@geoly-ai/social-hub-cli 0.3.19 → 0.3.21

package/dist/register-shared.test.js

@@ -1,3 +1,6 @@
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { Command } from "commander";
 import { afterEach, describe, expect, it, vi } from "vitest";
 // getLatestVersion is the only network call; pin it equal to the CLI version so
@@ -15,6 +18,36 @@ vi.mock("./skill-update-check.js", async (importOriginal) => {
     const actual = await importOriginal();
     return { ...actual, syncManagedSkillsNow: syncSpy };
 });
+// doctor 会打网络 + 读凭证:健康检查与 auth context 全部打桩,凭证走 env。
+vi.mock("@geoly-ai/social-hub-sdk", async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        getSocialHubHealth: vi.fn(async () => ({
+            ok: true,
+            db: "up",
+            redis: "up",
+        })),
+        getSocialHubHealthLive: vi.fn(async () => ({ ok: true })),
+    };
+});
+vi.mock("./client.js", async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        getBaseUrl: () => "https://example.invalid/api",
+        requireClient: () => ({
+            getAuthContext: async () => ({ role: "admin", teamId: TEST_TEAM_ID }),
+        }),
+    };
+});
+/** 可辨识的假凭证:出现在任何输出里都只可能来自泄漏。 */
+const LEAK_CANARY_API_KEY = "soh_cli_LEAKCANARY_do_not_print_0123456789";
+const TEST_TEAM_ID = "00000000-0000-4000-8000-000000000001";
+process.env.SOCIAL_HUB_CONFIG_DIR = mkdtempSync(join(tmpdir(), "social-hub-cli-test-"));
+process.env.SOCIAL_HUB_API_KEY = LEAK_CANARY_API_KEY;
+process.env.SOCIAL_HUB_API_URL = "https://example.invalid/api";
+process.env.SOCIAL_HUB_TEAM_ID = TEST_TEAM_ID;
 const { registerDoctorAndVersion } = await import("./register-shared.js");
 function run(argv) {
     const program = new Command();
@@ -38,4 +71,49 @@ describe("self-update (already latest)", () => {
         log.mockRestore();
     });
 });
+describe("doctor --json 不得泄漏 apiKey", () => {
+    it("完整输出里不出现凭证明文", async () => {
+        const lines = [];
+        const log = vi
+            .spyOn(console, "log")
+            .mockImplementation((...args) => {
+            lines.push(args.map((a) => String(a)).join(" "));
+        });
+        const errLines = [];
+        const stderr = vi
+            .spyOn(process.stderr, "write")
+            .mockImplementation((chunk) => {
+            errLines.push(String(chunk));
+            return true;
+        });
+        const exit = vi
+            .spyOn(process, "exit")
+            .mockImplementation((() => undefined));
+        let stdout = "";
+        let stderrText = "";
+        try {
+            await run(["doctor", "--json"]);
+            stdout = lines.join("\n");
+            stderrText = errLines.join("\n");
+        }
+        finally {
+            log.mockRestore();
+            stderr.mockRestore();
+        }
+        // 断言整段序列化文本,而不是某个字段——换个字段泄漏也要被抓住。
+        expect(stdout).not.toContain(LEAK_CANARY_API_KEY);
+        expect(stderrText).not.toContain(LEAK_CANARY_API_KEY);
+        // 输出确实产生了、且确实读到了这把 key(否则上面的断言是空过的)。
+        const payload = JSON.parse(stdout);
+        expect(payload.checks.apiKey).toBe("set");
+        expect(payload.checks.resolvedConfig.sources.apiKey).toBe("env");
+        expect(typeof payload.checks.configPath).toBe("string");
+        expect(payload.checks.configPath).toContain("config.json");
+        // 脱敏形状确实是脱敏的(既非明文,也非整把 key 的子串)。
+        expect(payload.checks.resolvedConfig.apiKey).not.toBe(LEAK_CANARY_API_KEY);
+        expect(LEAK_CANARY_API_KEY).not.toContain(payload.checks.resolvedConfig.apiKey);
+        expect(exit).not.toHaveBeenCalled();
+        exit.mockRestore();
+    });
+});
 //# sourceMappingURL=register-shared.test.js.map

package/dist/register-shared.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"register-shared.test.js","sourceRoot":"","sources":["../src/register-shared.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE7D,gFAAgF;AAChF,4EAA4E;AAC5E,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAsC,CAAC;IAC1E,OAAO,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;AACrE,CAAC,CAAC,CAAC;AACH,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAsC,CAAC;IAC1E,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;AACrD,CAAC,CAAC,CAAC;AACH,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACvE,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC1D,MAAM,MAAM,GACV,MAAM,cAAc,EAA4C,CAAC;IACnE,OAAO,EAAE,GAAG,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAE1E,SAAS,GAAG,CAAC,IAAc;IACzB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,CAAC,SAAS,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,GAAG,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"register-shared.test.js","sourceRoot":"","sources":["../src/register-shared.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE7D,gFAAgF;AAChF,4EAA4E;AAC5E,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAsC,CAAC;IAC1E,OAAO,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;AACrE,CAAC,CAAC,CAAC;AACH,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAsC,CAAC;IAC1E,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;AACrD,CAAC,CAAC,CAAC;AACH,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACvE,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC1D,MAAM,MAAM,GACV,MAAM,cAAc,EAA4C,CAAC;IACnE,OAAO,EAAE,GAAG,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,qDAAqD;AACrD,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC3D,MAAM,MAAM,GACV,MAAM,cAAc,EAA6C,CAAC;IACpE,OAAO;QACL,GAAG,MAAM;QACT,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACrC,EAAE,EAAE,IAAI;YACR,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC,CAAC,CAAC;AACH,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,EAAgC,CAAC;IACpE,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,GAAG,EAAE,CAAC,6BAA6B;QAC/C,aAAa,EAAE,GAAG,EAAE,CAClB,CAAC;YACC,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SACtE,CAAuD;KAC3D,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,gCAAgC;AAChC,MAAM,mBAAmB,GAAG,4CAA4C,CAAC;AACzE,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAE5D,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,WAAW,CAC7C,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CACvC,CAAC;AACF,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;AACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,6BAA6B,CAAC;AAC/D,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,YAAY,CAAC;AAE9C,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAE1E,SAAS,GAAG,CAAC,IAAc;IACzB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,CAAC,SAAS,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,GAAG,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;QAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,EAAE;aACX,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC;aACrB,kBAAkB,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE;YACzC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QACL,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE;aACd,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;aAC9B,kBAAkB,CAAC,CAAC,KAAc,EAAE,EAAE;YACrC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACL,MAAM,IAAI,GAAG,EAAE;aACZ,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;aACtB,kBAAkB,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAU,CAAC,CAAC;QAElD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YAChC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;QAED,kCAAkC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAClD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACtD,qCAAqC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAMhC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC3D,iCAAiC;QACjC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3E,MAAM,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,SAAS,CACvC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CACrC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geoly-ai/social-hub-cli",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "type": "module",
   "description": "social-hub CLI for Social Ops Hub",
   "repository": {
@@ -23,7 +23,7 @@
   "dependencies": {
     "commander": "^12.1.0",
     "@geoly-ai/social-hub-authz": "0.0.17",
-    "@geoly-ai/social-hub-sdk": "0.0.56"
+    "@geoly-ai/social-hub-sdk": "0.0.58"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",

package/skills/README.md

@@ -119,28 +119,29 @@ pnpm skills:check
 
 ## Skill 列表
 
-| Skill                                                              | 用途                               |
-| ------------------------------------------------------------------ | ---------------------------------- |
-| [social-hub-cli](social-hub-cli)                                   | 总路由 + 领域 skill 索引           |
-| [social-hub-shared](social-hub-shared)                             | config、auth、doctor、context      |
-| [social-hub-ops-runtime](social-hub-ops-runtime)                   | claim / complete / fail            |
-| [social-hub-openclaw-context](social-hub-openclaw-context)         | DB 聚合上下文                      |
-| [social-hub-accounts](social-hub-accounts)                         | 账号 CRUD、browser-envs、personas  |
-| [social-hub-posts](social-hub-posts)                               | Reddit 帖快照 CRUD、batch-upsert   |
-| [social-hub-style-curator](social-hub-style-curator)               | style-marks、curator、style-guide  |
-| [social-hub-style-profiles](social-hub-style-profiles)             | 板块画像四眼、帖子标注             |
-| [social-hub-calendar-jobs](social-hub-calendar-jobs)               | 日历与任务                         |
-| [social-hub-publishing](social-hub-publishing)                     | 发布闭环                           |
-| [social-hub-content-review](social-hub-content-review)             | 评论发布前复审/优化（gate 层③）    |
-| [social-hub-post-review](social-hub-post-review)                   | 帖子发布前审核/优化（post-review） |
-| [social-hub-events-observability](social-hub-events-observability) | events、dashboard、audit、reports  |
-| [social-hub-graph-compliance](social-hub-graph-compliance)         | 图谱与合规风控                     |
-| [social-hub-admin](social-hub-admin)                               | 系统/团队管理、通知渠道            |
-| [social-hub-intelligence](social-hub-intelligence)                 | 板块情报与 insights                |
-| [social-hub-subreddit-pools](social-hub-subreddit-pools)           | 运营板块池 catalog/aliases/tier    |
-| [social-hub-scrape](social-hub-scrape)                             | 通用网页抓取（Firecrawl）          |
-| [social-hub-migration](social-hub-migration)                       | 导入导出与 replay                  |
-| [social-hub-notifications](social-hub-notifications)               | 事件订阅通知：notify pull/ack/订阅 |
+| Skill                                                              | 用途                                         |
+| ------------------------------------------------------------------ | -------------------------------------------- |
+| [social-hub-cli](social-hub-cli)                                   | 总路由 + 领域 skill 索引                     |
+| [social-hub-shared](social-hub-shared)                             | config、auth、doctor、context                |
+| [social-hub-ops-runtime](social-hub-ops-runtime)                   | claim / complete / fail                      |
+| [social-hub-openclaw-context](social-hub-openclaw-context)         | DB 聚合上下文                                |
+| [social-hub-accounts](social-hub-accounts)                         | 账号 CRUD、browser-envs、personas            |
+| [social-hub-posts](social-hub-posts)                               | Reddit 帖快照 CRUD、batch-upsert             |
+| [social-hub-style-curator](social-hub-style-curator)               | style-marks、curator、style-guide            |
+| [social-hub-style-profiles](social-hub-style-profiles)             | 板块画像四眼、帖子标注                       |
+| [social-hub-calendar-jobs](social-hub-calendar-jobs)               | 日历与任务                                   |
+| [social-hub-publishing](social-hub-publishing)                     | 发布闭环                                     |
+| [social-hub-content-review](social-hub-content-review)             | 评论发布前复审/优化（gate 层③）              |
+| [social-hub-post-review](social-hub-post-review)                   | 帖子发布前审核/优化（post-review）           |
+| [social-hub-events-observability](social-hub-events-observability) | events、dashboard、audit、reports            |
+| [social-hub-graph-compliance](social-hub-graph-compliance)         | 图谱与合规风控                               |
+| [social-hub-admin](social-hub-admin)                               | 系统/团队管理、通知渠道                      |
+| [social-hub-intelligence](social-hub-intelligence)                 | 板块情报与 insights                          |
+| [social-hub-subreddit-pools](social-hub-subreddit-pools)           | 运营板块池 catalog/aliases/tier              |
+| [social-hub-scrape](social-hub-scrape)                             | 通用网页抓取（Firecrawl）                    |
+| [social-hub-migration](social-hub-migration)                       | 导入导出与 replay                            |
+| [social-hub-notifications](social-hub-notifications)               | 事件订阅通知：notify pull/ack/订阅           |
+| [social-hub-calendar-directives](social-hub-calendar-directives)   | 发布日历指令：外部 agent 建 cron + preflight |
 
 ### Reddit 矩阵 Skill（随 CLI 一同发布）
 

package/skills/manifest.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "package": "social-ops-hub",
-  "cliVersion": "0.3.19",
+  "cliVersion": "0.3.21",
   "repository": "social-ops-hub",
   "publish": {
     "registry": "https://skill.sh",
@@ -109,6 +109,11 @@
       "path": "social-hub-notifications",
       "description": "事件订阅通知：notify subscriptions/pull/ack/source-configs，本机 agent 拉走后自行执行副作用"
     },
+    {
+      "id": "social-hub-calendar-directives",
+      "path": "social-hub-calendar-directives",
+      "description": "发布日历指令：外部 agent 收 upsert/cancel 建 UTC 一次性 cron，到点先过 calendar preflight"
+    },
     {
       "id": "reddit-strategy-orchestrator",
       "path": "reddit-strategy-orchestrator",

package/skills/reddit-content-rewrite/SKILL.md

@@ -36,6 +36,16 @@ description: >-
 增加限制说明、增加社区观察句、把分节式结构改成叙事弧光、移动品牌出现位置、
 更换 `StructureFamily` 或 `ContentFunction`、按固定比例削减产品内容。
 
+**客户的收紧标准不进默认层。** 品牌出现次数上限、必须以问句结尾、PDP 语言限制、固定
+输出段式这类要求属于可选 profile（`AcceptanceProfile: NativeCopy`，见
+`../reddit-strategy-shared/references/native-copy-profile.md`）。**这些收紧项分属两个上游
+阶段，本 skill 两类都不施加**：结构类（品牌次数上限、受限 `EndingMode` 集合）只能由
+`reddit-phase-brief` 在**分配时**施加——`EndingMode` / `BrandEntryMode` 都是锁定指纹字段，
+改写阶段动它们等于绕过结构预分配并作废碰撞检查；register 类（PDP 语言、fake-Reddit-English、
+禁用官方全名）由撰写 skill 在**出初稿时**遵守，本 skill 不得新加或加码——那是把「只让你修」
+的稿子做成 house voice 归一化。把任何收紧项写进默认层，就等于给所有品牌强加一套
+house voice —— 那正是本 skill 被重新定义为约束保持型修复器要防的事。
+
 **没有该 subreddit 的 baseline（`SampleSetID`）时，不得声称已完成 subreddit-native 改写。**
 此时仍可工作，但只能声称到对应等级（见下方 `SubredditAdaptationStatus` 三档），
 并把缺口写进 `BlockingGaps`。
@@ -269,6 +279,10 @@ ExplicitStructureSpec:
 条件输入（可为 NotProvided；仅当本次修复确实依赖它时才 BlockingGap）：
 - TargetSubreddit / SampleSetID / AnchorSlot / ContentKey / MappingRuleID
 - OpeningMove / EvidenceShape / BrandEntryMode / CaveatMode / EndingMode / LengthBand
+- PersonaCardRef / PersonaCardVersion / PersonaCardHash：Brief 分配的知识边界
+  （含 `permittedExperienceClaims` / `knows` / `doesNotKnow` /
+  `brandRelationshipDisclosed`；契约见
+  `../reddit-strategy-shared/references/persona-card-contract.md`）
 - KnownProductFacts：可追溯的产品事实（SKU 基准表 / VOC / 甲方语料）
 - RealLimitations：真实存在的限制
 - RequiredDisclosure：必须保留的披露
@@ -482,6 +496,16 @@ ReadyForUse: No
 - 不编造作者身份、国籍、语言背景
 - **不主动制造 typo、拼写失误、错误冠词、介词误用、缺主语、"移民语法"**——
   这些不只是同质化，是伪造
+- **不得新增、也不得保留与已分配 Persona Card 相矛盾的主张。** 稿件声称了
+  `permittedExperienceClaims` 未授权的第一手经历（ownership / delivery / wear /
+  service），或表现出 `doesNotKnow` 列出的知识，属于**无来源主张**，落在
+  `FactualExpression` 的既有职责内：按最小改动去掉该主张即可。
+  ⚠️ 但**加宽边界不在允许范围内**：本 skill 不得撰写、递增、改写任何 Card。需要更宽的
+  边界就输出 `PersonaCardConflict: Yes` + 相矛盾的原句与对应 Card 字段，退回
+  `reddit-phase-brief` 换新版本 Card。`PersonaCardRef` / `PersonaCardVersion` /
+  `PersonaCardHash` 一律原样保持。
+  ⚠️ 命中「第一手经历」措辞本身**不是违规**——`mine arrived` 在授权 `delivery` 时完全正常；
+  只有与 Card 矛盾才算。也**不得**因此声称做过任何知识边界审核：这只是本地修复。
 - 所有进入可发布文本（标题 / 正文 / 评论 / 回复）的实质性 claim 必须是 `ClaimEvidenceStatus: Cited`（可映射到已批准证据 `KnownProductFacts` / `SourceEvidence`）或 `ExternallyVerified`（非产品事实类、有外部权威来源 `ExternalSourceRef`）；`Inferred`（无来源的模型推断）禁入可发布文本——删除或退回补证据，无法删且必需则 BlockingGap。三态权威定义见 `../reddit-strategy-shared/references/evidence-policy.md`
 
 ### 绝对禁用营销词
@@ -825,6 +849,11 @@ subreddit 规则、属于 `SampleSetID` 支持的异常值，否则保持原文
 - FingerprintSyncStatus: PendingWritingOwner | Confirmed | NotApplicable
 - DraftHash:
 
+- PersonaCardRef:                             # 原样保持；本 skill 不得撰写或改写 Card
+- PersonaCardVersion:
+- PersonaCardHash:
+- PersonaCardConflict: Yes | No | NotApplicable   # Yes ⇒ 退回 reddit-phase-brief 换新版本 Card
+
 - TargetSubreddit:
 - SubredditAdaptationStatus: Verified | RulesOnly | NotClaimed   # 阻断统一写 RoutingStatus / BlockingGaps
 - FactsAdded: None / Listed

package/skills/reddit-content-writing/SKILL.md

@@ -37,7 +37,9 @@ This skill writes planned Reddit posts and comments. It does not redo strategy,
 - `references/pgc-writing-strategy.md` when writing PGC posts
 - `references/comp-mention-strategy.md` only when competitor mention permission is explicitly `Yes`
 - installed `reddit-brand-risk-response` output for pre-publish bot/shill/promo/claim risk gates when the batch is not explicitly low risk
-- `../reddit-strategy-shared/references/content-review-gate.md` for the mandatory Social Hub review loop
+- `../reddit-strategy-shared/references/content-review-gate.md` for the mandatory Social Hub review loop, including how to read a dimension the Hub result reports as `not_assessed`
+- `../reddit-strategy-shared/references/persona-card-contract.md` for the Brief-assigned Persona Card this skill writes **inside** and never authors
+- `../reddit-strategy-shared/references/native-copy-profile.md` only when the batch runs `AcceptanceProfile: NativeCopy`
 
 ## Gate
 
@@ -49,6 +51,7 @@ Additionally, stop before writing a single word of body copy if any of these hol
 - a main-post row has no `StructureFamily` assigned by the Brief
 - a main-post row has no `AssignedFlair`, or the baseline card's `FlairCoverageStatus` is `Insufficient` → `BlockingGap`, return to `reddit-phase-brief`
 - a main-post row has no `PostingTrigger` assigned by the Brief, or its `Planned` `PostingTrigger` already violates the `PostingTrigger × BrandEntryMode` cross-constraint → `BlockingGap` (the post-draft re-derive of `PostingTrigger` vs `Planned` is checked after drafting, in the Writing Rules, not here)
+- a main-post row has no `PersonaCardRef` assigned by the Brief → `BlockingGap`, return to `reddit-phase-brief`. **Never author a Card here**: a writer that supplies its own knowledge boundary grants itself exactly the boundary the draft needs, which is the bypass pre-assignment exists to close
 - a target subreddit has no baseline card, or it is `Expired` / `Incomplete` → `BlockingGap: BaselineMissingOrStale`
 - `memory/phase4-叙事指纹索引.md` has not been read, or the rolling-window collision check has not been run
 - the collision check fails and no sample-based exception is on record → `BlockingGap: StructureCollision`, return to `reddit-phase-brief`
@@ -78,6 +81,17 @@ C-B/C-NB, and rows that were previously low risk.
    persona or inline style guide. Resolve an approved `brandContext` when Hub
    requires an explicit brand relationship; do not guess a brand or send an
    arbitrary `stage` value.
+   **Never add the Persona Card, any Card field, or a Card-derived score to the
+   request, and never pack it into `subredditRules` or the thread context to get
+   it through.** The request schemas are strict, so an extra field is a rejected
+   call rather than an ignored key, and a free-text slot reserved for rule
+   evidence is not a transport for planner text. The Card governs writing only
+   (`../reddit-strategy-shared/references/persona-card-contract.md` §7).
+   Recording which quadrant the batch was written for is a **local** planner
+   declaration (`LocalReviewIntent`); the review call carries no scope field and
+   the response states no scope, so never report a server-side scope, and never
+   claim the omission of `accountId` was recognised by Hub as a deliberate
+   content-only choice.
 3. Send `rewrite: true, attempt: 1`. Inspect `executionStatus` before
    `verdict`.
    For a comment/reply, include `thread.threadPermalink` when you know the
@@ -106,7 +120,14 @@ C-B/C-NB, and rows that were previously low risk.
    changing the family — only harder to notice. Apply only the local fixes, or
    resubmit stating the structural constraints. Submit the changed exact draft
    as `attempt: 2`.
-5. Accept only `completed/pass` for content review. In ContentOnly, record
+5. Accept only `completed/pass` for content review. Report any dimension the
+   result marks `not_assessed` as NotAssessed with its `notAssessedReason` — it
+   was excluded from the score, its remaining `score` number is diagnostic only,
+   and quoting it as a result or averaging it misrepresents the review. In
+   ContentOnly, `persona_consistency` / `persona_voice` coming back
+   `not_assessed` is correct behaviour, not a degraded review. Full semantics,
+   including why scores are comparable only within one `applicabilitySignature`:
+   `../reddit-strategy-shared/references/content-review-gate.md`. In ContentOnly, record
    `ReviewMode: ContentOnly`, `AccountBindingStatus: Pending`,
    `ReadyForContentNextSkill: Yes`, and `ReadyForDelivery: No`;
    `accountCandidateFeedback` is advisory and persona consistency is not
@@ -152,6 +173,24 @@ then hand to rewrite to keep editing".
 - **Real limitations:** state genuine, decision-relevant limitations when they exist; never invent a safe flaw to look authentic; position and form follow the content, not a fixed paragraph.
 - **Punctuation and format values follow the subreddit baseline** — no cross-subreddit em-dash ban, no parenthesis quota, no fixed word count.
 - **ABU (Answer-Bearing Unit, B-group):** 1–2 per post, all 8 hard requirements met, `AnchorSlot` from the 7-value enum, visibility gate satisfied per length band. The old "must sit in paragraph 2 or 3" rule is removed.
+- **The Persona Card is Brief-assigned; write inside it, never widen it.** Read
+  the Card behind the row's `PersonaCardRef` before drafting, and before handing
+  the draft to Hub review run the local boundary self-check
+  (`../reddit-strategy-shared/references/persona-card-contract.md` §8): every
+  firsthand experience claim maps to an entry in `permittedExperienceClaims`,
+  nothing displays knowledge listed in `doesNotKnow`, the stated relationship
+  matches `brandRelationshipDisclosed`, and `postingWhy` still coexists with the
+  assigned `PostingTrigger`. Record `PersonaCardSelfCheck: Pass | BlockingGap`
+  **per Key** in `PerKeyStructureContract`, alongside the `PersonaCardVersion` and
+  `PersonaCardHash` it was checked against, with the contradicting phrase and Card
+  field for each gap. A batch-level value alone cannot show that every post was
+  checked against its own current Card, which is what delivery verifies. A draft that needs a
+  wider boundary goes back to `reddit-phase-brief` for a new Card version — the
+  writer never edits the Card and never bumps its version. This check is local: it
+  produces no score, is not a review, and never substitutes for the Hub gate.
+  The Card does not relax `ClaimEvidenceStatus`; it adds *who may claim it* on top
+  of *whether it is sourced*. A firsthand phrase such as "mine arrived" is not an
+  offence by itself — it matters only when it contradicts the Card.
 - **`PostingTrigger` is Brief-pre-assigned, not writer-chosen.** After drafting,
   re-derive the actual `PostingTrigger` from the finished body and confirm it
   matches the `Planned` value; a mismatch is a `BlockingGap` (return to Brief),
@@ -214,14 +253,24 @@ then hand to rewrite to keep editing".
 - AssignedFlairVerified: Yes / No
 - PostingTriggerPlannedVsFinal: Match / Drift / NotAssigned
 - PostingTriggerCrossConstraintOK: Yes / No
+- PersonaCardSelfCheck: Pass / BlockingGap / NotApplicable   # batch-level = worst across Keys; per-Key values live in PerKeyStructureContract
+- PersonaCardTransportStatus: LocalOnly(ServerContractMissing)   # the Card was not sent to Hub
+- PersonaCardAuthorizationStatus: Authorized / DeclaredOnly / NotApplicable   # carried through from the Brief, not re-derived here
+- AcceptanceProfile: Default / NativeCopy
+- NativeCopyProfileStatus: NotSelected / Unavailable(ServerContractMissing)
+- LocalReviewIntent: accountBinding=<account_bound|persona_less>, brandTreatment=<managed_brand|organic>   # carried through from the Brief; local declaration, not a Hub receipt
+- HubReviewScopeStatus: Unavailable(ServerContractMissing)   # never report a server-side scope
+- NotAssessedDimensions:                       # per row: dimension + notAssessedReason, verbatim from Hub
 - ClaimEvidenceAllCitedOrExternallyVerified: Yes / No   # no Inferred claim reached any publishable text (title/body/comment/reply)
 - FingerprintIndexUpdated: Yes / No
 - CollisionCheckPassed: Yes / No / ExceptionRecorded
 - PerKeyStructureContract: |
     <one row per DraftKey — batch-level single values are not valid, a batch normally
      spans several families, anchor slots and hashes>
-    | Key | ClientContentPrototype | ContentFunction | PrimaryPostType | StructureFamily | AssignedFlair | FlairCoverageStatus | PostingTrigger | SampleSetID | AnchorSlot | SecondaryAnchorSlot | AllowedStructuralChanges | ForbiddenStructuralChanges | DraftHash |
-    |---|---|---|---|---|---|---|---|---|---|---|---|---|---|
+    <comment rows take N/A for PersonaCardRef / PersonaCardVersion /
+     PersonaCardHash / PersonaCardSelfCheck>
+    | Key | ClientContentPrototype | ContentFunction | PrimaryPostType | StructureFamily | AssignedFlair | FlairCoverageStatus | PostingTrigger | PersonaCardRef | PersonaCardVersion | PersonaCardHash | PersonaCardSelfCheck | SampleSetID | AnchorSlot | SecondaryAnchorSlot | AllowedStructuralChanges | ForbiddenStructuralChanges | DraftHash |
+    |---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
 - SKUBindingsPreserved: Yes / No
 - BrandWordStatusPreserved: Yes / No
 - ComplementRulesPassed: Yes / No

package/skills/reddit-delivery-check/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: reddit-delivery-check
 description: |
-  Reddit Phase 5 delivery QA skill. Use to verify final strategy deliverables, execution table coverage, batch draft completeness, SKU and brand-word quotas, external-comment audit status, brand-risk review status, unresolved placeholders, and the v2.12.25 structure gates before client delivery: client content-prototype mapping, StructureFamily preservation, rewrite structure drift, AnchorSlot legality, rolling-window structure collisions, subreddit baseline freshness, narrative-fingerprint / final-draft hash match, Hub optimized-draft structure override, and fabricated human signals (deliberate typos, fake community history, invented identity).
+  Reddit Phase 5 delivery QA skill. Use to verify final strategy deliverables, execution table coverage, batch draft completeness, SKU and brand-word quotas, external-comment audit status, brand-risk review status, unresolved placeholders, and the v2.12.25 structure gates before client delivery: client content-prototype mapping, StructureFamily preservation, rewrite structure drift, AnchorSlot legality, rolling-window structure collisions, subreddit baseline freshness, narrative-fingerprint / final-draft hash match, Hub optimized-draft structure override, fabricated human signals (deliberate typos, fake community history, invented identity), Persona Card preservation, correct reporting of not-assessed review dimensions, compliance-evidence freshness at delivery time, and acceptance-profile eligibility.
 ---
 
 # Reddit Delivery Check
@@ -18,6 +18,9 @@ Mandatory before running the structure gates:
 
 - `~/.cursor/skills/reddit-strategy-shared/references/content-type-routing-contract.md`
 - `~/.cursor/skills/reddit-strategy-shared/references/content-diversity-contract.md`
+- `~/.cursor/skills/reddit-strategy-shared/references/persona-card-contract.md`
+- `~/.cursor/skills/reddit-strategy-shared/references/content-review-gate.md` for how a `not_assessed` dimension must be reported and why scores are comparable only within one `applicabilitySignature`
+- `~/.cursor/skills/reddit-strategy-shared/references/native-copy-profile.md` when the batch declared `AcceptanceProfile: NativeCopy`
 
 ## Required Inputs
 
@@ -35,7 +38,7 @@ Mandatory before running the structure gates:
 - verifier output when available
 - external post audit results
 
-## Structure Checks (v2.12.25, all nine must pass)
+## Structure Checks (all ten must pass)
 
 Delivery is blocked unless every one of these verifies. This layer creates no
 diversity by itself; it exists so the earlier three layers cannot be skipped.
@@ -90,11 +93,25 @@ diversity by itself; it exists so the earlier three layers cannot be skipped.
    `this sub always...`), no invented identity, and no flaw inserted only to
    look authentic.
 
-**Scope.** Checks 1–7 apply to **main-post Keys only** (`WindowScope: PostOnly`).
+10. **Persona Card preserved.** Every delivered main-post Key's
+    `PersonaCardRef` / `PersonaCardVersion` / `PersonaCardHash` equal the Brief's
+    assigned Card, and `PersonaCardSelfCheck: Pass` was recorded **against that
+    same version**. A self-check recorded against an earlier version is stale, not
+    a pass — a Card change invalidates every boundary check made under the old
+    one. A Card authored or edited downstream of `reddit-phase-brief` is a
+    failure with `FixOwnerSkill: reddit-phase-brief`, whichever skill wrote it.
+    A missing Card on a post row is a `BlockingGap`, never "no Card, so nothing
+    to check". Carry `PersonaCardAuthorizationStatus` through from the Brief:
+    `DeclaredOnly` does not block delivery, but the delivery record may not
+    describe that row's firsthand claims as authorised. Do not read `RoleLabels`
+    in this check, and do not report the Card as a verified identity or as
+    anything Hub assessed.
+
+**Scope.** Checks 1–7 and 10 apply to **main-post Keys only** (`WindowScope: PostOnly`).
 Comments, self-comments, and external comments need no fingerprint row, no
-prototype mapping, no `StructureFamily`, no `SampleSetID`, and no `AnchorSlot`;
-they still need Hub `completed/pass` plus `FinalDraftSha256`, and checks 8–9
-still apply to them.
+prototype mapping, no `StructureFamily`, no `SampleSetID`, no `AnchorSlot`, and no
+Persona Card; they still need Hub `completed/pass` plus `FinalDraftSha256`, and
+checks 8–9 still apply to them.
 
 Missing index file, missing `Final` row for a post Key, zero or multiple active
 rows for one Key, unlocked window parameters, or a missing/expired baseline are
@@ -114,6 +131,10 @@ introduced by rewriting, set `FixOwnerSkill: reddit-content-rewrite`.
 - ContentOnly `completed/pass` is acceptable for a content handoff, but it is not a Phase 5 delivery pass and must show `AccountBindingStatus: Pending` and `ReadyForDelivery: No`.
 - No AccountBound delivered item has unresolved `brandFitReviewRequired=true` or blocking `accountCandidateFeedback`; the approved `brandContext` and resolution are recorded.
 - The review log covers every final draft, and any `revise` feedback is reflected in the exact delivered text. `degraded`, unavailable, or local-only review is a failure.
+- Every dimension a Hub result marked `not_assessed` is carried into the delivery record as NotAssessed with its `notAssessedReason` — never as a low score, a passing score, or a partial check, and never averaged into any figure. The `score` left on such a dimension is diagnostic only. `unevaluatedDimensions` on a `degraded` result is a *different* thing (assessable but unanswered) and must not be reported as not-applicable. No delivery figure compares or averages scores across different `applicabilitySignature` values — a ContentOnly score and an AccountBound score are not the same measurement.
+- Compliance evidence is still fresh **as of delivery**. Re-check the Compliance Output handoff's `EvidenceGatheredAt` / `EvidenceValidUntil` under the definition that handoff sets (`../reddit-strategy-shared/references/handoff-schemas.md`): they are batch-level **worst-case** scalars over the five delivery-required items (`RulesEvidenceStatus` / `PinnedEvidenceStatus` / `BotBannerEvidenceStatus` / `InstalledAppsStatus` / `AboutPageEvidenceStatus`) — earliest gathering time and earliest validity horizon. `EvidenceValidUntil` in the past, or `Unknown` on either scalar, holds the affected rows for re-gathering and re-judgement. A clearance recorded once at compliance time does not satisfy this.
+- Separately from freshness: where the board's brand/vendor permission or a disclosure requirement was **never adjudicated**, it stays in `MissingEvidence` with the corresponding `PostRisk` / `CommentRisk` and needs a recorded human decision. This is not a freshness question and no timestamp resolves it — re-gathering evidence re-opens the question, it never answers it, and the answer is never inferred from a style profile's brand-friendliness note or from raw collected evidence.
+- When the batch declared `AcceptanceProfile: NativeCopy`, `NativeCopyProfileStatus` is recorded and no row is `ReadyForDelivery: Yes` while it is `Unavailable(ServerContractMissing)`. A batch that was quietly re-labelled `Default` to release delivery, or whose review call was weakened until it succeeded and then counted as a profile pass, is a failure.
 - No placeholders, unresolved evidence gaps, or unmerged side tables remain.
 - Master Canvas has all 21 boards, including Data Support, MCP Status, and Verification Boundaries.
 - Feishu draft delivery uses a single draft document unless the user explicitly requests otherwise.
@@ -138,6 +159,10 @@ introduced by rewriting, set `FixOwnerSkill: reddit-content-rewrite`.
 - FingerprintHashIssues:
 - HubStructureConflictIssues:
 - FabricatedSignalIssues:
+- PersonaCardIssues:
+- NotAssessedReportingIssues:
+- EvidenceFreshnessIssues:
+- AcceptanceProfileIssues:
 - PlaceholderIssues:
 - RequiredFixes:
 - DeliverySummary:
@@ -160,6 +185,13 @@ introduced by rewriting, set `FixOwnerSkill: reddit-content-rewrite`.
 - FingerprintHashStatus: Matched / Mismatch / Pending
 - HubStructureConflictStatus: None / Escalated
 - FabricatedSignalStatus: None / Found
+- PersonaCardStatus: Preserved / Drift / Missing / NotApplicable
+- PersonaCardAuthorizationStatus: Authorized / DeclaredOnly / NotApplicable   # carried through from the Brief; DeclaredOnly does not block but may not be reported as authorised
+- EvidenceFreshnessStatus: Fresh / Expired / Unknown
+- AcceptanceProfile: Default / NativeCopy
+- NativeCopyProfileStatus: NotSelected / Unavailable(ServerContractMissing)
+- LocalReviewIntent: accountBinding=<account_bound|persona_less>, brandTreatment=<managed_brand|organic>   # carried through; local declaration only
+- HubReviewScopeStatus: Unavailable(ServerContractMissing)
 - ReviewMode: ContentOnly | AccountBound
 - AccountBindingStatus: Pending | Resolved | NeedsReview
 - ReadyForDelivery: Yes / No

package/skills/reddit-matrix.lock.json

@@ -7,7 +7,7 @@
       "contentSha256": "9a4fa3944ec3913a4e68cb1faf4d4a32ca04131fa4b0c37e054065f4e2c1a1ed"
     },
     "reddit-strategy-shared": {
-      "contentSha256": "05433f0686955304b3ccaf728aacead4680a9b89a9adff4955111c837a441c4a"
+      "contentSha256": "bba5c177a4af9bab0f2d9c227993862629e82ec9747cd2788e4874d058da3c89"
     },
     "reddit-phase-research": {
       "contentSha256": "9f47b8eb0d1c1c194c685856242c9b22d190dfa8c6f572869e964239215795fe"
@@ -16,16 +16,16 @@
       "contentSha256": "8080adce62b6db65be3dbc0f37f162a81e382d6b64108f7352ec83c356664659"
     },
     "reddit-phase-brief": {
-      "contentSha256": "6030d98d515355526e63d89246845dd18f0d0d2b3a2dbf71a2e9317eae31f54b"
+      "contentSha256": "3475bf4c4aa4796db1c99a3bd527c52dc8488f71db01753da0325e924d552b99"
     },
     "reddit-content-writing": {
-      "contentSha256": "b3a2219d2a328f76413cea34f0dfaa8588da635e3d644781d124e4d3b2a92e03"
+      "contentSha256": "08023a5dfa6cc2f3ffc3f1a551479c645ddcfc8cc775f88cd2d245c067829482"
     },
     "reddit-content-rewrite": {
-      "contentSha256": "3e7df833877fc81a46d66ab7c827fac386a1413862724179e87570d773ab8935"
+      "contentSha256": "2f9dfdbb2410d060f755860b57ebc7c6776f4df343990029a8770855ecd33005"
     },
     "reddit-delivery-check": {
-      "contentSha256": "690609ca874e259800d02dbeebd707546d432bc24525a7c65ace0e0a7633ee78"
+      "contentSha256": "9231ff9ae5d950bc2fb87e45bee05e793b3ff9c37bee45e8444059a8b698e4a9"
     },
     "reddit-voc-volume": {
       "contentSha256": "496c0d57af7507d86a16bd4d06f3a5a017ca10b3dc4e3564d82b0c988e1c87ac"
@@ -34,7 +34,7 @@
       "contentSha256": "dbba80345ebe68818a25e7604dfaa6951c6bf0e4d785d5013be7a06b22ec5b7c"
     },
     "reddit-subreddit-compliance": {
-      "contentSha256": "a996e1dbffee237d0535012ac3ec40698c2d4ba03d0c9fb088fefe27f51646ee"
+      "contentSha256": "3cab43d1c70d511212f3684929a8d7da73c11d3ae34563f31d1eebe04a6ecd8b"
     },
     "reddit-answers-research": {
       "contentSha256": "eb132d81021f0a24619d9b576a287f722cf61c24422874d5be86cd4be2c392df"

package/skills/reddit-phase-brief/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: reddit-phase-brief
 description: |
-  Reddit Phase 4 Brief skill for the matrix SOP. Use after reddit-phase-planning completes Phase 4.0.6 and before reddit-content-writing starts. It locks the target flair first by verifying planning's `ProposedFlair` from the scheduling ledger, then establishes the flair-level subreddit baseline, then locks ContentFunction and StructureFamily, then the outline; it also creates board rationale, content schedule, per-Key title/direction/outlines, brand/SKU placement strategy, prewriting control fields (AssignedFlair / PostingTrigger), structure pre-assignment (OpeningMove / EvidenceShape / BrandEntryMode / EndingMode / LengthBand / SampleSetID / RecentCollisionCheck), and the approval gate. Trigger when the user says "确认进入 Phase 4 Brief", "开始 Brief", "产出 Brief 汇报稿", or when planning is complete but drafting has not started.
+  Reddit Phase 4 Brief skill for the matrix SOP. Use after reddit-phase-planning completes Phase 4.0.6 and before reddit-content-writing starts. It locks the target flair first by verifying planning's `ProposedFlair` from the scheduling ledger, then establishes the flair-level subreddit baseline, then locks ContentFunction and StructureFamily, then the outline; it also creates board rationale, content schedule, per-Key title/direction/outlines, brand/SKU placement strategy, prewriting control fields (AssignedFlair / PostingTrigger / PersonaCardRef), structure pre-assignment (OpeningMove / EvidenceShape / BrandEntryMode / EndingMode / LengthBand / SampleSetID / RecentCollisionCheck), and the approval gate. Trigger when the user says "确认进入 Phase 4 Brief", "开始 Brief", "产出 Brief 汇报稿", or when planning is complete but drafting has not started.
 ---
 
 # Reddit Phase Brief
@@ -17,6 +17,8 @@ Read the shared contracts first:
 - `~/.cursor/skills/reddit-strategy-shared/references/context-contract.md`
 - `~/.cursor/skills/reddit-strategy-shared/references/content-type-routing-contract.md` (mandatory)
 - `~/.cursor/skills/reddit-strategy-shared/references/content-diversity-contract.md` (mandatory)
+- `~/.cursor/skills/reddit-strategy-shared/references/persona-card-contract.md` (mandatory — this skill **owns** the Persona Card)
+- `~/.cursor/skills/reddit-strategy-shared/references/native-copy-profile.md` only when the batch runs `AcceptanceProfile: NativeCopy`
 
 Then verify these project memory files exist:
 
@@ -95,9 +97,26 @@ outline before the structure is decided from evidence.
 7. **Lock the project diversity window** (`WindowCount` 8–12, `WindowDays` 30–60) if not already locked, and read the rolling window from `memory/phase4-叙事指纹索引.md`.
 8. Produce board-selection rationale with evidence URLs, then the board overview table.
 8b. **Run the material-modality preflight (G4, step B-1.4) before locking any structure.** Every selling point / material carries `MaterialID` + `OriginalModality` (`Required` / `Preferred` / `Optional` / `Forbidden`) + `EffectiveModality` + `ModalitySource`. Upgrading modality is blocked unless an `AuthoritativeSource` (`ClientContract` / `SubredditRule` / `ComplianceRequirement` / an already-authorized `ApprovedBrief`) backs it via `ModalityUpgradeRef`, with `ApprovedBy` ≠ the generating agent. **A material the user explicitly marked `Optional` is never upgraded** — go back to the user instead. Missing or conflicting modality is fail-closed. Disclosure/compliance requirements are not selling-point modality.
-9. For every post Key: resolve `客户内容原型` → `MappingRuleID`, lock `ContentFunction`, confirm the `EvidenceShape` actually in hand, narrow `StructureFamily` candidates with the ordered filter in `content-type-routing-contract.md`, pre-assign `OpeningMove` / `CaveatMode` / `EndingMode` / `LengthBand` / `AnchorSlot` (**`BrandEntryMode` is deliberately excluded here — it is assigned in 9b, after its gate**), and **record (not yet validate)** the `PostingTrigger` candidate — its cross-constraint with `BrandEntryMode` can only be checked after 9b（受控值 `ConcreteFailure` / `PurchaseDecision` / `MeasurementResult` / `CompatibilityGap` / `UnsolicitedTestimony`；`UnsolicitedTestimony` 仅当 `BrandEntryMode: 不出现` 且有真实非征集非品牌控制的 testimony 证据），and **only then** — after 9b has supplied `BrandEntryMode` — run `RecentCollisionCheck` on the complete triple. On collision, first swap `OpeningMove` / `EndingMode` within the same family; reselect a family only if that fails. **Only then** write the outline.
+9. For every post Key: resolve `客户内容原型` → `MappingRuleID`, lock `ContentFunction`, confirm the `EvidenceShape` actually in hand, narrow `StructureFamily` candidates with the ordered filter in `content-type-routing-contract.md`, pre-assign `OpeningMove` / `CaveatMode` / `EndingMode` / `LengthBand` / `AnchorSlot` (**`BrandEntryMode` is deliberately excluded here — it is assigned in 9b, after its gate**), and **record (not yet validate)** the `PostingTrigger` candidate — its cross-constraint with `BrandEntryMode` can only be checked after 9b（受控值 `ConcreteFailure` / `PurchaseDecision` / `MeasurementResult` / `CompatibilityGap` / `UnsolicitedTestimony`；`UnsolicitedTestimony` 仅当 `BrandEntryMode: 不出现` 且有真实非征集非品牌控制的 testimony 证据），and **only then** — after 9b has supplied `BrandEntryMode` — run `RecentCollisionCheck` on the complete triple. On collision, first swap `OpeningMove` / `EndingMode` within the same family; reselect a family only if that fails. **Only then** write the outline. Under `AcceptanceProfile: NativeCopy` a client requirement about how posts end narrows **the set this step may assign from** — it is never a question appended to a finished draft, since `EndingMode` is a locked field and one of the three collision fields. If the narrowed set leaves no collision-free option, that is a `BlockingGap` back to planning (`../reddit-strategy-shared/references/native-copy-profile.md`).
 9b. **Only now assign `BrandEntryMode`, and only through `BrandPlacementGate` (G2):** for **P-B / PGC posts**, placement is decided by the brand-first-mention histogram plus the §2 risk ceiling (`SelectedPlacement` = the later of the two, histogram bucket 结论 mapping to 后段; the domain is 标题/首段/中段/后段, and a class-D board or `NoBrandMentionRate ≥ 0.8` that leaves no viable spot is a `BlockingGap` back to planning, never a silent drop to 不出现/评论) — **never derived from the P-B label**. **P-NB posts** go straight to `不出现` without running the formula; **C-B comments** use `CommentPlacementDecision` plus the §2 ceiling and complement rules. Fill the placement evidence first, **branching by row type**: P-B / PGC posts need a complete `BrandPlacementBasis`; P-NB posts take `N/A(P-NB · 主帖不露品牌)`; C-B comments take `InheritedBrandPlacementBasis` + `CommentPlacementDecision` instead and are never required to carry their own. Legitimate title exposure is preserved for `PGCApproved` (precedent check passed, board allows vendor/official, flair/disclosure/frequency met) and `BrandReviewPost` (genuinely a post about that brand, judged from `PrimaryPostType` / `WritingVariant` plus topic evidence — never by inventing a `ContentFunction: Review` value). This gate governs *what decides placement only* — brand quota semantics (P-B / P-NB / C-B / C-NB / PGC) are untouched.
 9c. **Narrative layering (G1, step B-1.6) before writing title directions or outlines:** every post and comment carries `InternalCoverageIntent` (FAQ ids, fanout queries, keywords, gap codes, `prompt_id` — internal only) and a non-empty `ReaderVisiblePremise`. The gate scans only reader-facing fields (核心角度 / 标题方向 / 大纲 / 撰写逻辑一句话 / 评论任务方向 / outbound Reddit payload); Routing Decision, TraceFields and 方向选取理由 keep their internal labels. Converting FAQ evidence into a real reader question is the intended outcome — only raw internal labels in the narrative are blocked.
+9d. **Assign the Persona Card for every main-post Key (contract:
+   `../reddit-strategy-shared/references/persona-card-contract.md`).** The Card is the
+   third `PrewritingControlField` and this skill owns it: record `PersonaCardRef` +
+   `PersonaCardVersion` + `PersonaCardHash`, the capability fields
+   (`knowledgeAccess` — exactly one of `research` / `owned` / `used` / `observed` /
+   `supplied_by_brand`; `permittedExperienceClaims` — a possibly-empty subset of
+   `{ownership, delivery, wear, service}`; `attentionFocus`; `questionIntent`), and the
+   per-draft fields (`postingWhy`, `knows[]`, `doesNotKnow[]`, `permittedFactRefs`,
+   `brandRelationshipDisclosed`). `postingWhy` must be able to coexist with the assigned
+   `PostingTrigger` — they are different fields and neither substitutes for the other.
+   **The writer never authors a Card**; letting it do so would let the draft grant itself
+   whatever boundary it already needs. Comments / self-comments / external comments take
+   `N/A` — this train does not put comments under a Card. `permittedExperienceClaims` is
+   authorised from submitted context, never inferred from the brand relationship: a
+   partner may genuinely own the product, and an empty set is a normal Card. The Card is a
+   **declared posting context, not a verified identity** — it is `LocalOnly`, is never
+   sent to Hub, and never implies the publishing account was resolved.
 10. Create one Brief block for every execution-table Key in the selected batch, including posts, self-comments, and external comments.
 11. For all P-B/C-B/PGC rows, record brand/SKU placement rationale using `references/brand-SKU-PGC-rules.md` (§3's five sample-learning classes are *rationale records only* — they never write `SelectedPlacement` directly nor bypass §2.0's mechanical rules).
 12. Write a `Planned` fingerprint row for every briefed post Key into `memory/phase4-叙事指纹索引.md` (`DraftHash: PENDING`), including the two `PrewritingControlFields` (`AssignedFlair`, `PostingTrigger`).
@@ -115,6 +134,14 @@ Baseline cards may live in `memory/phase4-撰写brief.md` or a dedicated baselin
 file; either way each is addressed by its `SampleSetID` and is reusable across
 Keys and batches within its validity period.
 
+Persona Cards may likewise live inside `memory/phase4-撰写brief.md` or in a
+dedicated `memory/phase4-persona-card.md`; either way each is addressed by its
+`PersonaCardRef` and carries its own `PersonaCardVersion` / `PersonaCardHash`.
+Unlike a baseline card a Persona Card is **per post Key, not shared** — its
+per-draft fields belong to one submission. Do not record Cards in
+`memory/phase4-叙事指纹索引.md`: the index has a fixed schema and a fixed hash
+definition, and the Card is not a fingerprint field.
+
 Optional Feishu Brief documents require an explicit user-provided folder link.
 
 ## Gate
@@ -124,7 +151,8 @@ Writing may start only after:
 - Every target subreddit has a valid, unexpired baseline card with a `SampleSetID`, with flair coverage recorded (`BaselineScope` / `FlairCoverageStatus`); `FlairCoverageStatus` is `Exact` or `ApprovedFallback` (never `Insufficient`).
 - Every **main-post** Key carries a non-empty `AssignedFlair` — verified against the ledger's `ProposedFlair` and the subreddit's live flair list (`FlairVerificationStatus: Verified` or `FallbackAssigned`; no `Rejected` left open), or the sentinel `NoFlairAvailable` / `NoFlairRequired` for flairless boards — and its `AssignedFlair` matches the baseline card's covered flair (or an approved fallback).
 - Every **main-post** Key's `客户内容原型` resolves to an `Approved` mapping row (`MappingRuleID` / `MappingVersion` recorded in the Routing Decision). Self-comments inherit the paired post's value; external comments use `—` and need no mapping of their own.
-- Every post Brief row carries the nine `LockedFingerprintFields` (`ContentFunction`, `StructureFamily`, `OpeningMove`, `EvidenceShape`, `BrandEntryMode`, `CaveatMode`, `EndingMode`, `LengthBand`, `AnchorSlot`), the two `PrewritingControlFields` (`AssignedFlair`, `PostingTrigger` — the latter satisfying the `PostingTrigger × BrandEntryMode` cross-constraint), and the four `TraceFields` (`SampleSetID`, `RecentCollisionCheck`, `MappingRuleID`, `MappingVersion`).
+- Every post Brief row carries the nine `LockedFingerprintFields` (`ContentFunction`, `StructureFamily`, `OpeningMove`, `EvidenceShape`, `BrandEntryMode`, `CaveatMode`, `EndingMode`, `LengthBand`, `AnchorSlot`), the three `PrewritingControlFields` (`AssignedFlair`, `PostingTrigger` — satisfying the `PostingTrigger × BrandEntryMode` cross-constraint — and `PersonaCardRef`), and the four `TraceFields` (`SampleSetID`, `RecentCollisionCheck`, `MappingRuleID`, `MappingVersion`).
+- Every **main-post** Key carries a non-empty `PersonaCardRef` with its `PersonaCardVersion` / `PersonaCardHash`, a single `knowledgeAccess`, a `permittedExperienceClaims` set drawn only from `{ownership, delivery, wear, service}` (empty is valid), non-empty `postingWhy`, and a `postingWhy` that can coexist with the assigned `PostingTrigger`. Comments take `N/A`. Role labels, if present, are non-authoritative and no gate reads them. Any Card with a non-empty `permittedExperienceClaims` also carries `DeclaredBy` (never the generating agent) and `ClaimAuthorizationRef`; without both, the claim set is reported as a Brief declaration rather than an authorised set.
 - `RecentCollisionCheck` is `Pass` for every row, or `Exception` with an approved `ExceptionRef`.
 - Every **P-B / PGC post** row carries a complete `BrandPlacementBasis` and a `SelectedPlacement` consistent with it (an already-planned P-B/PGC row may only land on 标题/首段/中段/后段 — moving the brand to a comment or dropping it is a quota change, so it goes back to planning); **C-B comments** carry `InheritedBrandPlacementBasis` + `CommentPlacementDecision` instead and never build their own histogram. No row derives title-brand exposure from the P-B label; `NoComparableEvidence` rows went through re-sampling / StopAndAsk / a recorded `BrandTitleExposureException`, not a default; `Sparse` rows meet the three §2.5 conditions.
 - Every post and comment Brief carries `InternalCoverageIntent` + a non-empty `ReaderVisiblePremise`, and no reader-facing field leaks internal labels.
@@ -154,8 +182,15 @@ Writing may start only after:
 - FlairCoverageStatus: Exact / ApprovedFallback / Insufficient   # batch-level = worst status across cards (Insufficient > ApprovedFallback > Exact)
 - ClientPrototypeMappingStatus: AllApproved / BlockingGap
 - StructureFieldsAssigned: Yes / No
-- PrewritingControlFieldsAssigned: Yes / No   # AssignedFlair + PostingTrigger per main-post Key
+- PrewritingControlFieldsAssigned: Yes / No   # AssignedFlair + PostingTrigger + PersonaCardRef per main-post Key
 - PostingTriggerCrossConstraintOK: Yes / No    # UnsolicitedTestimony ⇒ BrandEntryMode 不出现
+- PersonaCardCoverage: <n>/<N>                # main-post Keys with a non-empty PersonaCardRef
+- PersonaCardTransportStatus: LocalOnly(ServerContractMissing)   # the Card is never sent to Hub
+- PersonaCardAuthorizationStatus: Authorized / DeclaredOnly / NotApplicable   # worst status across Keys; propagate to writing and delivery
+- AcceptanceProfile: Default / NativeCopy
+- NativeCopyProfileStatus: NotSelected / Unavailable(ServerContractMissing)
+- LocalReviewIntent: accountBinding=<account_bound|persona_less>, brandTreatment=<managed_brand|organic>   # local planner declaration; propagate to writing and delivery, never sent to Hub
+- HubReviewScopeStatus: Unavailable(ServerContractMissing)   # no server-side scope exists to report
 - FingerprintPlannedRows: <n>/<N>
 - DiversityWindow: WindowCount=<n>, WindowDays=<n>
 - RecentCollisionCheck: Pass / BlockingCollision / Exception(<ExceptionRef>)