@hongmaple0820/med-scale-research-os 0.43.0

package/docs/workflow/templates/plan.md

@@ -0,0 +1,37 @@
+# Plan - {{TASK_ID}}
+
+Date: {{DATE}}
+Level: {{LEVEL}}
+
+## Scope / Boundary
+
+- In scope:
+- Out of scope / non-goals:
+
+## Approach
+
+1. TBD
+2. TBD
+3. TBD
+
+## Exception / Failure Paths
+
+- Expected failure:
+- Error handling:
+- Manual recovery:
+
+## Rollback / Fallback
+
+- Rollback:
+- Fallback:
+- Disable path:
+
+## Acceptance Criteria
+
+- TBD
+
+## Verification
+
+- `make gate-quality`
+- `make verify PROFILE=default`
+- `git diff --check`

package/docs/workflow/templates/pre-push-scale-preflight.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env sh
+set -eu
+
+if command -v scale >/dev/null 2>&1; then
+  scale preflight --service all
+else
+  npx @hongmaple0820/scale-engine@latest preflight --service all
+fi

package/docs/workflow/templates/product-smoke.md

@@ -0,0 +1,61 @@
+# Product Smoke
+
+## Real Product Path
+
+Describe the smallest end-to-end path that proves the change works through the real product boundary.
+
+Example:
+
+```text
+UI or client -> gateway/router -> service -> database/storage/queue -> observable result
+```
+
+Do not use a green health endpoint as the only proof when the user-facing path depends on routing, authentication, storage, async tasks, browser behavior, or third-party integration.
+
+## Quick Setup
+
+1. Open `.scale/product-smoke.json`.
+2. Replace the example command with one real product path command.
+3. Set that probe's `enabled` field to `true`.
+4. Run `scale preflight --profile productSmoke --json`.
+5. Run `scale runtime final-check --level M --json`.
+
+`status: "skipped"` means no real product path was exercised. It does not count as completion evidence.
+
+## Setup
+
+- Base URL:
+- Test user or tenant:
+- Required fixtures:
+- Services that must be running:
+
+## Smoke Commands
+
+| Command | Expected Result | Evidence Artifact |
+| --- | --- | --- |
+| TBD | TBD | TBD |
+
+## Runtime Evidence
+
+Record at least one runtime evidence item:
+
+```bash
+scale runtime record \
+  --kind command \
+  --title "Product smoke: <flow>" \
+  --status passed \
+  --command "<exact smoke command>" \
+  --exit-code 0 \
+  --summary "<business result, task id, status, or observable output>" \
+  --artifacts ".agent/logs/<service>/<smoke>.json" \
+  --metadata-json '{"productSmoke":true,"realProductPath":true}'
+```
+
+## Assertions
+
+- [ ] Request crossed the real product boundary, not only an isolated unit.
+- [ ] Authentication or user identity path was exercised when relevant.
+- [ ] Persistence/storage/queue side effect was verified when relevant.
+- [ ] Async task or eventual state was polled to terminal status when relevant.
+- [ ] Failure output is specific enough to diagnose the failing layer.
+- [ ] Runtime artifacts are ignored or deliberately promoted according to resource governance.

package/docs/workflow/templates/reality-check.md

@@ -0,0 +1,28 @@
+# Reality Check - {{TASK_ID}}
+
+Date: {{DATE}}
+Level: {{LEVEL}}
+
+## Confirmed
+
+- TBD
+
+## Not Verified
+
+- TBD
+
+## Stub / Fake / Partial
+
+- TBD
+
+## Credential-Gated
+
+- TBD
+
+## Environment-Gated
+
+- TBD
+
+## User-Visible Risk
+
+- TBD

package/docs/workflow/templates/resource-cleanup.md

@@ -0,0 +1,17 @@
+# Resource Cleanup - {{TASK_ID}}
+
+Date: {{DATE}}
+Level: {{LEVEL}}
+
+## New Resources
+
+| Resource | Location | Keep / Move / Delete | Reason |
+| --- | --- | --- | --- |
+| TBD | TBD | TBD | TBD |
+
+## Docs Promotion
+
+- Promote to `docs/`:
+- Keep in `.planning/`:
+- Keep local under `.agent/`:
+- Delete before handoff:

package/docs/workflow/templates/resource-impact.md

@@ -0,0 +1,25 @@
+# Resource Impact
+
+## Resources Created
+
+| Path | Type | Git Policy | Retention |
+| --- | --- | --- | --- |
+| TBD | canonical-doc/task-artifact/evidence-report/temporary/reusable-script/generated-media/contract/decision-record | commit/ignore/lfs/external/review | TBD |
+
+## Resources Updated
+
+- TBD
+
+## Resources Promoted To Maintained Docs
+
+- TBD
+
+## Resources To Delete Or Archive Before Finish
+
+- TBD
+
+## Source Of Truth Updates
+
+- [ ] .scale/resource-policy.json
+- [ ] .scale/assets.json
+- [ ] docs/modules/<module>/README.md

package/docs/workflow/templates/review.md

@@ -0,0 +1,12 @@
+# Review - {{TASK_ID}}
+
+Date: {{DATE}}
+Level: {{LEVEL}}
+
+## Findings
+
+- TBD
+
+## Residual Risk
+
+- TBD

package/docs/workflow/templates/runtime.md

@@ -0,0 +1,23 @@
+# Runtime Contract - {{TASK_ID}}
+
+Date: {{DATE}}
+Level: {{LEVEL}}
+
+## Configuration Source
+
+- Source: TBD
+- Environment/profile: TBD
+- Local override file: TBD
+
+## Service Topology
+
+| Service | URL / Command | Config source | Auth mode | Status |
+| --- | --- | --- | --- | --- |
+| primary | TBD | TBD | TBD | Not checked |
+
+## Verification Boundary
+
+- Confirmed:
+- Not covered:
+- Requires external credentials:
+- Requires shared/cloud environment:

package/docs/workflow/templates/security-review.md

@@ -0,0 +1,26 @@
+# Security Review
+
+## Assets And Trust Boundaries
+
+TBD
+
+## Authorization Rules
+
+TBD
+
+## Abuse Cases
+
+1. TBD
+2. TBD
+3. TBD
+
+## Sensitive Data Impact
+
+TBD
+
+## Rollback Or Disable Strategy
+
+TBD
+
+## Final Verdict
+TBD

package/docs/workflow/templates/skill-evidence.md

@@ -0,0 +1,33 @@
+# Skill Evidence
+
+## Planned Skills
+
+- TBD
+
+## Tool Selection Rationale
+
+TBD
+
+## Used Skills
+
+| Skill | Phase | Trigger | Evidence | Status |
+| --- | --- | --- | --- | --- |
+| skill-id | plan/build/verify/review | why it was selected | command, screenshot, report, or artifact path | executed/skipped/fallback |
+
+## Browser Or Web Evidence
+
+| Tool | Target | Evidence | Result |
+| --- | --- | --- | --- |
+| web-access/agent-browser/Chrome DevTools MCP | URL or local target | screenshot, console log, network finding, source URL | passed/failed/skipped |
+
+## Desktop Or External CLI Evidence
+
+| Tool | Scope | Safety Boundary | Evidence | Result |
+| --- | --- | --- | --- | --- |
+| cua/codex/gemini/opencode/wps/wechat | command or app target | read-only/dry-run/test account/manual approval | output summary, screenshot, or report path | passed/failed/skipped |
+
+## Skipped Skills
+
+| Skill | Reason | Fallback Evidence |
+| --- | --- | --- |
+| skill-id | why it could not run | manual review, alternate command, or explicit risk |

package/docs/workflow/templates/skill-plan.md

@@ -0,0 +1,39 @@
+# Skill Plan
+
+## Detected Intents
+
+| Domain | Score | Evidence |
+| --- | ---: | --- |
+|  |  |  |
+
+## Required Skills
+
+- TBD
+
+## Recommended Skills
+
+- TBD
+
+## Required Artifacts
+
+- TBD
+
+## Required Verification Evidence
+
+- TBD
+
+## Tool Orchestration
+
+| Capability | Primary Tool Or Skill | Fallback | Required Evidence |
+| --- | --- | --- | --- |
+| UI/UX design | awesome-design-md, ui-ux-pro-max | frontend-design | design-system, ui-spec.md, visual-review.md |
+| Web research or logged-in pages | web-access | agent-browser, Chrome DevTools MCP | source citations, browser evidence |
+| Browser E2E | webapp-testing, Playwright | agent-browser, web-access | screenshot, console, network evidence |
+| Desktop GUI automation | CUA/computer-use | manual verification | desktop screenshot, operator-safety notes |
+| External agent CLI | codex/gemini/opencode CLI | manual review | version check, exact command output |
+
+## Skipped Skills
+
+| Skill | Reason | Fallback Evidence |
+| --- | --- | --- |
+|  |  |  |

package/docs/workflow/templates/spec.md

@@ -0,0 +1,17 @@
+# Spec - {{TASK_ID}}
+
+Date: {{DATE}}
+Level: {{LEVEL}}
+
+## What
+
+
+## Why
+
+
+## Boundaries
+
+
+## Acceptance Criteria
+
+- [ ] 

package/docs/workflow/templates/standards-impact.md

@@ -0,0 +1,28 @@
+# Standards Impact
+
+## Standards Checked
+
+- [ ] Logging and redaction
+- [ ] Architecture boundaries
+- [ ] ORM/database access
+- [ ] Framework/component conventions
+- [ ] UI/UX acceptance where user-facing
+- [ ] Test and verification rigor
+- [ ] Security-sensitive inputs and outputs
+
+## Findings
+
+| Severity | Rule | Path | Decision |
+| --- | --- | --- | --- |
+| TBD | TBD | TBD | fix/accept/escalate |
+
+## Policy Updates
+
+- [ ] .scale/engineering-standards.json
+- [ ] .scale/frameworks.json
+- [ ] docs/standards/
+
+## Settlement
+
+- Standards scan:
+- Standards doctor:

package/docs/workflow/templates/summary.md

@@ -0,0 +1,16 @@
+# Summary - {{TASK_ID}}
+
+Date: {{DATE}}
+Level: {{LEVEL}}
+
+## What Changed
+
+- TBD
+
+## Verification Result
+
+- TBD
+
+## Follow-up
+
+- TBD

package/docs/workflow/templates/tasks.md

@@ -0,0 +1,8 @@
+# Tasks - {{TASK_ID}}
+
+Date: {{DATE}}
+Level: {{LEVEL}}
+
+## Task List
+
+- [ ] 

package/docs/workflow/templates/ui-spec.md

@@ -0,0 +1,29 @@
+# UI Spec
+
+## User Goal
+
+TBD
+
+## Primary Flow
+
+TBD
+
+## Interaction States
+
+- Default:
+- Loading:
+- Empty:
+- Error:
+- Success:
+
+## Responsive Behavior
+
+TBD
+
+## Accessibility Requirements
+
+TBD
+
+## Acceptance Criteria
+
+- [ ] TBD

package/docs/workflow/templates/verification.md

@@ -0,0 +1,20 @@
+# Verification - {{TASK_ID}}
+
+Date: {{DATE}}
+Level: {{LEVEL}}
+
+## Commands Run
+
+- TBD
+
+## Passed
+
+- TBD
+
+## Failed / Blocked
+
+- TBD
+
+## Not Run
+
+- TBD

package/docs/workflow/templates/visual-review.md

@@ -0,0 +1,20 @@
+# Visual Review
+
+## Screenshots Or Evidence
+
+TBD
+
+## Layout And Responsiveness
+
+TBD
+
+## Text Fit And Overlap
+
+TBD
+
+## Accessibility Notes
+
+TBD
+
+## Final Verdict
+TBD

package/docs/zh/quickstart.md

@@ -0,0 +1,108 @@
+# MedSCALE Research OS 快速开始
+
+MedSCALE Research OS 是面向医学研究 Agent 工作流的本地操作系统。它把医学研究执行、质量门禁、事实核查、交付包审计、记忆播种和 Memory Brain 审核放进一个可复核的研究者视图。
+
+> 本项目不提供临床建议。所有医学结论都需要专家人工复核。
+
+## 30 秒本地启动
+
+```bash
+npm install
+npm run build
+npm run medscale -- doctor --json
+npm run medscale -- setup --lang zh
+npm run medscale -- setup --visual --lang zh
+npm run medscale -- dashboard
+```
+
+打开：
+
+```text
+http://127.0.0.1:18766
+```
+
+## 构建后入口
+
+```bash
+node dist/api/medscale.js doctor --json
+node dist/api/medscale.js setup --lang zh
+node dist/api/medscale.js setup --visual --lang zh
+node dist/api/medscale.js os-plan --json
+node dist/api/medscale.js dashboard
+```
+
+未来发布到 npm 后，目标入口是：
+
+```bash
+npx -y @hongmaple0820/med-scale-research-os setup --lang zh
+npx -y @hongmaple0820/med-scale-research-os setup --visual --lang zh
+npx -y @hongmaple0820/med-scale-research-os doctor --json
+npx -y @hongmaple0820/med-scale-research-os dashboard
+```
+
+## 常用命令
+
+```bash
+npm run medscale -- doctor --json
+npm run medscale -- setup --lang zh
+npm run medscale -- setup --visual --lang zh
+npm run medscale -- setup --lang en
+npm run medscale -- os-plan --json
+npm run medscale -- token report --json
+npm run medscale -- dashboard
+```
+
+Memory Brain learning candidate 审核：
+
+```bash
+npm run medscale -- memory-review approve --candidate-id <id> --json
+npm run medscale -- memory-review reject --candidate-id <id> --json
+npm run medscale -- memory-review stale --candidate-id <id> --json
+npm run medscale -- memory-review restore --candidate-id <id> --json
+```
+
+Token / cost 账本：
+
+```bash
+npm run medscale -- token record --provider anthropic --medical-lane literature --usage-file usage.json --json
+npm run medscale -- token ingest --target CDK4 --disease "breast cancer" --json
+npm run medscale -- token ingest --file artifact-usage.json --provider anthropic --json
+npm run medscale -- token report --json
+```
+
+Agent 或外部模型写入 `agent_reviews.json` 时，建议同步写入 `medscale.usage_envelope.v1`：`provider`、`model`、`medical_lane`、`source_role`、`usage.input_tokens` / `usage.output_tokens`。`medscale token ingest` 会自动识别并去重。
+
+## 环境要求
+
+- Node.js >= 20
+- Python 3.10+
+- Git（用于仓库变更追踪）
+- 可选增强能力：gbrain、Graphify、CodeGraph、RTK、agentmemory
+
+缺失的第三方能力不会阻断基础医学流程；它们会在 `medscale setup` 和 `medscale doctor` 中显示为 ready、partial、missing 或 planned。
+
+## 18766 首页能看什么
+
+- MedSCALE Research OS readiness score
+- 研究团队角色与 review gates
+- 医学 Prompt Studio 模板
+- Runtime Doctor
+- PubMed/OpenAlex、package audit、figure refs 深度检查
+- 论文质量门禁
+- 医学事实核查
+- 交付 ZIP / package audit
+- gbrain memory seed
+- learning candidate
+- Memory Brain approve/reject/stale/restore 审核动作
+- Token / Cost 账本状态与医学 lane 汇总
+
+## 最小验证
+
+```bash
+npm run typecheck
+npm run build
+npm run smoke:medscale-release
+npm test -- tests/memory/MemoryReview.test.ts tests/cli/targetCommands.test.ts tests/cli/medscaleCli.test.ts
+cd target-research-platform
+python -m pytest tests/test_deliverables.py
+```

package/examples/demo-projects/agent-governance-demo/CONTEXT.md

@@ -0,0 +1,14 @@
+# CONTEXT.md
+
+Project: Agent Governance Demo
+
+| Term | Definition | Examples | Aliases | Source |
+|------|------------|----------|---------|--------|
+| OAuth state | One-time callback correlation value that binds authorization return traffic to a user session | `state-123` | callback state | `src/oauth-state.ts` |
+| Consumed state | A state record that has already been used and must not be accepted again | `consumedAt: 900` | replayed state | `tests/oauth-state.test.ts` |
+| Evidence | A command result or artifact that proves what was verified | `npm test`, eval report, dashboard | verification proof | SCALE workflow |
+
+## Rejected Meanings
+
+- Do not treat an expired state as recoverable without a new authorization flow.
+- Do not treat a dashboard or eval report as a substitute for the business test.

package/examples/demo-projects/agent-governance-demo/README.md

@@ -0,0 +1,48 @@
+# Agent Governance Demo
+
+这是 SCALE Engine 的最小官方 demo 项目，用一个 OAuth state 校验场景展示 Agent 工程治理如何落到真实代码、测试、证据和报告里。
+
+业务目标很小：OAuth callback 必须拒绝缺失、过期、已消费或不匹配的 state。
+
+治理目标更重要：Agent 不能只说“我完成了”，必须留下可验证证据。
+
+## 快速运行
+
+```bash
+npm install
+npm test
+```
+
+## 一键治理烟测
+
+```bash
+npm run workflow:smoke
+```
+
+这个命令会依次运行：
+
+- `npm test`：验证业务行为。
+- `scale eval run --dir .`：运行工作流基线评测。
+- `scale context budget --dir .`：检查上下文预算，避免无节制读取。
+- `scale artifact dashboard --dir . --lang zh`：生成本地治理 HTML 看板。
+
+## 适合演示的 SCALE 命令
+
+```bash
+scale governance mode --task "修复 OAuth state 校验绕过问题" --files "src/oauth-state.ts,tests/oauth-state.test.ts"
+scale skill radar --dir . --task "修复 OAuth state 校验绕过问题" --phase verify --level M --files "src/oauth-state.ts,tests/oauth-state.test.ts"
+scale codegraph status --dir .
+scale eval run --dir .
+scale artifact dashboard --dir . --lang zh
+```
+
+## 观察点
+
+- `src/oauth-state.ts` 保持很小，便于核对 Agent 是否过度设计。
+- `tests/oauth-state.test.ts` 覆盖成功、缺失、过期、已消费和不匹配 state。
+- `CONTEXT.md` 和 `docs/CONTEXT-MAP.md` 只提供必要上下文，避免 demo 自己变成 token 污染源。
+- `.scale/evals/suites/workflow-baseline.json` 可由 `scale eval init --dir .` 重新生成。
+
+## 这不是业务模板
+
+这个 demo 不是 OAuth 产品模板，而是治理闭环模板。真实项目接入时，应保留 SCALE 的证据、评测、上下文预算和看板机制，再替换成自己的业务代码、服务矩阵和验证脚本。

package/examples/demo-projects/agent-governance-demo/docs/CONTEXT-MAP.md

@@ -0,0 +1,14 @@
+# CONTEXT-MAP.md
+
+Project: Agent Governance Demo
+
+| Module | Owner | Product Doc | Architecture Doc |
+| --- | --- | --- | --- |
+| OAuth state verifier | SCALE demo | `README.md` | `src/oauth-state.ts` |
+| Workflow evidence | SCALE demo | `README.md` | `.scale/evals/suites/workflow-baseline.json` |
+
+## Cross-Module Rules
+
+- Behavior changes in `src/oauth-state.ts` must update `tests/oauth-state.test.ts`.
+- Workflow command changes must update `README.md`.
+- Generated reports under `.scale/reports/` are review artifacts, not source of truth.

package/examples/demo-projects/agent-governance-demo/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "scale-agent-governance-demo",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 src/oauth-state.ts tests/oauth-state.test.ts",
+    "lint": "tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 src/oauth-state.ts tests/oauth-state.test.ts",
+    "test": "vitest run",
+    "scale:eval": "scale eval run --dir .",
+    "scale:budget": "scale context budget --dir .",
+    "scale:dashboard": "scale artifact dashboard --dir . --lang zh",
+    "workflow:smoke": "npm test && npm run scale:eval && npm run scale:budget && npm run scale:dashboard"
+  },
+  "devDependencies": {
+    "@hongmaple0820/scale-engine": "^0.20.0",
+    "@types/node": "^20.14.0",
+    "typescript": "^5.5.0",
+    "vitest": "^2.1.9"
+  }
+}
+