@ccoalm/ccl-skills 0.8.0 → 0.10.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_routing_bank_integrity.sh

@@ -71,20 +71,52 @@ with open(bank, encoding="utf-8") as fh:
         elif rid:
             seen[rid] = lineno
 
+        # "none" is the runner's negative-control / coverage-gap sentinel
+        # (eval-routing-bank.rb): the expected outcome is that no catalog skill
+        # claims the utterance. It is an outcome, never a routable target.
         expected = row.get("expected_skill")
-        if expected and expected not in installed:
+        if expected and expected != "none" and expected not in installed:
             bad(f"line {lineno} ({rid}): expected_skill '{expected}' is not a skill in skills/")
 
-        must_not = row.get("must_not_route_to") or []
-        if not isinstance(must_not, list):
-            bad(f"line {lineno} ({rid}): must_not_route_to must be a list")
+        # Type-check the ORIGINAL value: `x or []` would first convert an
+        # explicitly invalid "" (or 0/false) into a clean empty list, so the
+        # deterministic lane would pass a row the Ruby runner rejects.
+        must_not = row.get("must_not_route_to")
+        if must_not is None:
+            must_not = []
+        elif not isinstance(must_not, list):
+            bad(f"line {lineno} ({rid}): must_not_route_to must be a list, got {must_not!r}")
             must_not = []
         for target in must_not:
-            if target not in installed:
+            if target == "none":
+                bad(f"line {lineno} ({rid}): must_not_route_to names the sentinel 'none' (an outcome, not a routable target)")
+            elif target not in installed:
                 bad(f"line {lineno} ({rid}): must_not_route_to names '{target}', not a skill in skills/")
             if target == expected:
                 bad(f"line {lineno} ({rid}): '{target}' is both expected_skill and must_not_route_to")
 
+        acceptable = row.get("acceptable")
+        if acceptable is None:
+            acceptable = []
+        elif not isinstance(acceptable, list):
+            bad(f"line {lineno} ({rid}): acceptable must be a list, got {acceptable!r}")
+            acceptable = []
+        for target in acceptable:
+            if target != "none" and target not in installed:
+                bad(f"line {lineno} ({rid}): acceptable names '{target}', not a skill in skills/ (nor the 'none' sentinel)")
+            if target == expected:
+                bad(f"line {lineno} ({rid}): '{target}' is both expected_skill and acceptable (redundant)")
+            if target in must_not:
+                bad(f"line {lineno} ({rid}): '{target}' is both acceptable and must_not_route_to (contradictory)")
+
+        # Anti-gaming mirror of the runner's vacuous-row rule: expected +
+        # acceptable must leave at least one outcome that would fail the row,
+        # or every valid grader selection passes and the fixture fakes green.
+        if isinstance(acceptable, list) and expected:
+            outcome_space = set(installed) | {"none"}
+            if not outcome_space - ({expected} | set(acceptable)):
+                bad(f"line {lineno} ({rid}): expected_skill plus acceptable cover every possible outcome (vacuous row)")
+
 # A truncated or emptied bank must fail rather than vacuously pass.
 MIN_ROWS = 100
 if rows < MIN_ROWS:
@@ -203,3 +235,52 @@ print(f"routing_bank_provenance_info: source present on {with_source}/{rows} row
       f"(docs/f4-skill-effectiveness-harness.md lists it as required; not enforced here)")
 print(f"routing_bank_integrity_ok rows={rows} (structure only — routing NOT evaluated)")
 PY
+main_rc=$?
+[ "$main_rc" -eq 0 ] || exit "$main_rc"
+
+# --- validator self-proof (oracle-can-fail) ----------------------------------
+# A green main run proves nothing about the new field predicates unless the
+# validator is also seen to RED on applied mutants. Run this same script once
+# against a synthetic root carrying one mutant per predicate, and require both
+# the non-zero exit and each predicate's own FAIL message. Guarded against
+# recursion: the inner invocation skips this section.
+if [ -z "${BANK_INTEGRITY_SELFPROOF:-}" ]; then
+  SP_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/bank-integrity-selfproof.XXXXXX")"
+  trap 'rm -rf "$SP_ROOT"' EXIT
+  mkdir -p "$SP_ROOT/skills/testing-strategy" "$SP_ROOT/skills/tighten-doc" "$SP_ROOT/eval"
+  printf -- '---\ndescription: stub\n---\n' > "$SP_ROOT/skills/testing-strategy/SKILL.md"
+  printf -- '---\ndescription: stub\n---\n' > "$SP_ROOT/skills/tighten-doc/SKILL.md"
+  cat > "$SP_ROOT/eval/routing-tasks.jsonl" <<'MUTANTS'
+{"id": "bad-mustnot-none", "utterance": "x", "expected_skill": "testing-strategy", "why_expected": "y", "frozen_at_sha": "root", "must_not_route_to": ["none"]}
+{"id": "bad-acc-restate", "utterance": "x", "expected_skill": "testing-strategy", "why_expected": "y", "frozen_at_sha": "root", "acceptable": ["testing-strategy"]}
+{"id": "bad-acc-unknown", "utterance": "x", "expected_skill": "testing-strategy", "why_expected": "y", "frozen_at_sha": "root", "acceptable": ["not-a-skill"]}
+{"id": "bad-acc-contradict", "utterance": "x", "expected_skill": "testing-strategy", "why_expected": "y", "frozen_at_sha": "root", "acceptable": ["tighten-doc"], "must_not_route_to": ["tighten-doc"]}
+{"id": "bad-acc-empty-string", "utterance": "x", "expected_skill": "testing-strategy", "why_expected": "y", "frozen_at_sha": "root", "acceptable": ""}
+{"id": "bad-mustnot-empty-string", "utterance": "x", "expected_skill": "testing-strategy", "why_expected": "y", "frozen_at_sha": "root", "must_not_route_to": ""}
+{"id": "bad-none-typo", "utterance": "x", "expected_skill": "not-a-skill", "why_expected": "y", "frozen_at_sha": "root"}
+{"id": "bad-universal-pass", "utterance": "x", "expected_skill": "testing-strategy", "why_expected": "y", "frozen_at_sha": "root", "acceptable": ["tighten-doc", "none"]}
+MUTANTS
+  sp_out="$(BANK_INTEGRITY_SELFPROOF=1 BANK_ROOT="$SP_ROOT" bash "$0" 2>&1)"
+  sp_rc=$?
+  if [ "$sp_rc" -eq 0 ]; then
+    echo "FAIL: validator self-proof — the mutant bank exited 0 (the oracle cannot fail)" >&2
+    exit 1
+  fi
+  for expect in \
+    "bad-mustnot-none): must_not_route_to names the sentinel 'none'" \
+    "bad-acc-restate): 'testing-strategy' is both expected_skill and acceptable" \
+    "bad-acc-unknown): acceptable names 'not-a-skill'" \
+    "bad-acc-contradict): 'tighten-doc' is both acceptable and must_not_route_to" \
+    "bad-acc-empty-string): acceptable must be a list, got ''" \
+    "bad-mustnot-empty-string): must_not_route_to must be a list, got ''" \
+    "bad-none-typo): expected_skill 'not-a-skill' is not a skill in skills/" \
+    "bad-universal-pass): expected_skill plus acceptable cover every possible outcome (vacuous row)"; do
+    case "$sp_out" in
+      *"$expect"*) : ;;
+      *) echo "FAIL: validator self-proof — expected mutant message not found: $expect" >&2
+         echo "$sp_out" >&2
+         exit 1 ;;
+    esac
+  done
+  echo "routing_bank_validator_selfproof_ok: 8 applied mutants red on their own assertions"
+fi

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_validate_extraction_review_state.sh

@@ -140,7 +140,7 @@ def make_fixture(
     receipt_mutators=None,
     completion=True,
     completion_mutator=None,
-    budget=2,
+    budget=1,
     base_shas=None,
     closeout=None,
     unmatched=0,
@@ -168,9 +168,9 @@ def make_fixture(
     for index, findings in enumerate(receipt_findings, start=1):
         mode = "review" if index == 1 else "challenge"
         status = "findings" if findings else "passed"
-        remaining = 3 - index
+        remaining = 2 - index
         if status == "findings":
-            state = "post_review_budget" if index == 3 else "findings_pending"
+            state = "post_review_budget" if index == 2 else "findings_pending"
         else:
             state = "reviewed"
         receipt = {
@@ -181,7 +181,7 @@ def make_fixture(
             "review_chain_tracked": True,
             "review_chain_id": "extraction-chain",
             "autonomous_review_index": index,
-            "autonomous_review_budget": 3,
+            "autonomous_review_budget": 2,
             "autonomous_reviews_remaining": remaining,
             "autonomous_review_allowed": remaining > 0,
             "challenge_index": 0 if index == 1 else index - 1,
@@ -221,7 +221,7 @@ def make_fixture(
             "review_chain_tracked": True,
             "review_chain_id": final["review_chain_id"],
             "autonomous_review_index": final["autonomous_review_index"],
-            "autonomous_review_budget": 3,
+            "autonomous_review_budget": 2,
             "autonomous_reviews_remaining": final["autonomous_reviews_remaining"],
             "autonomous_review_allowed": False,
             "challenge_budget": budget,
@@ -411,9 +411,9 @@ run("float-schema", float_schema["ledger"], 1, "schema_version must be 3")
 
 float_budget = make_fixture(
     "float-budget",
-    receipt_mutators={2: lambda row: row.update(challenge_budget=2.0)},
+    receipt_mutators={2: lambda row: row.update(challenge_budget=1.0)},
 )
-run("float-budget", float_budget["ledger"], 1, "challenge_budget must be 2")
+run("float-budget", float_budget["ledger"], 1, "challenge_budget must be 1")
 
 nan_schema = make_fixture("nan-schema")
 nan_schema["ledger"]["schema_version"] = float("nan")
@@ -493,11 +493,17 @@ scope_mismatch = make_fixture("scope-mismatch", receipt_mutators={2: drift_scope
 run("scope-mismatch", scope_mismatch["ledger"], 1, "review scope changed")
 
 budget_four = make_fixture("budget-four", budget=4)
-run("budget-four", budget_four["ledger"], 1, "challenge_budget must be 2")
+run("budget-four", budget_four["ledger"], 1, "challenge_budget must be 1")
 
 review_only = make_fixture("review-only", receipt_findings=[[]])
 run("review-only", review_only["ledger"], 1, "ready requires at least one tracked challenge")
 
+# A caller must not out-run the wrapper budget by supplying extra receipts: a
+# third receipt under budget 1 claims a negative remaining count and would
+# otherwise reach completion validation as a ready-state budget bypass.
+over_budget = make_fixture("over-budget", receipt_findings=[[], [], []])
+run("over-budget", over_budget["ledger"], 1, "exceeds the wrapper budget")
+
 missing_complete = make_fixture("missing-complete")
 missing_complete["ledger"]["completion_receipt"] = None
 run("missing-complete", missing_complete["ledger"], 1, "requires a completion receipt")
@@ -537,7 +543,7 @@ run(
 
 continuation = make_fixture(
     "continuation",
-    receipt_findings=[[finding(1)], [], [finding(2)]],
+    receipt_findings=[[finding(1)], [finding(2)]],
     completion=False,
     open_last=True,
 )
@@ -550,10 +556,10 @@ run(
 
 continuation_unconsumed_first_drift = make_fixture(
     "continuation-unconsumed-first-drift",
-    receipt_findings=[[finding(1)], [], [finding(2)]],
+    receipt_findings=[[finding(1)], [finding(2)]],
     completion=False,
     open_last=True,
-    base_shas=[A, A, A, B],
+    base_shas=[A, A, B],
 )
 run(
     "continuation-unconsumed-first-drift",
@@ -564,7 +570,7 @@ run(
 
 continuation_candidate = make_fixture(
     "continuation-candidate",
-    receipt_findings=[[finding(1)], [], [finding(2)]],
+    receipt_findings=[[finding(1)], [finding(2)]],
     completion=False,
     open_last=True,
 )
@@ -595,8 +601,8 @@ run(
 
 unknown_state = make_fixture(
     "unknown-state",
-    receipt_findings=[[finding(1)], [], [finding(2)]],
-    receipt_mutators={3: lambda row: row.update(review_state="potato")},
+    receipt_findings=[[finding(1)], [finding(2)]],
+    receipt_mutators={2: lambda row: row.update(review_state="potato")},
     completion=False,
     open_last=True,
 )
@@ -605,10 +611,10 @@ run("unknown-state", unknown_state["ledger"], 1, "unknown controller review_stat
 
 passed_continuation = make_fixture(
     "passed-continuation",
-    receipt_findings=[[finding(1)], [], []],
+    receipt_findings=[[finding(1)], []],
     completion=False,
 )
-run("passed-continuation", passed_continuation["ledger"], 1, "round 3 findings in post_review_budget")
+run("passed-continuation", passed_continuation["ledger"], 1, "findings in post_review_budget")
 
 bad_finding_hash = make_fixture("bad-finding-hash")
 bad_finding_hash["ledger"]["finding_classes"][0]["occurrences"][0][
@@ -744,7 +750,7 @@ run(
 
 historical_open = make_fixture(
     "historical-open",
-    receipt_findings=[[finding(1)], [finding(2)], []],
+    receipt_findings=[[finding(1), finding(2)], []],
 )
 historical_open["ledger"]["finding_classes"][0]["occurrences"][0][
     "disposition"
@@ -756,7 +762,7 @@ run("historical-open", historical_open["ledger"], 1, "unresolved finding occurre
 
 historical_open_linked = make_fixture(
     "historical-open-linked",
-    receipt_findings=[[finding(1)], [finding(2)], []],
+    receipt_findings=[[finding(1), finding(2)], []],
 )
 historical_open_linked_occurrences = historical_open_linked["ledger"][
     "finding_classes"
@@ -825,7 +831,7 @@ run("needs-human", needs_human["ledger"], 1, "unresolved finding occurrence")
 
 third_occurrence = make_fixture(
     "third-occurrence",
-    receipt_findings=[[finding(1)], [finding(2)], [finding(3)]],
+    receipt_findings=[[finding(1), finding(2)], [finding(3)]],
     completion=False,
     unmatched=1,
     open_last=True,
@@ -1045,7 +1051,7 @@ for closing_disposition in sorted(CLOSED_DISPOSITIONS):
     case_name = f"historical-needs-human-{closing_disposition.replace('_', '-')}"
     historical_needs_human_linked = make_fixture(
         case_name,
-        receipt_findings=[[finding(1)], [finding(2)], []],
+        receipt_findings=[[finding(1), finding(2)], []],
     )
     historical_needs_human_occurrences = historical_needs_human_linked["ledger"][
         "finding_classes"
@@ -1128,7 +1134,7 @@ duplicate_completion_result = invoke(
 
 duplicate_sweep = make_fixture(
     "duplicate-sweep",
-    receipt_findings=[[finding(1)], [finding(2)], [finding(3)]],
+    receipt_findings=[[finding(1), finding(2)], [finding(3)]],
     completion=False,
     open_last=True,
 )

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/validate_extraction_review_state.py

@@ -30,6 +30,11 @@ TERMINAL_STATES = {
 }
 EXTERNAL_REVIEW_STATES = {"reviewed", "findings_pending", "post_review_budget"}
 KNOWN_REVIEW_STATES = EXTERNAL_REVIEW_STATES | {"self_reviewed"}
+# The extraction wrapper fixes the autonomous lane at one review plus one
+# challenge; every numeric bound below derives from these two constants so a
+# future budget change lands in exactly one place.
+WRAPPER_CHALLENGE_BUDGET = 1
+WRAPPER_AUTONOMOUS_ROUNDS = WRAPPER_CHALLENGE_BUDGET + 1
 DISPOSITIONS = {
     "fixed",
     "source_refuted",
@@ -272,8 +277,8 @@ def validate_scope(receipt: dict[str, Any], label: str) -> str:
     ]
     if len(normalized_risks) != len(set(normalized_risks)):
         fail(f"{label}.review_scope.risk_tags contains duplicates")
-    if scope["challenge_budget"] != 2 or type(scope["challenge_budget"]) is not int:
-        fail(f"{label}.review_scope.challenge_budget must be 2")
+    if scope["challenge_budget"] != WRAPPER_CHALLENGE_BUDGET or type(scope["challenge_budget"]) is not int:
+        fail(f"{label}.review_scope.challenge_budget must be {WRAPPER_CHALLENGE_BUDGET}")
     if (
         scope["wording_only_proof_sha256"] is not None
         or scope["wording_only_scope_sha256"] is not None
@@ -313,6 +318,11 @@ def validate_controller_receipts(
         payload["candidate_sha256"], "ledger.candidate_sha256"
     )
     for expected_index, value in enumerate(refs, start=1):
+        # A caller supplying more receipts than the wrapper can mint would
+        # otherwise claim a negative remaining count and reach completion
+        # validation as a ready-state budget bypass.
+        if expected_index > WRAPPER_AUTONOMOUS_ROUNDS:
+            fail("controller chain exceeds the wrapper budget")
         ref = exact_object(
             value, {"sequence", "file", "sha256"}, f"controller_receipts[{expected_index - 1}]"
         )
@@ -352,13 +362,13 @@ def validate_controller_receipts(
             receipt.get("challenge_index")
         ) is not int:
             fail(f"controller receipt {expected_index} challenge_index is invalid")
-        if receipt.get("challenge_budget") != 2 or type(receipt.get("challenge_budget")) is not int:
-            fail(f"controller receipt {expected_index} challenge_budget must be 2")
-        if receipt.get("autonomous_review_budget") != 3 or type(
+        if receipt.get("challenge_budget") != WRAPPER_CHALLENGE_BUDGET or type(receipt.get("challenge_budget")) is not int:
+            fail(f"controller receipt {expected_index} challenge_budget must be {WRAPPER_CHALLENGE_BUDGET}")
+        if receipt.get("autonomous_review_budget") != WRAPPER_AUTONOMOUS_ROUNDS or type(
             receipt.get("autonomous_review_budget")
         ) is not int:
-            fail(f"controller receipt {expected_index} autonomous_review_budget must be 3")
-        expected_remaining = 3 - expected_index
+            fail(f"controller receipt {expected_index} autonomous_review_budget must be {WRAPPER_AUTONOMOUS_ROUNDS}")
+        expected_remaining = WRAPPER_AUTONOMOUS_ROUNDS - expected_index
         if receipt.get("autonomous_reviews_remaining") != expected_remaining or type(
             receipt.get("autonomous_reviews_remaining")
         ) is not int:
@@ -415,7 +425,7 @@ def validate_controller_receipts(
             fail(f"controller receipt {expected_index} has unknown controller review_state {state}")
         expected_state = (
             "post_review_budget"
-            if receipt["status"] == "findings" and expected_index == 3
+            if receipt["status"] == "findings" and expected_index == WRAPPER_AUTONOMOUS_ROUNDS
             else "findings_pending"
             if receipt["status"] == "findings"
             else "reviewed"
@@ -469,17 +479,17 @@ def validate_completion_receipt(
         fail("completion receipt cannot close a final external receipt with findings")
     if receipt.get("review_chain_tracked") is not True or receipt.get("review_chain_id") != chain_id:
         fail("completion receipt review_chain_id does not match the controller chain")
-    if receipt.get("challenge_budget") != 2 or type(receipt.get("challenge_budget")) is not int:
-        fail("completion receipt challenge_budget must be 2")
-    if receipt.get("autonomous_review_budget") != 3 or type(
+    if receipt.get("challenge_budget") != WRAPPER_CHALLENGE_BUDGET or type(receipt.get("challenge_budget")) is not int:
+        fail(f"completion receipt challenge_budget must be {WRAPPER_CHALLENGE_BUDGET}")
+    if receipt.get("autonomous_review_budget") != WRAPPER_AUTONOMOUS_ROUNDS or type(
         receipt.get("autonomous_review_budget")
     ) is not int:
-        fail("completion receipt autonomous_review_budget must be 3")
+        fail(f"completion receipt autonomous_review_budget must be {WRAPPER_AUTONOMOUS_ROUNDS}")
     if receipt.get("autonomous_review_index") != len(receipts) or type(
         receipt.get("autonomous_review_index")
     ) is not int:
         fail("completion receipt autonomous_review_index does not match the final round")
-    expected_remaining = 3 - len(receipts)
+    expected_remaining = WRAPPER_AUTONOMOUS_ROUNDS - len(receipts)
     if receipt.get("autonomous_reviews_remaining") != expected_remaining or type(
         receipt.get("autonomous_reviews_remaining")
     ) is not int:
@@ -941,12 +951,12 @@ def validate(payload: dict[str, Any], ledger_dir: Path) -> tuple[str, int, int]:
     elif closeout == "continuation_authorization_required":
         final = receipts[-1]
         if (
-            len(receipts) != 3
+            len(receipts) != WRAPPER_AUTONOMOUS_ROUNDS
             or final.get("status") != "findings"
             or final.get("review_state") != "post_review_budget"
             or final.get("human_decision_required") is not True
         ):
-            fail("continuation_authorization_required requires round 3 findings in post_review_budget")
+            fail(f"continuation_authorization_required requires final-round (round {WRAPPER_AUTONOMOUS_ROUNDS}) findings in post_review_budget")
     elif closeout == "baseline_race" and not delta:
         fail("baseline_race requires a non-empty unreviewed_delta")
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/test-artifact-management/references/classical-test-design-techniques.md

@@ -13,7 +13,7 @@
 - **James Bach & Michael Bolton**, *Rapid Software Testing* — HTSM / SFDPOT
 - **Elisabeth Hendrickson**, *Explore It!* — test heuristics cheatsheet
 - **James Whittaker**, *Exploratory Software Testing* — tours
-- **Pairwise / Combinatorial**: **Kuhn / Wallace / Gallo 2004 NIST 实证**（多被测系统 2-way 捕到 50–90% 的缺陷，差异大）；工具：Microsoft PICT、NIST ACTS、Hexawise
+- **Pairwise / Combinatorial**: **Kuhn / Wallace / Gallo 2004 NIST 实证**（NIST SP 800-142 Table 1 复现其数据：各被测域 2-way 累计触发 53–97%，多数域 70–97%；NIST 同文提醒 pairwise 仍可能漏掉 10–40% 或更多缺陷，mission-critical 不足恃）；工具：Microsoft PICT、NIST ACTS、Hexawise
 - **Hans Buwalda 2004** — soap opera testing
 - **Lisa Crispin & Janet Gregory**, *Agile Testing*
 - **Glenford Myers**, *The Art of Software Testing* (1979) — error guessing 起源

package/dist/assets/marketplace/plugins/ccl-skills/skills/test-artifact-management/references/tc-review-and-prioritization.md

@@ -61,7 +61,7 @@ SKILL.md 现状 P0 / P1 / P2 是经验判断（"blocking / important / nice"）
 
 ### 2.1 风险公式（最通用）
 
-**Risk = Probability × Impact**（业内 30 年共识，ISTQB / ISO 29119 同源）
+**Risk = Probability × Impact**（出处：ISTQB CTFL v4.0.1 §5.2——风险级别由 likelihood 与 impact 决定，**定量法**为二者相乘，**定性法**用风险矩阵，二者皆合规；ISO/IEC/IEEE 29119-1 采用类似 likelihood/impact 框架，原文付费墙未逐字核）
 
 **Probability**（发生概率，1-5 分）：
 - 1 = 罕见（新代码 + 简单逻辑 + 测试覆盖好）

package/dist/assets/marketplace/plugins/ccl-skills/skills/test-artifact-management/references/update-lifecycle.md

@@ -49,6 +49,8 @@ python test/scripts/gen_report.py \
 - md 同步匹配必须以 用例ID 为唯一键；模块名或功能点相同不代表是同一条记录
 - 若 md 先于 Bitable 被修改（如直接编辑文件），需将 md 变更反向同步到 Bitable，再按 update 工作流补信息流转
 - **漂移检查**：定期运行 `python gen_report.py --config test/.report-config.json --diff-md test/cases/all.md` 显示 md 与 Bitable 的 added/removed/changed；废弃记录自动排除（不在 md 里属正常）；多人编辑后必跑一次再 commit
+- **版本钉扎**：当仓内测试代码/脚本按某条 TC 实现时，在实现侧记录该 TC 的修订标识——用**定义字段的规范化快照哈希**（或 Bitable 的不可变 record 修订号，若可得）；`[姓名 日期]` 不够（同人同日二次修订会撞标识，钉住旧版仍比对相等）。实现前先比对，**回写/提测前再验一次，且回写本身走与认领相同的修订条件更新**（先验后写仍是两步——验证通过与写入之间的并发修改只有条件写能挡）——哈希只有相等性判断：**任何一次不一致都视为分歧，停下、先做源对账**（更新钉扎侧并使差异可评审后再继续）；「更新/更旧」的说法仅当平台提供不可变单调修订号时才可用；发现源记录 stale/自相矛盾时**停下先修源记录**，不得按旧版实现后事后补
+- **认领防冲突**：多人/多 agent 并发按 TC 实现时，认领必须是**原子的修订条件更新**（仅当记录修订仍等于读取时的修订才写入——平台支持的 CAS/乐观锁语义）或走**串行化认领协调者**（单写入口）。「读空→写」是 TOCTOU；「写后回读」也不等价——A 回读成功后仍可被 B 顶掉、双方各自都验证通过。两种安全机制都不可得时，**并发认领在该表上不受支持：停下改走人工/单线分配，不得按回读结果继续**。字段已有他人活跃认领时不得覆盖，改为联系认领人或换条目
 - `+record-upsert --record-id` 中的 record_id 是 Bitable 内部 ID，必须先用 `get_record_index()` 从 用例ID 查出，不能直接用 用例ID 代替
 
 ## update 工作流

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/SKILL.md

@@ -71,25 +71,25 @@ Use this skill to decide whether a specialized or non-functional test belongs in
 - Conditional skips (missing-optional-dependency guards such as module-level `importorskip`, platform/env markers) combined with per-job test selection can leave an entire test file executed in NO CI job while every pipeline stays green: the job that selects the file lacks the optional dependency (the skip fires for the whole module), and the job that has the dependency does not select the file. When a suite mixes conditional skips with job-scoped test selection, the job that owns those tests must carry an executed-count guard — the per-file invariant and the floor fallback live in `references/ci-fixtures-and-flake-control.md`. Any change to job-level selection re-verifies which files each job actually executes (run with skip reporting and read the executed/skipped counts per file). "The tests exist and CI is green" is not evidence they ran anywhere.
 - A new, ported, or mirrored enforcement mechanism (pre-edit hook, permission guard, write-blocking plugin, validator) is not verified by loading, parsing, or config inspection — those prove installation, not enforcement. Require a behavioral matrix before a completion claim — blocked case per deny-condition, allowed/no-collateral cases, the fail-open/swallowed-exception bypass set, and the canonicalization/symlink/worktree edge cases; the matrix cells, the fail-open bypass set, the safe-unavailable-gap disposition for a case that cannot be exercised safely, and the port/mirror parity procedure live in `references/verify-enforcement-mechanisms.md`. Run the matrix only against scratch/synthetic targets (a throwaway checkout/worktree, fixture repo, or dry-run mode) — never a live workspace, real user data, or live credentials. Parity claimed from code reading alone is hypothesis-grade, not evidence. When a test is **ported/mirrored to a sibling stack**, input-fixture fidelity is part of that parity — see `references/test-code-authoring-patterns.md` (跨栈移植：移植对抗输入本身).
 - A "skip CI" / "no runner" instruction does not by itself lower verification rigor, only ceremony. When the blocking CI gate is skipped or unavailable, substitute a same-risk independent check before treating the change as verified — for a tiny/doc/test-only change a local command or `diff --check` is enough; for a change that can break its own gate (it edits the test/tripwire/CI config it is guarded by), an adversarial review/challenge of the diff is what catches the self-break CI would have. Note where a local run is not equivalent to CI (secrets, OS matrix, merge-result pipeline) rather than treating it as full proof. Separately, a project-enforced merge gate (pipeline-must-pass, required review) is not waived by a "skip CI" instruction for convenience: require green status, or an explicit authorized break-glass/override with recorded reason + residual risk — surface the conflict and stop rather than silently bypassing.
-- Browser/E2E smoke must assert visible outcomes, not just click controls. For frontend API pages, verify loading, success, failure, disabled/retry behavior, and absence of dangerous actions where relevant. Capture or inspect console errors and failed network requests when the browser tool supports it.
+- Browser/E2E smoke must assert visible outcomes, not just click controls. For frontend API pages, verify loading, success, failure, disabled/retry behavior, and absence of dangerous actions where relevant. Capture console errors and failed network requests when tools support it.
 - UI tests and screenshots must prove design quality layers, not only DOM existence. Assert or visually inspect aesthetic hierarchy/density, interaction path, behavioral recovery states, and psychology-critical cues such as disabled reasons, progress certainty, retry safety, confirmation consequences, and return context.
 - For every runtime-visible UI/UX slice, load the canonical sequence in `../product-ui-ux-design/references/delivery-contract.md` and `references/client-runtime-test-matrices.md` §UI/UX Delivery Contract before Phase 0 and after producer/client execution. Testing owns layer selection and sufficiency, binds and cites the complete design/test/producer/client record and candidate-binding sets, confirms every affected client wrote its canonical pre-edit `client_entry` and complete client-record member naming the producer version it exercised, fails closed on a missing/incomplete/mismatched/stale/changed-after-run/unexercised member, and never issues the holistic design verdict.
 - Authentication and account surfaces need an explicit scenario matrix before they can be called complete. Cover identity-input validation across relevant entries, available sign-in methods, registration, account recovery or password reset/change, logout/account switching, sensitive storage/log cleanup, permission or host-authorization denial, and UI/UX acceptance for error copy, disabled reasons, keyboard/safe-area/touch behavior, and visual evidence. If a capability such as recovery, host authorization, real message delivery, or live account verification is absent or external, record it as `product gap`, `blocked`, or `live-only` instead of silently excluding it from the test claim.
-- Test cases come before implementation and broad execution for behavior-changing work. Write a compact test-case register first: scenario, layer, assertion, data/dependency, command, expected current result (`fail`, `pass-existing`, `blocked`, or `gap`), and owner. For bug fixes and user-visible or contract-visible behavior, at least one relevant case must be added or updated and run RED before implementation unless no harness can support it after normal remediation; then record the evidence gap and strongest alternate check. The same RED-first discipline applies to defect records: a reported defect (issue, QA finding) carries the reproducible command plus the actual failing output, and the fix change references that failing test — a bug "fixed" from its description alone, without a RED reproduction, is unverified.
-- Do not answer "tests are complete" from command output alone. The claim must map each important scenario to a written case or to an explicit `blocked`, `live-only`, `product gap`, or `not applicable` row.
+- Test cases come before implementation and broad execution for behavior-changing work. Write a compact test-case register first: scenario, layer, assertion, data/dependency, command, expected current result (`fail`, `pass-existing`, `blocked`, `infra-error`, or `gap`), and owner. For bug fixes and user-visible or contract-visible behavior, at least one relevant case must be added or updated and run RED before implementation unless no harness can support it after normal remediation; then record the evidence gap and strongest alternate check. The same RED-first discipline applies to defect records: a reported defect (issue, QA finding) carries the repro command plus the actual failing output, and the fix change references that failing test — a bug "fixed" from its description alone, without a RED reproduction, is unverified.
+- Do not answer "tests are complete" from command output alone. Map each important scenario to a written case or an explicit `blocked`, `live-only`, `product gap`, `infra-error`, or `not applicable` row. (verdict definitions and their mutual exclusivity: `references/ci-fixtures-and-flake-control.md`).
 - For report-only QA, baseline comparison, or "testing only" branches with no product-code changes, failing tests can be the intended deliverable.
   - This exception applies only when a human reviewer, PR owner, or user explicitly states in the current work item, PR description, or current-turn context that the deliverable is test coverage, evidence, or a QA report rather than a product fix; an agent or automated process cannot infer or self-apply this exception from prior-session memory or summarized context.
   - Do not weaken the test or patch product code just to go green.
   - For disputed or high-stakes defects, prefer splitting verification and fix into two deliverables: a test-only verification slice first pins the confirm/deny verdict and root-cause attribution, and the fix is a separate change that references it — keeping the verification verdict uncontaminated by fix intent. Its failing regression test may land skip-marked as the trace only as a bounded state, not an escape: the skip carries the reason, an owner, and the linked fix item, and accepting the fix requires un-skipping it into the blocking regression set (or an explicitly owner-signed quarantine lane) — a RED test that stays skipped after its fix merges is the bypass this rule exists to prevent.
   - The QA report is not complete until pass evidence, red-light evidence, blocked/live-only gaps, and baseline comparison are each present and non-empty or explicitly marked `not applicable`; red-light evidence and baseline comparison cannot both be `not applicable`.
-  - Live or production behavior is environment evidence, not a correctness oracle: when live behavior contradicts automated or documented expectations, record the discrepancy as a `live-only gap` with owner and do not resolve it by trusting either side.
+  - Live or production behavior is environment evidence, not a correctness oracle: when live behavior contradicts automated or documented expectations, record the discrepancy as a `live-only gap` with owner; do not resolve it by trusting either side.
   - A QA report with an open live-contradiction gap is `blocked` until the discrepancy is escalated and an owner assigns a resolution path.
-- Generated starter tests are not regression evidence: replace scaffold placeholders (e.g. a counter widget test) in the same delivery slice with assertions for the actual app shell, route, state, or user-visible contract.
-- Verification warnings are not automatically follow-up work: classify build/bundle-size/lint/flaky/deprecation/security/performance warnings from a required gate before reporting success — fix now when caused by the current slice or cheaply local; defer only with reason, residual risk, owner, and follow-up artifact.
-- Do not open, merge, or describe an MR as ready for a contract-visible change until the test matrix has been written and executed, or each unavailable layer is explicitly marked unavailable with reason and residual risk. The matrix must include the relevant unit, API/contract, integration, and browser/device/E2E layers; missing layers are a release risk, not an afterthought.
+- Generated starter tests are not regression evidence: replace scaffold placeholders in the same delivery slice with assertions for the actual app shell, route, state, or user-visible contract.
+- Verification warnings are not automatically follow-up work: classify build/bundle/lint/flaky/deprecation/security/perf warnings from a required gate before reporting success — fix now when caused by the current slice or cheaply local; defer only with reason, residual risk, owner, and follow-up artifact.
+- Do not open, merge, or describe an MR as ready for a contract-visible change until the test matrix is written and executed, or each unavailable layer is explicitly marked unavailable with reason and residual risk. The matrix must include the relevant unit, API/contract, integration, and browser/device/E2E layers; missing layers are release risk, not afterthought.
 - A multi-stack development-standard family is incomplete without a testing standard. The testing standard must define test deliverables, layer policy, harness expectations, CI gates, high-risk coverage, evidence format, and stack handoff rules; stack docs may specialize commands but must not redefine the layer policy.
-- Do not mark a browser/device/E2E layer unavailable just because discovery returns no device, browser, server, or dependency. First run the normal remediation path: launch the emulator/browser/server/container, wait for readiness, restart the client daemon if appropriate, run the repo setup script, and re-run discovery. Only after that fails may the layer be reported unavailable, with command evidence, residual risk, and next unblock action.
-- If a browser/device/E2E or host-smoke layer is classified as blocking, unavailable means the delivery is not complete. Use `pre-runtime-test-ready` only when code, lower-layer tests, and build checks are done and a named human/device owner must finish the runtime gate; this is a handoff-only label, not merge-ready or release-ready. Otherwise use `blocked`. Do not describe such work as done, fixed, ready to merge, or ready to release.
+- Do not mark a browser/device/E2E layer unavailable just because discovery returns nothing. First run the normal remediation path: launch the emulator/browser/server/container, wait for readiness, restart the client daemon if appropriate, run the repo setup script, and re-run discovery. Only after that fails may the layer be reported unavailable, with command evidence, residual risk, and next unblock action.
+- If a browser/device/E2E or host-smoke layer is classified as blocking, unavailable means the delivery is not complete. Use `pre-runtime-test-ready` only when code, lower-layer tests, and build checks are done and a named human/device owner must finish the runtime gate; a handoff-only label, not merge-ready/release-ready. Otherwise use `blocked`. Do not describe such work as done, fixed, merge-ready, or release-ready.
 
 ## Entry Decision: TC Source and Scope
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/ci-fixtures-and-flake-control.md

@@ -16,7 +16,7 @@ Duplication and dead-code gates run with explicit configuration, not defaults: t
 
 ## Frozen Regression Set And Adversarial Passes
 
-Tier the frozen regression set so the gate stays affordable: deterministic frozen cases run in the blocking release gate; cases needing live infra / model calls / real indexes run in the release or pre-ramp gate with an explicit marker, owner, and timeout (do not stuff flaky live cases into the fast gate); human-review-only cases are release evidence, not mislabeled automated tests.
+Tier the frozen regression set so the gate stays affordable: deterministic frozen cases run in the blocking release gate; cases needing live infra / model calls / real indexes run in the release or pre-ramp gate with an explicit marker, owner, and timeout (do not stuff flaky live cases into the fast gate); human-review-only cases are release evidence, not mislabeled automated tests. The tiering criterion is cost and side effects, not speed: a case that consumes paid resources (model/API spend, sandbox creation, render jobs) or mutates external state never belongs in the default always-on lane even when it happens to be fast — the default lane is reserved for cases that are free and side-effect-free to run on every change.
 
 The proactive complement — the adversarial pass over code already considered "done": run it as an active defect-discovery step, deliberately hunting coverage blind spots — error-mapping boundaries, concurrency-protection bypass, double-release/double-close paths — instead of waiting for review or production to surface them. Each confirmed gap lands as a failing test first. Candidate blind-spot classes: the risk-matrix failure classes in `scenario-testing.md`, plus the dependency fault-injection and concurrency/cache cases in `integration-contract-testing.md`.
 
@@ -24,6 +24,10 @@ The proactive complement — the adversarial pass over code already considered "
 
 Use `test-data-and-determinism.md` as the canonical source for fixture shape, anonymization, data builders, golden-file normalization, and deterministic clocks/randomness/ordering.
 
+- `infra-error` verdict semantics (the entrypoint's status family). One discriminating predicate decides the verdict — **fault origin**, not symptom: a fault in the **evidence infrastructure** (collector, fixture cache/manifest, state-preparation or controlled-fault harness — anything outside the system under test) = `infra-error`, which is never a pass, never a business fail, and never a silent skip; a fault **in the system under test** (crash, malformed product response, product-path timeout) or an assertion that evaluates to false on collected evidence = business `fail`; an **external prerequisite missing before any attempt** = `blocked`. Exactly one verdict per case; ambiguous origin is resolved by investigation, never by defaulting to whichever verdict looks better; page text, a success toast, or another weaker surface must not substitute for the missing evidence. A required case standing at `infra-error` keeps the aggregate claim incomplete — it counts against merge/release readiness exactly like `blocked`, and a report that excludes `infra-error` cases to present a clean total is a false-green report. Before coding a case, each acceptance criterion names its collector and assertion.
+
+External-asset fixtures (media files, documents, large binaries fetched from an external system) form a supply chain that gets pinned end to end: test execution reads only a local read-only cache — never downloads from the external system at run time; a committed manifest pins each asset's identity/hash and CI verifies the manifest plus every blob before the suite runs; cache/manifest verification is part of each affected case's attempted preparation, so a missing or changed cached asset maps to `infra-error` for exactly the cases that need it (a manifest failure aborting before any case attempt marks those cases `infra-error` too, not `blocked` — the infrastructure was configured and failed), never a skip and never a fallback download; seeding/refreshing the cache is a separate offline step on a trusted host, not part of the test run. This composes the network-isolation default and manifest regenerate-and-diff rules in `test-data-and-determinism.md` with the missing-dependency-is-failure rule below into one chain.
+
 ### Fault-Injection Layers For External-Provider Recovery Paths
 
 Recovery behavior against an external provider (a model API, payment/storage backend, streaming dependency) needs its fault permutations proven below the live layer. Layer the fixtures; prove each fault class at the most protocol-real layer that can still script it deterministically:

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/e2e-real-flow-testing.md

@@ -23,7 +23,7 @@ Before adding a new E2E test, create or update the scenario matrix in `scenario-
 - Save authenticated state only when the test is not about login.
 - Capture console errors, failed network requests, screenshots/traces/video when useful.
 - Use network interception only to control nondeterminism or assert payloads; do not mock away the contract that the E2E test is meant to prove.
-- **Playwright 1.5x baseline (Microsoft, ongoing 2024-2026)** is the current default-recommendation browser-E2E framework for new web testing. Key features to use deliberately, per `playwright.dev` docs: (a) **Trace Viewer** is the load-bearing debugging surface — every CI failure should produce a `trace.zip` artifact. Set `trace: 'retain-on-failure'` (not `'on-first-retry'`) when CI runs with `retries: 0` for deterministic gating — `'on-first-retry'` produces no trace unless the test actually retries, leaving teams with zero diagnostics on first-failure-then-fix-the-flake debugging cycles. Reviewers open the artifact locally or via `trace.playwright.dev` to step through actions, screenshots, network, and console without re-running the test. (b) **Soft assertions** via `const softExpect = expect.configure({ soft: true })` let one test report multiple failures rather than stopping at the first — useful for state-snapshot assertions where the team wants the whole-page diff in one run, NOT a substitute for the "one test, one behavior" discipline. (c) `toMatchAriaSnapshot()` (Playwright 1.49+) is the structured accessibility-tree assertion — call it on a locator (`expect(page.locator('main')).toMatchAriaSnapshot(...)` or `await page.locator(...).ariaSnapshot()`), preferred over DOM-string snapshots for resilience to non-semantic markup changes. (d) **Component testing** (`@playwright/experimental-ct-{react,vue,svelte}`) is still labeled experimental — use Vitest browser mode for component-level tests until Playwright component-test API stabilizes. (e) **Projects** in `playwright.config.ts` define run matrices (browser × device emulation × baseURL × config variant) and produce one merged HTML report. Note: Projects ≠ sharding — sharding is a separate `--shard=k/n` mechanism that splits a single project's tests across multiple workers/machines; teams often combine both (projects for the matrix, sharding for parallelism per project). Pin worker count and shard count for CI determinism, do not let auto-detect choose. Routing the per-stack Playwright config implementation goes to `web-react-dev/references/web-quality-release.md`; this skill owns the test-layer policy.
+- **Playwright 1.5x baseline (Microsoft, ongoing 2024-2026)** is the current default-recommendation browser-E2E framework for new web testing (community-adoption evidence, reproducible: `curl -s https://api.npmjs.org/downloads/point/2026-07-31:2026-08-29/<pkg>` for `playwright` / `@playwright/test` / `cypress` returned 339.9M / 216.2M / 30.3M (fixed range, re-verified 2026-08-30), ≈11×; State of JS 2024 testing section, `2024.stateofjs.com/en-US/libraries/testing/`, shows Playwright leading E2E usage/retention — re-run the query before citing as current). Key features to use deliberately, per `playwright.dev` docs: (a) **Trace Viewer** is the load-bearing debugging surface — every CI failure should produce a `trace.zip` artifact. Set `trace: 'retain-on-failure'` (not `'on-first-retry'`) when CI runs with `retries: 0` for deterministic gating — `'on-first-retry'` produces no trace unless the test actually retries, leaving teams with zero diagnostics on first-failure-then-fix-the-flake debugging cycles. Reviewers open the artifact locally or via `trace.playwright.dev` to step through actions, screenshots, network, and console without re-running the test. (b) **Soft assertions** via `const softExpect = expect.configure({ soft: true })` let one test report multiple failures rather than stopping at the first — useful for state-snapshot assertions where the team wants the whole-page diff in one run, NOT a substitute for the "one test, one behavior" discipline. (c) `toMatchAriaSnapshot()` (Playwright 1.49+) is the structured accessibility-tree assertion — call it on a locator (`expect(page.locator('main')).toMatchAriaSnapshot(...)` or `await page.locator(...).ariaSnapshot()`), preferred over DOM-string snapshots for resilience to non-semantic markup changes. (d) **Component testing**: Playwright's current component-testing guide replaces the former `@playwright/experimental-ct-{react,vue}` packages (`playwright.dev/docs/test-components`) — that replacement statement is all the source establishes; draw no stability or package-layout inference from it, and follow the pinned Playwright version's own installation instructions before adding or removing any component-testing package. Vitest browser mode remains a valid component-level alternative when the portfolio already standardizes on Vitest. (e) **Projects** in `playwright.config.ts` define run matrices (browser × device emulation × baseURL × config variant) and produce one merged HTML report. Note: Projects ≠ sharding — sharding is a separate `--shard=k/n` mechanism that splits a single project's tests across multiple workers/machines; teams often combine both (projects for the matrix, sharding for parallelism per project). Pin worker count and shard count for CI determinism, do not let auto-detect choose. Routing the per-stack Playwright config implementation goes to `web-react-dev/references/web-quality-release.md`; this skill owns the test-layer policy.
 
 ## Runtime QA Sweep
 
@@ -58,7 +58,7 @@ When the deliverable ships as a built or installed artifact — a package `bin`,
 - Do not reproduce every unit branch through E2E.
 - Keep E2E flows few, stable, and tied to user/business risk.
 - Prefer one happy path plus high-risk negative paths over many shallow click-throughs.
-- A click-through without assertions is not E2E evidence.
+- A click-through without assertions is not E2E evidence — and weak proxy signals are not business assertions: page loaded, URL changed, non-empty body text, a generic button/canvas/heading visible, or a success toast alone do not prove the business outcome. Anchor the pass condition on objective effects — API response fields, persisted records, balance/count deltas, generated artifact URLs (sufficient alone only when URL issuance is the claimed contract; a generation-success case dereferences the URL and validates artifact status/metadata/content, since a request can issue a valid URL and fail before storing the artifact), or a stable user-visible terminal state (alone only when the visible terminal presentation IS the claimed contract — a rendered "completed" can outrun persistence/billing/artifact creation, so business-outcome cases pair it with the durable effect) — and match assertion strength to what the test title and scenario row claim; a shallow signal is acceptable only when the case explicitly tests just that shallow signal.
 - If a scenario can be proven with a stable API/contract/integration test and only needs one browser smoke for confidence, do not duplicate all permutations in the browser.
 - External-provider fault/recovery permutations (disconnects, malformed streams, rate limits) belong at the protocol-real fault-server and recorded-replay layers (`ci-fixtures-and-flake-control.md`, Fault-Injection Layers); the live credentialed e2e keeps one wiring sanity path, not the fault matrix.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/integration-contract-testing.md

@@ -113,6 +113,16 @@ the implementation.
 - For cross-RPC typed error envelopes, test a roundtrip: server raises a typed error, the wire-format payload is captured, the client reconstructs a typed error of the same class with the same code/message. Include the unknown-shape path: a wire payload that does not match the canonical envelope returns a transport/unknown error without silent loss of the original cause.
 - For Code-range allocation, test that a service trying to register a code outside its allocated range fails at build/test time, not at runtime.
 
+### Cross-Repo Field Change — End-to-End Checklist
+
+Adding, renaming, or retyping a field that crosses a repo/service boundary is one end-to-end contract change, not N independent edits. Before calling it covered, walk all five steps (each is a distinct failure site with its own evidence):
+
+1. **Producer fallback / bridge** — for an additive field the producer emits a safe default/absent form for consumers that have not upgraded; for a rename/retype a default is NOT enough — keep a compatibility bridge (dual-write old+new representation, or a versioned mapping) until every active consumer is confirmed reading the new form, then remove it in the cleanup stage. Asserted, not assumed.
+2. **Every transport mapper preserves the field explicitly** — do not assume an object spread/copy crosses a mapper or DTO boundary; each mapper in the chain gets an assertion that the field survives it.
+3. **Consumer coverage spans all active consumer variants** — enumerate them from the delivery record's consumer inventory (`../../product-ui-ux-design/references/delivery-contract.md` consumer_inventory for UI variants); testing one variant of a multi-variant consumer is the classic escape.
+4. **One real inbound frame through the mapper, plus one unchanged generic path as control** — the real-frame test proves the new field flows; the untouched-path test proves the change did not perturb everything else (the control catches over-broad mapping edits).
+5. **Paired changes are cross-linked and land in a compatibility-safe order** — not by mutually blocking merges (that deadlocks): consumer tolerance for the field's absence/new form lands first, then the producer emission (its fallback from step 1 keeps not-yet-upgraded consumers safe), then cleanup removes the fallback once all consumers are confirmed upgraded. Each stage gates on the previous stage's **deployed** compatibility state, and the MRs cross-reference per `../../product-rd-workflow/references/cross-repo-coordination.md` for visibility.
+
 ## Platform Contract / Protobuf / RPC Test Obligations
 
 Platform-service-connectivity owns policy and proof mechanics for protobuf-backed HTTP, response envelopes, RPC/base fields, and boundary exposure. `testing-strategy` owns assertion coverage, verdict shape, and CI placement.

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/test-code-authoring-patterns.md

@@ -78,7 +78,7 @@ def test_export_request_returns_signed_url_when_user_has_quota():
 
 ## 3. Test smells（测试异味）
 
-**定义**（精选自 Meszaros 2007 及其衍生分类）：测试代码的反模式。Meszaros 原书列约 18 项分 code/behavior/project 三类；下面是日常 review 最常碰到的子集（部分名字 / 阈值是团队启发，非原书字面）：
+**定义**（精选自 Meszaros 2007 及其衍生分类）：测试代码的反模式。Meszaros 原书顶层列 15 项 smell，分 code/behavior/project 三类（5/6/4；xunitpatterns.com "All Test Smells" 目录，另有类下变体/别名未计入）；下面是日常 review 最常碰到的子集（部分名字 / 阈值是团队启发，非原书字面）：
 
 | 异味 | 含义 | 后果 |
 |---|---|---|
@@ -229,7 +229,7 @@ internal_helper_mock.parse.assert_called_once()  # 重构改 parse 就挂
 - **MC/DC**（Modified Condition/Decision Coverage）：每个 boolean 子条件独立影响过决策。**DO-178C 航空 / 医疗 / 汽车 functional safety 才用**；普通业务代码无监管要求时不必上。
 - **Mutation coverage**（见 source-to-case-workflows §C.1）：才是真"测得好"的 proxy
 
-**用**：CI 设 floor（如 line 60% / branch 50%）防覆盖崩塌；critical-path 模块定专项目标（line 90%）。
+**用**：CI 设 floor（如 line 60% / branch 50%）防覆盖崩塌；critical-path 模块定专项目标（line 90%）。数值出处：60%/90% 对齐 Google Testing Blog "Code Coverage Best Practices"（2020）的 60% acceptable / 75% commendable / 90% exemplary 分档——注意该文同时反对自上而下的强制统一阈值，floor 应按仓现状起步再棘轮；branch 50% 为团队启发值，无外部权威出处。
 
 **不用**：
 - **不用 100% 作 KPI** — 强行凑 100% 会产生 lazy assertions（`assert result is not None` 这种）

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/test-topology-and-commands.md

@@ -64,7 +64,7 @@ Classify commands before running them:
 - E2E/release smoke: browser/API/device real flows in an isolated environment.
 - Long gate: compatibility matrix, migration dry-run, load/replay, visual regression, or full-suite release checks.
 
-If the repo separates markers such as `unit`, `integration`, `contract`, `slow`, or `e2e`, preserve that split. Do not move expensive tests into the default PR path unless the local CI contract already expects it.
+If the repo separates markers such as `unit`, `integration`, `contract`, `slow`, or `e2e`, preserve that split. Do not move expensive tests into the default PR path unless the local CI contract already expects it. Expensive includes billable: tests that consume metered external resources — paid AI/model inference, per-call third-party APIs, real payment/checkout flows, cloud sandboxes or device farms — get their own explicit marker/lane, stay out of default PR and scheduled-frequent lanes by default, and run only with a named budget owner and an authorized test account (credential/provisioning discipline per `ci-fixtures-and-flake-control.md`). Payment/checkout tests default to the provider's sandbox/test mode — a budget owner bounds spend but does not make live payment mutation safe; an unavoidable live-money canary needs its own explicit approval, a hard spending cap, and refund/cleanup handling. A case that silently creates paid resources under a generic `e2e` tag is a lane-classification finding.
 
 When existing commands use richer labels such as `contract_fake`, `contract_mysql`, `api`, `e2e_smoke`, `failure_mode`, `drill`, `shadow`, `smoke`, or `replay`, preserve the local meaning instead of flattening everything into unit/integration/E2E. Map them to the scenario matrix and CI gate they actually serve.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/tighten-doc/SKILL.md

@@ -99,7 +99,7 @@ For a 域卡/执行卡 (a card that sets WHAT a domain must achieve + who owns i
   - Required flow: STOP line edits → confirm the corrected core with the user (one short question, don't guess again — this failure class recurs precisely from re-guessing) → re-derive 负责人/红线/里程碑/验收/依赖兜底 from the corrected core as a **draft for review** (not a blind blast-write) → publish on approval.
   - Repeat signal: repeated user "这是什么/什么玩意儿" on the same card = the premise is wrong; escalate to re-derive, do not keep tightening.
 
-## 句子层（吸收 Strunk《风格的要素》与 Google Technical Writing 课程，仅取适合中文交付文档的；英文语法/标点规则不适用，已剔除）
+## 句子层（吸收 Strunk 与 Google Tech Writing，仅取中文交付文档适用项）
 
 > 英文文档：用完整 Strunk 规则（含被本节剔除的语法/标点条），本节只是中文交付子集。
 
@@ -140,6 +140,7 @@ Never destroy collaborative comments. Before editing a collaborative doc, fetch
 
 ## WORKFLOW
 
+0. 读者批注：判根因类、全文修同类（`references/annotation-driven-revision.md`）。
 1. Extract the decided-points checklist from the current text.
 2. Apply the DELETE list; keep everything in KEEP.
 3. Rewrite to FORM; confirm every decided point still present.

package/dist/assets/marketplace/plugins/ccl-skills/skills/tighten-doc/references/annotation-driven-revision.md

@@ -0,0 +1,9 @@
+# 批注驱动修订
+
+读者批注/评审意见不是孤立改句请求，而是**阅读断裂的证据**。处理协议：
+
+- 逐条判根因类：背景缺失 / 概念未定义 / 逻辑跳跃 / 措辞 / **事实・引用错误**（日期、数字、出处错——此类不走措辞同类扫，改走源核验：对一手源改正并按同源扫其余引用处）。
+- 按根因类**必须全文扫同类位置一起修，不得只改被标记的那一句**——点修复会把同类断裂留给下一位读者复发。**扫描全文、编辑限权**：当授权只覆盖某条批注/某节时，全文扫描产出同类候选清单，但自动编辑只落在授权范围内；范围外的同类位置先报告、经批准再修（不得以「修同类」为名越权改动已定内容）。
+- 改完以首次读者身份通读被改段落（standalone-paste 逐行读，同 closeout 判法）。
+- 批注本体的保全走 SKILL.md 的 COMMENT-SAFE 硬规则（先取真实评论数、定向编辑、改后复核锚点/条数）。
+- 出处：读者差集原则（好文档=读者需要的知识−已有的知识，Google Technical Writing audience 章）——批注正是「差集没算对」的实测信号。