@qijenchen/design-system 0.1.0-beta.92 → 0.1.0-beta.95

package/ds-canonical/adapters/claude-root-instructions.md

@@ -0,0 +1,24 @@
+# Claude Code 專屬機制層(provider adapter)
+
+**跨模型 bootstrap 核心住在 `AGENTS.md`**(上方 import,launch 全載,內容零損失)——增刪改共同 bootstrap 原則**只改 AGENTS.md**,Claude 與 Codex 等所有 agent 自動同步；其他治理／infra 只改 `infra/governance/protected-root-classification.json` 指定的 canonical owner，再跑完整 governance build graph。當前機器可驗的 authority chain 是 `packages/governance/canonical/manifest.json` → `scripts/governance-build-graph.json` → `infra/governance/` 內的 evidence/release/rollout contracts；`governance/planning/2026-07-16-provider-neutral-governance.md` 只是歷史遷移紀錄。本檔只收 Claude Code 的 generated adapter 機制說明，不是另一份 authority。
+
+## Path-scoped rules(Claude 自動載入;2026 Anthropic 推薦)
+
+僅在編對應 path 檔案時載入,降低每 session context 成本(其他 agent 依 AGENTS.md「Rule Index」在編對應檔案前主動讀**同一份檔案**):
+
+- `.claude/rules/meta-patterns.md` — 31 active M-rules(always loads,fundamental)
+- `.claude/rules/spec-rules.md` — paths: `**/*.spec.md` + `packages/design-system/**`
+- `.claude/rules/ui-development.md` — paths: `**/*.tsx` + `**/*.ts`
+- `.claude/rules/story-rules.md` — paths: `**/*.stories.tsx`
+- `.claude/rules/self-verify.md` — paths: `**/*`(開始處理任一 repo 檔案後載入，不佔純對話 session 的啟動 context)
+
+## Hooks(write-time 加速器,非信任邊界)
+
+`.claude/hooks/` 於 Claude Code lifecycle(PreToolUse / PostToolUse / Stop / SessionStart / UserPromptSubmit)提供**最早的回饋**(寫入當下攔截)。它是 Claude 專屬加速器；最終判定來自 provider-neutral verifier、受保護 CI 與外部 required check，且只有遠端保護已驗證時才可宣稱不可繞過。Hook 計數/預算 SSOT = `session_start_governance_check.sh` Check 7。
+
+## Skills / Commands / Memory(Claude 專屬 discovery)
+
+- **Skills**:`.claude/skills/`(invoke 情境的多步驟 workflow + checkpoint;`/skill-name` 觸發)
+- **Commands**:`.claude/commands/`(一次性單步 action)
+- **Memory**:committed `governance/memory/` 是跨 provider SSOT；`~/.claude/projects/<project>/memory/` 只是 Claude 可重建 cache。只允許 repo → home 的 `npm run sync-memory`，禁止 home 反向覆寫 repo。
+- **Plugin 邊界**:plugin 只能是 optional adapter / distribution convenience;任何 Critical 治理不得 plugin-only(cloud plugin 不可靠實證 → `governance/memory/reference_cloud_governance_loading.md`)

package/ds-canonical/adapters/claude-settings-base.json

@@ -0,0 +1,172 @@
+{
+  "permissions": {
+    "allow": [
+      "Edit",
+      "Skill(knowledge-prune)",
+      "Skill(design-system-audit)",
+      "Skill(ensure-canonical)",
+      "Skill(propose-options)",
+      "Skill(scan-similar-bugs)",
+      "Skill(component-quality-gate)",
+      "Skill(story-writing)",
+      "Skill(visual-audit)",
+      "Skill(ux-audit)",
+      "Skill(performance-audit)",
+      "Skill(code-quality-audit)",
+      "Skill(governance-health)",
+      "Skill(story-auto-compile-migrate)",
+      "Skill(prototype)",
+      "Skill(delivery-handoff)",
+      "Skill(product-ui-audit)",
+      "Skill(new-component)"
+    ],
+    "ask": [
+      "Bash(claude auth login*)",
+      "Bash(claude login*)",
+      "Bash(gh auth login*)",
+      "Bash(gh auth refresh*)",
+      "Bash(npm access grant *)",
+      "Bash(npm access revoke *)",
+      "Bash(npm access set *)",
+      "Bash(npm adduser*)",
+      "Bash(npm login*)",
+      "Bash(npm org set *)",
+      "Bash(npm org rm *)",
+      "Bash(npm owner add *)",
+      "Bash(npm owner rm *)",
+      "Bash(npm profile *2fa*)",
+      "Bash(docker login*)",
+      "Bash(aws configure*)",
+      "Bash(aws sso login*)",
+      "Bash(gcloud auth *)",
+      "Bash(az login*)",
+      "Bash(netlify login*)",
+      "Bash(vercel login*)"
+    ],
+    "deny": [
+      "Bash(gh auth token*)",
+      "Bash(gh secret set*)",
+      "Bash(gh secret delete*)",
+      "Bash(gh variable set*)",
+      "Bash(gh variable delete*)",
+      "Bash(git credential *)",
+      "Bash(npm token *)",
+      "Bash(ssh-add*)",
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Read(./secrets/**)",
+      "Read(~/.aws/**)",
+      "Read(~/.azure/**)",
+      "Read(~/.config/gcloud/**)",
+      "Read(~/.config/gh/**)",
+      "Read(~/.docker/**)",
+      "Read(~/.git-credentials)",
+      "Read(~/.gnupg/**)",
+      "Read(~/.kube/**)",
+      "Read(~/.netrc)",
+      "Read(~/.npmrc)",
+      "Read(~/.pypirc)",
+      "Read(~/.ssh/**)",
+      "Bash(git reset *)",
+      "Bash(git clean *)",
+      "Bash(git branch -D *)",
+      "Bash(git tag -d *)",
+      "Bash(git commit --amend *)",
+      "Bash(git checkout *)",
+      "Bash(git restore *)",
+      "Bash(git push *--force*)",
+      "Bash(git push -f *)",
+      "Bash(gh api *--method DELETE*)",
+      "Bash(gh api *-X DELETE*)",
+      "Bash(gh issue delete *)",
+      "Bash(gh release delete *)",
+      "Bash(gh repo delete *)",
+      "Bash(gh run delete *)",
+      "Bash(npm unpublish *)",
+      "Bash(npm deprecate *)",
+      "Bash(rm *)",
+      "Bash(find * -delete *)",
+      "Bash(dd *)",
+      "Bash(mkfs *)",
+      "Bash(shred *)",
+      "Bash(*--dangerously-skip-permissions*)",
+      "Bash(*--permission-mode bypassPermissions*)",
+      "Bash(*--dangerously-bypass-approvals-and-sandbox*)"
+    ],
+    "defaultMode": "acceptEdits",
+    "disableBypassPermissionsMode": "disable"
+  },
+  "sandbox": {
+    "enabled": true,
+    "failIfUnavailable": true,
+    "autoAllowBashIfSandboxed": true,
+    "allowUnsandboxedCommands": false,
+    "network": {
+      "allowedDomains": [],
+      "deniedDomains": [],
+      "allowUnixSockets": [],
+      "allowAllUnixSockets": false,
+      "allowLocalBinding": false,
+      "allowMachLookup": []
+    },
+    "filesystem": {
+      "allowWrite": [],
+      "denyWrite": [],
+      "denyRead": [],
+      "allowRead": []
+    },
+    "credentials": {
+      "files": [
+        { "path": "./.env", "mode": "deny" },
+        { "path": "./.env.*", "mode": "deny" },
+        { "path": "./secrets/**", "mode": "deny" },
+        { "path": "~/.aws/config", "mode": "deny" },
+        { "path": "~/.aws/credentials", "mode": "deny" },
+        { "path": "~/.azure/**", "mode": "deny" },
+        { "path": "~/.config/gcloud/**", "mode": "deny" },
+        { "path": "~/.config/gh/hosts.yml", "mode": "deny" },
+        { "path": "~/.docker/config.json", "mode": "deny" },
+        { "path": "~/.git-credentials", "mode": "deny" },
+        { "path": "~/.gnupg/**", "mode": "deny" },
+        { "path": "~/.kube/config", "mode": "deny" },
+        { "path": "~/.netrc", "mode": "deny" },
+        { "path": "~/.npmrc", "mode": "deny" },
+        { "path": "~/.pypirc", "mode": "deny" },
+        { "path": "~/.ssh/**", "mode": "deny" }
+      ],
+      "envVars": [
+        { "name": "ANTHROPIC_API_KEY", "mode": "deny" },
+        { "name": "AWS_ACCESS_KEY_ID", "mode": "deny" },
+        { "name": "AWS_CONTAINER_AUTHORIZATION_TOKEN", "mode": "deny" },
+        { "name": "AWS_CONTAINER_CREDENTIALS_FULL_URI", "mode": "deny" },
+        { "name": "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", "mode": "deny" },
+        { "name": "AWS_SECRET_ACCESS_KEY", "mode": "deny" },
+        { "name": "AWS_SESSION_TOKEN", "mode": "deny" },
+        { "name": "AWS_WEB_IDENTITY_TOKEN_FILE", "mode": "deny" },
+        { "name": "AZURE_CLIENT_CERTIFICATE_PATH", "mode": "deny" },
+        { "name": "AZURE_CLIENT_SECRET", "mode": "deny" },
+        { "name": "AZURE_FEDERATED_TOKEN_FILE", "mode": "deny" },
+        { "name": "CLAUDE_CODE_OAUTH_TOKEN", "mode": "deny" },
+        { "name": "DOCKER_AUTH_CONFIG", "mode": "deny" },
+        { "name": "GH_ENTERPRISE_TOKEN", "mode": "deny" },
+        { "name": "GH_TOKEN", "mode": "deny" },
+        { "name": "GITHUB_APP_PRIVATE_KEY", "mode": "deny" },
+        { "name": "GITHUB_TOKEN", "mode": "deny" },
+        { "name": "GOOGLE_APPLICATION_CREDENTIALS", "mode": "deny" },
+        { "name": "GOOGLE_GHA_CREDS_PATH", "mode": "deny" },
+        { "name": "NETLIFY_AUTH_TOKEN", "mode": "deny" },
+        { "name": "NODE_AUTH_TOKEN", "mode": "deny" },
+        { "name": "NPM_TOKEN", "mode": "deny" },
+        { "name": "SIGSTORE_ID_TOKEN", "mode": "deny" },
+        { "name": "SSH_AUTH_SOCK", "mode": "deny" },
+        { "name": "VERCEL_TOKEN", "mode": "deny" }
+      ],
+      "allowPlaintextInject": false
+    },
+    "enableWeakerNestedSandbox": false,
+    "enableWeakerNetworkIsolation": false,
+    "allowAppleEvents": false,
+    "excludedCommands": []
+  },
+  "disableAutoMode": "disable"
+}

package/ds-canonical/commands/README.md

@@ -1,26 +1,21 @@
-# .claude/commands/ Charter
+# .claude/commands/ Legacy charter
 
-## 這裡只收:**one-shot slash commands**(無 phase,單次 action)
+Claude Code 已將 custom commands 併入 skills，新增 workflow 一律放 `.claude/skills/<name>/SKILL.md`，以便 Claude、Codex 與其他 Agent Skills runtime 共用同一 SSOT。
 
-每個 command 一檔 `.md`,用戶打 `/<name>` 直接觸發。**vs Skill**:skill 是多 phase workflow + user CP;command 是單次動作無 CP。
+此目錄只保留舊 consumer 的相容 pointer；新的 `/<name>` 由同名 skill 提供。
 
-## 當前居民(1 pilot,2026-04-24)
+## 當前居民(0)
 
-| Command | 觸發 | 用途 |
-|---------|------|------|
-| `/gov-status` | user 輸入 `/gov-status` | 一次印 governance health snapshot(行數/retire rate/logs freshness/drift/pending)—不走 skill workflow,不要 CP,純 dump |
+原 `/gov-status` 已改為 `.claude/skills/governance-status/SKILL.md`，並移除主機絕對路徑與 Claude-only 假設。
 
 ## 這裡**不收**(反例)
 
 | 疑似要放這但其實不是 | 正確去處 | 為什麼 |
 |---------------------|---------|--------|
-| 多 phase + user 決策 | `.claude/skills/` | skill 管 phase + CP |
+| 任何可重複 workflow(單步或多階段) | `.claude/skills/` | Agent Skills 是跨 provider 共用面 |
 | 機械 tool-event 檢查 | `.claude/hooks/` | hook 是 pre/post tool 觸發,不是 user 觸發 |
 | 需要 isolated context / scoped tools | `.claude/agents/` | agent 是 AI worker,command 是 quick action |
 
-## 新 command criteria
+## 相容保留原則
 
-1. **< 10 秒完成**(不是 workflow)
-2. **無 user CP**(有決策點 = skill)
-3. **輸出簡潔**(一段 markdown / 表)
-4. **可重複 run**(每次同 behaviour)
+只有現存外部 consumer 仍固定呼叫 `.claude/commands/<name>.md` 時才可暫留 legacy command，並必須只是同名 skill 的 thin pointer，不得擁有另一份 substantive workflow。

package/ds-canonical/commands/gov-status.md

@@ -1,79 +1,9 @@
 ---
-description: One-shot dump governance health snapshot(無 workflow,< 10s 完成)
+description: Retired command compatibility pointer
 ---
 
-# /gov-status — Governance Health Snapshot
+# `/gov-status` retired
 
-快印現在 governance state,不走 `/governance-health` 完整 skill workflow(那有 5 phase + CP),只是 user 想 quick check 時的一眼看。
-
-## 跑法
-
-執行以下 bash 並 format output 成 markdown table:
-
-```bash
-echo "=== File sizes ==="
-echo "CLAUDE.md: $(wc -l < CLAUDE.md | tr -d ' ') / 400 target / 800 transition"
-echo ""
-echo "=== Over-cap specs ==="
-for f in $(find src/design-system -name "*.spec.md"); do
-  lines=$(wc -l < "$f" | tr -d ' ')
-  case "$f" in
-    */item-anatomy.spec.md) cap=1200 ;;
-    */color.spec.md|*/sidebar.spec.md|*/tree-view.spec.md) cap=800 ;;
-    *) cap=500 ;;
-  esac
-  if [ "$lines" -gt "$cap" ]; then
-    echo "  ❌ $f: $lines > $cap"
-  fi
-done
-echo ""
-echo "=== Memory ==="
-MEM_DIR=/Users/chenqiren/.claude/projects/-Users-chenqiren-Library-CloudStorage-GoogleDrive-qijenchen-gmail-com--------my-project/memory
-echo "active: $(ls $MEM_DIR/*.md | grep -v retired | wc -l | tr -d ' ') / 20 target"
-echo ""
-echo "=== Hooks / Skills / Agents / Commands ==="
-for d in hooks skills agents commands; do
-  c=$(ls .claude/$d/ 2>/dev/null | grep -v README | grep -v gitignore | wc -l | tr -d ' ')
-  echo "  .claude/$d: $c"
-done
-echo ""
-echo "=== Logs ==="
-for f in hook-fires skill-invokes user-corrections metric-snapshots; do
-  fn=".claude/logs/$f.jsonl"
-  if [ -f "$fn" ]; then
-    echo "  $f: $(wc -l < $fn | tr -d ' ') entries"
-  else
-    echo "  $f: (empty)"
-  fi
-done
-echo ""
-echo "=== Benchmark freshness ==="
-if [ -f .claude/benchmarks/last-fetch.txt ]; then
-  LAST=$(cat .claude/benchmarks/last-fetch.txt)
-  echo "  last: $LAST"
-else
-  echo "  never fetched — run bash .claude/benchmarks/fetch.sh"
-fi
-echo ""
-echo "=== Retire rate(latest snapshot)==="
-if [ -f .claude/logs/metric-snapshots.jsonl ]; then
-  tail -1 .claude/logs/metric-snapshots.jsonl | head -c 200
-fi
-echo ""
-echo "=== tsc state ==="
-npx tsc -b 2>&1 | grep -c "error TS" || echo "0"
-echo ""
-echo "=== compile-stories drift ==="
-node scripts/compile-stories.mjs --all --check 2>&1 | tail -1
-```
-
-## 結論分類
-
-根據上述輸出自動判斷:
-- **✅ OK** — 若無 over-cap spec + 無 tsc error + 無 drift + memory ≤ 20
-- **⚠️ Warning** — 有 over-cap / pending corrections > 10 / benchmark stale > 30 days
-- **❌ Fail** — tsc errors / compile drift / CLAUDE.md > 800
-
-最後給 user 一行 summary:「Governance:{✅/⚠️/❌}{one-line rationale}」。
-
-若要深度 audit → suggest `/governance-health` 跑完整 5-phase skill。
+This one-time Genesis compatibility file has no executable workflow. Use the
+provider-neutral `governance-status` skill. The distinct protected cleanup PR
+removes this legacy command path after the A/M-only transition closes.