@ccoalm/ccl-skills 0.18.5 → 0.18.7

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_proposed_next.py

@@ -141,13 +141,190 @@ class ProposedNextTests(unittest.TestCase):
             self.payload['last_assistant_message'] = text
             self.assert_block(self.run_hook())
         for text in ('proposed-next: none — status only', '**proposed-next:** none — status only',
-                     'proposed-next: blocked: need an explicit decision',
-                     'proposed-next: none — awaiting approval',
-                     'proposed-next: none - waiting for a resource'):
+                     'proposed-next: none — all requested work is done and verified'):
             with self.subTest(text=text):
                 self.payload['last_assistant_message'] = text
                 self.assertEqual(self.run_hook(), {})
 
+    def assert_decision_recheck(self, payload):
+        result = self.run_hook(payload)
+        self.assert_block(result)
+        self.assertIn('Decision recheck', result['reason'])
+        self.assertIn('security', result['reason'])
+        self.assertIn('supplies no new goal or authorization', result['reason'])
+        self.assertEqual(self.run_hook(dict(payload, stop_hook_active=True)), {})
+
+    def test_user_dependent_stop_rechecks_the_blocker_once(self):
+        for events in ([], self.claude_load()):
+            self.events(events)
+            for text in ('proposed-next: blocked: need an explicit decision',
+                         'proposed-next: none — awaiting approval',
+                         'proposed-next: none - waiting for a resource',
+                         'proposed-next: none — 等待确认安全负责人'):
+                with self.subTest(text=text):
+                    self.assert_decision_recheck(dict(self.payload, last_assistant_message=text))
+
+    def test_permission_question_after_edits_rechecks_instead_of_formatting(self):
+        for events in (self.claude_load(), self.edit_events()):
+            self.events(events)
+            for text in ('Patch is ready. Should I proceed with the remaining tests?',
+                         'Done with step 1. Do you want me to continue?',
+                         '第一步已完成，是否继续？', '安全风险需要你决定，要不要我修改？',
+                         'Patch ready. **Should I proceed?**', '**是否继续？**',
+                         'Patch ready. __Should I proceed?__', '_是否继续？_',
+                         '***Should I proceed?***', '*是否继续？*',
+                         '**是否继续？**\nproposed-next: none — status only'):
+                with self.subTest(text=text):
+                    self.assert_decision_recheck(dict(self.payload, last_assistant_message=text))
+        self.events([])
+        for text in ('Should I proceed?', '是否继续？', '**Should I proceed?**', '_是否继续？_'):
+            self.payload['last_assistant_message'] = text
+            self.assertEqual(self.run_hook(), {})
+        self.events(self.edit_events())
+        self.payload['last_assistant_message'] = 'Done; checks passed.'
+        self.assertEqual(self.run_hook(), {})
+
+    def test_long_permission_lines_finish_within_hook_timeout(self):
+        self.events(self.edit_events())
+        prefix = 'Should I do this; ' * 60000
+        for suffix, expected in (('', None), ('continue?', 'block')):
+            with self.subTest(terminal_question=bool(suffix)):
+                payload = dict(self.payload, last_assistant_message=prefix + suffix)
+                result = subprocess.run(
+                    ['python3', str(self.hooks / 'host-input.py'), 'proposed-next'],
+                    input=json.dumps(payload), text=True, capture_output=True,
+                    cwd=self.root, timeout=5)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertEqual(result.stderr, '')
+                value = json.loads(result.stdout) if result.stdout else {}
+                self.assertEqual(value.get('decision'), expected)
+
+    def test_finished_none_states_are_not_waits(self):
+        self.events(self.claude_load())
+        for text in ('proposed-next: none — PR approved and merged',
+                     'proposed-next: none — tests confirm the fix',
+                     'proposed-next: none — permission tests added',
+                     'proposed-next: none — authorization module refactored',
+                     'proposed-next: none — status only; awaiting nothing',
+                     'proposed-next: none — 已确认完成',
+                     'proposed-next: none — 已批准并合并',
+                     'proposed-next: none — merged after your approval',
+                     'proposed-next: none — all done; let me know if you need more',
+                     'proposed-next: none — fixed the await bug in fetch()',
+                     'proposed-next: none — 修复了等待超时',
+                     'proposed-next: none — 审批流程已实现',
+                     'proposed-next: none — PR opened; awaiting review',
+                     "Done.\nLet me know if you'd like me to make any other changes.\nproposed-next: none — complete",
+                     'proposed-next: none — 完成，期待你的反馈', 'proposed-next: none — 已按你定义的接口实现',
+                     'proposed-next: none — merged based on your approval'):
+            with self.subTest(text=text):
+                self.assertEqual(self.run_hook(dict(self.payload, last_assistant_message=text)), {})
+
+    def test_more_user_waits_and_labelled_questions_are_rechecked(self):
+        self.events(self.claude_load())
+        for text in ('proposed-next: none — your call', 'proposed-next: none — needs sign-off',
+                     'proposed-next: none — 等你拍板', 'proposed-next: none — 需要你审批',
+                     'Patch ready. Should I push it?\nproposed-next: none — work is ready',
+                     'Ready to merge. OK to merge?', 'Should I proceed? Or stop?',
+                     'Should I push the branch?\nproposed-next: none — status only',
+                     'proposed-next: none — 待确认', 'proposed-next: none — pending approval',
+                     'proposed-next: none — decision pending', 'proposed-next: none — 负责人未定',
+                     'proposed-next: none — need the owner to sign off', 'proposed-next: none — 请选择方案 A 或 B',
+                     '已改完。继续？\nproposed-next: none — 改动已完成', '要不要我继续\nproposed-next: none — 改动已完成',
+                     'proposed-next: none — 由你决定', 'proposed-next: none — up to you',
+                     'proposed-next: none — need access to prod', 'Done — should I push?\nproposed-next: none — ready',
+                     '我可以继续吗？\nproposed-next: none — 改动已完成'):
+            with self.subTest(text=text):
+                self.assert_decision_recheck(dict(self.payload, last_assistant_message=text))
+
+    def test_announced_next_steps_after_work_recheck_instead_of_stopping(self):
+        plan = ('已完成两项检查。下一步：\n1. 补回归用例\n2. 重跑本地套件\n3. 跑一次付费对照生成\n'
+                '先推进前两步；付费对照还需要确定费用上限。')
+        for events in (self.edit_events(), self.claude_load(), self.codex_read()):
+            self.events(events)
+            for text in (plan, "Patch applied. Next, I'll rerun the suite and update the docs.",
+                         '接下来我会补测试并重跑。', 'Now let me run the remaining checks.',
+                         'The config change is in. I will now update the migration.',
+                         'Step 1 is done; the paid comparison run still needs to settle a budget cap.',
+                         '**接下来我先修复失败用例。**', '第一步完成，我马上跑回归。',
+                         '下一步我先跑回归。\nproposed-next: none — status only'):
+                with self.subTest(text=text):
+                    payload = dict(self.payload, last_assistant_message=text)
+                    self.assert_decision_recheck(payload)
+                    self.assertIn('not a stopping point', self.run_hook(payload)['reason'])
+
+    def test_optional_clause_does_not_hide_an_unconditional_next_step(self):
+        self.events(self.edit_events())
+        for text in ("Patch applied. Next, I'll rerun the tests; let me know if you need anything else.",
+                     "Next, I'll rerun the tests. If you want, I can also add a flag.",
+                     "Let me know if you need a flag; next, I'll rerun the tests.",
+                     '改动已完成，接下来我会跑回归；如需其他调整请告诉我。',
+                     '如需其他调整请告诉我。接下来我会跑回归。'):
+            with self.subTest(text=text):
+                self.assert_decision_recheck(dict(self.payload, last_assistant_message=text))
+
+    def test_condition_applies_to_its_own_announced_step(self):
+        self.events(self.edit_events())
+        for text in ("If you want, next I'll add an optional flag.",
+                     "Next, I'll add the flag if you want it.",
+                     '如果你需要，接下来我会补文档。',
+                     '接下来我会补文档，如果你需要的话。'):
+            with self.subTest(text=text):
+                self.assertEqual(self.run_hook(dict(self.payload, last_assistant_message=text)), {})
+
+    def test_routine_test_permission_recheck_does_not_invent_a_cost_blocker(self):
+        self.events(self.edit_events())
+        for text in ('proposed-next: blocked: 小额测试等待你批准费用上限',
+                     '测试环境的回归已准备好，是否开始？',
+                     '开发环境验证准备完成，请确认授权？',
+                     'Should I start the small model smoke test?'):
+            with self.subTest(text=text):
+                payload = dict(self.payload, last_assistant_message=text)
+                self.assert_decision_recheck(payload)
+                reason = self.run_hook(payload)['reason']
+                self.assertIn('Small tests and routine development/test-environment operations', reason)
+                self.assertIn('explicit user cost or run-count limits', reason)
+                self.assertNotIn('such as a cost cap or a paid run', reason)
+
+    def test_finished_reports_offers_and_quoted_plans_are_not_announcements(self):
+        self.events(self.edit_events())
+        for text in ('Done; all checks passed.', "If you want, I'll also add a CLI flag.",
+                     '如需，我可以接着补文档。', '修复完成。我已经补了测试并重跑。',
+                     'Earlier I said I would rerun the suite; it now passes.',
+                     "Let me know if you need anything else and I'll start on it.",
+                     '> 接下来我会补测试', "```text\nNext, I'll run the suite\n```",
+                     "Plan was: next, I'll fix A.\nFixed A.\nFixed B.\nAll checks pass."):
+            with self.subTest(text=text):
+                self.assertEqual(self.run_hook(dict(self.payload, last_assistant_message=text)), {})
+        self.events([])
+        for text in ('接下来我会解释这个错误的含义。', "Next, I'll explain the error."):
+            with self.subTest(text=text, transcript='no work evidence'):
+                self.assertEqual(self.run_hook(dict(self.payload, last_assistant_message=text)), {})
+                self.assertEqual(self.run_hook(dict(
+                    self.payload, last_assistant_message=text + '\nproposed-next: none — status only')), {})
+
+    def test_pleasantries_and_quoted_questions_after_edits_are_not_permission_asks(self):
+        self.events(self.edit_events())
+        for text in ('Done. Can I help with anything else?',
+                     'Fixed. Q: why does continue fail?',
+                     'Done.\n> Should I proceed?',
+                     '这个问题是否已修复？', 'How should I interpret this error?',
+                     'What is the default if I go ahead without a flag?',
+                     'Does this look ok to you?', '不管要不要我做都行。',
+                     '> **Should I proceed?**', '```text\n**是否继续？**\n```',
+                     '`**Should I proceed?**`', '**Done; checks passed.**',
+                     '__Done; checks passed.__'):
+            with self.subTest(text=text):
+                self.assertEqual(self.run_hook(dict(self.payload, last_assistant_message=text)), {})
+
+    def edit_events(self):
+        target = str(self.root / 'src.txt')
+        return [
+            {'type': 'assistant', 'message': {'content': [{'type': 'tool_use', 'id': 'edit',
+             'name': 'Edit', 'input': {'file_path': target, 'old_string': 'a', 'new_string': 'b'}}]}},
+            {'type': 'user', 'message': {'content': [{'type': 'tool_result',
+             'tool_use_id': 'edit', 'is_error': False, 'content': 'updated'}]}}]
+
     def test_actionable_handoff_rechecks_continuation_instead_of_silently_stopping(self):
         for events in ([], self.claude_load(), self.codex_read()):
             self.events(events)

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_remind_review_covers_head.sh

@@ -24,10 +24,11 @@ git -C "$repo" config user.name 'Test User'
 commit() { printf '%s\n' "$2" >"$repo/$1"; git -C "$repo" add -A; git -C "$repo" commit -q -m "$3"; }
 commit code.txt one "first change"
 
-write_receipt() { # <head> <worktree_clean true|false>
+write_receipt() { # <head> <worktree_clean true|false> [status | none to omit; default passed]
   mkdir -p "$repo/.git/ccl-code-review"
-  jq -nc --arg h "$1" --argjson c "$2" \
-    '{schema_version:1,head:$h,worktree_clean:$c,mode:"review",status:"findings",recorded_at:"2026-01-01T00:00:00Z"}' \
+  jq -nc --arg h "$1" --argjson c "$2" --arg s "${3:-passed}" \
+    '{schema_version:1,head:$h,worktree_clean:$c,mode:"review",status:$s,recorded_at:"2026-01-01T00:00:00Z"}
+     | if .status == "none" then del(.status) else . end' \
     >"$repo/.git/ccl-code-review/last-review.json"
 }
 
@@ -45,6 +46,7 @@ probe() {
 }
 
 probe "no receipt" remind 'glab mr create --title x' "$repo" '没有记录到任何结论性的 code-review 结果'
+probe "no receipt names the path it checked" remind 'glab mr create --title x' "$repo" 'ccl-code-review/last-review.json'
 head1=$(git -C "$repo" rev-parse HEAD)
 write_receipt "$head1" true
 probe "covered head" quiet 'glab mr create --title x'
@@ -53,6 +55,18 @@ probe "commit in the same command" remind 'git add -A && git commit -m fix && gh
 probe "HEAD moves only after the PR opens" quiet 'gh pr create --fill && git checkout main'
 probe "draft, commit, then ready" remind 'gh pr create --draft --fill && git add -A && git commit -m fix && git push && gh pr ready' "$repo" '会先改动 HEAD'
 
+# Coverage is not disposition: findings on the covered HEAD still remind.
+write_receipt "$head1" true findings
+probe "findings on the covered head" remind 'glab mr merge 8 --yes' "$repo" '结论是 findings，不是 passed'
+probe "findings reminder names the receipt it read" remind 'gh pr ready 12' "$repo" 'ccl-code-review/last-review.json'
+write_receipt "$head1" true none
+[ "$(jq -r 'has("status")' "$repo/.git/ccl-code-review/last-review.json")" = false ] \
+  || { echo "FAIL: fixture still carries a status" >&2; exit 1; }
+probe "a receipt without a status is not a pass" remind 'glab mr create --title x' "$repo" '不是 passed'
+probe "a missing status is not reported as findings" remind 'glab mr create --title x' "$repo" '没有记录可识别的结论'
+write_receipt "$head1" true
+probe "passed on the covered head" quiet 'glab mr merge 8 --yes'
+
 commit test.txt added "add regression test after review"
 probe "commit after review" remind 'glab mr create --title x' "$repo" 'add regression test after review'
 probe "gh pr ready" remind 'gh pr ready 12'
@@ -82,6 +96,8 @@ head2=$(git -C "$repo" rev-parse HEAD)
 write_receipt "$head2" true
 git -C "$repo" commit -q --amend -m "reworded message only"
 probe "message-only amend keeps the reviewed tree" quiet 'glab mr create --title x'
+write_receipt "$head2" true findings
+probe "message-only amend keeps the findings too" remind 'glab mr create --title x' "$repo" '结论是 findings，不是 passed'
 
 # Rewritten history with different content: the reviewed commit is gone.
 git -C "$repo" reset -q --hard "$head1"

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_skill_loading.py

@@ -77,6 +77,83 @@ class SkillLoadingTests(unittest.TestCase):
         self.assertNotIn('permissionDecision":"ask', json.dumps(result))
         self.assertEqual(self.run_hook(self.payload()), {})
 
+    def ccl_checkout(self):
+        root = self.root / 'ccl'
+        (root / 'skills' / 'skill-extraction-workflow').mkdir(parents=True)
+        (root / 'skills' / 'skill-extraction-workflow' / 'SKILL.md').write_text('marker')
+        (root / 'skills' / 'sample-owner' / 'references').mkdir(parents=True)
+        (root / 'hooks').mkdir()
+        return root
+
+    def extraction_loaded(self, ident='ext'):
+        self.append({'type': 'assistant', 'message': {'content': [
+            {'type': 'tool_use', 'id': ident, 'name': 'Skill',
+             'input': {'skill': 'ccl-skills:skill-extraction-workflow'}}]}},
+            {'type': 'user', 'message': {'content': [
+                {'type': 'tool_result', 'tool_use_id': ident, 'content': 'Loaded owner'}]}})
+
+    def test_shared_skill_edit_names_the_extraction_owner_at_the_first_edit(self):
+        root = self.ccl_checkout()
+        target = root / 'skills' / 'sample-owner' / 'scripts' / 'gate.sh'
+        target.parent.mkdir(parents=True)
+        result = self.run_hook(self.payload(tool_input={'file_path': str(target)}))
+        self.assertEqual(self.decision(result), 'deny')
+        reason = result['hookSpecificOutput']['permissionDecisionReason']
+        self.assertIn('skill-extraction-workflow', reason)
+        self.assertIn('charter', reason.lower())
+
+    def test_shared_skill_markdown_edit_reaches_the_checkpoint(self):
+        root = self.ccl_checkout()
+        target = root / 'skills' / 'sample-owner' / 'references' / 'rule.md'
+        result = self.run_hook(self.payload(tool_input={'file_path': str(target)}))
+        self.assertEqual(self.decision(result), 'deny')
+        self.assertIn('skill-extraction-workflow',
+                      result['hookSpecificOutput']['permissionDecisionReason'])
+
+    def test_markdown_outside_a_ccl_checkout_still_skips_the_checkpoint(self):
+        outside = self.root / 'product' / 'skills' / 'thing' / 'notes.md'
+        outside.parent.mkdir(parents=True)
+        self.assertEqual(self.run_hook(self.payload(tool_input={'file_path': str(outside)})), {})
+        cached = self.ccl_checkout() / 'skills' / 'sample-owner' / 'SKILL.md'
+        # An installed plugin copy carries the same marker; only the cache exclusion skips it.
+        cache_root = self.root / 'plugins' / 'cache' / 'ccl'
+        (cache_root / 'skills' / 'skill-extraction-workflow').mkdir(parents=True)
+        (cache_root / 'skills' / 'skill-extraction-workflow' / 'SKILL.md').write_text('marker')
+        plugin_cache = cache_root / 'skills' / 'x' / 'SKILL.md'
+        plugin_cache.parent.mkdir(parents=True)
+        self.assertEqual(self.run_hook(self.payload(tool_input={'file_path': str(plugin_cache)})), {})
+        # The checkpoint is still unspent for a real shared-skill edit.
+        result = self.run_hook(self.payload(tool_input={'file_path': str(cached)}))
+        self.assertEqual(self.decision(result), 'deny')
+
+    def test_checkout_under_an_ancestor_named_like_a_surface_is_recognised(self):
+        root = self.root / 'skills' / 'ccl'
+        (root / 'skills' / 'skill-extraction-workflow').mkdir(parents=True)
+        (root / 'skills' / 'skill-extraction-workflow' / 'SKILL.md').write_text('marker')
+        target = root / 'skills' / 'sample-owner' / 'SKILL.md'
+        target.parent.mkdir(parents=True)
+        result = self.run_hook(self.payload(tool_input={'file_path': str(target)}))
+        self.assertEqual(self.decision(result), 'deny')
+        self.assertIn('skill-extraction-workflow',
+                      result['hookSpecificOutput']['permissionDecisionReason'])
+
+    def test_codex_install_copy_is_exempt_like_the_plugin_cache(self):
+        install = self.root / '.codex' / 'ccl'
+        (install / 'skills' / 'skill-extraction-workflow').mkdir(parents=True)
+        (install / 'skills' / 'skill-extraction-workflow' / 'SKILL.md').write_text('marker')
+        target = install / 'skills' / 'x' / 'SKILL.md'
+        target.parent.mkdir(parents=True)
+        self.assertEqual(self.run_hook(self.payload(tool_input={'file_path': str(target)})), {})
+        self.assertEqual(self.decision(self.run_hook(self.payload())), 'deny')
+
+    def test_shared_skill_edit_with_the_owner_loaded_keeps_the_generic_reason(self):
+        root = self.ccl_checkout()
+        self.extraction_loaded()
+        target = root / 'hooks' / 'gate.sh'
+        result = self.run_hook(self.payload(tool_input={'file_path': str(target)}))
+        self.assertEqual(self.decision(result), 'deny')
+        self.assertNotIn('charter', result['hookSpecificOutput']['permissionDecisionReason'].lower())
+
     def test_native_patch_and_all_targets(self):
         patch = '*** Begin Patch\n*** Add File: README.md\n+doc\n*** Add File: src/new.ts\n+code\n*** End Patch'
         value = self.run_hook(self.payload('apply_patch', tool_input={'command': patch}))

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/development-completion.md

@@ -5,9 +5,10 @@ This transition applies across implementation owners, including narrow fixes and
 ## Before invoking review
 
 1. Recover the current task, actual diff, scope and authorization. Changing the implementation or scope reopens this check; an earlier plan review cannot discharge review of the resulting code.
-2. Finish proportionate implementer self-review and affected verification. A failed quality check calls for available in-scope diagnosis and cleanup under [refactoring discipline](../../product-rd-workflow/references/refactoring-discipline.md#responding-to-quality-gates); preserve behavior and readability, rerun the check, and escalate only a remaining real blocker. Use `testing-strategy` to select tests: changed named test properties require the killing-mutation walk on disposable or restore-guarded resources; when the same contract has two implementations or paths, use differential/equivalence checks with bounded, asserted known differences. Record a concrete applicability or unavailable-evidence reason when a test family does not run. Do not force a full mutation framework or differential suite onto an unrelated change.
+2. Finish a deep self-review in the main implementing agent, not a subagent — it holds the intent and decisions, and independence comes from the external review — covering every changed branch and failure path, plus privacy, authority and data-loss risk, then affected verification. A failed quality check calls for available in-scope diagnosis and cleanup under [refactoring discipline](../../product-rd-workflow/references/refactoring-discipline.md#responding-to-quality-gates); preserve behavior and readability, rerun the check, and escalate only a remaining real blocker. Use `testing-strategy` to select tests: changed named test properties require the killing-mutation walk on disposable or restore-guarded resources; when the same contract has two implementations or paths, use differential/equivalence checks with bounded, asserted known differences. Record a concrete applicability or unavailable-evidence reason when a test family does not run. Do not force a full mutation framework or differential suite onto an unrelated change.
 3. Reuse a terminal independent review only when it covers the current candidate and satisfies the applicable owner gate, reviewer independence and required depth. Record the receipt location and its candidate identifier (commit or diff/packet digest), then compare with the current candidate using the owning gate's binding rules; HEAD alone cannot cover uncommitted edits. A different or missing candidate identifier cannot discharge review. A loaded skill, self-review, planned command, unfinished handle or unverified prose claim is not that evidence. A native subagent result counts only when the owning gate accepts its independence and evidence; it never silently substitutes for a required CLI receipt.
-4. An explicit user instruction to skip review controls this task: record `skipped`, not `passed`, and preserve any separate landing restrictions. Record its original wording and current scope; a superseded or unrelated instruction is not a skip for this task. Do not ask for confirmation of ordinary review already within the authorized development task. User client restrictions and existing confidentiality boundaries still control reviewer selection; capability matters, not a numeric CLI or skill version.
+4. Self-review and the external review below are yours to run; neither waits on a person. An ordinary change needs no human reviewer, sign-off or risk owner; human sign-off applies only where the product-rd design gate or the safety rules require it for a merge, launch or destructive action.
+5. An explicit user instruction to skip review controls this task: record `skipped`, not `passed`, and preserve any separate landing restrictions. Record its original wording and current scope; a superseded or unrelated instruction is not a skip for this task. Do not ask for confirmation of ordinary review already within the authorized development task. User client restrictions and existing confidentiality boundaries still control reviewer selection; capability matters, not a numeric CLI or skill version.
 
 ## Invoke and finish
 
@@ -23,7 +24,7 @@ A review quotes the repository's own tracked contract files for the changed path
 
 Walk these before you open a pull or merge request, push to one that is already open, ask for a merge, or report the work done or ready — every time, not only after the first review:
 
-1. Name the commit or packet the last conclusive review covered and compare it with the current candidate: HEAD plus staged, unstaged and untracked implementation files. For a review whose candidate `--base` derived from the whole worktree, the controller records that commit in the worktree's git directory (`ccl-code-review/last-review.json`; a bare `--diff-file` or `--paths` review records nothing), and the plugin's pull-request hook repeats this comparison when you open, ready or merge one; its reminder is this step firing, not a new question.
+1. Name the commit or packet the last conclusive review covered and compare it with the current candidate: HEAD plus staged, unstaged and untracked implementation files. For a review whose candidate `--base` derived from the whole worktree, the controller records that commit in the worktree's git directory (`ccl-code-review/last-review.json`; a bare `--diff-file` or `--paths` review records nothing), and the plugin's pull-request hook repeats this comparison when you open, ready or merge one; its reminder is this step firing, not a new question. A successful completion checkpoint on such a candidate records it as well, so a chain whose findings were disposed reads as passed; coverage alone is not disposition, and a covered receipt with findings or no status must still be dispositioned before a ready report.
 2. Any difference makes the current candidate unreviewed: a fix for a finding of any severity, an added or changed test, a changelog or doc line, a rebase that changed a file the candidate touches. Only the review's own record files (result JSON, disposition notes) are exempt.
 3. An unreviewed candidate must get the owning gate's renewed review now, run by you: a fresh full run per [manual invocation](manual-invocation-and-prompts.md); the skill-extraction lane runs its own delta pass instead. Pushing it for a human to review does not discharge it, and "awaiting human review" never stands in for the run.
 4. Apply the [review continuation checkpoint](#review-continuation-checkpoint) after five renewed runs or earlier when findings recur without progress. Necessary review continues within the task's authority; unresolved P0/P1 or unreviewed changes still prevent a ready report.

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/AGENTS.md

@@ -10,7 +10,8 @@ Rules:
   their arguments, returned bytes and completed lifecycle. This does not permit
   arbitrary commands or workspace access. A malformed, timeout, or inconclusive
   wrapper result is not a pass.
-- **Never pin the parser to a CLI version's vocabulary.** `parse_probe_result.py`
+- **Never pin a lane to a CLI version's vocabulary — reading it or writing it.**
+  `parse_probe_result.py`
   gates on *shape*, not on field/value names: the isolation proof is the exact
   `tools` allowlist plus the tool_use scan, which no init field can bypass.
   Field-name and value whitelists were tried twice (`fast_mode_state`, then
@@ -19,6 +20,15 @@ Rules:
   or empty-container, and `agents`/`capabilities` are list-of-strings checks
   with no value vocabulary. Only `permissionMode` stays value-pinned (it widens
   what the runtime may do with no tool added).
+  The write side is the same class and was missed once: config a wrapper
+  GENERATES and then submits to the runtime's own validator as an admission
+  precondition carries a key that release may not know, and rejecting it turns
+  the whole lane off. So a generated setting that a per-invocation environment
+  variable already carries is belt, not the gate — on rejection regenerate the
+  strict subset without it and revalidate, unconditionally rather than by
+  matching the runtime's error wording, which is the same pin relocated. Only a
+  setting with no second, independent path to the same property may fail the
+  lane closed, and admission must never widen on the retry.
 - **Skill, command and plugin lists are vocabulary, not a boundary.**
   `slash_commands`, `terminal_slash_commands`, `skills` and `plugins` may hold
   any value and are never judged by name, shape, or origin; only `mcp_servers`

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/kimi_review.sh

@@ -721,7 +721,7 @@ fi
 # prevention. The cooperative probe below attempts only private-workspace
 # Read/Glob/Grep canaries and rejects any observed tool exposure.
 install_packet_only_config() {
-  "$PYTHON_BIN_PATH" - "$RUNTIME_HOME/config.toml" "$PACKET_DELIVERY" <<'PY'
+  "$PYTHON_BIN_PATH" - "$RUNTIME_HOME/config.toml" "$PACKET_DELIVERY" "${1:-guard}" <<'PY'
 import json
 import os
 from pathlib import Path
@@ -730,6 +730,15 @@ import tomllib
 
 config_path = Path(sys.argv[1])
 delivery = sys.argv[2]
+# "guard" writes the watcher table; "omit" leaves it out for a runtime whose
+# own validator does not recognise it. Both are equally isolated: every
+# invocation sets KIMI_CODE_WATCH, which the runtime reads ahead of the config.
+watch_mode = sys.argv[3]
+# A retry regenerates from the previous generation, so the marker is dropped on
+# the way in and re-added below; the output is the same bytes either way.
+generated_marker = (
+    "# Generated by code-review; source-home hooks, tools, and permissions are not inherited."
+)
 source = config_path.read_text(encoding="utf-8") if config_path.exists() else ""
 lines = source.splitlines(keepends=True)
 kept = []
@@ -793,6 +802,8 @@ def decoded_assignment_root(line):
 
 for line in lines:
     stripped = line.strip()
+    if stripped == generated_marker:
+        continue
     table_root = decoded_table_root(stripped)
     if table_root is not None:
         table_allowed = table_root in safe_table_roots
@@ -828,10 +839,19 @@ guard = (
     "[tools]\n"
     f"enabled = {json.dumps(enabled_tools, separators=(',', ':'))}\n"
 )
+if watch_mode == "guard":
+    guard += "[watch]\nenabled = false\n"
 rendered = "".join(kept).rstrip() + guard
 parsed = tomllib.loads(rendered)
 allowed_roots = safe_root_keys | safe_table_roots | {"tools"}
-if set(parsed) - allowed_roots or parsed.get("tools") != {"enabled": enabled_tools}:
+expected_watch = {"enabled": False} if watch_mode == "guard" else None
+if watch_mode == "guard":
+    allowed_roots = allowed_roots | {"watch"}
+if (
+    set(parsed) - allowed_roots
+    or parsed.get("tools") != {"enabled": enabled_tools}
+    or parsed.get("watch") != expected_watch
+):
     raise SystemExit("generated packet-only policy failed semantic verification")
 replacement = config_path.with_name(f".{config_path.name}.code-review.tmp")
 replacement.write_text(rendered, encoding="utf-8")
@@ -839,14 +859,30 @@ os.chmod(replacement, 0o600)
 os.replace(replacement, config_path)
 PY
 }
-install_packet_only_config \
-  || die_inconclusive kimi_packet_only_config_failed capability_missing true
 DOCTOR_STDOUT="$RUN_ROOT/doctor.stdout"
 DOCTOR_STDERR="$RUN_ROOT/doctor.stderr"
-KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_DISABLE_TELEMETRY=1 \
-  timeout --kill-after=1s 15s "$KIMI_BIN_PATH" doctor config "$RUNTIME_HOME/config.toml" \
-  >"$DOCTOR_STDOUT" 2>"$DOCTOR_STDERR" \
-  || die_inconclusive kimi_packet_only_config_unrecognized capability_missing true
+validate_packet_only_config() {
+  doctor_rc=0
+  KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_CODE_WATCH=0 KIMI_DISABLE_TELEMETRY=1 \
+    timeout --kill-after=1s 15s "$KIMI_BIN_PATH" doctor config "$RUNTIME_HOME/config.toml" \
+    >"$DOCTOR_STDOUT" 2>"$DOCTOR_STDERR" \
+    || doctor_rc=$?
+  [ "$doctor_rc" -eq 0 ]
+}
+install_packet_only_config guard \
+  || die_inconclusive kimi_packet_only_config_failed capability_missing true
+# The watcher table is belt on top of KIMI_CODE_WATCH, which every invocation
+# below sets and which the runtime reads ahead of the config. A runtime whose
+# validator does not know the table must not cost the whole lane, so retry once
+# with a strict subset of the same policy — admission cannot widen, and the
+# retry is unconditional rather than matched against the runtime's error
+# wording, which would be the same release-vocabulary pin in another place.
+if ! validate_packet_only_config; then
+  install_packet_only_config omit \
+    || die_inconclusive kimi_packet_only_config_failed capability_missing true
+  validate_packet_only_config \
+    || die_inconclusive kimi_packet_only_config_unrecognized capability_missing true "$doctor_rc"
+fi
 
 # Exercise the forbidden built-in tool surface without depending on a version
 # string. In MCP mode the generated config still exposes the one packet reader,
@@ -866,7 +902,7 @@ PROBE_TIMEOUT="$TIMEOUT"
 [ "$PROBE_TIMEOUT" -le 60 ] || PROBE_TIMEOUT=60
 (
   cd "$RUN_WORKSPACE" || exit 2
-  KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_DISABLE_TELEMETRY=1 \
+  KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_CODE_WATCH=0 KIMI_DISABLE_TELEMETRY=1 \
     timeout --kill-after=1s "${PROBE_TIMEOUT}s" "$KIMI_BIN_PATH" \
       --skills-dir "$ACTIVE_SKILLS_DIR" --prompt "$PROBE_PROMPT" \
       --output-format stream-json
@@ -876,6 +912,24 @@ if [ "$probe_rc" -ne 0 ]; then
   if grep -qiE 'EMFILE|too many open files' "$PROBE_STDERR"; then
     die_inconclusive kimi_host_resource_exhausted client_unavailable true "$probe_rc"
   fi
+  # NO SUB-CLASSIFICATION OF PROVIDER PROSE. Splitting this failure into quota
+  # and auth reasons was tried and withdrawn: four independent review rounds
+  # each broke the predicate on a new message. A digit boundary excluded 4290
+  # but not an offset of exactly 429; requiring a status word before the number
+  # matched `code` inside `decode`; matching what the message said instead
+  # matched `hit` inside `whitelisted` and still missed `credits are exhausted`.
+  # That is the shape this directory's contract already names — a predicate over
+  # a vocabulary the control does not own — and same-class recurrence is the cue
+  # to remove the capability rather than guard it again.
+  #
+  # Nothing about the gate changes: every one of those reasons was
+  # die_inconclusive and cascade-eligible, so the split only ever decided an
+  # operator hint, and a wrong hint is worse than none. The contract also
+  # forbids putting raw provider text in the payload, so the honest replacement
+  # is not a looser regex but a classifier over the structured error the probe
+  # already streams, the way the Claude lane's envelope classifier works. That
+  # is its own change, against a real sample.
+  :
   die_inconclusive kimi_tool_capability_unverified capability_missing true "$probe_rc"
 fi
 # MCP mode enables the packet reader for the later formal transport, but this
@@ -962,14 +1016,14 @@ run_started=$SECONDS
 if [ "$PACKET_DELIVERY" = inline ]; then
   (
     cd "$RUN_WORKSPACE" || exit 2
-    KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_DISABLE_TELEMETRY=1 \
+    KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_CODE_WATCH=0 KIMI_DISABLE_TELEMETRY=1 \
       timeout --kill-after=1s "${FORMAL_TIMEOUT}s" "$KIMI_BIN_PATH" --skills-dir "$ACTIVE_SKILLS_DIR" \
         --prompt "$PROMPT" --output-format stream-json
   ) >"$EVENTS" 2>"$STDERR_FILE"
 else
   (
     cd "$RUN_WORKSPACE" || exit 2
-    KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_DISABLE_TELEMETRY=1 \
+    KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_CODE_WATCH=0 KIMI_DISABLE_TELEMETRY=1 \
       timeout --kill-after=1s "${FORMAL_TIMEOUT}s" "$KIMI_BIN_PATH" --skills-dir "$ACTIVE_SKILLS_DIR" \
         --agent-file "$AGENT_FILE" --prompt "$PROMPT" --output-format stream-json
   ) >"$EVENTS" 2>"$STDERR_FILE"

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/review_gate.py

@@ -4661,8 +4661,10 @@ def main(argv: list[str] | None = None) -> int:
             )
         # Only a candidate derived from the whole worktree says what HEAD holds:
         # a bare --diff-file packet or a --paths slice may cover less than HEAD.
+        # A completion checkpoint records too: it is what turns a findings
+        # receipt into a passed one once every finding is disposed.
         anchors_wanted = (
-            args.mode in {"review", "challenge"}
+            args.mode in {"review", "challenge", "complete"}
             and bool(args.base)
             and not args.paths
         )
@@ -4831,6 +4833,7 @@ def main(argv: list[str] | None = None) -> int:
                 ),
             )
             result.update(completion_metadata)
+            record_local_review(review_anchor, result)
             return emit(result, 0)
         last_reason_code = "no_independent_reviewer_available"
         for client in order: