@huicai/cli 2026.814.0 → 2026.1021.0

package/skills/report-craft/scripts/report_battery.py

@@ -0,0 +1,349 @@
+#!/usr/bin/env python3
+# 报告引擎压测台：图表引擎 / 财务测算 / 项目事实清单。改了这三个脚本中任何一个，必须重跑。
+#
+#   [1/3] 图表：每种图型 × 随机数据 N 份，断言出图成功、PNG 是按版心宽 300dpi 出的、
+#         数值标注之间不重叠（逐个量文字框）、同一张图的标注小数位一致；
+#         再加一组「必须拒绝」的输入（双纵轴、系列与类别数对不上、负值饼图、>8 个系列），断言报错而不是硬画。
+#   [2/3] 财务：教科书算例对答案；随机假设下的恒等式（IRR 处 NPV≈0、回收期落在累计由负转正的年份里、
+#         节约额永不超过被节约的支出、税后 NPV ≤ 税前 NPV、敏感性临界点处 NPV≈0）。
+#   [3/3] 取证：合成代码库里埋一个口令，断言输出里一个字都不出；同步副本只算一次。
+#
+# 用法：python report_battery.py [份数]      （出图部分需要 matplotlib：用托管运行时的 python 跑）
+
+import json
+import os
+import random
+import shutil
+import sys
+import tempfile
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+
+import fin_model as F          # noqa: E402
+import project_facts as PF     # noqa: E402
+
+try:
+    import chart_render as CR  # noqa: E402
+    HAS_MPL = True
+except Exception:              # 系统 python 没装 matplotlib：图表段跳过并说明
+    HAS_MPL = False
+
+
+def rnd_series(rng, n_cat, n_s, lo=5, hi=900, neg=False):
+    return [{'name': f'系列{i + 1}', 'values': [round(rng.uniform(-hi / 3 if neg else lo, hi), rng.choice([0, 1, 2]))
+                                                 for _ in range(n_cat)]} for i in range(n_s)]
+
+
+def rnd_spec(rng, t):
+    n_cat = rng.randint(2, 9)
+    cats = [str(2026 + i) if rng.random() < 0.5 else rng.choice(['华东', '华南', '华北', '西南', '研发人员人工',
+                                                                  '算力与云资源', '测试', '推广', '预备费']) + str(i)
+            for i in range(n_cat)]
+    if t in ('bar', 'hbar'):
+        return {'type': t, 'unit': '万元', 'categories': cats, 'series': rnd_series(rng, n_cat, rng.randint(1, 3), neg=rng.random() < 0.2)}
+    if t in ('stacked', 'hstacked'):
+        return {'type': t, 'unit': '万元', 'categories': cats, 'series': rnd_series(rng, n_cat, rng.randint(2, 4))}
+    if t in ('line', 'area'):
+        return {'type': t, 'unit': '%', 'categories': cats, 'series': rnd_series(rng, n_cat, 1 if t == 'area' else rng.randint(1, 4), neg=True)}
+    if t == 'pie':
+        return {'type': 'pie', 'unit': '万元', 'categories': cats, 'series': rnd_series(rng, n_cat, 1)}
+    if t == 'waterfall':
+        return {'type': 'waterfall', 'unit': '万元', 'items': [{'name': c, 'value': round(rng.uniform(-80, 300), 1)} for c in cats]}
+    if t == 'tornado':
+        base = round(rng.uniform(100, 600), 2)
+        return {'type': 'tornado', 'unit': '万元', 'metric': 'NPV', 'base': base,
+                'items': [{'name': c, 'low': round(base - rng.uniform(5, 300), 2), 'high': round(base + rng.uniform(5, 300), 2),
+                           'low_label': '-20%', 'high_label': '+20%'} for c in cats[:6]]}
+    if t == 'gantt':
+        tasks, m = [], rng.randint(1, 12)
+        for i in range(rng.randint(2, 9)):
+            s = m + rng.randint(0, 3)
+            e = s + rng.randint(0, 5)
+            tasks.append({'name': f'任务{i + 1}', 'start': f'{2026 + (s - 1) // 12}-{(s - 1) % 12 + 1:02d}',
+                          'end': f'{2026 + (e - 1) // 12}-{(e - 1) % 12 + 1:02d}', 'group': f'阶段{i // 3 + 1}'})
+            m = s + 1
+        return {'type': 'gantt', 'tasks': tasks, 'today': '2026-09-23',
+                'milestones': [{'name': '验收', 'date': tasks[-1]['end'] + '-28'}]}
+    return {'type': 'matrix', 'items': [{'id': f'R{i + 1}', 'name': f'风险{i + 1}', 'p': rng.randint(1, 5), 'i': rng.randint(1, 5)}
+                                        for i in range(rng.randint(1, 9))]}
+
+
+def label_boxes(fig):
+    """图里所有数值标注（annotate 出的 Text）的像素框。"""
+    import matplotlib.text as mtext
+    r = fig.canvas.get_renderer()
+    boxes = []
+    for ax in fig.axes:
+        for ch in ax.get_children():
+            if isinstance(ch, mtext.Annotation) and ch.get_text().strip():
+                bb = ch.get_window_extent(renderer=r)
+                boxes.append((bb.x0, bb.y0, bb.x1, bb.y1, ch.get_text()))
+    return boxes
+
+
+def fig_text_boxes(fig):
+    """画在 figure 上的文字（单位、图例、图下注）。"""
+    r = fig.canvas.get_renderer()
+    out = []
+    for t in fig.texts:
+        if t.get_text().strip():
+            bb = t.get_window_extent(renderer=r)
+            out.append((bb.x0, bb.y0, bb.x1, bb.y1, t.get_text()[:20]))
+    return out
+
+
+def overlaps(boxes):
+    bad = []
+    for i in range(len(boxes)):
+        for j in range(i + 1, len(boxes)):
+            a, b = boxes[i], boxes[j]
+            if a[0] < b[2] - 1 and b[0] < a[2] - 1 and a[1] < b[3] - 1 and b[1] < a[3] - 1:
+                bad.append((a[4], b[4]))
+    return bad
+
+
+# 真实翻车过的输入固定成回归用例（随机生成器造不出「里程碑扎堆 + 长任务名」这种组合）
+REGRESSION = [
+    {'type': 'gantt', 'title': 'A/B 实施进度', 'today': '2026-09-01',
+     'tasks': [{'name': '试用问题修复与跨端一致性收敛', 'start': '2026-10', 'end': '2027-01', 'group': '完善收敛期'},
+               {'name': '支付与订阅闭环打通、会员正式收费', 'start': '2026-11', 'end': '2027-02', 'group': '完善收敛期'},
+               {'name': '私有化交付标准化与交付手册', 'start': '2026-12', 'end': '2027-03', 'group': '交付突破期'},
+               {'name': '规模化运营与产品迭代', 'start': '2027-07', 'end': '2031-12', 'group': '运营增长期'}],
+     'milestones': [{'name': '试用问题修复完成', 'date': '2027-01-31'}, {'name': '会员订阅正式收费', 'date': '2027-02-28'},
+                    {'name': '私有化交付标准件发布', 'date': '2027-03-31'}, {'name': '首批私有化客户验收', 'date': '2027-06-30'},
+                    {'name': '累计净现金流转正', 'date': '2030-12-31'}]},
+    {'type': 'gantt', 'title': '两个里程碑挨着', 'tasks': [{'name': '开发', 'start': '2026-10', 'end': '2027-03'}],
+     'milestones': [{'name': '方案评审通过', 'date': '2026-10-31'}, {'name': '原型演示', 'date': '2026-11-15'}]},
+    {'type': 'gantt', 'title': '五个分组（图例一行放不下）', 'today': '2026-09-23',
+     'tasks': [{'name': f'任务{i}', 'start': f'2026-{10 + i % 3:02d}', 'end': f'2027-{1 + i % 6:02d}',
+                'group': g} for i, g in enumerate(['产品能力', '交付能力', '安全合规', '商业化', '工程基础', '产品能力'])],
+     'milestones': [{'name': '首个私有化项目验收', 'date': '2027-01-31'}, {'name': '付费闭环正式上线', 'date': '2027-02-28'}]},
+    {'type': 'bar', 'unit': '万元', 'categories': ['2027', '2028'],
+     'series': [{'name': f'第{i}条业务线（含私有化交付）', 'values': [10 + i, 20 + i]} for i in range(8)], 'labels': 'none'},
+    {'type': 'gantt', 'title': '八个里程碑 + 图下注（图注不许被截断）', 'today': '2026-09-24',
+     'tasks': [{'name': '稳定性与性能收口', 'start': '2026-10', 'end': '2026-12'},
+               {'name': '商业运营与持续演进', 'start': '2027-10', 'end': '2031-09'}],
+     'milestones': [{'name': n, 'date': d} for n, d in [('压测基线达标', '2027-01-01'), ('交付包发布', '2027-03-01'),
+                    ('等保测评通过', '2027-05-01'), ('四端正式上架', '2027-08-01'), ('运营期启动', '2027-10-01'),
+                    ('首批私有化客户验收', '2027-11-15'), ('年度复盘与规划', '2027-12-20'), ('累计净现金流转正', '2030-06-30')]],
+     'note': '数据来源：项目进度计划（2026-09-24 编制），里程碑判定标准见表 6-2；运营期按 5 年计。'},
+    {'type': 'tornado', 'unit': '万元', 'metric': 'NPV', 'base': 518.77,
+     'items': [{'name': '经营成本', 'low': 862.78, 'high': 173.67, 'low_label': '-20%', 'high_label': '+20%'},
+               {'name': '营业收入', 'low': 274.09, 'high': 763.26, 'low_label': '-20%', 'high_label': '+20%'}]},
+]
+
+
+def charts(n, work):
+    import matplotlib.pyplot as plt
+    rng = random.Random(7)
+    types = ['bar', 'hbar', 'stacked', 'hstacked', 'line', 'area', 'pie', 'waterfall', 'tornado', 'gantt', 'matrix']
+    fails = []
+    orig_close = plt.close
+    specs = [(types[k % len(types)], None) for k in range(n)] + [(r['type'], r) for r in REGRESSION]
+    for k, (t, fixed) in enumerate(specs):
+        spec = fixed or rnd_spec(rng, t)
+        out = os.path.join(work, f'c{k}.png')
+        captured = {}
+        plt.close = lambda fig=None: captured.setdefault('fig', fig)       # 拦住关闭，留下 figure 量标注
+        try:
+            res = CR.render(spec, out)
+        except CR.SpecError as e:
+            fails.append((t, f'合法随机输入被拒：{e}', spec))
+            continue
+        except Exception as e:
+            fails.append((t, f'引擎异常：{type(e).__name__}: {e}', spec))
+            continue
+        finally:
+            plt.close = orig_close
+        fig = captured.get('fig')
+        from PIL import Image
+        with Image.open(out) as im:
+            w_px = im.size[0]
+            dpi = (im.info.get('dpi') or (0, 0))[0]
+        if abs(w_px - round(res['width_cm'] / 2.54 * 300)) > 2 or round(dpi) != 300:
+            fails.append((t, f'出图尺寸不对：{w_px}px @ {dpi}dpi', spec))
+        if not os.path.exists(os.path.splitext(out)[0] + '.svg'):
+            fails.append((t, '缺同名 SVG', spec))
+        if fig is not None and t not in ('pie', 'matrix'):
+            bad = overlaps(label_boxes(fig))
+            if bad:
+                fails.append((t, f'数值标注互相压住：{bad[:3]}', spec))
+        if fig is not None and t == 'gantt' and spec.get('milestones'):
+            shown = ''.join(b[4] for b in label_boxes(fig)) + ''.join(tx.get_text() for tx in fig.texts)
+            shown = shown.replace('\n', '')
+            lost = [m['name'] for m in spec['milestones'] if m['name'] not in shown]
+            if lost:
+                fails.append((t, f'里程碑在图上丢了（标注和图注里都找不到）：{lost}', spec))
+        if fig is not None:
+            W, H = fig.bbox.width, fig.bbox.height
+            out_of = [b[4] for b in label_boxes(fig) + fig_text_boxes(fig) if b[0] < -1 or b[2] > W + 1 or b[1] < -1 or b[3] > H + 1]
+            if out_of:
+                fails.append((t, f'文字出了画布（会被裁掉）：{out_of[:3]}', spec))
+            if t == 'tornado' and min(min(it['low'], it['high']) for it in spec['items']) >= 0:
+                ticks = [tk for tk in fig.axes[0].get_xticks()]
+                if any(tk < 0 for tk in ticks):
+                    fails.append((t, f'数据全为正却标出负刻度：{ticks}', spec))
+            nums = [b[4].split('（')[0].replace(',', '').lstrip('+-') for b in label_boxes(fig)]
+            decs = {len(x.split('.')[1]) if '.' in x else 0 for x in nums if x.replace('.', '').isdigit()}
+            if len(decs) > 1:
+                fails.append((t, f'同一张图标注小数位不一致：{sorted(decs)}', spec))
+        if fig is not None:
+            orig_close(fig)
+    must_reject = [
+        ({'type': 'line', 'y2': True, 'categories': ['a', 'b'], 'series': [{'name': 'x', 'values': [1, 2]}]}, '双纵轴'),
+        ({'type': 'bar', 'categories': ['a', 'b'], 'series': [{'name': 'x', 'values': [1]}]}, '值与类别数不符'),
+        ({'type': 'pie', 'categories': ['a', 'b'], 'series': [{'values': [3, -1]}]}, '负值饼图'),
+        ({'type': 'bar', 'categories': ['a'], 'series': [{'name': str(i), 'values': [i]} for i in range(9)]}, '9 个系列'),
+        ({'type': 'gantt', 'tasks': [{'name': 'x', 'start': '2027-05', 'end': '2027-01'}]}, '结束早于开始'),
+        ({'type': 'matrix', 'items': [{'p': 6, 'i': 1}]}, '可能性超出 1~5'),
+        ({'type': 'radar'}, '不认识的图型'),
+    ]
+    rejected = 0
+    for spec, why in must_reject:
+        try:
+            CR.render(spec, os.path.join(work, 'x.png'))
+            fails.append(('reject', f'本该拒绝却画了：{why}', spec))
+        except CR.SpecError:
+            rejected += 1
+    return fails, rejected, len(must_reject)
+
+
+def finance(n):
+    fails = []
+    # 教科书算例
+    r = F.run({'years': 5, 'discount_rate': 0.1, 'investment': [{'name': 'a', 'amount': 100}],
+               'revenue': [{'name': 'r', 'per_year': 30}], 'costs': [{'name': 'c', 'per_year': 0}]})
+    i = r['indicators']['pre_tax']
+    for k, v, want in (('npv', i['npv'], 12.476), ('irr', i['irr'], 0.152382), ('payback', i['payback'], 4.3333),
+                       ('payback_dynamic', i['payback_dynamic'], 5.2633)):
+        if abs(v - want) > 1e-3:
+            fails.append(('教科书', f'{k}={v} 期望 {want}'))
+    # 情景方向：实测模型给悲观情景设了「收入×0.6、成本×0.8」——必须预警；方向对的情景不能误报
+    base_spec = {'years': 5, 'investment': [{'name': 'a', 'amount': 400}],
+                 'revenue': [{'name': 'r', 'values': [200, 300, 400, 500, 600]}],
+                 'costs': [{'name': '上游', 'pct_of_revenue': 0.35}, {'name': '人力', 'per_year': 80}]}
+    w_bad = F.run({**base_spec, 'scenarios': {'悲观': {'revenue': 0.6, 'costs': 0.8}, '乐观': {'revenue': 1.3, 'costs': 1.1}}})['warnings']
+    w_ok = F.run({**base_spec, 'scenarios': {'悲观': {'revenue': 0.7, 'costs': 1.1}, '乐观': {'revenue': 1.2, 'costs': 0.95}}})['warnings']
+    if sum('方向不对' in w for w in w_bad) != 2:
+        fails.append(('情景方向', f'方向相反的悲观/乐观情景没被点名：{w_bad}'))
+    if any('方向不对' in w for w in w_ok):
+        fails.append(('情景方向', f'方向正确的情景被误报：{w_ok}'))
+    rng = random.Random(11)
+    for k in range(n):
+        years = rng.randint(3, 10)
+        m = rng.randint(1, 3)
+        inv = [{'name': f'投{j}', 'amount': rng.uniform(50, 800), 'schedule': None} for j in range(rng.randint(1, 5))]
+        for it in inv:
+            w = [rng.random() + 0.01 for _ in range(m)]
+            it['schedule'] = [x / sum(w) for x in w]
+        spec = {'years': years, 'construction_years': m, 'discount_rate': rng.choice([0.06, 0.08, 0.1, 0.12]),
+                'tax_rate': rng.choice([0, 0.15, 0.25]), 'investment': inv,
+                'revenue': [{'name': f'收{j}', 'values': [rng.uniform(0, 600) * (1 + t * 0.3) for t in range(years)]}
+                            for j in range(rng.randint(1, 3))],
+                'costs': [{'name': '比例成本', 'pct_of_revenue': rng.uniform(0.05, 0.4)},
+                          {'name': '固定成本', 'per_year': rng.uniform(10, 150), 'growth': rng.uniform(0, 0.1)}],
+                'savings': [{'name': '节约', 'base_values': [rng.uniform(5, 60) for _ in range(years)], 'rate': rng.uniform(0, 1)}],
+                'scenarios': {'悲观': {'revenue': 0.7, 'costs': 1.1}}}
+        try:
+            res = F.run(spec)
+        except F.ModelError as e:
+            fails.append((f'随机{k}', f'合法假设被拒：{e}'))
+            continue
+        M = F.load(spec)
+        cf = F.cashflows(M)
+        main = F.main_ncf(M, cf)
+        ii = F.indicators(main, M['r'])
+        if ii['irr'] is not None and abs(F.npv(main, ii['irr'])) > 1e-4 * max(1, sum(abs(x) for x in main)):
+            fails.append((f'随机{k}', f'IRR 处 NPV 不为 0：{F.npv(main, ii["irr"])}'))
+        for s in M['savings']:
+            if any(v > b + 1e-9 for v, b in zip(s['values'], s['base'])):
+                fails.append((f'随机{k}', '节约额超过了被节约的支出'))
+        if M['tax'] > 0 and F.npv(cf['post'], M['r']) > F.npv(cf['pre'], M['r']) + 1e-9:
+            fails.append((f'随机{k}', '税后 NPV 大于税前'))
+        pb = ii['payback']
+        if pb is not None:
+            cum, T = 0.0, None
+            for t, v in enumerate(main):
+                prev, cum = cum, cum + v
+                if t > 0 and prev < 0 <= cum:
+                    T = t
+                    break
+            # 年序从 1 起：第 T+1 年累计转正 → 回收期 = T + |上年累计| ÷ 当年净流入，落在 [T, T+1]
+            if T is None or not (T - 1e-9 <= pb <= T + 1 + 1e-9):
+                fails.append((f'随机{k}', f'回收期 {pb} 不在累计由负转正的那一年（T={T}）'))
+        for srow in res['sensitivity']:
+            sw = srow['switch']
+            if sw is None or srow['factor'].startswith('其中'):
+                continue
+            key = {'营业收入': 'k_rev', '经营成本': 'k_cost', '建设投资': 'k_inv', '成本节约': 'k_sav'}[srow['factor']]
+            v = F.npv(F.main_ncf(M, F.cashflows(M, **{key: 1 + sw})), M['r'])
+            if abs(v) > 0.5:                                   # switch 四舍五入到 4 位小数，留余量
+                fails.append((f'随机{k}', f'{srow["factor"]} 临界点处 NPV={v:.3f}'))
+        if not res['conclusion'] or '万元' not in res['conclusion']:
+            fails.append((f'随机{k}', '结论句缺失'))
+    return fails
+
+
+def facts(work):
+    fails = []
+    root = os.path.join(work, 'repo')
+    def w(p, s):
+        os.makedirs(os.path.dirname(os.path.join(root, p)), exist_ok=True)
+        open(os.path.join(root, p), 'w', encoding='utf-8').write(s)
+    w('svc/src/main/resources/application.yml',
+      'server:\n  port: 9090\nspring:\n  application:\n    name: svc-a\n  datasource:\n    password: TopSecret#42\n'
+      '    url: jdbc:mysql://10.0.0.8:3306/db?user=root&password=TopSecret#42\n')
+    w('svc/src/main/resources/application.properties', 'spring.datasource.password=PropSecret99\nserver.port=9091\n')
+    w('docker-compose.yml', 'services:\n  db:\n    image: mysql:8\n    environment:\n      MYSQL_ROOT_PASSWORD: ComposeSecret7\n    ports:\n      - "3306:3306"\n')
+    w('a/core/x.js', 'export const x = 1;\n' * 20)
+    w('b/core/x.js', 'export const x = 1;\n' * 20)
+    res = PF.build(root)
+    blob = json.dumps(res, ensure_ascii=False)
+    for secret in ('TopSecret#42', 'PropSecret99', 'ComposeSecret7', '10.0.0.8'):
+        if secret in blob:
+            fails.append(('取证', f'输出里出现了配置值：{secret}'))
+    if res['code']['duplicates']['files'] != 1:
+        fails.append(('取证', f'同步副本应计 1 个，实际 {res["code"]["duplicates"]["files"]}'))
+    if not any(s['name'] == 'svc-a' and s['port'] == '9090' for s in res['services']):
+        fails.append(('取证', f'没数出服务端口：{res["services"]}'))
+    if not any(sv['image'] == 'mysql:8' and sv['ports'] == ['3306:3306'] for c in res['compose'] for sv in c['services']):
+        fails.append(('取证', f'compose 服务没取对：{res["compose"]}'))
+    return fails
+
+
+def main(argv):
+    n = next((int(a) for a in argv if a.isdigit()), 120)
+    work = tempfile.mkdtemp(prefix='reportbat-')
+    bad = 0
+    try:
+        print(f'[1/3] 图表：{n} 份随机数据 × 11 种图型')
+        if HAS_MPL:
+            f, rej, tot = charts(n, work)
+            for t, why, spec in f[:10]:
+                print(f'  ✗ {t}: {why}\n      {json.dumps(spec, ensure_ascii=False)[:240]}')
+            print(f'  {"✓" if not f else "✗"} {n + len(REGRESSION) - len([x for x in f if x[0] != "reject"])}/{n + len(REGRESSION)} 份出图合规'
+                  f'（含 {len(REGRESSION)} 个真实翻车回归用例）；必须拒绝的输入 {rej}/{tot} 被拒')
+            bad += bool(f)
+        else:
+            print('  - 跳过：当前 python 没有 matplotlib（用托管运行时的 python 跑这一段）')
+        print(f'[2/3] 财务：教科书算例 + {n} 组随机假设的恒等式')
+        f = finance(n)
+        for k, why in f[:10]:
+            print(f'  ✗ {k}: {why}')
+        print(f'  {"✓" if not f else "✗"} 全部恒等式成立' if not f else f'  ✗ {len(f)} 处不成立')
+        bad += bool(f)
+        print('[3/3] 取证：埋了口令的合成代码库')
+        f = facts(work)
+        for k, why in f:
+            print(f'  ✗ {k}: {why}')
+        print('  ✓ 配置值零泄露、同步副本只算一次、服务与编排取对' if not f else '')
+        bad += bool(f)
+    finally:
+        shutil.rmtree(work, ignore_errors=True)
+    print('\n全部通过。' if not bad else f'\n有 {bad} 段未通过。')
+    return 1 if bad else 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))

package/skills/report-craft/trigger-cases.json

@@ -0,0 +1,15 @@
+{
+  "skill": "report-craft",
+  "cases": [
+    { "id": "pos-finance", "prompt": "可研报告的财务评价怎么做，帮我算 NPV、IRR 和投资回收期", "shouldTrigger": true },
+    { "id": "pos-sensitivity", "prompt": "项目报告里要有投资估算表、现金流量表，还要做敏感性分析", "shouldTrigger": true },
+    { "id": "pos-charts", "prompt": "给这份报告配上甘特图、投资构成图和敏感性分析的龙卷风图", "shouldTrigger": true },
+    { "id": "pos-facts", "prompt": "把代码库的规模、模块和接口数统计出来写进项目报告里", "shouldTrigger": true },
+    { "id": "pos-bp", "prompt": "商业计划书的财务测算和数据图表怎么做才专业", "shouldTrigger": true },
+    { "id": "pos-feasibility", "prompt": "编写我们项目的可行性研究报告，技术细节、架构图、功能模块图和各类图表都要专业", "shouldTrigger": true, "lexical": false },
+    { "id": "neg-format", "prompt": "把这份 Word 的页边距和字体调成公文格式", "shouldTrigger": false },
+    { "id": "neg-excel", "prompt": "分析一下这个 Excel 里的销售数据，做个透视表", "shouldTrigger": false },
+    { "id": "neg-slides", "prompt": "做一份产品发布会用的 PPT", "shouldTrigger": false },
+    { "id": "neg-weekly", "prompt": "帮我写本周的周报", "shouldTrigger": false }
+  ]
+}

package/skills/retail-store-ops/trigger-cases.json

@@ -0,0 +1,30 @@
+{
+  "skill": "retail-store-ops",
+  "cases": [
+    {
+      "id": "pos-1",
+      "prompt": "门店分析，坪效人效怎么算",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-2",
+      "prompt": "菜单工程和损耗盘点怎么做",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-3",
+      "prompt": "选址评分和单店模型怎么建",
+      "shouldTrigger": true
+    },
+    {
+      "id": "neg-1",
+      "prompt": "做一次电商 GMV 的拆解归因",
+      "shouldTrigger": false
+    },
+    {
+      "id": "neg-2",
+      "prompt": "写一份仓储 KPI 报表",
+      "shouldTrigger": false
+    }
+  ]
+}

package/skills/risk-compliance/trigger-cases.json

@@ -0,0 +1,31 @@
+{
+  "skill": "risk-compliance",
+  "cases": [
+    {
+      "id": "pos-1",
+      "prompt": "做风险评估和风险登记册",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-2",
+      "prompt": "内控流程矩阵和合规检查怎么做",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-3",
+      "prompt": "应急预案和数据合规要点",
+      "shouldTrigger": true
+    },
+    {
+      "id": "neg-1",
+      "prompt": "做一次内部审计项目立项",
+      "shouldTrigger": false,
+      "lexical": false
+    },
+    {
+      "id": "neg-2",
+      "prompt": "写一份等保测评整改方案",
+      "shouldTrigger": false
+    }
+  ]
+}

package/skills/scope-creep/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: scope-creep
+description: 变更范围蔓延检查——这次改动是不是跑题了：主要改动集中在哪个模块、哪些文件落在别处、是否顺手改了配置/构建文件、是否悄悄加了依赖、有没有巨型改动块或纯格式改动。当用户说"这次改了些什么/是不是改多了/提交前看一眼/帮我拆一下这次改动/范围是不是太大"时使用，长任务跑完后也应主动自查一次。
+version: 1.0.0
+---
+
+# 变更范围蔓延检查
+
+一次改动最常见的失控形态不是「改错了」，而是**改多了**：跑一个长任务，回来发现顺手改了
+八个无关文件。每一处单看都说得通，合在一起却成了一次没人能安心评审的提交——
+评审的人只能整体通过或整体打回，而这两个选择都不对。
+
+## 何时使用
+
+- **长任务跑完之后主动自查**（这是最该用它的时刻，也是最容易忘的）
+- 提交或开 PR 之前
+- 用户问「这次改了些什么」「是不是改多了」「帮我拆一下」
+
+## 怎么用
+
+1. 调 `scope_check`。不传 intent 时会自动取当前目标（`/goal` 设过的那句话）作为意图。
+2. 逐条回答它提的问题，然后二选一：
+   - **保留**：在提交信息里写清这个文件为什么必须一起改；
+   - **拆分**：`git restore --staged <文件>` 把它挪出本次提交，单独提一次。
+3. 拆分优先。一次提交只做一件事，是让评审能进行下去的前提。
+
+## 五类信号
+
+| 信号 | 该问什么 |
+|---|---|
+| 落在主战场之外 | 这个文件是本次要做的事**必须**带上的吗？ |
+| 改到配置/构建文件 | 影响面远超它自身，且最容易在一堆功能改动里被漏看——确认必需，并在提交信息里单独点出来 |
+| 依赖清单有新增 | 引入依赖是需要单独说明的决定（体积、许可证、维护状况、供应链风险），不该混在功能提交里 |
+| 巨型改动块 | 这么大的块评审时几乎必然被囫囵放过。能拆就拆，拆不了就写清它做了什么 |
+| 纯格式调整 | 单独提一次。混在功能改动里会让真正的改动淹没在一片重排里 |
+
+## 边界
+
+- **它只提问，不下结论。** 输出是「这几个文件看着不在主战场，是有意的吗」，
+  不是「这些文件是多余的」。很多跨模块改动本来就是必要的——一个接口改了，
+  上下游跟着改是应该的。判断该由人做。
+- **不阻断提交。** 提交前只给提示。一个会拦住正当提交的检查器，两天之内就会被忽略。
+- **改动少于四个文件时不查。** 那时谈不上「蔓延」，报告纯属噪声。
+- **不审质量。** 代码写得对不对、有没有边界问题，那是 `code-review` 技能的事。
+  本技能只回答「该不该包含这些文件」。

package/skills/scope-creep/trigger-cases.json

@@ -0,0 +1,7 @@
+{
+  "cases": [
+    { "id": "changed-too-much", "prompt": "这次是不是改多了，帮我看看范围", "shouldTrigger": true },
+    { "id": "split-change", "prompt": "提交前看一眼，帮我拆一下这次改动", "shouldTrigger": true },
+    { "id": "review-quality", "prompt": "帮我审查这段代码的质量和边界情况", "shouldTrigger": false }
+  ]
+}

package/skills/sec-auth/trigger-cases.json

@@ -0,0 +1,31 @@
+{
+  "skill": "sec-auth",
+  "cases": [
+    {
+      "id": "pos-1",
+      "prompt": "接 SSO，OIDC 还是 SAML",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-2",
+      "prompt": "JWT 怎么吊销，会话还是 token",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-3",
+      "prompt": "权限模型选 RBAC 还是 ABAC，越权怎么整改",
+      "shouldTrigger": true
+    },
+    {
+      "id": "neg-1",
+      "prompt": "做一次等保三级的合规整改",
+      "shouldTrigger": false,
+      "lexical": false
+    },
+    {
+      "id": "neg-2",
+      "prompt": "写一段接口签名的实现",
+      "shouldTrigger": false
+    }
+  ]
+}

package/skills/sec-compliance/trigger-cases.json

@@ -0,0 +1,31 @@
+{
+  "skill": "sec-compliance",
+  "cases": [
+    {
+      "id": "pos-1",
+      "prompt": "等保测评临近，三级要求怎么落",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-2",
+      "prompt": "密评国密改造有哪些落点",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-3",
+      "prompt": "客户问我们过等保没，开源 License 怎么合规",
+      "shouldTrigger": true
+    },
+    {
+      "id": "neg-1",
+      "prompt": "做一次 SSO 单点登录接入",
+      "shouldTrigger": false,
+      "lexical": false
+    },
+    {
+      "id": "neg-2",
+      "prompt": "写一份数据分级分类标准",
+      "shouldTrigger": false
+    }
+  ]
+}

package/skills/securities-chain/trigger-cases.json

@@ -0,0 +1,31 @@
+{
+  "skill": "securities-chain",
+  "cases": [
+    {
+      "id": "pos-1",
+      "prompt": "资本市场诉求跨环节，先看用哪个技能",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-2",
+      "prompt": "从辅导到上市，整条证券链怎么走",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-3",
+      "prompt": "董秘全年披露怎么管，端到端排一下",
+      "shouldTrigger": true
+    },
+    {
+      "id": "neg-1",
+      "prompt": "做一次公司估值的 DCF 测算",
+      "shouldTrigger": false,
+      "lexical": false
+    },
+    {
+      "id": "neg-2",
+      "prompt": "写一份 IPO 申报材料清单",
+      "shouldTrigger": false
+    }
+  ]
+}

package/skills/securities-research/trigger-cases.json

@@ -0,0 +1,31 @@
+{
+  "skill": "securities-research",
+  "cases": [
+    {
+      "id": "pos-1",
+      "prompt": "写份研报，公司研究框架怎么搭",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-2",
+      "prompt": "DCF 和可比估值怎么做",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-3",
+      "prompt": "业绩点评和招股书分析怎么写",
+      "shouldTrigger": true
+    },
+    {
+      "id": "neg-1",
+      "prompt": "做一次持仓组合的再平衡",
+      "shouldTrigger": false,
+      "lexical": false
+    },
+    {
+      "id": "neg-2",
+      "prompt": "写一份上市申报的问询回复",
+      "shouldTrigger": false
+    }
+  ]
+}

package/skills/security-audit/trigger-cases.json

@@ -0,0 +1,31 @@
+{
+  "skill": "security-audit",
+  "cases": [
+    {
+      "id": "pos-1",
+      "prompt": "帮我做代码安全自查",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-2",
+      "prompt": "这段代码安全吗，OWASP 风险有哪些",
+      "shouldTrigger": true
+    },
+    {
+      "id": "pos-3",
+      "prompt": "上线安全检查，鉴权和密钥怎么看",
+      "shouldTrigger": true
+    },
+    {
+      "id": "neg-1",
+      "prompt": "做一次安全评审的威胁建模",
+      "shouldTrigger": false,
+      "lexical": false
+    },
+    {
+      "id": "neg-2",
+      "prompt": "写一份等保测评证据清单",
+      "shouldTrigger": false
+    }
+  ]
+}