@ccoalm/ccl-skills 0.15.1 → 0.15.3

package/README.md

@@ -23,7 +23,7 @@ Restart your CLI so it reloads the skills.
 
 `install` configures every host it detects. The package carries an immutable snapshot of the skills, agent context, plugin manifests, and runtime hooks, so installation needs no Git checkout.
 
-Requirements: Node.js 20 or later, macOS or Linux, and at least one host CLI — Claude Code, Codex 0.133.0 or later, or OpenCode.
+Requirements: Node.js 20 or later, macOS or Linux, and at least one host CLI — Claude Code, Codex with working `plugin marketplace list` and `plugin list` commands, or OpenCode. Codex availability is checked through these commands rather than its version number.
 
 Run it without a global install:
 
@@ -62,6 +62,8 @@ ccl-skills uninstall --yes   # remove host assets
 
 Limit any operation to one host with `--host claude`, `--host codex`, or `--host opencode`. Add `--json` for machine-readable output.
 
+For `--host codex`, unreadable public plugin state returns exit `3` with `host-state-unknown`; a missing CLI or failed capability probe returns `4`. If that host failure occurs with a pending journal, recovery is deferred: exit `5` with `partial-journal` retains the journal and records `details.hostFailure`. Restore the CLI or readable public plugin state, then rerun the command. Other outcomes can share these exit codes, so inspect the JSON status as well.
+
 `update` and `uninstall` are previews unless `--yes` is supplied. `update --yes` first upgrades the global npm package to `@latest`, then asks the freshly installed CLI to refresh host assets. Set `CCL_SKILLS_SKIP_SELF_UPDATE=1` for an assets-only refresh; `--allow-downgrade` always uses the currently invoked package without installing `@latest` first.
 
 After `ccl-skills uninstall --yes`, remove the CLI package itself with `npm uninstall --global @ccoalm/ccl-skills` if it is no longer needed.

package/dist/assets/marketplace/plugins/ccl-skills/agent-context/session-start.md

@@ -41,5 +41,5 @@
 - **完整优先**：能多花几分钟做完就别交半成品；但"完整"是把该做的做完，不是镀金或扩范围（详见 product-rd / feature-risk-router 的 gate）。
 - **持久件锚定（长/多阶段/委托/跨会话工作）**：锚到持久件、别只靠对话或临时任务卡——交付级 spec/plan → product-rd-workflow、委托进度 → multi-agent-delegation、技能/流程教训 → skill-extraction-workflow 的 source-register；更新/取代既有件，别复制（只提醒，不是第二个 plan 门，深度归 product-rd）。
 - **大文件/大技能分块读（读取易丢中段）**：单次读取**输出**超过 ~256 行 / 10KB 时，codex 等工具会头尾截断、丢中段（[openai/codex#6426](https://github.com/openai/codex/issues/6426)），常有截断标记但极易忽略、某些场景无标记（无标记 ≠ 读全）。需要看全时（完整评审 / 下"没有 X"结论 / 加载技能照做）分块读（每块 < ~200 行**且** < 8KB）并确认**中段**已读到，别一次整文件读就当看全（定点 `sed -n 'Np'` 不受限）。写码/测试/评审同样适用，详见 skill-extraction blocked-source-read。（`project_doc_max_bytes` 只管 project-doc 预算、不影响工具输出截断，不是绕过手段。）
-- **委托三方模型评审前先自审到收敛（任何开发都适用）**：codex/Claude 等是**最后一层对抗性兜底，不是主要发现机制**。先做**可证明的实现者自检**到预期通过再交评审——想清楚影响结果的分支/路径/状态，自审 security/privacy/authority/数据丢失轴；别把未收敛的活丢过去，再拿 findings 当清单陷进 review→改→再 review 的循环。深浅按对应 owner/风险闸定，不无差别全量、也不给窄/未触发改动强加 product-rd self-review row。自审**不缩短/不软化**那道闸（仍是一次全量对抗性 pass，按 diff 给对抗 prompt、别附"确认我的结论"导向），findings 仍按门处置不可降级。详见 product-rd 验证门 + skill-extraction `dual-track-review-gate.md`（shared-skill dual-track 的 persisted row 与有效性规则按 extraction-quickstart）。
+- **开发完成自动评审（含窄修复和测试代码）**：实现者先自检分支/失败路径及 security/privacy/authority/数据丢失风险，按 `testing-strategy` 完成适用测试，再自动调用 `code-review`，无需用户提醒；执行与收尾见 `skills/code-review/references/development-completion.md`。自审、读技能或说“下一步评审”都不算独立评审。按风险定深度；窄任务不额外套 product-rd self-review row，既有高风险/shared-skill gate 不降级。评审覆盖实际 diff，采用对抗问题，不要求确认实现者结论；findings 先核实再修复或有证据处置，避免循环追逐建议。用户明确跳过时记录 skipped；当前候选已有有效独立评审则复用。详见 product-rd 验证门 + skill-extraction `dual-track-review-gate.md`。
 </ccl-skills-routing>

package/dist/assets/marketplace/plugins/ccl-skills/skills/app-cross-platform-dev/SKILL.md

@@ -5,7 +5,7 @@ description: Use when designing, implementing, reviewing, debugging, testing, or
 
 # App Cross-Platform Dev
 
-Use this skill for mobile app and cross-platform client engineering. It covers Flutter, React Native, native Android, and native iOS. It does not own mini-programs, React web, backend service design, product requirements, or visual design rules.
+Use this skill for mobile app and cross-platform client engineering. It covers Flutter, React Native, native Android, and native iOS. It does not own mini-programs, React web, backend service design, product requirements, or visual design rules. After code/test edits, self-check and invoke `code-review` automatically before completion.
 
 ## Routing
 
@@ -15,7 +15,7 @@ Use this skill for mobile app and cross-platform client engineering. It covers F
 - Use `web-react-dev` for React web and browser-specific client work.
 - Use Go or Python backend skills for server contracts, persistence, queues, auth services, and API ownership.
 - Use `testing-strategy` to choose the test layer; return here for Flutter, React Native, Android, or iOS implementation details.
-- Use `test-artifact-management` when the ask is about generating structured test cases from a Feishu requirements doc or codebase and tracking them in Feishu Bitable before implementation begins.
+- Use `test-artifact-management` for structured Feishu Bitable cases derived from Feishu requirements or code before implementation.
 - Use `defect-diagnosis` first for bugs, failed tests, flaky behavior, crashes, rendering regressions, build failures, or store/release symptoms.
 - For money, quota, permission, tenant/user data, high-impact AI, repeated submit, async finality, or support-traceable incidents, apply `product-rd-workflow` high-risk resilience gates before treating the app flow as complete.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: code-review
-description: Use when an implementation needs an independent CLI reviewer or adversarial challenger, routing across Claude Code, Kimi, OpenCode, or Codex according to local availability, model-family independence, and the user's client order; also covers Claude-only bounded consultation and requests such as code review, Claude review, Kimi review, OpenCode review, second opinion, 找茬, 唱反调, or 第二意见. Skip 某个改动/提交还有没有价值、值不值得修这类交付裁决 → product-rd-workflow：本技能执行评审、找缺陷与风险，不裁决交付价值。
+description: Use automatically after changing code or executable tests, before completion or landing handoff, even without a user review request. Obtain independent CLI review/challenge across Claude Code, Kimi, OpenCode, or Codex by capability, model-family independence, and the user's client order; also covers Claude-only consultation, code review, Claude review, Kimi review, OpenCode review, second opinion, 找茬, 唱反调, or 第二意见. Skip 改动/提交值不值得修这类交付裁决 → product-rd-workflow；本技能执行评审，不裁决交付价值。
 ---
 
 # Code Review
 
-Use this skill from Claude, Codex, OpenCode, or another compatible agent to obtain an independent, attributable review or adversarial challenge. The job is not to delegate implementation. The caller supplies the model family that produced the candidate so the router can exclude same-family reviewers.
+After changing code or executable tests, invoke this skill automatically before completion or landing handoff; follow `references/development-completion.md`. Compatible hosts obtain independent review/challenge here, never delegate implementation. The caller supplies the implementer's model family so the router excludes same-family reviewers.
 
 ## Modes
 
@@ -13,7 +13,7 @@ Choose the smallest useful mode:
 
 - **Review mode**: normal pre-merge or plan review. Find blocking or materially misleading issues.
 - **Challenge mode**: adversarial pass modeled after `codex challenge`. Try to break the diff or decision by finding production failure paths.
-- **Complete mode**: local exact-candidate deep-self-review checkpoint after a passed final round. It invokes no reviewer and grants no human or merge authority.
+- **Complete mode**: local exact-candidate checkpoint after passing review or bound source refutations under the staged contract. It invokes no reviewer and grants no merge authority.
 - **Consult mode**: ask Claude a bounded question when no diff or plan review is needed.
 
 Use challenge mode when the user asks for "challenge", "poke holes", "try to break it", "adversarial", or when the change touches money, permissions, privacy, compliance, tenant/user data, production rollout, high-impact AI, architecture, economics, or IA.
@@ -74,7 +74,7 @@ Positive challenge capacity opens it at index 1; budget zero is untracked.
 The sole release/high-risk budget-zero exception is a controller-proved
 `markdown-punctuation-only` review: it requires `wording_only_boundary`, permits
 no `complete`, and rejects an author assertion alone (recipe:
-`references/staged-review-contract.md`). After a clean tracked
+`references/staged-review-contract.md`). After a clean/source-refuted tracked
 challenge, `complete` may close early and preserve unused rounds. Every result
 exposes controller-owned `self_review_gate`; an outstanding checkpoint blocks
 only external review or completion, not implementation or tests. Even a passed
@@ -215,10 +215,11 @@ Run the script by path while keeping `--cwd` pointed at the product repository u
 
 **The packet is the reviewer's whole world — compose it deliberately.** Review and challenge are built packet-bounded — Claude runs `--tools ""` with no `--add-dir`, and the other wrappers run in an isolated run workspace or a packet-only read surface. Treat the packet as the reviewer's whole world when deciding coverage: it is the only content bound by the packet hash and scanned before egress, so anything outside it is neither reliably visible to the reviewer nor covered by the verdict; a diff-only packet surfaces defects visible inside the changed lines and little else, and `--paths` only narrows it further. Whatever is absent from the packet is unreachable, not merely missed: a contradiction with an unchanged sibling clause, drift against a carrier outside the diff, or a silent weakening of upstream wording cannot be found by a reviewer who never saw the other side — that is the packet's shape, not the reviewer's weakness.
 
+- Codex permits frozen-packet read/search; see [tool boundaries](references/development-completion.md#review-tools).
 - To widen the packet, assemble it yourself and pass `--diff-file`: it replaces base-derived generation, is mutually exclusive with `--base`/`--paths`, and must name a regular file (no symlink or hardlink) holding text without NUL bytes. Worth adding beyond the diff — the canonical rule or contract text the changed lines must not contradict, the sibling clauses in the same file, the derived carriers that restate the change (commit message, MR/PR body), and the actual output of a gate or script under review. The gate hard-caps a packet at 200,000 bytes; split a larger candidate as described in the next bullet.
 - A verdict covers exactly the packet it was taken on, because the recorded packet hash is the reviewed identity. Within a packet, added context sits on top of the candidate diff and never in place of part of it. A candidate too large for one packet is split by file group or risk class into a partition that still covers the whole candidate — every part in some packet, none dropped — each partition's verdict recorded against its own packet hash, and the candidate-wide claim withheld until every partition is conclusive; one partition's `no blocking findings` is never a verdict on the landing candidate. Cross-partition contradictions are unreachable by construction, so repeat the shared canonical context in every partition's packet and review anything that spans partitions as its own packet.
 - Added context egresses to the selected reviewer exactly like the diff does, through the same credential tripwire — which catches machine-detectable secrets only. Paste rule text, carriers, and tool output; never paste credentials or material you would not send to that provider.
-- A finding that the input is insufficient to judge the change is an input defect, not a candidate defect: widen the packet and rerun that lane rather than editing the candidate to satisfy it. A reviewer reporting that the input is insufficient to judge the change is reporting an input defect — add the missing context and rerun that lane, do not edit the candidate to satisfy it.
+- A finding that the input is insufficient to judge the change is an input defect, not a candidate defect: widen the packet and rerun that lane rather than editing the candidate to satisfy it.
 
 When intentionally reviewing `code-review` itself, override the resolver from the ccl-skills repo under review before invoking the gate:
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/development-completion.md

@@ -0,0 +1,26 @@
+# Automatic review after development
+
+This transition applies across implementation owners, including narrow fixes and executable-test changes. Do not wait for the user to request review. Use the actual diff to classify the work: an implementation diff triggers this transition regardless of the task label. Read-only investigation, status answers and design-only work retain their owning workflow; they do not acquire an implementation-review requirement merely by using a development skill.
+
+## Before invoking review
+
+1. Recover the current task, actual diff, scope and authorization. Changing the implementation or scope reopens this check; an earlier plan review cannot discharge review of the resulting code.
+2. Finish proportionate implementer self-review and affected verification. A failed quality check calls for available in-scope diagnosis and cleanup under [refactoring discipline](../../product-rd-workflow/references/refactoring-discipline.md#responding-to-quality-gates); preserve behavior and readability, rerun the check, and escalate only a remaining real blocker. Use `testing-strategy` to select tests: changed named test properties require the killing-mutation walk on disposable or restore-guarded resources; when the same contract has two implementations or paths, use differential/equivalence checks with bounded, asserted known differences. Record a concrete applicability or unavailable-evidence reason when a test family does not run. Do not force a full mutation framework or differential suite onto an unrelated change.
+3. Reuse a terminal independent review only when it covers the current candidate and satisfies the applicable owner gate, reviewer independence and required depth. Record the receipt location and its candidate identifier (commit or diff/packet digest), then compare with the current candidate using the owning gate's binding rules; HEAD alone cannot cover uncommitted edits. A different or missing candidate identifier cannot discharge review. A loaded skill, self-review, planned command, unfinished handle or unverified prose claim is not that evidence. A native subagent result counts only when the owning gate accepts its independence and evidence; it never silently substitutes for a required CLI receipt.
+4. An explicit user instruction to skip review controls this task: record `skipped`, not `passed`, and preserve any separate landing restrictions. Record its original wording and current scope; a superseded or unrelated instruction is not a skip for this task. Do not ask for confirmation of ordinary review already within the authorized development task. User client restrictions and existing confidentiality boundaries still control reviewer selection; capability matters, not a numeric CLI or skill version.
+
+## Invoke and finish
+
+When no valid current review discharges the requirement, invoke `scripts/review_gate.sh` from this skill's actual installed/source directory with the current candidate, real implementer family, user client order and applicable risk tags. Follow the entrypoint's script contract; narrow work may use its derived-default plan. Use ordinary review for ordinary development; challenge and additional owner gates apply when triggered. Do not inflate a narrow repair into a product-design or shared-skill review ceremony.
+
+Invoke the reviewer in the same turn once self-checks are ready. Await an existing handle to its terminal result; do not stop at “review next,” start a duplicate process, or present timeout, invalid output or authentication failure as pass. Handle operational failures using the existing bounded recovery rules; a stopped reviewer lane does not stop safe independent work or authorize completion.
+
+Verify each finding against the actual call path and evidence. Fix confirmed defects and rerun affected checks; record evidenced rejection, deferral or acceptance under the owning gate. Pre-existing issues and optional suggestions do not automatically expand the task. After a tracked review and challenge on the unchanged candidate, when every finding is source-refuted, run the local disposition completion path in [the staged contract](staged-review-contract.md#mechanical-self-review-gate). Keep the raw findings; do not rerun merely to obtain zero findings or reset a review budget. Budget exhaustion limits reviewer calls, so finish available disposition, self-review and validation work in the same turn. A changed candidate still needs the owning gate's renewed review.
+
+Before completion or landing handoff, report the actual diff classification and a concrete reason if review is inapplicable. Support that classification with the change-inspection command and result, including untracked implementation files. Report the actual review outcome and candidate it covers, relevant tests and their results, skips, unresolved findings and remaining restrictions. A failed or missing required review leaves review/completion pending. Review does not grant permission to commit, push, merge, publish or deploy.
+
+## Review tools
+
+Packet-only allows read-only tools over the frozen material. Codex exposes pathless `read_packet` and `search_packet`; the parser checks returned content against the same packet and requires completed calls. Each server read checks the packet hash. Shell execution is disabled by effective capability, and inherited MCP servers are disabled only for this invocation. Unsupported capability falls back without a CLI version requirement. A read-only sandbox alone does not disable commands.
+
+Installed owner skills supply review lenses, not permission to execute development workflows or fetch references outside the packet. Add missing source context to the packet through the entrypoint's packet-composition contract. Read/search does not expand the verdict's coverage beyond its recorded packet.

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/staged-review-contract.md

@@ -8,10 +8,10 @@ The controller has three modes:
 
 Explore/build may configure `challenge_budget=0..4`; release/high-risk requires
 at least one challenge unless the exact candidate qualifies for the
-proof-bound wording-only single-review exception below. The initial review consumes Agent round 1, so total
-Agent-autonomous external review is at most five rounds. Human-requested review
-is outside this budget and must be attributed by the consuming trusted platform.
-The budget is a ceiling, not a quota: after a clean tracked challenge, local
+proof-bound wording-only single-review exception below. The initial review consumes chain round 1;
+each bounded chain uses at most five rounds. Necessary task-scoped review after a
+checkpoint inherits existing task authority; attribute explicit human round requests separately.
+The budget is a ceiling, not a quota: after a clean or fully source-refuted tracked challenge, local
 `complete` may close the chain early. It preserves unused-round count but sets
 `autonomous_review_allowed=false`; release/high-risk still requires at least one
 challenge before this early close is eligible.
@@ -283,7 +283,7 @@ Multi-round Agent automation supplies `review_chain_id`, a contiguous
 `autonomous_review_index` in `1..5`, and every earlier result through ordered
 `--prior-review-result-file` arguments. Prior rounds may contain findings and
 older candidate hashes; they remain consumed. Candidate edits, commits, plan
-refreshes, mode changes, and renamed invocations do not reset Agent authority.
+refreshes, mode changes, and renamed invocations never erase spending or broaden task authority.
 An initial `review` with positive challenge capacity must start this chain at
 index 1; an untracked initial review is single-round and therefore uses budget 0.
 
@@ -324,7 +324,7 @@ Envelope `schema_version` is `3`; a legacy `2` envelope predates the recorded
 scope and is rejected, which requires restarting an in-flight chain. Every
 prior round must retain the same controller digest, owner-selection source,
 selected owner names, and selected-owner digest. Missing, substituted,
-inconclusive, reordered, renamed-chain, or fourth-round input fails before any
+inconclusive, reordered, renamed-chain, or over-budget input fails before any
 provider runs. Scope drift returns `review_scope_changed` and requires deep
 self-review plus explicit task reframing; it does not silently create a new
 Agent budget. An untracked challenge is one-off advisory evidence; it cannot
@@ -332,8 +332,8 @@ enter a later Agent round or satisfy the local completion checkpoint.
 
 Two consequences follow from those stable bindings and must be planned for before round 1:
 
-- The selected-owner digest hashes each selected owner package's current working tree, and owners derive from the candidate's own paths — so a candidate edit inside any selected owner package invalidates every prior receipt and the next tracked round fails `review_chain_invalid`. For a self-hosted candidate (a skill-repo diff editing the package that owns it) that is nearly every applied fix — one confined to files outside every selected owner drifts only the candidate hash and may continue in-chain: "do not reset Agent authority" promises no continuation, and the in-chain tolerance for older candidate hashes is reachable only while the fix stays outside its selected owners.
-- A chain restarted after such a break re-enters the same cumulative Agent budget and must never be counted as fresh authority; the bounded restart recipe for the extraction lane (batched dispositions, cross-chain round accounting, full-context first packet, terminal disposition at the cap) is owned by the extraction workflow's dual-track gate reference.
+- The selected-owner digest hashes each selected owner package's current working tree, and owners derive from the candidate's own paths — so a candidate edit inside any selected owner package invalidates every prior receipt and the next tracked round fails `review_chain_invalid`. For a self-hosted candidate (a skill-repo diff editing the package that owns it) that is nearly every applied fix — one confined to files outside every selected owner drifts only the candidate hash and may continue in-chain: in-chain tolerance for older candidate hashes applies only while fixes stay outside selected owners. Necessary recovery uses fresh bindings after the task checkpoint below.
+- A chain restarted after such a break never erases cumulative spending or task history. An existing task includes necessary fixes, tests and review by default. At exhaustion, first disposition findings from source, run deep self-review and tests, and change the failed method or add missing evidence before another necessary bounded sequence. Record `continuation_basis=existing-task-scope`, the original authority reference and scope, the reason and changed method/evidence, cumulative rounds, and old/new sequence links in the caller-owned task artifact. Preserve every earlier receipt, focus and disposition; do not add this field to CLI arguments or runtime receipts. Existing per-chain and consuming-owner sequence bounds still apply; the extraction recipe remains in its dual-track gate reference. No repeated calls solely to obtain an empty verdict, invented human round requests, history reset or ignored user cost/round/stop limit is allowed.
 
 The controller is stateless and prevents accidental/cooperative resets only. A
 trusted host or platform must retain the ledger when hostile local callers are in
@@ -370,10 +370,34 @@ allowing refreshed self-review conclusions and evidence, and is the Agent path t
 round index, prior-result hashes, and prior challenge focuses. It is not a human
 waiver or merge authorization.
 
+For an unchanged candidate with a conclusive tracked review and challenge,
+`complete` also accepts `--finding-dispositions-file`. Supply every earlier raw
+receipt with ordered `--prior-review-result-file` arguments and the final one
+with `--completion-review-result-file`. The UTF-8 JSON has `schema_version: 1`,
+`candidate_sha256`, ordered `review_result_sha256` hashes including the final
+receipt, and `dispositions`. Each disposition contains `receipt_sha256`, the
+canonical-JSON `finding_sha256`, `disposition: "source_refuted"`, and a non-empty
+`evidence` array naming the first-hand source or failure-path counter-evidence.
+Every original finding occurrence must appear exactly once. Within one receipt,
+findings with identical canonical content share one hash-pair identity in
+first-seen order; retain every raw entry unchanged. Different content or a
+different receipt remains a separate occurrence. Missing history,
+changed candidates, inconclusive results, open findings and risk acceptance do
+not qualify. A code fix with changed bytes requires renewed review.
+
+This local checkpoint records `completion_basis=source_refuted_findings`, the
+dispositions digest and resolved occurrence bindings; original external
+findings remain unchanged. A clean external result uses `external_pass`.
+Validation proves binding and coverage, not the truth of an evidence statement:
+the implementer must trace the cited source, and the judgment remains open to
+challenge. No budget is refreshed and no model is called. At the review cap,
+finish this local work instead of requesting another round solely to obtain an
+empty verdict. Unresolved findings still block completion, not independent work.
+
 ## Human and failure boundary
 
-Only an external authenticated platform action may prove human request, stop,
-resume, waiver, commit, or merge authority. A `review_waiver` clears only the
+Existing task scope covers necessary continuation; exhaustion alone creates no new grant.
+Only an external authenticated platform action may prove new human request, stop, resume, waiver, commit, or merge authority. A `review_waiver` clears only the
 review-process gate. A distinct exact-candidate `merge_authorization` is the
 human's final decision: CI may keep running and reporting every failed/pending
 gate, but none may block that authorized merge. Report
@@ -381,9 +405,9 @@ gate, but none may block that authorized merge. Report
 
 Provider/input/integrity failures stop that reviewer lane, not the whole task.
 Their stable action is `stop_reviewer_lane`, never the ambiguous `stop`.
-Budget exhaustion likewise stops only automatic reviewer calls. Continue local
-fixes, self-review, tests, and independent work; park only decision-dependent
-work. Enter `awaiting_human` only when no independent runnable work remains.
+Budget exhaustion triggers the method/authority checkpoint, not an automatic user handoff. Check legacy
+`human_decision_required` / `continuation_authorization_required` against existing task scope first.
+Continue necessary bounded review; enter `awaiting_human` only for a genuine missing decision, explicit user limit or authority outside that scope.
 
 The current result envelope is schema 3. The generic per-invocation `--timeout`
 keeps its 600-second default and accepts 5..1200 seconds; direct wrappers clamp

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/AGENTS.md

@@ -5,8 +5,11 @@ parsers for Claude, Kimi, OpenCode, and Codex.
 
 Rules:
 
-- Preserve no-tools posture and structured output validation. A malformed,
-  timeout, or inconclusive wrapper result is not a pass.
+- Preserve the packet boundary and structured output validation. A wrapper may
+  expose pathless read/search tools over its frozen, hash-bound packet; verify
+  their arguments, returned bytes and completed lifecycle. This does not permit
+  arbitrary commands or workspace access. A malformed, timeout, or inconclusive
+  wrapper result is not a pass.
 - **Never pin the parser to a CLI version's vocabulary.** `parse_probe_result.py`
   gates on *shape*, not on field/value names: the isolation proof is the exact
   `tools` allowlist plus the tool_use scan, which no init field can bypass.

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/codex_review.sh

@@ -140,10 +140,15 @@ CODEX_EXEC_HELP="$(timeout --kill-after=1s 5s "$CODEX_BIN_PATH" exec --disable h
 # supported lifecycle state: `features list` still prints removed keys, and a
 # removed or unknown-state row means `--disable hooks` may be a silent no-op
 # that lets user-trusted hooks run during packet-only review.
-CODEX_FEATURES_LIST="$(timeout --kill-after=1s 5s "$CODEX_BIN_PATH" features list 2>/dev/null)" \
+CODEX_FEATURES_LIST="$(timeout --kill-after=1s 5s "$CODEX_BIN_PATH" features list --disable hooks --disable shell_tool 2>/dev/null)" \
   || die_inconclusive codex_hook_disable_unavailable capability_missing true
-grep -Eq '^hooks[[:space:]]+(stable|under development|experimental)([[:space:]]|$)' <<<"$CODEX_FEATURES_LIST" \
+grep -Eq '^hooks[[:space:]]+(stable|under development|experimental)[[:space:]]+false[[:space:]]*$' <<<"$CODEX_FEATURES_LIST" \
   || die_inconclusive codex_hook_disable_unavailable capability_missing true
+# A read-only sandbox still exposes command execution. Disable the actual
+# shell surface, including its unified-exec implementation, before inference.
+# Check effective capability rather than a CLI release number or flag parsing.
+grep -Eq '^shell_tool[[:space:]]+(stable|under development|experimental)[[:space:]]+false[[:space:]]*$' <<<"$CODEX_FEATURES_LIST" \
+  || die_inconclusive codex_shell_disable_unavailable capability_missing true
 if [ -n "${CODEX_HOME:-}" ]; then
   SOURCE_HOME="$CODEX_HOME"
 else
@@ -240,6 +245,72 @@ fi
 DIFF_TEXT="$(cat "$DIFF_FILE" || exit 1; printf '\001')" \
   || die_inconclusive diff_read_failed local_tool_failure false
 DIFF_TEXT="${DIFF_TEXT%$'\001'}"
+PACKET_FILE="$RUN_ROOT/packet.txt"
+PACKET_SERVER="$SCRIPT_DIR/kimi_packet_mcp.py"
+[ -f "$PACKET_SERVER" ] && [ -r "$PACKET_SERVER" ] && [ ! -L "$PACKET_SERVER" ] \
+  || die_inconclusive packet_server_missing local_tool_failure false
+printf '%s' "$DIFF_TEXT" >"$PACKET_FILE"
+PACKET_SHA256="$(python3 - "$PACKET_FILE" <<'PY_HASH'
+import hashlib, sys
+from pathlib import Path
+print(hashlib.sha256(Path(sys.argv[1]).read_bytes()).hexdigest())
+PY_HASH
+)" || die_inconclusive packet_hash_failed local_tool_failure false
+MCP_CONFIG="$(python3 - "$PACKET_FILE" "$PACKET_SERVER" "$PACKET_SHA256" <<'PY_MCP_CONFIG'
+import json, sys
+values = [sys.argv[2], "--packet", sys.argv[1], "--sha256", sys.argv[3], "--allow-search"]
+print('mcp_servers={code_review_packet={command=' + json.dumps(sys.executable)
+      + ',args=[' + ','.join(json.dumps(value) for value in values)
+      + '],enabled=true,enabled_tools=["read_packet","search_packet"]}}')
+PY_MCP_CONFIG
+)" || die_inconclusive packet_config_failed local_tool_failure false
+# TOML overrides merge server tables. Disable inherited servers for this run
+# without changing user configuration, then verify the effective public list.
+CODEX_PACKET_CONFIG=(-c "$MCP_CONFIG" -c 'web_search="disabled"' -c 'approval_policy="never"')
+CODEX_HOME="$SOURCE_HOME" timeout --kill-after=1s 5s "$CODEX_BIN_PATH" mcp list --json "${CODEX_PACKET_CONFIG[@]}" >"$RUN_ROOT/mcp.json" 2>"$STDERR_FILE" \
+  || die_inconclusive codex_packet_tools_unavailable capability_missing true
+MCP_CONFIG="$(python3 - "$RUN_ROOT/mcp.json" "$MCP_CONFIG" <<'PY_MCP_OVERRIDES'
+import json, sys
+from pathlib import Path
+try:
+    rows = json.loads(Path(sys.argv[1]).read_text())
+    if not isinstance(rows, list):
+        raise ValueError()
+    disabled = []
+    for row in rows:
+        if not isinstance(row, dict) or not isinstance(row.get("name"), str) or not row["name"]:
+            raise ValueError()
+        if row["name"] != "code_review_packet":
+            disabled.append(json.dumps(row["name"]) + "={enabled=false}")
+    print(sys.argv[2][:-1] + "".join("," + entry for entry in disabled) + "}")
+except (OSError, ValueError, TypeError):
+    sys.exit(1)
+PY_MCP_OVERRIDES
+)" || die_inconclusive codex_packet_tools_unavailable capability_missing true
+CODEX_PACKET_CONFIG=(-c "$MCP_CONFIG" -c 'web_search="disabled"' -c 'approval_policy="never"')
+CODEX_HOME="$SOURCE_HOME" timeout --kill-after=1s 5s "$CODEX_BIN_PATH" mcp list --json "${CODEX_PACKET_CONFIG[@]}" >"$RUN_ROOT/mcp.json" 2>"$STDERR_FILE" \
+  || die_inconclusive codex_packet_tools_unavailable capability_missing true
+python3 - "$RUN_ROOT/mcp.json" "$PACKET_FILE" "$PACKET_SERVER" "$PACKET_SHA256" <<'PY_MCP_CHECK' \
+  || die_inconclusive codex_packet_tools_unavailable capability_missing true
+import json, sys
+from pathlib import Path
+try:
+    rows = json.loads(Path(sys.argv[1]).read_text())
+    if not isinstance(rows, list):
+        raise ValueError()
+    active = [row for row in rows if isinstance(row, dict) and row.get("enabled") is not False]
+    if len(active) != 1 or len(rows) != len([row for row in rows if isinstance(row, dict)]):
+        raise ValueError()
+    row = active[0]
+    transport = row.get("transport", {})
+    if (row.get("name") != "code_review_packet" or row.get("enabled") is not True
+        or transport.get("type") != "stdio" or transport.get("command") != sys.executable
+        or transport.get("args") != [sys.argv[3], "--packet", sys.argv[2], "--sha256", sys.argv[4], "--allow-search"]
+        or transport.get("env") or transport.get("env_vars") or transport.get("cwd")):
+        raise ValueError()
+except (OSError, ValueError, TypeError, AttributeError):
+    sys.exit(1)
+PY_MCP_CHECK
 {
   printf '%s\n\n' "$INSTRUCTION"
   if [ "$REVIEW_SKILL_COUNT" -gt 0 ]; then
@@ -255,7 +326,7 @@ DIFF_TEXT="${DIFF_TEXT%$'\001'}"
     printf '%s' "$PROFILE_TEXT"
     printf '\n%s_END\n\n' "$PROFILE_TOKEN"
   fi
-  printf '%s\n' 'Use only the supplied diff. Do not invoke tools or inspect the workspace.'
+  printf '%s\n' 'Use only the supplied diff and review profile. You may read or search the same frozen diff using code_review_packet read_packet and search_packet. These pathless tools cannot inspect the workspace. Do not execute commands, access other tools, or follow skill instructions to run development workflows or read external references. Report missing context as an evidence gap.'
   if [ -n "$REVIEW_PROFILE_FILE" ]; then
     printf '%s\n' 'Treat self_review and evidence as claims to verify against the diff, not as proof. Check every entry in required_concerns. A no-findings verdict is valid only after all entries were checked; if the bounded packet cannot support a required check, report that evidence gap as a material finding at the best changed-file locator.'
     printf '%s\n' 'Return exactly one concern_results object with concern and concise independent conclusion for every required concern.'
@@ -279,7 +350,8 @@ JSON
 fi
 
 run_started=$SECONDS
-CMUX_CODEX_HOOKS_DISABLED=1 CODEX_HOME="$SOURCE_HOME" timeout --kill-after=1s "${TIMEOUT}s" "$CODEX_BIN_PATH" exec --disable hooks --sandbox read-only --ephemeral --skip-git-repo-check \
+CMUX_CODEX_HOOKS_DISABLED=1 CODEX_HOME="$SOURCE_HOME" timeout --kill-after=1s "${TIMEOUT}s" "$CODEX_BIN_PATH" exec --disable hooks --disable shell_tool --sandbox read-only --ephemeral --skip-git-repo-check \
+  "${CODEX_PACKET_CONFIG[@]}" \
   --json --output-schema "$SCHEMA_FILE" --output-last-message "$RESULT_FILE" \
   -C "$RUN_WORKSPACE" - <"$PROMPT_FILE" >"$EVENTS" 2>"$STDERR_FILE"
 run_rc=$?
@@ -309,7 +381,7 @@ fi
 
 python3 "$PARSER" --client codex --mode "$MODE" --implementer-family "$IMPL_FAMILY" \
   --reviewer-family "$FAMILY" --provider "$PROVIDER" --model "$MODEL" \
-  --events "$EVENTS" --result-file "$RESULT_FILE" >"$PARSED_FILE"
+  --events "$EVENTS" --result-file "$RESULT_FILE" --packet "$PACKET_FILE" --packet-sha256 "$PACKET_SHA256" >"$PARSED_FILE"
 parser_rc=$?
 if [ "$parser_rc" -eq 0 ]; then
   native_skill_binding="not_requested"

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/kimi_packet_mcp.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Expose one SHA-256-bound review packet through a pathless stdio MCP tool."""
+"""Expose one SHA-256-bound review packet through pathless stdio MCP tools."""
 
 from __future__ import annotations
 
@@ -12,8 +12,11 @@ from typing import Any
 
 
 TOOL_NAME = "read_packet"
+SEARCH_TOOL_NAME = "search_packet"
 MAX_PAGE_BYTES = 48_000
 MAX_CHUNK_BYTES = 46_000
+MAX_QUERY_BYTES = 1_024
+MAX_SEARCH_RESULTS = 100
 
 
 def packet_bytes(path: Path, expected_sha256: str) -> bytes:
@@ -57,6 +60,84 @@ def tool_result(text: str, *, error: bool = False) -> dict[str, Any]:
     return {"content": [{"type": "text", "text": text}], "isError": error}
 
 
+def search_tool_definition() -> dict[str, Any]:
+    return {
+        "name": SEARCH_TOOL_NAME,
+        "description": (
+            "Find non-overlapping, case-sensitive literal substrings in the one "
+            "controller-frozen review packet. No regex or filesystem paths. "
+            "Query is at most 1024 UTF-8 bytes; byte_offset must be a UTF-8 "
+            "boundary. Returns byte offsets and 1-based line numbers, with "
+            "next_byte_offset for more matches or null when exhausted. "
+            "Use read_packet at a match offset to inspect its context."
+        ),
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "query": {"type": "string", "minLength": 1, "maxLength": MAX_QUERY_BYTES},
+                "byte_offset": {"type": "integer", "minimum": 0},
+                "limit": {"type": "integer", "minimum": 1, "maximum": MAX_SEARCH_RESULTS},
+            },
+            "required": ["query", "byte_offset", "limit"],
+            "additionalProperties": False,
+        },
+    }
+
+
+def search_packet(path: Path, expected_sha256: str, arguments: Any) -> dict[str, Any]:
+    if not isinstance(arguments, dict) or set(arguments) != {"query", "byte_offset", "limit"}:
+        return tool_result("invalid packet search arguments", error=True)
+    query = arguments.get("query")
+    byte_offset = arguments.get("byte_offset")
+    limit = arguments.get("limit")
+    if (
+        not isinstance(query, str)
+        or not isinstance(byte_offset, int)
+        or isinstance(byte_offset, bool)
+        or byte_offset < 0
+        or not isinstance(limit, int)
+        or isinstance(limit, bool)
+        or not 1 <= limit <= MAX_SEARCH_RESULTS
+    ):
+        return tool_result("invalid packet search arguments", error=True)
+    try:
+        needle = query.encode("utf-8")
+    except UnicodeEncodeError:
+        return tool_result("invalid packet search arguments", error=True)
+    if not 1 <= len(needle) <= MAX_QUERY_BYTES:
+        return tool_result("invalid packet search arguments", error=True)
+    try:
+        data = packet_bytes(path, expected_sha256)
+    except (OSError, ValueError):
+        return tool_result("packet binding changed", error=True)
+    if byte_offset > len(data):
+        return tool_result("packet search starts beyond end", error=True)
+    try:
+        data[:byte_offset].decode("utf-8")
+    except UnicodeDecodeError:
+        return tool_result("packet search starts inside a UTF-8 character", error=True)
+
+    matches = []
+    cursor = byte_offset
+    while len(matches) < limit:
+        found = data.find(needle, cursor)
+        if found < 0:
+            break
+        matches.append({"byte_offset": found, "line": data.count(b"\n", 0, found) + 1})
+        cursor = found + len(needle)
+    rendered = json.dumps(
+        {
+            "matches": matches,
+            "next_byte_offset": cursor if data.find(needle, cursor) >= 0 else None,
+            "total_bytes": len(data),
+        },
+        separators=(",", ":"),
+    )
+    if len(rendered.encode("utf-8")) > MAX_PAGE_BYTES:
+        return tool_result("packet search exceeds result bound", error=True)
+    return tool_result(rendered)
+
+
 def read_chunk(path: Path, expected_sha256: str, arguments: Any) -> dict[str, Any]:
     if not isinstance(arguments, dict) or set(arguments) != {"byte_offset", "max_bytes"}:
         return tool_result("invalid packet chunk arguments", error=True)
@@ -119,7 +200,9 @@ def response(request_id: Any, *, result: Any = None, error: Any = None) -> dict[
     return payload
 
 
-def handle(message: Any, path: Path, expected_sha256: str) -> dict[str, Any] | None:
+def handle(
+    message: Any, path: Path, expected_sha256: str, *, allow_search: bool = False
+) -> dict[str, Any] | None:
     if not isinstance(message, dict) or message.get("jsonrpc") != "2.0":
         return response(None, error={"code": -32600, "message": "Invalid Request"})
     request_id = message.get("id")
@@ -140,9 +223,17 @@ def handle(message: Any, path: Path, expected_sha256: str) -> dict[str, Any] | N
     if method == "ping":
         return response(request_id, result={})
     if method == "tools/list":
-        return response(request_id, result={"tools": [tool_definition()]})
+        definitions = [tool_definition()]
+        if allow_search:
+            definitions.append(search_tool_definition())
+        return response(request_id, result={"tools": definitions})
     if method == "tools/call":
         params = message.get("params")
+        if isinstance(params, dict) and allow_search and params.get("name") == SEARCH_TOOL_NAME:
+            return response(
+                request_id,
+                result=search_packet(path, expected_sha256, params.get("arguments")),
+            )
         if not isinstance(params, dict) or params.get("name") != TOOL_NAME:
             return response(request_id, result=tool_result("unknown tool", error=True))
         return response(
@@ -156,6 +247,9 @@ def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--packet", required=True)
     parser.add_argument("--sha256", required=True)
+    parser.add_argument(
+        "--allow-search", action="store_true", help="also expose bounded literal packet search"
+    )
     args = parser.parse_args()
     if not len(args.sha256) == 64 or any(ch not in "0123456789abcdef" for ch in args.sha256):
         parser.error("--sha256 must be a lowercase SHA-256 digest")
@@ -169,7 +263,7 @@ def main() -> int:
     for raw_line in sys.stdin:
         try:
             message = json.loads(raw_line)
-            payload = handle(message, path, args.sha256)
+            payload = handle(message, path, args.sha256, allow_search=args.allow_search)
         except (json.JSONDecodeError, UnicodeError):
             payload = response(None, error={"code": -32700, "message": "Parse error"})
         if payload is not None:

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/parse_cli_review.py

@@ -10,6 +10,7 @@ import re
 from typing import Any
 
 from concern_excerpt import bounded_reason_detail, concern_fields
+import kimi_packet_mcp as packet_tools
 from kimi_packet_mcp import MAX_CHUNK_BYTES
 
 
@@ -652,6 +653,18 @@ def audit_codex(
     def invalid(reason: str) -> dict[str, Any]:
         return invalid_model_output(args, reason, "\n".join(concern_fragments))
 
+    packet_path = getattr(args, "packet", None)
+    packet_sha256 = getattr(args, "packet_sha256", None)
+    if packet_path or packet_sha256:
+        try:
+            if not packet_path or not packet_sha256:
+                raise ValueError()
+            packet_tools.packet_bytes(Path(packet_path), packet_sha256)
+        except (OSError, ValueError):
+            return inconclusive(args, "Codex packet binding changed", "binding_mismatch", False)
+    pending_packet_calls: dict[str, tuple[str, Any]] = {}
+    completed_packet_calls: set[str] = set()
+
     for event in events:
         event_type = event.get("type")
         if event_type == "turn.completed":
@@ -678,6 +691,39 @@ def audit_codex(
                 attempted_tool=event_type,
             )
         item_type = item.get("type")
+        if item_type == "mcp_tool_call" and packet_path and packet_sha256:
+            tool = item.get("tool")
+            if item.get("server") != "code_review_packet" or tool not in {"read_packet", "search_packet"}:
+                return inconclusive(args, "Codex attempted a tool outside the frozen packet", "tool_boundary_violation", False)
+            reader = packet_tools.read_chunk if tool == "read_packet" else packet_tools.search_packet
+            expected = reader(Path(packet_path), packet_sha256, item.get("arguments"))
+            content = expected["content"]
+            if expected.get("isError") and content[0]["text"] == "packet binding changed":
+                return inconclusive(args, "Codex packet binding changed", "binding_mismatch", False)
+            if expected.get("isError") and content[0]["text"].startswith("invalid packet"):
+                return inconclusive(args, "Codex supplied arguments outside the packet tool schema", "tool_boundary_violation", False)
+            call_id = item.get("id")
+            signature = (tool, item.get("arguments"))
+            if (not isinstance(call_id, str) or not call_id or call_id in completed_packet_calls
+                or (call_id in pending_packet_calls and pending_packet_calls[call_id] != signature)):
+                return inconclusive(args, "Codex packet tool lifecycle is unverifiable", "transport_unverifiable", False)
+            if event_type != "item.completed":
+                if item.get("status") != "in_progress":
+                    return inconclusive(args, "Codex packet tool lifecycle is unverifiable", "transport_unverifiable", False)
+                pending_packet_calls[call_id] = signature
+                continue
+            result = item.get("result")
+            if not isinstance(result, dict):
+                return invalid("Codex packet tool returned no verifiable result")
+            if (result.get("content") != content or result.get("structured_content") not in (None, {})
+                or result.get("structuredContent") not in (None, {})):
+                return inconclusive(args, "Codex packet tool result did not match frozen bytes", "binding_mismatch", False)
+            allowed_statuses = {"completed", "failed"} if expected.get("isError") else {"completed"}
+            if item.get("status") not in allowed_statuses or (item.get("error") and not expected.get("isError")):
+                return invalid("Codex packet tool did not complete successfully")
+            pending_packet_calls.pop(call_id, None)
+            completed_packet_calls.add(call_id)
+            continue
         if item_type == "agent_message":
             item_text = item.get("text")
             if isinstance(item_text, str) and item_text.strip():
@@ -729,7 +775,7 @@ def audit_codex(
             )
         if event_type == "item.completed" and item_type == "agent_message":
             saw_completed_agent_message = True
-    if not saw_completed_agent_message or not saw_completed_turn:
+    if pending_packet_calls or not saw_completed_agent_message or not saw_completed_turn:
         return inconclusive(
             args,
             "Codex event stream lacked positive completion evidence",
@@ -926,6 +972,7 @@ def main() -> int:
     parser.add_argument("--model", default="")
     parser.add_argument("--events", required=True)
     parser.add_argument("--packet")
+    parser.add_argument("--packet-sha256")
     parser.add_argument("--packet-delivery", choices=("mcp", "inline"), default="mcp")
     parser.add_argument("--packet-receipt", default="")
     parser.add_argument("--result-file")