@gobing-ai/knowledge-kit 0.0.35 → 0.0.36

package/plugins/kk/scripts/kk-workflow-stages.ts

@@ -55,7 +55,7 @@ import {
     writeFileSync,
 } from 'node:fs';
 import { homedir } from 'node:os';
-import { basename, dirname, join, relative, resolve } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 
 export const SCRIPTS_DIR = import.meta.dir;
 export const VALIDATE_SIDECAR = 'validate-voicescript.ts';
@@ -1280,10 +1280,24 @@ function publishCompleteness(
                 detail: 'en/ja scaffolded, never synced',
             });
         } else if (syncResult.ok === true) {
+            // A filled marker only proves the locale was SCAFFOLDED. The workflow's `translate` agent is
+            // what publishes it (its prompt flips `draft: true` → `draft: false`), so a run whose
+            // translation failed used to report `locales: done` while the site kept an unpublished
+            // scaffold — the one channel whose loss nothing in the run's artifacts named. Read the draft
+            // the marker points at: still `draft: true` means it was never translated.
+            const untranslated = ['en', 'ja'].filter((locale) => {
+                const marker = readFileSync(at(`20_translate-localize_${locale}-post-path.txt`), 'utf-8').trim();
+                if (!isFile(marker)) return true;
+                const head = readFileSync(marker, 'utf-8').split('---')[1] ?? '';
+                return /^draft:\s*true\s*$/m.test(head);
+            });
             rows.push({
                 channel: 'locales',
-                state: 'done',
-                detail: 'en/ja drafts scaffolded',
+                state: untranslated.length === 0 ? 'done' : 'failed',
+                detail:
+                    untranslated.length === 0
+                        ? 'en/ja drafts scaffolded and translated'
+                        : `${untranslated.join(', ')} draft is still a scaffold (draft: true) — not translated, so it stays unpublished`,
             });
         } else {
             rows.push({
@@ -1327,6 +1341,12 @@ function publishCompleteness(
 function dailyPublishPartial(args: string[]): void {
     const [workDir = '', runDate = ''] = args;
     const result = join(workDir, '31-publish', `${runDate}_17_publish_result.json`);
+    // The marker describes this run, so it belongs under that run's workDir — a cwd-relative path
+    // litters whatever tree the caller stood in and hides the note from the episode it describes.
+    const marker =
+        workDir === ''
+            ? join('.spur', 'run', `publish-partial-${runDate}.txt`)
+            : join(workDir, '.spur', 'run', `publish-partial-${runDate}.txt`);
     timed(workDir, 'publish-partial', () => {
         const failed = targetsOf(result)
             .filter((entry) => entry.ok !== true || entry.status !== 'published')
@@ -1334,10 +1354,10 @@ function dailyPublishPartial(args: string[]): void {
             .join(',');
         const list = failed === '' ? '(unparsed)' : failed;
         console.error(`WARNING: partial publish — failed targets: ${list}`);
-        sted('mkdir', '.spur/run', () => mkdirSync('.spur/run', { recursive: true }));
-        sted('write', `.spur/run/publish-partial-${runDate}.txt`, () =>
+        sted('mkdir', dirname(marker), () => mkdirSync(dirname(marker), { recursive: true }));
+        sted('write', marker, () =>
             writeFileSync(
-                `.spur/run/publish-partial-${runDate}.txt`,
+                marker,
                 `${runDate} partial publish: failed targets: ${list} (result.json preserved for kk executor fan-out --retry-from)\n`,
             ),
         );
@@ -1345,10 +1365,16 @@ function dailyPublishPartial(args: string[]): void {
 }
 
 /**
- * 20260917 review #4/#6: after both publishes land, patch the surfdash disk posts —
- * reuse the podcast-hosted cover URL in frontmatter (image/og_image; no re-upload; fallback:
- * copy the local cover into assets/) and append a podcast cross-link at the end of zh/en/ja.
- * Idempotent per post; commits + pushes the surfdash checkout (SURFDASH_AUTO_PUSH=0 keeps commit-only).
+ * Post-publish surfdash healing — a thin delegation to the publisher that owns it (2026-10-12).
+ *
+ * The work itself (podcast cover URL into `image`/`og_image`, the per-locale podcast cross-link, the
+ * local cover's `assets/` fallback, the EmDash re-sync that makes CMS cards carry a servable image,
+ * and the pathspec commit + push) lives in the `surfdash-pub` `patch` operation now: it is the
+ * publisher's job, and every path that publishes a post needs it. This stage only reads the run's
+ * publish results into the operation's payload and reports its outcome.
+ *
+ * `KK_SURFDASH_PATCH_OFFLINE=1` keeps fixture tests hermetic — the plugin would otherwise write to,
+ * commit and push a real checkout.
  */
 function dailyPatchSurfdash(args: string[]): void {
     const [workDir = '', runDate = '', surfdashRoot = '', pluginsPath = ''] = args;
@@ -1369,149 +1395,53 @@ function dailyPatchSurfdash(args: string[]): void {
         const sd = targetOf(sdResult);
         const pod = targetOf(podcastResult);
         const postPath = (sd.metadata as Record<string, unknown> | undefined)?.postPath;
-        if (typeof postPath !== 'string' || postPath === '')
+        if (typeof postPath !== 'string' || postPath === '') {
             failWith(1, 'patch-surfdash: surfdash result carries no postPath');
-        // Refuse before anything is written: surfdash's deploy.yml publishes from main, so a commit
-        // on any other branch is invisible to production. Placed here (after the input checks) so a
-        // refusal leaves the working tree untouched.
-        const head = spawnSync('git', ['-C', surfdashRoot, 'rev-parse', '--abbrev-ref', 'HEAD'])
-            .stdout?.toString()
-            .trim();
-        if (head !== 'main')
-            failWith(1, `patch-surfdash: refusing to commit on '${head}' — surfdash deploys from main`);
-        // Paths this run actually wrote, relative to surfdashRoot. `git add`/`commit` take these as a
-        // pathspec so the operator's unrelated staged work is never swept into the commit.
-        const written: string[] = [];
-        const slugDir = dirname(postPath);
-        const showNotesUrl = typeof pod.url === 'string' ? pod.url : '';
-        const coverUrl = ((pod.metadata as Record<string, unknown> | undefined)?.imageUrl as string | undefined) ?? '';
-        const localCover = join(workDir, '23-cover', `${runDate}_07_cover_cover.png`);
-        const dateIso = `${runDate.slice(0, 4)}-${runDate.slice(4, 6)}-${runDate.slice(6, 8)}`;
-        const crossLink: Record<string, string> = {
-            // Task 0189 R4: cross-links carry the column's episode-title pattern, not the retired
-            // news-bulletin name (the VoiceScript episode title is episodeTitle(lead, date)).
-            zh: `🎧 本期已同步制作为播客节目，[点击收听《每日AI乱炖 · ${dateIso}》](${showNotesUrl})。`,
-            en: `🎧 This episode is also available as a podcast: [listen to 每日AI乱炖 · ${dateIso}](${showNotesUrl}).`,
-            ja: `🎧 本エピソードはポッドキャストでも配信中：[每日AI乱炖 · ${dateIso} を聴く](${showNotesUrl})。`,
-        };
-        let changed = 0;
-        for (const [locale, dir] of [
-            // zh posts live under articles/zh/<slug>; en/ja under articles/<locale>/<slug> —
-            // two dirnames up, not one (20260919: `articles/zh/en/...` never existed, so en/ja
-            // were silently skipped by the not-published branch).
-            ['zh', slugDir],
-            ['en', join(dirname(dirname(slugDir)), 'en', basename(slugDir))],
-            ['ja', join(dirname(dirname(slugDir)), 'ja', basename(slugDir))],
-        ] as const) {
-            const indexMd = join(dir, 'index.md');
-            if (!existsSync(indexMd)) {
-                console.error(`patch-surfdash: ${locale} post not published (${indexMd}) — skip`);
-                continue;
-            }
-            let md = readFileSync(indexMd, 'utf-8');
-            const fmEnd = md.indexOf('---', 3); // frontmatter is `---\n ... \n---\n`
-            if (fmEnd < 0) failWith(1, `patch-surfdash: no frontmatter in ${indexMd}`);
-            // Upsert a single-line `key: 'value'`; the regex consumes folded-scalar continuation
-            // lines (`og_image: >-\n  https://...`) so multi-line publish output is replaced whole.
-            const upsertKey = (src: string, key: string, value: string): string => {
-                // YAML single-quoted scalars escape `'` as `''`; the replacement is a function so
-                // `$&`/`$1`/`$$` in the value are never expanded. Scope the match to the frontmatter
-                // (recomputed per call, since each upsert shifts offsets) so a body line starting with
-                // `image:` is not rewritten.
-                const end = src.indexOf('\n---', 3);
-                const fm = src.slice(0, end);
-                const body = src.slice(end);
-                const line = `${key}: '${value.replaceAll("'", "''")}'`;
-                const re = new RegExp(`^${key}:.*(?:\\n[ \\t]+.*)*`, 'm');
-                const next = re.test(fm)
-                    ? fm.replace(re, () => line)
-                    : fm.replace(/^publishDate: .*$/m, (m0) => `${m0}\n${line}`);
-                return next + body;
-            };
-            if (coverUrl !== '') {
-                // 20260919 prod feedback: the podcast-hosted cover URL wins even when surfdash-pub
-                // already wrote `image:` — its resolved og_image points at /content-posts/<slug>/
-                // assets/cover.png, which the deployed worker does not serve (404).
-                md = upsertKey(md, 'image', coverUrl);
-                md = upsertKey(md, 'og_image', coverUrl);
-            } else if (!/^image:/m.test(md.slice(0, fmEnd))) {
-                // Fallback for runs without a podcast cover: copy the local cover instead.
-                if (existsSync(localCover)) {
-                    const assets = join(dir, 'assets');
-                    mkdirSync(assets, { recursive: true });
-                    copyFileSync(localCover, join(assets, 'cover.png'));
-                    written.push(relative(surfdashRoot, join(assets, 'cover.png')));
-                    md = upsertKey(md, 'image', './assets/cover.png');
-                    md = upsertKey(md, 'og_image', './assets/cover.png');
-                }
-            }
-            if (showNotesUrl !== '' && !md.includes(showNotesUrl)) {
-                md = `${md.replace(/\s*$/, '')}\n\n${crossLink[locale]}\n`;
-            }
-            if (md !== readFileSync(indexMd, 'utf-8')) {
-                sted('write', indexMd, () => writeFileSync(indexMd, md));
-                written.push(relative(surfdashRoot, indexMd));
-                changed++;
-            }
         }
-        // 20260929 prod feedback: CMS cards (homepage hero/tag/search) read EmDash rows whose
-        // featured_image is snapshotted at translate-sync time — i.e. the pre-patch
-        // `./assets/cover.png`, which the deployed worker does not serve (404). The patch only
-        // rewrites files, so re-sync the EmDash rows from the patched files through the same
-        // `kk executor` path as translate-sync (its plugin child gets EMDASH_API_TOKEN from kk
-        // config; a direct orchestrator spawn gets 403 from prod dev-bypass). Runs before the
-        // changed===0 early-return so re-runs heal rows an earlier commit left stale
-        // (20260925/20260929). Fixture tests pass no plugins-path and must not shell out.
-        if (pluginsPath === '') {
-            // A missing plugins-path silently drops the CMS re-sync, and the CMS cards then keep the
-            // pre-patch `./assets/cover.png` the deployed worker cannot serve (20261002 lost its
-            // cover this way). Leave a marker for the classify step's completeness report.
+        const resultPath = join(workDir, '31-publish', `${runDate}_23_patch-surfdash_sync-result.json`);
+        if (process.env.KK_SURFDASH_PATCH_OFFLINE === '1') {
+            // The marker keeps the completeness report's cms-resync row honest in offline runs.
             const skipMarker = join(workDir, '31-publish', `${runDate}_23_patch-surfdash_emdash-resync.txt`);
-            sted('write', skipMarker, () => writeRaw(skipMarker, 'skipped: no plugins-path\n'));
-            console.error('patch-surfdash: no plugins-path — skip emdash re-sync');
-        } else {
-            const syncIn = join(workDir, '31-publish', `${runDate}_23_patch-surfdash_sync.json`);
-            const syncResult = join(workDir, '31-publish', `${runDate}_23_patch-surfdash_sync-result.json`);
-            sted('write', syncIn, () =>
-                writeJqText(syncIn, { body: '', options: { operation: 'sync', postPath: join(slugDir, 'index.md') } }),
-            );
-            const status = kk(
-                ['executor', 'run', 'surfdash-pub', '--in', syncIn, '--out', syncResult, ...pluginsArgs(pluginsPath)],
-                { unset: NESTED_SPUR_UNSET, soft: true },
-            );
-            const result = isFile(syncResult) ? readJson(syncResult) : null;
-            const ok =
-                status === 0 &&
-                result !== null &&
-                (result.ok === true || (result.targets as Array<{ ok?: boolean }> | undefined)?.[0]?.ok === true);
-            if (!ok) {
-                console.error(
-                    `patch-surfdash: WARNING: emdash re-sync failed (exit ${status}) — CMS cards keep the stale cover; fix: kk executor run surfdash-pub --in ${syncIn} --out ${syncResult} --plugins-path ${pluginsPath}`,
-                );
-            } else {
-                console.error('patch-surfdash: emdash rows re-synced from patched files');
-            }
-        }
-        if (changed === 0) {
-            console.error('patch-surfdash: nothing to change');
+            sted('write', skipMarker, () => writeRaw(skipMarker, 'skipped: offline (KK_SURFDASH_PATCH_OFFLINE=1)\n'));
+            console.error('patch-surfdash: offline — skip the plugin patch (KK_SURFDASH_PATCH_OFFLINE=1)');
             return;
         }
-        const git = (...a: string[]): void => {
-            const r = spawnSync('git', ['-C', surfdashRoot, ...a]);
-            if (r.status !== 0) failWith(1, `patch-surfdash: git ${a[0]} failed: ${r.stderr?.toString().trim()}`);
-        };
-        git('add', '--', ...written);
-        git(
-            'commit',
-            '-m',
-            `feat: cover + podcast cross-link for ${basename(slugDir)} (kk daily patch)`,
-            '--',
-            ...written,
+        const payload = join(workDir, '31-publish', `${runDate}_23_patch-surfdash_patch.json`);
+        const podcastMeta = (pod.metadata ?? {}) as Record<string, unknown>;
+        sted('write', payload, () =>
+            writeJqText(payload, {
+                body: '',
+                options: {
+                    operation: 'patch',
+                    postPath,
+                    coverUrl: typeof podcastMeta.imageUrl === 'string' ? podcastMeta.imageUrl : '',
+                    showNotesUrl: typeof pod.url === 'string' ? pod.url : '',
+                    dateIso: `${runDate.slice(0, 4)}-${runDate.slice(4, 6)}-${runDate.slice(6, 8)}`,
+                    localCover: join(workDir, '23-cover', `${runDate}_07_cover_cover.png`),
+                },
+            }),
         );
-        if (process.env.SURFDASH_AUTO_PUSH !== '0') git('push', 'origin', 'main');
-        console.error(
-            `patch-surfdash: patched ${changed} post(s), committed${process.env.SURFDASH_AUTO_PUSH !== '0' ? ' + pushed' : ' (push skipped: SURFDASH_AUTO_PUSH=0)'}`,
+        const status = kk(
+            ['executor', 'run', 'surfdash-pub', '--in', payload, '--out', resultPath, ...pluginsArgs(pluginsPath)],
+            { unset: NESTED_SPUR_UNSET, env: { SURFDASH_ROOT: surfdashRoot }, soft: true },
         );
+        const result = isFile(resultPath) ? readJson(resultPath) : null;
+        const meta = (result?.metadata ?? {}) as Record<string, unknown>;
+        if (result?.ok === true) {
+            console.error(
+                `patch-surfdash: ${String(result.message ?? 'patched')} — cms-resync ${String(meta.cmsResync ?? 'ok')}, commit ${String(meta.gitCommit ?? 'unchanged')}${Array.isArray(meta.absentLocales) && meta.absentLocales.length > 0 ? `, no post for ${(meta.absentLocales as string[]).join('/')}` : ''}`,
+            );
+            return;
+        }
+        // The posts are patched and committed; only the EmDash rows keep the unservable cover. That is
+        // the soft channel the completeness report carries, so warn instead of failing the run.
+        if (meta.cmsResync === 'failed') {
+            console.error(
+                `patch-surfdash: WARNING: cms re-sync failed — ${String(result?.error ?? `exit ${status}`)}; fix: kk executor run surfdash-pub --in ${payload} --out ${resultPath}${pluginsArgs(pluginsPath).join(' ')}`,
+            );
+            return;
+        }
+        failWith(1, `patch-surfdash: ${String(result?.error ?? `surfdash-pub patch exited ${status}`)}`);
     });
 }
 

package/plugins/kk/skills/publish/SKILL.md

@@ -24,10 +24,12 @@ not add a `kk publish` noun.
 | medium | `medium-pub` | `file-cli` (token API) | `kk executor run medium-pub --in <content.json> --out <result.json>` |
 | wechatmp | `wechatmp-pub` | `file-cli` (`draft/add`) | `kk executor run wechatmp-pub` (default operation `draft`) |
 | x post | `x-pub` | `file-cli` (`POST /2/tweets`) | `kk executor run x-pub` (`options.operation` omitted / `post`) |
-| x article | `x-pub` | `browser` / `agent` | workflow `agent.run` — not `kk fanout` |
-| juejin | `juejin-pub` | `browser` / `agent` | workflow `agent.run` |
-| infoq | `infoq-pub` | `browser` / `agent` | workflow `agent.run` |
-| substack | `substack-pub` | `browser` / `agent` | workflow `agent.run` |
+| x article | `x-pub` | `browser` / `script` | `kk executor run x-pub --in <content.json> --out <result.json>` (`options.operation: article`); a missing or expired profile refuses (`ok: false`, naming `profile-check.ts login`) before any window opens |
+| juejin | `juejin-pub` | `browser` / `script` | `kk executor run juejin-pub --in <content.json> --out <result.json>` |
+| infoq | `infoq-pub` | `browser` / `script` | `kk executor run infoq-pub --in <content.json> --out <result.json>` |
+| substack | `substack-pub` | `browser` / `script` | `kk executor run substack-pub --in <content.json> --out <result.json>` (needs `SUBSTACK_PUBLICATION_URL`) |
+| threads | `threads-pub` | `file-cli` (Threads Graph, container → `threads_publish`) | `kk executor run threads-pub --in <content.json> --out <result.json>` — text only; needs `THREADS_ACCESS_TOKEN` + `THREADS_USER_ID`, no browser path |
+| weibo | `weibo-pub` | `browser` / `script` | `kk executor run weibo-pub --in <content.json> --out <result.json>`; `options.operation` `article` (头条文章, draft via 保存草稿 by default) or `post` (home composer, which has **no draft** — it requires `metadata.publishStatus: public`) |
 | xhs | `xhs-pub` | `browser` / `script` | `kk executor run xhs-pub --in <content.json> --out <result.json>` — its default `script` driver uploads the ordered card images with Playwright `setInputFiles`; the `agent` driver fails loud for this channel (ADR-024) |
 
 Already-harvested file-cli channels (`qiita-pub`, `zenn-pub`, `surfdash-pub`,
@@ -99,5 +101,7 @@ the confirmed live status; otherwise fail naming the switch.
 | medium-pub | `MEDIUM_INTEGRATION_TOKEN` |
 | wechatmp-pub | `WECHAT_APP_ID`, `WECHAT_APP_SECRET` |
 | x-pub `post` | `X_API_KEY`, `X_API_SECRET`, `X_ACCESS_TOKEN`, `X_ACCESS_TOKEN_SECRET` |
+| threads-pub `post` | `THREADS_ACCESS_TOKEN`, `THREADS_USER_ID` |
+| weibo-pub | none — its session lives in the browser profile (`WEIBO_PROFILE_DIR` overrides the dir; tier: `--profile` > `WEIBO_PROFILE_DIR` > `KK_BROWSER_PROFILE_DIR` > `~/.config/kk/browser-profiles/weibo`) |
 
 Missing env → plugin exit 1, `Result.ok false`, error names the variable.

package/plugins/kk/workflows/feature-verification.yaml

@@ -0,0 +1,93 @@
+# Feature-scoped verification pass (ADR-119, feature D62, task 0872; D63 task
+# 0915 remediation folds the evidence contract into a workflow-owned script).
+#
+# Owns a lifecycle boundary no per-task graph owns: the repo-wide checks whose
+# invariant spans the repository rather than a single task's diff. They run
+# once per feature, deliberately the slow pass; `feature-lifecycle`'s verifying
+# entry invokes this workflow (task 0880 caller wiring), and its verifying→done
+# guard refuses to complete the feature until this pass records PASS (ADR-119
+# consequence: a feature is not done until it passes).
+#
+# Run: spur workflow run feature-verification.yaml --vars '{"featureId":"D63"}'
+#
+# Shape: verify -> done | failed. The onEnter step runs the standard script
+# `feature-verification-steps.ts` (no public CLI verb, D63 task 0915): it
+# resolves this very definition for the verifier identity (name, source path,
+# layer, definition digest), records the RUNNING receipt (run-scoped +
+# feature-latest copies), registers the run-scoped receipt as a run artifact,
+# runs the configured verification command via the safe launch splitter, and
+# completes the receipt PASS/FAIL with the after-pass proof-input digest. A
+# changed tree during the pass records FAIL.
+#
+# Reliability (aligned with task-pipeline / ADR-043): no agent.run nodes; the
+# verification command comes from `vars.verificationCmd` below and is never
+# interpolated through a shell. The always-exit-0 onEnter means missing,
+# corrupt or FAIL evidence routes to `failed` via the guard (fail-closed),
+# never a silent PASS; infrastructure errors exit nonzero and surface.
+"$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
+kind: state-machine
+name: feature-verification
+version: "1"
+description: "Feature-scoped verification pass (ADR-119): runs the repo-wide check set once per feature and records a bound PASS/FAIL evidence receipt. Invoked by feature-lifecycle's verifying entry."
+iterationBound: 2
+initialState: verify
+terminalStates:
+  - done
+  - failed
+failureStates:
+  - failed
+vars:
+  featureId: "X"
+  spurBin: "spur"
+  verificationCmd: "bun run spur-check"
+  __runId: ""
+
+states:
+  - id: verify
+    description: >
+      Resolve this run's installed sp script root via Superskill, then run the
+      pinned installed verifier with Bun against the repo-wide check set. The
+      verifier records the bound evidence receipt (verifier identity,
+      checked-input digest, run identity) and the coarse status file. Both
+      actions fail closed — a locator/script failure, an unresolved or
+      non-installed root, an absent verifier, or a failing check yields a
+      non-PASS status — and always exit 0, so the transition guard routes
+      missing/corrupt/FAIL to `failed`.
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            S="$(superskill script path sp script-root.mjs 2>/dev/null)" || S="";
+            if [ -n "$S" ] && [ -f "$S" ]; then node "$S" --run-id "$__runId" --spur-bin "$spurBin";
+            else echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
+            fi;
+            exit 0
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run;
+            DIR="$(jq -r 'select(.mode == "installed" and (.dir | type == "string") and .dir != "") | .dir' ".spur/run/$__runId-script-root.json" 2>/dev/null)" || DIR="";
+            [ -n "$DIR" ] && [ -f "$DIR/feature-verification-steps.mjs" ] && S="$DIR/feature-verification-steps.mjs";
+            [ -f "$S" ] && bun "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" || printf 'FAIL feature-verification failed closed — unresolved root or verifier failure\n' > ".spur/run/$__runId-feature-verification.status";
+            exit 0
+
+  - id: done
+    description: Terminal — repo-wide checks passed and the receipt is bound.
+
+  - id: failed
+    description: Terminal — repo-wide checks failed or the evidence is missing/corrupt.
+
+transitions:
+  - from: verify
+    to: done
+    description: Repo-wide checks passed — the script completed the receipt with PASS.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$__runId-feature-verification.status 2>/dev/null)" = PASS'
+  - from: verify
+    to: failed
+    terminalReason: failed-check
+    description: Repo-wide checks failed (or the evidence is missing/corrupt) — stop at failed.
+    guard:
+      kind: always

package/plugins/kk/workflows/judge-gated-publish-example.yaml

@@ -91,6 +91,7 @@ transitions:
   # FAIL, out-of-contract verdict, or NEEDS_REVISION with no retries left -> failed.
   - from: judge
     to: failed
+    terminalReason: failed-guard
     description: "Judge verdict is FAIL, out-of-contract, or NEEDS_REVISION with retries exhausted -> block publish"
     guard:
       kind: shell

package/plugins/kk/workflows/kk-collect.yaml

@@ -27,6 +27,10 @@ vars:
   # builtin — a shell command may only reference declared vars). It is the lock owner and the
   # `collect_runs` / ledger identity.
   __runId: ""
+  # Definition digest of the executed workflow, injected by spur at launch (G8/0252 §9). The
+  # Board capture compares it with the public `spur workflow list --json` catalog and reads the
+  # topology only on exact agreement; a missing/mismatched digest omits topology with a diagnostic.
+  __definitionDigest: ""
   # Per-source collection parameters, seeded into the plugin source configs by `lock`.
   limit: "10"
   last30days_topic: "AI news"
@@ -72,18 +76,34 @@ states:
           # IS the lock contract, and the guard below reads it back:
           # `{"acquired":true}` or `{"skipped":"locked","holder":<run>}` (R1).
           command: >-
-            kk store lock acquire --name collect --run "${vars.__runId}" --ttl 21600000 > "${vars.work_dir}/lock.json"
+            kk lock acquire --name collect --run "${vars.__runId}" --ttl 21600000 > "${vars.work_dir}/lock.json"
 
   - id: collect
     description: >-
-      Fan-in every ingestion source into the run's blended Doc[] (same sources and timeout overrides as
-      kk-daily-ai-voice's collect state) and render the core-facts markdown with the existing stage (R3/R4).
+      Bind the run to its workspace for the Board (G8/0252 §9), then fan-in every ingestion source into
+      the run's blended Doc[] (same sources and timeout overrides as kk-daily-ai-voice's collect state)
+      and render the core-facts markdown with the existing stage (R3/R4).
     onEnter:
       - kind: shell
-        # onError: continue on both actions, with the artifact guard below as the positive success
-        # contract: a state-machine aborts the run on a failed action without taking a transition, so a
-        # hard failure here would leave the lock behind. The run still ends `failed` — through
-        # `release-failed`, which releases the lock first.
+        # Board capture (G8/0252 §9): revoke any previous workspace owner and bind THIS run to the
+        # workspace before any collection output exists. Revocation is mandatory — a refusal writes no
+        # board-capture.json, so the artifact guard below routes to `release-failed` and no result is
+        # ever stored over another owner's files. An optional capture failure after a successful
+        # revocation warns (captured:false) and only disables Board previews.
+        # onError: continue keeps the lock-releasing failure path intact instead of a hard abort.
+        options:
+          onError: continue
+          command: >-
+            kk board capture --workflow kk-collect --run "${vars.__runId}"
+            --work-dir "${vars.work_dir}" --stamp "${vars.stamp}"
+            --definition-digest "${vars.__definitionDigest}"
+            --setting "limit=${vars.limit}" --setting "horizon_hours=${vars.horizon_hours}"
+            > "${vars.work_dir}/board-capture.json"
+      - kind: shell
+        # onError: continue on both ingestion actions, with the artifact guard below as the positive
+        # success contract: a state-machine aborts the run on a failed action without taking a
+        # transition, so a hard failure here would leave the lock behind. The run still ends `failed`
+        # — through `release-failed`, which releases the lock first.
         onError: continue
         options:
           # horizon-ingest's latency straddles the fan-in 30m per-source default (0098/0099), so it gets
@@ -153,7 +173,7 @@ states:
       - kind: shell
         options:
           command: >-
-            kk store lock release --name collect --run "${vars.__runId}"
+            kk lock release --name collect --run "${vars.__runId}"
 
   - id: release-failed
     description: >-
@@ -164,7 +184,7 @@ states:
         onError: continue
         options:
           command: >-
-            kk store lock release --name collect --run "${vars.__runId}"
+            kk lock release --name collect --run "${vars.__runId}"
 
   - id: done
     description: "Terminal — collection stored; the daily workflow reads it back through `kk store extract`"
@@ -192,13 +212,14 @@ transitions:
 
   - from: collect
     to: store
-    description: "Blended Doc[] written and core facts rendered -> store it"
+    description: "Blended Doc[], core facts and Board capture recorded -> store it"
     guard:
       kind: shell
       options:
         command: >-
           test -s "${vars.work_dir}/10-ingest/${vars.stamp}_02_collect_blended.json" &&
-          test -s "${vars.work_dir}/20-facts/${vars.stamp}_02_collect_core-facts.md"
+          test -s "${vars.work_dir}/20-facts/${vars.stamp}_02_collect_core-facts.md" &&
+          test -s "${vars.work_dir}/board-capture.json"
 
   - from: collect
     to: release-failed
@@ -232,6 +253,17 @@ transitions:
         # refusal names the offending value on stderr before the transition falls through to
         # `release-failed` — fail-closed, and never a deadlock (that state is `always`).
         # Kept at 3 logical commands: spur's ADR-115 composition lint errors on a guard above 5.
+        # Task 0268 — degraded pass is a WARNING, not a gate. `kk store label` prints
+        # `degraded: true` and writes `kk.store.label.degraded: fallback: N/M consults (P%)` to
+        # stderr whenever the fallback share of its consults exceeds 0.5 — a majority of consults
+        # answered `source: default` (spur's `no-backend` degradation). Chosen at one-half because
+        # the 2026-10-12 incident measured `fallback: 22/26` (0.85) and `33/45` (0.73), well past
+        # it, while a healthy pass stays near zero; the threshold is the operator's signal in
+        # launchd.log/the ledger, not a transition. A degraded pass still prints `verdict: PASS`,
+        # so this guard releases the lock and the labels it DID write survive for the next tick —
+        # making the verdict non-`PASS` instead would route to `release-failed` and, with the
+        # label state's `onError: continue`, throw away a whole day's labels for a backend the
+        # next tick can reach. The fail-closed defaults themselves are unchanged (task 0268 R3).
         command: >-
           test "$(jq -r 'if (.verdict // "") == "PASS" then (.verdict + (if ((.confidence // "") | test("^(HIGH|MEDIUM|LOW)$")) then "" else "!" end)) else (.verdict // "") end' "${vars.work_dir}/label-result.txt" 2>/dev/null)" = PASS ||
           { echo "kk-collect.label.confidence-refused: verdict '$(jq -r '.verdict // "<none>"' "${vars.work_dir}/label-result.txt" 2>/dev/null)' carries confidence '$(jq -r '.confidence // "<absent>"' "${vars.work_dir}/label-result.txt" 2>/dev/null)', not HIGH|MEDIUM|LOW" >&2; false; }

package/plugins/kk/workflows/kk-daily-ai-voice.yaml

@@ -21,7 +21,9 @@ vars:
   limit: "10"
   language: "zh"
   voice_profile: "robin-news"
-  # Voice driver switch — voicebox (voice-gen) | ominivoice (omni-voice-gen) | gemini (gemini-tts).
+  # Voice driver switch — voicebox (voice-gen) | ominivoice (omni-voice-gen) | gemini (gemini-tts)
+  # | voxcpm (voxcpm-tts, opt-in; ADR-036). VoxCPM never probes Gemini and never falls back; its
+  # 5.6 字/秒 spoken-rate estimate is PROVISIONAL until 0258 measures a real render.
   # 20260917 introduced the switch; 20260920 flipped default to voicebox after an operator A/B;
   # 20260929 operator override: gemini-tts is the default again (verified live on this machine —
   # robin-news replicated profile, GEMINI_API_KEY + GEMINI_TTS_MODEL via ~/.config/kk/config.yaml
@@ -400,7 +402,7 @@ states:
             kk stage daily-wrap-docs "${vars.work_dir}" "${vars.run_date}" "${vars.voice_profile}"
 
   - id: generate
-    description: "Invoke voice driver plugin (vdriver var: ominivoice -> omni-voice-gen, voicebox -> voice-gen, gemini -> gemini-tts) to generate audio"
+    description: "Invoke voice driver plugin (vdriver var: ominivoice -> omni-voice-gen, voicebox -> voice-gen, gemini -> gemini-tts, voxcpm -> voxcpm-tts) to generate audio"
     onEnter:
       - kind: shell
         options: