@gobing-ai/knowledge-kit 0.0.32 → 0.0.33

package/plugins/kk/skills/content-safety/SKILL.md

@@ -67,13 +67,14 @@ it as a category-4 finding (quoted as evidence) and apply the decision rules exa
 
 A platform file is a snapshot. When its `Last verified` date is older than the content's run
 date by more than 90 days, or a takedown/feedback event post-dates it, treat its rules as
-`unverified` for this review (`evidenceGap: true`, escalate) and say so in the report.
+`unverified` for this review (`evidenceGap: true`, `disposition: "gap"`) and say so in the report.
 
 ## Decision per platform
 
 For each requested platform, load `references/platforms/<platform>.md` and decide. A requested
 platform with **no reference file** is unsupported: emit `BLOCK` with `evidenceGap: true` and
-`escalate: true` for it; rules come only from that platform's own reference file.
+`disposition: "escalate"` for it (no rules at all is a genuine operator decision); rules come
+only from that platform's own reference file.
 
 - `OK` — no finding reaches a block rule.
 - `RISK` — findings exist but are warn-grade (e.g. evidence gap on this platform); submission is
@@ -84,8 +85,9 @@ platform with **no reference file** is unsupported: emit `BLOCK` with `evidenceG
   never offsets a high-risk finding.**
 
 If the platform file's evidence status is `unknown`/`unverified` for the rule a finding rests on,
-the finding is reported with `evidenceGap: true` and the decision escalates to manual review —
-a silent auto-`OK` on gapped evidence is a contract violation.
+the finding is reported with `evidenceGap: true` and `disposition: "gap"` — risk recorded on the
+report, never a silent auto-`OK` (that combination is a contract violation). A gap alone does not
+require pre-publish human review; only `disposition: "escalate"` does (20261007).
 
 ## Output contract
 
@@ -96,6 +98,7 @@ One JSON report per invocation, written to the path the caller provides (default
 {
   "content_ref": "<path or id of reviewed Content>",
   "mode": "detect-only | detect+revise",
+  "confidence": "HIGH | MEDIUM | LOW",
   "platforms": [
     {
       "platform": "<reference file name>",
@@ -106,7 +109,8 @@ One JSON report per invocation, written to the path the caller provides (default
           "item": "<platform review-item id, or generic>",
           "evidence": "<quoted passage / location>",
           "detail": "<why this is a finding>",
-          "evidenceGap": false
+          "evidenceGap": false,
+          "disposition": "note | fix | gap | escalate"
         }
       ],
       "revision": {
@@ -126,6 +130,30 @@ One JSON report per invocation, written to the path the caller provides (default
 `escalate: true` + printed report path is required whenever evidence is missing for a finding's
 rule. Never emit `OK` with `evidenceGap` findings; that combination is a contract violation.
 
+### Finding dispositions (20261007)
+
+Every finding carries `disposition`, telling the consumer what answering it requires:
+
+| `disposition` | Meaning | Set when |
+|---|---|---|
+| `note` | Recorded context judgment / verified-OK observation; no action | 字词命中 without mainline risk, checks that passed with commentary |
+| `fix` | Fixable by deletion / desensitization / disclosure; revision proposed in `detect+revise` | Categories 3–5 findings the drafts can be edited to resolve |
+| `gap` | Evidence gap: the rule text is unverified for this review; risk recorded, review not forced | `evidenceGap: true` findings on an otherwise sound draft |
+| `escalate` | Unresolved admission risk an operator must decide before submission | Category-2 residue that survives exclusion, no-reference-file platforms, anything the operator must answer by hand |
+
+Report-level `escalate: true` is set **iff at least one finding carries `disposition:
+"escalate"`**; `escalation_reason` names those findings. Consumers that key on this field: the
+`kk-daily-ai-voice` gate escalates only on `disposition: "escalate"`; a report with no
+`disposition` field anywhere keeps the legacy behavior (any RISK decision or report-level
+escalate pauses a run) — fail-closed back-compat.
+
+Report-level `confidence` (`HIGH | MEDIUM | LOW`) is the reviewer's self-graded certainty in the
+report's decisions and dispositions, graded the same way as the content-judge verdict confidence.
+A disposition-contract report **must** carry a valid `confidence`: the daily gate blocks a report
+that classifies with dispositions whose confidence is missing or outside the enum (fail-closed,
+mirroring the 20261003 verdict-confidence hardening). Legacy reports (no `disposition` field)
+remain exempt.
+
 ## Relation to content-judge
 
 - content-judge scores **quality**; content-safety decides **admission risk**. Different questions.
@@ -163,8 +191,11 @@ travel with the draft still block (a PII finding on a blocked platform, or a jud
 outside the admission criteria: prohibited claims / disclosure / data-handling), while
 **admission-only findings** (the CN 资质口径 / 播报形态 rules) drop the platform
 they name from that run and let every other target publish; the drop is recorded in the verdict
-stamp's `excludedPlatforms` and honoured by the per-target publish stages. A `RISK` decision or
-`escalate: true` still forces the human review even when the run is otherwise unattended.
+stamp's `excludedPlatforms` and honoured by the per-target publish stages. On an otherwise clean
+pass (PASS verdict, no BLOCK), only findings marked `disposition: "escalate"` force the human
+review (20261007); evidence-gap and note/fix-class RISK stay recorded and publish at recorded
+risk (gate status `exclude`, empty `excludedPlatforms`). A report with no `disposition` field
+keeps the legacy behavior — any RISK decision or `escalate: true` pauses.
 
 The report is bound to the exact draft bytes: editing a draft after the verdict invalidates it, and
 the remediation loop re-requests a fresh review for that reason. The earlier deterministic gate is

package/plugins/kk/skills/web-automation/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: web-automation
+description: >-
+  Discover, enhance, and automate web tasks with Playwright (or agent-browser
+  over CDP) — "walk this console and record evidence", "figure out this site's
+  UI", "automate this web flow", "reuse my cached login on <channel>", "check
+  whether my session on <channel> is still valid", "fix this channel's
+  selectors", or when a spur workflow `agent.run` step targets the
+  web-automation skill. Owns method and evidence; transport stays in kk
+  plugins; orchestration is a @gobing-ai/ts-dual-workflow-engine
+  transition-flow (see docs/design/web-automation-engine.md).
+---
+
+# web-automation — discover, enhance, automate with a real browser
+
+## Purpose
+
+Three operations over one method: drive a **real Chromium on the channel's
+cached login profile**, record **evidence** (screenshots, DOM signals, JSON),
+and never report an outcome that was not observed.
+
+| Operation | When | Output |
+| --- | --- | --- |
+| **discover** | new/changed site; "figure out this UI" | evidence dir + drift list (`docs/design/<channel>-ui-discovery.md` convention) |
+| **enhance** | selectors/signals drifted; a plugin or workflow fails on a live console | fixed selectors/signals in the owning plugin + updated discovery doc, same commit |
+| **automate** | a repeatable web task (login-gated save/draft/fill/read) | workflow-driven run with per-step Result/evidence; draft-safe by default |
+
+This skill owns **method**. It does not own transport (that is the
+`kind: publish`/`ingestion` plugins) or orchestration (that is the engine —
+`spur workflow` runs `@gobing-ai/ts-dual-workflow-engine`; see
+`docs/design/web-automation-engine.md` for the layering and the YAML).
+
+## Cached login (`auth: cached` — the default)
+
+Login state is cached **per channel** as a persistent Playwright profile dir —
+cookies, localStorage, and session live on disk outside git:
+
+```
+~/.config/kk/browser-profiles/<channel>   # xhs, infoq, juejin, substack, x, wechatmp
+```
+
+| `auth` | Behavior |
+| --- | --- |
+| `cached` (default) | Preflight the profile; reuse it read-only. Launch with `launchPersistentContext` (see `references/browser-launch.md`). No credentials are typed, read, or stored by any script. |
+| `fresh` | Profile missing/expired → **headed** launch, operator completes login by hand (QR/OAuth/password), then the profile is the cache again. Never auto-type credentials; OAuth gates need the stealth args. |
+
+Preflight before any drive — cheap and headless:
+
+```bash
+test -d ~/.config/kk/browser-profiles/<channel> && echo cached || echo fresh-required
+```
+
+A profile dir existing is necessary, not sufficient: before `automate` runs,
+do a read-only session probe (open the console URL, check a signed-in-only
+selector) and route to `fresh` on failure. Age-guessing timestamps is banned —
+probe, don't predict.
+
+## Method
+
+1. **Launch** — `chromium.launchPersistentContext(profileDir, { headless, args: [CDP port, stealth] })`.
+   Decision table and the exact snippet: `references/browser-launch.md`.
+2. **Discover** — screenshot first, then read DOM (selectors, shadow roots,
+   iframes, counts) with small throwaway scripts; save frames + a signals JSON
+   into the run's evidence dir; write/refresh the channel's
+   `docs/design/<channel>-ui-discovery.md` (selectors, drift list, date).
+3. **Enhance** — diff observed DOM against the plugin's encoded
+   selectors/signals; fix the plugin (root cause — one shared helper, not
+   every caller), re-walk to prove it, update the discovery doc in the same
+   commit.
+4. **Automate** — encode the flow as engine workflow nodes (preflight →
+   launch → drive → verify → record); `drive` steps run the measured
+   selectors and **assert an observed outcome signal** (toast, counter delta,
+   URL change). An unobserved outcome is reported as failure, never success.
+5. **Confidence-verified verdicts** — every outcome verdict carries
+   `confidence: HIGH | MEDIUM | LOW` (HIGH = measured signal observed;
+   MEDIUM = indirect signal, e.g. counter delta without toast; LOW = partial
+   evidence, one check passed). **Missing or out-of-enum confidence is itself
+   a failure** — the verify gate blocks it, mirroring the safety-verdict
+   convention (`kk-daily-ai-voice.md`, 20261003).
+
+## Safety rails (non-negotiable)
+
+- **Never click publish/send/submit/delete** unless the task explicitly
+  authorizes live publishing. Default target: draft/save/暂存.
+- Bot-walled channels (xhs) and fresh logins stay **headed**; headless only
+  after the session is proven.
+- Every reported success cites observed evidence (signal, screenshot, JSON).
+  No evidence → it is a failure with the reason — and every verdict states
+  its `HIGH | MEDIUM | LOW` confidence; a verdict without a valid level
+  fails the gate like a missing verdict.
+- Secrets stay out of repo, YAML, and vars. Login state lives only in the
+  profile dir under `~/.config` (outside git); scripts print paths, never tokens.
+- One browser per channel/profile at a time; close contexts you launched.
+
+## Engine invocation (summary)
+
+Orchestration is a `kind: transition-flow` workflow; `startable` nodes let a
+run re-enter at `drive` after a manual login without redoing earlier nodes.
+Full YAML, node contract, and the option-B (in-process runners) design:
+`docs/design/web-automation-engine.md`.

package/plugins/kk/skills/web-automation/references/browser-launch.md

@@ -0,0 +1,86 @@
+# Browser launch & cached-login recipes
+
+Everything here is measured on the kk channels (E92 discovery, 2026-10).
+The launcher is the proven pattern from `.spur/run/discovery/xhs-launch.ts` /
+`walk-wechatmp*.ts`; the profile matrix is the live
+`~/.config/kk/browser-profiles/` tree.
+
+## The launcher (persistent context + CDP + stealth)
+
+```ts
+import { chromium } from 'playwright';
+
+const profileDir = process.env.KK_WEB_PROFILE ?? `${process.env.HOME}/.config/kk/browser-profiles/<channel>`;
+const port = process.env.KK_WEB_CDP ?? '9222';
+
+const ctx = await chromium.launchPersistentContext(profileDir, {
+    headless: process.env.KK_WEB_HEADLESS === 'true', // default headed
+    viewport: null,
+    args: [
+        `--remote-debugging-port=${port}`,              // agent-browser / external CDP clients attach here
+        '--disable-blink-features=AutomationControlled', // required at OAuth/bot-wall gates
+    ],
+});
+const page = ctx.pages()[0] ?? (await ctx.newPage());
+console.log(JSON.stringify({ cdpPort: port, profile: profileDir, url: page.url() }));
+process.on('SIGTERM', async () => { await ctx.close(); process.exit(0); });
+await new Promise(() => {}); // stay up for CDP drivers
+```
+
+- The **profile dir is the credential cache** — cookies + storage survive runs;
+  nothing else is persisted, no tokens are printed.
+- `agent-browser` (or any CDP client) attaches to the printed port; plain
+  Playwright scripts can also import the same process's `page`.
+- One context per channel. Two concurrent launches on one profile corrupt it.
+
+## Headless vs headed
+
+| Situation | Mode | Why |
+| --- | --- | --- |
+| Session probe / preflight | headless OK | read-only, cheap |
+| Automated drive on a proven session | headless OK | measured: infoq/juejin/substack/x/wechatmp drives work headless post-login |
+| `auth: fresh` login | **headed** | operator completes QR/OAuth by hand |
+| xhs any operation | **headed** | bot-walls headless loads (measured); shadow-root clicks need CDP anyway |
+| Any step that might trip a bot wall first time | **headed** | watch it once, record, then automate |
+
+## Profile matrix (as shipped)
+
+| Channel | Profile dir | Notes |
+| --- | --- | --- |
+| xhs | `browser-profiles/xhs` | headed always; shadow-root controls via CDP box models |
+| infoq | `browser-profiles/infoq` | draft save = `/draft/<id>` URL |
+| juejin | `browser-profiles/juejin` | draft id from post-save URL |
+| substack | `browser-profiles/substack` | robinmin.substack.com; post id in `/publish/post/<id>` |
+| x | `browser-profiles/x` | article edit URL carries draft id |
+| wechatmp | `browser-profiles/wechatmp` | QR login; draft id from draft/add response + editor URL |
+
+New channel ⇒ one-time headed `fresh` login on that dir, then it becomes the cache.
+
+## Session probe (cached-auth validity)
+
+Don't age-guess — probe a signed-in-only selector on the channel's console URL:
+
+```ts
+const ok = await page.locator('<signed-in-only selector>').first().isVisible({ timeout: 10_000 });
+if (!ok) throw new Error('auth=expired: fresh login required');
+```
+
+Per-channel selectors live in the channel's `docs/design/<channel>-ui-discovery.md`.
+
+## storageState vs profile dir
+
+Prefer the **profile dir** (this is what every shipped plugin uses): it caches
+service workers, IndexedDB, and cookie chaos that JSON `storageState` loses and
+that OAuth flows notice. Reach for `storageState` only when a tool requires a
+portable JSON snapshot — export once from the live context, mark it
+time-sensitive, keep it out of git, and treat expiry as probe-verified, never
+assumed.
+
+## Failure semantics
+
+- No observed outcome signal (toast / counter delta / URL change) ⇒ report
+  **failure with the reason**; never infer success from "no exception".
+- Save actions assert the channel's measured signal within its measured
+  timeout (e.g. wechatmp `.weui-desktop-toast` ≤ 15 s) — loud on miss.
+- Always `ctx.close()` on SIGTERM/exit paths; orphaned Chromiums hold the
+  profile lock and the next run fails confusingly.

package/plugins/kk/workflows/kk-collect.yaml

@@ -0,0 +1,258 @@
+---
+"$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
+name: kk-collect
+kind: state-machine
+description: >-
+  Standalone 6-hourly (04:00/10:00/16:00/22:00 local) collection into the kk store (task 0208, feature G31): take the single-flight lock
+  → fan-in ingest every source (aihot + last30days + horizon) + render the core-facts markdown → upsert the
+  Doc[] into the store → label the new and label-invalidated items (0209; a no-op until then) → release the
+  lock and record the run. It never generates, renders audio or publishes; the store is the only state it
+  shares with the daily voice workflow, which reads it back through the extract verb.
+initialState: lock
+terminalStates:
+  - done
+  - skipped
+  - failed
+failureStates:
+  - failed
+
+vars:
+  # Effective workspace, projected by `lock` from `.spur/runs/kk-collect/work-dir.txt` (shell actions
+  # cannot set vars). Empty at launch: `.works/kk-collect/<stamp>` is composed in the lock state (R4).
+  work_dir: ""
+  # Run stamp, `$(date -u +%Y%m%dT%H%MZ)` by default. A caller may pin it (an in-minute re-run, a
+  # test); the empty default keeps the scheduled derivation authoritative.
+  stamp: ""
+  # Run id, injected by spur at launch (0674 R5 / R8; the engine's equivalent of a `run.id`
+  # builtin — a shell command may only reference declared vars). It is the lock owner and the
+  # `collect_runs` / ledger identity.
+  __runId: ""
+  # Per-source collection parameters, seeded into the plugin source configs by `lock`.
+  limit: "10"
+  last30days_topic: "AI news"
+  # Matches the 6h tick cadence: a trailing lookback shorter than the interval leaves a blind
+  # gap between ticks (dogfood 2026-10-08 P3); equal windows just dedup on re-ingest.
+  horizon_hours: "6"
+  plugins_path: ""
+
+states:
+  - id: lock
+    description: >-
+      Sync the ledger, compose the run workspace and acquire the store lock — the single-flight guard that
+      makes two overlapping ticks one collection (R1, AC3). Writes <work_dir>/lock.json; the transition guard
+      routes a held lock to `skipped`.
+    onEnter:
+      - kind: shell
+        options:
+          # Reporting only: a ledger failure must never abort a tick before the lock is even taken.
+          onError: continue
+          command: >-
+            kk ledger sync --workflow kk-collect
+      - kind: shell
+        options:
+          # stamp: the pinned var, else the UTC minute (R4). work_dir: `.works/kk-collect/<stamp>` (R4),
+          # written to the anchor file the engine reads back into vars.work_dir below — shell actions
+          # cannot set vars. The stage also writes the three source configs (daily-prepare's shape),
+          # because `kk executor fan-in --source <plugin>:<file>` refuses a missing input file.
+          command: >-
+            kk stage collect-prepare "${vars.stamp}" "${vars.limit}" "${vars.last30days_topic}" "${vars.horizon_hours}"
+      - kind: file.read.into-var
+        options:
+          path: .spur/runs/kk-collect/work-dir.txt
+          var: work_dir
+      - kind: file.read.into-var
+        options:
+          path: .spur/runs/kk-collect/stamp.txt
+          var: stamp
+      - kind: shell
+        options:
+          # The claim is re-entrant for the same run and is stolen once its TTL has
+          # passed, so a crashed holder costs at most one tick (the TTL below covers the
+          # 6 h cadence and every plausible collect duration, so a slow run is never overtaken). stdout
+          # IS the lock contract, and the guard below reads it back:
+          # `{"acquired":true}` or `{"skipped":"locked","holder":<run>}` (R1).
+          command: >-
+            kk store lock acquire --name collect --run "${vars.__runId}" --ttl 21600000 > "${vars.work_dir}/lock.json"
+
+  - id: collect
+    description: >-
+      Fan-in every ingestion source into the run's blended Doc[] (same sources and timeout overrides as
+      kk-daily-ai-voice's collect state) and render the core-facts markdown with the existing stage (R3/R4).
+    onEnter:
+      - kind: shell
+        # onError: continue on both actions, with the artifact guard below as the positive success
+        # contract: a state-machine aborts the run on a failed action without taking a transition, so a
+        # hard failure here would leave the lock behind. The run still ends `failed` — through
+        # `release-failed`, which releases the lock first.
+        onError: continue
+        options:
+          # horizon-ingest's latency straddles the fan-in 30m per-source default (0098/0099), so it gets
+          # the same 45m leash the daily workflow pins. Writes <work_dir>/10-ingest/<stamp>_02_collect_blended.json.
+          # A single failed source degrades to an error entry in the merge (exit 0, surviving docs kept);
+          # only an all-sources failure exits 1 and leaves the file unwritten.
+          command: >-
+            kk executor fan-in
+            --source "aihot-ingest:${vars.work_dir}/10-ingest/source.json"
+            --source "last30days-ingest:${vars.work_dir}/10-ingest/last30days.json"
+            --source "horizon-ingest:${vars.work_dir}/10-ingest/horizon.json"
+            --source-timeout-override "horizon-ingest:2700000"
+            --out "${vars.work_dir}/10-ingest/${vars.stamp}_02_collect_blended.json"
+      - kind: shell
+        onError: continue
+        options:
+          # R4: the shipped stage, unmodified — no new code in kk-workflow-stages.ts. Writes
+          # <work_dir>/20-facts/<stamp>_02_collect_core-facts.md.
+          command: >-
+            kk stage daily-collect-facts "${vars.work_dir}" "${vars.stamp}" "${vars.plugins_path}"
+
+  - id: store
+    description: >-
+      Upsert the collected Doc[] into the store (items + collect_runs) and write the labelling input (R2).
+      A failure routes to `release-failed`: the lock must never be left behind.
+    onEnter:
+      - kind: shell
+        # onError: continue — a store failure is release-and-fail, not a hard abort that would keep the
+        # lock. The transition guard reads the result file this step writes.
+        onError: continue
+        options:
+          command: >-
+            kk store ingest --run "${vars.__runId}"
+            --in "${vars.work_dir}/10-ingest/${vars.stamp}_02_collect_blended.json"
+            --new-ids "${vars.work_dir}/new-ids.json"
+            > "${vars.work_dir}/store-result.json"
+
+  - id: label
+    description: >-
+      Label the stored items through the kk decision catalog (`kk store label --run … --new-ids …`,
+      task 0209): heuristic-first, so the model is consulted only for items the keyword pass files
+      `non-ai` while seeing an AI signal, and a degraded backend records the heuristic value with
+      `source: default` instead of failing. stdout is the `{verdict, confidence, labeled, model,
+      fallback}` contract and doubles as the routing guard's positive artifact: `verdict: PASS`
+      carries exactly one `HIGH | MEDIUM | LOW` level (the weakest level among the pass's rows,
+      G31 R14), and the guard below reads that line so a missing or out-of-enum level is refused
+      rather than read as a pass — a command that failed before printing emits no verdict at all
+      and is refused the same way.
+    onEnter:
+      - kind: shell
+        onError: continue
+        options:
+          command: >-
+            kk store label --run "${vars.__runId}" --new-ids "${vars.work_dir}/new-ids.json"
+            > "${vars.work_dir}/label-result.txt"
+
+  - id: release
+    description: >-
+      Release the lock and record the run in the ledger (R7). The append runs with onError: continue
+      because a run's own trace is still `running` while a state executes, so `kk ledger append` refuses
+      it (`kk.ledger.run.running`, exit 1); the section is written by the next tick's `lock` →
+      `kk ledger sync`, which is the backfill contract of docs/design/kk-collect-and-daily-voice2.md §7.
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            kk store lock release --name collect --run "${vars.__runId}"
+      - kind: shell
+        onError: continue
+        options:
+          command: >-
+            kk ledger append --workflow kk-collect --run "${vars.__runId}"
+
+  - id: release-failed
+    description: >-
+      Release the lock on a failed run before failing: a claim left by a failed tick would stall the next
+      four hours of collection even though the TTL would eventually cover it.
+    onEnter:
+      - kind: shell
+        onError: continue
+        options:
+          command: >-
+            kk store lock release --name collect --run "${vars.__runId}"
+
+  - id: done
+    description: "Terminal — collection stored; the daily workflow reads it back through `kk store extract`"
+
+  - id: skipped
+    description: "Terminal — another run held the lock inside its TTL; nothing was collected or stored"
+
+  - id: failed
+    description: "Terminal — collection or storage failed; the lock was released on the way out"
+
+transitions:
+  - from: lock
+    to: skipped
+    description: "The lock is held by another run inside its TTL -> nothing to do (exit 0, single-flight)"
+    guard:
+      kind: shell
+      options:
+        command: 'jq -e .skipped "${vars.work_dir}/lock.json" > /dev/null'
+
+  - from: lock
+    to: collect
+    description: "Lock acquired -> collect every source"
+    guard:
+      kind: always
+
+  - from: collect
+    to: store
+    description: "Blended Doc[] written and core facts rendered -> store it"
+    guard:
+      kind: shell
+      options:
+        command: >-
+          test -s "${vars.work_dir}/10-ingest/${vars.stamp}_02_collect_blended.json" &&
+          test -s "${vars.work_dir}/20-facts/${vars.stamp}_02_collect_core-facts.md"
+
+  - from: collect
+    to: release-failed
+    description: "A source set that failed outright, or a failed core-facts render -> release the lock and fail"
+    guard:
+      kind: always
+
+  - from: store
+    to: label
+    description: "Ingest reported its counts (store-result.json) -> label the new and invalidated items"
+    guard:
+      kind: shell
+      options:
+        command: 'test -s "${vars.work_dir}/store-result.json"'
+
+  - from: store
+    to: release-failed
+    description: "The store write failed -> release the lock and fail the run"
+    guard:
+      kind: always
+
+  - from: label
+    to: release
+    description: "Labels written and the pass verdict is PASS with a HIGH|MEDIUM|LOW confidence -> release and record"
+    guard:
+      kind: shell
+      options:
+        # The pass verdict is read through the same confidence-aware jq filter the judge gates use
+        # (byte-identical, so the one contract cannot drift): a `verdict: PASS` whose `confidence` is
+        # missing or outside HIGH|MEDIUM|LOW reads as `PASS!`, which no accept guard matches. The
+        # refusal names the offending value on stderr before the transition falls through to
+        # `release-failed` — fail-closed, and never a deadlock (that state is `always`).
+        # Kept at 3 logical commands: spur's ADR-115 composition lint errors on a guard above 5.
+        command: >-
+          test "$(jq -r 'if (.verdict // "") == "PASS" then (.verdict + (if ((.confidence // "") | test("^(HIGH|MEDIUM|LOW)$")) then "" else "!" end)) else (.verdict // "") end' "${vars.work_dir}/label-result.txt" 2>/dev/null)" = PASS ||
+          { echo "kk-collect.label.confidence-refused: verdict '$(jq -r '.verdict // "<none>"' "${vars.work_dir}/label-result.txt" 2>/dev/null)' carries confidence '$(jq -r '.confidence // "<absent>"' "${vars.work_dir}/label-result.txt" 2>/dev/null)', not HIGH|MEDIUM|LOW" >&2; false; }
+
+  - from: label
+    to: release-failed
+    description: "The label pass failed, or its verdict carried no HIGH|MEDIUM|LOW confidence -> release the lock and fail the run"
+    guard:
+      kind: always
+
+  - from: release
+    to: done
+    description: "Lock released and the ledger appended -> done"
+    guard:
+      kind: always
+
+  - from: release-failed
+    to: failed
+    description: "Lock released after a failed step -> failed"
+    terminalReason: failed-check
+    guard:
+      kind: always

package/plugins/kk/workflows/kk-daily-ai-voice.yaml

@@ -52,6 +52,8 @@ vars:
   # "true" retries down AUTO_ORDER, anything else is a comma-separated provider list. The empty
   # default keeps F614's pinned look the default; availability trades against it only on opt-in.
   cover_fallback: ""
+  # 0219 R3: image-gen vendor fallback for the XHS render; "" restores strict fail-fast.
+  xhs_fallback: "true"
   # E8: XHS image-card target. Cards are planned from the lead plan item (the same source the
   # cover uses) and rendered through the pinned xhs-card/xhs-knowledge presets, then the xhs-pub
   # headed browser saves them into the creator draft box.
@@ -471,7 +473,7 @@ states:
         onError: continue
         options:
           command: >-
-            kk stage daily-xhs-render "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.xhs_cards}" "${vars.xhs_style}" "${vars.xhs_provider}" "${vars.xhs_model}"
+            kk stage daily-xhs-render "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.xhs_cards}" "${vars.xhs_style}" "${vars.xhs_provider}" "${vars.xhs_model}" "${vars.xhs_fallback}"
 
   - id: xhs-publish
     description: "Publish the packaged card series to XHS — draft, or live only when xhs_live=true (ADR-022); independent and non-blocking: its outcome never enters publish_status. xhs-pub itself enforces a headless session preflight and a 2h publish/check cap (ADR-025), so a sessionless or capped run fails soft with a named reason and the run continues"
@@ -520,8 +522,12 @@ states:
             kk stage daily-publish-partial "${vars.work_dir}" "${vars.run_date}"
 
   - id: run-report
-    description: "Assemble the per-run report (scores+aggregates+rejected counts+step timing) from existing artifacts — news-report-gen; output-only, never throws; 0117"
+    description: "Assemble the per-run report (scores+aggregates+rejected counts+step timing) from existing artifacts — news-report-gen; output-only, never throws; 0117; preceded by terminal publish-completeness snapshot (0220)"
     onEnter:
+      - kind: shell
+        options:
+          command: >-
+            kk stage daily-publish-completeness "${vars.work_dir}" "${vars.run_date}"
       - kind: shell
         options:
           command: >-
@@ -723,7 +729,7 @@ transitions:
 
   - from: safety-judge
     to: review
-    description: "pass without skip_review, or escalate (RISK / evidence gap) -> operator review; skip_review never bypasses an escalation"
+    description: "pass without skip_review, or escalate (a finding marked disposition:\"escalate\"; legacy reports: any RISK/escalate) -> operator review; skip_review never bypasses an escalation"
     guard:
       kind: shell
       options: