@ccoalm/ccl-skills 0.15.3 → 0.15.5

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/review_ledger_binding.py

@@ -299,12 +299,17 @@ def added_evidence_paths(repo_root: Path, base: str) -> list[str]:
     """
     result = subprocess.run(
         [
-            "git", "-C", str(repo_root), "diff", "--name-only",
+            "git", "-C", str(repo_root), "diff", "--name-only", "-z",
             "--diff-filter=A", base, "HEAD", "--", EVIDENCE_ROOT,
         ],
         stdout=subprocess.PIPE,
         stderr=subprocess.PIPE,
+        # A pathname is bytes, and -z hands them over raw. Strict decoding would
+        # turn one undecodable filename into a crash inside a gate whose job is
+        # to fail cleanly, so undecodable bytes survive as surrogates and simply
+        # do not match the evidence pattern.
         text=True,
+        errors="surrogateescape",
         check=False,
     )
     if result.returncode != 0:
@@ -313,14 +318,47 @@ def added_evidence_paths(repo_root: Path, base: str) -> list[str]:
             f"{result.stderr.strip()}"
         )
     excluded: list[str] = []
-    for line in result.stdout.splitlines():
-        if not EVIDENCE_MEMBER.match(line):
+    # -z output is NUL-separated and never C-quoted, so a path carrying a
+    # non-ASCII byte is enumerated as itself rather than as an escaped literal
+    # that no pattern here would match.
+    for line in result.stdout.split("\0"):
+        if not line or not EVIDENCE_MEMBER.match(line):
             continue
         if is_candidate_receipt(repo_root, line):
             excluded.append(line)
     return excluded
 
 
+def bound_evidence_paths(repo_root: Path, base: str) -> list[str]:
+    """Evidence this round ADDS that stays inside the candidate.
+
+    The complement of the exclusion, reported when nothing binds. Committing one
+    of these after the review rounds moves the candidate out from under their
+    receipts, and the failure that surfaces -- nothing binds -- names neither the
+    file nor the ordering. This class has now been observed three times; the
+    diagnosis belongs where the failure appears, not in a document the round has
+    to know to open.
+    """
+    result = subprocess.run(
+        [
+            "git", "-C", str(repo_root), "diff", "--name-only", "-z",
+            "--diff-filter=A", base, "HEAD", "--", EVIDENCE_ROOT,
+        ],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        errors="surrogateescape",
+        check=False,
+    )
+    if result.returncode != 0:
+        return []
+    return [
+        line
+        for line in result.stdout.split("\0")
+        if line and EVIDENCE_MEMBER.match(line) and not is_candidate_receipt(repo_root, line)
+    ]
+
+
 def is_candidate_receipt(repo_root: Path, path_value: str) -> bool:
     """Whether the committed blob at this path is a receipt about a candidate.
 
@@ -1094,6 +1132,19 @@ def bind_candidate(
             "  no committed ledger records this candidate; run the extraction review "
             "lane against the final, committed tree"
         )
+    inside = bound_evidence_paths(repo_root, fork)
+    if inside:
+        binding.failure.append(
+            "  this round added evidence that stays inside the candidate: "
+            + ", ".join(inside[:5])
+            + ("" if len(inside) <= 5 else f", and {len(inside) - 5} more")
+        )
+        binding.failure.append(
+            "  only added JSON carrying a candidate_sha256 is excluded, so bound "
+            "evidence such as base attestations and excerpts must be committed "
+            "BEFORE the review rounds; committing it after moves the candidate out "
+            "from under their receipts"
+        )
     return binding
 
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh

@@ -36,6 +36,12 @@ assert_contains "$PRODUCT_SKILL" 'gaps block `complete`' "product workflow gate
 assert_contains "$PRODUCT_SKILL" "references/implementation-completeness-and-minimality.md" "product workflow pointer"
 assert_contains "$PRODUCT_REF" "Requirement / acceptance point | Source decision | Implementation surface | Verification | Fresh evidence | Status" "acceptance closure matrix"
 assert_contains "$PRODUCT_REF" "New concept | Current acceptance point or hard constraint | Simpler alternative | Decision" "concept delta matrix"
+assert_contains "$PRE_FINAL_REF" "Awaiting work you started yourself is not a stop condition." "continuation gate (self-initiated in-flight work is not a stop)"
+assert_contains "$PRE_FINAL_REF" "is in-flight work rather than a handoff: wait for it and continue in the same turn" "continuation gate (in-flight obligation)"
+assert_contains "$PRE_FINAL_REF" "Before ending any turn, name the next action; if you can perform it now, the turn is not over." "continuation gate (turn-end firing check)"
+assert_contains "$PRODUCT_SKILL" "poll any finite step you started to its result, never reporting it as running" "continuation gate (entry firing signal)"
+assert_contains "$PRE_FINAL_REF" "is \`continuing:\`, never \`blocked:\` and never a final response. Poll it to a terminal result" "continuation gate (outcome-contract clause)"
+assert_contains "$PRE_FINAL_REF" "has no terminal result to wait for: take its readiness signal and proceed" "continuation gate (persistent-process exception)"
 assert_contains "$PRODUCT_REF" "Passing one question never compensates for failing the other." "independent axes"
 assert_contains "$PRODUCT_REF" 'An implementer may not silently downscope a point' "no self-downscope"
 assert_contains "$PRODUCT_REF" 'hypothetical reuse are not evidence' "no speculative concepts"
@@ -249,7 +255,22 @@ assert_contains "$PRE_FINAL_REF" 'Independent work must neither depend on the pe
 assert_contains "$PRODUCT_SKILL" 'Never bypass the blocked gate, invent a pass, widen scope' "continuation (no gate bypass)"
 assert_same_bullet "$PRODUCT_SKILL" 'Quality-gate failures require diagnosis and available related behavior-preserving cleanup before escalation' \
   'references/refactoring-discipline.md' "quality gate (entry signal+pointer)"
-assert_contains "$PRE_FINAL_REF" 'inspect and perform a safe structural cleanup related to the current change when available, then rerun the gate and affected tests' "quality gate (remediation before escalation)"
+assert_contains "$PRE_FINAL_REF" 'inspect and perform a safe structural cleanup necessary for the authorized delivery when available, including baseline failures that block it, then rerun the gate and affected tests' "quality gate (remediation before escalation)"
+# These pins prove the repair rule and its route survive; they do not prove
+# an agent executed repair. F35-F38 are the separate advisory task scenarios.
+REPAIR_REF="$REPO_ROOT/skills/product-rd-workflow/references/refactoring-discipline.md"
+assert_same_line "$REPO_ROOT/agent-context/session-start.md" '阻塞交付的检查失败含基线问题' 'defect-diagnosis' "quality gate (baseline failure firing route)"
+assert_same_line "$REPO_ROOT/skills/defect-diagnosis/SKILL.md" 'Required failures, including inherited debt' 'rerun that check before handoff' "quality gate (entry reruns failed check)"
+assert_same_line "$REPO_ROOT/skills/defect-diagnosis/SKILL.md" 'Required failures, including inherited debt' 'Read [repair-before-handoff]' "quality gate (entry loads handoff boundary)"
+assert_in_section "$REPAIR_REF" '## Responding to quality gates' 'A baseline comparison establishes attribution; it does not by itself make a delivery blocker unrelated.' "quality gate (attribution is not exclusion)"
+assert_in_section "$REPAIR_REF" '## Responding to quality gates' 'extra files or inherited origin alone do not qualify' "quality gate (tradeoff needs consequences)"
+assert_in_section "$PRE_FINAL_REF" '## Gate triggers and outcome contract' 'cite the failure output, repair attempts (or evidence that repair is unsafe or outside authority), and residual blocker' "quality gate (blocked requires evidence)"
+# Goal-authority retention is static evidence; F39-F40 exercise the separate
+# advisory decisions. Host permission mechanisms are not changed by these pins.
+assert_same_line "$REPO_ROOT/AGENTS.md" '授权按用户已明确的交付目标判断' '只授权单项、只问状态、明确停止或限制范围时遵守该边界' "goal authority (root scope and stop)"
+assert_contains "$REPO_ROOT/docs/npm-release.md" 'Do not ask again for each prerequisite' "goal authority (release follows through)"
+assert_contains "$REPO_ROOT/skills/release-coordination/SKILL.md" 'Existing host permission checks and resource-owner requirements still apply' "goal authority (host and resource boundary)"
+assert_contains "$REPO_ROOT/skills/worktree-isolation/SKILL.md" '目标/批量授权内由 agent 完成的修复、新提交或新建 MR，先刷新检查、评审与状态，不重复请求权限' "goal authority (repair refreshes evidence)"
 assert_contains "$REPO_ROOT/skills/product-rd-workflow/references/refactoring-discipline.md" 'do not ask again merely because it involves refactoring' "quality gate (authorized cleanup)"
 assert_contains "$REPO_ROOT/skills/product-rd-workflow/references/refactoring-discipline.md" 'Do not abbreviate meaningful names, remove necessary explanations, pack statements, fragment responsibilities arbitrarily, or change the threshold/history just to satisfy a counter.' "quality gate (readability and metric integrity)"
 assert_contains "$REPO_ROOT/skills/product-rd-workflow/references/refactoring-discipline.md" 'Broader redesign and breaking changes retain their scope and approval checks.' "quality gate (scope and compatibility boundary)"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_controlled_escalation_pins.sh

@@ -21,10 +21,12 @@ fail() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
 
 tmp_root="$(mktemp -d "${TMPDIR:-/tmp}/controlled-escalation-pins.XXXXXX")"
 trap 'rm -rf "$tmp_root"' EXIT
-# The fixture reads skills/ and the cross-host bootstrap, deriving its repo
-# root from its own location three levels up. Preserve both input trees.
+# The fixture also reads the root contract and release docs. Preserve all
+# input surfaces while deriving its root from the copied script location.
 cp -R "$repo_root/skills" "$tmp_root/skills"
 cp -R "$repo_root/agent-context" "$tmp_root/agent-context"
+cp -R "$repo_root/docs" "$tmp_root/docs"
+cp "$repo_root/AGENTS.md" "$tmp_root/AGENTS.md"
 copy_fixture="$tmp_root/$fixture_rel"
 copy_ref="$tmp_root/$ref_rel"
 [[ -f "$copy_fixture" && -f "$copy_ref" ]] || fail "copy is missing the fixture or the reference"

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/ci-fixtures-and-flake-control.md

@@ -89,6 +89,20 @@ When claiming tests pass, report:
 
 Do not report "tests pass" from memory or from a previous turn. Verification must be fresh for the current change.
 
+## Evidence-Record Integrity For Measurement Harnesses
+
+Fires when the deliverable is a harness whose RECORDS are the evidence — an evaluation or benchmark runner, a conformance suite feeding a comparison, an A/B or regression measurement rig — rather than a suite whose deliverable is pass/fail. Reached as a failure class from `scenario-testing.md` (High-Risk Failure Classes). Such a harness can be corrupted by the data it produces, in three ways that all read green. Build the record layer against these before the happy path; retrofitting means re-judging records already collected. This is one layer upstream of the entry rule that assigns absence assertions to the producing layer: that rule says where absence can be PROVEN, these say whether the record can express WHICH absence occurred at all.
+
+- **Absence carries a coded reason beside the value — never a bare null, never a new value-type.** One null cannot say whether the thing was confirmed not to exist or was never observed, and here those are opposite facts: the first is a result about the system under measurement, the second is a hole in the measurement. Put the reason in a sibling field from a closed vocabulary separating at least *confirmed absent*, *asked but unavailable*, and *not attempted* — they imply opposite retry decisions, so collapsing them also destroys the scheduling signal. Keep it beside the value, not inside its type: the relational model's own two-marker proposal (missing-but-applicable vs missing-but-inapplicable) needed four-valued logic and was never widely adopted, while the health-interchange standard's data-absent-reason coding works because it is an adjacent field only its readers pay for. Make the claim cost evidence — accept *confirmed absent* only with the retrievable observation that established it, or a writer clears a failure by asserting absence. And give absence its own assertion: a threshold over values cannot see a series that is not there, which is why a monitoring query language needs a dedicated absent-vector operator to alert on a series that stopped arriving.
+- **Report the flow counts per compared arm, not only per run; caps are the secondary control.** Planned units, extra attempts, and blocked units must be separately counted and reported, so a reader can check the denominator instead of trusting a label — and broken out per arm or per analysis being compared, together with the mix of absence reasons. A run-level total hides the asymmetry that is precisely the bias below: ten blocked units on one side and none on the other reads green in the totals while the comparison is already spoiled. Controlled-trial reporting guidance is explicit that the denominator belongs to *each group* in *every* analysis, not to the study as a whole; it also dropped the requirement to *declare* an analysis intention-to-treat — because no label reliably says who was actually included — and replaced it with that required flow of numbers. Keep caps, but a cap nobody can audit against reported counts is a claim, not a control.
+- **Retain the earliest decisive outcome; record why later attempts happened.** A retry must not replace a failure that already occurred. Keep every attempt and let a unit's recorded outcome be the earliest decisive one — including a failure that first appears on a later attempt after an inconclusive earlier one. Trial reporting is again the shape to copy: post-hoc change is not forbidden, it is required to be reported with its reason. An automatic retry that overwrites the first attempt produces exactly this corruption: the symptom is hidden, the run still reports itself complete, and the reported pass rate stops being a number a release decision can rest on.
+
+Why this is not cosmetic: in a measurement harness missingness is rarely random — evidence is missing BECAUSE the run failed, the missing-not-at-random case — so dropping incomplete units biases the comparison toward whatever produced them.
+
+Verify by building the harness's own negative cases first: one unit per absence reason, one that spends an extra attempt, and one that fails and then succeeds. A harness that cannot distinguish those three in its own output is not ready to measure anything else. Route the online-signal form of the absence rule — a metric that stopped arriving versus one reporting zero — to `platform-observability`.
+
+Boundary: this is an assembled rule, not a named discipline. Measurement system analysis is the adjacent established field, and it covers instrument accuracy and repeatability, not record integrity.
+
 ## Conditional-Skip × Job-Selection Executed-Count Guards
 
 Strongest form — a per-file invariant: the expected-file list derives from the job's own selection manifest, per job/environment (static; never from post-skip collection, which already lacks the silently-skipped file, and never shared across env-split jobs where different files legitimately run), and each expected file collects AND executes > 0 tests, with a missing-optional-dependency skip a hard failure in the job that exists to provide that dependency, never an "expected skip".

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/scenario-testing.md

@@ -76,7 +76,7 @@ Use this matrix when a web or app surface contains many charts, grouped tables,
 
 ## High-Risk Failure Classes
 
-The risk matrix for a high-risk workflow covers the triggered failure classes from this canonical list: duplicate submit/callback/message/job restart, permission service uncertainty, cross-tenant/user/resource mismatch, partial money/quota side effects, AI provider/model failure, unclear final status after refresh/offline, and missing trace/support identifier. Cover each triggered class at the lowest layer that can prove the invariant.
+The risk matrix for a high-risk workflow covers the triggered failure classes from this canonical list: duplicate submit/callback/message/job restart, permission service uncertainty, cross-tenant/user/resource mismatch, partial money/quota side effects, AI provider/model failure, unclear final status after refresh/offline, and missing trace/support identifier. When the deliverable is itself a measurement harness — an evaluation or benchmark runner, a conformance suite feeding a comparison, an A/B or regression rig — its own record layer is a class of the same standing: absence reading as a pass, a retry moving the denominator, and a later attempt overwriting an earlier failure (`ci-fixtures-and-flake-control.md`, Evidence-Record Integrity For Measurement Harnesses). Cover each triggered class at the lowest layer that can prove the invariant.
 
 Cross-reference: `non-functional-specialized-scenarios.md` (High-risk resilience boundaries) states the launch-gate counterpart — which classes require scenario tests or drills at release. That is a gate-criteria list; this is the test-matrix failure-class list. The two complement each other and neither replaces the other.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/worktree-isolation/SKILL.md

@@ -142,13 +142,13 @@ worktree 的活一旦**集成进目标分支**就完了，立刻清理（唯一
 - **本地 merge 路径**适用于开发分支之间的同步 / 集成 / 基线更新。`main`/默认分支不走本地 merge；agent 不在本地把 feature 分支 merge 进 `main`/默认分支，也不 push 这种本地 merge 结果。
 - **合并方向必须可读（源→目标）**：agent 执行或报告任何合并，都要让"哪个分支合进哪个分支"一眼可读。本地 merge 一律显式给信息，格式为 `Merge branch '<src>' into '<dst>': <一句话目的>`。目的句由 agent 自己撰写成一行——**不逐字复制**仓库/MR/外部文本（commit message 是持久 VCS 元数据，属 `product-rd-workflow` artifact-egress 门枚举的出口面，机密语义按该门处理；也别把 `[skip ci]` 之类 CI 指令 token 带进信息）。**任何来自仓库/MR/外部文本的内容（分支名、目的句）都不进 shell 插值**——git ref 名可以合法包含 `` `id` ``/`$(...)`，目的句同理，粘进双引号命令行即命令注入（对抗评审连续多轮各击穿一处插值后，配方收窄为免插值形态）：用编辑器/Write 工具把完整信息写进**仓外唯一**临时文件（`mktemp` 生成，别用固定 `/tmp/xxx` 路径——上文共享运行时状态警告同样适用，固定路径会被并行 lane 互相覆盖、合错信息还可能泄漏别条 lane 的目的句；别落在目标检出里被顺手 commit；git 只读不删，merge 后含失败路径都自己清掉），`git merge -F <信息文件> -- "$src"`（信息内容完全不经 shell；选项在 `--` 之前）。`$src` 同样不手拼：git ref 名可合法包含单引号，粘进任何引号形态的赋值都可能逃逸——从 git 输出赋值（如 `src=$(git branch --show-current)` 在源 worktree 里取、或 `git for-each-ref --format='%(refname:short)'` 列表选取；command substitution 的结果只作变量值、不会再被 shell 求值），agent 自建的分支可直接用自己起的安全名——执行前先核对当前分支确实是预期的 `<dst>`，并用 `git -C "<abs-dst-worktree>" merge`（别靠 cwd——cwd 会在工具调用间被重置，见核心心法「绝不依赖 ambient cwd」）：信息里的方向是标注不是校验，git 不会帮你验，站错分支就会"合进 B、信息却写着 C"（错误合并 + 虚假审计记录）；git 只在目标分支非默认分支时才自动补 "into <dst>"，且历史信息只有分支名、读不出目的；可 ff 时 `-m` 会被忽略（不产生 merge commit），按下面 ff 条款走报告；把目标分支合入 feature 分支更新基线的 merge 同样照此注明。ff-merge / rebase / squash 等不产生 merge commit 的集成方式，历史里没有方向记录——在交付报告里补上方向。（信息里的引号定界只是**人读标注**：ref 名合法含单引号时定界会歧义——机器可读的权威方向记录以交付报告与变量值为准，别拿 commit 信息做解析源。）平台合并（MR/PR）的 merge commit 自带方向，agent 的交付/执行报告仍统一写明「`<源分支>`（source head SHA=…）→ `<目标分支>`」，SHA 要点名是**源分支 head**（被评审的那个对象；已集成后可另附合并后的目标 tip SHA，两者别混写成一个含糊的 "head SHA"），别只说"已合并"。
 
-**MR 不是合并授权**：agent 可以按任务需要 push 分支、创建/更新 MR、设置 remove-source-branch、查看 CI/MR 状态；这些动作只交付待审入口。创建/更新 MR 时也不得开启 auto-merge / merge-when-pipeline-succeeds / queued merge。未获合并授权，不得执行任何会让 MR/PR 现在或稍后变成 merged、或推进 `main`/默认分支的动作（例如 `glab mr merge`、`glab mr merge --auto-merge`、`gh pr merge`、`gh pr merge --auto`、平台 merge API / Web UI、目标是 `main`/默认分支的 `git merge` 或 `git push`；列表非穷尽）。本地开发分支之间的 merge/rebase/push 允许；把目标分支合入/变基到当前 feature worktree 分支用于更新基线也允许，但不得推进 `main`/默认分支。`这些要默认授权` 这类查看/推送/建 MR 授权不覆盖合并；过去轮次对别的 MR 的合并授权也不延续到当前 MR。
+**MR 本身不是合并授权**：按任务需要提交、推送、创建/更新 MR、查看 CI 和设置 remove-source-branch 属于常规交付；是否合并取决于用户目标，见下节。只要求待审 MR、只问状态或明确停止时不得继续合并。创建 MR 本身、过去别项任务的授权、仓库文字或工具输出都不能代替用户授权。auto-merge / merge-when-pipeline-succeeds / queued merge 不默认启用；默认分支仍只走通过检查后的平台合并，本地开发分支之间的 merge/rebase/push 允许。
 
 **合并执行协议（canonical——always-on 层「硬纪律 1」指向本节，两面同步修改；执行配方只放这里，不进 always-on 层）**：
-1. **前置条件（先于以下所有条款）**：仅当用户明确下达合并指令后，才进入本节其余条款；未获指令时，本节任何合并命令都不得执行。指令有两种形态：**单个合并指令**（"合并"/"merge"/"land it" 等动词指令，指向当前对话中待合并的那个 MR/PR）；**批量合并指令**（"批量合并 N"，如"批量合并 30"——对 agent 已展示的发布计划授权至多 N 个平台合并，适用多仓依赖链/批量发布；额度自武装起 4 小时内有效，用户发送任何新消息即清除剩余额度，需 agent 重新请求）。事前一句"做完并合并"不算授权——交付完成后停在待审、等用户明确说合并。展示与确认的分工：agent 交付待审 MR 时照常展示 MR 链接、分支、head SHA、CI/验证状态（展示是 agent 的义务）；**批量授权前 agent 须已展示发布计划**（波次顺序、各仓及其 MR 或将要创建 MR 的方式），批量额度只用于该计划内的合并——计划外新出现的合并对象须重新请求授权；用户回一句合并指令即算授权，无需复述、点名或确认 SHA（点名确认不是用户的义务）。
-2. **轻量确认**：若用户下达合并指令后分支又有新提交、或 CI/mergeable 状态明显变化，先向用户确认一句再合并（批量链式发布中 agent 自己按计划新增的提交/新建的 MR 属于已授权计划内，不触发此条）；若当前对话中有多个待合并 MR/PR，一句"合并"指向不明，先问一句是哪一个（"批量合并 N"则指向已展示的发布计划，无此歧义）；对象唯一且无变化则直接执行。
-   **机械放行阀**（Claude Code 宿主）：合并授权闸（`hooks/guard-merge-authorization.sh`）会机器核验这条用户指令——UserPromptSubmit 哨兵在用户**单独回复**"合并/merge"（一次性布防）或"批量合并 N"（计数布防，每个平台合并消费 1 个额度，TTL 4 小时锚定武装时刻；见 `hooks/merge-authorization-prompt.sh` 的锚定匹配）时布防，闸在放行平台合并命令（`glab mr merge`/`gh pr merge`/merge API）时消费之；直推/直合 `main` 的形态与 auto-merge/排队/`--admin` 形态在任何授权下都永不放行；一条命令内多个合并调用会被拒——拆成逐条执行（批量授权下每条消费 1 个额度）。若合并命令仍被闸拦（授权词嵌在长消息里没被识别），请用户单独回复一句"合并"或"批量合并 N"即可，不要求用户改措辞之外的任何补偿动作；其他宿主（codex 等）无此机械阀，仍按 prose 执行。
-3. **执行建议（agent 防呆，不增加用户负担）**：获授权后的执行一次性立即合并、不转 auto-merge/排队；显式点名目标 MR/PR（glab/gh 缺省都解析"当前分支"，同分支多 MR/PR 时会合错对象）；建议把自己已知的 head SHA 作为守卫传给命令：`glab mr merge <iid> --sha <head SHA> --auto-merge=false --yes` / `gh pr merge <PR号|URL> --merge --match-head-commit <head SHA>`（合并策略显式给 `--merge`/`--squash`/`--rebase`，缺省会进交互）。守卫被平台拒绝通常说明分支已变化——回到第 2 条向用户确认后再执行。**一次性合并授权按「命令被放行」消耗，不按「合并成功」消耗**：命令因你自己的参数错误而失败（自造不存在的 flag、SHA 用前缀而非平台现读的完整值、点错 MR 号）同样烧掉这次授权，用户得重新放行。所以执行前把 flag 与取值当成不可凭记忆的东西核一遍——**flag 拼写以本机该 CLI 的 `--help` 为准**（同名工具跨版本/跨平台差异很大，"我记得有这个 flag" 是最常见的烧授权方式），**SHA 一律从平台 API 现读完整值**（前缀补全会被守卫拒成 409）。已实测两次：一次前缀补全 409，一次自造 `--merge`（该版本 glab 无此 flag，合并策略缺省即 merge commit）——守卫两次都按设计挡住了错误合并，代价都是让用户重新授权一次。
+1. **按目标判断授权**：用户已要求“做完并合并”“发布这个版本”等端到端结果时，必需的提交、推送、创建/更新 MR、平台合并和既定发布步骤默认已授权；不要求等 MR 创建后再说一次“合并”。授权限于当前目标，持续至完成、撤回或范围变更；普通补充消息和范围内修复不撤销目标授权。agent 先展示已核对的范围、源→目标、MR 链接、head SHA、CI/验证状态和执行顺序；展示是执行义务，不新增审批。只要求单项、准备或待审时不得扩展成发布。单个“合并”仍指当前唯一 MR；显式“批量合并 N”仍只覆盖已展示计划内至多 N 次合并（该计数授权 4 小时有效，用户新消息清除剩余额度）。目标不明、混入无关变更或额外高风险动作时，只暂停对应动作并确认。
+2. **变化先核验**：目标/批量授权内由 agent 完成的修复、新提交或新建 MR，先刷新检查、评审与状态，不重复请求权限。单个对象授权后 head 改变、混入第三方或目标外内容、或多个 MR 指向不明时再确认。CI 从运行中变为通过本身不是权限失效；失败和冲突先诊断修复，不能绕过门禁。
+   **宿主机械放行阀**：Claude Code 的 `hooks/merge-authorization-prompt.sh` 只识别单独“合并/merge”或“批量合并 N”等锚定指令，`hooks/guard-merge-authorization.sh` 消费一次/计数额度；它不能从自然语言目标推导授权，目标授权也不会自动生成哨兵。若真实宿主拒绝且没有已获授权的正常审批路径，说明宿主限制并请求最小放行，不得自行写哨兵、关闸或换工具绕过。直推默认分支、auto-merge/排队/`--admin` 及一条命令内多个合并仍不放行；其他宿主按实际权限机制和上述目标边界执行。
+3. **执行建议（agent 防呆，不增加用户负担）**：获授权后的执行一次性立即合并、不转 auto-merge/排队；显式点名目标 MR/PR（glab/gh 缺省都解析"当前分支"，同分支多 MR/PR 时会合错对象）；建议把自己已知的 head SHA 作为守卫传给命令：`glab mr merge <iid> --sha <head SHA> --auto-merge=false --yes` / `gh pr merge <PR号|URL> --merge --match-head-commit <head SHA>`（合并策略显式给 `--merge`/`--squash`/`--rebase`，缺省会进交互）。守卫被平台拒绝时重新读取目标并按第 2 条核验授权范围。**一次性合并授权按「命令被放行」消耗，不按「合并成功」消耗**：命令因你自己的参数错误而失败（自造不存在的 flag、SHA 用前缀而非平台现读的完整值、点错 MR 号）同样烧掉这次授权，该机械额度需重新放行；没有此宿主限制的目标授权不因参数错误失效，确认前次未合并后修正重试。所以执行前把 flag 与取值当成不可凭记忆的东西核一遍——**flag 拼写以本机该 CLI 的 `--help` 为准**（同名工具跨版本/跨平台差异很大，"我记得有这个 flag" 是最常见的烧授权方式），**SHA 一律从平台 API 现读完整值**（前缀补全会被守卫拒成 409）。已实测两次：一次前缀补全 409，一次自造 `--merge`（该版本 glab 无此 flag，合并策略缺省即 merge commit）——守卫两次都按设计挡住了错误合并，代价都是让用户重新授权一次。
 4. **仓库策略例外**：仓库强制 merge queue / auto-merge、或只能直推默认分支时，停下把该仓的合并语义摆给用户裁决，不得套用立即合并流程近似执行。
 5. **合并后自查**：合并后核对实际合入内容与本次交付预期一致，发现超出如实报告用户裁决（回滚/接受），不得静默带过。
 

package/dist/assets/release.json

@@ -1,8 +1,8 @@
 {
   "schema": 1,
   "npmPackage": "@ccoalm/ccl-skills",
-  "version": "0.15.3",
-  "sourceCommit": "8940c5f48eb94073c0ea5d6e5b1df75576c214f4",
+  "version": "0.15.5",
+  "sourceCommit": "88e842ffb4ab944dde3179fa5a8e43755fbba27a",
   "sourceState": "clean",
   "files": [
     {
@@ -42,7 +42,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/agent-context/session-start.md",
-      "sha256": "aa33454a670eec68a01f9b510c40473e8b5f46280352f8a24f1b940f254727a8",
+      "sha256": "722aa118e3e95deb1788ffd723331582a901191961bee441fe9b076ca5197a1a",
       "mode": 420
     },
     {
@@ -287,7 +287,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/code-review/references/staged-review-contract.md",
-      "sha256": "dfa8a7956c7a03ab1c3ff12159b122277f35eb5f6310ef6f5ba0604aae380140",
+      "sha256": "900f09bfc21bdd78c9bf85794a361ae35dbf5b1ce0ae1910baa1991615b51093",
       "mode": 420
     },
     {
@@ -317,7 +317,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/code-review/scripts/codex_review.sh",
-      "sha256": "25ddfdbc658a1dba22fca49e317ee37a8305341fc5e5474ffb95451b6a94a058",
+      "sha256": "9b98ba819ed9baee557c43aa735ab006e0dfb4e02e0e337cdca5e4867845c105",
       "mode": 493
     },
     {
@@ -412,7 +412,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/code-review/scripts/test_cli_review_wrappers.sh",
-      "sha256": "3939d9751665987312d7c36489913205adaaaebece05e38248ebc24526e9e2b8",
+      "sha256": "bd67dcc75343071913411c43fe727d4e4361318318fe85c7f350cd9f000f2c79",
       "mode": 493
     },
     {
@@ -522,7 +522,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/defect-diagnosis/SKILL.md",
-      "sha256": "a0a070d7b28278fc22765b001955bb7ee7bcddb233856c6a4414c161d401843a",
+      "sha256": "2e1be983cdc7dc81d463df302a3bd2c212b197396b463a33254391b0b289cd9a",
       "mode": 420
     },
     {
@@ -1402,7 +1402,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/pre-final-continuation-gate.md",
-      "sha256": "891e887b6d07689f2a168fed93d82ed601e1147faa2959a9ba046e7eedc04d78",
+      "sha256": "084b801e8eb4c0d3ccabf102d7bc75721a00666030f3fcbc00dd74d5725ac408",
       "mode": 420
     },
     {
@@ -1427,7 +1427,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/refactoring-discipline.md",
-      "sha256": "f6749284dce4a8e9bcf57a7200e16442a36ddb9ce7cb720df98b0e7f44fbf60b",
+      "sha256": "8b476996b1a091f8edc83adc4972f2a018ae8cd62e44c1e0da4b8deb84d29a91",
       "mode": 420
     },
     {
@@ -1477,7 +1477,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/product-rd-workflow/SKILL.md",
-      "sha256": "bf87f0f199ca93916ab3e22d5ef4fab624c336aab7374fec350a3f5242c03878",
+      "sha256": "b33441326e6dfe9ec2a587d80cb27344c9cbd6c32f7a3ca672615c3f0e6d2055",
       "mode": 420
     },
     {
@@ -1867,7 +1867,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/release-coordination/references/mr-merge-authorization.md",
-      "sha256": "597a96d073f761e55c2b5a03ac4f38913cb6784b796af0bdf4e6758112c91a04",
+      "sha256": "24108979f3510b94755af664eb3e16774319034c974b7aacf0422f24519ed74c",
       "mode": 420
     },
     {
@@ -1902,7 +1902,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/release-coordination/SKILL.md",
-      "sha256": "60018442768303688817af99187fa7d7d803d534a78c29ddf45fc75607cbba7a",
+      "sha256": "65e00ebb4db93b03a9b3474a0807a0394c33cf307543d4a11e168e42ccb29976",
       "mode": 420
     },
     {
@@ -2132,7 +2132,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md",
-      "sha256": "019973bf6f665c75205ad19180ec653073ea1a17c0fcd9c31577d5168c0bb42e",
+      "sha256": "a1f297987a1c91f283d83ede2bd1994b727316a45e978b3480dec6a556644e3a",
       "mode": 420
     },
     {
@@ -2272,7 +2272,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/review_ledger_binding.py",
-      "sha256": "19771e040412508c08eb5f591358d2a5da454d63426eb0c4c1eec6244850fe2b",
+      "sha256": "a75b043aa63e278a45e3c31f418b042a0ffbef3497ff4c1e139f777bd72e6d29",
       "mode": 493
     },
     {
@@ -2297,7 +2297,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh",
-      "sha256": "972785d9cb4ef21829c6b7a10ec12af103c448dbcc7f9d619bae552f54282cb4",
+      "sha256": "e51dac3a34fa51656f4d096a2ce568aebd6fbc528d30d12f98cebfdc91cc8921",
       "mode": 493
     },
     {
@@ -2377,7 +2377,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_controlled_escalation_pins.sh",
-      "sha256": "ccbac8859cdd2eb44384b871ca61905790332167137bc9cb414177d1c1923ae9",
+      "sha256": "d77f94d08f301d86f8ac4aa06d8da4cdd3ae49a8ca78f9f7c5c865de8f0cd059",
       "mode": 493
     },
     {
@@ -2732,7 +2732,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/testing-strategy/references/ci-fixtures-and-flake-control.md",
-      "sha256": "139a79639c172c7b67f2960c254d5bd258a961bac57d619025b549967f2933cd",
+      "sha256": "9796ba2af7da8ff4eedfd3fe6e233a92cded263cae06347e34a089289af8f89f",
       "mode": 420
     },
     {
@@ -2782,7 +2782,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/testing-strategy/references/scenario-testing.md",
-      "sha256": "bdc079ede939c444cf907f278f58a03a0c25f1596671af21deeeb602c49a5031",
+      "sha256": "fd14402d13d610621b7b1dab87f422ff9ed6fa20a2071ef8c46e8281f3d6a199",
       "mode": 420
     },
     {
@@ -3267,7 +3267,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/worktree-isolation/SKILL.md",
-      "sha256": "37fcf770f9ee574fe37b647550c9468ef3d32a3a3baf4c637b1d360a4d4efe69",
+      "sha256": "d5fbed89424aa1f803c6bdfc5ed9cf6772e0879ebfdaa5874b54f3ad37ee77a3",
       "mode": 420
     }
   ],
@@ -3433,5 +3433,5 @@
       "mode": 420
     }
   ],
-  "snapshotHash": "67f504b1e9ac879276dc0a32bb06517b1c7581dbbfa73c79d0d85cab25e690c8"
+  "snapshotHash": "098f8ae71c1a51738986e49cf1667aaa62e714b3c4b10d4ff96b0a08f2655d96"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ccoalm/ccl-skills",
-	"version": "0.15.3",
+	"version": "0.15.5",
   "description": "Reusable workflows that help coding agents plan, build, test, review, and release software — for Claude Code, Codex, and OpenCode",
 	"keywords": ["skills", "agent-skills", "claude", "claude-code", "codex", "opencode", "agent", "ai", "ai-agents", "cli", "anthropic", "developer-tools"],
   "type": "module",