@winspan/claude-forge 8.54.4 → 9.2.0

package/dist/skills/distilled/distilled-defi-amm-security.md

@@ -0,0 +1,293 @@
+---
+name: distilled-defi-amm-security
+version: 0.2.0-distilled
+description: 'Distilled IT-universal skill: defi-amm-security (score 3.5/5)'
+keywords:
+  - defi
+  - amm
+  - security
+rubric_version: 2
+distilled_from:
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - defi-amm-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - django-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - laravel-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - llm-trading-agent-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - perl-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - quarkus-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-bounty-hunter/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-review/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-scan/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - springboot-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-review/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - laravel-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - quarkus-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-review/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - springboot-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - defi-amm-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - django-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - laravel-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - llm-trading-agent-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - perl-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-bounty-hunter/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-review/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-scan/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - springboot-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-review/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - defi-amm-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - django-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - laravel-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - llm-trading-agent-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - perl-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - quarkus-security/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-bounty-hunter/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-review/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - security-scan/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - springboot-security/SKILL.md
+distilled_at: '2026-05-29T08:14:29.853Z'
+distilled_by: claude-code skill-distiller agent
+it_universal_score: 3.5
+it_universal_dims:
+  d1: 0.5
+  d2: 1
+  d3: 0.5
+  d4: 1
+  d5: 0.5
+it_universal_rationale: >-
+  Domain-specific to DeFi/smart-contracts but toolchain-neutral and directly reusable across any AMM
+  protocol audit without project-specific rewrites.
+---
+
+# DeFi AMM Smart Contract Security Audit Patterns
+
+## When to use
+- Auditing or reviewing any AMM-style smart contract (swap, mint, burn logic)
+- Detecting economic attack vectors: flash loans, sandwich attacks, price manipulation
+- Adding security assertions to DeFi protocol tests
+- Pre-deployment security review for decentralized exchange contracts
+- Evaluating third-party DeFi integrations your protocol depends on
+
+## Core idea
+AMM contracts face economic attacks that don't exist in traditional software — a
+single transaction can borrow billions, manipulate prices, and repay within the
+same block. The primary defense is the **Check-Effects-Interactions (CEI)**
+pattern combined with trustless price oracles and user-controlled slippage
+guards. Flash loans make any on-chain spot price untrustworthy as a valuation
+oracle; always reference time-weighted or off-chain signed prices. Reentrancy
+guards prevent state corruption when external calls re-enter your contract.
+Access control and event emission provide governance safety and off-chain
+auditability.
+
+## Steps
+
+### 1. Flash Loan Resistance
+- Never trust spot reserve ratios (`reserve1 / reserve0`) as a price oracle
+  inside a single transaction — they are flash-loanable in one block
+- Use TWAP (Time-Weighted Average Price) accumulators sampled over ≥ 30 min,
+  or off-chain signed feeds (e.g., Chainlink, Pyth) for valuation decisions
+- If your function snapshots a price at entry, verify it against a trustworthy
+  oracle *before* any critical state change
+
+### 2. Slippage Protection
+- Every trade/swap function must accept caller-supplied `minAmountOut`
+  (or equivalent) — revert if actual output < `minAmountOut`
+- Add a `deadline` parameter; revert if `block.timestamp > deadline` to
+  prevent transactions from sitting in the mempool and executing at stale rates
+- Never silently accept a worse rate on the user's behalf
+
+### 3. Reentrancy Guards
+- Apply CEI order strictly on every state-changing path:
+  **Check** conditions → **Effect** storage writes → **Interact** externally
+- Add a reentrancy mutex or use a standard `ReentrancyGuard` on swap, mint,
+  burn, and flash-loan entry points
+- Callback tokens (ERC-777, hooks) can re-enter on `transfer` — test this
+  path explicitly
+
+### 4. Price Oracle Integrity
+- **Instantaneous** (`reserve1/reserve0`): manipulable, use only for display
+- **TWAP** (cumulative price accumulators, ≥ 30 min): safer for reference
+- **Off-chain signed feeds**: validate `updatedAt` staleness and deviation
+  thresholds before accepting a price
+- Clearly document which oracle type each function relies on
+
+### 5. Integer Arithmetic Safety
+- Use a compiler version / library with built-in overflow checks, or explicit
+  safe-math throughout
+- In fixed-point math: **multiply before divide** to preserve precision;
+  use adequate decimal precision (18 decimals is standard for ERC-20)
+- For fee calculations in basis points (e.g., 30 bps = 0.3%), verify
+  `amount * fee / 10_000` does not truncate to zero for dust amounts
+
+### 6. Access Control & Governance
+- Separate liquidity-provider roles from protocol-admin roles
+- Privileged operations (fee changes, pause, emergency drain) must be
+  role-gated and ideally time-locked
+- Emit events for every privileged and economically significant state change
+  to enable off-chain monitoring and incident response
+
+## Anti-patterns
+- **Trusting spot reserves as an oracle**: single-block flash loan makes this
+  trivially exploitable
+- **Missing `minAmountOut`**: exposes users to MEV sandwich attacks
+- **State update after external call**: classic reentrancy window
+- **Hardcoded price thresholds**: market conditions change; use relative %
+  deviation guards instead
+- **Single-owner admin key with no timelock**: single point of failure for
+  protocol governance
+- **Silent overflow/underflow**: corrupts pool accounting without revert
+
+## Audit Checklist
+
+- [ ] All valuation-critical price references come from TWAP or external oracle
+- [ ] Flash loan scenario analyzed — protocol is not exploitable within a
+      single block
+- [ ] Every trade function has `minAmountOut` + `deadline` parameters
+- [ ] CEI pattern applied on all state-changing functions with external calls
+- [ ] Reentrancy guard present on swap, mint, burn, and flash entry points
+- [ ] Integer overflow / underflow handled (compiler-enforced or explicit)
+- [ ] Admin vs. LP roles separated; governance actions time-locked
+- [ ] Events emitted for all privileged and economic state changes
+- [ ] Callback-token (ERC-777, hooks) reentrancy explicitly tested in your
+      test suite
+
+## References
+- Upstream: https://github.com/affaan-m/ECC.git

package/dist/skills/distilled/distilled-executing-plans.md

@@ -0,0 +1,113 @@
+---
+name: distilled-executing-plans
+version: 0.2.0-distilled
+description: 'Distilled IT-universal skill: executing-plans (score 4/5)'
+keywords:
+  - executing
+  - plans
+rubric_version: 2
+distilled_from:
+  - upstream: https://github.com/obra/superpowers.git
+    license: MIT
+    commit: unknown
+    paths:
+      - executing-plans/SKILL.md
+  - upstream: https://github.com/obra/superpowers.git
+    license: MIT
+    commit: unknown
+    paths:
+      - writing-plans/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - inventory-demand-planning/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - plan-orchestrate/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - inventory-demand-planning/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - inventory-demand-planning/SKILL.md
+  - upstream: https://github.com/affaan-m/ECC.git
+    license: MIT
+    commit: unknown
+    paths:
+      - plan-orchestrate/SKILL.md
+distilled_at: '2026-05-29T08:10:47.754Z'
+distilled_by: claude-code skill-distiller agent
+it_universal_score: 4
+it_universal_dims:
+  d1: 1
+  d2: 0.5
+  d3: 1
+  d4: 0.5
+  d5: 1
+it_universal_rationale: >-
+  Language-neutral plan-execution methodology with strong stop/verify discipline; only mild
+  deduction for cross-referencing a platform-specific skill framework (abstracted away in
+  distillation).
+---
+
+# Executing Plans
+
+## When to use
+- You have a written implementation plan (file or structured checklist) and are about to start a separate implementation session
+- You want to ensure critical review, progress tracking, and verification gates before shipping
+- Any codebase, any language — the skill governs *how* you work through a plan, not *what* the plan contains
+
+## Core idea
+
+Before writing a single line of code, load the plan and review it critically. Raise any concerns with your collaborator; resolve ambiguity before execution, not during. Then execute task-by-task, marking each item `in_progress` → `completed` and running the verifications the plan specifies. If you hit a genuine blocker, stop and ask — never guess your way through an unclear or broken instruction. After all tasks pass verification, hand off to a finishing/review phase before merging.
+
+## Steps
+
+1. **Announce intent** — Tell your collaborator which plan file you are executing, so they have the same mental model.
+
+2. **Load & review the plan critically**
+   - Read the entire plan before touching any code.
+   - Flag ambiguities, missing dependencies, or risky assumptions.
+   - If concerns exist → raise them with your collaborator and wait for resolution.
+   - If no concerns → proceed to step 3.
+
+3. **Create a task list** — Derive a checklist (e.g., TodoWrite or any tracking mechanism) directly from the plan's task list. Do not reinterpret task scope at this stage.
+
+4. **Execute tasks one at a time**
+   - Mark the task `in_progress`.
+   - Follow every sub-step exactly as written; bite-sized steps exist for a reason.
+   - Run each verification the plan specifies (tests, lint, manual checks, etc.).
+   - Mark the task `completed` only after verification passes.
+   - Repeat for the next task.
+
+5. **Stop-and-ask triggers** — Immediately halt execution and ask your collaborator when:
+   - A dependency is missing or unavailable.
+   - A verification fails repeatedly and the cause is unclear.
+   - An instruction is ambiguous or contradictory.
+   - The plan has a critical gap that prevents starting the next task.
+
+6. **Do not skip to a later task** to work around a blocker in an earlier one — partial execution can leave the codebase in an inconsistent state.
+
+7. **Finishing phase** — After all tasks complete and all verifications pass:
+   - Summarise what was done and which tests were run.
+   - Present the diff / change summary to your collaborator.
+   - Get explicit sign-off before merging to the main branch.
+
+## Anti-patterns
+
+- **Guessing through blockers** — If an instruction is unclear, guessing introduces silent bugs. Stop and ask.
+- **Skipping verifications** — "I'll run the tests later" defeats the purpose of checkpoints.
+- **Starting on the main branch without consent** — Always confirm the branch policy with your collaborator; default to a feature branch.
+- **Re-interpreting plan scope mid-execution** — If the plan seems wrong, surface it (step 2 or stop-and-ask), don't silently change what you're building.
+- **Marking completed before verification** — Status should reflect reality, not optimism.
+- **Merging multiple tasks into one batch** — Granular tracking makes rollback and review far easier.
+
+## References
+- Upstream: https://github.com/obra/superpowers.git

package/dist/skills/distilled/distilled-harness-engineering.md

@@ -0,0 +1,242 @@
+---
+name: distilled-harness-engineering
+version: 0.1.0-distilled
+description: 'Distilled IT-universal skill: harness-engineering (score 5/5)'
+spawn_agent: refactor-specialist
+keywords:
+  - harness
+  - engineering
+  - legacy
+  - 遗留代码
+  - 特征测试
+  - characterization
+  - 重构
+  - refactor
+  - 改造
+  - 老代码
+rubric_version: 2
+distilled_from:
+  - upstream: https://github.com/winspan/claude-forge.git
+    license: MIT
+    commit: 7d96b86c
+    paths:
+      - official/official-harness-engineering.md
+distilled_at: '2026-05-27T02:00:47.967Z'
+distilled_by: claude-sonnet-4-6
+it_universal_score: 5
+it_universal_dims:
+  d1: 1
+  d2: 1
+  d3: 1
+  d4: 1
+  d5: 1
+it_universal_rationale: Characterization-tests-first refactor; SDLC universal.
+---
+
+## 触发条件
+
+- 需要修改缺少测试覆盖的现有代码（遗留代码、接手的陌生代码库）
+- 代码复杂度高，直接改动风险大，担心破坏现有行为
+- 计划进行大规模重构或模块迁移
+- 接手高风险核心模块，需要在理解行为后再动手
+- 现有代码有隐含假设或副作用，需要先记录再修改
+
+---
+
+## 核心原则
+
+1. **先保护，后修改** — 在任何改动之前，用测试固化现有行为，确保改动有安全网兜底。
+2. **特征测试记录现实，不评判对错** — 测试描述"代码现在做什么"，即使存在 bug 也先如实记录，避免在理解阶段引入主观判断。
+3. **小步前进，即时验证** — 每次只改一处，改完立即运行测试套件；测试失败立即回滚，不积累未验证的变更。
+4. **行为一致性是重构的唯一成功标准** — 重构完成后，外部可观测行为必须与原始行为文档一致；新功能用新测试覆盖，不混入重构过程。
+5. **与 TDD 的边界清晰** — TDD 用于新功能（先写测试再实现）；Harness Engineering 用于改动现有代码（先理解再保护再修改），两者目的不同，不可混用。
+
+---
+
+## 工作流
+
+**复杂度判断（入口）**
+
+| 复杂度 | 描述 | 流程 |
+|--------|------|------|
+| 简单 | 改动范围小、依赖少 | 跳过阶段 1，直接从阶段 2 开始 |
+| 中等 | 多模块依赖、有副作用 | 完整四阶段 |
+| 复杂 | 核心模块、跨层依赖、高风险迁移 | 完整四阶段 + 额外人工审查 |
+
+---
+
+**阶段 1 — 理解（Understand）**
+
+1. 阅读目标代码，识别关键逻辑、边界条件和隐含假设。
+2. 绘制依赖关系图：哪些调用方依赖这段代码，哪些外部资源（数据库、网络、文件系统）被访问。
+3. 找到所有入口点（公开接口、事件触发点）和输出点（返回值、副作用、写操作）。
+4. 输出**行为文档**：以自然语言或表格记录当前实际行为，作为后续阶段的基准。
+
+---
+
+**阶段 2 — 特征测试（Characterize）**
+
+5. 针对行为文档中的每条行为编写特征测试（Characterization Tests），覆盖正常路径、边界条件和已知异常路径。
+6. 运行测试套件，确保**全部通过**（目标覆盖率 > 80%）。若测试失败，说明行为文档有遗漏，先补文档再补测试，不修改被测代码。
+7. 全绿后方可进入下一阶段。
+
+---
+
+**阶段 3 — 安全重构（Refactor）**
+
+8. 按优先级逐步重构：消除重复 → 提取函数/模块 → 改善命名 → 简化复杂逻辑。每次只改一处，改完立即运行完整 harness；测试失败立即回滚。
+
+---
+
+**阶段 4 — 验证（Verify）**
+
+在阶段 3 完成后执行：运行完整测试套件；对照原始行为文档逐条确认行为一致性；进行代码审查；新增行为用新测试覆盖，旧特征测试在确认无用后逐步退役。
+
+---
+
+## 反模式
+
+1. **边理解边修改** — 在行为文档和特征测试建立之前就动手改代码，导致无法判断改动是否破坏了原有行为。
+2. **特征测试写"应该怎样"而非"现在怎样"** — 将期望行为写入特征测试，掩盖了现有 bug，后续重构时误以为行为已修复。
+3. **大步重构，延迟运行测试** — 一次性改动多处后才运行测试，失败时无法定位是哪一步引入的问题。
+4. **测试失败后继续前进** — 不回滚、不修复，带着红色测试继续重构，导致安全网失效。
+5. **将重构与新功能开发混在同一次提交** — 行为变更和结构变更混合，代码审查和问题定位都变得困难。
+
+---
+
+## 验证标准
+
+完成 Harness Engineering 流程后，逐项确认：
+
+- [ ] 行为文档已输出，覆盖所有已知入口点、输出点和边界条件
+- [ ] 特征测试覆盖率 ≥ 80%，且在重构开始前全部通过（全绿）
+- [ ] 重构过程中每一步改动后测试均保持全绿；出现红色时已立即回滚
+- [ ] 重构完成后，外部可观测行为与行为文档逐条一致
+- [ ] 新增行为有独立的新测试覆盖，未混入特征测试
+- [ ] 代码审查已完成，无遗留的 TODO / 临时注释
+- [ ] 旧特征测试中已无用的部分已标记退役或删除
+
+---
+
+## 适用范围
+
+本技能适用于以下通用层次，与具体技术栈无关：
+
+- **后端服务** — 业务逻辑层、API 处理层、中间件
+- **持久化层** — 数据库访问、文件读写、缓存操作
+- **CLI 工具** — 命令解析、子命令处理、输出格式化
+- **前端** — 组件逻辑、状态管理、数据转换工具函数
+- **调度器 / 后台任务** — 定时任务、队列消费者、事件处理器
+- **知识库 / 配置加载** — 配置解析、数据初始化、静态资源处理
+
+> 任何存在"不敢改、不了解、没有测试"的代码模块，均适用本技能。
+
+---
+
+## 上游对照
+
+本技能从单一上游的 harness-engineering 规范（来源见 frontmatter）提炼，核心方法论源自 Michael Feathers《Working Effectively with Legacy Code》的特征测试思想。上游文档包含特定 Agent 调用建议（`researcher` / `tester` / `refactor-specialist`），已泛化为通用流程步骤，适配任意项目的工具链和团队分工。
+
+---
+
+## 示例（伪代码）
+
+场景：对一个缺少测试的"用户权限校验"模块进行重构。
+
+### 阶段 1 — 理解
+
+```
+// 阅读 auth_check 模块，记录行为文档
+behavior_doc = {
+  inputs:  [user_id, resource_id, action],
+  outputs: [bool: allowed, side_effect: audit_log_write],
+  paths: [
+    "user not found → return false",
+    "resource not found → raise NotFoundError",
+    "user.role == 'admin' → return true (skip resource check)",
+    "user.permissions includes action → return true",
+    "otherwise → return false + write audit log"
+  ],
+  hidden_deps: ["reads from cache first, falls back to DB", "audit log is async"]
+}
+```
+
+### 阶段 2 — 特征测试
+
+```python
+# Python
+def test_admin_always_allowed():
+    assert auth_check(admin_user, any_resource, "delete") == True
+
+def test_unknown_user_denied():
+    assert auth_check(unknown_id, resource, "read") == False
+
+def test_missing_resource_raises():
+    with raises(NotFoundError):
+        auth_check(user, nonexistent_resource, "read")
+
+def test_permitted_action_allowed():
+    assert auth_check(user_with_read, resource, "read") == True
+
+def test_denied_action_writes_audit():
+    auth_check(user_no_perms, resource, "write")
+    assert audit_log.last_entry.action == "write"
+```
+
+```typescript
+// TypeScript
+test("admin always allowed", () => {
+  expect(authCheck(adminUser, anyResource, "delete")).toBe(true);
+});
+test("unknown user denied", () => {
+  expect(authCheck(unknownId, resource, "read")).toBe(false);
+});
+test("missing resource raises", () => {
+  expect(() => authCheck(user, nonexistentResource, "read")).toThrow(NotFoundError);
+});
+```
+
+```go
+// Go
+func TestAdminAlwaysAllowed(t *testing.T) {
+    result, _ := authCheck(adminUser, anyResource, "delete")
+    assert.True(t, result)
+}
+func TestUnknownUserDenied(t *testing.T) {
+    result, _ := authCheck(unknownID, resource, "read")
+    assert.False(t, result)
+}
+```
+
+> 运行测试套件 → 全绿 → 进入阶段 3。
+
+### 阶段 3 — 安全重构（小步示例）
+
+```
+// 步骤 A：提取 "admin shortcut" 为独立函数
+function isAdminShortcut(user, action) → bool
+
+// 运行 harness → 全绿 → 提交
+
+// 步骤 B：提取 "permission lookup" 为独立函数
+function hasPermission(user, resource, action) → bool
+
+// 运行 harness → 全绿 → 提交
+
+// 步骤 C：将 audit log 写入改为显式调用，消除隐式副作用
+// 运行 harness → 某测试红色 → 立即 git revert 步骤 C → 分析原因
+```
+
+### 阶段 4 — 验证
+
+```
+// 对照行为文档逐条验证
+✓ "admin → true"              — test_admin_always_allowed 通过
+✓ "user not found → false"    — test_unknown_user_denied 通过
+✓ "resource not found → raise"— test_missing_resource_raises 通过
+✓ "permitted → true"          — test_permitted_action_allowed 通过
+✓ "denied → audit log"        — test_denied_action_writes_audit 通过
+
+// 新增行为（重构后 audit log 改为显式）→ 新增独立测试覆盖
+// 旧特征测试中针对隐式副作用的断言 → 标记退役
+```