@gobing-ai/knowledge-kit 0.1.11 → 0.1.12

package/plugins/kk/skills/smart-seo/SKILL.md

@@ -6,6 +6,7 @@ description: >-
   this saved audit", "explain these SEO findings", or "check GEO readiness". Read-only results: no
   site mutation, no ranking and no citation promises.
 version: 0.1.0
+requires: [cli:kk, cli:spur, local-fs]
 ---
 
 # smart-seo — evidence-grounded SEO/GEO audits

package/plugins/kk/skills/storm-research/SKILL.md

@@ -8,6 +8,7 @@ description: >-
   (prepare → ingest → generate → render) over the 0056 works layout. Research is separate from
   authoring: topic owns init→outline→draft and this skill never merges into topic.
 version: 0.1.0
+requires: [cli:kk, local-fs]
 ---
 
 # storm-research — STORM daily research (topic sentence XOR markdown file → content.md)

package/plugins/kk/skills/taste-unslop/SKILL.md

@@ -5,6 +5,7 @@ description: >-
   voice and substance — "make this sound human", "remove the AI tells", "audit this
   copy for canned patterns", "restore my voice after AI editing". Not for code,
   translation-only work, or proofreading that must preserve style.
+requires: [local-fs]
 ---
 
 # taste-unslop

package/plugins/kk/skills/topic/SKILL.md

@@ -7,6 +7,7 @@ description: >-
   Runs the topic-core authoring loop (init → outline → draft) through four
   operations with explicit operator gates and safe resume. knowledge-kit's
   cohesive topic-authoring core, harvested from the WT 7-stage wrappers.
+requires: [cli:kk, cli:spur, local-fs]
 ---
 
 # topic — topic-core authoring (create | init | outline | draft)

package/plugins/kk/skills/web-automation/SKILL.md

@@ -9,6 +9,7 @@ description: >-
   web-automation skill. Owns method and evidence; transport stays in kk
   plugins; orchestration is a @gobing-ai/ts-dual-workflow-engine
   transition-flow (see docs/design/web-automation-engine.md).
+requires: [cli:spur, local-fs]
 ---
 
 # web-automation — discover, enhance, automate with a real browser

package/plugins/kk/skills/xhs-images/SKILL.md

@@ -7,6 +7,7 @@ description: >-
   closing) grounded in the source, renders them through the image-gen executor
   with the xhs-card/xhs-knowledge presets, packages a publishable Content, and
   hands off to kk:publish channel xhs. Never publishes directly.
+requires: [cli:kk, local-fs]
 ---
 
 # xhs-images — source-grounded XHS card series (plan → render → package → handoff)

package/plugins/kk/workflows/kk-daily-ai-voice2.yaml

@@ -509,7 +509,7 @@ nodes:
     # 0238 R3: reads 21-plan/<date>_03_plan_plan.json, so it must not start before the plan
     # producers settle. `script-style` stays first in the list: a done dependency in the mix keeps
     # this node runnable when the plan-authoring nodes are disabled (all-skipped deps skip a node).
-    dependsOn: [script-style, plan-translate, plan-translate-retry]
+    dependsOn: [script-style, plan-translate, plan-translate-retry, article]
     condition:
       kind: shell
       options:
@@ -620,8 +620,8 @@ nodes:
           kk store pool-count "${vars.work_dir}/21-plan/${vars.run_date}_04_quality-control-content_candidates.json" --min 1
     action:
       kind: shell
+      onError: continue
       options:
-        onError: continue
         command: >-
           OMNIVOICE_SPEED=1.06 kk stage daily-generate "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.transcode_mp3}" "${vars.vdriver}" "1" "${vars.episode_max_minutes}" "${vars.episode_min_minutes}"
 
@@ -641,8 +641,8 @@ nodes:
           && ! jq -e '(.metadata.generator == "kk:voxcpm-tts" or .metadata.generator == "kk:gemini-tts") and .metadata.qc.passed == true' "${vars.work_dir}/30-audio/${vars.run_date}_11_generate_content.json"
     action:
       kind: shell
+      onError: continue
       options:
-        onError: continue
         command: >-
           kk stage daily-generate "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.transcode_mp3}" "gemini" "1" "${vars.episode_max_minutes}" "${vars.episode_min_minutes}"
 
@@ -829,7 +829,9 @@ nodes:
 
   - id: translate
     description: >-
-      Agent translates both scaffolded locale drafts in place. The two draft paths are read from the
+      Agent translates both scaffolded locale drafts into <run_date>_21_translate_<locale>.md under the
+      work dir (2026-11-04: both executor sandboxes refuse writes into the Surfdash checkout, and the
+      step still exits 0); translate-refine installs them over the drafts. The two draft paths are read from the
       marker files at their fixed paths (no var projection after the fan-out: concurrent setVars is
       last-writer-wins, design §6), and an empty marker means that locale is absent. The local
       validation node gates final Surfdash publish so its strict all-locale CMS policy is met.
@@ -856,11 +858,11 @@ nodes:
           Translate the en/ja draft posts of the zh article. Read the two marker files at these fixed paths — each holds one draft path, or is empty when that locale was not scaffolded:
           English: ${vars.work_dir}/31-publish/${vars.run_date}_20_translate-localize_en-post-path.txt
           Japanese: ${vars.work_dir}/31-publish/${vars.run_date}_20_translate-localize_ja-post-path.txt
-          For each: if the marker is empty or unreadable, skip that locale. Otherwise edit the named file in place — translate the frontmatter title and the whole markdown body to natural English/Japanese respectively. Keep frontmatter keys, dates, URLs, code, and the assets/ image reference untouched. Set draft: false (the translated post publishes to the site) and remove any canonical: frontmatter line pointing at a different locale's URL.
+          For each: if the marker is empty or unreadable, skip that locale. Otherwise read the named draft but do NOT edit it (it sits in the Surfdash checkout, outside your writable workspace): write the complete translated file — frontmatter and body — to ${vars.work_dir}/31-publish/${vars.run_date}_21_translate_en.md (English) or ${vars.work_dir}/31-publish/${vars.run_date}_21_translate_ja.md (Japanese); a later stage installs it over the draft. Translate the frontmatter title and the whole markdown body to natural English/Japanese respectively. Keep frontmatter keys, dates, URLs, code, and the assets/ image reference untouched. Set draft: false (the translated post publishes to the site) and remove any canonical: frontmatter line pointing at a different locale's URL.
           Also translate these frontmatter values into the target locale, keeping all other keys untouched: description, seo_title, seo_description, and each key_points item. Each stays one coherent standalone sentence that summarizes the same story as the zh source — never splice fragments from different items or stories into one, and key_points must keep exactly the same number of items as the zh post. The 2026-10-23 run failed this: spliced description/key_points had to be hand-repaired before sync.
           Series names are fixed product identity, never invented or freely translated: the en series name is "Daily AI Stew" (show "Salty Talk"); the ja series name is "デイリーAIシチュー" (show "咸話咸説"). Never emit 毎日AIブレンド, ごった煮, "Daily AI Medley", "hodgepodge", "Daily AI Briefing", or the zh name 每日AI乱炖 in en/ja prose or link text (a URL keeps whatever it contains). Openers: en "Your Daily AI Stew from Robin, on Salty Talk."; ja "咸話咸説のデイリーAIシチュー、Robin がお届けします。" Listen links: en "[listen to Daily AI Stew · <date>](<url>)", ja "[デイリーAIシチュー · <date> を聴く](<url>)". In each key_points item keep the "Label — sentence" shape: the label before " — " stays a short phrase of at most 14 characters (ja) / 28 (en), never truncated with "…". The local translate-validate stage rewrites known retired names deterministically and fails the publish gate on leftovers.
           Keep frontmatter valid YAML: double-quote any value containing ': '. Read the surfdash translator glossary if present at the surfdash checkout root under .agents/skills/surfdash-translator/glossary.md and apply its terminology.
-          Do not wait for operator confirmation. Each edited file must end fully in its target language.
+          Do not wait for operator confirmation. Each written file must end fully in its target language.
 
   # 2026-10-24: the locale translation carried `onError: continue` with NO retry sibling, so a
   # failed executor left the en/ja drafts untranslated and the old sync stage could not distinguish
@@ -874,7 +876,7 @@ nodes:
       options:
         command: >-
           test "$(cat "${vars.work_dir}/31-publish/${vars.run_date}_20_translate-localize_zh-post-path.txt" 2>/dev/null)" != ""
-          && { for L in en ja; do M="${vars.work_dir}/31-publish/${vars.run_date}_20_translate-localize_$L-post-path.txt"; P="$(cat "$M" 2>/dev/null)"; [ -z "$P" ] && continue; grep -q '^draft: *false' "$P" || { echo "untranslated: $L ($P)"; exit 0; }; done; exit 1; }
+          && { for L in en ja; do M="${vars.work_dir}/31-publish/${vars.run_date}_20_translate-localize_$L-post-path.txt"; P="$(cat "$M" 2>/dev/null)"; [ -z "$P" ] && continue; O="${vars.work_dir}/31-publish/${vars.run_date}_21_translate_$L.md"; grep -q '^draft: *false' "$O" || { echo "untranslated: $L ($O)"; exit 0; }; done; exit 1; }
     action:
       kind: agent.run
       options:

package/plugins/kk/workflows/kk-daily-ai-voice3.yaml

@@ -24,6 +24,12 @@ vars:
   publish_window: "after-generate"
   publish_preset: ""
   publish_dummy: "false"
+  # 0334 R7: opt-in live consent channel, forwarded verbatim to the nested publish3
+  # `live_channels`. Empty by default — this variable alone can never produce a live send
+  # (ADR-022: only an operator launch that sets it, with tokens the plan stage validates
+  # against the window, promotes rows; `publish_dummy=true` and a non-empty token list
+  # refuse each other at plan time).
+  publish_live_channels: ""
   # Composed by the `prepare` node (`kk daily prepare`), then read back into vars through the
   # single-node read chain below — shell actions cannot set vars, and a concurrent `setVars` merge
   # is last-writer-wins, so the DAG exchanges data by fixed paths under work_dir, never by vars.
@@ -140,6 +146,7 @@ nodes:
         command: >-
           kk stage daily-preflight plugins/kk/workflows/kk-daily-ai-voice2.yaml
           plugins/kk/workflows/kk-daily-safety.yaml
+          plugins/kk/workflows/kk-daily-publish3.yaml
           && kk daily prepare --workflow kk-daily-ai-voice2 --run-date "${vars.run_date}" --ledger-sync
           --run "${vars.__runId}" --definition-digest "${vars.__definitionDigest}"
           --setting window="${vars.window}" --setting language="${vars.language}" --setting vdriver="${vars.vdriver}"
@@ -243,6 +250,31 @@ nodes:
         command: >-
           kk stage daily-qc-content "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.qc_categories}" "${vars.qc_min_quality}" "${vars.qc_min_importance}" "${vars.qc_min_urgency}" "${vars.qc_min_impact}" "${vars.qc_min_episode_items}" "${vars.episode_min_minutes}" "${vars.vdriver}"
 
+  # One guard for the whole pool (0324 R3; 0329 F01/F15): it sits right after `qc-content`, in
+  # front of every token reader, and NEVER exits non-zero — in this engine a failed dependency
+  # never releases its dependents, so a failing gate on an empty pool wedges the graph into
+  # dag-unreachable and turns a thin day into a failed run. The token carries the verdict
+  # instead: PASS opens the content fan-out, EMPTY makes every token-gated node skip, and the
+  # run still closes `done` with a no-content run report.
+  - id: pool-gate
+    description: >-
+      The single pool guard (0324 R3, 0329): `kk store pool-count --min 1` over the candidates
+      file that `qc-content` wrote, recorded once as a token at
+      `.spur/run/<runId>-pool-gate.status`. A token, not a bare dependency, because the engine
+      skips a node only when ALL its dependencies were skipped — so a failed gate beside a done
+      dependency would still admit the node. The gate itself always exits 0 (0329: an empty pool
+      is a no-content day, not a failed run).
+    dependsOn: [qc-content]
+    action:
+      kind: shell
+      options:
+        command: >-
+          OUT=".spur/run/${vars.__runId}-pool-gate.status";
+          mkdir -p "$(dirname "$OUT")";
+          if kk store pool-count "${vars.work_dir}/21-plan/${vars.run_date}_04_quality-control-content_candidates.json" --min 1;
+          then echo PASS > "$OUT";
+          else echo EMPTY > "$OUT"; rm -f "${vars.work_dir}/bundle.json"; fi
+
   - id: select
     description: >-
       Record today's planned set in the store's topic-scoped `selections` ledger (0228). It runs at
@@ -250,7 +282,7 @@ nodes:
       depends on the DAG reaching its tail: a run that fails, pauses at review or skips publish still
       excludes what it planned. Guarded on the QC candidates — a pool that filtered to zero items
       selects nothing.
-    dependsOn: [qc-content]
+    dependsOn: [qc-content, pool-gate]
     condition:
       kind: shell
       options:
@@ -275,7 +307,7 @@ nodes:
 
   - id: plan-translate
     description: "Translate the needsTranslation plan items into the output plan.json via agent.run; onError: continue — plan-translate-retry below is the loud gate (0238 R2)"
-    dependsOn: [qc-content]
+    dependsOn: [qc-content, pool-gate]
     condition:
       kind: shell
       options:
@@ -315,7 +347,7 @@ nodes:
       VALID expectFile (missing or contract-violating JSON), retries the same input on a different
       tier, and carries NO onError — a second miss fails the run loudly instead of letting an
       untranslated or truncated plan flow downstream.
-    dependsOn: [plan-translate]
+    dependsOn: [plan-translate, pool-gate]
     condition:
       kind: shell
       options:
@@ -335,7 +367,7 @@ nodes:
 
   - id: article-write
     description: "Write the tech-sharing prose article from the translated plan via agent.run (3-format split: surfdash gets prose, not a news list); onError: continue — article-write-retry below is the loud gate (0238 R2)"
-    dependsOn: [qc-content, plan-translate, plan-translate-retry]
+    dependsOn: [qc-content, plan-translate, plan-translate-retry, pool-gate]
     condition:
       kind: shell
       options:
@@ -369,7 +401,7 @@ nodes:
       Bounded recovery for article-write (0238 R2): runs only when the primary settled without its
       expectFile, retries the same input on a different tier, and carries NO onError — a second miss
       fails the run loudly instead of publishing an article nobody wrote.
-    dependsOn: [article-write]
+    dependsOn: [article-write, pool-gate]
     condition:
       kind: shell
       options:
@@ -394,7 +426,7 @@ nodes:
       this node: a done dependency in the mix keeps it runnable) as well as on both authoring nodes
       AND their retry siblings, and it carries the same candidates guard — a pool that filtered to
       zero items must not build an empty article.
-    dependsOn: [qc-content, plan-translate, plan-translate-retry, article-write, article-write-retry]
+    dependsOn: [qc-content, plan-translate, plan-translate-retry, article-write, article-write-retry, pool-gate]
     condition:
       kind: shell
       options:
@@ -411,7 +443,7 @@ nodes:
     # 0238 R3: reads 21-plan/<date>_03_plan_plan.json, so it must not start before the plan
     # producers settle. `qc-content` stays in the list: a done dependency in the mix keeps this node
     # runnable when the plan-authoring nodes are disabled (all-skipped deps skip a node).
-    dependsOn: [qc-content, plan-translate, plan-translate-retry]
+    dependsOn: [qc-content, plan-translate, plan-translate-retry, pool-gate]
     condition:
       kind: shell
       options:
@@ -458,7 +490,7 @@ nodes:
 
   - id: script-style
     description: "Snapshot the shipped zh style contract into the work dir (separate node: it is also an audit input for the revision loop)"
-    dependsOn: [qc-content]
+    dependsOn: [qc-content, pool-gate]
     condition:
       kind: shell
       options:
@@ -475,7 +507,7 @@ nodes:
     # 0238 R3: reads 21-plan/<date>_03_plan_plan.json, so it must not start before the plan
     # producers settle. `script-style` stays first in the list: a done dependency in the mix keeps
     # this node runnable when the plan-authoring nodes are disabled (all-skipped deps skip a node).
-    dependsOn: [script-style, plan-translate, plan-translate-retry]
+    dependsOn: [script-style, plan-translate, plan-translate-retry, article, pool-gate]
     condition:
       kind: shell
       options:
@@ -505,7 +537,7 @@ nodes:
       Compile the episode plan Doc[] into structured broadcast VoiceScript YAML Content. Depends on
       `article` so the node still runs when the plan-authoring nodes were disabled or skipped (the
       builder falls back to templates) — but not when the whole content branch is skipped.
-    dependsOn: [article, script-style, script-write]
+    dependsOn: [article, script-style, script-write, pool-gate]
     condition:
       kind: shell
       options:
@@ -558,7 +590,7 @@ nodes:
 
   - id: wrap-docs
     description: "Wrap VoiceScript into Doc[] input for the voice generator plugin (the generate-side variant input)"
-    dependsOn: [script, review]
+    dependsOn: [script, review, pool-gate]
     condition:
       kind: shell
       options:
@@ -574,7 +606,7 @@ nodes:
     description: "Voice tier, primary driver (vars.vdriver — voxcpm; its 40 ms lattice is known and monitored, see the vdriver comment). onError: continue — the fallback siblings below are the loud chain (same pattern as 0238 R2)."
     # wrap-docs is a data dependency, not a sibling: daily-generate reads its _10_wrap-docs_docs.json
     # as the TTS input. Without this edge the two nodes race in the same wave (0212 dogfood finding).
-    dependsOn: [script, safety, review, wrap-docs]
+    dependsOn: [script, safety, review, wrap-docs, pool-gate]
     condition:
       kind: shell
       options:
@@ -582,8 +614,8 @@ nodes:
         command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
+      onError: continue
       options:
-        onError: continue
         command: >-
           OMNIVOICE_SPEED=1.06 kk stage daily-generate "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.transcode_mp3}" "${vars.vdriver}" "1" "${vars.episode_max_minutes}" "${vars.episode_min_minutes}"
 
@@ -595,7 +627,7 @@ nodes:
 
   - id: generate-fallback
     description: "Voice tier fallback 1: gemini (gemini-tts) when the primary driver left no valid Content — the measured-dry escape hatch from voxcpm's lattice"
-    dependsOn: [generate]
+    dependsOn: [generate, pool-gate]
     condition:
       kind: shell
       options:
@@ -605,14 +637,14 @@ nodes:
           && ! jq -e '(.metadata.generator == "kk:voxcpm-tts" or .metadata.generator == "kk:gemini-tts") and .metadata.qc.passed == true' "${vars.work_dir}/30-audio/${vars.run_date}_11_generate_content.json"
     action:
       kind: shell
+      onError: continue
       options:
-        onError: continue
         command: >-
           kk stage daily-generate "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.transcode_mp3}" "gemini" "1" "${vars.episode_max_minutes}" "${vars.episode_min_minutes}"
 
   - id: generate-fallback2
     description: "Voice tier fallback 2 (last, loud): omni-voice-gen when neither voxcpm nor gemini delivered"
-    dependsOn: [generate-fallback]
+    dependsOn: [generate-fallback, pool-gate]
     condition:
       kind: shell
       options:
@@ -626,9 +658,17 @@ nodes:
         command: >-
           OMNIVOICE_SPEED=1.06 kk stage daily-generate "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.transcode_mp3}" "ominivoice" "1" "${vars.episode_max_minutes}" "${vars.episode_min_minutes}"
 
+  # 0329 F15: a script-gate refusal produces no audio, but the sting must not fail the day —
+  # the refusal artifact admits intro (and duration closes the run as no-content on it).
   - id: intro
     description: "Prepend the 8s intro sting (intro_music var; empty = skip), update duration/audioPath"
     dependsOn: [generate, generate-fallback, generate-fallback2]
+    condition:
+      kind: shell
+      options:
+        command: >-
+          test -f "${vars.work_dir}/30-audio/${vars.run_date}_11_generate_content.json"
+          -o -f "${vars.work_dir}/30-audio/${vars.run_date}_11_generate_content_duration-refusal.json"
     action:
       kind: shell
       options:
@@ -658,32 +698,39 @@ nodes:
         onError: continue
 
   - id: duration
-    description: "Measured duration gate: under episode_min_minutes the run refuses and closes as no-content (refusal artifact + emptied candidates, exit 0 — 0266); above episode_max_minutes it still fails loud. Duration is authoritative."
+    description: "Measured duration gate: under episode_min_minutes the run refuses and closes as no-content (refusal artifact + emptied candidates + publish-path invalidation, exit 0 — 0266/0329); above episode_max_minutes it still fails loud. Duration is authoritative."
     dependsOn: [intro]
     action:
       kind: shell
       options:
         command: >-
-          kk stage daily-episode-duration "${vars.work_dir}" "${vars.run_date}" "${vars.episode_min_minutes}" "${vars.episode_max_minutes}" "${vars.vdriver}"
+          kk stage daily-episode-duration "${vars.work_dir}" "${vars.run_date}" "${vars.episode_min_minutes}" "${vars.episode_max_minutes}" "${vars.vdriver}" "${vars.__runId}"
 
   - id: quality
     description: >-
-      Verify audio quality, speech rate, and silence/repetition QC metrics over the assembled
-      episode. Depends on the audio tail and wrap-docs: voice3 no longer packages a publish-prep
-      Content, so the audited bytes are the generated episode itself.
-    dependsOn: [duration, wrap-docs]
+      Print the daily QC table (daily-quality-report) and then gate on it (0329 F23): the print
+      alone never gated anything — a 41/100 episode sailed into show-notes, the bundle and the
+      publish windows. The verdict stage fails loud when the generator's audio qc verdict is
+      missing or `passed` is false, so a bad episode dies here instead of at a tier-0 send.
+    dependsOn: [duration, wrap-docs, pool-gate]
+    condition:
+      kind: shell
+      options:
+        # 0324 R3: the pool verdict is `pool-gate`'s token, never a repeated `kk store pool-count`.
+        command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
       options:
         command: >-
           kk stage daily-quality-report "${vars.work_dir}" "${vars.run_date}"
+          && kk stage run daily-quality-verdict "${vars.work_dir}" "${vars.run_date}"
 
   - id: show-notes
     description: >-
       Render timeline show notes from the episode plan — content, not publishing: the publish half
       ships them as the episode variant's `metadata.showNotes`, and the link placeholders stay
       unresolved until a send resolves them."
-    dependsOn: [quality]
+    dependsOn: [quality, pool-gate]
     condition:
       kind: shell
       options:
@@ -694,13 +741,36 @@ nodes:
       options:
         command: >-
           kk stage daily-show-notes "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}" "${vars.title}"
+
+  # 0329 F02: voice3 lost daily-publish-prep in the migration (voice2 keeps it at its :704), so
+  # `31-publish/<date>_13_publish-prep_content.json` — the episode variant's source — was never
+  # written by this workflow, and a freeze only succeeded against a stale same-day voice2 prep
+  # file. Rebuilt per the voice2 template: after duration (it reads the generate content's
+  # mp3Path, and ID3 stamps must land on the final post-intro MP3), pool-gated so a refused
+  # episode packages nothing.
+  - id: publish-prep
+    description: >-
+      Package the publish-ready episode Content (ID3 tags on the final post-intro MP3, cover
+      path, article link) into 31-publish/<date>_13_publish-prep_content.json — the episode
+      variant's source for bundle-variants.
+    dependsOn: [duration, article, safety, pool-gate]
+    condition:
+      kind: shell
+      options:
+        # 0324 R3: the pool verdict is `pool-gate`'s token, never a repeated `kk store pool-count`.
+        command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
+    action:
+      kind: shell
+      options:
+        command: >-
+          kk stage daily-publish-prep "${vars.work_dir}" "${vars.run_date}" "${vars.podcast_artist}" "${vars.podcast_album}"
   - id: cards-write
     description: "Plan the card series across the episode's plan items via agent.run; onError: continue — a failed plan skips the card series, never the run"
     dependsOn: [script, review, pool-gate]
     condition:
       kind: shell
       options:
-        command: 'test "${vars.cards_enabled}" = "true"'
+        command: 'test "${vars.cards_enabled}" = "true" && test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: agent.run
       onError: continue
@@ -720,14 +790,14 @@ nodes:
 
   - id: cards-render
     description: "Render the card series through the pinned xhs-card/xhs-knowledge presets, attach the episode cover last and pair every image with its numbered line (0235 note_scope=episode); onError: continue — the publish node names the missing series and stays soft"
-    dependsOn: [cards-write]
+    dependsOn: [cards-write, pool-gate]
     # A skipped cards-write still admits its dependents, so each card node keeps its own switch:
     # without it a run with cards_enabled=false would re-package a stale same-day 25-xhs/ series.
     # The pool guard is `pool-gate`'s alone in voice3 (0324 R3).
     condition:
       kind: shell
       options:
-        command: 'test "${vars.cards_enabled}" = "true"'
+        command: 'test "${vars.cards_enabled}" = "true" && test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
       onError: continue
@@ -737,31 +807,12 @@ nodes:
 
   # ---- generate-side payloads and the frozen bundle (0324 R2/R3) ----
 
-  # One guard for the whole pool (0324 R3): every node that used to repeat `kk store pool-count`
-  # depends on this one, so a refused pool empties the candidates file once and the rest of the
-  # graph skips through the engine's all-deps-skipped rule.
-  - id: pool-gate
-    description: >-
-      The single pool guard (0324 R3): `kk store pool-count --min 1` over the candidates file that
-      `qc-content` wrote, recorded once as a token at `.spur/run/<runId>-pool-gate.status`. voice2
-      repeated the same guard on twenty-one conditions. A token, not a bare dependency, because the
-      engine skips a node only when ALL its dependencies were skipped — so a failed gate beside a
-      done dependency would still admit the node. Everything downstream reads the token.
-    dependsOn: [qc-content]
-    action:
-      kind: shell
-      options:
-        command: >-
-          OUT=".spur/run/${vars.__runId}-pool-gate.status";
-          if kk store pool-count "${vars.work_dir}/21-plan/${vars.run_date}_04_quality-control-content_candidates.json" --min 1;
-          then echo PASS > "$OUT";
-          else echo EMPTY > "$OUT"; exit 1; fi
-
   - id: social-write
     description: >-
-      Author one short post per social platform (x, weibo, threads) from the approved plan, in zh,
-      inside each platform's character cap. `daily-bundle-variants` truncates as a backstop, so a
-      missed cap degrades rather than fails; a missing file simply skips that platform's variant.
+      Author one short post per social platform (x, weibo, threads, linkedin) from the approved
+      plan, in zh, inside each platform's character cap. `daily-bundle-variants` truncates as a
+      backstop, so a missed cap degrades rather than fails; a missing file simply skips that
+      platform's variant.
     dependsOn: [quality]
     action:
       kind: agent.run
@@ -771,10 +822,11 @@ nodes:
         agent: ${vars.agent}
         input: |
           Read the approved episode plan at ${vars.work_dir}/21-plan/${vars.run_date}_03_plan_plan.json.
-          Write three short zh posts, one per file:
+          Write four short zh posts, one per file:
           - ${vars.work_dir}/26-social/x.md — at most 280 weighted characters (this feed counts CJK as 2, so ~140 汉字 or 280 Latin letters)
           - ${vars.work_dir}/26-social/weibo.md — at most 2000 characters
           - ${vars.work_dir}/26-social/threads.md — at most 500 characters
+          - ${vars.work_dir}/26-social/linkedin.md — at most 3000 characters
           Each post: the day's single most interesting item, one concrete number or name from the
           plan, no hashtag spam, no emoji, no "点击链接", no invented facts. Plain text, no markdown
           headings. Deliver with your file-write tool; each file must be non-empty.
@@ -784,35 +836,83 @@ nodes:
     description: >-
       Build the channel payloads from the run's own artifacts (0327 builders): `30-variants/<key>`
       for article / episode / cards plus the channel-specific keys and the social posts, all with
-      `{{article_url}}` / `{{podcast_url}}` placeholders because nothing is published yet.
-    dependsOn: [quality, social-write]
+      `{{article_url}}` / `{{podcast_url}}` placeholders because nothing is published yet. 0329
+      F16: depends on every producer it reads (the 0324 file order alone was not a guarantee),
+      wipes stale variants first, and follows the cards/cover switches so a disabled producer's
+      variant is a skip, not a stale re-read.
+    dependsOn: [quality, social-write, publish-prep, cover-normalize, cards-render, pool-gate]
+    condition:
+      kind: shell
+      options:
+        # 0324 R3: the pool verdict is `pool-gate`'s token, never a repeated `kk store pool-count`.
+        command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
       options:
         command: >-
           kk stage run daily-bundle-variants "${vars.work_dir}" "${vars.run_date}" "${vars.plugins_path}"
+          "${vars.cards_enabled}" "${vars.cover_enabled}"
+
+  - id: safety-variants
+    description: >-
+      Final-variant safety review through the same nested kk-daily-safety machine (0331): the
+      manifest stage registers every `30-variants/*.content.json` first, then the machine runs in
+      the variants scope (`safety_scope_dir=4-safety-variants` re-roots its stages, guards and
+      prompts; the drafts review above is untouched). On an admitted outcome the machine leaves
+      `4-safety-variants/safety.json` — status, exclusion record and the sha256 of every reviewed
+      variant's current bytes — which publish-matrix-bundle freezes into the bundle so live
+      launches and social edits are gated on exactly the reviewed bytes. Fails closed: a block or
+      an integrity failure fails this node (the drafts scope's non-zero = never publish contract).
+    dependsOn: [bundle-variants, pool-gate]
+    condition:
+      kind: shell
+      options:
+        # 0324 R3: the pool verdict is `pool-gate`'s token, never a repeated `kk store pool-count`.
+        command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
+    action:
+      kind: shell
+      options:
+        command: >-
+          kk stage run daily-safety-manifest "${vars.work_dir}" "${vars.run_date}" &&
+          env -u SPUR_WORKFLOW_RUN_ACTIVE -u SPUR_EXPECTED_DEFINITION_DIGEST
+          spur workflow run plugins/kk/workflows/kk-daily-safety.yaml
+          --vars "{\"work_dir\":\"${vars.work_dir}\",\"run_date\":\"${vars.run_date}\",\"safety_max_revise\":\"${vars.safety_max_revise}\",\"safety_platforms\":\"${vars.safety_platforms}\",\"agent\":\"${vars.agent}\",\"safety_scope_dir\":\"4-safety-variants\"}"
+          --quiet --no-plan
 
   - id: bundle-freeze
     description: >-
       Freeze `bundle.json` (0321 `BundleSchema`): every `30-variants/*` file with its sha256 plus the
       episode title, so the publish half can run later, or three times a day, against exactly these
       bytes. Fails when the article or episode variant is missing — a bundle never advertises what
-      generate did not produce.
-    dependsOn: [bundle-variants]
+      generate did not produce. 0329 F15: token-gated, so a refused episode never freezes — the
+      duration gate also drops this run's bundle.json on a refusal. 0331: after safety-variants, so
+      the freeze reads the review's evidence (or the bundle stays without it, on a skipped run).
+    dependsOn: [bundle-variants, safety-variants, pool-gate]
+    condition:
+      kind: shell
+      options:
+        # 0324 R3: the pool verdict is `pool-gate`'s token, never a repeated `kk store pool-count`.
+        command: 'test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
       options:
         command: >-
-          kk stage run publish-matrix-bundle "${vars.work_dir}" --run-date "${vars.run_date}" --run-id "${vars.__runId}"
+          case "${vars.publish_preset}" in '') ARGS='' ;; *) ARGS="--preset ${vars.publish_preset}" ;; esac;
+          kk stage run publish-matrix-bundle "${vars.work_dir}" --run-date "${vars.run_date}" --run-id "${vars.__runId}" $ARGS
 
   - id: generation-report
-    description: "The generate half's report (the publish half writes its own, per window)."
-    dependsOn: [bundle-freeze]
+    description: "The generate half's report (the publish half writes its own, per window). 0329 F15: real run-report flags — the phantom skip flag made every invocation exit 1; the pool/candidates/qc inputs are what let the report record a no-content close. Depends on pool-gate beside bundle-freeze: pool-gate always completes, so the report (and the ledger after it) also land on a no-content close — the design requires the report reachable from extract/QC/no-content, not only bundle-freeze."
+    dependsOn: [bundle-freeze, pool-gate]
     action:
       kind: shell
       options:
         command: >-
-          kk daily run-report --work-dir "${vars.work_dir}" --run-date "${vars.run_date}" --skip-store
+          kk daily run-report --work-dir "${vars.work_dir}" --run-date "${vars.run_date}"
+          --pool "${vars.work_dir}/10-collect/pool.json"
+          --candidates "${vars.work_dir}/21-plan/${vars.run_date}_04_quality-control-content_candidates.json"
+          --plugins-path "${vars.plugins_path}"
+          --qc-min-quality "${vars.qc_min_quality}" --qc-min-importance "${vars.qc_min_importance}"
+          --qc-min-urgency "${vars.qc_min_urgency}" --qc-min-impact "${vars.qc_min_impact}"
 
   - id: publish
     description: >-
@@ -820,18 +920,18 @@ nodes:
       window against the bundle this run just froze. The launcher vars are stripped at the nested
       boundary (the same two voice2 strips for the safety machine), and the nested run's exit code is
       surfaced — a failed publish window is a failed generate run's last step, never a silent one.
-    dependsOn: [generation-report]
+    dependsOn: [generation-report, pool-gate]
     condition:
       kind: shell
       options:
-        command: 'test "${vars.auto_publish}" = "true"'
+        command: 'test "${vars.auto_publish}" = "true" && test "$(cat ".spur/run/${vars.__runId}-pool-gate.status" 2>/dev/null)" = PASS'
     action:
       kind: shell
       options:
         command: >-
           env -u SPUR_WORKFLOW_RUN_ACTIVE -u SPUR_EXPECTED_DEFINITION_DIGEST
           spur workflow run plugins/kk/workflows/kk-daily-publish3.yaml
-          --vars "{\"work_dir\":\"${vars.work_dir}\",\"run_date\":\"${vars.run_date}\",\"window\":\"${vars.publish_window}\",\"preset\":\"${vars.publish_preset}\",\"dummy\":\"${vars.publish_dummy}\"}"
+          --vars "{\"work_dir\":\"${vars.work_dir}\",\"run_date\":\"${vars.run_date}\",\"window\":\"${vars.publish_window}\",\"preset\":\"${vars.publish_preset}\",\"dummy\":\"${vars.publish_dummy}\",\"live_channels\":\"${vars.publish_live_channels}\"}"
 
   - id: ledger
     description: "Append this run to the workflow ledger; bookkeeping never fails a generation."