@gobing-ai/knowledge-kit 0.0.34 → 0.0.36

package/plugins/kk/scripts/kk-workflow-stages.ts

@@ -55,7 +55,7 @@ import {
     writeFileSync,
 } from 'node:fs';
 import { homedir } from 'node:os';
-import { basename, dirname, join, relative, resolve } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 
 export const SCRIPTS_DIR = import.meta.dir;
 export const VALIDATE_SIDECAR = 'validate-voicescript.ts';
@@ -569,6 +569,30 @@ export function kk(
     return status;
 }
 
+/**
+ * `kk()` sibling with `stdio: 'pipe'`: captures the child's stdout/stderr, reprints both to the
+ * parent so the operator log is unchanged, and returns the exit status plus the captured stderr.
+ * Only stages that branch on the child's stderr use it (0251: the xhs-render overflow retry);
+ * every other call keeps `kk()`'s inherit default.
+ */
+export function kkCaptured(
+    args: string[],
+    options: { env?: Record<string, string>; unset?: readonly string[]; soft?: boolean } = {},
+): { status: number; stderr: string } {
+    const env = { ...process.env, ...(options.env ?? {}) };
+    for (const name of options.unset ?? []) delete env[name];
+    const runner = spawnSync('kk', args, { stdio: 'pipe', encoding: 'utf-8', env });
+    if (runner.error !== undefined) {
+        console.error(`kk: ${runner.error.message}`);
+        failWith(127);
+    }
+    process.stdout.write(runner.stdout ?? '');
+    process.stderr.write(runner.stderr ?? '');
+    const status = runner.status ?? 1;
+    if (status !== 0 && options.soft !== true) failWith(status);
+    return { status, stderr: runner.stderr ?? '' };
+}
+
 export function writeJsonText(path: string, value: unknown): void {
     // `Bun.write(path, JSON.stringify(value, null, 2))` — no trailing newline.
     writeFileSync(path, JSON.stringify(value, null, 2));
@@ -1147,6 +1171,22 @@ export function firstPostPath(parsed: Record<string, unknown> | null, target: st
     return '';
 }
 
+/**
+ * The public URL a target published to, or '' — the sibling of {@link firstPostPath} for consumers
+ * that need the reader-facing address (WeChat's 原文链接 points at the surfdash post).
+ */
+export function firstTargetUrl(parsed: Record<string, unknown> | null, target: string): string {
+    const targets = parsed?.targets;
+    if (!Array.isArray(targets)) return '';
+    for (const entry of targets) {
+        if (entry === null || typeof entry !== 'object') continue;
+        const record = entry as Record<string, unknown>;
+        if (record.target !== target || record.ok !== true) continue;
+        if (typeof record.url === 'string' && record.url !== '') return record.url;
+    }
+    return '';
+}
+
 function dailyPublishClassify(args: string[]): void {
     const [workDir = '', runDate = ''] = args;
     const result = join(workDir, '31-publish', `${runDate}_17_publish_result.json`);
@@ -1240,10 +1280,24 @@ function publishCompleteness(
                 detail: 'en/ja scaffolded, never synced',
             });
         } else if (syncResult.ok === true) {
+            // A filled marker only proves the locale was SCAFFOLDED. The workflow's `translate` agent is
+            // what publishes it (its prompt flips `draft: true` → `draft: false`), so a run whose
+            // translation failed used to report `locales: done` while the site kept an unpublished
+            // scaffold — the one channel whose loss nothing in the run's artifacts named. Read the draft
+            // the marker points at: still `draft: true` means it was never translated.
+            const untranslated = ['en', 'ja'].filter((locale) => {
+                const marker = readFileSync(at(`20_translate-localize_${locale}-post-path.txt`), 'utf-8').trim();
+                if (!isFile(marker)) return true;
+                const head = readFileSync(marker, 'utf-8').split('---')[1] ?? '';
+                return /^draft:\s*true\s*$/m.test(head);
+            });
             rows.push({
                 channel: 'locales',
-                state: 'done',
-                detail: 'en/ja drafts scaffolded',
+                state: untranslated.length === 0 ? 'done' : 'failed',
+                detail:
+                    untranslated.length === 0
+                        ? 'en/ja drafts scaffolded and translated'
+                        : `${untranslated.join(', ')} draft is still a scaffold (draft: true) — not translated, so it stays unpublished`,
             });
         } else {
             rows.push({
@@ -1287,6 +1341,12 @@ function publishCompleteness(
 function dailyPublishPartial(args: string[]): void {
     const [workDir = '', runDate = ''] = args;
     const result = join(workDir, '31-publish', `${runDate}_17_publish_result.json`);
+    // The marker describes this run, so it belongs under that run's workDir — a cwd-relative path
+    // litters whatever tree the caller stood in and hides the note from the episode it describes.
+    const marker =
+        workDir === ''
+            ? join('.spur', 'run', `publish-partial-${runDate}.txt`)
+            : join(workDir, '.spur', 'run', `publish-partial-${runDate}.txt`);
     timed(workDir, 'publish-partial', () => {
         const failed = targetsOf(result)
             .filter((entry) => entry.ok !== true || entry.status !== 'published')
@@ -1294,10 +1354,10 @@ function dailyPublishPartial(args: string[]): void {
             .join(',');
         const list = failed === '' ? '(unparsed)' : failed;
         console.error(`WARNING: partial publish — failed targets: ${list}`);
-        sted('mkdir', '.spur/run', () => mkdirSync('.spur/run', { recursive: true }));
-        sted('write', `.spur/run/publish-partial-${runDate}.txt`, () =>
+        sted('mkdir', dirname(marker), () => mkdirSync(dirname(marker), { recursive: true }));
+        sted('write', marker, () =>
             writeFileSync(
-                `.spur/run/publish-partial-${runDate}.txt`,
+                marker,
                 `${runDate} partial publish: failed targets: ${list} (result.json preserved for kk executor fan-out --retry-from)\n`,
             ),
         );
@@ -1305,10 +1365,16 @@ function dailyPublishPartial(args: string[]): void {
 }
 
 /**
- * 20260917 review #4/#6: after both publishes land, patch the surfdash disk posts —
- * reuse the podcast-hosted cover URL in frontmatter (image/og_image; no re-upload; fallback:
- * copy the local cover into assets/) and append a podcast cross-link at the end of zh/en/ja.
- * Idempotent per post; commits + pushes the surfdash checkout (SURFDASH_AUTO_PUSH=0 keeps commit-only).
+ * Post-publish surfdash healing — a thin delegation to the publisher that owns it (2026-10-12).
+ *
+ * The work itself (podcast cover URL into `image`/`og_image`, the per-locale podcast cross-link, the
+ * local cover's `assets/` fallback, the EmDash re-sync that makes CMS cards carry a servable image,
+ * and the pathspec commit + push) lives in the `surfdash-pub` `patch` operation now: it is the
+ * publisher's job, and every path that publishes a post needs it. This stage only reads the run's
+ * publish results into the operation's payload and reports its outcome.
+ *
+ * `KK_SURFDASH_PATCH_OFFLINE=1` keeps fixture tests hermetic — the plugin would otherwise write to,
+ * commit and push a real checkout.
  */
 function dailyPatchSurfdash(args: string[]): void {
     const [workDir = '', runDate = '', surfdashRoot = '', pluginsPath = ''] = args;
@@ -1329,149 +1395,53 @@ function dailyPatchSurfdash(args: string[]): void {
         const sd = targetOf(sdResult);
         const pod = targetOf(podcastResult);
         const postPath = (sd.metadata as Record<string, unknown> | undefined)?.postPath;
-        if (typeof postPath !== 'string' || postPath === '')
+        if (typeof postPath !== 'string' || postPath === '') {
             failWith(1, 'patch-surfdash: surfdash result carries no postPath');
-        // Refuse before anything is written: surfdash's deploy.yml publishes from main, so a commit
-        // on any other branch is invisible to production. Placed here (after the input checks) so a
-        // refusal leaves the working tree untouched.
-        const head = spawnSync('git', ['-C', surfdashRoot, 'rev-parse', '--abbrev-ref', 'HEAD'])
-            .stdout?.toString()
-            .trim();
-        if (head !== 'main')
-            failWith(1, `patch-surfdash: refusing to commit on '${head}' — surfdash deploys from main`);
-        // Paths this run actually wrote, relative to surfdashRoot. `git add`/`commit` take these as a
-        // pathspec so the operator's unrelated staged work is never swept into the commit.
-        const written: string[] = [];
-        const slugDir = dirname(postPath);
-        const showNotesUrl = typeof pod.url === 'string' ? pod.url : '';
-        const coverUrl = ((pod.metadata as Record<string, unknown> | undefined)?.imageUrl as string | undefined) ?? '';
-        const localCover = join(workDir, '23-cover', `${runDate}_07_cover_cover.png`);
-        const dateIso = `${runDate.slice(0, 4)}-${runDate.slice(4, 6)}-${runDate.slice(6, 8)}`;
-        const crossLink: Record<string, string> = {
-            // Task 0189 R4: cross-links carry the column's episode-title pattern, not the retired
-            // news-bulletin name (the VoiceScript episode title is episodeTitle(lead, date)).
-            zh: `🎧 本期已同步制作为播客节目，[点击收听《每日AI乱炖 · ${dateIso}》](${showNotesUrl})。`,
-            en: `🎧 This episode is also available as a podcast: [listen to 每日AI乱炖 · ${dateIso}](${showNotesUrl}).`,
-            ja: `🎧 本エピソードはポッドキャストでも配信中：[每日AI乱炖 · ${dateIso} を聴く](${showNotesUrl})。`,
-        };
-        let changed = 0;
-        for (const [locale, dir] of [
-            // zh posts live under articles/zh/<slug>; en/ja under articles/<locale>/<slug> —
-            // two dirnames up, not one (20260919: `articles/zh/en/...` never existed, so en/ja
-            // were silently skipped by the not-published branch).
-            ['zh', slugDir],
-            ['en', join(dirname(dirname(slugDir)), 'en', basename(slugDir))],
-            ['ja', join(dirname(dirname(slugDir)), 'ja', basename(slugDir))],
-        ] as const) {
-            const indexMd = join(dir, 'index.md');
-            if (!existsSync(indexMd)) {
-                console.error(`patch-surfdash: ${locale} post not published (${indexMd}) — skip`);
-                continue;
-            }
-            let md = readFileSync(indexMd, 'utf-8');
-            const fmEnd = md.indexOf('---', 3); // frontmatter is `---\n ... \n---\n`
-            if (fmEnd < 0) failWith(1, `patch-surfdash: no frontmatter in ${indexMd}`);
-            // Upsert a single-line `key: 'value'`; the regex consumes folded-scalar continuation
-            // lines (`og_image: >-\n  https://...`) so multi-line publish output is replaced whole.
-            const upsertKey = (src: string, key: string, value: string): string => {
-                // YAML single-quoted scalars escape `'` as `''`; the replacement is a function so
-                // `$&`/`$1`/`$$` in the value are never expanded. Scope the match to the frontmatter
-                // (recomputed per call, since each upsert shifts offsets) so a body line starting with
-                // `image:` is not rewritten.
-                const end = src.indexOf('\n---', 3);
-                const fm = src.slice(0, end);
-                const body = src.slice(end);
-                const line = `${key}: '${value.replaceAll("'", "''")}'`;
-                const re = new RegExp(`^${key}:.*(?:\\n[ \\t]+.*)*`, 'm');
-                const next = re.test(fm)
-                    ? fm.replace(re, () => line)
-                    : fm.replace(/^publishDate: .*$/m, (m0) => `${m0}\n${line}`);
-                return next + body;
-            };
-            if (coverUrl !== '') {
-                // 20260919 prod feedback: the podcast-hosted cover URL wins even when surfdash-pub
-                // already wrote `image:` — its resolved og_image points at /content-posts/<slug>/
-                // assets/cover.png, which the deployed worker does not serve (404).
-                md = upsertKey(md, 'image', coverUrl);
-                md = upsertKey(md, 'og_image', coverUrl);
-            } else if (!/^image:/m.test(md.slice(0, fmEnd))) {
-                // Fallback for runs without a podcast cover: copy the local cover instead.
-                if (existsSync(localCover)) {
-                    const assets = join(dir, 'assets');
-                    mkdirSync(assets, { recursive: true });
-                    copyFileSync(localCover, join(assets, 'cover.png'));
-                    written.push(relative(surfdashRoot, join(assets, 'cover.png')));
-                    md = upsertKey(md, 'image', './assets/cover.png');
-                    md = upsertKey(md, 'og_image', './assets/cover.png');
-                }
-            }
-            if (showNotesUrl !== '' && !md.includes(showNotesUrl)) {
-                md = `${md.replace(/\s*$/, '')}\n\n${crossLink[locale]}\n`;
-            }
-            if (md !== readFileSync(indexMd, 'utf-8')) {
-                sted('write', indexMd, () => writeFileSync(indexMd, md));
-                written.push(relative(surfdashRoot, indexMd));
-                changed++;
-            }
         }
-        // 20260929 prod feedback: CMS cards (homepage hero/tag/search) read EmDash rows whose
-        // featured_image is snapshotted at translate-sync time — i.e. the pre-patch
-        // `./assets/cover.png`, which the deployed worker does not serve (404). The patch only
-        // rewrites files, so re-sync the EmDash rows from the patched files through the same
-        // `kk executor` path as translate-sync (its plugin child gets EMDASH_API_TOKEN from kk
-        // config; a direct orchestrator spawn gets 403 from prod dev-bypass). Runs before the
-        // changed===0 early-return so re-runs heal rows an earlier commit left stale
-        // (20260925/20260929). Fixture tests pass no plugins-path and must not shell out.
-        if (pluginsPath === '') {
-            // A missing plugins-path silently drops the CMS re-sync, and the CMS cards then keep the
-            // pre-patch `./assets/cover.png` the deployed worker cannot serve (20261002 lost its
-            // cover this way). Leave a marker for the classify step's completeness report.
+        const resultPath = join(workDir, '31-publish', `${runDate}_23_patch-surfdash_sync-result.json`);
+        if (process.env.KK_SURFDASH_PATCH_OFFLINE === '1') {
+            // The marker keeps the completeness report's cms-resync row honest in offline runs.
             const skipMarker = join(workDir, '31-publish', `${runDate}_23_patch-surfdash_emdash-resync.txt`);
-            sted('write', skipMarker, () => writeRaw(skipMarker, 'skipped: no plugins-path\n'));
-            console.error('patch-surfdash: no plugins-path — skip emdash re-sync');
-        } else {
-            const syncIn = join(workDir, '31-publish', `${runDate}_23_patch-surfdash_sync.json`);
-            const syncResult = join(workDir, '31-publish', `${runDate}_23_patch-surfdash_sync-result.json`);
-            sted('write', syncIn, () =>
-                writeJqText(syncIn, { body: '', options: { operation: 'sync', postPath: join(slugDir, 'index.md') } }),
-            );
-            const status = kk(
-                ['executor', 'run', 'surfdash-pub', '--in', syncIn, '--out', syncResult, ...pluginsArgs(pluginsPath)],
-                { unset: NESTED_SPUR_UNSET, soft: true },
-            );
-            const result = isFile(syncResult) ? readJson(syncResult) : null;
-            const ok =
-                status === 0 &&
-                result !== null &&
-                (result.ok === true || (result.targets as Array<{ ok?: boolean }> | undefined)?.[0]?.ok === true);
-            if (!ok) {
-                console.error(
-                    `patch-surfdash: WARNING: emdash re-sync failed (exit ${status}) — CMS cards keep the stale cover; fix: kk executor run surfdash-pub --in ${syncIn} --out ${syncResult} --plugins-path ${pluginsPath}`,
-                );
-            } else {
-                console.error('patch-surfdash: emdash rows re-synced from patched files');
-            }
-        }
-        if (changed === 0) {
-            console.error('patch-surfdash: nothing to change');
+            sted('write', skipMarker, () => writeRaw(skipMarker, 'skipped: offline (KK_SURFDASH_PATCH_OFFLINE=1)\n'));
+            console.error('patch-surfdash: offline — skip the plugin patch (KK_SURFDASH_PATCH_OFFLINE=1)');
             return;
         }
-        const git = (...a: string[]): void => {
-            const r = spawnSync('git', ['-C', surfdashRoot, ...a]);
-            if (r.status !== 0) failWith(1, `patch-surfdash: git ${a[0]} failed: ${r.stderr?.toString().trim()}`);
-        };
-        git('add', '--', ...written);
-        git(
-            'commit',
-            '-m',
-            `feat: cover + podcast cross-link for ${basename(slugDir)} (kk daily patch)`,
-            '--',
-            ...written,
+        const payload = join(workDir, '31-publish', `${runDate}_23_patch-surfdash_patch.json`);
+        const podcastMeta = (pod.metadata ?? {}) as Record<string, unknown>;
+        sted('write', payload, () =>
+            writeJqText(payload, {
+                body: '',
+                options: {
+                    operation: 'patch',
+                    postPath,
+                    coverUrl: typeof podcastMeta.imageUrl === 'string' ? podcastMeta.imageUrl : '',
+                    showNotesUrl: typeof pod.url === 'string' ? pod.url : '',
+                    dateIso: `${runDate.slice(0, 4)}-${runDate.slice(4, 6)}-${runDate.slice(6, 8)}`,
+                    localCover: join(workDir, '23-cover', `${runDate}_07_cover_cover.png`),
+                },
+            }),
         );
-        if (process.env.SURFDASH_AUTO_PUSH !== '0') git('push', 'origin', 'main');
-        console.error(
-            `patch-surfdash: patched ${changed} post(s), committed${process.env.SURFDASH_AUTO_PUSH !== '0' ? ' + pushed' : ' (push skipped: SURFDASH_AUTO_PUSH=0)'}`,
+        const status = kk(
+            ['executor', 'run', 'surfdash-pub', '--in', payload, '--out', resultPath, ...pluginsArgs(pluginsPath)],
+            { unset: NESTED_SPUR_UNSET, env: { SURFDASH_ROOT: surfdashRoot }, soft: true },
         );
+        const result = isFile(resultPath) ? readJson(resultPath) : null;
+        const meta = (result?.metadata ?? {}) as Record<string, unknown>;
+        if (result?.ok === true) {
+            console.error(
+                `patch-surfdash: ${String(result.message ?? 'patched')} — cms-resync ${String(meta.cmsResync ?? 'ok')}, commit ${String(meta.gitCommit ?? 'unchanged')}${Array.isArray(meta.absentLocales) && meta.absentLocales.length > 0 ? `, no post for ${(meta.absentLocales as string[]).join('/')}` : ''}`,
+            );
+            return;
+        }
+        // The posts are patched and committed; only the EmDash rows keep the unservable cover. That is
+        // the soft channel the completeness report carries, so warn instead of failing the run.
+        if (meta.cmsResync === 'failed') {
+            console.error(
+                `patch-surfdash: WARNING: cms re-sync failed — ${String(result?.error ?? `exit ${status}`)}; fix: kk executor run surfdash-pub --in ${payload} --out ${resultPath}${pluginsArgs(pluginsPath).join(' ')}`,
+            );
+            return;
+        }
+        failWith(1, `patch-surfdash: ${String(result?.error ?? `surfdash-pub patch exited ${status}`)}`);
     });
 }
 

package/plugins/kk/skills/content-safety/references/platforms/wechatmp.md

@@ -9,7 +9,7 @@ Review-item IDs here are **this skill's bookkeeping numbers**, not official plat
 | Effective date | unknown（运营规范版本/生效日期未核验） |
 | Last verified | 2026-09-29（仅事件层面；规则原文未逐条核验） |
 | Evidence status | 规则条文**未核验**；2026-09-29 图文下架事件为**用户报告**，平台未给出书面理由 |
-| Changelog | 2026-09-29 — file created after the takedown report (task 0189) |
+| Changelog | 2026-09-29 — file created after the takedown report (task 0189) · 2026-10-10 — 操作者裁定：WX-02 降级为 note，不再 escalate |
 
 ## Evidence distinctions
 
@@ -23,7 +23,7 @@ Review-item IDs here are **this skill's bookkeeping numbers**, not official plat
 | ID | Item | Grade |
 |----|------|-------|
 | WX-01 | 时政/公共事务主线：政治、外交/贸易管制、军事、公共政策争议、社会公共事件为主的图文或音频 | block |
-| WX-02 | 资质口径：不做新闻资讯播报形态的标题/摘要（未持有相关资质；同小宇宙 XY-01 的教训） | block |
+| WX-02 | 资质口径：不做新闻资讯播报形态的标题/摘要（未持有相关资质；同小宇宙 XY-01 的教训）。**操作者裁定 2026-10-10**：同小宇宙 XY-01 裁定——本号不持有也不声称持有新闻资质，剩余风险只在单集标题/摘要是否真的退回播报形态，按 note 记录，不要因「账号无新闻资质」而 block 或 `escalate: true`；仅当某集实际呈现新闻播报形态时才升级为 block。 | note |
 | WX-03 | AI 生成声明：图文含 AI 生成内容时按平台入口如实声明（声明入口以平台当前设置为准，未核验 → evidenceGap） | disclose |
 | WX-04 | 可识别个人信息；标题党/夸大断言（未经核实断言按类别 4 处理） | desensitize / fix |
 

package/plugins/kk/skills/content-safety/references/platforms/xiaoyuzhou.md

@@ -9,7 +9,7 @@ Review-item IDs here are **this skill's bookkeeping numbers**, not official plat
 | Effective date | unknown（协议页面未标注可引用的版本生效日期） |
 | Last verified | 2026-09-29（任务 0189 期间人工阅读协议页） |
 | Evidence status | 协议原文已读；**未发现公开的字级禁用词表**；2026-09-29 下架事件为**用户报告的反馈**，非官方说明 |
-| Changelog | 2026-09-29 — file created after the daily-episode takedown report (task 0189) |
+| Changelog | 2026-09-29 — file created after the daily-episode takedown report (task 0189) · 2026-10-10 — 操作者裁定：XY-01 降级为 note，不再 escalate |
 
 ## Evidence distinctions
 
@@ -23,7 +23,7 @@ Review-item IDs here are **this skill's bookkeeping numbers**, not official plat
 
 | ID | Item | Grade |
 |----|------|-------|
-| XY-01 | 资质口径：简介/标题不得呈现「新闻资讯播报」形态或暗示持有新闻资质（对齐用户报告的下架理由；新闻资质口径为国内平台语境） | block |
+| XY-01 | 资质口径：简介/标题不得呈现「新闻资讯播报」形态或暗示持有新闻资质（对齐用户报告的下架理由；新闻资质口径为国内平台语境）。**操作者裁定 2026-10-10**：本档为个人技术分享播客（栏目「AI 乱炖」），不持有也不声称持有新闻资质，因此不得宣称或暗示该资质这一项本身已满足；剩余风险只在单集文案是否真的退回播报形态，按 note 记录，不要因为「账号无新闻资质」而 block 或 `escalate: true`——它对每一集都一样，逐集 escalate 只会让无人值守的每日任务永远无法收尾。仅当某集实际呈现新闻播报形态时才升级为 block。 | note |
 | XY-02 | 时政/公共事务主线：政治、外交/贸易管制、军事、公共政策争议、社会公共事件为主线的单集内容 | block |
 | XY-03 | 字词命中：敏感领域词汇出现时先做上下文判断（hit ≠ verdict）；命中且主线无风险 → 记录为 note | note→judge |
 | XY-04 | 可识别个人信息（简介/shownotes 中听众或第三方的私人信息） | desensitize→block if unfixable |
@@ -33,3 +33,5 @@ Review-item IDs here are **this skill's bookkeeping numbers**, not official plat
 - 无官方字级词表 → 任何「词命中即下架」的断言都不成立；同理，无词表不等于安全。
 - 下架真实原因未获官方确认 → 每次提审前按 XY-01/XY-02 复核；`RISK` 或证据缺口一律人工复审
   （`escalate: true`），不得静默 PASS。
+- 裁定 2026-10-10：XY-01 已按上表降级，资质口径本身不再触发人工复审；XY-02（时政主线）
+  与证据缺口仍照旧 escalate。

package/plugins/kk/skills/publish/SKILL.md

@@ -24,10 +24,12 @@ not add a `kk publish` noun.
 | medium | `medium-pub` | `file-cli` (token API) | `kk executor run medium-pub --in <content.json> --out <result.json>` |
 | wechatmp | `wechatmp-pub` | `file-cli` (`draft/add`) | `kk executor run wechatmp-pub` (default operation `draft`) |
 | x post | `x-pub` | `file-cli` (`POST /2/tweets`) | `kk executor run x-pub` (`options.operation` omitted / `post`) |
-| x article | `x-pub` | `browser` / `agent` | workflow `agent.run` — not `kk fanout` |
-| juejin | `juejin-pub` | `browser` / `agent` | workflow `agent.run` |
-| infoq | `infoq-pub` | `browser` / `agent` | workflow `agent.run` |
-| substack | `substack-pub` | `browser` / `agent` | workflow `agent.run` |
+| x article | `x-pub` | `browser` / `script` | `kk executor run x-pub --in <content.json> --out <result.json>` (`options.operation: article`); a missing or expired profile refuses (`ok: false`, naming `profile-check.ts login`) before any window opens |
+| juejin | `juejin-pub` | `browser` / `script` | `kk executor run juejin-pub --in <content.json> --out <result.json>` |
+| infoq | `infoq-pub` | `browser` / `script` | `kk executor run infoq-pub --in <content.json> --out <result.json>` |
+| substack | `substack-pub` | `browser` / `script` | `kk executor run substack-pub --in <content.json> --out <result.json>` (needs `SUBSTACK_PUBLICATION_URL`) |
+| threads | `threads-pub` | `file-cli` (Threads Graph, container → `threads_publish`) | `kk executor run threads-pub --in <content.json> --out <result.json>` — text only; needs `THREADS_ACCESS_TOKEN` + `THREADS_USER_ID`, no browser path |
+| weibo | `weibo-pub` | `browser` / `script` | `kk executor run weibo-pub --in <content.json> --out <result.json>`; `options.operation` `article` (头条文章, draft via 保存草稿 by default) or `post` (home composer, which has **no draft** — it requires `metadata.publishStatus: public`) |
 | xhs | `xhs-pub` | `browser` / `script` | `kk executor run xhs-pub --in <content.json> --out <result.json>` — its default `script` driver uploads the ordered card images with Playwright `setInputFiles`; the `agent` driver fails loud for this channel (ADR-024) |
 
 Already-harvested file-cli channels (`qiita-pub`, `zenn-pub`, `surfdash-pub`,
@@ -99,5 +101,7 @@ the confirmed live status; otherwise fail naming the switch.
 | medium-pub | `MEDIUM_INTEGRATION_TOKEN` |
 | wechatmp-pub | `WECHAT_APP_ID`, `WECHAT_APP_SECRET` |
 | x-pub `post` | `X_API_KEY`, `X_API_SECRET`, `X_ACCESS_TOKEN`, `X_ACCESS_TOKEN_SECRET` |
+| threads-pub `post` | `THREADS_ACCESS_TOKEN`, `THREADS_USER_ID` |
+| weibo-pub | none — its session lives in the browser profile (`WEIBO_PROFILE_DIR` overrides the dir; tier: `--profile` > `WEIBO_PROFILE_DIR` > `KK_BROWSER_PROFILE_DIR` > `~/.config/kk/browser-profiles/weibo`) |
 
 Missing env → plugin exit 1, `Result.ok false`, error names the variable.

package/plugins/kk/workflows/feature-verification.yaml

@@ -0,0 +1,93 @@
+# Feature-scoped verification pass (ADR-119, feature D62, task 0872; D63 task
+# 0915 remediation folds the evidence contract into a workflow-owned script).
+#
+# Owns a lifecycle boundary no per-task graph owns: the repo-wide checks whose
+# invariant spans the repository rather than a single task's diff. They run
+# once per feature, deliberately the slow pass; `feature-lifecycle`'s verifying
+# entry invokes this workflow (task 0880 caller wiring), and its verifying→done
+# guard refuses to complete the feature until this pass records PASS (ADR-119
+# consequence: a feature is not done until it passes).
+#
+# Run: spur workflow run feature-verification.yaml --vars '{"featureId":"D63"}'
+#
+# Shape: verify -> done | failed. The onEnter step runs the standard script
+# `feature-verification-steps.ts` (no public CLI verb, D63 task 0915): it
+# resolves this very definition for the verifier identity (name, source path,
+# layer, definition digest), records the RUNNING receipt (run-scoped +
+# feature-latest copies), registers the run-scoped receipt as a run artifact,
+# runs the configured verification command via the safe launch splitter, and
+# completes the receipt PASS/FAIL with the after-pass proof-input digest. A
+# changed tree during the pass records FAIL.
+#
+# Reliability (aligned with task-pipeline / ADR-043): no agent.run nodes; the
+# verification command comes from `vars.verificationCmd` below and is never
+# interpolated through a shell. The always-exit-0 onEnter means missing,
+# corrupt or FAIL evidence routes to `failed` via the guard (fail-closed),
+# never a silent PASS; infrastructure errors exit nonzero and surface.
+"$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
+kind: state-machine
+name: feature-verification
+version: "1"
+description: "Feature-scoped verification pass (ADR-119): runs the repo-wide check set once per feature and records a bound PASS/FAIL evidence receipt. Invoked by feature-lifecycle's verifying entry."
+iterationBound: 2
+initialState: verify
+terminalStates:
+  - done
+  - failed
+failureStates:
+  - failed
+vars:
+  featureId: "X"
+  spurBin: "spur"
+  verificationCmd: "bun run spur-check"
+  __runId: ""
+
+states:
+  - id: verify
+    description: >
+      Resolve this run's installed sp script root via Superskill, then run the
+      pinned installed verifier with Bun against the repo-wide check set. The
+      verifier records the bound evidence receipt (verifier identity,
+      checked-input digest, run identity) and the coarse status file. Both
+      actions fail closed — a locator/script failure, an unresolved or
+      non-installed root, an absent verifier, or a failing check yields a
+      non-PASS status — and always exit 0, so the transition guard routes
+      missing/corrupt/FAIL to `failed`.
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            S="$(superskill script path sp script-root.mjs 2>/dev/null)" || S="";
+            if [ -n "$S" ] && [ -f "$S" ]; then node "$S" --run-id "$__runId" --spur-bin "$spurBin";
+            else echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
+            fi;
+            exit 0
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run;
+            DIR="$(jq -r 'select(.mode == "installed" and (.dir | type == "string") and .dir != "") | .dir' ".spur/run/$__runId-script-root.json" 2>/dev/null)" || DIR="";
+            [ -n "$DIR" ] && [ -f "$DIR/feature-verification-steps.mjs" ] && S="$DIR/feature-verification-steps.mjs";
+            [ -f "$S" ] && bun "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" || printf 'FAIL feature-verification failed closed — unresolved root or verifier failure\n' > ".spur/run/$__runId-feature-verification.status";
+            exit 0
+
+  - id: done
+    description: Terminal — repo-wide checks passed and the receipt is bound.
+
+  - id: failed
+    description: Terminal — repo-wide checks failed or the evidence is missing/corrupt.
+
+transitions:
+  - from: verify
+    to: done
+    description: Repo-wide checks passed — the script completed the receipt with PASS.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$__runId-feature-verification.status 2>/dev/null)" = PASS'
+  - from: verify
+    to: failed
+    terminalReason: failed-check
+    description: Repo-wide checks failed (or the evidence is missing/corrupt) — stop at failed.
+    guard:
+      kind: always

package/plugins/kk/workflows/judge-gated-publish-example.yaml

@@ -91,6 +91,7 @@ transitions:
   # FAIL, out-of-contract verdict, or NEEDS_REVISION with no retries left -> failed.
   - from: judge
     to: failed
+    terminalReason: failed-guard
     description: "Judge verdict is FAIL, out-of-contract, or NEEDS_REVISION with retries exhausted -> block publish"
     guard:
       kind: shell

package/plugins/kk/workflows/kk-collect.yaml

@@ -27,6 +27,10 @@ vars:
   # builtin — a shell command may only reference declared vars). It is the lock owner and the
   # `collect_runs` / ledger identity.
   __runId: ""
+  # Definition digest of the executed workflow, injected by spur at launch (G8/0252 §9). The
+  # Board capture compares it with the public `spur workflow list --json` catalog and reads the
+  # topology only on exact agreement; a missing/mismatched digest omits topology with a diagnostic.
+  __definitionDigest: ""
   # Per-source collection parameters, seeded into the plugin source configs by `lock`.
   limit: "10"
   last30days_topic: "AI news"
@@ -72,18 +76,34 @@ states:
           # IS the lock contract, and the guard below reads it back:
           # `{"acquired":true}` or `{"skipped":"locked","holder":<run>}` (R1).
           command: >-
-            kk store lock acquire --name collect --run "${vars.__runId}" --ttl 21600000 > "${vars.work_dir}/lock.json"
+            kk lock acquire --name collect --run "${vars.__runId}" --ttl 21600000 > "${vars.work_dir}/lock.json"
 
   - id: collect
     description: >-
-      Fan-in every ingestion source into the run's blended Doc[] (same sources and timeout overrides as
-      kk-daily-ai-voice's collect state) and render the core-facts markdown with the existing stage (R3/R4).
+      Bind the run to its workspace for the Board (G8/0252 §9), then fan-in every ingestion source into
+      the run's blended Doc[] (same sources and timeout overrides as kk-daily-ai-voice's collect state)
+      and render the core-facts markdown with the existing stage (R3/R4).
     onEnter:
       - kind: shell
-        # onError: continue on both actions, with the artifact guard below as the positive success
-        # contract: a state-machine aborts the run on a failed action without taking a transition, so a
-        # hard failure here would leave the lock behind. The run still ends `failed` — through
-        # `release-failed`, which releases the lock first.
+        # Board capture (G8/0252 §9): revoke any previous workspace owner and bind THIS run to the
+        # workspace before any collection output exists. Revocation is mandatory — a refusal writes no
+        # board-capture.json, so the artifact guard below routes to `release-failed` and no result is
+        # ever stored over another owner's files. An optional capture failure after a successful
+        # revocation warns (captured:false) and only disables Board previews.
+        # onError: continue keeps the lock-releasing failure path intact instead of a hard abort.
+        options:
+          onError: continue
+          command: >-
+            kk board capture --workflow kk-collect --run "${vars.__runId}"
+            --work-dir "${vars.work_dir}" --stamp "${vars.stamp}"
+            --definition-digest "${vars.__definitionDigest}"
+            --setting "limit=${vars.limit}" --setting "horizon_hours=${vars.horizon_hours}"
+            > "${vars.work_dir}/board-capture.json"
+      - kind: shell
+        # onError: continue on both ingestion actions, with the artifact guard below as the positive
+        # success contract: a state-machine aborts the run on a failed action without taking a
+        # transition, so a hard failure here would leave the lock behind. The run still ends `failed`
+        # — through `release-failed`, which releases the lock first.
         onError: continue
         options:
           # horizon-ingest's latency straddles the fan-in 30m per-source default (0098/0099), so it gets
@@ -153,7 +173,7 @@ states:
       - kind: shell
         options:
           command: >-
-            kk store lock release --name collect --run "${vars.__runId}"
+            kk lock release --name collect --run "${vars.__runId}"
 
   - id: release-failed
     description: >-
@@ -164,7 +184,7 @@ states:
         onError: continue
         options:
           command: >-
-            kk store lock release --name collect --run "${vars.__runId}"
+            kk lock release --name collect --run "${vars.__runId}"
 
   - id: done
     description: "Terminal — collection stored; the daily workflow reads it back through `kk store extract`"
@@ -192,13 +212,14 @@ transitions:
 
   - from: collect
     to: store
-    description: "Blended Doc[] written and core facts rendered -> store it"
+    description: "Blended Doc[], core facts and Board capture recorded -> store it"
     guard:
       kind: shell
       options:
         command: >-
           test -s "${vars.work_dir}/10-ingest/${vars.stamp}_02_collect_blended.json" &&
-          test -s "${vars.work_dir}/20-facts/${vars.stamp}_02_collect_core-facts.md"
+          test -s "${vars.work_dir}/20-facts/${vars.stamp}_02_collect_core-facts.md" &&
+          test -s "${vars.work_dir}/board-capture.json"
 
   - from: collect
     to: release-failed
@@ -232,6 +253,17 @@ transitions:
         # refusal names the offending value on stderr before the transition falls through to
         # `release-failed` — fail-closed, and never a deadlock (that state is `always`).
         # Kept at 3 logical commands: spur's ADR-115 composition lint errors on a guard above 5.
+        # Task 0268 — degraded pass is a WARNING, not a gate. `kk store label` prints
+        # `degraded: true` and writes `kk.store.label.degraded: fallback: N/M consults (P%)` to
+        # stderr whenever the fallback share of its consults exceeds 0.5 — a majority of consults
+        # answered `source: default` (spur's `no-backend` degradation). Chosen at one-half because
+        # the 2026-10-12 incident measured `fallback: 22/26` (0.85) and `33/45` (0.73), well past
+        # it, while a healthy pass stays near zero; the threshold is the operator's signal in
+        # launchd.log/the ledger, not a transition. A degraded pass still prints `verdict: PASS`,
+        # so this guard releases the lock and the labels it DID write survive for the next tick —
+        # making the verdict non-`PASS` instead would route to `release-failed` and, with the
+        # label state's `onError: continue`, throw away a whole day's labels for a backend the
+        # next tick can reach. The fail-closed defaults themselves are unchanged (task 0268 R3).
         command: >-
           test "$(jq -r 'if (.verdict // "") == "PASS" then (.verdict + (if ((.confidence // "") | test("^(HIGH|MEDIUM|LOW)$")) then "" else "!" end)) else (.verdict // "") end' "${vars.work_dir}/label-result.txt" 2>/dev/null)" = PASS ||
           { echo "kk-collect.label.confidence-refused: verdict '$(jq -r '.verdict // "<none>"' "${vars.work_dir}/label-result.txt" 2>/dev/null)' carries confidence '$(jq -r '.confidence // "<absent>"' "${vars.work_dir}/label-result.txt" 2>/dev/null)', not HIGH|MEDIUM|LOW" >&2; false; }