@namewta/speculo 1.0.24 → 2.0.1

package/template/workflows/ops/common/tests/test_ops_bootstrap.mjs

@@ -1,7 +1,7 @@
 /** Node-less Linux SSH bootstrap/enroll contracts. SSH/scp are simulated; no public network. */
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { copyFileSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, existsSync } from "node:fs";
+import { realpathSync, copyFileSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, existsSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, posix } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -141,7 +141,7 @@ function writeConn(dir, host) {
 }
 
 test("posix ssh uses the same host-key contract", () => {
-  const d = mkdtempSync(join(tmpdir(), "ops-posix-"));
+  const d = mkdtempSync(join(realpathSync(tmpdir()), "ops-posix-"));
   const kh = join(d, "known_hosts");
   writeFileSync(kh, "fixture pinned key\n");
   const captured = {};
@@ -164,7 +164,7 @@ test("posix ssh uses the same host-key contract", () => {
 });
 
 test("scp uses the same host-key contract", () => {
-  const d = mkdtempSync(join(tmpdir(), "ops-scp-"));
+  const d = mkdtempSync(join(realpathSync(tmpdir()), "ops-scp-"));
   const kh = join(d, "known_hosts");
   writeFileSync(kh, "fixture pinned key\n");
   const local = join(d, "a.tar.gz");
@@ -188,7 +188,7 @@ test("scp uses the same host-key contract", () => {
 });
 
 test("scp rejects controller paths and unsafe Linux paths before spawning", (t) => {
-  const d = mkdtempSync(join(tmpdir(), "ops-scp-path-"));
+  const d = mkdtempSync(join(realpathSync(tmpdir()), "ops-scp-path-"));
   t.after(() => rmSync(d, { recursive: true, force: true }));
   const kh = join(d, "known_hosts"), local = join(d, "archive.tar.gz");
   writeFileSync(kh, "fixture pinned key\n"); writeFileSync(local, "reviewed archive");
@@ -201,7 +201,7 @@ test("scp rejects controller paths and unsafe Linux paths before spawning", (t)
 });
 
 test("bootstrap-volta apply installs wrapper and does not touch profile", linuxExecution, () => {
-  const d = mkdtempSync(join(tmpdir(), "ops-vol-"));
+  const d = mkdtempSync(join(realpathSync(tmpdir()), "ops-vol-"));
   const home = join(d, "home");
   mkdirSync(home);
   const bashrc = join(home, ".bashrc");
@@ -224,7 +224,7 @@ test("bootstrap-volta apply installs wrapper and does not touch profile", linuxE
 });
 
 test("bootstrap-volta apply without ack blocked", linuxExecution, () => {
-  const d = mkdtempSync(join(tmpdir(), "ops-ack-"));
+  const d = mkdtempSync(join(realpathSync(tmpdir()), "ops-ack-"));
   const archives = makeArchives(d);
   const p = spawnSync("/bin/sh", [scriptPath, "--apply", archives.voltaTar, archives.voltaSha, archives.nodeTar, archives.nodeSha, join(d, "volta"), "24.21.0", "nope"], { encoding: "utf8" });
   assert.equal(p.error, undefined);
@@ -234,7 +234,7 @@ test("bootstrap-volta apply without ack blocked", linuxExecution, () => {
 });
 
 test("bootstrap-volta sha mismatch blocked", linuxExecution, () => {
-  const d = mkdtempSync(join(tmpdir(), "ops-sha-"));
+  const d = mkdtempSync(join(realpathSync(tmpdir()), "ops-sha-"));
   const archives = makeArchives(d);
   const p = spawnSync("/bin/sh", [scriptPath, "--apply", archives.voltaTar, "0".repeat(64), archives.nodeTar, archives.nodeSha, join(d, "volta"), "24.21.0", ACK], { encoding: "utf8" });
   assert.equal(p.error, undefined);
@@ -245,7 +245,7 @@ test("bootstrap-volta sha mismatch blocked", linuxExecution, () => {
 });
 
 function cliFixture({ executeLinux = false } = {}) {
-  const tmp = mkdtempSync(join(tmpdir(), "ops-bootcli-"));
+  const tmp = mkdtempSync(join(realpathSync(tmpdir()), "ops-bootcli-"));
   const state = join(tmp, "controller");
   // A simulated Linux SSH target is not a path on the controller filesystem.
   const target = executeLinux ? join(tmp, "server") : "/srv/speculo-bootstrap-test";
@@ -535,7 +535,7 @@ test("probe --connection-file still does not imply register", () => {
 });
 
 test("environmentSpec uses managed volta path", () => {
-  const tmp = mkdtempSync(join(tmpdir(), "ops-env-"));
+  const tmp = mkdtempSync(join(realpathSync(tmpdir()), "ops-env-"));
   const state = join(tmp, "controller");
   const target = join(tmp, "server");
   const prevProbe = cliHooks.probeLocal;
@@ -571,7 +571,7 @@ test("environmentSpec uses managed volta path", () => {
 });
 
 test("environmentSpec still throws when volta truly absent", () => {
-  const tmp = mkdtempSync(join(tmpdir(), "ops-envmiss-"));
+  const tmp = mkdtempSync(join(realpathSync(tmpdir()), "ops-envmiss-"));
   const state = join(tmp, "controller");
   const target = join(tmp, "server");
   const prevProbe = cliHooks.probeLocal;

package/template/workflows/ops/common/tests/test_ops_onboarding.mjs

@@ -1,7 +1,7 @@
 /** Root-consent contracts, simulated SSH and real disposable local initialization. */
 import assert from "node:assert/strict";
 import test from "node:test";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { realpathSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
@@ -17,7 +17,7 @@ import { fileState } from "../tools/opslib/agent.mjs";
 import { generateFleet } from "../tools/opslib/fleet.mjs";
 
 function fixture(t, local = false) {
-  const dir = mkdtempSync(join(tmpdir(), "ops-onboard-")), state = join(dir, "state");
+  const dir = mkdtempSync(join(realpathSync(tmpdir()), "ops-onboard-")), state = join(dir, "state");
   mkdirSync(state); mkdirSync(join(state, "private"));
   const registry = emptyStatus();
   registry.controller = { controller_id: "fixture", state_root: state, created_at: "2026-01-01T00:00:00Z" };

package/template/workflows/ops/common/tests/test_ops_workspace.mjs

@@ -1,7 +1,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { createHash } from "node:crypto";
-import { mkdtempSync, mkdirSync, readFileSync, writeFileSync, existsSync, statSync, symlinkSync, rmSync } from "node:fs";
+import { realpathSync, mkdtempSync, mkdirSync, readFileSync, writeFileSync, existsSync, statSync, symlinkSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve, posix } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -14,7 +14,7 @@ import { projectFleet, renderHtml, renderMarkdown, generateFleet } from "../tool
 import { parseWorkspaceArgs, workspaceCommand } from "../tools/opslib/workspace_cli.mjs";
 
 function fixture(t) {
-  const root = mkdtempSync(join(tmpdir(), "speculo-workspace-"));
+  const root = mkdtempSync(join(realpathSync(tmpdir()), "speculo-workspace-"));
   t.after(() => rmSync(root, { recursive: true, force: true }));
   const state = join(root, "state"); mkdirSync(state);
   const s = emptyStatus(); s.controller = { controller_id: "controller-a", state_root: state, created_at: now() };
@@ -68,10 +68,10 @@ async function authorized(f, req, adapter) {
 
 test("explicit layer routing distinguishes controller, access, server, project and inventory", (t) => {
   const f = fixture(t);
-  assert.equal(route(f.s, { scope: "controller", server_ids: [], project_ids: [] }).work, "I-initialize");
-  assert.equal(route(f.s, { scope: "server", server_ids: ["node-a"], project_ids: [] }).work, "H-host-manage");
-  assert.equal(route(f.s, { scope: "project", server_ids: ["node-b"], project_ids: ["app-a"] }).work, "D-project-deploy");
-  assert.equal(route(f.s, { scope: "inventory", server_ids: [], project_ids: [] }).work, "V-inventory-view");
+  assert.equal(route(f.s, { scope: "controller", server_ids: [], project_ids: [] }).work, "ops-i-initialize");
+  assert.equal(route(f.s, { scope: "server", server_ids: ["node-a"], project_ids: [] }).work, "ops-h-host-manage");
+  assert.equal(route(f.s, { scope: "project", server_ids: ["node-b"], project_ids: ["app-a"] }).work, "ops-d-project-deploy");
+  assert.equal(route(f.s, { scope: "inventory", server_ids: [], project_ids: [] }).work, "ops-v-inventory-view");
   assert.deepEqual(route(f.s, { scope: "access", server_ids: ["new-node"], project_ids: [] }).registration_required, ["new-node"]);
   for (const c of [
     { scope: "controller", server_ids: ["node-a"], project_ids: [] }, { scope: "server", server_ids: ["node-a"], project_ids: ["app-a"] },

package/template/workflows/ops/common/tools/opslib/workspace.mjs

@@ -5,8 +5,8 @@ import { fileURLToPath } from "node:url";
 import { digest, exact, identifier, noSymlinks, OpsError, readJson } from "./core.mjs";
 
 export const WORKS = Object.freeze({
-  controller: "I-initialize", access: "S-server-connect", server: "H-host-manage",
-  project: "D-project-deploy", inventory: "V-inventory-view",
+  controller: "ops-i-initialize", access: "ops-s-server-connect", server: "ops-h-host-manage",
+  project: "ops-d-project-deploy", inventory: "ops-v-inventory-view",
 });
 const WORKFLOW = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
 export const MAX_JSON_BYTES = 16 * 1024 * 1024;

package/template/workflows/ops/common/tools/validate-ops.mjs

@@ -20,13 +20,13 @@ try {
     if (JSON.stringify(works) !== JSON.stringify(expected)) throw new Error("OPS Work directories differ from explicit scope router");
     const manifest = JSON.parse(readFileSync(join(root, "manifest.json"), "utf8"));
     const stages = manifest.stages.map((s) => s.id).sort();
-    if (new Set(stages).size !== stages.length || JSON.stringify(stages) !== JSON.stringify(works.map((w) => w.slice(2)).sort())) throw new Error("manifest stages differ from Work entries");
+    if (new Set(stages).size !== stages.length || JSON.stringify(stages) !== JSON.stringify(works.map((w) => w.slice(6)).sort())) throw new Error("manifest stages differ from Work entries");
     for (const stage of manifest.stages) for (const id of stage.after) if (!stages.includes(id)) throw new Error("unknown manifest prerequisite " + id);
     for (const id of works) {
-      const text = readFileSync(join(root, id, id + ".md"), "utf8");
-      if (!text.includes("type: workflow-entry") || !text.includes("读取范围") || !text.includes("id: ops/" + id.slice(2))) throw new Error("invalid work " + id);
+      const text = readFileSync(join(root, id, "SKILL.md"), "utf8");
+      if (!text.includes("speculo-kind: work-skill") || !text.includes("读取范围") || !text.includes("speculo-id: ops/" + id.slice(6))) throw new Error("invalid work " + id);
     }
-    for (const file of ["INDEX.md", "README.md", "manifest.json", "runtime-contract.json", "common/USAGE.md", "common/WORKSPACE-USAGE.md", "common/CAPABILITIES.md", "common/templates/FLEET.html", "common/schemas/fleet-view.schema.json", "common/schemas/task-request.schema.json", "common/schemas/server-check.schema.json", "common/tools/opslib/execution.mjs", "common/tools/opslib/tasks.mjs", "common/tools/opslib/fleet.mjs", "common/tools/opslib/onboarding.mjs", "common/tools/server-discover.sh", "common/schemas/server-discovery.schema.json", "common/schemas/root-confirmation.schema.json", "common/rules/host-root-and-onboarding.md"]) {
+    for (const file of ["SKILL.md", "common/rules/domain-runtime.md", "manifest.json", "runtime-contract.json", "common/USAGE.md", "common/WORKSPACE-USAGE.md", "common/CAPABILITIES.md", "common/templates/FLEET.html", "common/schemas/fleet-view.schema.json", "common/schemas/task-request.schema.json", "common/schemas/server-check.schema.json", "common/tools/opslib/execution.mjs", "common/tools/opslib/tasks.mjs", "common/tools/opslib/fleet.mjs", "common/tools/opslib/onboarding.mjs", "common/tools/server-discover.sh", "common/schemas/server-discovery.schema.json", "common/schemas/root-confirmation.schema.json", "common/rules/host-root-and-onboarding.md"]) {
       if (!existsSync(join(root, file))) throw new Error("missing " + file);
     }
     for (const name of readdirSync(join(root, "common/schemas")).filter((x) => x.endsWith(".json"))) {

package/template/workflows/ops/manifest.json

@@ -1,5 +1,5 @@
 {
-  "schema_version": 1,
+  "schema_version": 2,
   "id": "ops",
   "version": "2.3.0",
   "persistent_knowledge": [
@@ -99,5 +99,20 @@
       "risk": "local-reversible",
       "context_budget": 16000
     }
-  ]
+  ],
+  "entry": "SKILL.md",
+  "works": [
+    "ops-d-project-deploy/SKILL.md",
+    "ops-h-host-manage/SKILL.md",
+    "ops-i-initialize/SKILL.md",
+    "ops-s-server-connect/SKILL.md",
+    "ops-v-inventory-view/SKILL.md"
+  ],
+  "work_stages": {
+    "ops-d-project-deploy/SKILL.md": [],
+    "ops-h-host-manage/SKILL.md": [],
+    "ops-i-initialize/SKILL.md": [],
+    "ops-s-server-connect/SKILL.md": [],
+    "ops-v-inventory-view/SKILL.md": []
+  }
 }

package/template/workflows/ops/ops-d-project-deploy/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: ops-d-project-deploy
+description: "固定一个项目及目标服务器，配置项目容器、依赖、升级与双边文档，不隐式取得整台服务器的维护权限。"
+metadata:
+  speculo-kind: work-skill
+  speculo-id: ops/project-deploy
+  speculo-domain: ops
+  speculo-contract-version: "2"
+---
+
+# 项目与共享服务部署
+
+激活本 Work 后先读取 `<Path>{roots.workflows}/ops/common/rules/domain-runtime.md</Path>`。
+
+## 读取范围
+
+读取 `<Path>{roots.workflows}/ops/common/rules/activation-and-memory.md</Path>`，按当前 ID 定位最小证据。规划、执行或恢复前读取 `<Path>{roots.workflows}/ops/common/rules/workspace-and-authorization.md</Path>`、`<Path>{roots.workflows}/ops/common/rules/persistence-and-secrets.md</Path>`、`<Path>{roots.workflows}/ops/common/rules/deployment-layout.md</Path>` 与 `<Path>{roots.workflows}/ops/common/rules/recovery.md</Path>`；共享依赖再读取 `<Path>{roots.workflows}/ops/common/rules/shared-services.md</Path>`。
+
+## 流程与完成标准
+
+先固定 project_id、显式 server_ids、环境和实例；读取 <Path>{roots.workflows}/ops/common/rules/host-root-and-onboarding.md</Path>，展示每个目标已登记 host.root 和派生项目根，不从 cwd、默认 HOME 或上次目标猜测；新 Host 缺根确认先转 S。公共 MySQL/Redis/MinIO 作为 shared-service 项目，Host.host_services 里的 Nginx/WireGuard 不伪装成项目。服务器缺接入走 S，缺系统基线走 H；已明确授权的前置 H/D specs 可组成同一 task 顺序执行，不重复确认。
+
+从用户指定的本地路径或固定 Git commit 读取实际清单；analyze 不执行仓库代码。网络获取源码必须用户允许并固定完整提交，不用浮动 main/tag。修改来源版本用 resource_updates 写进新计划，而非伪造旧部署的源码版本。任务执行所用本地构件/脚本放入 input_paths 冻结，编译器新发现的未审阅输入必须停止。
+
+识别项目真实启动、构建、所有持久化参数、环境变量、迁移、健康检查及恢复能力。不能仅生成通用 Compose 后声称完成。选择专用、shared、external 依赖：优先遵循用户指定 provider，多候选不得随机选择。MySQL/Redis/MinIO 按显式逻辑资源与应用账号分配；未知 lauctric 保留原名，需要真实仓库/版本和经验证的适配规则，不猜产品。
+
+生成 APP 专属 compose/service、env、data/component/purpose、logs、backups、releases 与 README。公共服务独立同级，不向 APP 复制其物理数据。APP 副本可以使用同一 allocation；不同 APP 默认不同逻辑数据与凭据。跨 Compose/主机依赖由 Binding 与执行序列管理，不能使用跨文件 depends_on 冒充协调。
+
+完整 plan 明示持久化映射、来源和构件摘要、执行顺序、账号版本、网络、受影响消费者、数据库迁移单一执行者、备份与恢复限制。新装或现有 provider 均先准备并验证，再分配逻辑资源，再部署消费者。跨主机失败停止后续，逐主机保留事实，不假装全局事务。
+
+已确认任务按 workspace-and-authorization.md 连续执行；未采用任务授权时仍须精确单计划批准。upgrade/rollback 使用新的明确版本和新计划，不把旧授权或数据回滚隐含继承。迁移创建新的 deployment 身份，源数据的备份、复制、追平、验证和切换步骤必须项目专用且在计划中；通用执行器不生成未经验证的数据库恢复命令。
+
+uninstall 只停止自身、退役绑定和实例，保留所有数据、账号、公共服务和共享网络。删除逻辑业务数据不是默认能力。
+
+完成条件：所有业务步骤与健康检查成功；服务端 README 具有最新版本、时间、配置、持久化、步骤和依赖；控制端对应目录保存完整部署记录和受限真实配置镜像，普通文档默认 secret_ref，明文导出需显式 opt-in；两边文档 SHA256 回执通过。docs_pending 不得报全部完成。最后执行 V 更新项目→服务器与服务器→项目清单。
+
+需要实际命令参数时，只查当前动作的合同：`<Path>{roots.workflows}/ops/common/USAGE.md</Path>` 与 `<Path>{roots.workflows}/ops/common/WORKSPACE-USAGE.md</Path>`；执行只通过现有 ops.mjs 网关及明确新增的任务命令，不绕过授权直接拼接目标修改命令。
+
+## 接收 SpecDev 成果（仅存在交付请求时）
+
+SpecDev 已安装且存在该参考时读取 `<Path>{roots.workflows}/specdev/common/rules/deployment-handoff.md</Path>`，在既有 source/deployments.notes 与原 Evidence/回执中连接双方事实；没有安装 SpecDev 时只要求可核验的原始交付资料，不创建假 change。目标与授权仍由 OPS 原网关取得，不能继承开发权限；OPS 不代写开发 Ticket。

package/template/workflows/ops/ops-h-host-manage/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: ops-h-host-manage
+description: "只维护一个明确服务器的系统基线、Docker 和主机级入口，不把系统配置误路由到项目。"
+metadata:
+  speculo-kind: work-skill
+  speculo-id: ops/host-manage
+  speculo-domain: ops
+  speculo-contract-version: "2"
+---
+
+# 服务器环境与治理
+
+激活后读取 `<Path>{roots.workflows}/ops/common/rules/domain-runtime.md</Path>` 与 `<Path>{roots.workflows}/ops/common/rules/activation-and-memory.md</Path>`。输入是一个明确的 local/SSH host_id（用户侧 server_id）；只维护系统环境，不从当前目录推断项目或扩大部署范围。
+
+## 读取范围与预检
+
+定位最近盘点与当前问题证据。未登记或 SSH 接入未验证时转 `<Path>{roots.workflows}/ops/ops-s-server-connect/SKILL.md</Path>`；Linux SSH 缺 Node 的 bootstrap-node / enroll 也由该入口按唯一 onboarding 协议处理，已有工具复用。
+
+计划、执行或恢复前必须读取 `<Path>{roots.workflows}/ops/common/rules/workspace-and-authorization.md</Path>`、`<Path>{roots.workflows}/ops/common/rules/persistence-and-secrets.md</Path>` 和 `<Path>{roots.workflows}/ops/common/rules/recovery.md</Path>`。按本次 profile 读取 `<Path>{roots.workflows}/ops/ops-h-host-manage/references/host-profiles.md</Path>` 的工具环境、Docker/镜像源、资源清理或系统控制/入口章节。
+
+## 最小初始化
+
+首次准备 Host 先读 <Path>{roots.workflows}/ops/common/rules/host-root-and-onboarding.md</Path>，使用 server-initialize-spec 生成 H/prepare 规格，经原批准/执行通道补齐根内目录及双边文档。复用现有目录，不改账号 HOME 权限；Docker、语言环境和入口服务按具体需求补齐。登记成功不等于目录、文档或项目运行环境已就绪。
+
+## 计划与执行
+
+明确受影响消费者 `acknowledged_consumers`；任务还需列 `related_project_ids` 与相关 server_ids。计划包含下载、系统控制文件、服务重启、默认恢复、持久化和验证。影响项目布局/双边文档时先读 `<Path>{roots.workflows}/ops/common/rules/deployment-layout.md</Path>`；共享服务消费者再读 `<Path>{roots.workflows}/ops/common/rules/shared-services.md</Path>`。
+
+通过 `<Path>{roots.workflows}/ops/common/tools/ops.mjs</Path>` 执行已确认任务，或原单计划精确批准，不直接拼接绕过网关的修改命令。不擅改 shell profile、删旧环境或清未知进程/数据。系统控制文件仅有计划内精确例外，业务数据不享有该例外；生成器负责的文档和知识投影不手写覆盖。
+
+## 验收与恢复
+
+执行需求对应的 server-check profile，保留未测项与实际失败；检查不代替双边回执或 APP 业务健康。成功刷新主机双边记录并转 `<Path>{roots.workflows}/ops/ops-v-inventory-view/SKILL.md</Path>` 更新清单。
+
+缺权限/输入、漂移、锁或 failed/unknown 时按恢复合同停止受影响步骤，保留原 Run 和现场，不以新 task 绕过未知动作。返回目标、实际修改、检查/回执、未完成项和恢复路径；不把视图失败当作重跑业务的理由。

package/template/workflows/ops/ops-i-initialize/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: ops-i-initialize
+description: "仅准备发起任务的控制端，建立受限状态根与本机工具证据，不默认登记部署服务器。"
+metadata:
+  speculo-kind: work-skill
+  speculo-id: ops/initialize
+  speculo-domain: ops
+  speculo-contract-version: "2"
+---
+
+# 控制端初始化
+
+激活本 Work 后先读取 `<Path>{roots.workflows}/ops/common/rules/domain-runtime.md</Path>`。
+
+## 读取范围
+
+读取 `<Path>{roots.workflows}/ops/common/rules/activation-and-memory.md</Path>`，按当前 ID 定位最小证据。
+
+## 流程与完成标准
+
+先只读识别 shell、SSH、Git、Node、uv、JDK 和权限；已有且满足要求的工具复用。控制端执行器是 Node；bootstrap 的 probe 只做检测。用户提供带 SHA256 的可信安装器并确认后才执行引导。安装器完整命令/作用范围必须先展示。
+
+使用 init 创建控制端身份与绝对 state 根，记录当前工具版本；不会顺便连接远端或清理当前机器。控制端受限账本和默认凭据文档策略按 `<Path>{roots.workflows}/ops/common/rules/persistence-and-secrets.md</Path>` 初始化，不加载后续服务器部署配方。新文档只含 secret_ref，明文交付必须显式 opt-in；真实 env/配置镜像仍受限保存。
+
+服务器登记和根选择交给 S，项目登记/安排交给 D；不编造身份、用户名、旧密码或工具版本。控制端需要作为部署目标时必须另外明确登记 local Host，不能把“本机准备”自动变成项目配置。初始化系统软件时再读取 `<Path>{roots.workflows}/ops/common/rules/workspace-and-authorization.md</Path>` 和原 I/H 的完整 spec/plan；缺少管理员权限就报告阻塞，不绕过 sudo。
+
+完成条件：控制端状态有效、目录权限受限、工具盘点有证据，后续入口可以独立运行。未具备的服务器能力明确列为缺口。下一步接入服务器用 S，查看已登记资产用 V。
+
+需要实际命令参数时，只查当前动作的合同：`<Path>{roots.workflows}/ops/common/USAGE.md</Path>` 与 `<Path>{roots.workflows}/ops/common/WORKSPACE-USAGE.md</Path>`；执行只通过现有 ops.mjs 网关及明确新增的任务命令，不绕过授权直接拼接目标修改命令。

package/template/workflows/ops/ops-s-server-connect/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: ops-s-server-connect
+description: "处理指定服务器的可信 SSH、真实登录主目录探测、用户确认持久化根及接入登记，不部署项目或隐式改写 sshd。"
+metadata:
+  speculo-kind: work-skill
+  speculo-id: ops/server-connect
+  speculo-domain: ops
+  speculo-contract-version: "2"
+---
+
+# 服务器接入与登记
+
+激活本 Work 后先读取 `<Path>{roots.workflows}/ops/common/rules/domain-runtime.md</Path>`。
+
+## 读取范围
+
+读取 `<Path>{roots.workflows}/ops/common/rules/activation-and-memory.md</Path>`，按当前 ID 定位最小证据。
+
+## 流程与完成标准
+
+必读 `<Path>{roots.workflows}/ops/common/rules/server-onboarding.md</Path>` 和 <Path>{roots.workflows}/ops/common/rules/host-root-and-onboarding.md</Path>。输入为明确 server_id、真实地址/端口、远端账号、已验证主机指纹及私钥/agent 来源；根在连接后识别主目录并由用户选定。已有明确指定直接记录，不重复问确认。
+
+按 onboarding 唯一顺序推进：可信接入 → server-discover（不提权）→ 用户选定根 / server-root-confirm → 必要的固定 Node 引导 → enroll/盘点 → server-check base。已明确授权的正常步骤连续推进；没有初次信任或可用认证时记录具体阻塞，不能以自动接受指纹、明文密码参数或任意 shell 写 authorized_keys 绕过原网关。
+
+新增 records/servers/ID/checks 只由 server-check 写入，不手工补 pass。完成产物为 status.hosts 资源、账号/根确认回执、原 inventory、接入检查回执及缺口清单；登记成功不等于接入成功，base-ready 不等于可部署所有项目。
+
+服务器接入完成后：用户已要求服务器初始化则进入 H 的最小初始化；只要求接入则返回路由。更换账号通过 server-connection-spec 验证同机身份并保留原根，按 S 的精确计划批准更新连接。系统环境用 H，项目部署用 D，列表与查看用 V。不从用户当前项目目录推断部署目标，不将控制端自动登记为目标机器。
+
+需要实际命令参数时，只查当前动作的合同：`<Path>{roots.workflows}/ops/common/USAGE.md</Path>` 与 `<Path>{roots.workflows}/ops/common/WORKSPACE-USAGE.md</Path>`；执行只通过现有 ops.mjs 网关及明确新增的任务命令，不绕过授权直接拼接目标修改命令。

package/template/workflows/ops/ops-v-inventory-view/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: ops-v-inventory-view
+description: "从现有资源和检查证据生成简单 MD、标准 JSON 与离线 HTML，双向查看服务器与项目，不连接或修改目标。"
+metadata:
+  speculo-kind: work-skill
+  speculo-id: ops/inventory-view
+  speculo-domain: ops
+  speculo-contract-version: "2"
+---
+
+# 服务器与部署资产视图
+
+激活本 Work 后先读取 `<Path>{roots.workflows}/ops/common/rules/domain-runtime.md</Path>`。
+
+视图按 Host 与 Project 双向组织，并列出连接账号、持久化根、根确认状态以及目录/双边文档/项目运行环境的分别验证结果；旧根标记 legacy-registered，不补造确认。只读取允许的回执摘要，不输出确认原话或私钥来源。
+
+## 读取范围
+
+读取 `<Path>{roots.workflows}/ops/common/rules/activation-and-memory.md</Path>`，按当前 ID 定位最小证据。
+
+## 流程与完成标准
+
+必读 `<Path>{roots.workflows}/ops/common/rules/inventory-and-records.md</Path>`。输入为明确的已初始化 state 根，以及可选的检查过期阈值；服务器/项目筛选只影响浏览，不授予执行权。
+
+通过 ops.mjs fleet 生成 state_root/FLEET.md 入口与 records/views/view-id/{inventory.json,FLEET.md,index.html,manifest.json}。HTML 使用 `<Path>{roots.workflows}/ops/common/templates/FLEET.html</Path>`，JSON 遵循 `<Path>{roots.workflows}/ops/common/schemas/fleet-view.schema.json</Path>`；不额外启动服务、安装依赖或访问 CDN。
+
+产物由 fleet 独占生成，不手改投影；永不读取 private、env、server-files、任务规格或授权文本用于展示。服务器、项目、部署、主机级服务、外部依赖、任务及 Run 状态必须保留真实关系，desired 与 observed 版本分开，未测/过期/未知不改成正常。
+
+完成条件：所有视图文件已读回匹配 manifest；FLEET.md 指向同一批次 HTML/JSON；没有 catalog 漂移或链接越界；提供本机可打开的实际路径。生成失败保留旧入口，只报告视图失败，不重跑业务，也不回写 status.json。
+
+刷新视图是本地衍生记录操作，不需要每次再确认部署。要重新检查服务器时转 S/H 的明确只读 server-check；要改部署时转 D，新任务不能来自看板按钮。
+
+需要命令参数时只查 `<Path>{roots.workflows}/ops/common/WORKSPACE-USAGE.md</Path>` 的 fleet 段。V 不读取 workspace-and-authorization、部署布局或凭据协议来渲染视图；不把这些文件、任务授权或私密原文作为展示数据。

package/template/workflows/person/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: person
+description: "用于认知方法咨询和双向钢人论证；按具体问题选择能力，不自动启动其他流程。"
+metadata:
+  speculo-kind: domain-skill
+  speculo-id: domain/person
+  speculo-domain: person
+  speculo-contract-version: "2"
+---
+
+# person
+
+## 发现与激活
+
+只读发现不创建状态、不执行 Work、不取得写入授权。先按 ID/关键词定位相关能力和永久知识条目，再少量回读原文与 provenance。用户指定具体 Work 时直接进入该入口；不需要再次激活本领域。
+
+明确进入本领域后读取 <Path>{roots.workflows}/person/common/rules/activation-and-memory.md</Path>，解析 workspace，仅读取当前任务需要的状态、入口与分支参考。缺少输入、权限、有效 schema 或 owner 冲突时停止受影响分支并保留恢复证据。
+
+## 能力路由
+
+<!-- AUTO-INDEX-START -->
+
+- **person/mao-zedong-cognitive-os** — 毛泽东 · 认知操作系统：<Path>{roots.workflows}/person/person-m-mao-zedong-cognitive-os/SKILL.md</Path>
+- **person/steelman-deliberation** — 双向钢人论证：<Path>{roots.workflows}/person/person-s-steelman-deliberation/SKILL.md</Path>
+
+<!-- AUTO-INDEX-END -->
+
+## 永久知识
+
+本领域不声明独立永久知识 namespace。
+
+正式写入前检查原 owner/gateway、未闭合事务及恢复证据。读取索引不自动激活能力，未知网关只阻塞对应写入。

package/template/workflows/person/manifest.json

@@ -1 +1,57 @@
-{"schema_version":1,"id":"person","version":"1.0.0","persistent_knowledge":[],"stages":[{"id":"frame","after":[],"inputs":["question"],"outputs":["dossier"],"risk":"read-only","context_budget":14000},{"id":"deliberate","after":["frame"],"inputs":["dossier"],"outputs":["decision"],"risk":"read-only","context_budget":18000},{"id":"act","after":["deliberate"],"inputs":["decision"],"outputs":["actions"],"risk":"local-reversible","context_budget":10000}]}
+{
+  "schema_version": 2,
+  "id": "person",
+  "version": "1.0.0",
+  "persistent_knowledge": [],
+  "stages": [
+    {
+      "id": "frame",
+      "after": [],
+      "inputs": [
+        "question"
+      ],
+      "outputs": [
+        "dossier"
+      ],
+      "risk": "read-only",
+      "context_budget": 14000
+    },
+    {
+      "id": "deliberate",
+      "after": [
+        "frame"
+      ],
+      "inputs": [
+        "dossier"
+      ],
+      "outputs": [
+        "decision"
+      ],
+      "risk": "read-only",
+      "context_budget": 18000
+    },
+    {
+      "id": "act",
+      "after": [
+        "deliberate"
+      ],
+      "inputs": [
+        "decision"
+      ],
+      "outputs": [
+        "actions"
+      ],
+      "risk": "local-reversible",
+      "context_budget": 10000
+    }
+  ],
+  "entry": "SKILL.md",
+  "works": [
+    "person-m-mao-zedong-cognitive-os/SKILL.md",
+    "person-s-steelman-deliberation/SKILL.md"
+  ],
+  "work_stages": {
+    "person-m-mao-zedong-cognitive-os/SKILL.md": [],
+    "person-s-steelman-deliberation/SKILL.md": []
+  }
+}

package/template/workflows/person/person-m-mao-zedong-cognitive-os/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: person-m-mao-zedong-cognitive-os
+description: "以毛泽东方法论为底座的问题诊断、战略制定与行动规划咨询"
+metadata:
+  speculo-kind: work-skill
+  speculo-id: person/mao-zedong-cognitive-os
+  speculo-domain: person
+  speculo-contract-version: "2"
+---
+
+# 毛泽东 · 认知操作系统
+
+以特定方法论开展“分析问题—制定战略—组织行动”咨询，产物只写当前 person change。激活时读取 `<Path>{roots.workflows}/person/common/rules/activation-and-memory.md</Path>`；Person 没有 README，不加载其他 phase 或整套书籍。
+
+## 按阶段推进
+
+下表有序且硬依赖：上一阶段产物完成、验证后才进入下一阶段。每个阶段只读取自己的入口，角色、声音、模型和引用纪律由该入口及其参考单点维护。
+
+| 阶段 | 进入时读取 | 产物与可判定完成门 |
+|---|---|---|
+| 1 激活与问诊 | `<Path>{roots.workflows}/person/person-m-mao-zedong-cognitive-os/references/activate.md</Path>` | `<Path>{roots.state}/person/changes/{change}/problem-statement.md</Path>`：首次激活声明；开口三问中至少追问两题且用户回应；问题类型和主框架确定；六段填实 |
+| 2 诊断分析 | `<Path>{roots.workflows}/person/person-m-mao-zedong-cognitive-os/references/diagnose.md</Path>` | `<Path>{roots.state}/person/changes/{change}/analysis.md</Path>`：至少两个 Module A 模型；必过 A1，二手信息过 A3，多方利益过 A6；每个结论含条件/局限，主要矛盾有论证 |
+| 3 战略制定 | `<Path>{roots.workflows}/person/person-m-mao-zedong-cognitive-os/references/strategize.md</Path>` | `<Path>{roots.state}/person/changes/{change}/strategy.md</Path>`：沿定性→定向→站位→时间→投放→运用展开主框架；必要辅助框架；至少两阶段及明确关键战役 |
+| 4 组织行动 | `<Path>{roots.workflows}/person/person-m-mao-zedong-cognitive-os/references/mobilize.md</Path>` | `<Path>{roots.state}/person/changes/{change}/action-plan.md</Path>`：行动、责任人、期限、完成条件、失败处置与反馈机制明确 |
+| 5 综合交付 | `<Path>{roots.workflows}/person/person-m-mao-zedong-cognitive-os/references/deliver.md</Path>` | `<Path>{roots.state}/person/changes/{change}/consultation-output.md</Path>`：按交付模板整合四阶段，教员第一人称、五拍论证、收尾四动作、反模式检查与内在张力标注；全部原文引用有篇目出处 |
+
+每项产物回读后必须无残留 `[TODO:]`；缺少用户回应、阶段证据或原文出处时保留当前阶段，不用后续产物掩盖缺口。
+
+## 引用检索
+
+需要引用时，先读当前 phase 的 framework index，再在 `<Path>{roots.workflows}/person/person-m-mao-zedong-cognitive-os/references/research/15-quote-bank.md</Path>` 定位篇目编号，最后仅回读匹配的原文。目录映射查询 `<Path>{roots.workflows}/person/person-m-mao-zedong-cognitive-os/books/README.md</Path>`；无匹配证据则停止该引用或依赖结论，不扫描整套书籍。
+
+## 状态追踪
+
+咨询过程中维护以下状态字段，记录在 `<Path>{roots.state}/person/status.json</Path>` 中：
+
+- **`problem_type`**（字符串）—— 问题类型，从激活阶段的问题类型表中选定
+- **`primary_framework`**（字符串）—— 匹配的主框架及篇目编号
+- **`models_applied`**（数组）—— 诊断阶段已应用的 Module A 模型列表
+- **`frameworks_applied`**（数组）—— 战略阶段已应用的 Module B 框架列表
+- **`methods_applied`**（数组）—— 组织阶段已应用的 Module C 方法列表
+- **`quotes_cited`**（数组）—— 已引用的毛泽东原话及出处
+- **`consultation_status`**（字符串）—— 当前阶段：`activating` → `diagnosing` → `strategizing` → `mobilizing` → `delivering` → `completed`

package/template/workflows/person/person-m-mao-zedong-cognitive-os/books/README.md

@@ -0,0 +1,17 @@
+# 《毛泽东选集》知识库导航
+
+本目录收录 229 篇数字化原文（编号 000–228），供 `M-mao-zedong-cognitive-os` workflow 离线检索与引用。
+
+## 快速入口
+
+| 用途 | 路径 |
+|------|------|
+| 层级目录（按卷次浏览） | [`src/目录.md`](src/目录.md) |
+| 金句与篇目编号映射 | [`../references/research/15-quote-bank.md`](../references/research/15-quote-bank.md) |
+| 单篇原文 | `src/NNN-标题.md`（先查 quote-bank 得编号，再打开对应文件） |
+
+## 引用纪律
+
+1. 引金句先读 `references/research/15-quote-bank.md`，再按编号打开单个 `src/NNN-*.md`；不得默认扫描或整读 `books/src/`。
+2. 逐字原文加引号并标注篇目；概括转述标注「转述/大意」。
+3. 建国后争议文本只取方法论句，并附边界提示。