@xgent-ai/skills 0.7.6 → 0.7.8

package/skills/crd-respond/assets/response-template.md

@@ -1,23 +1,24 @@
 ### RESP-<下一编号> · <接收方项目> · 需求评估与答复
 
-- 类型：<答复草案（未发送/未确认）；已有明确确认则写实际状态与来源>
+- 类型：<本方答复；仅用户要求草案/预审稿或原样收录草案时标草案>
+- 发送状态：<未发送 / 已发送及依据；未发送不使本方技术结论成为草案>
 - 发言方与项目：<实际代表的接收方项目；收录提出方消息时保留提出方归属，未知联系人不编造>
 - 原消息时间：<实际时间；未知则注明>
 - 整理时间：<本次整理日期>
 - 来源：<原 CRD 标识、路径/链接、收到版本/章节及调查前内容 hash（可用时）>
 - 代码基线：<本方仓库、调查日期、分支、SHA、dirty 状态与相关工作树范围；非 Git 写可用版本>
 - 关联与范围：<原 R/Q 或稳定章节；本轮未评估范围；更正/续接的 RESP>
-- 确认边界：<本方技术推荐、用户明确确认和对方确认分别的依据；尚未发送、未承诺排期或未交付如实写明>
+- 确认边界：<本方技术结论、用户保留的具体决定和对方确认分别的依据；尚未发送、未承诺排期或未交付如实写明>
 
 #### 总体结论
 
-<先说需求目标是否合理，再说原方案是否适合本方、推荐什么以及主要取舍。推荐不等于双方已接受。>
+<先说需求目标是否合理，再说原方案是否适合本方、明确选择什么以及长期维护/演进的主要取舍，列已定事项与剩余实质分歧。本方结论不等于双方已接受或已承诺排期，不因此将整体标草案。>
 
 **本方代码动作**：<需要修改 / 无需修改 / 待定，部分范围分列；区分本方和对方改动>
 
 #### 逐项答复
 
-| 原需求/问题 | 目标与原方案判断 | 本方当前能力与证据 | 拟议立场及条件 | 本方代码动作/计划去向 |
+| 原需求/问题 | 目标与原方案判断 | 本方当前能力与证据 | 本方技术立场及条件 | 本方代码动作/计划去向 |
 | --- | --- | --- | --- | --- |
 | <R-ID/章节，Q-ID 可引用已有行> | <目标价值、指定方案问题与影响> | <足够/缺口/未核实；可共享的路径/符号或契约定位，标证据类型> | <接受/部分接受/替代方案/不接受/待澄清；保留和不接受部分、理由与验收变化> | <需要/无需/待定；增量、真实计划链接与状态或受阻原因> |
 
@@ -38,9 +39,9 @@
 
 | Q-ID/原问题定位 | 关联需求 | 待决定的问题与推荐/选项后果 | 提问方 → 待答方 | 阻塞哪一步 / 解除条件 |
 | --- | --- | --- | --- | --- |
-| <沿用或递增 Q-ID> | <R-ID/章节> | <缺证还是取舍；推荐不得冒称已选> | <本方 → 用户/对方项目> | <具体契约、计划就绪或验收；非阻塞也注明> |
+| <沿用或递增 Q-ID> | <R-ID/章节> | <确实缺哪个事实/保留给用户的取舍、为何影响结论；已有授权内的技术选择直接定论，不再求一次转正确认> | <本方 → 用户/对方项目> | <具体契约、计划就绪或验收；非阻塞也注明> |
 
-无待决/未答事项时写「暂无」，不制造问题。
+无待决/未答事项时写「暂无」，不制造问题；双方已定事项不重问。若往返只有重复理由，写明最小分歧、本方主张与可接受边界，需用户裁定时用交互工具提出，不再续写草案。
 
 #### 开发计划与下一步
 

package/skills/crd-respond/evals/scenarios.md

@@ -26,7 +26,7 @@
 | 收到的 CRD 要新增接口；旧文档说不支持，但相关未提交代码已有同语义接口、权限和错误测试 | 调查当前工作树并逐项核实契约，接受合理目标、提出复用方案，判无需本方代码变更；完整原 CRD 文末追加答复，无新计划 | 仅凭 HEAD/旧计划断言缺口，重造接口，或把本地代码称已上线 |
 | 请求本方对某租户写特殊分支；仓中有多个同类策略场景和明确的数据归属 | 区分目标价值与 hard-code 原案，比较真实长期备选，说明共同语义与双方成本；需本方改码时实际读取 dev-plan、产出计划并回填链接 | 无条件接受特例、口号式“通用平台”、只给后续调用命令或直接实施 |
 | 只有一个真实用例，已有局部增量可保持稳定契约 | 选足够简单的长期方案，解释为何不造规则引擎/适配器；不把「通用」等同抽象层数 | 虚构未来调用者、无收益的插件/平台架构 |
-| 外部契约需变更，本方技术上明确要改，但尚无对方确认；用户不交互 | 回复标待确认；实际生成 Blocked 计划，推荐方案保持提议性质，写明解除条件 | 无答复就默认为批准、标 Ready，或因待确认完全跳过计划 |
+| 外部契约需变更，本方技术上明确要改，但尚无对方接受；用户已明确暂缓需其裁定的事项 | 本方明确选择替代方案，只有契约接受/用户保留取舍单列待决；实际生成 Blocked 计划，写明解除条件，不将整个本方答复降为草案 | 无答复就默认为批准、标 Ready，或因待确认完全跳过计划 |
 | 需求目标不清，证据不足以确定本方是否需改；另有可独立明确的需求 | 未知与不合理分开，代码动作待定，提出具体补证/取舍问题；只规划已确定独立范围，不宣称覆盖整份 CRD | 把未知判拒绝或确定改码、吞掉未决项 |
 | 稳态需要消除双轨，但发布必须滚动兼容 | 推荐长期终态，同时定义迁移、兼容窗口、退出与恢复条件 | 因“可持续”拒绝必要迁移，或永久双写被包装成最终方案 |
 | 最便宜的本方方案把权限与重试复杂度全推给消费方 | 比较双方和全生命周期成本，解释职责及失败所有权，不直接称更优 | 仅按本方 diff/工期决定胜者 |
@@ -46,6 +46,15 @@
 | 对方仓库不可访问，CRD 含片面能力声明；只有本方静态代码 | 本方已核实/对方陈述/未知分别标注；不声称真实联调或性能通过 | 推断对方不存在能力、把函数存在当行为足够 |
 | 原输入是只读链接或非 Markdown，或定稿时有人修改原文件 | 保真工作副本/受阻说明；并发时重读、保留增量后只追加，不假称改了远程原件 | 强制转格式丢原文、旧快照覆盖他人修改、声称已回写只读来源 |
 
+## 本方结论与往返收敛
+
+| 请求与项目材料 | 应观察的行为 | 失败信号 |
+| --- | --- | --- |
+| 用户要求代表接收方评估并答复，事实与项目约束充分；未另说「批准你的答复」，也未授权发送 | 直接形成接受/部分接受/替代方案/不接受的本方技术结论，写长期取舍及依据；仅发送状态为未发送，不虚构预算/排期/对方接受 | 整份标「草案，待用户确认」、额外问能否将技术结论转正，或为显果断编造交付承诺 |
+| 双方两次仅重复原有责任边界理由，无新事实；本方可接受边界明确，但协调取舍超出既有授权 | 本方立场明确，提炼最小分歧与可行路径，通过 Ask User 类工具提出具体裁定并等待答复，其他已定项继续 | 追加同义澄清/草案、只在聊天留待办、把轮数当达成一致依据或擅自让步改验收 |
+| 用户明确要预审草案；另一变体为仅原样追加已有草案 | 前者可标草案但仍有本方判断；后者保留原标识与原意，不代拟新立场 | 为了果断擅自升级为已确认，扩大为评估或生成计划 |
+| 双方同一契约已有有效一致结论；只有部署交付与联调证据尚缺 | 明确契约已定，保留真实交付/联调前置，按授权规划；不再次请求确认本轮确认 | 继续标契约待确认，或反向把契约成立当作交付和联调已完成 |
+
 ## 证据与报告
 
 每次记录测试输入/代码版本、实际加载路径、技能/相关文件读取、CRD 前后差异、计划链接与就绪状态、检查命令及未运行部分。语义断言与结构校验分开：YAML/链接通过不证明方案质量，显式加载的冒烟通过也不证明客户端会自动选择。查重场景需真跑第二次；缺技能、并发、只读等未运行时明确保留为待测。

package/skills/phoenix-diagram/ENGINE.json

@@ -3,9 +3,9 @@
   "distribution": "release",
   "tool": "phoenix-diagram",
   "toolVersion": "0.2.0",
-  "npmPackageVersion": "0.7.6",
-  "sourceCommit": "6a01c326c1f3dd0390151882e6e03205ea1dc6b8",
-  "sourceInputSha256": "0f1df3fb0de1d1be7289d102dffccebe58e25a4393104385690f5e666e1af29e",
+  "npmPackageVersion": "0.7.8",
+  "sourceCommit": "4e2a4e4dccbbceb84152eb93bc74662aa4b759d0",
+  "sourceInputSha256": "51b65bd3f53b989e1f242cae99542ed67c5fe3e855edf906f7f5fab23939ab94",
   "inputContractSchema": 1,
   "receiptSchema": 1,
   "viewerRevision": "phoenix-v2",
@@ -14,26 +14,26 @@
     "darwin-arm64": {
       "asset": "phoenix-diagram-darwin-arm64",
       "size": 17566448,
-      "sha256": "7f86c913a72a9767607529ffe36a426ced92e5f6c480cafbad6ab41d227376ef",
-      "url": "https://download.xgent.ai/vendor/phoenix-diagram/v0.7.6/darwin-arm64/phoenix-diagram-darwin-arm64"
+      "sha256": "f85846e9a0967847eaf3f3b0a290d4009c069821c028495b047db358176ce17c",
+      "url": "https://download.xgent.ai/vendor/phoenix-diagram/v0.7.8/darwin-arm64/phoenix-diagram-darwin-arm64"
     },
     "darwin-x64": {
       "asset": "phoenix-diagram-darwin-x64",
       "size": 19576864,
-      "sha256": "5b826e660f39fd234a500d521d8b2bf96bb47f352aee4f528209291f7a2c5cc5",
-      "url": "https://download.xgent.ai/vendor/phoenix-diagram/v0.7.6/darwin-x64/phoenix-diagram-darwin-x64"
+      "sha256": "b3df962d82d3f731d9641184cceec5516c082aa1fbc871ac41692cc7acd85dc8",
+      "url": "https://download.xgent.ai/vendor/phoenix-diagram/v0.7.8/darwin-x64/phoenix-diagram-darwin-x64"
     },
     "linux-x64": {
       "asset": "phoenix-diagram-linux-x64",
       "size": 21880592,
-      "sha256": "37cbf5d8b4a2b1daa0f7c44f462f1d34b0e1a5d3b3e438bfe0988021cfcee457",
-      "url": "https://download.xgent.ai/vendor/phoenix-diagram/v0.7.6/linux-x64/phoenix-diagram-linux-x64"
+      "sha256": "59ef4d6ac3f08e000c387a668915e31a8f44a83cc01ba9b89381fadc193e09f6",
+      "url": "https://download.xgent.ai/vendor/phoenix-diagram/v0.7.8/linux-x64/phoenix-diagram-linux-x64"
     },
     "linux-arm64": {
       "asset": "phoenix-diagram-linux-arm64",
       "size": 19406792,
-      "sha256": "cb1ceb6cabc492b0c22e5f57f270cb1484ee6332b028b29bc8a824fff74095ae",
-      "url": "https://download.xgent.ai/vendor/phoenix-diagram/v0.7.6/linux-arm64/phoenix-diagram-linux-arm64"
+      "sha256": "f86c8610dde3af5c01cf70275d3a8241d35e937916e34367963c1a728bfba7ac",
+      "url": "https://download.xgent.ai/vendor/phoenix-diagram/v0.7.8/linux-arm64/phoenix-diagram-linux-arm64"
     }
   }
 }

package/skills/phoenix-ui/GENERATED.json

@@ -131,7 +131,7 @@
       "reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "reference/typeset.md": "266887459ebcf2247c9a569e34c828058854a6c5db75b986d952335df197cd3a",
       "reference/visualize.md": "9f2fefa242907cb6f5e3a2bf62ab4571151118c774ac8edd813179eb4d4e58b4",
-      "scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -202,7 +202,7 @@
       "agents/.agents/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "agents/.agents/skills/phoenix-ui/reference/typeset.md": "09471ffe6fc9917a6e2dd0f18e820ba025cc8dcd2f461157f1466e2ecffa20fc",
       "agents/.agents/skills/phoenix-ui/reference/visualize.md": "1c51d37995cbd7fb993be4ad2105357c06447086770707bfc4fe9ae432253ea7",
-      "agents/.agents/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "agents/.agents/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "agents/.agents/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "agents/.agents/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "agents/.agents/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -270,7 +270,7 @@
       "antigravity/.agent/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "antigravity/.agent/skills/phoenix-ui/reference/typeset.md": "bd9aad79eb1f071fbf4b52964a877d74437ec04baf1b449de247ba40724877c4",
       "antigravity/.agent/skills/phoenix-ui/reference/visualize.md": "991d2d7129415c51cca616b23bd500fdb46bb54d391d9c6bf01944cee7c42dd9",
-      "antigravity/.agent/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "antigravity/.agent/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "antigravity/.agent/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "antigravity/.agent/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "antigravity/.agent/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -339,7 +339,7 @@
       "claude-code/.claude/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "claude-code/.claude/skills/phoenix-ui/reference/typeset.md": "a87afc99d24146fe8fe0d4040641559d355f4ffff4edb15e062c4a3487dacd70",
       "claude-code/.claude/skills/phoenix-ui/reference/visualize.md": "0389662aa8c9bd0df1f7802773a783fee5b1c773eed77f8a4a55252dcd750f6e",
-      "claude-code/.claude/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "claude-code/.claude/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "claude-code/.claude/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "claude-code/.claude/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "claude-code/.claude/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -405,7 +405,7 @@
       "codex/.codex/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "codex/.codex/skills/phoenix-ui/reference/typeset.md": "aebe2f0424cf20722302f897a8fb658abc31e9819d2007bb2280ff1611ad3abf",
       "codex/.codex/skills/phoenix-ui/reference/visualize.md": "9a6623eb816608930834366a62387df67585c00ddd866dcafd572f37f94becfb",
-      "codex/.codex/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "codex/.codex/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "codex/.codex/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "codex/.codex/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "codex/.codex/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -478,7 +478,7 @@
       "cursor/.cursor/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "cursor/.cursor/skills/phoenix-ui/reference/typeset.md": "748e309d9f9277994639b843208794e07bc7aa1d7669877f37517cc373508da1",
       "cursor/.cursor/skills/phoenix-ui/reference/visualize.md": "6817bb72f26d0592f34cf785c7a7db98ac888ee70f28b3dfb49b92820c583402",
-      "cursor/.cursor/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "cursor/.cursor/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "cursor/.cursor/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "cursor/.cursor/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "cursor/.cursor/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -542,7 +542,7 @@
       "dsh/.dsh/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "dsh/.dsh/skills/phoenix-ui/reference/typeset.md": "f05511879e0707c46b481678de61629c8e971976ea4419e3257845a4665537a2",
       "dsh/.dsh/skills/phoenix-ui/reference/visualize.md": "b6b6b4e82376e65a8e86047b2bfe8643a259b8aab9f65aa4d9abb167c40a738c",
-      "dsh/.dsh/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "dsh/.dsh/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "dsh/.dsh/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "dsh/.dsh/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "dsh/.dsh/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -607,7 +607,7 @@
       "gemini/.gemini/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "gemini/.gemini/skills/phoenix-ui/reference/typeset.md": "5707efcbda57b681d9598a0f3a49eb0b1300dfd155c37ad985363fc5bd56b5ef",
       "gemini/.gemini/skills/phoenix-ui/reference/visualize.md": "3d8d9a62aa3f861a6ebfe97e258f72084023962fa7954d46b5c9269d2cb48450",
-      "gemini/.gemini/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "gemini/.gemini/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "gemini/.gemini/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "gemini/.gemini/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "gemini/.gemini/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -676,7 +676,7 @@
       "github/.github/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "github/.github/skills/phoenix-ui/reference/typeset.md": "8d35fdd9909ecb618b5fd2fb7ef49e90f234ff946b541b9acc14580b8a293b7d",
       "github/.github/skills/phoenix-ui/reference/visualize.md": "fc7c75a51875eaffa28b4731b0d0395241f3b6d095a597315b3dbc2a58dce308",
-      "github/.github/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "github/.github/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "github/.github/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "github/.github/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "github/.github/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -745,7 +745,7 @@
       "grok/.grok/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "grok/.grok/skills/phoenix-ui/reference/typeset.md": "5057febac0a0bd935882a9bb6ce6fbf3b3ae5ea0f9dae4bcc591fc78b5e32540",
       "grok/.grok/skills/phoenix-ui/reference/visualize.md": "955c2c2bc70822d3c65d334aa8dce55ed3bc5ba66f33d683ca2f2f9ac5d792e1",
-      "grok/.grok/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "grok/.grok/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "grok/.grok/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "grok/.grok/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "grok/.grok/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -809,7 +809,7 @@
       "hermes/.hermes/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "hermes/.hermes/skills/phoenix-ui/reference/typeset.md": "2d16e6cd514e98996f8cf4b58552eec71016b0c06695e8526eaffc396ff22dd7",
       "hermes/.hermes/skills/phoenix-ui/reference/visualize.md": "451faed5574d012b4f63191db25d451b4b916c972ca7d47610e862b3d868e259",
-      "hermes/.hermes/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "hermes/.hermes/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "hermes/.hermes/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "hermes/.hermes/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "hermes/.hermes/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -873,7 +873,7 @@
       "kiro/.kiro/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "kiro/.kiro/skills/phoenix-ui/reference/typeset.md": "77995c215ddefdcdb596e0be9ed3989fbbba0d258fd959f731dcd54b81729bd5",
       "kiro/.kiro/skills/phoenix-ui/reference/visualize.md": "4aec66dea1c41cef5d24615cf6770e1593a2ace068bc4ce2cdc94c5078f03226",
-      "kiro/.kiro/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "kiro/.kiro/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "kiro/.kiro/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "kiro/.kiro/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "kiro/.kiro/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -938,7 +938,7 @@
       "opencode/.opencode/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "opencode/.opencode/skills/phoenix-ui/reference/typeset.md": "616df84da8448ecf3c4eb3d3c63535e150c3f7a519ee34f75187cfa9fe742d88",
       "opencode/.opencode/skills/phoenix-ui/reference/visualize.md": "6968dcbe46b7a06b555d952a3b5a93099240ac3a2e9594db90ad85edc79c4928",
-      "opencode/.opencode/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "opencode/.opencode/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "opencode/.opencode/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "opencode/.opencode/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "opencode/.opencode/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -1002,7 +1002,7 @@
       "pi/.pi/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "pi/.pi/skills/phoenix-ui/reference/typeset.md": "97266c256014b963e9f029e4e671f186111207e18ee4e85b0e7373a1badf9ada",
       "pi/.pi/skills/phoenix-ui/reference/visualize.md": "420657758f3952f0eea8ce774e79ab50ce541e31c7e6f55aff8139a51ac98ec4",
-      "pi/.pi/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "pi/.pi/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "pi/.pi/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "pi/.pi/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "pi/.pi/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -1066,7 +1066,7 @@
       "qoder/.qoder/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "qoder/.qoder/skills/phoenix-ui/reference/typeset.md": "5fb9019041a849724f4bf6b5aff825670e00d8f289a7940de8150083d9182ad3",
       "qoder/.qoder/skills/phoenix-ui/reference/visualize.md": "30a4b25e0f38b51fa22dbf7c3bed8d42b35bce4b9d03b66a18ce18d726b69cd8",
-      "qoder/.qoder/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "qoder/.qoder/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "qoder/.qoder/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "qoder/.qoder/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "qoder/.qoder/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -1130,7 +1130,7 @@
       "rovo-dev/.rovodev/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "rovo-dev/.rovodev/skills/phoenix-ui/reference/typeset.md": "837fd8f637f57ccd09a938a26205486c23be5d004e20f4cfd9adfd921d31b23d",
       "rovo-dev/.rovodev/skills/phoenix-ui/reference/visualize.md": "54eba14f6fdfe0c107b79e404614c9553b7c8e998ee3b75e478364544ed7c3fc",
-      "rovo-dev/.rovodev/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "rovo-dev/.rovodev/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "rovo-dev/.rovodev/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "rovo-dev/.rovodev/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "rovo-dev/.rovodev/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -1194,7 +1194,7 @@
       "trae/.trae/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "trae/.trae/skills/phoenix-ui/reference/typeset.md": "d40f18b6419f82d35b93164b480b18f58f61dd6df813bfe14d89697ec167b571",
       "trae/.trae/skills/phoenix-ui/reference/visualize.md": "767511785216ff25b8780d39674d8d33469e4338c539565af58a09e3b2124def",
-      "trae/.trae/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "trae/.trae/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "trae/.trae/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "trae/.trae/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "trae/.trae/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -1258,7 +1258,7 @@
       "trae-cn/.trae-cn/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "trae-cn/.trae-cn/skills/phoenix-ui/reference/typeset.md": "8c7aaa03ec8131eb4c2f25f5f33cdcb7e011e7db0240f5a9d926386585ed1f49",
       "trae-cn/.trae-cn/skills/phoenix-ui/reference/visualize.md": "f6cec907cf998a070724c4c457cd7217bec65a0fbf50fd1b9f823489f607166c",
-      "trae-cn/.trae-cn/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "trae-cn/.trae-cn/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "trae-cn/.trae-cn/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "trae-cn/.trae-cn/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "trae-cn/.trae-cn/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -1322,7 +1322,7 @@
       "veto/.veto/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "veto/.veto/skills/phoenix-ui/reference/typeset.md": "b23a2e8201ae72f13205fdaaf1eec3e75904a0154adc3f7445c3df4647d584c7",
       "veto/.veto/skills/phoenix-ui/reference/visualize.md": "53d699a61ec9cacd18600cac7e1ec945529789863db6a28e4baaa1767d8be9b8",
-      "veto/.veto/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "veto/.veto/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "veto/.veto/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "veto/.veto/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "veto/.veto/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",
@@ -1386,7 +1386,7 @@
       "vibe/.vibe/skills/phoenix-ui/reference/shape.md": "a55f016c046cb6a27c55bd7f346375aeb506a755c4fbca19a5f92dbd42309c23",
       "vibe/.vibe/skills/phoenix-ui/reference/typeset.md": "997a23f558b6164a991ffcd66ecd5255a327fbf5c8181451349340d2988d3247",
       "vibe/.vibe/skills/phoenix-ui/reference/visualize.md": "bea1f841298b40d6078e028ba03cd7fd5dffe48676a3d8c4dbaa07e65535050e",
-      "vibe/.vibe/skills/phoenix-ui/scripts/ENGINE.json": "93db1befcba8c542b373d623c6aa15055b378d80dd24bb95cf71282ff2866150",
+      "vibe/.vibe/skills/phoenix-ui/scripts/ENGINE.json": "01e516b823bc6ec729f063f27fa9831da603fa0c77b541880d6599ea95593259",
       "vibe/.vibe/skills/phoenix-ui/scripts/VERSION": "e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67",
       "vibe/.vibe/skills/phoenix-ui/scripts/command-metadata.json": "fcab887ef557cc74babd484ddd764f36ab04fa2d8251d440d93f6018239b05fe",
       "vibe/.vibe/skills/phoenix-ui/scripts/data/catalog/composition-ingredients.json": "ce19855b842a453973bff4eab9614bcfe502092dc9b2f4238dce27038e2d15d1",

package/skills/phoenix-ui/scripts/ENGINE.json

@@ -2,38 +2,38 @@
   "schemaVersion": 1,
   "distribution": "release",
   "toolVersion": "0.1.0",
-  "npmPackageVersion": "0.7.6",
-  "sourceCommit": "6a01c326c1f3dd0390151882e6e03205ea1dc6b8",
-  "sourceTree": "34fecf8ada60947a681e278760e30fd658211b91",
+  "npmPackageVersion": "0.7.8",
+  "sourceCommit": "4e2a4e4dccbbceb84152eb93bc74662aa4b759d0",
+  "sourceTree": "eb87c0c92741ca9a268d570424977f881409f859",
   "sourceState": "dirty",
-  "sourceInputSha256": "466dc76c552ee4b79049cbe41852d84dc010c25f31ecf3062b79605f5d557e31",
+  "sourceInputSha256": "39ffc51ac021550f2ef80f7a2587a1d6f46cfc2c30b6a72ba9705cf2bc95ca21",
   "bundleSchema": 1,
   "bundleSha256": "637ec2dbcaad98d0765bf0d73fd2fc5935004212288c69f3f5798a13fb584c78",
   "reviewSchema": 1,
   "engines": {
     "darwin-arm64": {
       "asset": "phoenix-ui-darwin-arm64",
-      "sha256": "b688b6d70b37270a451cfd8002c6139ade3197cc3458da54201d4764cf77fd95",
-      "size": 18350288,
-      "url": "https://download.xgent.ai/vendor/phoenix-ui/v0.7.6/darwin-arm64/phoenix-ui-darwin-arm64"
+      "sha256": "7e0ff1a5e492ce23227dbe59aaa0430383ca53427af51cfa64d1a37addc489cb",
+      "size": 18350304,
+      "url": "https://download.xgent.ai/vendor/phoenix-ui/v0.7.8/darwin-arm64/phoenix-ui-darwin-arm64"
     },
     "darwin-x64": {
       "asset": "phoenix-ui-darwin-x64",
-      "sha256": "f8b59faf9bda40347ce9fec8abd2001414aa22b705cddb01e6ed30df487bb15c",
-      "size": 20838208,
-      "url": "https://download.xgent.ai/vendor/phoenix-ui/v0.7.6/darwin-x64/phoenix-ui-darwin-x64"
+      "sha256": "8dfad2ee41cfbebb0a17f77d62c93a58098f4e4cb5c05e193519305d73dc6d22",
+      "size": 20842304,
+      "url": "https://download.xgent.ai/vendor/phoenix-ui/v0.7.8/darwin-x64/phoenix-ui-darwin-x64"
     },
     "linux-x64": {
       "asset": "phoenix-ui-linux-x64",
-      "sha256": "c233dd554bc033d339aa568704e136d6d0d949f8fc8e8ea0a3e3ab69d5cb329b",
-      "size": 22931072,
-      "url": "https://download.xgent.ai/vendor/phoenix-ui/v0.7.6/linux-x64/phoenix-ui-linux-x64"
+      "sha256": "85e7f2bbd01983a0c89153602152d68b42e6c21fce314f8b1fc4b7178cf73996",
+      "size": 22932672,
+      "url": "https://download.xgent.ai/vendor/phoenix-ui/v0.7.8/linux-x64/phoenix-ui-linux-x64"
     },
     "linux-arm64": {
       "asset": "phoenix-ui-linux-arm64",
-      "sha256": "6f846f717e7403d419fcab253057ab35355fd00ee8b247235fe63c2fb2d65548",
+      "sha256": "311aefb7b8451bc61b3eb20303b62a5ddf32f658860db90165cfcc716e0523f8",
       "size": 19768520,
-      "url": "https://download.xgent.ai/vendor/phoenix-ui/v0.7.6/linux-arm64/phoenix-ui-linux-arm64"
+      "url": "https://download.xgent.ai/vendor/phoenix-ui/v0.7.8/linux-arm64/phoenix-ui-linux-arm64"
     }
   }
 }

package/skills/portal-external-app/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: portal-external-app
-description: '用于把独立仓库、以 Docker 镜像交付的外部服务接入 XGENT 门户或评审交付物。覆盖 manifest、注册、鉴权、成员客户端与终端用户身份、/svc 路由、健康检查与一盒联调。'
+description: '用于把独立仓库、以 Docker 镜像交付的外部服务接入 XGENT 门户或评审交付物。覆盖 manifest、注册、鉴权、MCP OAuth 发现、成员客户端与终端用户身份、/svc 路由、健康检查与一盒联调。'
 when_to_use: "用户会说「把我们服务接进门户」「manifest 怎么填」「/svc 路由不通」时。"
 ---
 
@@ -25,7 +25,8 @@ when_to_use: "用户会说「把我们服务接进门户」「manifest 怎么填
 | 服务账号写进应用空间的文件，要让作者本人在文件管理里看得到 | [references/files-member-docs.md](references/files-member-docs.md)：`onBehalfOf` 署名、成员只读可见、成员内容隐私开关 |
 | 门户成员的原生客户端（iOS/Android/桌面）登录与刷新、设备凭证、停用后失效时效、服务端成员查询与事件 | [references/native-clients.md](references/native-clients.md) |
 | 顾客/学生等终端用户的完整能力、租户用户中心、托管注册登录、账号与隐私治理 | [references/end-users.md](references/end-users.md)：先区分成员与终端身份，再按任务读认证协议或生命周期接口 |
-| 用户以 CLI、MCP、个人自动化调用 App，或接入门户多服务用户密钥与服务发现 | [references/cli-user-keys.md](references/cli-user-keys.md)：受审 `cliAccess` 声明、标准绑定与通用目录；不改门户业务代码 |
+| CLI、MCP、个人自动化使用门户用户访问密钥，或接入多服务用户密钥目录 | [references/cli-user-keys.md](references/cli-user-keys.md)：受审 `cliAccess` 声明、标准绑定与通用目录 |
+| MCP/OAuth 客户端发现元数据，或标准 `/.well-known/…/svc/<key>` 返回 HTML/404 | [references/oauth-discovery.md](references/oauth-discovery.md)：`oauthDiscovery` 声明、匿名元数据、审批、固定提案交付与撤销 |
 | 为外部服务写/审对接契约文档 | [references/contract-doc-template.md](references/contract-doc-template.md) |
 | 有「每租户最多几个 X」的配额诉求（选模型、数值谁配、已用怎么来） | [references/quota-and-seats.md](references/quota-and-seats.md) |
 | 一个配置项该放哪（环境变量 / 平台级或租户级管理页 / 应用内设置 / 用户偏好），`requiredEnvNotes`、`adminPages` 与 service `tenantConfig` 怎么写 | [references/config-placement.md](references/config-placement.md) |

package/skills/portal-external-app/references/oauth-discovery.md

@@ -0,0 +1,94 @@
+# MCP / OAuth 标准发现接入
+
+适用于 App 自己提供 OAuth 元数据，客户端从门户 origin 查找标准发现地址的场景。
+`oauthDiscovery` 只配置路由；门户透明转发，不生成 JSON，不实现 App 的授权、token、scope 或客户端回调。
+门户用户访问密钥与多服务目录使用 `cliAccess`，见 [CLI 用户密钥](cli-user-keys.md)，两者不能互相替代。
+
+## 前置与声明
+
+目标门户须已部署 OAuth 发现迁移、API/controller 和统一 v2 网关模板（container/process 均支持）。
+不支持 v1；不依赖 `PUBLIC_SITES_ENABLED`、Sites 权益或 CSP strict 开关。安装新版 SDK、
+whoami 成功、后端 healthy 都不能证明这些平台前置已满足；能力未部署时交平台升级，不逐 App 手改 Caddy。
+需要 TypeScript 契约时，`@xgent/shared` 从 0.11.1 提供 `OAuthDiscovery`。
+
+将以下片段合入 App 自己的完整 `app.manifest.json`，递增 `version`：
+
+```json
+{
+  "oauthDiscovery": {
+    "authorizationServer": true,
+    "protectedResources": ["/mcp"]
+  }
+}
+```
+
+- 非空声明要求最终清单有 `deployDescriptor` 或 `serviceBaseUrl`，服务须可用。需要常驻时在既有 descriptor 设置 `alwaysOn: true`。
+- 只接受 `authorizationServer`（布尔值，省略为 false）与 `protectedResources`（路径数组，省略为空）。仅资源服务器可以只声明后者。
+- 路径从 App 服务根起算，填 `/mcp`，不填 `/svc/<key>/mcp`。`/` 表示根资源；其他路径由非空的字母、数字、`.`、`_`、`~`、`-` 段组成。单独的 `.`/`..` 段、空段、尾斜线、URL、百分号编码、query、fragment、空白、通配符均拒绝。
+- 路径去重并排序；声明中不能指定 issuer、resource、域名或 upstream。这些元数据值由 App 的响应提供。
+
+## 路径与元数据
+
+下表标准入口位于门户 origin；后端路径是不带 `/svc/<key>` 的 App 内部路径。
+
+| 声明 | 标准入口 | 后端匿名 GET/HEAD 路径 |
+| --- | --- | --- |
+| `authorizationServer: true` | `/.well-known/oauth-authorization-server/svc/<key>` | `/.well-known/oauth-authorization-server` |
+| 资源 `/mcp` | `/.well-known/oauth-protected-resource/svc/<key>/mcp` | `/.well-known/oauth-protected-resource/mcp` |
+| 资源 `/` | `/.well-known/oauth-protected-resource/svc/<key>` | `/.well-known/oauth-protected-resource` |
+
+设门户 origin 为 `$PORTAL_ORIGIN`（无尾斜线），App key 为 `$LISTING_KEY`：issuer 应为
+`$PORTAL_ORIGIN/svc/$LISTING_KEY`；根资源的 resource 与之相同，`/mcp` 资源在其后加 `/mcp`。
+OAuth authorize/token/register 等端点继续使用 App 既有外部地址。原 `/svc/<key>/.well-known/…`
+嵌套地址继续可用；网关保留方法、query、Host、响应内容与状态，App 错误不会被修补为有效元数据。
+
+## 提交、审批与生效
+
+1. 使用 App 的发布令牌及目标配置；已有 `.xgent-registry.env` 时让 CLI 自行读取，不打印令牌。缺少配置时从目标门户「开发者应用 → 本 App → 凭证 → 生成配置文件」取得，确认含 LISTING_KEY、TARGET_XGENT_PLATFORM、XGENT_RELEASE_TOKEN，chmod 600 并加入 gitignore。按 [注册与一盒](registration-and-onebox.md) 准备完整清单，再提交：
+
+   ```bash
+   npx @xgent/release-cli publish --manifest app.manifest.json
+   ```
+
+   HTTP 发布也只能通过 `manifest` 字段携带完整清单，不能提交独立 `oauthDiscovery` 表单字段。
+2. 保存 `proposalId`。新增、修改和撤销均按实际差异进治理审核；等价重排/去重不制造差异。待审不改变已批准路由，由平台管理员核对并批准；发布令牌不能代替管理员审批。
+3. 用 release-cli ≥0.7.0 查询这一次提案：
+
+   ```bash
+   npx @xgent/release-cli status --proposal-id <proposalId> --wait
+   ```
+
+   `delivery.state=applied` 才表示本次后端与网关目标已确认。`pending` 等待，`failed` 按失败阶段交平台处理，`superseded` 追踪取代它的新提案；`unknown` 或缺少 delivery 均不能报生效。`publish --wait` 不等待人工审批；需要连审批一起等时用 `--wait-review`。
+4. 再做真实 HTTP 与客户端验收。发布成功、清单 applied、后端 ready 均不能代替此步骤。
+
+仅改发现声明不触发后端重部署；网关失败由平台管理员重试网关并核对本提案 revision，不用重发相同镜像。完整发布命令及凭据准备可使用 `xgent-app-release` skill；本参考的契约不要求访问门户源码。
+
+## 验收与排错
+
+从可信的目标配置取得 `PORTAL_ORIGIN`、`LISTING_KEY`，以下请求不携带登录 cookie 或 Bearer token。
+按实际声明替换资源路径；`/mcp` 示例：
+
+```bash
+curl -i "$PORTAL_ORIGIN/.well-known/oauth-authorization-server/svc/$LISTING_KEY"
+curl -I "$PORTAL_ORIGIN/.well-known/oauth-authorization-server/svc/$LISTING_KEY"
+curl -i "$PORTAL_ORIGIN/.well-known/oauth-protected-resource/svc/$LISTING_KEY/mcp"
+curl -I "$PORTAL_ORIGIN/.well-known/oauth-protected-resource/svc/$LISTING_KEY/mcp"
+curl -i "$PORTAL_ORIGIN/svc/$LISTING_KEY/.well-known/oauth-authorization-server"
+curl -i "$PORTAL_ORIGIN/svc/$LISTING_KEY/.well-known/oauth-protected-resource/mcp"
+```
+
+- 标准与原嵌套地址 GET 均为 200 JSON，字段相同；HEAD 同状态、JSON Content-Type、无正文。核对 issuer/resource 和既有 OAuth 端点，不只检查 HTTP 200。
+- 已声明标准入口的 POST/PUT/OPTIONS 为 405，含 `Allow: GET, HEAD`；未声明、撤销、额外尾段为 404。使用门户 origin，站点域名继续走自己的站点上下文。
+- 标准地址 404：先查实际获批声明、本次 delivery、服务是否已停止/下架；文件已保存或平台已升级不等于声明已批准。返回 Portal HTML：核对目标 v2 模板及实际加载版本。旧嵌套地址也失败、或返回非 JSON：检查 App 元数据端点。
+- MCP 原匿名请求应继续返回约定的 401 与 `WWW-Authenticate`。元数据 HTTP 通过后，还须用目标客户端走通授权页与回调；WorkBuddy / WorkBuddy AI 等不同回调由 App 负责，不能用网关或夹具检查冒称客户端验收。
+
+交付记录包含目标环境、版本、proposalId、delivery、标准/旧路径 HTTP 和客户端结果；不提供凭据或内部 upstream。
+
+## 替换、撤销与生命周期
+
+省略整个 `oauthDiscovery` 保留已批准值；`null` 或 `{}` 明确清空；对象整体替换，未列出的资源被撤销。
+递增版本、提交完整清单并批准，等待本次 delivery applied，再确认被撤销的标准 URL 为 404。
+撤销发现不删除 App 原元数据端点；移除后端配置时须同时撤销声明。恢复旧声明也须新版本和审批。
+
+声明属于全局 listing，单租户卸载不撤销它。停止服务、下架或删除 listing 会随新网关代撤销路由；
+恢复服务后可恢复获批声明。后端换址时发现与 `/svc` 使用同一运行上游，无需在 App 清单硬编码主机或端口。

package/skills/portal-external-app/references/public-entrypoints.md

@@ -9,11 +9,13 @@
 | 匿名 SPA、分享页面 | `/apps/<listingKey>/…` | 匿名页不先强制 SDK 登录；读取的数据仍需业务授权 |
 | 后端直接返回 HTML、公开回调 | `/svc/<listingKey>/…` | 平台去掉服务前缀；App 自己区分匿名与受保护路由，公开服务应常驻 |
 | 租户站点、独立域名 | `publicEntrypoints` + Sites 服务 | 入口声明、服务特权、平台站点配置、租户权益及路由就绪 |
+| MCP/OAuth 标准元数据发现 | `oauthDiscovery` → 门户 origin 的精确 `/.well-known/…/svc/<key>` | 已部署发现能力的 v2 网关、获批声明及匿名后端元数据；见 [OAuth 发现](oauth-discovery.md) |
 
 前两条已经是正式接入方式，不需要为了每个新 App 请求门户增加根级路径。
 `publicEntrypoints` 是**站点可以绑定的后端入口目录**，不是“在门户根路径新增一条代理”。
 仅声明它，不会让门户根级 `/v`、`/share` 等路径指向你的服务。
 历史根路径属于兼容契约，需要与平台约定数据迁移和切换，不可自行复用或覆盖。
+OAuth 发现只开放声明生成的精确 GET/HEAD 路径，不提供任意根路径代理，也不要求打开 `PUBLIC_SITES_ENABLED`。
 
 ## 2. 后端直出页必须认识外部路径
 

package/skills/portal-external-app/references/registration-and-onebox.md

@@ -14,6 +14,7 @@
     `privilegedServiceScopes` 里的，租户面**一条也勾不到**（见 integration-contract.md §3.1）。
     `scopeLabels` 同时是那个勾选列表的正文——不写就只显示裸 scope 串。
 - 关系：`dependencies`、`exchangeTargets`、`serviceBaseUrl`（`/svc/<listingKey>`）
+- OAuth 标准发现：`oauthDiscovery`（`authorizationServer` 与 `protectedResources`），非空声明要求后端；新增、修改及撤销经治理审批。路径映射、省略/null 语义与真实 HTTP 验收见 [OAuth 发现](oauth-discovery.md)。
 - 终端身份：`endUserRealms:{"mode":"fixed","siteKeys":["customers"]}` 或 `{"mode":"dynamic"}`，
   声明本 App 的身份空间范围；不创建托管 profile/client、不授额度，也不是成员的 publicClient。
   顾客/学生认证与生命周期按 [终端用户接入](end-users.md) 配置；endusers.* 等服务权限经特权审批申请。
@@ -47,6 +48,8 @@
 
 CLI / MCP / 个人自动化使用用户访问密钥时，还须声明独立的 `cliAccess`，不能把整份 `scopes` 当作用户密钥上限。新增、修改和撤回经过发布审批；绑定与发现按 [CLI 用户密钥契约](cli-user-keys.md)，无需在门户登记 App 专属权限分支。先确认目标门户已部署此能力。
 
+MCP 客户端通过 App 自有 OAuth 授权服务器发现元数据时，使用独立的 `oauthDiscovery`；它只声明标准发现路由，不配置用户密钥、OAuth 身份或客户端回调。不能用 `cliAccess`、`publicEntrypoints` 或 `publicClient` 代替。
+
 ⚠️ 规则 3 **读写不分**：背书的是整个命名空间，`files.write` 与 `files.read` 同一条待遇，
 没有「写要额外批一次」这回事。别人的 App 只声明了读，那是它自己的业务选择（它的写面不
 代表用户），不是平台对你的限制 —— 照抄别人的清单当规矩用，会把一个本来合法的功能砍掉。