@ccoalm/ccl-skills 0.7.0 → 0.9.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/update_review_plan_intent.py

@@ -0,0 +1,513 @@
+#!/usr/bin/env python3
+"""Append or compact bounded intent without lossy truncation.
+
+The caller owns writer serialization and provides a trusted, stable parent
+directory. ``--expected-sha256`` rejects input that was already stale when
+opened; it is not a lock against concurrent writers.
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import hashlib
+import json
+import os
+import re
+import stat
+import sys
+import tempfile
+from pathlib import Path
+from typing import NoReturn
+
+
+MIN_INTENT_CHARS = 8
+MAX_INTENT_CHARS = 4000
+MAX_PLAN_BYTES = 32_000
+PLAN_FIELDS = {"intent", "acceptance", "self_review", "evidence"}
+SHA256_RE = re.compile(r"[0-9a-f]{64}")
+STABLE_CORE_EVIDENCE_ID = "review-plan-intent-stable-core-v1"
+STABLE_CORE_RESULT_RE = re.compile(r"chars=([1-9][0-9]{0,3});sha256=([0-9a-f]{64})")
+HISTORY_EVIDENCE_PREFIX = "review-plan-intent-history-v1"
+HISTORY_BASE64_CHUNK_CHARS = 1800
+MAX_EVIDENCE_ROWS = 50
+
+
+class UpdateError(Exception):
+    def __init__(self, reason: str, detail: str) -> None:
+        super().__init__(detail)
+        self.reason = reason
+        self.detail = detail
+
+
+class DuplicateKeyError(ValueError):
+    pass
+
+
+def reject_duplicate_keys(pairs: list[tuple[str, object]]) -> dict[str, object]:
+    result: dict[str, object] = {}
+    for key, value in pairs:
+        if key in result:
+            raise DuplicateKeyError
+        result[key] = value
+    return result
+
+
+def fail(reason: str, detail: str) -> NoReturn:
+    raise UpdateError(reason, detail)
+
+
+def read_regular(path: Path, *, label: str, max_bytes: int) -> tuple[bytes, int]:
+    if not hasattr(os, "O_NOFOLLOW") or not hasattr(os, "O_NONBLOCK"):
+        fail(
+            f"{label}_unsupported",
+            "this platform cannot safely open files without following links or blocking on special files",
+        )
+    flags = os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | getattr(os, "O_CLOEXEC", 0)
+    fd = -1
+    try:
+        fd = os.open(path, flags)
+    except OSError as exc:
+        fail(f"{label}_unreadable", str(exc))
+    try:
+        info = os.fstat(fd)
+        if not stat.S_ISREG(info.st_mode):
+            fail(f"{label}_not_regular", "expected a regular, non-symlink file")
+        if info.st_nlink != 1:
+            fail(f"{label}_hardlinked", "refusing a multiply-linked file")
+        if label == "plan" and hasattr(os, "geteuid") and info.st_uid != os.geteuid():
+            fail("plan_not_owned", "the plan must be owned by the current user")
+        if info.st_size > max_bytes:
+            fail(f"{label}_too_large", f"maximum is {max_bytes} bytes")
+        with os.fdopen(fd, "rb") as handle:
+            fd = -1
+            chunks: list[bytes] = []
+            remaining = max_bytes + 1
+            while remaining:
+                chunk = handle.read(min(65_536, remaining))
+                if not chunk:
+                    break
+                chunks.append(chunk)
+                remaining -= len(chunk)
+            data = b"".join(chunks)
+    except OSError as exc:
+        fail(f"{label}_unreadable", str(exc))
+    finally:
+        if fd >= 0:
+            os.close(fd)
+    if len(data) > max_bytes:
+        fail(f"{label}_too_large", f"maximum is {max_bytes} bytes")
+    return data, stat.S_IMODE(info.st_mode)
+
+
+def decode_utf8(data: bytes, *, label: str) -> str:
+    try:
+        return data.decode("utf-8")
+    except UnicodeDecodeError as exc:
+        fail(f"{label}_invalid_utf8", f"invalid UTF-8 at byte {exc.start}")
+
+
+def digest(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def normalized_intent(
+    value: object, *, reason_prefix: str, minimum: int = MIN_INTENT_CHARS
+) -> str:
+    if not isinstance(value, str):
+        fail(f"{reason_prefix}_not_string", "intent must be a string")
+    stripped = value.strip()
+    if value != stripped:
+        fail(f"{reason_prefix}_not_normalized", "intent must not have outer whitespace")
+    if len(value) < minimum:
+        fail(f"{reason_prefix}_too_short", f"minimum is {minimum} characters")
+    return value
+
+
+def remove_file_line_ending(value: str) -> str:
+    """Remove only the one line ending used as a text-file delimiter."""
+    if value.endswith("\r\n"):
+        return value[:-2]
+    if value.endswith(("\n", "\r")):
+        return value[:-1]
+    return value
+
+
+def render_plan(plan: dict[str, object]) -> bytes:
+    try:
+        encoded = (json.dumps(plan, ensure_ascii=False, indent=2) + "\n").encode(
+            "utf-8"
+        )
+    except UnicodeEncodeError as exc:
+        fail("updated_plan_invalid_unicode", f"cannot encode UTF-8 at character {exc.start}")
+    if len(encoded) > MAX_PLAN_BYTES:
+        fail("updated_plan_too_large", f"maximum is {MAX_PLAN_BYTES} bytes")
+    return encoded
+
+
+def stable_core_identity(plan: dict[str, object]) -> tuple[int, str]:
+    evidence = plan.get("evidence")
+    if not isinstance(evidence, list):
+        fail("intent_core_identity_missing", "plan evidence has no stable-core identity")
+    records = [
+        item
+        for item in evidence
+        if isinstance(item, dict) and item.get("id") == STABLE_CORE_EVIDENCE_ID
+    ]
+    if not records:
+        fail("intent_core_identity_missing", "plan evidence has no stable-core identity")
+    if len(records) != 1:
+        fail("intent_core_identity_invalid", "plan must contain exactly one stable-core identity")
+    record = records[0]
+    if set(record) != {"id", "result"} or not isinstance(record.get("result"), str):
+        fail("intent_core_identity_invalid", "stable-core identity has an invalid schema")
+    match = STABLE_CORE_RESULT_RE.fullmatch(record["result"])
+    if match is None:
+        fail("intent_core_identity_invalid", "stable-core identity has an invalid encoding")
+    core_chars = int(match.group(1))
+    if not MIN_INTENT_CHARS <= core_chars <= MAX_INTENT_CHARS:
+        fail(
+            "intent_core_identity_invalid",
+            f"stable-core character length must be between {MIN_INTENT_CHARS} and {MAX_INTENT_CHARS}",
+        )
+    return core_chars, match.group(2)
+
+
+def text_digest(value: str, *, reason: str, label: str) -> str:
+    try:
+        return digest(value.encode("utf-8"))
+    except UnicodeEncodeError as exc:
+        fail(reason, f"{label} cannot encode as UTF-8 at character {exc.start}")
+
+
+def archive_discarded_intent(
+    plan: dict[str, object], *, old_intent: str, core: str
+) -> None:
+    """Retain the exact old intent bytes before compacting its visible field."""
+    suffix = old_intent[len(core) :]
+    if not suffix:
+        return
+    evidence = plan.get("evidence")
+    if not isinstance(evidence, list):
+        fail("intent_history_invalid", "plan evidence must be an array")
+    used_ids = {
+        item.get("id")
+        for item in evidence
+        if isinstance(item, dict) and isinstance(item.get("id"), str)
+    }
+    group = None
+    for group_number in range(1, MAX_EVIDENCE_ROWS + 1):
+        candidate_group = f"{group_number:04d}"
+        candidate_prefix = f"{HISTORY_EVIDENCE_PREFIX}-{candidate_group}"
+        if not any(
+            evidence_id == f"{candidate_prefix}-manifest"
+            or evidence_id.startswith(f"{candidate_prefix}-part-")
+            for evidence_id in used_ids
+        ):
+            group = candidate_group
+            break
+    if group is None:
+        fail("intent_history_full", "no unique intent-history evidence group remains")
+    try:
+        old_bytes = old_intent.encode("utf-8")
+        suffix_bytes = suffix.encode("utf-8")
+    except UnicodeEncodeError as exc:
+        fail(
+            "intent_history_invalid_unicode",
+            f"old intent cannot encode as UTF-8 at character {exc.start}",
+        )
+    encoded_suffix = base64.b64encode(suffix_bytes).decode("ascii")
+    chunks = [
+        encoded_suffix[index : index + HISTORY_BASE64_CHUNK_CHARS]
+        for index in range(0, len(encoded_suffix), HISTORY_BASE64_CHUNK_CHARS)
+    ]
+    prefix = f"{HISTORY_EVIDENCE_PREFIX}-{group}"
+    rows: list[dict[str, str]] = [
+        {
+            "id": f"{prefix}-manifest",
+            "result": (
+                f"format={HISTORY_EVIDENCE_PREFIX};"
+                f"old_chars={len(old_intent)};"
+                f"old_sha256={hashlib.sha256(old_bytes).hexdigest()};"
+                f"core_chars={len(core)};"
+                f"suffix_bytes={len(suffix_bytes)};"
+                f"suffix_sha256={hashlib.sha256(suffix_bytes).hexdigest()};"
+                f"encoding=base64-utf8;parts={len(chunks)}"
+            ),
+        }
+    ]
+    rows.extend(
+        {
+            "id": f"{prefix}-part-{part_number:04d}",
+            "result": (
+                f"format={HISTORY_EVIDENCE_PREFIX};group={group};"
+                f"part={part_number}/{len(chunks)};data={chunk}"
+            ),
+        }
+        for part_number, chunk in enumerate(chunks, start=1)
+    )
+    if len(evidence) + len(rows) > MAX_EVIDENCE_ROWS:
+        fail(
+            "intent_history_evidence_overflow",
+            f"zero-loss compaction needs {len(rows)} history rows but the plan "
+            f"would exceed {MAX_EVIDENCE_ROWS} evidence rows",
+        )
+    plan["evidence"] = [*evidence, *rows]
+
+
+def atomic_replace(path: Path, data: bytes, mode: int) -> None:
+    fd = -1
+    temp_path: Path | None = None
+    try:
+        try:
+            fd, raw_temp = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
+            temp_path = Path(raw_temp)
+            with os.fdopen(fd, "wb") as handle:
+                fd = -1
+                handle.write(data)
+                handle.flush()
+                os.fchmod(handle.fileno(), mode)
+                os.fsync(handle.fileno())
+        except OSError as exc:
+            fail("plan_write_failed", str(exc))
+        try:
+            os.replace(temp_path, path)
+            temp_path = None
+        except OSError as exc:
+            fail("plan_write_failed", str(exc))
+        try:
+            directory_flags = (
+                os.O_RDONLY
+                | getattr(os, "O_DIRECTORY", 0)
+                | getattr(os, "O_CLOEXEC", 0)
+            )
+            directory_fd = os.open(path.parent, directory_flags)
+            try:
+                os.fsync(directory_fd)
+            finally:
+                os.close(directory_fd)
+        except OSError as exc:
+            fail(
+                "plan_committed_durability_unknown",
+                f"the target was replaced with sha256={digest(data)} but directory sync failed ({exc}); re-read the plan and do not retry blindly",
+            )
+    finally:
+        cleanup_errors: list[str] = []
+        if fd >= 0:
+            try:
+                os.close(fd)
+            except OSError as exc:
+                cleanup_errors.append(f"close failed: {exc}")
+        if temp_path is not None:
+            try:
+                temp_path.unlink()
+            except FileNotFoundError:
+                pass
+            except OSError as exc:
+                cleanup_errors.append(f"temporary-file removal failed: {exc}")
+        if cleanup_errors:
+            active_error = sys.exc_info()[1]
+            detail = "; ".join(cleanup_errors)
+            if isinstance(active_error, UpdateError):
+                detail = (
+                    f"{detail}; original failure was {active_error.reason}: "
+                    f"{active_error.detail}"
+                )
+            raise UpdateError("plan_cleanup_failed", detail)
+
+
+def parse_args(argv: list[str]) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        description=(
+            "Update a review plan intent without lossy truncation. Overflow is "
+            "an error and leaves the plan unchanged."
+        )
+    )
+    parser.add_argument("--plan", required=True, type=Path)
+    parser.add_argument("--append-intent-file", type=Path)
+    parser.add_argument("--compact-core-intent-file", type=Path)
+    parser.add_argument("--latest-intent-file", type=Path)
+    parser.add_argument(
+        "--expected-sha256",
+        help="optional stale-input guard for the current plan bytes",
+    )
+    return parser.parse_args(argv)
+
+
+def run(argv: list[str]) -> int:
+    args = parse_args(argv)
+    append_mode = args.append_intent_file is not None
+    compact_mode = (
+        args.compact_core_intent_file is not None or args.latest_intent_file is not None
+    )
+    if append_mode == compact_mode or (
+        compact_mode
+        and (
+            args.compact_core_intent_file is None
+            or args.latest_intent_file is None
+        )
+    ):
+        fail(
+            "intent_update_mode_invalid",
+            "choose append, or supply both compact core and latest intent files",
+        )
+    plan_bytes, plan_mode = read_regular(
+        args.plan, label="plan", max_bytes=MAX_PLAN_BYTES
+    )
+    if plan_mode & 0o7000:
+        fail("plan_mode_unsupported", "setuid, setgid, and sticky plan modes are unsupported")
+    plan_mode &= 0o777
+    current_digest = digest(plan_bytes)
+    if args.expected_sha256 is not None:
+        expected = args.expected_sha256.lower()
+        if SHA256_RE.fullmatch(expected) is None:
+            fail("expected_sha256_invalid", "expected exactly 64 hexadecimal characters")
+        if expected != current_digest:
+            fail("plan_digest_mismatch", "the plan changed after the caller read it")
+
+    try:
+        plan = json.loads(
+            decode_utf8(plan_bytes, label="plan"),
+            object_pairs_hook=reject_duplicate_keys,
+        )
+    except DuplicateKeyError:
+        fail("plan_duplicate_key", "duplicate JSON object keys are unsupported")
+    except json.JSONDecodeError as exc:
+        fail("plan_invalid_json", f"JSON parse failed at line {exc.lineno} column {exc.colno}")
+    if not isinstance(plan, dict) or set(plan) != PLAN_FIELDS:
+        fail("plan_schema_invalid", "top-level fields must be intent, acceptance, self_review, evidence")
+    old_intent = normalized_intent(plan["intent"], reason_prefix="plan_intent")
+
+    if append_mode:
+        if len(old_intent) > MAX_INTENT_CHARS:
+            fail("plan_intent_overflow", f"maximum is {MAX_INTENT_CHARS} characters")
+        incoming_bytes, _ = read_regular(
+            args.append_intent_file, label="intent_input", max_bytes=MAX_PLAN_BYTES
+        )
+        incoming = remove_file_line_ending(
+            decode_utf8(incoming_bytes, label="intent_input")
+        )
+        if not incoming:
+            fail("intent_append_empty", "append input must not be empty")
+        candidate = old_intent + incoming
+        reason_prefix = "intent_append"
+    else:
+        core_bytes, _ = read_regular(
+            args.compact_core_intent_file,
+            label="intent_core",
+            max_bytes=MAX_PLAN_BYTES,
+        )
+        latest_bytes, _ = read_regular(
+            args.latest_intent_file,
+            label="intent_latest",
+            max_bytes=MAX_PLAN_BYTES,
+        )
+        core = normalized_intent(
+            remove_file_line_ending(decode_utf8(core_bytes, label="intent_core")),
+            reason_prefix="intent_core",
+        )
+        latest = normalized_intent(
+            remove_file_line_ending(decode_utf8(latest_bytes, label="intent_latest")),
+            reason_prefix="intent_latest",
+            minimum=1,
+        )
+        if not old_intent.startswith(core):
+            fail(
+                "intent_core_not_preserved",
+                "compact core must be an exact prefix of the current intent",
+            )
+        if latest in old_intent:
+            fail(
+                "intent_latest_not_new",
+                "latest transition is already present in the current intent",
+            )
+        core_chars, core_sha256 = stable_core_identity(plan)
+        if len(old_intent) < core_chars:
+            fail(
+                "plan_core_identity_mismatch",
+                "current intent is shorter than its persisted stable-core identity",
+            )
+        persisted_core = old_intent[:core_chars]
+        if text_digest(
+            persisted_core,
+            reason="plan_core_identity_mismatch",
+            label="persisted stable core",
+        ) != core_sha256:
+            fail(
+                "plan_core_identity_mismatch",
+                "persisted stable-core identity does not match the current intent",
+            )
+        if len(core) != core_chars or text_digest(
+            core,
+            reason="intent_core_identity_mismatch",
+            label="compact core",
+        ) != core_sha256:
+            fail(
+                "intent_core_identity_mismatch",
+                "compact core does not match the plan's persisted stable-core identity",
+            )
+        archive_discarded_intent(plan, old_intent=old_intent, core=core)
+        candidate = f"{core}\n\n{latest}"
+        reason_prefix = "intent_compact"
+
+    candidate = normalized_intent(candidate, reason_prefix=reason_prefix)
+    if len(candidate) > MAX_INTENT_CHARS:
+        fail(
+            f"{reason_prefix}_overflow",
+            f"candidate has {len(candidate)} characters; maximum is {MAX_INTENT_CHARS}; rebuild intent as core + latest and keep history in evidence/prior results",
+        )
+
+    plan["intent"] = candidate
+    updated = render_plan(plan)
+    atomic_replace(args.plan, updated, plan_mode)
+    # flush inside the guarded path: without it the receipt sits in the stdout
+    # buffer and a closed pipe only surfaces BrokenPipeError at interpreter
+    # shutdown, after main() returned rc 0 and past its handler.
+    print(
+        "review_plan_intent_updated "
+        f"mode={'append' if append_mode else 'compact'} "
+        f"chars={len(candidate)} old_sha256={current_digest} new_sha256={digest(updated)}",
+        flush=True,
+    )
+    return 0
+
+
+def main() -> int:
+    try:
+        return run(sys.argv[1:])
+    except UpdateError as exc:
+        print(
+            f"review_plan_intent_error: reason={exc.reason} detail={exc.detail}",
+            file=sys.stderr,
+        )
+        return 2
+    except (BrokenPipeError, OSError):
+        # The success receipt is printed (flushing) only after atomic_replace
+        # committed, and every other file operation converts its OSError to
+        # UpdateError, so an OS-level error here means the receipt was lost on
+        # a closed/broken stdout — not that the update failed. rc 0 with no
+        # receipt would read as "no update happened"; report the committed-but-
+        # unreported state the same way a failed durability sync does.
+        try:
+            print(
+                "review_plan_intent_error: reason=plan_committed_receipt_lost "
+                "detail=stdout closed before the success receipt was delivered; "
+                "re-read the plan for the committed state and do not retry blindly",
+                file=sys.stderr,
+            )
+            sys.stderr.flush()
+        except (BrokenPipeError, OSError):
+            pass
+        # Point stdout at devnull so the interpreter's shutdown flush of the
+        # broken pipe cannot override this exit status with 120.
+        try:
+            devnull = os.open(os.devnull, os.O_WRONLY)
+            os.dup2(devnull, sys.stdout.fileno())
+            os.close(devnull)
+        except (OSError, ValueError):
+            pass
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/dist/assets/marketplace/plugins/ccl-skills/skills/defect-diagnosis/SKILL.md

@@ -65,6 +65,7 @@ Use this skill for the full defect discipline: diagnose the immediate failure, f
 
 5. Verify cause.
    - Prove the cause with evidence.
+   - Report query/lookup evidence by cardinality: a data query, log search, or identity resolution that returns 0, 1, or N matches reports each of those outcomes distinctly — never silently take the first row of N, and never treat 0 rows as "no evidence collected" (an empty result over a named scope IS evidence: record which scopes matched and which were empty).
    - When the cause is environment/toolchain state, prove it from the tool that owns that state, not only from the high-level wrapper. A wrapper failure is a symptom until the underlying compiler, generator, runtime registry, dependency resolver, or platform destination evidence explains it.
    - If disproven, return to hypotheses instead of guessing.
    - Separate symptom, immediate cause, contributing factors, and prevention.

package/dist/assets/marketplace/plugins/ccl-skills/skills/feature-risk-router/SKILL.md

@@ -7,7 +7,9 @@ description: 风险定级 / 要不要灰度 / 需要哪些 gate / 双人 review
 
 Use this lightweight router before or during product delivery when the required rigor is unclear. It classifies risk and names the gates that must run; it does not replace `product-rd-workflow`, `testing-strategy`, `product-ui-ux-design`, stack-specific development skills, review skills, or release workflows.
 
-**Objective high-risk change-shapes force classification even when the change feels trivial — a low-risk intuition is not a substitute for running the tags.** The "when rigor is unclear" entry is not a licence to skip the router because you judged a change low-risk: the tags below classify well *once you are here*; the failure mode is never arriving because you felt sure. So regardless of that intuition, if the change deletes / backfills / migrates data or is otherwise irreversible, touches authentication / authorization / roles / tenant isolation, handles secrets / credentials / tokens, moves money or billing / quota, alters an external-facing or service-client API contract, changes a trust boundary or an untrusted-input sink, drives a production rollout / flag, or changes a shared deterministic gate / validator / CI harness / merge-readiness or completion-status rule (which can look docs/scripts-only yet decide future merge and completion semantics), run the classification FIRST and only then conclude low-risk if the relevant tags (`write-finality`, `data-migration`, `permission-access`, `security-review`, `api-contract`, `money-quota`, `release-ops`, `shared-gate`, `ai-action`) actually clear. Self-de-escalating one of those change-shapes to "not needed" without running its tag is the miss this prevents. (The always-on routing layer and `product-rd-workflow` owner-dispatch are the backstops for the case where the router is never invoked at all — this clause governs the case where you are deciding whether it applies.)
+**Objective high-risk change-shapes force classification even when the change feels trivial — a low-risk intuition is not a substitute for running the tags.** The "when rigor is unclear" entry is not a licence to skip the router because you judged a change low-risk: the tags below classify well *once you are here*; the failure mode is never arriving because you felt sure. So regardless of that intuition, if the change deletes / backfills / migrates data or is otherwise irreversible, touches authentication / authorization / roles / tenant isolation, handles secrets / credentials / tokens, moves money or billing / quota, alters an external-facing or service-client API contract, changes a trust boundary or an untrusted-input sink, drives a production rollout / flag, or changes a shared deterministic gate / validator / CI harness / merge-readiness or completion-status rule (which can look docs/scripts-only yet decide future merge and completion semantics), run the classification FIRST and only then conclude low-risk if the relevant tags (`write-finality`, `data-migration`, `permission-access`, `security-review`, `api-contract`, `money-quota`, `release-ops`, `shared-gate`, `ai-action`) actually clear. Self-de-escalating one of those change-shapes to "not needed" without running its tag is the miss this prevents.
+
+- Tone and diff size are not classification inputs: a reporter's urgent tone or executive pressure must never escalate a change's tags, and a small diff must never de-escalate them — tags run on the change's objective shape (production impact, frequency, money/data finality, workaround availability, rollback difficulty, verification sufficiency). (The always-on routing layer and `product-rd-workflow` owner-dispatch are the backstops for the case where the router is never invoked at all — this clause governs the case where you are deciding whether it applies.)
 
 ## Output Contract
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/go-microservice-architecture/references/architecture-playbook.md

@@ -89,7 +89,7 @@ Not appropriate for:
 - Keep transport DTOs, application parameters/results, domain objects, and storage models as separate boundaries when behavior or compatibility is non-trivial.
 - Patch/update contracts need presence semantics, not only zero values.
 - For finite values used across contracts, domain logic, persistence, clients, analytics, or events, architecture owns the semantic source of truth. Decide the canonical owner, shared contract/package location, allowed representations per boundary, parser/canonicalization owner, unknown/default behavior, and rollout order. If a shared location does not yet exist, the architecture decision must approve a local fallback and a consolidation task with owner and deadline; unowned `finite-value-debt` markers are architecture findings.
-- **RPC framework choice: Kitex remains the default; ConnectRPC is the credible 2025-2026 alternative for specific contexts**. Per `connectrpc.com` docs, Connect ships as a single small Go package (single-digit-thousand LOC), built on `net/http` with handlers implementing `http.Handler` and clients wrapping `http.Client` — works with any third-party router, middleware, or server. Supports three protocols (gRPC, gRPC-Web, Connect's own protocol) over both HTTP/1.1 and HTTP/2; any gRPC client in any language can call a Connect server, and Connect clients can call any gRPC server (validated by Google's interop tests). CNCF-incubated as of 2025; production-adopted at CrowdStrike, PlanetScale, Bluesky, Dropbox per `buf.build/blog`. Architecture choice: **choose Connect** when (a) the service hosts a browser-facing API and gRPC-Web is the main use case (Connect collapses gRPC + gRPC-Web + Connect into one server), (b) the service is small and Kitex's framework surface is over-spec'd, (c) the service must interop bidirectionally with multi-language gRPC clients but the team wants to avoid grpc-go's 130k-LOC dependency footprint. **Stay on Kitex** when (a) the team already operates Kitex across many services and the platform observability/middleware/registry contracts are Kitex-native, (b) Thrift IDL (TTHeader / TTHeader Streaming) is in active use alongside protobuf — Connect is protobuf-only, (c) Kitex-specific features (StreamX, FastCodec, generic call) are load-bearing. The two are NOT mutually exclusive: a Connect-based public-edge gateway can fan out to internal Kitex services, but **wire compatibility alone is not interop** — Connect speaks gRPC on the wire when configured for gRPC, and Kitex servers configured with the gRPC meta handler can accept those calls; however, Kitex services in production typically depend on Kitex-specific framework metadata (lane / tenant / caller-identity ctx values propagated via TTHeader or Kitex middleware), and Connect clients do not emit those by default. The fan-out works ONLY when (a) the target Kitex services are configured for the gRPC meta handler (not TTHeader), (b) the Connect-side Go client explicitly attaches the gRPC metadata (`metadata.MD`) that the Kitex service's middleware reads as caller-identity / lane / tenant — typically through a small adapter layer at the Connect-side that pulls fields from the Connect call context and writes them as gRPC headers, (c) any Kitex-specific TTHeader Streaming / generic call / Thrift-only paths stay routed through a Kitex-native edge instead. Plan the adapter layer as a first-class architecture component, not a one-line bridge; otherwise tenant / lane context drops silently at the protocol boundary and downstream services run without isolation.
+- **RPC framework choice: Kitex remains the default; ConnectRPC is the credible 2025-2026 alternative for specific contexts**. Per `connectrpc.com` docs, Connect ships as a single small Go package (single-digit-thousand LOC), built on `net/http` with handlers implementing `http.Handler` and clients wrapping `http.Client` — works with any third-party router, middleware, or server. Supports three protocols (gRPC, gRPC-Web, Connect's own protocol) over both HTTP/1.1 and HTTP/2; any gRPC client in any language can call a Connect server, and Connect clients can call any gRPC server (the project validates gRPC compatibility with an extended version of Google's own gRPC interoperability test suite). CNCF **sandbox** project (per connectrpc.com, 2026-08 — not incubating/graduated); production-adopted at CrowdStrike, PlanetScale, Bluesky, Dropbox per `buf.build/blog`. Architecture choice: **choose Connect** when (a) the service hosts a browser-facing API and gRPC-Web is the main use case (Connect collapses gRPC + gRPC-Web + Connect into one server), (b) the service is small and Kitex's framework surface is over-spec'd, (c) the service must interop bidirectionally with multi-language gRPC clients but the team wants to avoid grpc-go's 130k-LOC dependency footprint. **Stay on Kitex** when (a) the team already operates Kitex across many services and the platform observability/middleware/registry contracts are Kitex-native, (b) Thrift IDL (TTHeader / TTHeader Streaming) is in active use alongside protobuf — Connect is protobuf-only, (c) Kitex-specific features (StreamX, FastCodec, generic call) are load-bearing. The two are NOT mutually exclusive: a Connect-based public-edge gateway can fan out to internal Kitex services, but **wire compatibility alone is not interop** — Connect speaks gRPC on the wire when configured for gRPC, and Kitex servers configured with the gRPC meta handler can accept those calls; however, Kitex services in production typically depend on Kitex-specific framework metadata (lane / tenant / caller-identity ctx values propagated via TTHeader or Kitex middleware), and Connect clients do not emit those by default. The fan-out works ONLY when (a) the target Kitex services are configured for the gRPC meta handler (not TTHeader), (b) the Connect-side Go client explicitly attaches the gRPC metadata (`metadata.MD`) that the Kitex service's middleware reads as caller-identity / lane / tenant — typically through a small adapter layer at the Connect-side that pulls fields from the Connect call context and writes them as gRPC headers, (c) any Kitex-specific TTHeader Streaming / generic call / Thrift-only paths stay routed through a Kitex-native edge instead. Plan the adapter layer as a first-class architecture component, not a one-line bridge; otherwise tenant / lane context drops silently at the protocol boundary and downstream services run without isolation.
 
 ## Data Design
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/go-microservice-architecture/references/multi-tenant-isolation.md

@@ -162,7 +162,7 @@ Tenant commitments around where data lives and who can see it shape the isolatio
 - **Residency** — "tenant X's data stays in region Y" is a region-per-tenant or region-pinned commitment; the data plane (DB, object storage, backup, analytics) all honor it; the routing layer enforces it.
 - **Sovereignty** — government / regulated tenants may require a separate stack with no cross-border access; this is a deployment-level isolation, not a runtime knob.
 - **Encryption** — at-rest encryption per tenant (separate keys per tenant) is a stronger model than a shared key.
-- **Crypto-deletion is conditional, not universal** — destroying the per-tenant key is acceptable proof of erasure **only when** the key hierarchy, key backups, envelope keys, restore paths, and the relevant regulator's interpretation all support it. NIST SP 800-88 treats cryptographic erase as a sanitization technique with conditions; some interpretations of GDPR distinguish anonymization (irreversible) from pseudonymization (key-linkable encrypted data may still be personal data). Where any condition fails, crypto-deletion is a *beyond-use / suppression* control (one of the per-store deletion modes above), not proof of erasure; the deletion workflow records the actual mode achieved per tenant per store, and the tenant is told what was achieved. **Required evidence before recording "erasure" via crypto-deletion**, per store and per tenant; each artifact must be authentic to *this* deletion, not theatrical paperwork:
+- **Crypto-deletion is conditional, not universal** — destroying the per-tenant key is acceptable proof of erasure **only when** the key hierarchy, key backups, envelope keys, restore paths, and the relevant regulator's interpretation all support it. NIST SP 800-88 treats cryptographic erase as a sanitization technique with explicit conditions — do not use CE when data predates encryption enablement or when keys were backed up/escrowed without verified protection (conditions as stated in Rev.1 §2.6; Rev.2, 2025, supersedes Rev.1 and continues the CE-conditions framework — verify the corresponding Rev.2 section when citing it as the authority); and EDPB guidance (e.g. Guidelines 02/2025) holds that encrypted personal data remains personal data "at least until the algorithm is broken", so key destruction is a conditional control, not automatic GDPR erasure. Where any condition fails, crypto-deletion is a *beyond-use / suppression* control (one of the per-store deletion modes above), not proof of erasure; the deletion workflow records the actual mode achieved per tenant per store, and the tenant is told what was achieved. **Required evidence before recording "erasure" via crypto-deletion**, per store and per tenant; each artifact must be authentic to *this* deletion, not theatrical paperwork:
   - *(a) key hierarchy diagram* — scoped to this store and this tenant's key version, dated within a defined freshness window (e.g., last 30 days), showing every key that wraps or could reconstruct the data.
   - *(b) key-backup inventory* — for this store, scoped to this tenant's keys, naming every backup location, rotation policy, and the holder of each backup; dated within the freshness window.
   - *(c) restore-path test result* — run against *this* backup store with *this* tenant's key-version destroyed, confirming the restore fails because the key is gone. A restore test on a different store or a different key-version is not evidence.

package/dist/assets/marketplace/plugins/ccl-skills/skills/go-microservice-dev/SKILL.md

@@ -18,7 +18,10 @@ Use this for implementation of new backend products and services. It should adap
 - Use codebase-specific skills only when the task is explicitly about an existing legacy/workspace repository.
 - Development references should turn already-chosen architecture into code, tests, and generated artifacts. If a change requires choosing ownership, security model, source of truth, or release governance, first apply `go-microservice-architecture`.
 - For money, billing, quota, permission, tenant/user data isolation, high-impact AI, repeated writes, async finality, or incident-explanation risk, apply `product-rd-workflow` high-risk resilience gates and route test-layer design through `testing-strategy`.
-- When a change edits strings, templates, or config values that are returned to, persisted for, emitted to, served to, synchronized with, or configured for client consumption (error copy, labels, notification text, localization payloads, content/CMS/seed rows, message or notification templates, flag-delivered content), classify the consumers with a recorded bounded check (client repo / contract / locale search) before closing on API/log evidence; if any client surface renders the value user-facing, or consumers are unknown, load `product-ui-ux-design` and record its implementation-owner checkpoint — including the consuming client stack owner(s) and `testing-strategy` per that checkpoint's field list — with client-side rendered-evidence routing. Backend-only closure without that recorded consumer check is invalid.
+- When a change can alter what a client renders or which state, action, or decision path it offers—including strings/templates/config/flags and API/event/schema fields, enums, status/progress, permission/capability signals, defaults, or result shapes—load `../product-ui-ux-design/references/delivery-contract.md`, create the applicable full or lightweight record in that contract, and follow its canonical consumer-universe classification, design/test/client handoffs, and terminal-status rules.
+- This Go owner returns only its `producer_record` delta: immutable binding, build/schema/config artifact identity, exact command/environment, and API/event/log/output observation.
+
+- For a standalone Go CLI, this skill owns Go parser/library implementation mechanics. Any change to a user-facing command tree, subcommand, flag/default/action path, help/output/exit behavior, confirmation, progress, or recovery path also loads `terminal-cli-dev`, which owns the terminal contract and its UI/UX/testing handoff. Only internal parser refactors proven to preserve all user-visible semantics may skip that owner.
 
 ## Generalization Discipline
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/go-microservice-dev/references/state-machine-task-patterns.md

@@ -22,6 +22,8 @@ For generic async, consumer, scheduled-job, panic recovery, context timeout, and
 - Start transitions should move pending work to processing before expensive work.
 - Failure transitions should capture canonical error code, safe message, retryable flag, retry count, and last trace or log id.
 - Success transitions should persist result pointer or summary before publishing completion events.
+- All timestamps the transition itself stamps come from a single captured `now` (capturing the clock twice inside one transition produces `finished_at < started_at` records or audit rows disagreeing with the state row under load); domain-provided times — an upstream completion time, an event time — are recorded as received, never re-stamped with the local `now`.
+- Validate external/dependency response structure before casting or mapping it: an assertion/parse step with a typed error path, never a blind cast — a malformed upstream payload must become a failure transition with the canonical error, not a panic or silently-zeroed field.
 
 ## Async Processing
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/llm-inference-integration/SKILL.md

@@ -16,7 +16,8 @@ Use this for product backend work that calls, hosts, evaluates, or operates LLM
 - Use `product-rd-workflow` first when the request spans product goal, PRD, architecture, implementation plan, release, and learning loop.
 - Use `product-rd-workflow` first for AI/algorithm product launch SOPs, business acceptance baselines, build-vs-buy ROI, new-vs-iteration launch gates, or multi-algorithm product quality gates. This skill owns inference implementation/evaluation mechanics after the product gate is defined.
 - For high-impact answers or decisions where wrong output can mislead users, affect money/rights/access, or create support/compliance risk, use `product-rd-workflow` high-risk resilience gates before fallback, downgrade, or launch decisions.
-- When a change edits strings, templates, or config values that are returned to, persisted for, emitted to, served to, synchronized with, or configured for client consumption (error copy, labels, notification text, localization payloads, content/CMS/seed rows, message or notification templates, flag-delivered content), classify the consumers with a recorded bounded check (client repo / contract / locale search) before closing on API/log evidence; if any client surface renders the value user-facing, or consumers are unknown, load `product-ui-ux-design` and record its implementation-owner checkpoint — including the consuming client stack owner(s) and `testing-strategy` per that checkpoint's field list — with client-side rendered-evidence routing. Inference-side closure without that recorded consumer check is invalid.
+- When a change can alter what a client renders or which state, action, or decision path it offers—including strings/templates/config/flags and API/event/schema fields, enums, status/progress, permission/capability signals, defaults, or result shapes—you must load `../product-ui-ux-design/references/delivery-contract.md`, create the applicable full or lightweight record in that contract, and follow its canonical consumer-universe classification, design/test/client handoffs, and terminal-status rules.
+- This inference owner returns only its `producer_record` delta: immutable binding, prompt/model/config/artifact identity, exact command/environment, and API/event/log/output observation.
 
 ## Generalization Discipline
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/llm-inference-integration/references/inference-capacity-operations.md

@@ -43,6 +43,30 @@ Before rollout, run a bounded capacity check for:
 
 Use dry-run or report-only modes for migration/backfill/batch jobs whenever possible.
 
+## Provider Evaluation Evidence Ladder
+
+When the decision is "adopt / switch to / gray-ramp provider X or model Y for a real workload" (procurement or migration, not routine regression), the two questions are: is it cheaper on the real workload, and is it stable at the required load — and neither is answerable from a model list, a public price page, or one successful request.
+
+**Contract before the first paid call.** Write down: exact environment/model IDs/protocol/credential scope; the production request-shape distribution being simulated; the capability-parity checklist; **spend cap, request cap, wall-time cap, automatic stop conditions, and who approved the budget** — enforced by reservation at admission (mechanics in the bullet below), so the invariant is cap ≥ reconciled spend + outstanding reservations at all times; the stop latch halts new admissions, not merely accounting; and the acceptance thresholds plus which decision this run feeds. Thresholds precede data (measurement-design discipline); a run whose stop conditions were invented after the spend is not an evaluation. Before any run that costs money or creates external resources, show the (redacted) config plus the exact commands and estimated cost/duration and get explicit confirmation — never proceed on inferred consent.
+
+- Reservation mechanics: admission must be an atomic check-and-reserve against a single reservation ledger — read-headroom-then-reserve is a TOCTOU that lets concurrent workers jointly overshoot the cap — and a reservation releases only on billing reconciliation, never on completion alone (usage/billing signals lag).
+
+**Seven evidence layers — a stronger layer may use lower layers as context, never substitute for them:**
+1. published claim (price page / model card) →
+2. authenticated control-plane fact (the model is actually on this account/region) →
+3. single-call data-plane success →
+4. capability parity on the checklist (structured output, tool use, streaming, context length — against the exact model string; aliases/version suffixes/casing variants are non-equivalent until proven) →
+5. capacity/stability under sustained load →
+6. billing reconciliation (billed vs calculated within tolerance, e.g. ≤2%; failure/cancel/refund behavior checked against the contract) →
+7. end-to-end on the real workload path.
+A PASS verdict binds to the **exact** account/model/region/protocol combination that produced layers 3-7; anything less is CONDITIONAL/FAIL/BLOCKED naming the missing layer.
+
+**Load-methodology minima:** drive load open-loop at a fixed arrival rate — closed-loop concurrency hides throughput loss when requests slow down (coordinated-omission family: Schroeder et al., "Open Versus Closed", NSDI'06; Gil Tene's coordinated-omission analysis for the latency-distortion half). Report first-attempt results separately from retry-assisted results. Make warmup semantics explicit — including cold start measures the real user experience, excluding it measures steady-state capability; they are two different experiments, name which one you ran. Step the load (fractional → 1× → burst) with pre-set stop thresholds per stage, include a recovery segment (idle then back to 1×), and never continue to a higher stage merely to fill a report.
+
+- A sample count below ~3 runs per cell must be reported as unreliable, never averaged into a verdict (team heuristic, no external source — raise the floor per your observed variance).
+
+**Cost accounting:** separate the five cost frames — internal charge-back price, incumbent's actually-paid price, candidate's nominal price, candidate's measured price on the real workload, and cash cost (tax/discount/FX) — and state which frames are assumptions rather than quotes. Task submission ≠ success: success requires the expected terminal state, a usable artifact, normalized usage, and billing evidence; an HTTP 200 carrying an error envelope is a failure. The attempt ledger is append-only — a retry never overwrites a failed attempt's record.
+
 ## Fine-Tuning And Local Models
 
 - Treat fine-tuned models as registry versions with parent base model, training data lineage, training job id, parameter recipe, eval gate, and rollback path.