@tea-agent/loop-agent 0.1.0-fe-test.0

package/skills/browser-tools/package.json

@@ -0,0 +1,19 @@
+{
+	"name": "browser-tools",
+	"version": "1.0.0",
+	"type": "module",
+	"description": "Minimal CDP tools for collaborative site exploration",
+	"author": "Mario Zechner",
+	"license": "MIT",
+	"dependencies": {
+		"@mozilla/readability": "^0.6.0",
+		"cheerio": "^1.1.2",
+		"jsdom": "^27.0.1",
+		"puppeteer": "^24.31.0",
+		"puppeteer-core": "^23.11.1",
+		"puppeteer-extra": "^3.3.6",
+		"puppeteer-extra-plugin-stealth": "^2.11.2",
+		"turndown": "^7.2.2",
+		"turndown-plugin-gfm": "^1.0.2"
+	}
+}

package/skills/code-review-core/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: code-review-core
+description: 用于只读 code review 节点，产出带文件与行号引用的优先级 findings。
+---
+
+# Code Review Core
+
+本 skill 用于 reviewer 节点。
+
+## Review 重点
+
+- 优先关注 correctness、行为回归、security、数据丢失与缺失验证。
+- findings 须 grounded 在具体文件与行号。
+- 区分 blocking findings 与次要 maintainability 备注。
+- 检查测试是否证明变更行为，文档是否与面向用户的变更一致。
+- 若无 findings，明确说明，并指出 residual test gap（如有）。
+
+## Output
+
+按 severity 排序列出 findings。仅当无 blocking findings 时，才写 `VERDICT: pass`。

package/skills/codebase-scout/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: codebase-scout
+description: 用于只读 scout 节点，在实现前定位现有代码、测试、文档与集成点。
+---
+
+# Codebase Scout
+
+本 skill 用于 scout 节点。
+
+## 规则
+
+- 从 repo 指令、task source 与邻近测试入手。
+- 可用时优先 CodeGraph；否则用 `rg` 与聚焦文件阅读。
+- 在提议新抽象前，识别现有 helper 与 ownership 边界。
+- 只返回事实，不做编辑。
+
+## Output
+
+列出相关文件、现有模式、风险，以及实现所需的最小 write surface。

package/skills/frontend-bounded-implement/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: frontend-bounded-implement
+description: >-
+  Use only for frontend implementation and repair writers after the canonical
+  contract gate has authorized a bounded write set.
+---
+
+# Frontend Bounded Implement
+
+## Authoritative Inputs
+
+- For implementation, use the run-owned
+  `contracts/frontend-implementation-contract.json`.
+- For repair, also use `contracts/frontend-repair-assessment.json`.
+- Treat requirement `expectedOutcome`, interaction `trigger` /
+  `expectedBehavior`, target files, UI states, Mock/API strategy, and verification
+  targets as closed decisions. Do not rediscover or reinterpret them.
+
+## Exploration Boundary
+
+- Read the canonical contract, its declared target files, and only directly
+  imported/called local code needed to edit those targets safely.
+- Do not open task sources, plans, reviews, OpenSpec, `ai_workspace/`, knowledge
+  bases, or unrelated repository areas. Do not recursively search the repository.
+- Start the bounded edit after confirming the contract and targets. Optional
+  context is not a reason to postpone implementation.
+- If behavior is still ambiguous or a required target is outside `writeSet`, stop
+  with `IMPLEMENTATION_OUTCOME: blocked`; do not compensate with broader scouting.
+
+## Implementation Discipline
+
+- Work test-first where behavior changes. Preserve unrelated files and stay inside
+  `allowedPaths` and `writeSet`.
+- Implement every requirement outcome, interaction, and applicable UI state
+  assigned to the writer. Keep the real request path enabled by default and use
+  only the approved Mock/API strategy.
+- Do not add dependencies unless the contract approves them. Never relax lint,
+  type, test, or build configuration; never add `.skip` or `.only`.
+- Run only the focused checks already frozen by the task. Leave full verification
+  to downstream deterministic nodes.
+
+## Required Outcome
+
+The first non-empty response line must be exactly one of:
+
+- `IMPLEMENTATION_OUTCOME: changed` — a non-empty bounded diff was produced.
+- `IMPLEMENTATION_OUTCOME: already-satisfied` — the contract was already met and
+  no file changed.
+- `IMPLEMENTATION_OUTCOME: blocked` — implementation cannot proceed without
+  guessing or exceeding the write boundary.
+
+Then report changed files, requirements/interactions implemented, tests or focused
+checks attempted, and residual risks. Never report `changed` for an empty diff.

package/skills/frontend-design-review/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: frontend-design-review
+description: Use for the frontend plan design gate before any writer runs.
+references:
+  - path: references/review-checklist.md
+    required: true
+    maxChars: 3600
+---
+
+# Frontend Design Review
+
+For frontend design review nodes. Read the checklist; audit contract, scout, Mock
+strategy, effective plan, task bounds, and traceable design evidence.
+Knowledge base, OpenSpec, and `ai_workspace/` are parallel sources. Query the
+knowledge-base connector when available; always search/read `openspec/schemas/**`,
+`openspec/project-specs/**`, and `ai_workspace/**` before accepting conventions.
+Connector format is TODO: never invent results.
+
+## Verdict Contract
+
+First non-empty line: exactly `VERDICT: pass` or `VERDICT: request-revision`.
+Any blocker requires request-revision. An initial pass is the effective verdict;
+there is no intermediate first-design shell gate.
+
+In standard/full topology, revision and final review run only after initial
+`VERDICT: request-revision`. Verify every Required Plan Correction against the
+complete revision; reject remaining, incomplete, or new gaps. An initial pass uses
+the original plan and skips both conditional nodes.
+
+Small-risk topology instead removes initial review and revision, then runs
+`frontend-final-design-review-pi` as the sole review of the original plan. Do not
+expect initial findings or a revision there.
+
+The deterministic gate prefers final-review output and falls back to initial review
+only when no current-run final output exists. Existing malformed/non-pass primary
+output fails closed.
+
+## Blocking Conditions
+
+- Any criterion lacks implementation/verification; UI states lack reasons; a
+  dependency lacks permission; confirmed primitives/rules are ignored; design claims
+  lack knowledge-base or required openspec specification evidence; paths cross
+  write bounds; commands are missing/non-deterministic; or
+  interaction, responsive, accessibility, data, or failure behavior requires guessing.
+- `MOCK_STRATEGY: blocked`; missing permitted target paths, endpoint/schema-to-fixture
+  mapping, fixed verification, or dev/test-only activation; a second Mock framework;
+  inline fake data; commented real requests; Mock-on production defaults; test-only
+  production imports; or Mock evidence reported as real integration.
+
+Knowledge-base absence is advisory if relevant rules from either openspec
+specification directory were read and applied. Block skipped fallback, unresolved
+conflict, or unresolved UI decisions.
+
+## Method And Output
+
+Map criteria to steps/files/states/checks, audit paths/evidence, classify Blocking
+or Advisory, and never edit files.
+
+### Spec Evidence Rules
+
+Run `grep`/`find`, then explicit `read` calls for applicable specs/checklist. Only
+successful paired reads count as “已读取规范文件”; summaries do not. List each path/
+section in `Checked Items`; search/read both openspec specification directories
+before accepting conventions.
+
+```markdown
+VERDICT: pass
+
+## Findings
+- None blocking.
+
+## Required Plan Corrections
+- None.
+
+## Checked Items
+- ...
+```
+
+Each correction names its criterion/section, gap, and exact plan change.

package/skills/frontend-design-review/references/review-checklist.md

@@ -0,0 +1,43 @@
+# Frontend Design Review Checklist
+
+## Coverage
+
+- Route/component, non-goals, assumptions, and unresolved ambiguity are explicit.
+- Each acceptance criterion maps to steps, files, UI behavior, states, and verification.
+- Success/error/loading/empty/disabled/permission/retry/stale/boundary states are handled or N/A.
+
+## Project Fit
+
+- Reuse components, hooks, API helpers, mocks, schemas, router patterns, tokens, and theme rules.
+- Cite knowledge base, `openspec/schemas/`, `openspec/project-specs/`, and `ai_workspace/` as parallel sources; failed or empty
+  knowledge queries must still search `<repoRoot>/openspec/schemas/`, `<repoRoot>/openspec/project-specs/`, and `<repoRoot>/ai_workspace/`.
+- Record source status, query terms, paths/headings, conflicts, authorized deps, and allowed paths for both.
+- Component selection conformance: every UI purpose must be declared in the contract `uiComponentChoices[]`. `specified` must carry a non-empty `specReference { path, section, line }` hitting a supported openspec/ai_workspace spec; `new` must declare a deviation rationale with `specReference` null; a spec-defined component must not be silently replaced or self-invented without a declared deviation.
+
+## Interaction / Quality
+
+- Actions, feedback, validation timing, navigation, persistence, recovery, responsive/overflow, focus/keyboard/semantics/contrast/reduced motion, cancellation, and data lifecycle are covered when applicable.
+
+## Verification
+
+- Static/behavior commands are exact, frozen, discoverable, and deterministic.
+- Tests prove changed state and flows at supported levels; browser/visual only when task/gate requires.
+- Missing required verification is a blocker; optional gaps are disclosed risks.
+
+## Mock Safety
+
+- Strategy line is valid and not `MOCK_STRATEGY: blocked`.
+- Mock API fields/states trace to contract evidence; gaps are explicit.
+- Prefer native mock; browser intercept only for existing e2e; request adapter only for reversible local preview.
+- Real request stays default; activation is explicit, reversible, local/test-only, and production-off.
+- Plans use only DAG-frozen shell entrypoints.
+- Mock strategies need default-real-path build with Mock off plus Mock-backed behavior evidence.
+- `not-needed` needs real/no-remote evidence, or default-auto skipped-Mock rationale with Real Integration Gap preserved when no project Mock capability exists.
+- Mock-backed checks prove frontend states only; real integration remains pending until actual backend evidence exists.
+
+## Verdict Matrix
+
+- Request revision for coverage gaps, unsafe scope, unauthorized deps, unresolved required interaction, missing required verification, skipped local specification fallback (`openspec/schemas/`, `openspec/project-specs/`, or `ai_workspace/`), unsafe/missing Mock strategy, or Mock evidence presented as real integration.
+- Request revision for component selection non-conformance: spec-defined components silently replaced or self-invented without a declared deviation, `uiComponentChoices` missing for UI-visible work, or a `uiComponentChoices` `specReference.path` not cited in the `openspec-citations` block / not actually read.
+- Knowledge-base unavailable but relevant OpenSpec or `ai_workspace/` rules applied is advisory only.
+- Optional cleanup that cannot affect acceptance is advisory.

package/skills/frontend-implementation/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: frontend-implementation
+description: >-
+  Use for frontend contract, scout, mock strategy, and plan DAG nodes.
+references:
+  - path: references/node-contracts.md
+    required: true
+    # Compact contract index must stay under skill total budget (~10k with body + other refs).
+    # Headroom above current ~4k file; do not raise alone without checking totalMaxChars.
+    maxChars: 6000
+  - path: references/design-spec.md
+    required: true
+    maxChars: 3000
+  - path: references/code-standards.md
+    required: true
+    maxChars: 3000
+---
+
+# Frontend Implementation
+
+Read all required references before running any listed frontend node.
+
+## Source And Evidence Rules
+
+Use task sources/references, constraints, then `task.json`. Follow `design-spec.md`:
+query the knowledge base when available and always inspect `openspec/schemas/`,
+`openspec/project-specs/`, and `ai_workspace/`; then use repo evidence. Cite tight paths/symbols, and never invent APIs,
+rules, commands, or retrievals. Scout/planners locate and explicitly read applicable
+specs; only successful paired reads count. Lockfile-only, fixture-only, or unread
+search hits do not prove a reusable Mock service.
+
+This broad discovery rule applies only to contract, scout, and plan phases.
+Implementation and repair use the separate `frontend-bounded-implement` skill.
+
+## Implementation Discipline
+
+- Reuse confirmed specs, components, tokens, helpers, APIs, mocks, schemas, and tests.
+- Keep real requests enabled by default; never comment them out for a mock.
+- Prefer native Mock support; otherwise use existing browser interception for e2e or
+  a reversible request adapter/DI seam for local preview.
+- Trace fixtures to API/schema evidence. Activation is explicit, dev/test-only,
+  production-off; Mock evidence never proves real API integration.
+- Add dependencies only when approved. Cover applicable success/loading/empty/error/
+  permission/boundary states and justify N/A.
+- Keep state testable. Stay in `writeSet`, preserve behavior, and update tests.
+- Never relax lint/type/test/build config or write unauthorized generated output.
+
+## Output And Failure Rules
+
+- Follow `node-contracts.md`; read-only nodes never edit. Missing input blocks work
+  when proceeding would guess behavior, bounds, or verification.
+- Preserve tokens, commands, paths, IDs, and language. Completion needs fresh shell evidence.

package/skills/frontend-implementation/references/code-standards.md

@@ -0,0 +1,33 @@
+# Frontend Code Standards
+
+Discover rules from task constraints, `design-spec.md` source order, config, code,
+tests, manifests, and generated types. Regardless of knowledge-base results,
+applicable `openspec/schemas/`, `openspec/project-specs/`, and `ai_workspace/` rules are normative.
+Preferences are not rules, and docs do not override installed APIs without an
+explicit compatibility decision.
+
+## Discover And Cite
+
+- Find routing and server/client boundaries; state, forms, data/cache, and errors;
+  API/mock/UI/schema/test locations and naming; supported tests; dependency rules.
+
+Cite representative files/config for each convention. Describe conflicts instead of
+silently selecting one.
+
+## Plan And Implement
+
+- Map criteria to code and checks. Define placement, state ownership, request
+  lifecycle, validation/failures, API compatibility, mocks, and fixtures.
+- Trace fixtures to API evidence; label gaps. Prefer native mocks, then browser
+  interception for existing e2e, then a reversible request adapter/DI preview seam.
+- Real API stays default; mock activation is explicit, local/test-only,
+  non-production, and removable.
+- Reuse helpers/public APIs and preserve out-of-contract behavior. Keep rendering,
+  transitions, validation, and side effects testable; cover lifecycle races/bounds
+  when relevant. Update supported tests; stay in `writeSet`.
+
+## Prohibited
+
+- Do not relax checks, add unapproved dependencies, comment real requests, hardcode
+  fixtures in production UI, import test mocks into production, store fixture
+  secrets, equate mock evidence with real integration, or report unrun checks as verified.

package/skills/frontend-implementation/references/design-spec.md

@@ -0,0 +1,56 @@
+# Frontend Design And Component Specification
+
+## Required Source Sequence
+
+Knowledge base, OpenSpec, and `ai_workspace/` are parallel specification sources:
+
+1. Attempt the configured component/design knowledge-base query first when a
+   connector is available.
+2. Regardless of knowledge-base success/failure/timeout/no-match, also
+   recursively search `openspec/schemas/`, `openspec/project-specs/`, and
+   `ai_workspace/` for index files and relevant content.
+3. Treat relevant matches from both sources as the current project's
+   specification for this run.
+4. Only then use component source, tokens, stories, tests, and pages as
+   non-normative repository fallback.
+
+Never skip local OpenSpec or `ai_workspace/` for neighboring-code conventions,
+even when a knowledge-base query returned results. Report source conflicts instead
+of combining them. Explicit task requirements remain the contract.
+
+Connector format is TODO; attempt only an available connector, otherwise record
+`not-configured` and run the openspec fallback (never invent a connection).
+
+## openspec Fallback Procedure
+
+- Inspect `<repoRoot>/openspec/schemas/`, `<repoRoot>/openspec/project-specs/`,
+  and `<repoRoot>/ai_workspace/` when present; enumerate supported files recursively.
+- Read indexes first, then search names/content using task, route, component,
+  interaction, theme, token, and state terms.
+- Read matches in context; a filename-only hit is not a rule.
+- Record search terms, inspected/matched paths, headings or tight line ranges,
+  applied rules, and conflicts.
+- If both directories or relevant rules are absent, record that before using
+  repository fallback.
+
+## Retrieval Evidence
+
+Record source as `knowledge-base`, `openspec fallback`, `repository fallback`, or
+`unavailable`. Knowledge-base evidence includes query, source ID/version/time, rules,
+and conflicts. `openspec fallback` includes terms, paths/headings/lines, rules, and conflicts.
+
+## Rules To Retrieve Or Discover
+
+- Components, variants, props, composition, accessibility, deprecations, placement, forms, overlays, navigation, and state patterns.
+- Tokens, typography, color, layout, breakpoints, motion, focus/keyboard/contrast, exceptions, design debt, and forbidden patterns.
+
+## Gate Expectations
+
+- Reuse confirmed primitives unless a new pattern is authorized.
+- Define applicable states and responsive behavior before implementation.
+- Cite knowledge-base or openspec spec evidence for component/token choices;
+  label weaker repo fallback.
+- Make deviations and unresolved gaps explicit.
+- Contract `uiComponentChoices[]` per UI purpose: `specified` needs
+  `specReference {path,section,line}`; `new` needs null ref + rationale; never
+  silently replace a spec-defined component.

package/skills/frontend-implementation/references/node-contracts.md

@@ -0,0 +1,31 @@
+# Frontend Node Contracts
+
+Pre-write nodes are read-only. Preserve IDs, labels, commands, language, required headings.
+
+## Core nodes
+
+- **`frontend-contract-pi`**: `Scope`, `Non-goals`, `Acceptance Criteria`, `UI States`, `Target Runtime Environment`, `Risks`, `Verification Expectations`; no guessed requirements.
+- **`frontend-scout-pi`**: routes, components, tokens, data/API/Mock, scripts, tests, assets; fact vs inference vs gap. Search+read `openspec/schemas/`, `openspec/project-specs/`, `ai_workspace/` first. Output stack, styling, conventions, state/data, test entry points, reuse, risks.
+- **`frontend-plan-pi` + conditional design loop**: AC → observable `expectedOutcome`; interactions → `trigger`+`expectedBehavior`; include steps, in-bound files, UI states, reuse, deps, Mock/API, frozen verify entrypoints and integration gaps. DAG freezes a protected skeleton (`schemaVersion`, `sourceBinding`, `riskLevel`, `targets.files`, `mockApi.productionDefaultOff`). Model returns a **JSON-only** editable RFC 7386 patch (`frontend-implementation-contract-plan-patch-v1`) plus one `openspec-citations` block. Runtime compiles canonical `frontend-implementation-contract-v1` and archives raw/extracted/normalized/validation candidates; unresolved optional symbols are dropped and audited. No plan prose; gate renders plan.md. IDs+paths ≠ behavior semantics. Applicable UI states need behavior/implementation/verification; non-applicable states need reasons. Active Mock needs frozen commands; `auto` without confirmed capability/command → `not-needed`; `required` without command → generation-time blocked. Only `request-revision` runs revision+final review; small-risk gets one review.
+  - `uiComponentChoices[]` (optional): `{purpose, component, decision, specReference, rationale}`; `specified` needs `specReference{path,section,line}`; `new` needs null ref+rationale.
+- **`frontend-prewrite-gate-shell`**: sole write authorization. Resolve effective plan (revised if revision ran, else original) + review; require exact pass; retain every REQ/BR/AC id; enforce Mock policy; validate schema/source binding+writeSet containment; materialize `contracts/frontend-implementation-contract.json` from the **single** fenced contract block (multiple candidates fail closed `invalid-output`). Fallback only when conditional primary absent; malformed primary fails closed. Generation-time blocked Mock yields one blocking shell node, no writer.
+  - `verificationTarget.commandLabel` must be a **frozen command label** from `verifyEvidence.commandLabels`; others fail closed (`invalid-output`). Empty frozen set (no `run.json`) skips check.
+  - `mockApi.strategy !== "not-needed"` fails closed when `mockCommandLabels` empty (`no authorized Mock verification commands`).
+  - OpenSpec policy: `task.json.frontendOpenspec.policy` (default `cited`); candidates = `requiredReadPaths` ∪ task-source citations; effective plan must append one fenced `openspec-citations` block (one JSON `{"path","section","line"}` per line). Candidates non-empty but block missing/unparseable → `openspec-citation-block-unparseable`; candidate not cited → `openspec-not-cited`; cited path without read event → `openspec-citation-not-read` (anti-fabrication). Empty candidates skip enforcement. `scan-strict` keeps full-read semantics (`openspec-not-read`); both modes keep `candidate-missing-drift`.
+  - Component conformance: missing `uiComponentChoices` (frozen bucket non-empty + UI-visible work) → `component-choices-missing`; bad/uncited `specReference.path` → `component-spec-reference-invalid` / `component-spec-not-cited`.
+  - revisionPatch mode: revision output is an RFC 7386 merge-patch delta applied on the original canonical contract node (`planFallbackFromNodeIds[0]`); protected skeleton paths remain immutable. Legacy DAGs keep full-contract semantics. Size guard: canonical serialization >64KB → `retryable-invalid` + `contract-too-large`.
+- **`frontend-implement-pi`**: sole regular exclusive writer; uses `frontend-bounded-implement` (not this skill). Stay in `writeSet`; real requests default-on. Atomic handler/intercept/adapter with tests. Stop on forbidden paths/guesses. First line `IMPLEMENTATION_OUTCOME: changed|already-satisfied|blocked`; runtime checks against attributed diff. Optional mock-verify when frozen; static+behavior always; behavior must prove page consumption. `not-needed` keeps real integration pending unless real backend has fresh evidence.
+
+## Contract / trace / stages (M1–M2)
+
+- `frontend-verify-assess-shell` runs Mock/static/behavior groups, binds `verificationTargets` to command labels+evidence, writes `frontend-verification-trace.json`+`frontend-repair-assessment.json`; browser/visual stay `not-run`.
+- `frontend-review-context-shell` captures real diff; combines contract, effective trace, repair assessment, diff into `contracts/frontend-review-context.json`.
+- Implement stages: (1) contract confirm (2) tests sync (3) component/UI (4) API/Mock (5) frozen checks (6) diff cleanup. Summary: Contract Ref, Changed Files, Requirements, UI States, Tests, Verification Attempts, Deviations, Residual Risks.
+
+## Repair (M3)
+
+Only `eligible=true` runs `frontend-repair-pi` (same writeSet; no re-spec; max 1 attempt) + `frontend-reverify-shell`. No-failure skips both. Non-repairable contract/path/dependency/credential/deploy/spec-unclear failures fail closed.
+
+## Risk & capability (M4–M6)
+
+Deterministic risk, no model; high-risk beats small; supervised never small. Standard/high-risk: 15 top-level nodes; small: 13 (omits revision + final review). Capability seed injects adapters; openspec specs and task sources outrank adapter guidance. A11y: static/component tools only when present; Browser a11y always not-run.

package/skills/frontend-review/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: frontend-review
+description: Use to review completed frontend code and verification before closeout.
+references:
+  - path: references/review-findings.md
+    required: true
+    maxChars: 2800
+---
+
+# Frontend Review
+
+Use for `frontend-review-pi`; read the findings guide first. Required inputs are
+original task/reference material, effective plan/design branch, implementation summary,
+and `contracts/frontend-review-context.json`. That canonical context binds the validated
+implementation contract, effective verification trace, repair assessment, optional
+`frontend-lint-assessment-v1`, and run-owned diff. The diff is authoritative.
+
+## Verdict Contract
+
+The first non-empty line must be exactly `VERDICT: pass` or
+`VERDICT: request-revision`. Any Critical/Important finding, failed or missing
+required check, forbidden write, or unmet acceptance criterion forces revision.
+
+## Review Scope
+
+- Compare intent, contract, plan, diff, and evidence; report altered requirements.
+- Inspect every changed file against allowed, forbidden, and approved write scope.
+- Map criteria to behavior, applicable UI states, tests, and shell evidence.
+- Review state/data flow, validation, async/error behavior, design, responsive/a11y,
+  dependencies, maintenance, and regression risk when applicable.
+- Inspect static, behavior, and available Mock-specific artifacts directly. For Mock
+  strategies, compare the endpoint matrix, handler/fixture/adapter and consumer diff;
+  require the real request as default, contract-aligned fixtures, production isolation,
+  and no false real-integration claim. `not-needed` needs applicable real/no-remote
+  evidence, or an explicit default-auto skipped-Mock rationale with the Real
+  Integration Gap preserved when no project Mock capability is confirmed.
+- Inspect lint assessment directly. `baseline-debt` requires intact evidence, only
+  baseline-matched diagnostics on unchanged files, and none on writer-changed files.
+  Report debt, never `lint passed`; `failed`/`unavailable` blocks. Typecheck, build,
+  and test still require successful final exits.
+- Component/design claims need both knowledge-base and local openspec evidence. Query
+  the connector when available and always read task-relevant files under
+  `<repoRoot>/openspec/schemas/`, `<repoRoot>/openspec/project-specs/`, and `<repoRoot>/ai_workspace/`.
+  Connector format is TODO; never invent evidence. Only successful `read` calls are
+  observable as "已读取规范文件".
+- Treat shell exit status as authoritative. Do not edit files.
+
+## Evidence And Output
+
+Findings cite a tight file location, exact command/result, or named DAG artifact.
+Separate confirmed defects, missing evidence, and residual risks using Findings,
+Verification Assessment, UX Assessment, and Residual Risks headings.
+
+A pass requires no Critical/Important findings and all required shell checks passed.
+Still report knowledge-source status and optional browser/manual gaps.

package/skills/frontend-review/references/review-findings.md

@@ -0,0 +1,50 @@
+# Frontend Review Findings Guide
+
+## Severity
+
+- **Critical**: blocks primary flow, corrupts data, violates security/privacy, writes forbidden paths, bypasses required verification.
+- **Important**: acceptance/state/validation gap, material convention drift, missing behavior tests, unauthorized dependency, unsafe mock activation/import, mock-contract drift, misleading real-integration claim, or failed/missing required verification.
+- **Minor**: non-blocking maintainability, copy, layout, or cleanup issue.
+
+## Evidence
+
+- Cite tight file locations, exact commands/results, or named DAG artifacts.
+- Never invent evidence; name the missing check. An implementation summary is not the actual diff.
+- Failed required static/behavior verification is at least Important. Lint may be
+  `baseline-debt` only with a valid `frontend-lint-assessment-v1`; this is not a
+  passed lint result. A changed-file lint diagnostic, new unmatched diagnostic,
+  command drift, missing baseline, timeout, or unparseable output is Important.
+- Treat knowledge base, `openspec/schemas/`, `openspec/project-specs/`, and `ai_workspace/` as
+  parallel sources. Record connector/query/source/time plus openspec search terms and
+  matched paths/headings; label fallback or unavailable accurately.
+
+## Review Sequence
+
+1. Establish changed-file inventory and write boundaries.
+2. Compare original requirement with derived contract/constraints.
+3. Map each criterion to code, states, tests, and evidence.
+4. Inspect interactions, state/data/API behavior, failure paths, and regressions.
+5. Check mock selection, contract-to-fixture mapping, activation/default path,
+   handler/fixture/adapter and consumer diff, verification, production imports, and
+   the real-integration gap.
+6. Check design evidence, responsive/a11y behavior, dependencies, and maintenance.
+7. Classify findings and derive the verdict mechanically.
+
+Skipping either directory is Important when design compliance affects acceptance.
+
+```text
+- [Critical|Important|Minor] path:line — Problem; impact; required correction; evidence.
+```
+
+## Pass Rules
+
+- No Critical or Important findings remain.
+- Required static and behavior nodes ran and passed.
+- Lint is `passed` or evidence-backed `baseline-debt`; typecheck, build, and test are
+  passed. Any debt count and affected unchanged files remain disclosed.
+- Changed files are authorized.
+- Criteria and applicable states have implementation and evidence.
+- Required Mock-backed behavior passed; any generated Mock-specific verification also
+  passed; Mock is not enabled by default in production. For default-auto skipped
+  Mock, the real request remains default and the Real Integration Gap is preserved.
+- Optional unavailable knowledge/browser/visual/manual checks remain explicit risks.

package/skills/frontend-verification/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: frontend-verification
+description: Use to assess frontend evidence and produce closeout.
+references:
+  - path: references/verification-checklist.md
+    required: true
+    maxChars: 3000
+---
+
+# Frontend Verification
+
+Use for `frontend-closeout-pi`. Shell nodes execute commands; this read-only skill
+assesses their evidence. Read the checklist first.
+
+Inputs: criteria, change inventory, shell commands/status/artifacts, review
+verdict/findings, and required browser, visual, manual, or knowledge evidence.
+
+## Evidence Rules
+
+- Static evidence covers type/build/schema; behavior evidence must exercise the flow.
+  Lint has its own assessment status: `passed`, `baseline-debt`, `failed`, or
+  `unavailable`.
+- Shell exit status is authoritative. Classify as `passed`, `failed`, `not-run`,
+  `blocked`, or `unavailable`; only passed satisfies a required check.
+- Never use static success as behavior proof, or tests as visual/browser proof they did not exercise.
+- Mock-backed behavior proves frontend rendering and state transitions only. It never
+  proves backend readiness, transport compatibility, or real API integration.
+- Unavailable commands remain gaps.
+- `baseline-debt` is not lint passed. It requires
+  `frontend-lint-assessment-v1` proving only pre-writer diagnostics on unchanged
+  files. Report debt count, changed files, and raw evidence. Typecheck/build/test do
+  not support debt.
+- Use design and requirement evidence already bound inside
+  `contracts/frontend-review-context.json`. Closeout must not query connectors,
+  re-open task sources, OpenSpec, AI workspace, upstream model prose, or start new
+  repository research.
+- Separate Mock service/handler checks from page consumption and record the
+  dev/test-only boundary; handler tests alone do not prove page use.
+
+## Method And Output
+
+Map required checks to fresh evidence, classify gaps, confirm review pass, and state
+only proven changes.
+
+Return Markdown headings:
+
+- `Changes`: changed behavior and areas.
+- `Mock Decision`, `Mock Files`, `Mock Verification`, `Production Boundary`.
+- `Verification Evidence`: table of check, command/source, status, and artifact/result.
+  Keep lint `baseline-debt` verbatim rather than converting it to `passed`.
+- `Review Result`: exact review verdict and findings.
+- `Known Risks`: missing optional checks and environment caveats.
+- `Follow-up`: concrete work or `None`.
+
+With only Mock evidence, state `Frontend status: mock-validated`; when default `auto`
+skipped Mock without real API evidence, state `Frontend status: locally-validated`.
+Both require `Real integration: pending` and explicit
+`<task-id>-real-api-integration-verify` follow-up; it is not auto-created/executed.
+
+Do not edit files. Do not claim complete when review is not pass or a required check
+is failed, not-run, blocked, unavailable, stale, or contradicted.

package/skills/frontend-verification/references/verification-checklist.md

@@ -0,0 +1,48 @@
+# Frontend Verification Checklist
+
+## Static And Behavior Evidence
+
+- Required type/compile, lint/format, build, schema/client, browser/e2e/manual checks ran.
+- Lint is recorded as `passed | baseline-debt | failed | unavailable`.
+  `baseline-debt` cites `frontend-lint-baseline-v1` and
+  `frontend-lint-assessment-v1`, writer changed files, tolerated diagnostic count,
+  command identity, and raw output hashes; it is never labeled passed.
+- Every remaining lint diagnostic is on an unchanged file and matches the
+  writer-preceding baseline. Changed-file diagnostics, new unmatched diagnostics,
+  command drift, timeout, worktree mutation, or unparseable output fail closed.
+- Typecheck, build, and test are fully passed; none accepts baseline debt.
+- Generated output was authorized; tests cover changed logic, flows, and regressions.
+- Fixed entrypoints prove selected-strategy behavior and applicable UI states.
+- Mock-specific checks cover service/handler/schema/fixtures; behavior evidence separately proves page consumption.
+- Mock activation is explicit/non-production; a default-real-path build with Mock off proves the real request remains default.
+- `not-needed` has real/no-remote evidence or a default-auto skipped-Mock rationale.
+- Mock-backed evidence is frontend-only and never satisfies real API integration.
+
+## Design And Component Evidence
+
+- Claims cite knowledge-base, OpenSpec, and `<repoRoot>/ai_workspace/` sources.
+- Evidence records query/source/time, local-spec terms, paths, headings, and rules.
+- OpenSpec or `ai_workspace/` matches satisfy source availability; none blocks required design decisions.
+
+## Status
+
+- `passed`: fresh successful evidence matches current implementation.
+- `failed`: check ran and failed.
+- `not-run`: no fresh attempt exists.
+- `blocked`: a prerequisite prevented execution.
+- `unavailable`: tool, environment, connector, or source was absent.
+
+Only passed satisfies a required check. For lint alone, evidence-backed
+`baseline-debt` may continue as explicit debt; it replaces no other check.
+
+## Closeout Checks
+
+- List exact commands/source/exit status/artifacts; map every criterion to evidence or a named gap.
+- Record review verdict before completion.
+- Do not conflate static, behavior, browser/visual/manual, or knowledge-base proof.
+- If only Mock evidence exists, report `Frontend status: mock-validated` and `Real integration: pending`, with actual API verification follow-up.
+- If default `auto` skipped Mock and no real API evidence exists, report `Frontend status: locally-validated` and `Real integration: pending`.
+
+Output uses Changes, Verification Evidence, Mock Decision/Files/Verification,
+Production Boundary, Review Result, Known Risks, and Follow-up headings. If review is
+not pass or a required check fails, describe the task as incomplete with follow-up.

package/skills/grill-me/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: grill-me
+description: Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".
+---
+
+Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.
+
+Ask the questions one at a time.
+
+If a question can be answered by exploring the codebase, explore the codebase instead.