@givolt/i3-composer-agent 3.0.0 → 3.1.0

package/docs/upstream-repository/skill-gap.yml

@@ -0,0 +1,80 @@
+name: Skill gap
+description: Report when a skill's guidance was wrong, outdated, or did not apply in your project.
+title: "[skill-gap]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form when a skill gave incorrect, outdated, or ecosystem-mismatched guidance.
+        Keep answers short — enough context for maintainers to triage, not a full write-up.
+
+  - type: dropdown
+    id: skill
+    attributes:
+      label: Affected skill
+      description: Which skill did not work as expected?
+      options:
+        - api-and-interface-design
+        - browser-testing-with-devtools
+        - ci-cd-and-automation
+        - code-review-and-quality
+        - code-simplification
+        - context-engineering
+        - debugging-and-error-recovery
+        - deprecation-and-migration
+        - documentation-and-adrs
+        - doubt-driven-development
+        - frontend-ui-engineering
+        - git-workflow-and-versioning
+        - idea-refine
+        - incremental-implementation
+        - interview-me
+        - observability-and-instrumentation
+        - performance-optimization
+        - planning-and-task-breakdown
+        - security-and-hardening
+        - shipping-and-launch
+        - source-driven-development
+        - spec-driven-development
+        - test-driven-development
+        - using-agent-skills
+        - other / not sure
+    validations:
+      required: true
+
+  - type: textarea
+    id: excerpt
+    attributes:
+      label: Relevant instruction or excerpt
+      description: Paste the line or short passage from SKILL.md (or a linked reference) that misled the agent or did not apply.
+      placeholder: e.g. the verification checklist said to run `npm test`
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Project context
+      description: Language, build tool, test runner, or other conventions that matter here.
+      placeholder: e.g. Java 21, Maven, JUnit 5
+    validations:
+      required: true
+
+  - type: textarea
+    id: what-failed
+    attributes:
+      label: What did not work or did not apply
+      description: What happened when the agent followed the skill? What was wrong or irrelevant?
+      placeholder: e.g. agent insisted on npm scripts in a Maven repo; no package.json exists
+    validations:
+      required: true
+
+  - type: textarea
+    id: workaround
+    attributes:
+      label: What you did instead
+      description: How did you (or the agent) get unblocked? Optional but very helpful.
+      placeholder: e.g. pointed the agent at `./mvnw test` and ignored the npm checklist
+    validations:
+      required: false

package/docs/upstream-repository/skills-contributing.md

@@ -0,0 +1,15 @@
+---
+description: Anti-duplication guardrail for adding or changing skills
+paths:
+  - "skills/**"
+---
+
+# Adding or changing a skill
+
+This repo already covers most of the development lifecycle, so most new-skill ideas overlap an existing skill or an open PR. Before creating a new `skills/<name>/` directory or significantly reworking an existing one:
+
+- Run the pre-flight checks in [CONTRIBUTING.md](../../CONTRIBUTING.md#before-proposing-a-new-skill): search the catalog, check open PRs (`gh pr list --state open`), and justify the gap.
+- Prefer extending an existing skill over adding a near-duplicate. If the idea overlaps an existing skill, edit that skill instead of adding a new directory.
+- Keep the `SKILL.md` within [docs/skill-anatomy.md](../../docs/skill-anatomy.md), and never duplicate content between skills, reference the other skill instead.
+
+CONTRIBUTING.md is the single source of truth for the full workflow; this rule points to it rather than restating its checklist.

package/docs/upstream-repository/test-plugin-install.yml

@@ -0,0 +1,167 @@
+name: Test Plugin Installation
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  validate-skills:
+    name: Validate skill content
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+
+      - name: Validate all skills
+        run: node scripts/validate-skills.js
+
+      - name: Test skill lint rules
+        run: node --test scripts/lib/skill-lint-test.js
+
+      - name: Validate manifest versions
+        run: node scripts/validate-versions.js
+
+      - name: Test manifest version validator
+        run: node --test scripts/validate-versions-test.js
+
+      - name: Test skill eval runner
+        run: node --test scripts/run-evals-test.js
+
+      - name: Run skill evals (trigger + routing)
+        run: node scripts/run-evals.js --min-rank1 95
+
+      - name: Validate references/ links in skills
+        run: node scripts/validate-reference-links.js
+
+      - name: Test reference-link validator
+        run: node --test scripts/validate-reference-links-test.js
+
+      - name: Test floor-guard reference
+        run: node --test scripts/floor-guard-reference-test.js
+
+      - name: Test session-start hook payload
+        run: bash hooks/session-start-test.sh
+
+  validate-commands:
+    name: Validate command parity and description sync
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+
+      - name: Validate commands across all tool directories
+        run: node scripts/validate-commands.js
+
+      - name: Test command validator
+        run: node --test scripts/validate-commands-test.js
+
+      - name: Validate spec/plan/todo artifact paths
+        run: node scripts/validate-artifact-paths.js
+
+      - name: Test artifact-path validator
+        run: node --test scripts/validate-artifact-paths-test.js
+
+  # Ubuntu coverage stays in the existing jobs above, preserving their check names.
+  validate-platforms:
+    name: Validate tooling (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+
+      - name: Test validators and eval runner
+        run: >-
+          node --test
+          scripts/lib/skill-lint-test.js
+          scripts/validate-versions-test.js
+          scripts/run-evals-test.js
+          scripts/validate-reference-links-test.js
+          scripts/validate-commands-test.js
+          scripts/validate-artifact-paths-test.js
+          scripts/floor-guard-reference-test.js
+
+      - name: Validate all skills
+        run: node scripts/validate-skills.js
+
+      - name: Validate manifest versions
+        run: node scripts/validate-versions.js
+
+      - name: Validate references/ links in skills
+        run: node scripts/validate-reference-links.js
+
+      - name: Validate commands across all tool directories
+        run: node scripts/validate-commands.js
+
+      - name: Validate spec/plan/todo artifact paths
+        run: node scripts/validate-artifact-paths.js
+
+      - name: Run skill evals (trigger + routing)
+        run: node scripts/run-evals.js --min-rank1 95
+
+  test-hooks:
+    name: Hook regression tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Test sdd-cache hooks (stubbed curl, no network)
+        run: bash hooks/sdd-cache-test.sh
+
+      - name: Test simplify-ignore hook
+        run: bash hooks/simplify-ignore-test.sh
+
+  validate:
+    name: Validate plugin structure
+    needs: [validate-skills, validate-commands, validate-platforms]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Claude Code
+        run: npm install -g @anthropic-ai/claude-code
+
+      - name: Validate marketplace and plugin manifests
+        run: claude plugin validate .
+
+  test-install:
+    name: Test plugin installation
+    runs-on: ubuntu-latest
+    needs: validate
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Claude Code
+        run: npm install -g @anthropic-ai/claude-code
+
+      - name: Configure git to use HTTPS
+        run: git config --global url."https://github.com/".insteadOf "git@github.com:"
+
+      - name: Add marketplace
+        run: claude plugin marketplace add ./
+
+      - name: List marketplaces
+        run: claude plugin marketplace list
+
+      - name: Install plugin
+        run: claude plugin install agent-skills@addy-agent-skills --scope user

package/docs/workbuddy-setup.md

@@ -10,8 +10,8 @@ npx @givolt/i3-composer-agent --agents codebuddy,workbuddy --scope global --yes
 
 向导中 WorkBuddy 位于第 2 项，预选后仍可多选。全局目录：
 
-- `~/.workbuddy/skills/`：27 个 `i3-` 技能，选择说明和默认回复中文。
-- `~/.workbuddy/commands/`：11 个 `/i3-*` 短命令。
+- `~/.workbuddy/skills/`：28 个 `i3-` 技能，选择说明和默认回复中文。
+- `~/.workbuddy/commands/`：12 个 `/i3-*` 短命令。
 - `~/.workbuddy/agents/`：4 个专业角色。
 - `~/.workbuddy/i3-composer-agent/references/`：共享参考。
 - `~/.workbuddy/i3-composer-agent/docs/agents.md`：角色说明。
@@ -27,7 +27,7 @@ WorkBuddy 的目录选择使用自己的配置，不借用 `CODEBUDDY_CONFIG_DIR
 
 运行 `node ~/.workbuddy/i3-composer-agent/scripts/run-evals.js --min-rank1 95`，检查实际安装技能的中英文触发，
 不会调用模型。进入 `~/.workbuddy/i3-composer-agent/` 运行 `npm test` 可检查完整内容、两种语言及全部脚本回归；原 `.js` 入口保留。项目安装将 `~/.workbuddy/` 换成 `.codebuddy/`。五项校验、行为评测用例、样例和
-脚本用法见 [评测说明](../evals/README.md)。原型审计 Hooks 默认注册，其他原版 Hook 文件保留但不新增注册；实际回调和补调仍需本机验收。
+脚本用法见 [评测说明](../evals/README.md)。原型审计 Hooks 已移除；新安装不注册，升级只清理精确归属的旧注册，保留其他设置和历史。
 
 ## 发现和调用
 
@@ -85,22 +85,19 @@ npx @givolt/i3-composer-agent --workbuddy --scope global --yes --force
 
 ## 可选原型工具
 
-原型辅助工具位于本宿主基址的 `tools/i3-prototype/`，支持项目和全局范围；旧项目 `.prototype-tools` 继续读取兼容。推荐使用 `npx @givolt/i3-composer-agent@3.0.0 --workbuddy --scope global --yes --prototype-skills uiux,antdv`；项目安装将 scope 改为 project。可选依赖默认 none，后续也可使用已安装 Skill 的 prototype-dependencies.cjs 单独检测／补装。完整用法见原型 Skill 的 references/optional-skills.md。
+原型辅助工具位于本宿主基址的 `tools/i3-prototype/`，支持项目和全局范围；旧项目 `.prototype-tools` 继续读取兼容。推荐使用 `npx @givolt/i3-composer-agent@3.1.0 --workbuddy --scope global --yes --prototype-skills uiux,antdv`；项目安装将 scope 改为 project。可选依赖默认 none，后续也可使用已安装 Skill 的 prototype-dependencies.cjs 单独检测／补装。完整用法见原型 Skill 的 references/optional-skills.md。
 
 原型共享资料统一在项目 prototypes/：新索引 prototypes/index.json，准备范围 prototypes/.preparation/<id>/scope.json。新原生 scope.moduleIds 自动生成 appliesTo；旧索引、输入和实例保持兼容，安装升级不自动迁移。工具及运行缓存使用所选宿主基址；全局浏览器缓存按业务项目身份隔离。详细规则和只读查询／显式迁移命令见 i3-ui-prototype/references/project-layout.md。
 
 
-## 原型 Hooks 与本地 antDv
+## 原型审计退役与本地 antDv
 
-项目安装注册到 .codebuddy/settings.json，全局注册到 WORKBUDDY_CONFIG_DIR 或 ~/.workbuddy/settings.json。与 CodeBuddy 共用项目目录时，每事件只有一个原型入口；各宿主允许范围、明确禁用和运行状态分别记录。重载 WorkBuddy 后验证，不因文件存在宣称生效。
+WorkBuddy 新安装不注册原型审计 Hook。项目升级清理 `.codebuddy/settings.json` 中本包拥有的旧注册；全局清理 WORKBUDDY_CONFIG_DIR 或 ~/.workbuddy/settings.json 中对应注册。共享项目的旧 Buddy 注册一并退役，其他 Hook、权限、原型和审计历史保留。被手改或未知归属先停止并报告；清理后重载 WorkBuddy。
 
 ```bash
 node ~/.workbuddy/i3-composer-agent/hooks/manage.cjs check --host workbuddy --scope global --project "/业务项目"
-node ~/.workbuddy/i3-composer-agent/hooks/manage.cjs enable --host workbuddy --scope global --project "/业务项目" --groups prototype
 node ~/.workbuddy/i3-composer-agent/hooks/manage.cjs disable --host workbuddy --scope global --project "/业务项目" --groups prototype
 node ~/.workbuddy/skills/i3-ui-prototype/scripts/prototype-dependencies.cjs query --host workbuddy --scope global --project "/业务项目" --kind info --component Table --version 1.5.2
 ```
 
-项目范围将入口改为 .codebuddy 并使用 --scope project。只读 query 解析本宿主 Node／CLI 入口，不要求全局 antdv 命令；它不代替实际 antDv Skill 调用。新实例使用 --host workbuddy --execution-policy buddy-ab-v2，按 Skill 合同先加载前端／适用专业技能，再实施。
-
-当前适配依据官方插件 Hooks 文档及 WorkBuddy 5.8.3 随包 CLI 源代码核对。六组宿主／范围的文件级集成测试使用合成日志，实际宿主执行状态仍 pending-user。手测须看到漏调拒绝、当前主会话真实成功加载和重试成功；持续失败到预算上限后如实报告阻塞，不能用只读文件或自述代替调用证据。
+项目范围将入口改为 .codebuddy 并使用 --scope project。check 只读，enable prototype 已拒绝。query 使用本宿主的本地入口，不代替 antDv Skill 调用。按 Skill 合同先实际加载前端／适用专业技能，再实施；固定业务断言、构建和浏览器证据校验保持。正常流程不要求 Hook 会话绑定，自动调用审计显示未验证。

package/evals/cases/i3-ui-demo.json

@@ -0,0 +1,98 @@
+{
+  "skill_name": "i3-ui-demo",
+  "trigger": {
+    "positive": [
+      {
+        "prompt": "Use i3-ui-demo to create a template-based UI demo from this business document with required UI/UX Pro Max and antdv-next 1.6.0",
+        "top_k": 1
+      },
+      {
+        "prompt": "Add a details page to our existing i3-ui-demo, preserving manual edits and the template-based UI demo design",
+        "top_k": 1
+      },
+      {
+        "prompt": "Analyze a i3-ui-demo template-based UI demo plan without writing files or installing dependencies",
+        "top_k": 1
+      }
+    ],
+    "negative": [
+      {
+        "prompt": "Maintain the approved baseline of an existing i3-ui-prototype candidate",
+        "owner": "i3-ui-prototype"
+      },
+      {
+        "prompt": "Implement the approved production design as an accessible reusable Vue form component",
+        "owner": "i3-frontend-ui-engineering"
+      },
+      {
+        "prompt": "Optimize slow database indexes",
+        "owner": "i3-performance-optimization"
+      }
+    ]
+  },
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "Use i3-ui-demo to create the asset-management UI demo from the supplied document in a separate prototype directory. The document includes my template and design choices; preserve them. Use required fixed dependencies and explicit professional Skill loading, implement the representative edit failure/retry journey before extending the remaining pages, and verify the current build where the browser tools are available. Leave it for human review.",
+      "expected_output": "A runnable business-specific Vue and antdv-next 1.6.0 prototype with traceability, explicit Skill execution and truthful current-code verification",
+      "files": [
+        "i3-ui-demo"
+      ],
+      "expectations": [
+        "Reads the actual supplied document and preserves its template and design choices instead of inventing generic requirements or asking again",
+        "Explicitly loads the specialist Skills named in the workflow through the actual supported host mechanism and reports that mechanism honestly",
+        "Verifies the fixed versions and real knowledge data rather than treating a successful version argument or package presence as proof",
+        "Uses the pinned query entry for actual component queries so running at a business root with a nested app cannot silently select another knowledge version",
+        "Reads back the persisted Master and page rules and reconciles them with confirmed template and design choices instead of promoting a rejected search result",
+        "Requires a successful concrete browser tool call for connectivity; an empty ready server list is insufficient",
+        "Implements and checks validation failure, preserved input, simulated save failure, retry, list/detail synchronization and incremental scope coverage",
+        "Preserves other prototypes and manual edits, records current build/browser evidence or an explicit verification gap, and leaves human review pending",
+        "Loads the owned capability definition, selected reference HTML, behavior modules and preset, without reading another prototype Skill",
+        "Builds one template contract with native capability bindings, actual business fields/actions and explicit reference-node decisions; unresolved items remain pending",
+        "Preserves the original template palette and dimensions by default, constrains UI/UX Pro Max to confirmed template choices, and compares current runtime against owned references"
+      ]
+    },
+    {
+      "id": 2,
+      "kind": "dialogue",
+      "prompt": "Use i3-ui-demo for read-only analysis of the supplied prototype request. Do not write files, install dependencies, persist design output, change MCP settings or start a browser. The required official tool is missing. Explain the next steps only.",
+      "expected_output": "Read-only analysis with a truthful missing dependency and a future preparation plan",
+      "expectations": [
+        "No skill-managed file, callback, cache, design persistence, service, browser or MCP configuration mutation occurs",
+        "Missing creation dependencies are reported without blocking delivery of the read-only analysis",
+        "No tool installation, native Skill invocation or browser execution is falsely claimed"
+      ]
+    },
+    {
+      "id": 3,
+      "kind": "dialogue",
+      "prompt": "Create a i3-ui-demo. ui-ux-pro-max is available but the official antdv Skill and fixed CLI data are missing. I decline installing the required official tools. Do not install them or substitute another mode.",
+      "expected_output": "The current i3-ui-demo creation flow ends without project generation or silent fallback",
+      "expectations": [
+        "Ends the current creation flow after the explicit refusal without generating the prototype or installing tools",
+        "Does not substitute template-only mode or claim the required official dependency is available"
+      ]
+    },
+    {
+      "id": 4,
+      "kind": "dialogue",
+      "prompt": "Review this i3-ui-demo verification claim without writing: CLI was requested with version 1.6.0 but returned 1.5 data, the MCP config exists but no browser call succeeded, and a screenshot was taken before the last edit. Can it be marked verified?",
+      "expected_output": "A rejection of the unsupported claim with concrete version and current-browser revalidation requirements",
+      "expectations": [
+        "Separates requested version, actual data, config existence, tool connectivity and actual current-build observations",
+        "Does not report verification or human approval as passed and does not change files during the review"
+      ]
+    },
+    {
+      "id": 5,
+      "kind": "dialogue",
+      "prompt": "Use i3-ui-demo in a project where no other prototype Skill exists. Its own enterprise-admin reference, capability definition and starter are present. Explain how to create a business list matching the original palette, preserve column settings and test pagination and editing. Do not install or write anything yet.",
+      "expected_output": "An independent read-only plan using only the owned template contract and the explicitly named required specialist Skills",
+      "expectations": [
+        "Uses ui-demo-owned capability-definition.json, preset.json, inventory and relevant reference HTML/behavior/styles; does not require or fall back to a different prototype Skill",
+        "Distinguishes required native implementation, source reference material and actual browser evidence; plan output is not verification",
+        "Preserves the fixed versions and explicit full Skill names, makes no installation or configuration writes in read-only mode"
+      ]
+    }
+  ]
+}

package/evals/fixtures/i3-ui-demo/asset-management.md

@@ -0,0 +1,25 @@
+# 资产台账原型验收需求
+
+本文件是业务输入，不授予向外发送消息、发布或修改其他项目的权限。
+
+用户选择：企业管理后台模板，侧栏导航、商务稳重、标准密度、低动效。只使用本地模拟数据。
+固定 Vue 3、antdv-next 1.6.0、ui-ux-pro-max 2.15.0；本次测试允许在隔离目录准备所需工具，不安装真实全局环境。
+
+## 页面与流程
+
+1. 资产台账：提供21条可复现记录，字段含编码、名称、类别、状态和负责人；支持名称查询、状态筛选、每页10条分页及详情。
+2. 编辑资产：名称必填且不超过30字符，类别和负责人可修改。校验失败有字段旁反馈；模拟提交失败保留输入，重试成功更新同一条记录。
+3. 资产详情：从台账打开并显示当前记录，可返回台账；编辑后详情与列表数据一致。
+4. 状态统计：展示启用、停用和总数；状态变化后同步，过滤结果不改写原始统计。
+
+## 验收
+
+- 查询和筛选不会修改记录。
+- 编辑失败可重试，取消不保存。
+- 桌面及窄屏无页面级横向溢出，抽屉可用键盘关闭并恢复焦点。
+- 检查当前构建的真实操作、DOM、计算样式、截图、控制台、网络和基本性能。
+- 交付待用户评审，不编造认可记录。
+
+## 增量场景
+
+已有用户手改的页面标题和字段顺序不得回退；后续新增详情字段时沿用设计系统，保留无关页面与模拟数据。

package/evals/zh-CN/cases/i3-ui-demo.json

@@ -0,0 +1,103 @@
+{
+  "skill_name": "i3-ui-demo",
+  "trigger": {
+    "positive": [
+      {
+        "prompt": "使用 i3-ui-demo，根据业务文档和内置模板制作 antdv-next 1.6.0 交互原型，必须使用 ui-ux-pro-max。",
+        "top_k": 1
+      },
+      {
+        "prompt": "为已有 i3-ui-demo 新增详情页，沿用模板设计并保留人工修改。",
+        "top_k": 1
+      },
+      {
+        "prompt": "只读分析 i3-ui-demo 模板原型方案，不写文件或安装依赖。",
+        "top_k": 1
+      }
+    ],
+    "negative": [
+      {
+        "prompt": "选择 UI 原型模板，制作一个可操作的申请审批交互原型供评审。",
+        "owner": "i3-ui-prototype"
+      },
+      {
+        "prompt": "开发一个响应式前端页面，做好组件布局和无障碍交互。",
+        "owner": "i3-frontend-ui-engineering"
+      },
+      {
+        "prompt": "产品页面有一千条数据渲染很慢，请定位性能瓶颈并优化。",
+        "owner": "i3-performance-optimization"
+      }
+    ]
+  },
+  "evals": [
+    {
+      "id": 1001,
+      "prompt": "使用 i3-ui-demo 根据所附资产台账文档制作原型，保留文档中已明确的模板和设计选择，在独立目录显式加载所需技能并使用固定版本。先实现编辑校验、提交失败及重试的代表流程，再扩展其他页面；有浏览器能力时验证当前构建，交付待用户评审。",
+      "expected_output": "A runnable business-specific Vue and antdv-next 1.6.0 prototype with traceability, explicit Skill execution and truthful current-code verification",
+      "files": [
+        "i3-ui-demo"
+      ],
+      "expectations": [
+        "Reads the actual supplied document and preserves its template and design choices instead of inventing generic requirements or asking again",
+        "Explicitly loads the specialist Skills named in the workflow through the actual supported host mechanism and reports that mechanism honestly",
+        "Verifies the fixed versions and real knowledge data rather than treating a successful version argument or package presence as proof",
+        "Uses the pinned query entry for actual component queries so running at a business root with a nested app cannot silently select another knowledge version",
+        "Reads back the persisted Master and page rules and reconciles them with confirmed template and design choices instead of promoting a rejected search result",
+        "Requires a successful concrete browser tool call for connectivity; an empty ready server list is insufficient",
+        "Implements and checks validation failure, preserved input, simulated save failure, retry, list/detail synchronization and incremental scope coverage",
+        "Preserves other prototypes and manual edits, records current build/browser evidence or an explicit verification gap, and leaves human review pending",
+        "Loads the owned capability definition, selected reference HTML, behavior modules and preset, without reading another prototype Skill",
+        "Builds one template contract with native capability bindings, actual business fields/actions and explicit reference-node decisions; unresolved items remain pending",
+        "Preserves the original template palette and dimensions by default, constrains UI/UX Pro Max to confirmed template choices, and compares current runtime against owned references",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    },
+    {
+      "id": 1002,
+      "kind": "dialogue",
+      "prompt": "使用 i3-ui-demo 只读分析原型请求：不写文件、不安装依赖、不持久化设计、不修改 MCP、不启动浏览器。所需官方工具缺失，只说明缺项和后续步骤。",
+      "expected_output": "Read-only analysis with a truthful missing dependency and a future preparation plan",
+      "expectations": [
+        "No skill-managed file, callback, cache, design persistence, service, browser or MCP configuration mutation occurs",
+        "Missing creation dependencies are reported without blocking delivery of the read-only analysis",
+        "No tool installation, native Skill invocation or browser execution is falsely claimed",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    },
+    {
+      "id": 1003,
+      "kind": "dialogue",
+      "prompt": "用 i3-ui-demo 创建原型。ui-ux-pro-max 可用，但官方 antdv 技能和固定 CLI 数据缺失。我拒绝安装这些必备工具，请不要安装或改用其他模式。",
+      "expected_output": "The current i3-ui-demo creation flow ends without project generation or silent fallback",
+      "expectations": [
+        "Ends the current creation flow after the explicit refusal without generating the prototype or installing tools",
+        "Does not substitute template-only mode or claim the required official dependency is available",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    },
+    {
+      "id": 1004,
+      "kind": "dialogue",
+      "prompt": "只读审查 i3-ui-demo 验证声明：CLI 请求1.6.0却返回1.5数据，MCP配置已存在但实际浏览器调用失败，截图来自最后一次修改之前。是否可以标记验证通过？不要写文件。",
+      "expected_output": "A rejection of the unsupported claim with concrete version and current-browser revalidation requirements",
+      "expectations": [
+        "Separates requested version, actual data, config existence, tool connectivity and actual current-build observations",
+        "Does not report verification or human approval as passed and does not change files during the review",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    },
+    {
+      "id": 1005,
+      "kind": "dialogue",
+      "prompt": "项目没有安装其他原型 Skill，i3-ui-demo 自有企业后台模板、能力定义和 starter 均在。使用 i3-ui-demo 只读说明如何按原模板配色创建业务列表、保留列设置并检查分页与编辑。暂不安装或写文件。",
+      "expected_output": "An independent read-only plan using only the owned template contract and the explicitly named required specialist Skills",
+      "expectations": [
+        "Uses ui-demo-owned capability-definition.json, preset.json, inventory and relevant reference HTML/behavior/styles; does not require or fall back to a different prototype Skill",
+        "Distinguishes required native implementation, source reference material and actual browser evidence; plan output is not verification",
+        "Preserves the fixed versions and explicit full Skill names, makes no installation or configuration writes in read-only mode",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    }
+  ]
+}

package/hooks/PROTOTYPE.md

@@ -1,4 +1,4 @@
-# 原型 Hooks 安装与维护
+# 原型审计 Hooks 退役与旧注册清理
 
 <!-- i3:zh-guide:start -->
 ## 中文使用说明
@@ -8,16 +8,24 @@
 默认使用简体中文解释、追问及生成报告；用户明确要求其他语言时可切换。原方法正文、引用、阈值和审批条件完整保留。代码标识、路径、命令、工具参数、JSON 键/枚举与原文引用保持原样。
 <!-- i3:zh-guide:end -->
 
-本文件面向安装器和维护人员。i3-ui-prototype 的正常职责是制作、修订和验收原型，不承担宿主或 Hook 排障。
+原型审计 Hook 已移除。CodeBuddy／WorkBuddy 的新安装不注册 prototype 组，旧回调入口只返回空结果，不再采集调用、拦截写入、发起补调或阻止 Stop。原型 Skill 继续负责制作、修订和验收 UI。
 
-安装器在 CodeBuddy/WorkBuddy 项目或全局范围注册 prototype 组。宿主自动触发；不要求原型使用者额外执行 execution-begin 或确认任务绑定。必要 Skill 的真实调用由原生 Pre/Post 回调记录，PTC/REPL 的内部工具分别记录；REPL 脚本文本不能代替调用成功。Bash 不提供 stdout 时由本包第一方入口捕获实际结果；其他只读查询可使用 native-tool-result.cjs 的本地绝对入口，不安装依赖。
+安装或升级时，统一管理器精确清理本包拥有的旧 prototype 注册。清理同时覆盖该范围内共享的 Buddy 注册，保留权限、用户 Hook、原版三组、已有原型和审计历史。被手改的注册、缺归属记录或无效配置会停止清理并报告原因，不能强行覆盖。清理后的旧 installation.json 存入 `state/i3-prototype/history/retired-<digest>.json`，不删除原会话记录。
 
-漏调检查由当前操作和固定原型策略决定，不根据最新一句话是否包含“原型”启停采集。缺少 Skill 时拦截并提示通过宿主工具补调，真实成功后重试原操作；普通追问保持同一会话/有效上下文内的调用记录和原型运行。新会话或上下文压缩后重核 Skill，输入、实例或构建变化按原有合同重核业务证据。明确只读、暂停或取消独立限制受管变更，收到 UserPromptSubmit 即生效，不等待日志写盘；普通追问不解除，明确继续实施后解除。这个授权限制不控制回调采集，也不生成新的任务身份。
+只读检查：
 
-Stop 只对本轮实际操作过的原型检查完成声明；无关文件任务不会被历史原型的验收接管。finalize 仍核验当前原型的真实调用、构建和浏览器证据。
+```sh
+npx --yes @givolt/i3-composer-agent hooks check --host codebuddy --scope project --project .
+```
 
-检查命令：`npx --yes @givolt/i3-composer-agent hooks check --host codebuddy --scope project --project .`；全局将 scope 改为 global。检查只读，不启用/修复设置。registered 表示已注册；active 表示观察到当前注册的有效运行；failure 显示当前无法核验的操作、会话和原因。次数只限制重复催调/提示，不构成永久操作锁；新的真实成功结果可恢复。普通追问不清零计数，原型会话不承担 Hook 排障。
+已安装入口可显式清理旧注册：
 
-诊断、补调审计与 PTC 机器回调位于宿主基址的 state/i3-prototype/；项目/全局、宿主/会话/有效上下文和原型实例分别隔离。required、ready-to-retry、recovered、blocked 为兼容的审计显示，放行始终重新核对当前真实结果，不把状态名当额外前置。记录请求、失败或只读 SKILL.md 均不能代替成功调用；recovered 只表示观察到补调及重试，不代表业务验收。保留上游 Hooks、用户注册、旧 HTML 和已有原型；旧 execution-* 命令仅供兼容，不是新流程的前置。
+```sh
+node .codebuddy/i3-composer-agent/hooks/manage.cjs disable --host codebuddy --scope project --project . --groups prototype
+```
 
-CodeBuddy 项目/全局 × IDE/CLI（CLI direct/PTC）真实注册、触发、必要 Skill 调用、缺失补调和失败展示必须分别验收。自动化回放不能冒充真实宿主；正式发布门禁在仓库维护工具中执行，不放到业务原型 Skill 内。
+全局改用对应全局入口和 `--scope global`；WorkBuddy 使用 `--host workbuddy`。旧 `--prototype-hooks` 和 `prototype-hooks.cjs` 只保留检查／清理兼容，不能重新 enable。只读 check 不清理设置、不扫描会话日志；输出中的 retired／cleanupRequired 描述旧配置，不代表调用或业务验收通过。清理后重载受影响宿主。
+
+原版 `session-start`、`sdd-cache`、`simplify-ignore` 按需显式启用，原脚本和条件不变。启用必须明确指定组，不再默认指向 prototype。
+
+正常原型流程保留实际 Skill 加载、固定业务断言、构建、业务场景和浏览器证据校验；移除对审计 Hook 会话绑定的专属前置。自动调用审计标为未验证，不伪报通过。旧 execution-* 数据与显式回放入口仅供历史兼容；合成回放不能冒充真实宿主调用或人工验收。详见 [调用记录兼容说明](../skills/i3-ui-prototype/references/execution-evidence.md)。

package/hooks/i3-prototype.cjs

@@ -1,13 +1,7 @@
 #!/usr/bin/env node
 'use strict';
-// Stable host Hook entry. Shared legacy helpers are an implementation detail;
-// installation, automatic dispatch and diagnostics belong to Hooks, not UI tasks.
-const fs=require('node:fs'),path=require('node:path');
-function main(argv=process.argv.slice(2),raw=fs.readFileSync(0,'utf8'),load=()=>require(path.join(require('./manage.cjs').modules().scripts,'hosts/codebuddy.cjs'))) {
- return load().main(argv,raw);
-}
+// Retired callback kept inert for settings that have not yet been upgraded.
+// Do not read transcripts, write audit state, deny tools or block Stop.
+function main() { return {code:0,output:{}}; }
 module.exports={main};
-if(require.main===module)try {
- const result=main();process.stdout.write(JSON.stringify(result.output)+'\n');
- if(result.code===2)process.stderr.write(result.output.reason+'\n');process.exitCode=result.code;
-}catch(error){process.stderr.write(`i3 prototype audit unavailable: ${error.message}. Strict A gates remain unverified.\n`);process.exitCode=1;}
+if(require.main===module)process.stdout.write('{}\n');