
 
 Framework SDK circuit breakers (e.g. hystrix-style) are a fallback for environments without mesh, or for business-logic-driven breaking (e.g. "this dependency's error rate hit 10%, switch to degraded mode").
 
@@ -91,36 +91,40 @@ Don't run mesh outlier-detection AND SDK circuit breaker simultaneously without
 
 ## Cascading cancel
 
-When a caller's ctx is cancelled (deadline, client disconnect, user back-button), the cancel MUST propagate to in-flight downstream calls. Frameworks should support this natively; verify by spawning a long-running downstream call and cancelling the parent — both should terminate.
+When a caller's ctx is cancelled (deadline, client disconnect, user back-button), propagate it to in-flight downstream calls. [gRPC cancellation](https://grpc.io/docs/guides/cancellation/) requires application handlers to cooperate; outgoing-call propagation also depends on the language/runtime. Verify cancellation reaches the handler, stops its work and child calls, and releases resources within the service's documented cancellation bound. A transport cancellation signal alone does not prove application work stopped.
 
 If a service swallows ctx cancel, downstream load amplifies during user disconnects (every abandoned tab continues hammering the DB).
 
 ## Hedging
 
-Hedging = send a second request after a timeout T, return whichever responds first. Useful for latency-sensitive read APIs.
+Hedging sends an additional request while the first is still in flight and returns the first acceptable response. It can reduce tail latency for idempotent reads, at the cost of concurrent upstream work.
 
 Risks:
 - Doubles load if T is too short.
 - Not safe for non-idempotent calls.
-- Mesh-level hedging is preferred (e.g. Envoy `retry_priority` patterns); SDK hedging is workable but harder to tune.
+- Bound concurrent attempts, total deadline and admitted load; cancel losing attempts after choosing a response and propagate caller cancellation.
+- Envoy's [HedgePolicy](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-hedgepolicy) uses `hedge_policy.hedge_on_per_try_timeout` with a finite per-try timeout and a retry policy containing retry conditions and a positive retry limit. `retry_priority` selects upstream priorities; it does not enable hedging.
+- Istio's HTTPRetry API does not expose a hedging field. Use an explicitly supported platform mechanism (such as an EnvoyFilter with generated-route and runtime verification), or a method-aware SDK; do not infer hedging from `perTryTimeout` alone. Keep a single retry/hedge owner.
 
 Default: off. Enable per-method after measuring p99 latency distribution.
 
 ## Common mistakes
 
-- Setting framework client timeout > mesh timeout → client never sees mesh-side errors, retries the same call, mesh times out anyway. Align them.
-- Retrying on 4xx → client errors don't fix themselves; you just amplify load.
+- Treating a shorter mesh timeout as invisible to the client → the client can receive a mesh timeout response before its own deadline. Verify error mapping and the retry-owning layer; do not turn that response into an unsafe replay.
+- Retrying every 4xx → permanent client errors do not fix themselves. Only a documented transient condition, such as a rate-limit response with a bounded retry delay, may be eligible under the idempotency and remaining-budget rules.
 - Retrying with exponential backoff while caller deadline is 200ms → backoff exceeds deadline, retry never fires, you wasted code.
-- Mesh retry + SDK retry both on, both default 3 → 9 actual attempts per logical call.
+- Mesh and SDK each allow 3 retries after the initial request → up to 16 backend attempts per logical call, before deadline/budget limits.
 - Circuit breaker tripped but no metric → debugging blind.
 
 ## Tuning starting points
 
-| Policy | Default |
+These are example starting points for eligible traffic, not vendor defaults or a mandate to enable retries. Apply the idempotency and single-owner rules first.
+
+| Policy | Starting point |
 |---|---|
 | Mesh request timeout | 5s (HTTP), 10s (RPC); per-callee override |
-| Mesh retry attempts | 2 |
-| Mesh retry per-try timeout | 1s |
+| Mesh retry attempts | 0 unless mesh owns safe retries; then up to 2 retries within the call budget |
+| Mesh retry per-try timeout | Fit within the remaining call budget; reserve time for backoff and any later attempt |
 | Mesh outlier detection | 5 consecutive 5xx, 30s eject |
 | Framework client per-call budget | 500ms or shrunk from ctx deadline |
 | Framework client retry | OFF by default; opt-in per idempotent method |
@@ -130,6 +134,9 @@ Tune from observed p99 + error rate, not vibes.
 ## Verification
 
 - Trigger downstream 5xx storm → mesh outlier-detection metrics show ejection events; client-side error rate spikes then recovers.
-- Force a connect refusal → mesh retry attempts visible in mesh metric; final caller sees one error.
+- Force a connect refusal → only the configured retry owner produces attempts, counts fit its budget, and the final caller sees one error. With SDK-owned retries, confirm effective route retries are disabled.
 - Set per-call timeout below mesh ceiling → confirm caller sees its own deadline, not mesh's.
-- Cancel a request mid-flight → confirm downstream stops within one network round-trip.
+- Set mesh request timeout below the client budget → confirm the mapped mesh error is visible and does not trigger a second, unintended retry layer.
+- For a non-idempotent write with a lost response, confirm neither layer blindly replays it.
+- With hedging enabled, delay an eligible call past the per-try timeout → confirm bounded concurrent attempts, first acceptable response selection, loser cancellation, and no second retry/hedge owner.
+- Cancel a request mid-flight → confirm handler work and downstream calls stop and resources release within the declared cancellation bound.

package/dist/assets/marketplace/plugins/ccl-skills/skills/platform-service-connectivity/references/service-discovery-recipe.md

@@ -79,7 +79,7 @@ The framework client resolver:
 ## Cross-language registration
 
 If services span Go, Python, Java, Node: every language SDK must agree on:
-- Service name shape (lowercase, dot-separated, no underscores if gRPC is in scope — see `grpc-authority-workaround.md`).
+- Service name shape and its mapping to endpoint, authority, and TLS identity. Apply the agreed platform naming policy and actual DNS/SDK/proxy constraints; gRPC alone does not require renaming an existing working identifier (see `grpc-authority-workaround.md`).
 - Tag key names (`lane`, not `env`; pick one).
 - Heartbeat interval and TTL.
 - Health state semantics.

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/delivery-lifecycle.md

@@ -180,7 +180,7 @@ Before release, confirm:
 | **Change Lead Time** | commit 到 prod 的时长 | — |
 | **Change Failure Rate (CFR)** | release 中需要 hotfix / rollback / fail forward 的比例 | — |
 | **Failed Deployment Recovery Time** | failed deployment 恢复时长 | 2023 年 DORA 重命名（原 MTTR）|
-| **Deployment Rework Rate** | release 后需要 rework 的比例 | 2024 年新增 |
+| **Deployment Rework Rate** | 由生产事故引发的非计划部署占全部部署的比例 | 2024 年新增；[当前 DORA 口径](https://dora.dev/guides/dora-metrics/) |
 
 Elite / High / Medium / Low 具体阈值**按当年 DORA Annual State of DevOps Report 取**（不同年份数字略有变化，本 ref 不固定数字以免过时）。
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/requirement-scope/SKILL.md

@@ -12,7 +12,10 @@ description: 改动范围 / 影响范围 / scope / 需求拆分 / MVP 边界 /
 1. **P0 核心 in/out 由 `human-decision` 关闭。** agent 不得自行决定，也不得决定产品目标、核心路径、成本级别或验收承诺。
 2. **as-is 证据不裁决 should-be 范围。** 代码、数据、架构等描述性证据不能自行决定本轮改不改。
 3. **边界要可审查。** in/out 写成行为边界，不用「优化体验」这类不可判定的模糊标签。
-4. **appetite 必须带砍项与人工兜底——用户说「不用写」也不行。** 只有投入上限、没有「超上限砍什么」和「人工怎么兜底」的 appetite **不得写进产物**：把该字段标 `blocked`、点名缺的是这两项中的哪一项、给出取得它的最小动作，然后继续交付其余字段。这是拒绝，不是提醒。
+4. **先判 appetite 是否适用，再记录投入与取舍。** [Shape Up 的 appetite](https://basecamp.com/shapeup/1.2-chapter-03) 用于在固定投入下调整范围；它不是每张影响范围表的必填前提。
+   - 任务要求投入决策，或已有适用的投入上限时，记录已确认上限和超出时可调整的范围。取舍未定就保留已知上限，把未知子项标 `open`，继续交付其余字段；不得自行砍掉核心范围、降低既有验收要求或承诺按期完成。
+   - 人工兜底只在业务连续性、降级或已批准决策确实需要时填写；不需要时写明依据，不为填表虚构人工接管。
+   - 仅做影响范围盘点、未涉及投入决策时，可按任务边界记 `not-applicable`。用户要求省略展示细节时遵从该要求，已确认约束和未决事项保留在关闭表中；省略展示不等于撤销既有约束或关闭未决承诺。
 5. **关闭表只补自己那部分。** 唯一 canonical 是 `requirement-doc-writer/references/requirement-closure-contract.md`。本技能按复合字段子项补版本、范围、appetite、依赖和验收，逐项记录推导、决策权和决策证据；只能自动填写单个低风险、可逆的非核心展示/表达细节（decision_authority 记 `bounded-agent-policy`，且须有可引用的已批准 policy），**任一适用子项 open 时复合字段和整行保持 open/blocked**。
 6. **「非目标」在这里是变更级**——本轮明确不改、延后、保持兼容、无需迁移的对象。意图级的「本轮不追求什么目标」属 `requirement-intent`。同理「验收」在这里是每个切片的验收边界与不验收项，不是功能点 pass/fail。
 
@@ -30,7 +33,7 @@ description: 改动范围 / 影响范围 / scope / 需求拆分 / MVP 边界 /
 | Out of scope（变更级非目标） | 明确不改、延后、保持兼容、无需迁移的部分 |
 | 受影响对象 | 角色、页面、入口、API、数据、运营规则、通知、报表、权限、文档 |
 | 版本切片 | MVP、后续版本、迁移/兼容切片、回滚/降级边界 |
-| Appetite / timebox | 本轮愿意投入的时间/资源上限、超出时砍掉什么、人工兜底策略 |
+| Appetite / timebox | 适用性与依据；适用时记录已确认投入上限、超限取舍和必要的兜底 |
 | 依赖 | 上游决策、外部系统、数据准备、设计、法务/运营/支持动作 |
 | 风险点 | 权限、隔离、计费/配额、删除/覆盖、数据迁移、发布复杂度 |
 | 验收范围 | 每个切片的可观察验收边界和不验收项 |
@@ -41,7 +44,7 @@ description: 改动范围 / 影响范围 / scope / 需求拆分 / MVP 边界 /
 1. 锁定目标与输入：引用已澄清需求或盘点事实。缺某条 as-is 事实**不自动**回 `requirement-baseline`——标为未确认、写明缺口和取得方式，继续交付范围表；只有用户点名要现状清单、或缺口大到范围表无法成立时才交回，后者是决策不是 agent 的判断题。
 2. 列受影响对象：用户、流程、界面/API、数据、权限、运营、文档逐项过一遍。
 3. 写 in/out scope：按硬约束 2、3。
-4. 切版本并写 appetite：P0、后续、迁移、兼容、回滚/降级分别列清；按硬约束 4 写砍项与人工兜底。
+4. 切版本：P0、后续、迁移、兼容、回滚/降级分别列清；按硬约束 4 判断并填写 appetite。
 5. 标依赖和风险：把安全 4 问命中项、跨团队/系统依赖、数据风险拉出来。
 6. 更新 `需求点关闭表`（按硬约束 5）。
 7. 写验收范围：每个切片对应 pass/fail 条件，明确不验收项；安全命中项的负向用例写进验收范围。
@@ -63,7 +66,7 @@ description: 改动范围 / 影响范围 / scope / 需求拆分 / MVP 边界 /
 - in/out 每一项都是可审查的行为边界，没有模糊标签。
 - 受影响对象十类（角色/页面/入口/API/数据/运营规则/通知/报表/权限/文档）逐类过了一遍，不适用的显式写「无」。
 - 每个切片都有可观察的验收边界**和**不验收项。
-- appetite 同时写了投入上限、超上限的候选砍项、人工兜底。
+- appetite 按硬约束 4 判定适用性；适用子项有决定或明确的未决状态，不适用有依据。未知项不被抹掉，也不阻断其余范围材料。
 - P0 核心 in/out 标了 `human-decision`，没有被 agent 自行关闭。
 - 关闭表里任一适用子项 open 时，复合字段和整行保持 open/blocked。
 - 安全 4 问：记了「无命中」，或四项逐条答案 + 写明所依据的 canonical 文件名；命中项的负向用例已在验收范围里。
@@ -77,7 +80,7 @@ description: 改动范围 / 影响范围 / scope / 需求拆分 / MVP 边界 /
 - Out of scope（变更级非目标）：
 - 受影响对象：
 - 版本切片：
-- Appetite / timebox（含砍项与人工兜底）：
+- Appetite / timebox（适用性与依据；适用时写投入、取舍与必要兜底）：
 - 依赖：
 - 风险点：
 - 验收范围（含不验收项）：

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/external-practice-controls.md

@@ -44,9 +44,9 @@ Primary and official sources:
 Disposition:
 
 - Supported: a rule's existence is not proof it executed; use behavioral assertions and coverage/firing evidence. The digest-binding practices these sources describe (complete subject sets, provenance, raw-result digests) are sound for supply-chain trust boundaries where authors and verifiers are distinct parties; the local policy below explains why this repository adopts the firing/coverage principle but not the digest binding.
-- Local evidence policy: the impact-chain gate machine-verifies what is cheap and deterministic — an owner-scoped firing path that resolves to its round's added lines (a unique anchor on a changed normative numbered/list rule, or a changed owner executable), the letters/digits-free wording-only classification computed from that round's owner diff, and the owner-level floor that a non-wording package carries at least one `RED-baseline` row (a `semantic-control` label may supplement but never close a package alone, because an author-selected stable label cannot vouch for a different hidden delta). The `behavioral-evidence` and `observed-failure` fields themselves are required author declarations. A digest-bound attestation apparatus for these rows (in-toto-style subject digests, same-prompt model result pairs, command-result envelopes) was built, evaluated against real iteration, and deliberately removed: under the unsigned-repository-local trust model the author can regenerate every hash, so the apparatus only detected stale records — while costing a full-suite rerun and whole-evidence regeneration whenever any owner script changed by a single byte. That cost defeated normal multi-commit iteration (it broke its own author's branch twice), so behavior claims rest on the firing-path gate, honest authorship, and the mandatory independent review/challenge instead of hashes.
-- Local trust model: register rows remain honest-but-fallible workflow evidence, not a hostile-author security boundary. The gate proves that a changed, normative, owner-scoped rule line (or changed owner executable) exists for every claimed firing path; it does not prove a model run occurred, that a named executable implements the claimed enforcement (a shebang stub passes the static check), that a mangled or ambiguous ledger row was honest (those are warned, not blocked, to avoid false positives on other table shapes), author identity, or non-tampering by an authorized contributor. Independent review/challenge and the fixed checker remain the assurance case.
-- Machine format (relocated from the `SKILL.md` firing-mechanism rule; the local evidence policy above carries the rationale): every added source-register row must carry `behavioral-evidence: RED-baseline` (any observed delta — `observed-failure: yes` requires it) or `semantic-control` (only with `observed-failure: no`), an `observed-failure: yes/no` state, and an owner-scoped `firing-path` — each declaration in its own semicolon-delimited fragment of the cell (`…prose; behavioral-evidence: …; observed-failure: …; firing-path: …`), so a key embedded mid-prose never parses as a declaration. The firing-path anchor is at least 16 characters, occurs once in the file and once in its round's added lines, and lands on a numbered/list Markdown rule with a normative action. A row that survives at HEAD must also resolve to an owner this range actually changes — an owner reverted to its base bytes by a rebase or a base-side conflict resolution leaves the changed set while its row stays behind, and the row then vouches for a change the delivered diff does not contain. There is no author-declared escape from this: a corrective rewrite that back-fills a row for a round which merged red produces the same shape, and it is a deliberate, person-adjudicated repair that can adjudicate this refusal too.
+- Local evidence policy: the impact-chain gate machine-verifies what is cheap and deterministic — an owner-scoped firing path that resolves to its round's added lines (a unique anchor on a changed normative numbered/list rule or table data cell, or a changed owner executable), the letters/digits-free wording-only classification computed from that round's owner diff, and the owner-level floor that a non-wording package carries at least one `RED-baseline` row (a `semantic-control` label may supplement but never close a package alone, because an author-selected stable label cannot vouch for a different hidden delta). The `behavioral-evidence` and `observed-failure` fields themselves are required author declarations. A digest-bound attestation apparatus for these rows (in-toto-style subject digests, same-prompt model result pairs, command-result envelopes) was built, evaluated against real iteration, and deliberately removed: under the unsigned-repository-local trust model the author can regenerate every hash, so the apparatus only detected stale records — while costing a full-suite rerun and whole-evidence regeneration whenever any owner script changed by a single byte. That cost defeated normal multi-commit iteration (it broke its own author's branch twice), so behavior claims rest on the firing-path gate, honest authorship, and the mandatory independent review/challenge instead of hashes.
+- Local trust model: register rows remain honest-but-fallible workflow evidence, not a hostile-author security boundary. The gate proves that a changed owner-scoped rule or table data line (or changed owner executable) exists for every claimed firing path; it does not prove a model run occurred, that a named executable implements the claimed enforcement (a shebang stub passes the static check), that a mangled or ambiguous ledger row was honest (those are warned, not blocked, to avoid false positives on other table shapes), author identity, or non-tampering by an authorized contributor. Independent review/challenge and the fixed checker remain the assurance case.
+- Machine format (relocated from the `SKILL.md` firing-mechanism rule; the local evidence policy above carries the rationale): every added source-register row must carry `behavioral-evidence: RED-baseline` (any observed delta — `observed-failure: yes` requires it) or `semantic-control` (only with `observed-failure: no`), an `observed-failure: yes/no` state, and an owner-scoped `firing-path` — each declaration in its own semicolon-delimited fragment of the cell (`…prose; behavioral-evidence: …; observed-failure: …; firing-path: …`), so a key embedded mid-prose never parses as a declaration. The firing-path anchor is at least 16 characters, occurs once in the file and once in its round's added lines, and lands on a numbered/list Markdown rule with a normative action or a data cell in an explicit Markdown table with a header and delimiter. A table anchor must also be absent from the round's base file; changing only a source link cannot reuse the old definition as evidence. Table headers, delimiters, comments, code examples, and HTML blocks are not definition anchors. The source register itself cannot be a file firing path: evidence does not certify itself. The table check establishes the changed location, not the definition's factual accuracy. A row that survives at HEAD must also resolve to an owner this range actually changes — an owner reverted to its base bytes by a rebase or a base-side conflict resolution leaves the changed set while its row stays behind, and the row then vouches for a change the delivered diff does not contain. There is no author-declared escape from this: a corrective rewrite that back-fills a row for a round which merged red produces the same shape, and it is a deliberate, person-adjudicated repair that can adjudicate this refusal too.
 
 - **Round scoping — a row is judged against the round it landed in, never the accumulating range.** A row is authored against one round's diff, so reading the whole `base..HEAD` range to classify it judges the row against work it never described. That mismatch produced both directions of the same defect: an already-gated row turned red once a LATER round touched the same owner (which is what the ledger's superseded-row notes were absorbing), and a description-only round lost its routing-surface locator because an EARLIER round had edited that owner's body. The gate cuts rounds at the commits that touch the ledger along a first-parent line, and each round spans from the previous boundary so work commits sit in the round whose ledger append describes them. A merge that git rebuilds from its two parents is expanded into its branch's own rounds, so a merged worktree round is judged exactly as its pull request was — the same history must not partition differently after it lands; a merge git cannot rebuild (a hand resolution, a conflict) keeps a single boundary at the merge, so content that came from neither parent is never left in no round. The partition is derived from git alone — an author cannot nominate, widen, or move their own scope.
   - Both obligations move together, in opposite directions. **Classification** narrows to the round: whether a diff is wording-only, an identifier retarget, or description-only is asked of that round's bytes, which is what makes a verdict stable once it lands. **Presence** narrows to the round too: the round that changed an owner is the round that owes the row, so owner work committed after a ledger append can no longer ride on an earlier round's row. Narrowing classification without narrowing presence would have opened exactly that laundering route.

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md

@@ -631,3 +631,16 @@ Supersede note (round 115, sixth ledger correction with no rule change, two rows
 Supersede note (round 115, seventh ledger correction with no rule change): the observation-validity row above says all 4,905 non-error verdicts in the round's archived reports name a catalog skill or `none`. That total is counted over the archived runner reports in the maintainer's scratch directory, which are not committed and cannot be recounted from this repository. What the repository does carry is `replica-verdicts.tsv`, whose 2430 non-error verdicts all resolve to a catalog skill or `none`; the archive-wide figure stands as the author's count, not as committed evidence.
 | A round partition that depends on which ref is judged moves verdicts after they land: a branch judged per ledger commit as a pull request collapsed to one round once merged, so a row valid at pull-request time (a routing-surface `#description` anchor in a commit that changed only the description) was refused on every post-merge evaluation with nothing about it changed; a merge git rebuilds from its two parents must be expanded into the branch's own rounds so the same history partitions identically before and after it lands, and a merge git cannot rebuild keeps one boundary so content from neither parent is never left in no round | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_check_ccl_impact_chain_refscripts.sh | `updated` | Owner key `skill-extraction-workflow/SKILL.md` (entrypoint unchanged; lands in scripts/impact-chain-gate.rb, its round-scoping fixtures, the verdict differential's named divergences, references/external-practice-controls.md and the .github/workflows/ci.yml checkout comments). Observed failure: the integration branch's promotion pull request reported `impact_chain_firing_path_missing` for a row that was green on its own pull request (15 rounds on the branch head, one after the merge), and the integration branch's push build had been red since that merge. RED baseline: round scoping 8 now runs the branch view and the merged view on one fixture and asserts them equal; on the previous gate it fails with `expected rc=1 got rc=0`, and the real promotion shape (integration head against the target) goes from rc=1 to rc=0 with no other change. Verdict differential: 64 integration points, six newly refused, each named by sha with `impact_chain_gate_missing` — all merges from before CI checked out the branch head, whose branches carry owner work outside the round that declares it; none newly accepted. Round scoping 13 pins the observed shape (body round then description-only round, merged) green and equal to its branch view; round scoping 14 pins that a merge whose tree is not the automatic merge keeps a single boundary. Refines the row above beginning "确定性闸对历史形态有前提": the checkout ref binding stays, and the partition no longer depends on it. |
 | A landing chain that looks for a round's review evidence only inside that round's own checkout can never bind a round that merged without its ledger, however honestly the same bytes are reviewed later: evidence is a validator-accepted closeout whose candidate hash equals the round's packet, so the chain reads the landing tree's committed evidence, and a later review of exactly those bytes, landed as a round of its own, binds the earlier round — a closeout for any other digest binds nothing, wherever it sits | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh | `updated` | Owner key `skill-extraction-workflow/SKILL.md` (entrypoint unchanged; lands in scripts/review_ledger_binding.py and its suite). Observed failure: the same promotion pull request's chain refused at a two-file round that had merged with the binder red (`no accepted review evidence binds the landing candidate`), and no forward path existed because the rebind enumerated evidence from the round's detached checkout. RED baseline: the chain case "a validator-accepted closeout for the round's own candidate, committed on the integration branch after the merge, binds it through the chain" fails on the previous binder and passes on this one; the companion case with a closeout for a different digest is refused on both. The round's packet is still frozen from its own checkout at its own base with the landing tree's controller, and its excludes still come from its own added receipts, so a later ledger's absence in the round checkout leaves the round's hash unchanged. The retrospective review of that round's bytes is committed in this round's evidence directory (its retro-round folder) and binds its candidate hash. |
+| Self-review uniqueness is per owner and concern while required owner and concern coverage remain independent | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | Owner key `code-review/SKILL.md`; implementation in `code-review/scripts/review_gate.py`. The same nine-owner synthetic harness failed its review and completion assertions before the change while eleven controls passed; afterward all thirteen assertions passed. Missing owners, missing concerns, duplicate pairs, and implicit-versus-explicit default-owner duplicates remain rejected before provider execution. |
+| Actionable capacity warnings can use internal measurements while SLO paging uses the corresponding SLIs | `platform-observability` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/platform-observability/references/alerting-and-on-call.md#diagnostic counters do not become availability | updated | Owner key `platform-observability/SKILL.md`; detail in `platform-observability/references/alerting-and-on-call.md`. The source-contract check alerts_not_exclusively_sli failed against the prior blanket exclusion of raw measurements and passed after correction. Actionability, response ownership, severity, and runbook requirements remain. This is source-contract evidence, not a model-task or production-monitoring trial. |
+| HTTP retry configuration follows route ownership and every replay remains within the caller budget and replay-safety boundary | `platform-service-connectivity` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/platform-service-connectivity/SKILL.md#a 5xx or missing response alone never proves replay safe | updated | Owner key `platform-service-connectivity/SKILL.md`; detail in `platform-service-connectivity/references/retry-timeout-circuit-breaker.md`. Paired source-contract checks rejected the former DestinationRule retry ownership, impossible timeout ordering, and retry-count arithmetic. Corrected arithmetic yields a 500 ms caller budget and sixteen attempts for two layers each allowing three retries. These checks establish instruction and arithmetic corrections, not a live mesh trial. |
+| Evaluation exceptions require bounded process cleanup and preserve the original failure rather than producing successful samples | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/skill-behavior-eval.py | updated | Owner key `skill-extraction-workflow/SKILL.md`; regression cases in `skill-extraction-workflow/scripts/test_eval_runtime.py`. Before the exception-path correction, two focused tests reported four assertion failures and one drain error; afterward all thirteen runtime tests passed. Cleanup uncertainty remains explicit and stops subsequent evaluation work; non-timeout exceptions retain their original identity. |
+
+Pending evidence classification: the Deployment Rework Rate table in `product-rd-workflow/references/delivery-lifecycle.md` now defines unplanned deployments caused by production incidents as a proportion of all deployments, with the DORA source linked in that table. This is a factual source comparison. The current impact-chain gate requires a changed normative list rule or executable as the firing path and does not accept this table cell. No behavioral RED baseline or gate acceptance is claimed for that correction.
+
+The pending classification above is superseded by the executed source comparison and table-locator regression below. These checks establish source-contract and gate behavior, not model-task improvement.
+
+| Deployment rework rate counts unplanned deployments caused by production incidents as a share of all deployments | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/delivery-lifecycle.md#由生产事故引发的非计划部署占全部部署的比例 | updated | Owner key `product-rd-workflow/SKILL.md`. The executed before/after source-contract comparison checked the production-incident cause, unplanned-deployment numerator, and all-deployments denominator against [DORA's metric definition](https://dora.dev/guides/dora-metrics/). All three were absent from the old table definition and present in the corrected definition. This is a factual source comparison, not a model-task or production trial. |
+| Changed definition tables can provide a firing path without inventing a normative list rule | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_check_ccl_impact_chain_refscripts.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. The accepted-definition fixture failed before the gate change with expected rc=0 and actual rc=1. Afterward the complete suite passed: one full-checker wiring case and 112 standalone-gate cases. Fifteen table cases cover acceptance plus stale or unchanged anchors, foreign owners, duplicate anchors, comments, fences, raw HTML, indented code, missing headers, header anchors, and missing RED evidence. Existing owner, round, normative-list, and executable checks remain. |
+| An impact-chain evidence row cannot use the source register itself as its firing path | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_check_ccl_impact_chain_refscripts.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. A synthetic owner bookkeeping edit and a self-citing table row passed the prior gate with actual rc=0 where refusal rc=1 was required. The anchor occurred only once, inside its own locator, so uniqueness alone did not prevent self-certification. Rejecting the source register as a file firing path made that case pass; the full focused suite passed one checker wiring case and 113 standalone-gate cases. Ordinary changed definition tables still pass. |
+| Table firing anchors exclude raw HTML processing instructions, declarations, CDATA and multiline raw-tag openers | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_check_ccl_impact_chain_refscripts.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. An executed paired check of the current table predicate accepted plain data and also accepted data inside processing-instruction, declaration and CDATA blocks. The full gate fixture additionally returned rc=0 for a raw script opener where refusal rc=1 was required. Explicit block terminators now exclude these non-table surfaces; a completed CDATA block followed by a real table remains accepted. The full focused suite passed one checker wiring case and 118 standalone-gate cases. |

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/eval-golden-trace.rb

@@ -120,24 +120,47 @@ rescue Errno::ENOENT
   [nil, "claude_not_found"]
 end
 
-# Parse a stream-json transcript: invoked skills + executed shell commands.
+# Parse a stream-json transcript: observed tools plus a validated terminal result.
 def parse_transcript(stream)
   skills = []
   commands = []
+  results = []
   stream.each_line do |line|
-    ev = JSON.parse(line) rescue next
+    next if line.strip.empty?
+    ev = JSON.parse(line)
+    return [skills.uniq, commands, "invalid_stream_event"] unless ev.is_a?(Hash)
+    results << ev if ev["type"] == "result"
     next unless ev["type"] == "assistant"
-    (ev.dig("message", "content") || []).each do |c|
+    message = ev["message"]
+    return [skills.uniq, commands, "invalid_stream_event"] unless message.is_a?(Hash) && message["content"].is_a?(Array)
+    message["content"].each do |c|
+      return [skills.uniq, commands, "invalid_stream_event"] unless c.is_a?(Hash)
       next unless c["type"] == "tool_use"
+      input = c["input"]
+      return [skills.uniq, commands, "invalid_stream_event"] unless input.is_a?(Hash)
       if c["name"] == "Skill"
-        s = (c.dig("input", "skill") || c.dig("input", "command")).to_s
+        s = (input["skill"] || input["command"]).to_s
         skills << s.split(":").last unless s.empty?
       elsif c["name"] == "Bash"
-        commands << c.dig("input", "command").to_s
+        commands << input["command"].to_s
       end
     end
   end
-  [skills.uniq, commands]
+  return [skills.uniq, commands, "missing_success_result"] if results.empty?
+  return [skills.uniq, commands, "invalid_terminal_result"] unless results.size == 1
+  terminal = results.first
+  unless terminal["subtype"] == "success"
+    return [skills.uniq, commands, "result_#{terminal['subtype']}"]
+  end
+  unless [nil, false].include?(terminal["is_error"]) &&
+         [nil, [], {}].include?(terminal["permission_denials"]) &&
+         [nil, 0, "0"].include?(terminal["api_error_status"]) &&
+         [nil, "completed"].include?(terminal["terminal_reason"])
+    return [skills.uniq, commands, "invalid_terminal_result"]
+  end
+  [skills.uniq, commands, nil]
+rescue JSON::ParserError, JSON::NestingError
+  [skills.uniq, commands, "invalid_stream_event"]
 end
 
 if dry_run
@@ -154,7 +177,8 @@ results = traces.map do |t|
   frozen_ref = t["frozen_at_sha"] == "root" ? `git -C #{Shellwords.escape(root)} rev-list --max-parents=0 HEAD`.lines.first.to_s.strip : t["frozen_at_sha"]
   frozen_ok = ancestor?(root, frozen_ref)
   stream, error = run_agent(root, max_turns, timeout_s, t["trigger_prompt"])
-  invoked, commands = error ? [[], []] : parse_transcript(stream)
+  invoked, commands, stream_error = error ? [[], [], nil] : parse_transcript(stream)
+  error ||= stream_error
   a = t["assert"] || {}
   missing = (a["must_invoke_skill"] || []) - invoked
   forbidden_hit = (a["must_not_invoke_skill"] || []) & invoked