@qijenchen/design-system 0.1.0-beta.13 → 0.1.0-beta.130

package/ds-canonical/skills/independent-review/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: independent-review
+description: Obtain a provider-adaptive, read-only second opinion on product-repository changes; use before accepting a material product, design-system-consumption, exact-package-upgrade, or canary conclusion that needs review by a distinct provider.
+---
+
+# Independent product review
+
+Use this workflow only for product-consumer work. Canonical semantics request an independent capability, never a provider, model, version, API, context length, or token count. The provider adapter resolves the exact reviewer only through the registered capability policy; never infer it from a skill name or prose.
+
+## Preconditions
+
+- Bind `authorProvider` to the current provider and exclude it from selection. Resolve the highest policy-allowed certified assurance, reasoning, and compute capability from a different provider. Assurance tiers are `standard`, `high`, and `maximum`; Tier-0 governance requires `maximum`.
+- Budget may change deterministic batching or stop the review, but must never downgrade capability, model, reasoning, compute, or coverage. A subscription entitlement is a route constraint, not a model identity; it requires exact certified adapter-readback evidence.
+- Freeze the Git head/tree, diff, complete in-scope inventory, user wording, applicable product rules, installed governance lock, and verification artifacts. Digest the packet before dispatch.
+- After selection, freeze the exact provider, review profile, model release, entitlement where applicable, and provider/capability/certification/invocation/model-release registry digests. Reject mutable aliases and any response substitution.
+- Finish the author's analysis before revealing it to the peer. Send facts and criteria, not the author's conclusions.
+- Enforce a separate read-only peer context. Fingerprint status and binary diff before and after; mutation, missing identity, or moving inputs produce `REVIEW-BLOCKED`.
+
+An unknown provider, absent binding, same-provider peer, uncertified target, unavailable transport, or incomplete evidence is `REVIEW-BLOCKED`. Never impersonate a peer or downgrade the requirement silently.
+
+## Role boundary
+
+Review product code, product tests/stories, product configuration, use of installed public design-system APIs, exact-version upgrade effects, and product canary evidence.
+
+Do not edit anything. Do not authorize or perform design-system canonical changes, template/governance corpus changes, package publication, release/promotion, privileged GitHub changes, deep-audit remediation, or fleet rollout. If a finding belongs upstream, identify the owner and provide a minimal reproduction; leave the upstream change to the DS-author workflow.
+
+## Workflow
+
+1. Classify the target as a product consumer from committed evidence. Otherwise return `ROLE-BLOCKED`.
+2. Build one neutral brief containing the frozen inventory, criteria, artifact digests, and explicit questions. Exclude all author conclusions.
+3. Resolve and freeze the highest certified distinct capability, then dispatch through its registered adapter/transport. Require provider, exact profile/model release, entitlement where applicable, context, transport, target-certification, selection receipt, and input-digest evidence.
+4. Require the peer to inspect the full declared scope, cite path/line or runtime artifacts, report counterexamples and uncertainty, and remain read-only.
+5. Validate the returned identity, certification, digests, coverage, and before/after fingerprints before reading the verdict.
+6. Reproduce each material claim against the frozen source. Classify it as verified, false, partial, or evidence-blocked; never resolve disagreement by vote.
+7. Emit the evidence record described in [references/evidence-contract.md](references/evidence-contract.md). Suggestions remain text only.
+
+Return `PASS`, evidence-backed findings, `ROLE-BLOCKED`, or `REVIEW-BLOCKED`. A local unbrokered opinion may be useful, but label it `LOCAL-REVIEW-ONLY`; it cannot satisfy a required independent-review gate.

package/ds-canonical/skills/independent-review/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Independent Review"
+  short_description: "Read-only cross-provider product second opinion"
+  default_prompt: "Use $independent-review to obtain an evidence-bound read-only second opinion from a distinct provider."

package/ds-canonical/skills/independent-review/references/evidence-contract.md

@@ -0,0 +1,23 @@
+# Independent-review evidence contract
+
+Use the transport selected by the generated provider binding. Do not invent a provider command, copy credentials into the repository, or create a second evidence schema.
+
+The model-broker execution layer (evidence broker, shard/transcript carriers, model runner, managed-CI executors) was retired 2026-08-04; broker or managed receipts are permanently rejected. The surviving authority-owned contract surfaces are `scripts/lib/deep-audit-evidence-contract.mjs` (waived self-review and entitlement review-lane validation) and `scripts/lib/model-api-transport.mjs` (pure invocation-profile and response-substitution contract). A product reviewer consumes their validated receipt but never edits, publishes, or executes authority release controls. If a validated receipt is unavailable, use `LOCAL-REVIEW-ONLY` or `REVIEW-BLOCKED`, never managed or certified evidence.
+
+A caller-supplied JavaScript callback, a self-declared model string, or structurally valid result
+JSON is not transport attestation and can never yield `REVIEW-VALIDATED`. An independent-review
+claim requires the entitlement review lane: a resolved provider binding whose peer, profile, and
+entitlement readback are certified for the exact target, with response substitution fail-closed.
+Without that binding the only honest outcomes are the waived self-review route (recorded waiver,
+self-attested coverage, `unverifiedModelCoverage` visible) or `REVIEW-BLOCKED`.
+
+Emit one closed review record in the response with:
+
+- outcome and evidence class;
+- author/current/peer provider, model release, context, transport, and exact target-certification identity;
+- repository, head, tree, diff, inventory, rubric, brief, and peer-output digests;
+- before/after worktree fingerprints and mutation verdict;
+- complete scope coverage, verified findings, rejected claims, unresolved disagreements, and unavailable evidence;
+- explicit role-boundary confirmation: no files, Git state, comments, external systems, releases, or upstream canonical sources were mutated.
+
+Missing fields or digest mismatch produce `REVIEW-BLOCKED`. The record is evidence about a review, not authorization to change or release anything.

package/ds-canonical/skills/knowledge-prune/SKILL.md

@@ -1,19 +1,21 @@
 ---
 name: knowledge-prune
-description: Prune governance sprawl across CLAUDE.md / specs / skills / hooks / memory / settings. Finds duplicate rules (Rule-of-3), dead hooks (6mo 0 fire via `.claude/logs/hook-fires-per-hook.jsonl`), stale memories, over-concrete bug case studies that should abstract to meta, and contradictions across homes. Enforces per-file budget (CLAUDE.md target ≤ 200 / transition ≤ 400, spec ≤ 300, SKILL ≤ 250, memory ≤ 100) and retire rate ≥ 5% / quarter. Invoke via /knowledge-prune quarterly or when CLAUDE.md > 800 / MEMORY.md > 20 entries / audit Phase F reports sprawl. Auto-chained by /design-system-audit --deep Phase 4.5.
+description: Prune governance sprawl across provider-neutral instructions / specs / skills / hooks / memory / settings. Finds duplicate rules (Rule-of-3), dead hooks from the Git-owned provider telemetry state, stale memories, over-concrete bug case studies that should abstract to meta, and contradictions across homes. Enforces per-file budgets and quantifies quarterly retire rate without forcing deletion. Invoke quarterly or when governance exceeds its documented budgets. Auto-chained by /design-system-audit --deep Phase 4.5.
 ---
 
 # Knowledge Prune — 治理反膨脹 skill
 
-**目的**:本 DS governance 自身是活的知識庫,若只 append 會讓 CLAUDE.md 載入成本失控、MEMORY.md 條目爆炸、hook 變殭屍、spec.md 重複。本 skill 掃 8 個 home 找冗贅,提議 retire 候選,加嚴執行 Rule-of-3 SSOT + 行數預算。
+**目的**:本 DS governance 自身是活的知識庫,若只 append 會讓 provider-neutral canonical 載入成本失控、MEMORY.md 條目爆炸、hook 變殭屍、spec.md 重複。本 skill 依 `design-system-audit/references/rule-placement.md` 的 Level 1–9 taxonomy 與 provider registry 動態枚舉 canonical homes 找冗贅,提議 retire 候選,加嚴執行 Rule-of-3 SSOT + 行數預算;`.claude/**` / `.agents/**` 只是 generated provider delivery/discovery view,不參與 authority 枚舉或 retire 決策。
 
-**對齊 CLAUDE.md `# 資訊治理 canonical`**:本 skill 是 L3(Periodic deep)實作。L1(pre-write hook)+ L2(fire log)自動執行,L3 需人決策 canonical retire,走 checkpoint。
+**🔒 核心前提(每次必遵,不需 user 提醒 — mindset #6「tell me once」)**:prune 唯一目的是**移除噪音以銳化 signal、提升遵循正確率**,**絕不以犧牲品質換行數 / 條目下降**。每次跑同時必滿足:(a) 品質不可因 prune 打折;(b) 以**提升品質**(清晰度↑ / drift 風險↓ / recall 精度↑)為目標。故:① 只 retire 真冗餘 / stale / 已被上游完整吸收的條目(這類本身是噪音,清掉反提升正確率);② consolidate 重複(同概念多 home → 選 SSOT + pointer);③ **每條真實 invariant / 機械防線必完整保留 — retire 前必 grep 確認保護已被別處覆蓋,否則不動**;④ distinct 條目強合成大條目會降 recall 精度 = 反 pattern,不做。**retire rate 是結果指標非目標**:湊 % 傷品質 = 違本前提;寧可 retire rate < 5% + report 明寫「成熟無冗餘」rationale,也不強刪真保護。本前提 override 下方所有 Phase / Checkpoint 的數值 target。
 
-**對齊 CLAUDE.md `# 稽核 canonical`「Audit-vs-execute 分權」**:動 canonical substantive meaning → **STOP 提議**;對齊 / 清 duplicate / 回填 pointer → **AUTO**。
+**對齊 `AGENTS.md` `# 治理 canonical`**:本 skill 是 L3(Periodic deep)實作。L1(pre-write hook)+ L2(fire log)自動執行；L3 的純工程治理 retire／consolidate 決策已 standing-delegated，依 evidence 與最高可用工程能力自主收斂。只有 task／deliverable 明確要求時才啟動 independent review；明確 waiver 必記錄且不得冒充已做。
+
+**Authority boundary**:canonical substantive 本身不是 human gate。只有 resolution 會改變產品／UI／UX SSOT 且仍存在真實取捨才 **STOP**；治理 ownership、hook/skill lifecycle、架構與表達／duplicate／pointer 都依 `AGENTS.md # 自主執行 canonical` **AUTO**。
 
 ## When to run
 
-- CLAUDE.md 超過 800 行(hook 硬 cap 觸發)
+- Bootstrap instructions(`AGENTS.md` + provider import shell) 超過 800 行(hook 硬 cap 觸發)
 - MEMORY.md 超過 20 條 index
 - 季度健檢(每 3 個月跑 1 次)
 - `/design-system-audit --deep` Phase 4.5 自動 chain
@@ -26,34 +28,32 @@ description: Prune governance sprawl across CLAUDE.md / specs / skills / hooks /
 - 不刪歷史 commit / git log
 - 不 rewrite spec.md 內容(只刪 duplicate / 提議合併,實質改寫走 `/design-system-audit`)
 
----
-
 ## Workflow(5 phases)
 
 ### Phase 0 — Baseline scan(AUTO)
 
-掃 8 個 home 建立基準表:
+依 Level 1–9 taxonomy + canonical provider registry 動態枚舉 homes，建立基準表（下表是最低必含，不是封閉清單）:
 
 ```
 Home              Size           Over-budget?
 ─────────────────────────────────────────────
-CLAUDE.md         N lines        [target ≤ 200 / transition ≤ 400 / hard cap 800]
+Bootstrap         N lines        [AGENTS.md + provider import shell;target ≤ 250 / transition ≤ 400 / hard cap 800]
 MEMORY.md         N entries      [≤20]
 spec.md total     N files        per-file ≤300
 SKILL.md total    N files        per-file ≤250
 hooks             N scripts      (count only, Phase 3 看 fire log)
 memory files      N              per-file ≤100
-.claude/logs/     parse existing  (feed Phase 3)
+<absolute-git-dir>/governance-runtime/evidence/ parse existing evidence(feed Phase 3)
 ```
 
 **Output**:`phase0-baseline.md`(session-local,不 commit)
 
 ### Phase 0.5 — 讀 external signal(AUTO)
 
-讀 `.claude/logs/` + `.claude/benchmarks/`(Commit 5 後):
+讀 Git-owned provider-neutral evidence `<absolute-git-dir>/governance-runtime/evidence/` + provider telemetry `${GOVERNANCE_STATE_DIR}` + benchmark policy `governance/benchmarks/`:
 
 - `hook-fires.jsonl` — governance-file edits(tool/path per event);用於 hot governance files 分析
-- `hook-fires-per-hook.jsonl` — per-hook fire count(2026-04-25 起);via shared helper `.claude/hooks/_log-fire.sh`;啟用 D2 dead-hook detection
+- `hook-fires-per-hook.jsonl` — per-hook fire count(2026-04-25 起);via canonical shared helper `packages/design-system/ds-canonical/hooks/_log-fire.sh`;啟用 D2 dead-hook detection
 - `skill-invokes.jsonl`(若存在)— 過去 3 月每 skill invoke 次數
 - `user-corrections.jsonl`(若存在)— pending codification 清單
 - `benchmarks/claude-code-features.jsonl` — 新 CC feature 採用提議
@@ -71,16 +71,19 @@ Scan:同概念(同 keyword / 同 canonical)出現在 ≥ 3 個不同 home 寫完
 
 Example violations(historic — 2026-05-22 prune verify 後均已收斂為 pointer 模式,僅留作教學範例):
 - `Portal 逃脫 theme`:過去在 hover-card.spec.md / avatar.spec.md / color.spec.md 各重述;現只 M3 SSOT + 各 spec pointer。2026-05-22 audit verify 為已對齊(僅 ui-development.md / meta-patterns.md 2 home 涉及,clean pointer)
-- `Inline Action vs Button predicate`:過去 CLAUDE.md / item-anatomy.spec.md / button.spec.md 各完整;現 `inline-action.spec.md` 為 SSOT,其他 cross-link
-- 新範例(2026-05-22 抓):**hook count threshold** 在 CLAUDE.md L35 / meta-patterns M14 / M20 / `session_start_governance_check.sh:173` 4 處 drift 3 值(40/35/30)→ M14/M20 strip 數字改 pointer SSOT 修
+- `Inline Action vs Button predicate`:過去 `AGENTS.md` / item-anatomy.spec.md / button.spec.md 各完整;現 `inline-action.spec.md` 為 SSOT,其他 cross-link
+- 新範例(2026-05-22 抓):**hook count threshold** 在 `AGENTS.md` `# 治理 canonical` 行數預算表 / meta-patterns M14 / M20 / `session_start_governance_check.sh` 4 處 drift 3 值(40/35/30)→ M14/M20 strip 數字改 pointer SSOT 修
 
 **Output**:duplicate cluster 清單 + 建議 SSOT home。
 
 #### D2 — Dead & stale(fire / edit recency)
 
-- **Dead hooks**:讀 `.claude/logs/hook-fires-per-hook.jsonl`(2026-04-25 起 instrumented via `_log-fire.sh` helper),6 月 0 fire 的 hook 名 → retire 提名
-- **Stale memories**:`ls -la ~/.claude/.../memory/*.md`,6 月無 git log 變動且不在 MEMORY.md index head = stale
+- **Dead hooks**:跑 `npm run audit:hook-quality`(= `scripts/audit-hook-quality.mjs`,讀 Git-owned provider telemetry `${GOVERNANCE_STATE_DIR}/hook-fires-per-hook.jsonl`,產 report → `<absolute-git-dir>/governance-runtime/evidence/audit/hook-quality-report.json`:fire_count_6mo / fire_per_day / hot-warm-cool-dead / orphan / retire_candidate)。6 月 0 fire 的 hook 名 → retire 提名(report 已標 `dead`)
+- **Stale memories**:只枚舉 repository SSOT `governance/memory/*.md`；以 `git log -- governance/memory/<file>`、`governance/memory/MEMORY.md` index 與 `governance/memory/contract.json` 判斷。不得讀取或回寫任何 provider home/cache 來決定 authority。
 - **Unused skills**:`skill-invokes.jsonl` 3 月 0 invoke(除非是 rare-event skill,例 `delivery-handoff`)
+- **Commands / context-fork agents**(2026-07-10 hunt 補,原零掃描):先讀 `packages/governance/canonical/providers.json` 的 `canonical.roots.commands` 與 `canonical.roots.contextForkAgents`,再對這兩個 canonical tree 做 enumeration。Commands 對照 `skill-invokes.jsonl`(命令同走 registered skill invocation log);context-fork agents 無 invoke log → 用 canonical file 的 git log recency + transcript grep 判 dead。Provider views 只驗 generated projection,不參與 dead/retire 決策。
+- **References orphan**(2026-07-10 hunt 補):枚舉 `packages/design-system/ds-canonical/references/*.md`,rg 檔名 across `packages/design-system/ds-canonical/skills/` + `AGENTS.md` + `packages/**/*.spec.md` + `packages/design-system/ds-canonical/hooks/`;0 cite = retire 候選。Provider views 僅可用 mirror-check 驗交付完整性,不能反向證明 canonical 在使用。
+- **Stale marker 兌現**(2026-07-10 hunt 補):`marker='stale''-pending-prune'; rg -l "$marker" packages/design-system/ds-canonical/ governance/ AGENTS.md` → 命中即列 update/retire 候選；命令與教學文字不得直接含 marker literal 造成自命中；generated provider view 的同源命中不重複計數。
 
 **Output**:retire 候選 + rationale(`fire=0 / last_edit=2025-10 / 被 M14 吸收`)
 
@@ -96,86 +99,38 @@ Example:
 
 #### D4 — Cross-home contradiction
 
-Scan:CLAUDE.md canonical vs spec.md vs skill reference 描述同概念時**語義衝突**(非表達差異)?
+Scan:`AGENTS.md` canonical vs spec.md vs skill reference 描述同概念時**語義衝突**(非表達差異)?
 
 Example:
-- CLAUDE.md M3 說「Portal 必繼承 data-theme」;但 avatar.spec.md 說「Portal 必繼承 data-theme + data-density」— 差 `data-density`,看誰真 SSOT
-- CLAUDE.md `# 稽核 canonical` 列 D4 UX 同時也談 3-tier scope — 2026-04-24 已合併為一章(原本 2 章重疊)
+- `AGENTS.md` M3 說「Portal 必繼承 data-theme」;但 avatar.spec.md 說「Portal 必繼承 data-theme + data-density」— 差 `data-density`,看誰真 SSOT
+- `AGENTS.md` `# 稽核 canonical` 列 D4 UX 同時也談 3-tier scope — 2026-04-24 已合併為一章(原本 2 章重疊)
 
 **Output**:matrix of 衝突點 + 誰該讓步
 
-#### D5 — Canonical drift(spec vs code 語義漂移)— 2026-05-17 加
-
-Scan:`*.spec.md` 寫的 canonical vs `*.tsx` 實際 code 行為衝突 / spec 寫禁止但 code 仍用 / spec 升級但 code 沒跟。
-
-Example:
-- `radius.spec.md:57-71` 禁 `rounded-xl/2xl/3xl` → grep `packages/design-system/src/**/*.tsx` 仍有用 → drift
-- `field-controls.spec.md` v13 state machine 升級 → 但 Combobox.tsx 還是 v12 behavior → drift
-
-**Output**:per (spec, code) drift entry + 對應 commit hash 追溯 last alignment 時點
-
-#### D6 — Hook-fire health(log-driven)— 2026-05-17 加
-
-讀 `.claude/logs/hook-fires-per-hook.jsonl`,3 大病徵:
-- **Dead**:6 月 0 fire(retire 候選,per `# Retire rules` Hook 規則)
-- **Hot**(過 fire):fire / day > 50 → 可能 false positive 多 / regex 太鬆
-- **Toggle pattern**:同 fire 反覆 inject + retract → hook design 不穩
-
-**Output**:dead retire list + hot tune list + toggle re-design list
-
-#### D7 — Skill-invoke health(log-driven)— 2026-05-17 加
-
-讀 `.claude/logs/skill-invokes.jsonl`,2 大病徵:
-- **Unused**:3 月 0 invoke(除 rare-event skill 如 delivery-handoff)
-- **Always co-invoked**:Skill A 永遠跟 Skill B 一起 invoke → 該合 1 skill 或 chain auto
-
-**Output**:retire list + merge candidate list
-
-#### D8 — Memory recency / orphan— 2026-05-17 加
-
-Scan `~/.claude/.../memory/*.md`:
-- 6 月無 git log 變動 + 不在 MEMORY.md index head = stale candidate(per existing D2 retire rule)
-- file 存在但 MEMORY.md 沒 entry = orphan(可能 retire 漏刪)
-- entry 存在但 file 不在 = broken pointer
-
-**Output**:stale / orphan / broken pointer 3-class list
+#### D5-D10 — 2026-05-17 加維度(各維 scan + Example + Output 詳 references/prune-dimensions-d5-d10.md)
 
-#### D9 — Benchmark / citation debt(2026-05-17 加,對應 M22)
+D5 Canonical drift(spec vs code)/ D6 Hook-fire health / D7 Skill-invoke health / D8 Memory recency-orphan / D9 Benchmark-citation debt(M22)/ D10 Verification artifact rot(M32)。
 
-Scan 全 repo:
-- `@benchmark-unverified-blanket` marker(per file retraction;codify 後該 backfill cite 變 verified)
-- spec.md / tsx 含 world-class DS keyword(Material / Polaris / Carbon / Ant / Atlassian / Apple)但無 inline URL / GitHub path / screenshot ref
-- 過期 benchmark(cite URL 是 v3 但 framework 已 v5)
-
-**Output**:per (file, claim) cite debt entry + 建議 WebFetch 補 source
-
-#### D10 — Verification artifact rot(2026-05-17 加,對應 M32)
-
-Scan 全 audit / test infra:
-- audit script 只驗 `getAttribute(...)` / `class.includes(...)` 不驗 `getBoundingClientRect()` numeric(pixel-quantified 缺)
-- `*.spec.md` 寫 visual canonical 但無對應 playwright snapshot 或 visual-audit 覆蓋
-- stale screenshot ref(snapshot file 6 月未更新)
-
-**Output**:per audit script 升 pixel-quantified 提名 + 缺 visual coverage 列表
-
-### Phase 2 — Triage + Checkpoint 1(MUST ASK)
+### Phase 2 — Triage + authority classification
 
 ```
-Phase 1 findings:
+Phase 1 findings(D1-D10):
 - D1 duplicate: M clusters
 - D2 dead/stale: N items
 - D3 over-concrete: K items (abstract proposals)
 - D4 contradiction: L pairs
+- D5-D10(2026-05-17 加,detail 詳 references/prune-dimensions-d5-d10.md): D5 canonical drift / D6 hook-fire health / D7 skill-invoke health / D8 memory recency-orphan / D9 benchmark-citation debt / D10 verification artifact rot — 各 N items
 
 Priority:
 - P0 (AUTO): 對齊 SSOT / 補 pointer / 刪 confirmed dead hook / retire unused skill — 表達層調整,不動 canonical 意思
 - P1 (AUTO with brief report): 合併 duplicate(保 semantic)/ 刪 6+ 月 stale memory(非 critical)/ 編號 renumber
-- P2 (STOP / CHECKPOINT): 抽新 meta / 合併 contradiction 要選哪邊 / 撤 Meta-Pattern / 改 SSOT ownership
+- P2E (AUTO):抽工程治理 meta / 解 governance contradiction / 撤工程 Meta-Pattern / 改治理 SSOT ownership；若 task／deliverable 明確要求 review，再加 maximum-assurance independent review
+- P2H (HUMAN-ONLY):resolution 會改變產品／UI／UX SSOT，且 evidence 收斂後仍有真實選擇或取捨
 
-Proceed with P0+P1 as atomic commit? Then discuss P2?
+Execution receipt:P0/P1/P2E 的分組、evidence、review binding、rollback；P2H 若有則 batch-at-end 一次列出。
 ```
 
-**Do NOT skip**:P2 動 canonical substantive,per `# 稽核 vs 執行 分權`,必 user sign-off。
+**Do NOT skip authority classification**:純工程 canonical substantive 必自主執行，不能用 user sign-off 代替工程判斷；只有 P2H 停下。
 
 ### Phase 3 — Apply P0 + P1 fixes(分組 commit)
 
@@ -183,21 +138,25 @@ Proceed with P0+P1 as atomic commit? Then discuss P2?
 - 每次 commit 後 `npx tsc -b` 驗證(prune 不動 code,但防 spec path 斷)
 - 每 commit 後重跑 Phase 0 baseline,確認 size 有下降
 
-### Phase 4 — P2 discussion + apply(user sign-off 後)
+### Phase 4 — P2 resolution + apply
+
+- 每 P2 item 一個獨立 commit(animation trail 可回溯)；P2E 依最高 certified capability + evidence 自主收斂，只有明確要求時才加 independent review；P2H 只在取得產品／UI／UX決策後執行
+- 新 meta-pattern 加進 `AGENTS.md` `# Meta-Pattern 預警` → 同時**必檢討哪些下游條目冗餘**(上游加 = 下游減)
 
-- 每 P2 item 一個獨立 commit(animation trail 可回溯)
-- 新 meta-pattern 加進 CLAUDE.md `# Meta-Pattern 預警` → 同時**必檢討哪些下游條目冗餘**(上游加 = 下游減)
+### Phase Z reference — Cross-repo SSOT propagation
+
+詳 references/phase-z-cross-repo-ssot-propagation.md。跨 repo 傳播由 protected PR merge 後的 immutable release workflow + GitHub App upgrade PR 統一觸發；skill 不自行 dispatch、直寫 main 或解析 mutable tag。
 
 ### Phase 5 — Final report + **quantified retire rate** + baseline update
 
 **Retire rate 計算公式**(從 aspirational 轉 quantified,2026-04-24):
 
 ```
-total_governance_items_before = 
-  count(CLAUDE.md 章節) 
+total_governance_items_before =
+  count(AGENTS.md 章節)
   + count(Meta-Pattern 條目)
-  + count(.claude/skills/)
-  + count(.claude/hooks/)
+  + count(packages/design-system/ds-canonical/skills/)
+  + count(packages/design-system/ds-canonical/hooks/)
   + count(MEMORY.md entries)
   + count(memory files)
   + count(spec.md SSOT anchors)
@@ -213,7 +172,7 @@ retire_rate = retired_this_quarter / total_governance_items_before
 ## Prune report(N 日期)
 
 ### Metric delta
-- CLAUDE.md: B → A(-X 行)
+- Bootstrap instructions: B → A(-X 行)
 - MEMORY.md: B → A(-Y 條目 / -Z 檔)
 - Total spec.md: B → A(-Z 行)
 - Hooks: B → A(-N 個 hook retired)
@@ -228,8 +187,8 @@ retire_rate = retired_this_quarter / total_governance_items_before
 ### 未達 retire target rationale(若 < 5%)
 - {e.g. "governance ecosystem stable, 上季已大幅 prune,本季無重大冗贅"}
 
-### Still deferred(P2 pending user sign-off)
-- {list}
+### Human-only pending(只限產品／UI／UX SSOT 真取捨)
+- {list or 無}
 
 ## Self-improvement capture
 - 新發現 prune pattern: {...} OR "無"
@@ -237,33 +196,29 @@ retire_rate = retired_this_quarter / total_governance_items_before
 - 下次 prune trigger 建議: {...}
 ```
 
-Update `.claude/logs/metric-snapshots.jsonl`:
+Update `${GOVERNANCE_STATE_DIR}/metric-snapshots.jsonl`(provider-neutral Git telemetry state):
 
 ```json
-{"ts":"2026-04-24","retire_rate":0.07,"retired":5,"total_before":71,"claude_md_lines":612,"hooks_total":18,"skills_total":13,"memory_entries":29}
+{"ts":"2026-04-24","retire_rate":0.07,"retired":5,"total_before":71,"bootstrap_instruction_lines":238,"hooks_total":18,"skills_total":13,"memory_entries":29}
 ```
 
 **本 snapshot 讓 `/governance-health` trend 分析:**若 3 季連續 retire rate < 5% 且 governance 行數仍增 → auto-propose「有隱性冗贅未抓,考慮換 /knowledge-prune 掃描策略」。
 
----
-
-## Checkpoints(禁止跳)
-
-### ⚠️ Checkpoint 1 — Phase 2 triage(見上)
+## Authority gates(禁止把 milestone 變成人類工程核准)
 
-### ⚠️ Checkpoint 2 — 動 Meta-Pattern(P2)
+### Gate 1 — Phase 2 triage(見上)
 
-提議撤 / 合併 / 改寫 Meta-Pattern 條目前 STOP。Meta-Pattern 是 CLAUDE.md 最上游,動意思必 user 拍板。
+### Gate 2 — 動 Meta-Pattern(P2)
 
-### ⚠️ Checkpoint 3 — 抽新 canonical
+撤／合併／改寫工程治理 Meta-Pattern 由最高 certified capability 依全 repo evidence、tests 與 rollback 自主決定；若 task／deliverable 明確要求 independent review 才把它納入 required evidence。若條目本身定義產品／UI／UX SSOT 且存在真取捨，才列 P2H 給 user 拍板。
 
-Phase 1 D3 發現 5+ 條下游條目可被新 meta 吸收 → 提議新 Meta-Pattern 前走命名三 test + world-class benchmark(對齊 CLAUDE.md M8 / M12)。
+### Gate 3 — 抽新 canonical
 
-### ⚠️ Checkpoint 4 — Retire 率 < 5%
+Phase 1 D3 發現 5+ 條下游條目可被新 meta 吸收 → 建立新 Meta-Pattern 前走命名三 test + world-class benchmark；只有 task／deliverable 明確要求時才加 independent review(對齊 `AGENTS.md` M8 / M12)，工程 governance 直接落地。
 
-季度 prune 若 retire 不到 5%,表示:(a) 真沒冗餘(罕見),OR (b) judgment 太保守。STOP 跟 user 確認哪邊。
+### Gate 4 — Retire 率 < 5%
 
----
+季度 prune 若 retire 不到 5%,由 evidence 判定是(a)成熟無冗餘或(b)judgment 太保守，report rationale；不得為達數字強刪，也不得把純工程判斷轉交 user。
 
 ## Retire rules(執行規則)
 
@@ -281,23 +236,11 @@ Phase 1 D3 發現 5+ 條下游條目可被新 meta 吸收 → 提議新 Meta-Pat
 
 ## 世界級對照
 
-本 skill 是本 DS 原創的自我 prune 機制,但對齊:
-
-- **Elasticsearch Index Lifecycle Management**:hot / warm / cold 階段自動降級 + delete old data — 類 retire rate
-- **Linux kernel doc policy**:Sphinx deprecation warnings + removal schedule — 類 transition period 過渡期
-- **Python PEP 387 Backwards Compatibility Policy**:明定哪些改動需 deprecation 期,哪些可立刻刪 — 類 P0 vs P2 triage
+詳 references/world-class-prune-alignment.md(Elasticsearch ILM / Linux kernel doc policy / Python PEP 387)。
 
 ## 與其他 skill 的分工
 
 | Skill | Scope | 不重疊點 |
 |-------|-------|---------|
-| `/design-system-audit` | **33 維 DS code + spec audit**(Phase 0 自建 baseline) | 不管治理文件冗贅 — 找 bug / drift,不 prune governance 大小 |
+| `/design-system-audit` | **full-dim DS code + spec audit**(Phase 0 自建 baseline) | 不管治理文件冗贅 — 找 bug / drift,不 prune governance 大小 |
 | `/knowledge-prune` | **治理文件冗贅 + 行數 + 矛盾** | 不 audit DS code 本體 — 管 governance 不管 DS |
-
----
-
-## Non-goals 重申
-
-- 不 refactor spec.md 內容(改寫走 `/design-system-audit`)
-- 不 retire 有 active consumer 的 rule(必先改 consumer)
-- 不處理 `git log` 歷史 / 歷史 commit 訊息

package/ds-canonical/skills/knowledge-prune/references/phase-z-cross-repo-ssot-propagation.md

@@ -0,0 +1,15 @@
+# Cross-repository SSOT propagation
+
+The trigger is not completion of `/knowledge-prune` or any other skill. Standard propagation is owned only by `infra/governance/release-workflow.json` and resumed by `npm run release:auto` under the standing engineering authorization.
+
+Canonical chain:
+
+1. `pr-checks`:the single task branch/PR contains the intended exact version and generated projections; required CI and conversation resolution pass.
+2. `merge`:the PR merges through protected `main`, followed by protected-main readback.
+3. `publish`:the registered Release workflow publishes the exact npm packages.
+4. `readback`:GitHub Release and npm exact-version readbacks both match.
+5. `consumer`:reviewed exact-version PRs land in the template and WM, and both protected `main` lockfiles read back the released version.
+
+`release:preflight`, candidate freeze, offline signatures, preview/canary, model certification, soak, and fleet promotion are retired or optional assurance for the standard profile. Their absence never inserts a sixth step or blocks the five-step completion claim. Login/MFA/OAuth/credential reference may pause only the exact action; completion resumes automatically afterward.
+
+No skill or SessionStart hook may install, bump, dispatch a mutable tag, write a lockfile, push consumer `main`, or silently repair drift. `release:auto`, protected CI, and live readback are authoritative; native provider hooks only provide earlier feedback.

package/ds-canonical/skills/knowledge-prune/references/prune-dimensions-d5-d10.md

@@ -0,0 +1,57 @@
+# Prune Phase 1 D5-D10 dimension detail(2026-05-17 加;knowledge-prune SKILL.md Phase 1 extract)
+
+#### D5 — Canonical drift(spec vs code 語義漂移)— 2026-05-17 加
+
+Scan:`*.spec.md` 寫的 canonical vs `*.tsx` 實際 code 行為衝突 / spec 寫禁止但 code 仍用 / spec 升級但 code 沒跟。
+
+Example:
+- `radius.spec.md:57-71` 禁 `rounded-xl/2xl/3xl` → grep `packages/design-system/src/**/*.tsx` 仍有用 → drift
+- `field-controls.spec.md` v13 state machine 升級 → 但 Combobox.tsx 還是 v12 behavior → drift
+
+**Output**:per (spec, code) drift entry + 對應 commit hash 追溯 last alignment 時點
+
+#### D6 — Hook-fire health(log-driven)— 2026-05-17 加
+
+讀 `${GOVERNANCE_STATE_DIR}/hook-fires-per-hook.jsonl`,3 大病徵:
+- **Dead**:6 月 0 fire(retire 候選,per `# Retire rules` Hook 規則)
+- **Hot**(過 fire):fire / day > 50 → 可能 false positive 多 / regex 太鬆
+- **Toggle pattern**:同 fire 反覆 inject + retract → hook design 不穩
+
+**Output**:dead retire list + hot tune list + toggle re-design list
+
+#### D7 — Skill-invoke health(log-driven)— 2026-05-17 加
+
+讀 `${GOVERNANCE_STATE_DIR}/skill-invokes.jsonl`,2 大病徵:
+- **Unused**:3 月 0 invoke(除 rare-event skill 如 delivery-handoff)
+- **Always co-invoked**:Skill A 永遠跟 Skill B 一起 invoke → 該合 1 skill 或 chain auto
+
+**Output**:retire list + merge candidate list
+
+#### D8 — Memory recency / orphan— 2026-05-17 加
+
+Scan repository authority `governance/memory/*.md`(禁止以 `~/.claude/**` 或 provider cache 當 authority):
+- 6 月無 git log 變動 + 不在 `governance/memory/MEMORY.md` index head = stale candidate(per existing D2 retire rule)
+- file 存在但 MEMORY.md 沒 entry = orphan(可能 retire 漏刪)
+- entry 存在但 file 不在 = broken pointer
+- **Planning orphan**(2026-07-10 hunt 補,原方向相反不掃 planning/):`ls governance/planning/*.md` 逐檔 rg 檔名 across memory/*.md + MEMORY.md;無引用 = planning orphan 候選(存檔性質可標 archived,活的必補 memory pointer)
+
+**Output**:stale / orphan / broken pointer 3-class list
+
+#### D9 — Benchmark / citation debt(2026-05-17 加,對應 M22)
+
+Scan 全 repo:
+- `@benchmark-unverified-blanket` marker(per file retraction;codify 後該 backfill cite 變 verified)
+- spec.md / tsx 含 world-class DS keyword(Material / Polaris / Carbon / Ant / Atlassian / Apple)但無 inline URL / GitHub path / screenshot ref
+- 過期 benchmark(cite URL 是 v3 但 framework 已 v5)
+
+**Output**:per (file, claim) cite debt entry + 建議 WebFetch 補 source
+
+#### D10 — Verification artifact rot(2026-05-17 加,對應 M32)
+
+Scan 全 audit / test infra:
+- audit script 只驗 `getAttribute(...)` / `class.includes(...)` 不驗 `getBoundingClientRect()` numeric(pixel-quantified 缺)
+- `*.spec.md` 寫 visual canonical 但無對應 playwright snapshot 或 visual-audit 覆蓋
+- stale screenshot ref(`infra/governance/baseline/visual/**` 內 committed baseline 6 月未更新;provider compatibility mirror 不另行計數)
+- 依 [runtime evidence retention canonical](../../../references/runtime-evidence-retention.md) 枚舉每個 observed worktree 的 `<absolute-git-dir>/governance-runtime/evidence/`:保留 current active/live referenced/genuine review/unexpired receipt closure；將 unreferenced blocked/failed/stale run 列為 whole-run 自主回收候選，禁止 partial CAS pruning
+
+**Output**:per audit script 升 pixel-quantified 提名 + 缺 visual coverage列表 + runtime evidence bytes/保留根/whole-run 回收結果

package/ds-canonical/skills/knowledge-prune/references/world-class-prune-alignment.md

@@ -0,0 +1,7 @@
+# knowledge-prune 世界級對照(knowledge-prune SKILL.md「世界級對照」extract)
+
+本 skill 是本 DS 原創的自我 prune 機制,但對齊:
+
+- **Elasticsearch Index Lifecycle Management**:hot / warm / cold 階段自動降級 + delete old data — 類 retire rate
+- **Linux kernel doc policy**:Sphinx deprecation warnings + removal schedule — 類 transition period 過渡期
+- **Python PEP 387 Backwards Compatibility Policy**:明定哪些改動需 deprecation 期,哪些可立刻刪 — 類 P0 vs P2 triage