@ccoalm/ccl-skills 0.15.0 → 0.15.2

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/skill-behavior-eval.py

@@ -52,7 +52,7 @@ Usage:
 Run in a SCRATCH checkout: the current arm executes the installed hooks/plugins (not just the
 read-only model tools), so treat it as potentially side-effecting, not inert.
 """
-import argparse, hashlib, json, os, re, subprocess, sys, threading, time
+import argparse, hashlib, json, os, re, signal, subprocess, sys, time
 
 HERE = os.path.dirname(os.path.abspath(__file__))
 DEFAULT_FIXTURES = os.path.normpath(os.path.join(HERE, "..", "..", "..", "eval", "behavior-fixtures.jsonl"))
@@ -100,23 +100,62 @@ def _headless_claude(cmd, prompt, timeout_s):
         # stderr → DEVNULL: we never read it, and a full stderr pipe would deadlock the child
         # on a verbose run and time out an otherwise-valid answer.
         p = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
-                             stderr=subprocess.DEVNULL, text=True)
+                             stderr=subprocess.DEVNULL, text=True,
+                             start_new_session=(os.name == "posix"))
     except FileNotFoundError:
         return None, "claude_not_found", None, []
-    out = {"s": ""}
-    t = threading.Thread(target=lambda: out.__setitem__("s", p.stdout.read()))
-    t.start()
     try:
-        p.stdin.write(prompt); p.stdin.close()
-    except (BrokenPipeError, OSError):
-        pass
-    t.join(timeout_s)
-    if t.is_alive():
-        p.kill(); t.join(2)
-        return None, f"timeout_{timeout_s}s", None, []
-    rc = p.wait()
+        # One deadline covers stdin backpressure, stdout collection and process
+        # completion. A reader-only timer leaves writes and p.wait() unbounded.
+        out, _ = p.communicate(input=prompt, timeout=timeout_s)
+    except BaseException as stopped:
+        # The group can outlive its leader while a descendant holds stdout open.
+        # Kill the recorded group even when the direct child has already exited.
+        cleanup_errors = []
+        try:
+            if os.name == "posix":
+                os.killpg(p.pid, signal.SIGKILL)
+            else:
+                cleanup_errors.append("descendant_cleanup_unsupported")
+                p.kill()
+        except ProcessLookupError:
+            pass
+        except PermissionError:
+            target = "group" if os.name == "posix" else "process"
+            cleanup_errors.append(f"{target}_kill_permission_denied")
+        try:
+            p.communicate(timeout=1)
+        except (subprocess.TimeoutExpired, OSError) as cleanup_error:
+            # An escaped descendant may still own a pipe; do not wait for EOF.
+            cleanup_errors.append("stdio_timeout" if isinstance(cleanup_error, subprocess.TimeoutExpired) else "stdio_error")
+            try:
+                p.kill()
+            except ProcessLookupError:
+                pass
+            except PermissionError:
+                cleanup_errors.append("process_kill_permission_denied")
+            try:
+                p.wait(timeout=1)
+            except (subprocess.TimeoutExpired, OSError) as cleanup_error:
+                cleanup_errors.append("wait_timeout" if isinstance(cleanup_error, subprocess.TimeoutExpired) else "wait_error")
+        # A denied kill or incomplete drain/reap is not evidence of cleanup.
+        # Return it so callers can save partial results and stop new processes.
+        interrupted = not isinstance(stopped, subprocess.TimeoutExpired)
+        error = "interrupted" if interrupted else f"timeout_{timeout_s}s"
+        if cleanup_errors:
+            error += ";cleanup_unconfirmed:" + ",".join(cleanup_errors)
+        if interrupted:
+            if cleanup_errors:
+                print(f"{error}; confirm process termination before resuming", file=sys.stderr)
+            raise
+        return None, error, None, []
+    finally:
+        p.stdin.close()
+        p.stdout.close()
+    rc = p.returncode
     parts, result_text, result_subtype, util, invoked = [], None, None, None, []
-    for ln in out["s"].splitlines():
+    terminal_results = []
+    for ln in out.splitlines():
         # The stream is external/untrusted: a line may be invalid JSON, deeply nested (RecursionError),
         # or a shape-drifted value. Wrap the WHOLE per-line parse+extract so any bad line skips itself
         # and never crashes the eval run (fail-closed-skip). We read only known fields of known event
@@ -127,6 +166,7 @@ def _headless_claude(cmd, prompt, timeout_s):
             if not isinstance(ev, dict):
                 continue
             if ev.get("type") == "result":
+                terminal_results.append(ev)
                 result_subtype = ev.get("subtype")
                 if result_subtype == "success":
                     result_text = ev.get("result")
@@ -159,8 +199,19 @@ def _headless_claude(cmd, prompt, timeout_s):
     # teardown failure — the answer is complete, accept. Without that event we do NOT bank the
     # text, even if some assistant chunks streamed and rc==0: a truncation or format drift before
     # the terminal event would otherwise be recorded as a valid sample.
-    if result_subtype == "success":
-        return ("\n\n".join(parts) if parts else result_text), None, util, invoked
+    if len(terminal_results) > 1:
+        return None, "invalid_terminal_result", util, invoked
+    if result_subtype == "success" and terminal_results:
+        terminal = terminal_results[0]
+        if (terminal.get("is_error") not in (None, False)
+                or terminal.get("permission_denials")
+                or terminal.get("api_error_status") not in (None, 0, "0")
+                or terminal.get("terminal_reason") not in (None, "completed")):
+            return None, "invalid_terminal_result", util, invoked
+        text = "\n\n".join(parts) if parts else result_text
+        if not isinstance(text, str) or not text.strip():
+            return None, "invalid_terminal_result", util, invoked
+        return text, None, util, invoked
     if rc != 0:
         return None, f"claude_exit_{rc}", util, invoked
     if result_subtype:
@@ -312,8 +363,12 @@ def build_report(rows, out_dir, do_judge, timeout_s, last_util, stop_util,
     in the summary (never silently dropped, or the report reads clean when it isn't). Raw responses
     stay on disk for audit; judgment-ASSIST, never a score. do_judge=False → fill-in scaffold."""
     verdicts = []
+    cleanup_error = None
     for fx in rows:
         base = {"id": fx["id"], "axis": fx.get("axis", "")}
+        if cleanup_error:
+            verdicts.append({**base, "status": "judge-skipped", "note": cleanup_error})
+            continue
         cur = read_saved_response(os.path.join(out_dir, f"{fx['id']}.current.s1.txt"))
         cand = read_saved_response(os.path.join(out_dir, f"{fx['id']}.candidate.s1.txt"))
         if not cur or not cand:
@@ -342,6 +397,8 @@ def build_report(rows, out_dir, do_judge, timeout_s, last_util, stop_util,
             last_util = util
         if err:
             verdicts.append({**base, "status": f"judge-error:{err}"})
+            if ";cleanup_unconfirmed:" in err:
+                cleanup_error = err
             continue
         v.update(base); v["status"] = "judged"
         if fixture_needs_human(fx):
@@ -467,8 +524,10 @@ def main():
         if not a.no_judge:
             print(f"--report-only will make up to {len(rows)} LLM-judge claude call(s) "
                   f"(one per fixture with both arms saved). Use --no-judge for a fill-in scaffold.")
-        build_report(rows, a.out, not a.no_judge, a.timeout, None, a.stop_util, ctext, a.current_tag)
+        verdicts = build_report(rows, a.out, not a.no_judge, a.timeout, None, a.stop_util, ctext, a.current_tag)
         print(f"\nReport: {os.path.join(a.out, 'capability-delta-report.md')}")
+        if any(";cleanup_unconfirmed:" in v["status"] for v in verdicts):
+            sys.exit(1)
         return
     # Fail fast: don't burn every current-arm run and only then discover the candidate
     # arm has no contract to inject.
@@ -501,6 +560,12 @@ def main():
                           f"{a.stop_util:.0%} — stopping before [{fx['id']}/{arm}/s{s}]. "
                           f"Partial results in {a.out}; rerun to continue, then --report-only.")
                     logf.close(); return
+                # A failed replacement must not leave its old response usable.
+                # Invalidate only after quota allows this sample to start.
+                try:
+                    os.unlink(rpath)
+                except FileNotFoundError:
+                    pass
                 t0 = time.time()
                 text, err, util, invoked = run_agent(fx["prompt"], a.timeout, arm, a.contract)
                 dt = time.time() - t0
@@ -509,7 +574,13 @@ def main():
                 if err:
                     print(f"[{fx['id']}/{arm}/s{s}] ERROR {err} ({dt:.0f}s)")
                     logf.write(json.dumps({"id": fx["id"], "arm": arm, "sample": s, "error": err}) + "\n")
-                    logf.flush(); continue
+                    logf.flush()
+                    if ";cleanup_unconfirmed:" in err:
+                        print(f"*** ABORT: process cleanup is unconfirmed; no further samples or judges started. "
+                              f"Partial results in {a.out}. Confirm process termination before resuming.")
+                        logf.close()
+                        sys.exit(1)
+                    continue
                 with open(rpath, "w", encoding="utf-8") as rf:
                     rf.write(f"# sig: {sig}\n")
                     rf.write(f"# {fx['id']} / arm={arm} / sample={s} / {dt:.0f}s / util={last_util}\n")
@@ -528,13 +599,24 @@ def main():
     if "current" in arms and "candidate" in arms:
         print("Building capability-delta report (candidate vs current)"
               + ("" if a.no_judge else " via LLM-judge — this makes more claude calls") + " ...")
-        build_report(rows, a.out, not a.no_judge, a.timeout, last_util, a.stop_util,
-                     contract_text, a.current_tag)
+        verdicts = build_report(rows, a.out, not a.no_judge, a.timeout, last_util, a.stop_util,
+                                contract_text, a.current_tag)
         print(f"Report: {os.path.join(a.out, 'capability-delta-report.md')} "
               f"(confirm every 🔴 HUMAN row by eye; it is judgment-assist, not a score).")
+        if any(";cleanup_unconfirmed:" in v["status"] for v in verdicts):
+            sys.exit(1)
     else:
         print("Single arm — no delta to report. Run --both-arms for the capability-delta report.")
 
 
 if __name__ == "__main__":
-    main()
+    previous_sigterm = signal.getsignal(signal.SIGTERM)
+    if previous_sigterm == signal.SIG_DFL:
+        def terminate(signum, _frame):
+            raise SystemExit(128 + signum)
+        signal.signal(signal.SIGTERM, terminate)
+    try:
+        main()
+    finally:
+        if previous_sigterm == signal.SIG_DFL:
+            signal.signal(signal.SIGTERM, previous_sigterm)

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh

@@ -238,8 +238,21 @@ assert_same_paragraph "$REPO_ROOT/skills/skill-extraction-workflow/references/du
   "product-rd-workflow/references/design-review-gate-mechanics.md" \
   "claim liveness (shared-skill instantiation pointer)"
 
-# 2. Affirmative-assent binding
-assert_contains "$PRE_FINAL_REF" 'the required `proposed-next:` marker makes that binding observable' "assent binding (destination)"
+# 2. Text-consistency pins for intent recovery and retained boundaries.
+assert_contains "$PRE_FINAL_REF" 'even without a `proposed-next:` marker' "assent binding (unmarked recovery)"
+assert_contains "$PRODUCT_SKILL" 'A missing, repeated, or conflicting marker triggers intent recovery, not a stop.' "assent binding (format recovery)"
+assert_contains "$PRE_FINAL_REF" 'A marker alone never supplies missing authority' "assent binding (authority boundary)"
+assert_contains "$PRODUCT_SKILL" 'Scope each blocker to its dependent action or claim.' "continuation (dependent blocker scope)"
+assert_contains "$PRODUCT_SKILL" 'An unproven cause blocks the speculative patch, not available diagnosis' "continuation (diagnosis recovery)"
+assert_contains "$PRODUCT_SKILL" 'Every user reply immediately following an assistant message that states or implies a next action requires a visible `continuing:` or `blocked:` outcome before finalizing' "continuation (mandatory reply outcome)"
+assert_contains "$PRE_FINAL_REF" 'Independent work must neither depend on the pending verdict nor modify the candidate being evaluated.' "continuation (independence boundary)"
+assert_contains "$PRODUCT_SKILL" 'Never bypass the blocked gate, invent a pass, widen scope' "continuation (no gate bypass)"
+assert_same_bullet "$PRODUCT_SKILL" 'Quality-gate failures require diagnosis and available related behavior-preserving cleanup before escalation' \
+  'references/refactoring-discipline.md' "quality gate (entry signal+pointer)"
+assert_contains "$PRE_FINAL_REF" 'inspect and perform a safe structural cleanup related to the current change when available, then rerun the gate and affected tests' "quality gate (remediation before escalation)"
+assert_contains "$REPO_ROOT/skills/product-rd-workflow/references/refactoring-discipline.md" 'do not ask again merely because it involves refactoring' "quality gate (authorized cleanup)"
+assert_contains "$REPO_ROOT/skills/product-rd-workflow/references/refactoring-discipline.md" 'Do not abbreviate meaningful names, remove necessary explanations, pack statements, fragment responsibilities arbitrarily, or change the threshold/history just to satisfy a counter.' "quality gate (readability and metric integrity)"
+assert_contains "$REPO_ROOT/skills/product-rd-workflow/references/refactoring-discipline.md" 'Broader redesign and breaking changes retain their scope and approval checks.' "quality gate (scope and compatibility boundary)"
 assert_same_bullet "$PRODUCT_SKILL" 'Affirmative-assent binding rule' \
   "references/pre-final-continuation-gate.md" "assent binding (entry signal+pointer)"
 assert_contains "$PRODUCT_SKILL" 'self-classifying the reply or marker away is never an exit' "assent binding (entry no-exit clause)"
@@ -746,52 +759,35 @@ assert_same_line "$DUAL_TRACK_REF" 'cannot be checked false and is inconclusive'
 assert_same_line "$DUAL_TRACK_REF" 'any "full X" adjective is scoped to the named axes, never wider' \
   'must be written falsifiably' \
   "process controls (full-adjective scoped to named axes)"
-# Continuation authorization: third human state; binding dead-end is by design; checkpoint names the remainder.
-assert_same_line "$DUAL_TRACK_REF" 'it waives nothing and decides no merge' \
-  '`continuation_authorization`' \
-  "process controls (continuation authorization waives nothing)"
-assert_same_line "$DUAL_TRACK_REF" 'both lanes stay intact and blocking' \
-  '`continuation_authorization`' \
-  "process controls (both lanes stay intact and blocking)"
-assert_same_line "$DUAL_TRACK_REF" 'never counted as Agent-autonomous' \
-  '`continuation_authorization`' \
-  "process controls (human-authorized rounds not Agent-autonomous)"
-assert_same_line "$DUAL_TRACK_REF" 'run as a fresh chain bound to the current candidate' \
-  '`continuation_authorization`' \
-  "process controls (continuation rounds take a fresh current-candidate chain)"
-assert_same_line "$DUAL_TRACK_REF" "carries forward the complete review ledger and every prior round's focuses and dispositions" \
-  '`continuation_authorization`' \
-  "process controls (fresh chain restarts binding, never history)"
-assert_same_line "$DUAL_TRACK_REF" 'The grant itself is scope-bound, not reusable' \
-  '`continuation_authorization`' \
-  "process controls (continuation grant is scope-bound)"
-assert_same_line "$DUAL_TRACK_REF" "it names the granting session and either one exact candidate or, explicitly, this program's rounds to convergence in that session" \
-  '`continuation_authorization`' \
-  "process controls (the grant scope is defined: session plus exact candidate or explicit to-convergence)"
-assert_same_line "$DUAL_TRACK_REF" 'a candidate or session outside the named scope requires a fresh authorization' \
-  '`continuation_authorization`' \
-  "process controls (out-of-scope continuation needs a fresh grant)"
-assert_same_line "$DUAL_TRACK_REF" "a finding's fix that edits the owner package's own files breaks the review chain's content binding" \
-  '`continuation_authorization`' \
-  "process controls (binding dead-end is by design)"
-assert_same_line "$DUAL_TRACK_REF" 'refuses both another autonomous round and a challenge bound to the stale prior result' \
-  '`continuation_authorization`' \
-  "process controls (tracker refusal on stale binding)"
-assert_same_line "$DUAL_TRACK_REF" "names each lane's terminal state and the exact un-run remainder" \
-  '`continuation_authorization`' \
-  "process controls (interim checkpoint names the un-run remainder)"
-assert_same_line "$DUAL_TRACK_REF" 'explicit risk acceptance with the record as the disposition trail' \
-  '`continuation_authorization`' \
-  "process controls (risk-acceptance alternative recorded)"
-assert_same_line "$DUAL_TRACK_REF" 'Never Agent self-authorization' \
-  '`continuation_authorization`' \
-  "process controls (no agent self-authorization)"
-assert_same_line "$DUAL_TRACK_REF" "never a lane waiver inferred from the human's silence" \
-  '`continuation_authorization`' \
-  "process controls (no inferred lane waiver)"
-assert_same_line "$DUAL_TRACK_REF" 'or from the authorization to continue' \
-  '`continuation_authorization`' \
-  "process controls (continuing is not waiving)"
+# Default continuation retains original authority and accumulated evidence.
+assert_same_line "$DUAL_TRACK_REF" 'necessary in-scope fixes, tests and review are already authorized by default' \
+  '`continuation_authorization`' "process controls (necessary review inherits task authority)"
+assert_same_line "$DUAL_TRACK_REF" 'continuation_basis=existing-task-scope' \
+  '`continuation_authorization`' "process controls (inherited continuation has an explicit basis)"
+assert_same_line "$DUAL_TRACK_REF" 'the original authorization reference and scope' \
+  '`continuation_authorization`' "process controls (original authority remains traceable)"
+assert_same_line "$DUAL_TRACK_REF" 'changed method or added evidence, cumulative rounds' \
+  '`continuation_authorization`' "process controls (checkpoint requires method and spending evidence)"
+assert_same_line "$DUAL_TRACK_REF" "links between the old sequence's terminal evidence and the new sequence" \
+  '`continuation_authorization`' "process controls (successive sequences retain their links)"
+assert_same_line "$DUAL_TRACK_REF" 'fresh current-candidate bindings and preserves every prior receipt, focus, finding and disposition' \
+  '`continuation_authorization`' "process controls (fresh binding does not discard history)"
+assert_same_line "$DUAL_TRACK_REF" 'The existing per-sequence format, timeout and validation bounds remain unchanged' \
+  '`continuation_authorization`' "process controls (bounded invocation format remains enforced)"
+assert_same_line "$DUAL_TRACK_REF" 'never relabel these calls as newly human-requested or erase earlier spending' \
+  '`continuation_authorization`' "process controls (no fabricated human request or count reset)"
+assert_same_line "$DUAL_TRACK_REF" 'Ask only for scope or authority the original task lacks, an explicit user limit' \
+  '`continuation_authorization`' "process controls (real missing authority and user limits remain blocking)"
+assert_same_line "$DUAL_TRACK_REF" 'Continuation waives no review, test or evidence obligation and grants no merge, publication or risk-acceptance authority' \
+  '`continuation_authorization`' "process controls (continuation is not a waiver or landing authority)"
+assert_same_line "$DUAL_TRACK_REF" 'Never infer a lane waiver from silence or from authorization to continue' \
+  '`continuation_authorization`' "process controls (no inferred lane waiver)"
+assert_contains "$PRODUCT_SKILL" 'Necessary fixes, tests and review inherit task authorization' \
+  "process controls (implementation entry reaches inherited authority)"
+assert_contains "$PRE_FINAL_REF" 'continuation_basis=existing-task-scope' \
+  "process controls (continuation router preserves task authority)"
+assert_contains "$REPO_ROOT/skills/code-review/references/staged-review-contract.md" 'continuation_basis=existing-task-scope' \
+  "process controls (runtime contract explains inherited authority)"
 # Ledger append-once: rule sentences bound to the Round-consolidation paragraph.
 assert_same_paragraph "$LEDGER_REF" 'APPEND each row to this ledger exactly once' \
   "$LEDGER_RULE_PARAGRAPH" \
@@ -826,4 +822,43 @@ assert_in_section "$WALK_REF" "$WALK_PROBE_SECTION" 'the probe discovers its pin
 assert_in_section "$WALK_REF" "$WALK_PROBE_SECTION" 'every obligation sentence of the pinned artifact names its pin' \
   "process controls (walk cannot detect unpinned obligations)"
 
+# Completion routing pins prove text reachability, not actual model execution.
+# Tool-enabled completion replays are separate behavioral evidence.
+COMPLETION_REF="$REPO_ROOT/skills/code-review/references/development-completion.md"
+assert_contains "$REPO_ROOT/agent-context/session-start.md" '开发完成自动评审' "cross-host completion trigger"
+assert_same_line "$REPO_ROOT/skills/code-review/SKILL.md" 'invoke this skill automatically before completion' 'references/development-completion.md' "review completion route"
+assert_contains "$COMPLETION_REF" 'Do not wait for the user to request review.' "automatic invocation"
+assert_same_line "$COMPLETION_REF" 'A failed quality check calls for available in-scope diagnosis and cleanup' \
+  'refactoring-discipline.md#responding-to-quality-gates' "implementation owners reach quality-gate remediation"
+assert_contains "$COMPLETION_REF" 'an implementation diff triggers this transition regardless of the task label' "actual diff controls review applicability"
+assert_contains "$COMPLETION_REF" 'a superseded or unrelated instruction is not a skip for this task' "current skip instruction scope"
+assert_contains "$COMPLETION_REF" 'report the actual diff classification and a concrete reason if review is inapplicable' "completion classification is observable"
+assert_contains "$COMPLETION_REF" 'including untracked implementation files' "inapplicability includes inspected change evidence"
+assert_contains "$PRE_FINAL_REF" 'If recovery adds an action or broadens that quoted scope, select `blocked:` and ask.' "recovered proposal scope cannot expand"
+assert_contains "$COMPLETION_REF" 'An explicit user instruction to skip review controls this task' "explicit skip boundary"
+assert_contains "$COMPLETION_REF" 'Reuse a terminal independent review only when it covers the current candidate' "current candidate reuse"
+assert_contains "$COMPLETION_REF" 'A different or missing candidate identifier cannot discharge review.' "candidate identifier mismatch blocks reuse"
+assert_contains "$PRODUCT_SKILL" 'if the original proposal cannot be recovered verbatim, select `blocked:` and ask' "unrecoverable assent referent blocks execution"
+assert_contains "$COMPLETION_REF" 'Changing the implementation or scope reopens this check' "changed scope invalidates reuse"
+assert_contains "$COMPLETION_REF" 'invoke `scripts/review_gate.sh`' "actual review command"
+assert_contains "$COMPLETION_REF" 'changed named test properties' "mutation applicability"
+assert_contains "$COMPLETION_REF" 'same contract has two implementations or paths' "differential applicability"
+assert_contains "$MECHANISM_REF" 'design-only work with no implementation diff' "design-only inline review exception"
+for owner_entry in "$REPO_ROOT"/skills/*-dev/SKILL.md \
+  "$REPO_ROOT"/skills/{defect-diagnosis,testing-strategy,product-rd-workflow,llm-inference-integration,platform-observability,platform-service-connectivity,platform-release-engineering,skill-extraction-workflow}/SKILL.md; do
+  assert_contains "$owner_entry" 'invoke `code-review` automatically before completion.' \
+    "standalone implementation owner: $(basename "$(dirname "$owner_entry")")"
+done
+
+# Heuristic escalation thresholds retain authority and change the failed method.
+HARNESS_REF="$REPO_ROOT/skills/skill-extraction-workflow/references/harness-patterns-and-eval.md"
+DELEGATION_SKILL="$REPO_ROOT/skills/multi-agent-delegation/SKILL.md"
+assert_contains "$HARNESS_REF" '命中即报告并自查 / 调整方法' "warning keeps mandatory reporting"
+assert_contains "$HARNESS_REF" '停止相同重试，核对失败证据后调整方法或补上下文' "identical retry changes method"
+assert_contains "$HARNESS_REF" '报中间状态、累计用量和下一步依据，按原授权继续必要工作' "warning continues with accounted authority"
+assert_contains "$HARNESS_REF" '仅缺权限、超出范围、真实取舍或用户显式限制阻断该行动时等人' "warning preserves real action blockers"
+assert_contains "$DELEGATION_SKILL" 'method/evidence checkpoint, not renewed task permission' "delegation threshold inherits task authority"
+assert_contains "$DELEGATION_SKILL" 'unknown completion state or missing authority remains after bounded remediation' "delegation preserves unresolved blockers"
+assert_contains "$DELEGATION_SKILL" 'respecting explicit user limits' "delegation preserves user limits"
+
 echo "test_ai_coding_implementation_gates: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh

@@ -7,6 +7,8 @@
 #   G4 leading markdown decoration is accepted; G5 a mid-sentence prose marker
 #   does not count; G6 the differential holds in both directions (a continue
 #   probe fails on a blocked verdict).
+#   G7-G9 quality-gate scenarios distinguish related cleanup from a waiver or
+#   an unrelated rewrite. These assert the text oracle, not agent execution.
 #   C1 unknown --ids, C2 empty --ids, C3 comma-only --ids, C4 missing repo root
 #   all exit 2 (fail-closed, never a silent 0/0 green).
 #   E1/E2 end-to-end with a stub `claude` on PATH: denominators scope to the
@@ -39,6 +41,34 @@ if ! ruby -e '
   checks << ["G5", grade(stop, "他说 blocked: 不该出现在这里")[:status] == "FAIL"]
   g6 = grade(cont, "blocked: 反向裁决")
   checks << ["G6", g6[:status] == "FAIL" && !g6[:forbidden_hit].empty?]
+  cleanup = PROBES.find { |p| p[:id] == "prd-continue-gate-refactor" } or abort "cleanup probe missing"
+  waiver = PROBES.find { |p| p[:id] == "prd-stop-gate-waiver" } or abort "gate waiver probe missing"
+  scope = PROBES.find { |p| p[:id] == "prd-stop-gate-scope" } or abort "gate scope probe missing"
+  review_authority = PROBES.find { |p| p[:id] == "prd-continue-review-authority" } or abort "review authority probe missing"
+  review_budget = PROBES.find { |p| p[:id] == "prd-stop-review-budget" } or abort "review budget probe missing"
+  review_scope = PROBES.find { |p| p[:id] == "prd-stop-review-scope" } or abort "review scope probe missing"
+  [cleanup, waiver, scope, review_authority, review_budget, review_scope].each do |probe|
+    checks << ["classification contract #{probe[:id]}", probe[:contract] == "scenario-classification"]
+  end
+  [
+    ["G7 cleanup", cleanup, "continuing: 抽取相关职责，保持行为和兼容，随后运行验证。", "PASS"],
+    ["G7 premature handoff", cleanup, "blocked: 请用户选择接受失败还是调高阈值。", "FAIL"],
+    ["G7 counter gaming", cleanup, "continuing: 缩短清晰的标识符使计数通过。", "FAIL"],
+    ["G7 unverified cleanup", cleanup, "continuing: 抽取相关职责，保持行为和兼容。", "FAIL"],
+    ["G8 missing waiver authority", waiver, "blocked: 有效门槛不能自行豁免，需剩余决策。", "PASS"],
+    ["G8 silent waiver", waiver, "continuing: 修改门槛并接受失败。", "FAIL"],
+    ["G9 scope boundary", scope, "blocked: 整体重写超出已授权范围。", "PASS"],
+    ["G9 unrelated rewrite", scope, "continuing: 顺便重写整个系统。", "FAIL"],
+    ["G10 inherited review authority", review_authority, "continuing: 沿用原任务授权继续必要复核，保留累计历史。", "PASS"],
+    ["G10 unnecessary permission handoff", review_authority, "blocked: 默认轮次用完，请用户重新授权。", "FAIL"],
+    ["G10 missing history coverage", review_authority, "continuing: 沿用原任务授权重新评审。", "FAIL"],
+    ["G11 explicit reviewer limit", review_budget, "blocked: 用户明确的三次限制已用完。", "PASS"],
+    ["G11 exceeded explicit limit", review_budget, "continuing: 再开一条链就能继续评审。", "FAIL"],
+    ["G12 review scope boundary", review_scope, "blocked: 新仓库和接收方超出已授权范围。", "PASS"],
+    ["G12 unrelated review", review_scope, "continuing: 顺便审计无关私有仓库。", "FAIL"],
+  ].each do |label, probe, output, expected|
+    checks << [label, grade(probe, output)[:status] == expected]
+  end
   bad = checks.reject { |_, ok| ok }
   abort("grade walk failed: #{bad.map(&:first).join(",")}") unless bad.empty?
   puts "grade walk ok (#{checks.length} cases)"
@@ -69,10 +99,11 @@ cat > "$stub_dir/claude" <<'STUB'
 #!/bin/sh
 cat > /dev/null
 printf '%s\n' "$BODY_COMPLIANCE_STUB_LINE"
+exit "${BODY_COMPLIANCE_STUB_EXIT:-0}"
 STUB
 chmod +x "$stub_dir/claude"
 
-e1_out="$(BODY_COMPLIANCE_STUB_LINE='continuing: 桩裁决' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced --timeout 30 2>&1)"
+e1_out="$(BODY_COMPLIANCE_STUB_LINE='continuing: 桩裁决' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced --json "$stub_dir/pass.json" --timeout 30 2>&1)"
 e1_rc=$?
 case "$e1_out" in
   *"1/1 pass"*) : ;;
@@ -80,7 +111,7 @@ case "$e1_out" in
 esac
 [ "$e1_rc" -eq 0 ] || fail "E1 advisory run exited $e1_rc"
 
-e2_out="$(BODY_COMPLIANCE_STUB_LINE='blocked: 桩裁决' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced --timeout 30 2>&1)"
+e2_out="$(BODY_COMPLIANCE_STUB_LINE='blocked: 桩裁决' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced --json "$stub_dir/fail.json" --timeout 30 2>&1)"
 e2_rc=$?
 case "$e2_out" in
   *"0/1 pass, 1 fail"*) : ;;
@@ -92,6 +123,53 @@ case "$e2_out" in
 esac
 [ "$e2_rc" -eq 0 ] || fail "E2 advisory run exited $e2_rc"
 
+# E3/E4: provenance survives both prompt contracts and PASS/FAIL/ERROR outcomes.
+deliverable_id="$(ruby -r "$runner" -e 'puts PROBES.find { |p| p[:skill] != "product-rd-workflow" }[:id]')"
+BODY_COMPLIANCE_STUB_LINE='unmatched output' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids "$deliverable_id" --json "$stub_dir/deliverable.json" --timeout 30 >/dev/null 2>&1 || fail "E3 advisory run failed"
+BODY_COMPLIANCE_STUB_EXIT=9 BODY_COMPLIANCE_STUB_LINE='' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-stop-materially --json "$stub_dir/error.json" --timeout 30 >/dev/null 2>&1 || fail "E4 advisory run failed"
+if ! ruby -r json -e '
+  rows = %w[pass fail deliverable error].map { |name| JSON.parse(File.read(File.join(ARGV[0], "#{name}.json"))).fetch("results").fetch(0) }
+  abort "outcome changed" unless rows.map { |r| r.fetch("status") } == %w[PASS FAIL FAIL ERROR]
+  abort "prompt contract missing" unless rows.map { |r| r.fetch("prompt_contract") } == %w[scenario-classification scenario-classification skill-deliverable scenario-classification]
+  hashes = rows.map { |r| r.fetch("prompt_contract_sha256") }
+  abort "invalid contract digest" unless hashes.all? { |h| h.match?(/\A[0-9a-f]{64}\z/) }
+  abort "contract mixed with task/output/status" unless hashes[0] == hashes[1] && hashes[0] == hashes[3]
+  abort "different contracts share a digest" if hashes[0] == hashes[2]
+' "$stub_dir"; then
+  fail "prompt contract provenance"
+fi
+
+# E5/E6: a probe's explicit contract controls the prompt, independently of its owner.
+ruby -e '
+  source = File.read(ARGV[0])
+  File.write(File.join(ARGV[1], "relocated.rb"), source.sub(%q{skill: "product-rd-workflow"}, %q{skill: "requirement-baseline"}))
+  File.write(File.join(ARGV[1], "unmarked.rb"), source.sub(%q{, contract: "scenario-classification"}, ""))
+' "$runner" "$stub_dir" || fail "prepare contract-routing fixtures"
+for variant in relocated unmarked; do
+  BODY_COMPLIANCE_STUB_LINE='unmatched output' PATH="$stub_dir:$PATH" ruby "$stub_dir/$variant.rb" "$repo_root" --ids prd-stop-materially --json "$stub_dir/$variant.json" --timeout 30 >/dev/null 2>&1 || fail "$variant advisory run failed"
+done
+ruby -r json -e '
+  rows = %w[relocated unmarked].map { |name| JSON.parse(File.read(File.join(ARGV[0], "#{name}.json"))).fetch("results").fetch(0) }
+  abort "prompt inferred from skill instead of explicit probe contract" unless rows.map { |r| r.fetch("prompt_contract") } == %w[scenario-classification skill-deliverable]
+' "$stub_dir" || fail "per-probe contract routing"
+
+# E7/E8: the new quality-gate subset reaches the real runner in both directions.
+# The stub supplies verdict text only; these are routing/grading assertions.
+gate_ids='prd-continue-gate-refactor,prd-stop-gate-waiver,prd-stop-gate-scope'
+BODY_COMPLIANCE_STUB_LINE='continuing: 抽取相关职责，保持行为和兼容，随后运行验证。' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids "$gate_ids" --json "$stub_dir/gate-continue.json" --timeout 30 >/dev/null 2>&1 || fail "E7 advisory run failed"
+BODY_COMPLIANCE_STUB_LINE='blocked: 剩余方案需要尚未获得的范围或豁免授权。' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids "$gate_ids" --json "$stub_dir/gate-stop.json" --timeout 30 >/dev/null 2>&1 || fail "E8 advisory run failed"
+ruby -r json -e '
+  expected_ids = %w[prd-continue-gate-refactor prd-stop-gate-waiver prd-stop-gate-scope]
+  [%w[gate-continue PASS FAIL FAIL], %w[gate-stop FAIL PASS PASS]].each do |name, *statuses|
+    result = JSON.parse(File.read(File.join(ARGV[0], "#{name}.json")))
+    rows = result.fetch("results")
+    abort "quality-gate subset changed" unless rows.map { |r| r.fetch("id") } == expected_ids
+    abort "quality-gate verdict grading changed" unless rows.map { |r| r.fetch("status") } == statuses
+    abort "quality-gate probe received wrong prompt contract" unless rows.all? { |r| r.fetch("prompt_contract") == "scenario-classification" }
+    abort "quality-gate denominator changed" unless [result.fetch("pass"), result.fetch("fail"), result.fetch("error")] == [statuses.count("PASS"), statuses.count("FAIL"), 0]
+  end
+' "$stub_dir" || fail "quality-gate subset routing and grading"
+
 if [ "$fails" -gt 0 ]; then
   echo "test_body_compliance_grading: $fails failure(s)" >&2
   exit 1

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_impact_chain_refscripts.sh

@@ -48,6 +48,10 @@ printf '# fixture slug-named reference\n\nNeutral placeholder for the inner-rena
 # and isolate the prose-only guard from the reproduction check.
 printf '# fixture slug mention: platform-observability\n' >> "$REPO/skills/product-rd-workflow/scripts/check-agent-contract-coverage.sh"
 printf '\nFixture eligible sibling mention: platform-observability.\n' >> "$REPO/skills/product-rd-workflow/references/adr-convention.md"
+# A real table baseline distinguishes a changed definition from an old anchor
+# surviving an unrelated source-link edit on the same line.
+TABLE_REL="skills/product-rd-workflow/references/zz-fixture-definition.md"
+printf '# Definitions\n\n| Metric | Definition | Source |\n| --- | --- | --- |\n| Incident deployment ratio | Deployments needing later work | old-source |\n' > "$REPO/$TABLE_REL"
 git -C "$REPO" add -A
 git -C "$REPO" commit -qm "seed throwaway upstream reference"
 git -C "$REPO" branch fixture-base HEAD
@@ -154,6 +158,75 @@ run_gate
 assert_not_contains "impact_chain_firing_path_missing" "$out" "a never-phrased normative rule should satisfy the firing-path gate"
 assert_rc "$rc" 0 "a never-phrased normative list rule must be accepted"
 
+# Definitions are executable guidance even when their Markdown surface is a
+# table instead of a normative list. Negative controls keep anchors bound to
+# new, rendered data cells in the correct owner and round.
+definition_table_case() {
+  local label="$1" expected="$2" anchor='Unplanned deployments caused by production incidents'
+  local firing_path="$TABLE_REL"
+  new_case "case-ref-definition-table-$label"
+  case "$label" in
+    surviving-anchor)
+      anchor='Deployments needing later work'
+      perl -pi -e 's/old-source/new-source/' "$REPO/$TABLE_REL" ;;
+    unchanged-table)
+      anchor='Deployments needing later work'
+      printf '\nChanged neighboring prose.\n' >> "$REPO/$TABLE_REL" ;;
+    *)
+      perl -pi -e 's/Deployments needing later work/Unplanned deployments caused by production incidents/' "$REPO/$TABLE_REL" ;;
+  esac
+  case "$label" in
+    foreign-owner)
+      firing_path='skills/terminal-cli-dev/references/zz-fixture-definition.md'
+      cp "$REPO/$TABLE_REL" "$REPO/$firing_path" ;;
+    duplicate) printf '\n%s\n' "$anchor" >> "$REPO/$TABLE_REL" ;;
+    inline-comment) perl -pi -e 's/Unplanned deployments caused by production incidents/<!-- Unplanned deployments caused by production incidents -->/' "$REPO/$TABLE_REL" ;;
+    multiline-comment) perl -0777 -pi -e 's/\n\| Metric/\n<!--\n| Metric/; $_ .= "-->\n"' "$REPO/$TABLE_REL" ;;
+    backtick-fence) perl -0777 -pi -e 's/\n\| Metric/\n```markdown\n| Metric/; $_ .= "```\n"' "$REPO/$TABLE_REL" ;;
+    tilde-fence) perl -0777 -pi -e 's/\n\| Metric/\n~~~markdown\n| Metric/; $_ .= "~~~\n"' "$REPO/$TABLE_REL" ;;
+    raw-html) perl -0777 -pi -e 's/\n\| Metric/\n<script>\n\n| Metric/; $_ .= "<\/script>\n"' "$REPO/$TABLE_REL" ;;
+    raw-html-open-line) perl -0777 -pi -e 's/\n\| Metric/\n<script\n| Metric/; $_ .= "<\/script>\n"' "$REPO/$TABLE_REL" ;;
+    processing-instruction) perl -0777 -pi -e 's/\n\| Metric/\n<?xml\n| Metric/; $_ .= "?>\n"' "$REPO/$TABLE_REL" ;;
+    cdata) perl -0777 -pi -e 's/\n\| Metric/\n<![CDATA[\n| Metric/; $_ .= "]]>\n"' "$REPO/$TABLE_REL" ;;
+    declaration) perl -0777 -pi -e 's/\n\| Metric/\n<!DOCTYPE\n| Metric/; $_ .= ">\n"' "$REPO/$TABLE_REL" ;;
+    closed-cdata) perl -0777 -pi -e 's/\n\| Metric/\n<![CDATA[\nclosed example\n]]>\n\n| Metric/' "$REPO/$TABLE_REL" ;;
+    html-block) perl -0777 -pi -e 's/\n\| Metric/\n<div>\n| Metric/; $_ .= "<\/div>\n"' "$REPO/$TABLE_REL" ;;
+    indented-code) perl -pi -e 's/^\|/    |/' "$REPO/$TABLE_REL" ;;
+    no-header) perl -ni -e 'print unless /^\| (Metric|---)/' "$REPO/$TABLE_REL" ;;
+    header-anchor) perl -0777 -pi -e 's/\| Metric \| Definition \| Source \|/| Unplanned deployments caused by production incidents | Definition | Source |/; s/\n\| Incident deployment ratio[^\n]*\n/\n/' "$REPO/$TABLE_REL" ;;
+    no-red) : ;;
+  esac
+  local status='RED-baseline' observed='yes'
+  if [ "$label" = no-red ]; then status='semantic-control'; observed='no'; fi
+  printf '| Fixture definition table %s | `downstream-executor` | behavioral-evidence: %s; observed-failure: %s; result-class: failure; firing-path: file:%s#%s | `updated` | `product-rd-workflow/SKILL.md` definition correction |\n' "$label" "$status" "$observed" "$firing_path" "$anchor" >> "$REGISTER"
+  commit_case "definition table $label"
+  run_gate
+  assert_rc "$rc" "$expected" "definition table $label"
+  if [ "$expected" = 1 ]; then
+    if [ "$label" = no-red ]; then
+      assert_contains 'impact_chain_behavior_evidence_missing' "$out" "definition table $label: $out"
+    else
+      assert_contains 'impact_chain_firing_path_missing' "$out" "definition table $label: $out"
+    fi
+  fi
+}
+definition_table_case accepted 0
+definition_table_case closed-cdata 0
+for definition_control in surviving-anchor unchanged-table foreign-owner duplicate inline-comment multiline-comment backtick-fence tilde-fence raw-html raw-html-open-line processing-instruction cdata declaration html-block indented-code no-header header-anchor no-red; do
+  definition_table_case "$definition_control" 1
+done
+
+# Evidence is not its own firing surface. Keep the anchor only in the locator
+# itself so uniqueness cannot accidentally reject the self-certifying row.
+new_case case-ref-definition-table-self-register
+printf '\nFixture bookkeeping note, with no new enforcing rule.\n' >> "$REPO/skills/skill-extraction-workflow/references/validation-and-landing.md"
+printf '\n| Rule | Owner | Behavior | Status | Evidence |\n| --- | --- | --- | --- | --- |\n' >> "$REGISTER"
+printf '| Fixture self-citing table | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; firing-path: file:skills/skill-extraction-workflow/references/source-register.md#SELF-REGISTER-DEFINITION-ANCHOR | updated | `skill-extraction-workflow/SKILL.md` bookkeeping edit |\n' >> "$REGISTER"
+commit_case "source register cannot certify its own firing path"
+run_gate
+assert_rc "$rc" 1 "source register must not be its own firing surface"
+assert_contains 'impact_chain_firing_path_missing' "$out" "self-register refusal must name the firing-path boundary"
+
 # A purely DESCRIPTIVE list line ("always exposes" — no imperative/prohibitive
 # verb) is not an enforcing rule; the widened verb list must not admit it.
 new_case case-ref-descriptive-always-firing-path
@@ -1583,6 +1656,6 @@ assert_rc "$rc" 1 "a directory masquerading as SKILL.md must not read as a prese
 assert_contains "platform-observability/SKILL.md" "$out" "the masqueraded owner must be named"
 
 assert_rc "$full_check_runs" 1 "fixture suite must retain exactly one full checker wiring case"
-assert_rc "$gate_runs" 97 "all remaining impact-chain fixtures must run the standalone gate"
+assert_rc "$gate_runs" 118 "all remaining impact-chain fixtures must run the standalone gate"
 
 echo "test_check_ccl_impact_chain_refscripts: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_controlled_escalation_pins.sh

@@ -21,9 +21,10 @@ fail() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
 
 tmp_root="$(mktemp -d "${TMPDIR:-/tmp}/controlled-escalation-pins.XXXXXX")"
 trap 'rm -rf "$tmp_root"' EXIT
-# The fixture asserts only on files under skills/, and derives its repo root
-# from its own location three levels up — copying skills/ preserves both.
+# The fixture reads skills/ and the cross-host bootstrap, deriving its repo
+# root from its own location three levels up. Preserve both input trees.
 cp -R "$repo_root/skills" "$tmp_root/skills"
+cp -R "$repo_root/agent-context" "$tmp_root/agent-context"
 copy_fixture="$tmp_root/$fixture_rel"
 copy_ref="$tmp_root/$ref_rel"
 [[ -f "$copy_fixture" && -f "$copy_ref" ]] || fail "copy is missing the fixture or the reference"