dsh-fact-check 1.3.0

package/README.md

@@ -0,0 +1,191 @@
+# dsh-fact-check
+
+[![version](https://img.shields.io/github/v/tag/7starsseeker/dsh-fact-check?label=version)](https://github.com/7starsseeker/dsh-fact-check/tags)
+[![selftest](https://img.shields.io/github/actions/workflow/status/7starsseeker/dsh-fact-check/selftest.yml?label=selftest)](https://github.com/7starsseeker/dsh-fact-check/actions/workflows/selftest.yml)
+[![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
+[![node](https://img.shields.io/badge/node-%E2%89%A518-brightgreen.svg)](https://nodejs.org)
+[![DSH plugin](https://img.shields.io/badge/DeepSeek%20Harness-plugin-4B6BFB.svg)](https://github.com/deepseek-ai/deepseek-harness)
+[![dependencies: 0](https://img.shields.io/badge/dependencies-0-brightgreen.svg)](./package.json)
+[![last commit](https://img.shields.io/github/last-commit/7starsseeker/dsh-fact-check)](https://github.com/7starsseeker/dsh-fact-check/commits/main)
+[![stars](https://img.shields.io/github/stars/7starsseeker/dsh-fact-check?style=flat)](https://github.com/7starsseeker/dsh-fact-check/stargazers)
+[![issues](https://img.shields.io/github/issues/7starsseeker/dsh-fact-check)](https://github.com/7starsseeker/dsh-fact-check/issues)
+[![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](./CONTRIBUTING.md)
+
+> A fact-checking skill for DeepSeek Harness that verifies claims against the open web instead of model
+> memory — multi-source cross-checking, domestic and international search ecosystems in parallel,
+> adversarial re-search, and a conclusion-first report where every statement is traceable.
+
+**简体中文 → [README.zh-CN.md](./README.zh-CN.md)**
+
+---
+
+## Table of contents
+
+- [What it is](#what-it-is)
+- [Requirements](#requirements)
+- [Install](#install)
+- [How it works](#how-it-works)
+- [The optional Jev decision layer](#the-optional-jev-decision-layer)
+- [Verify it yourself](#verify-it-yourself)
+- [Project layout](#project-layout)
+- [Configuration](#configuration)
+- [Contributing](#contributing)
+- [License](#license)
+
+## What it is
+
+A fact-checking skill. Hand it a claim, a rumour, a figure, a news item or a "is this true?" and it
+returns a verification report. What separates it from asking a model directly is that it is built around
+five rules it is not allowed to skip:
+
+1. **No model memory.** Even if the model "knows" the answer, it must verify by searching the internet
+   first. If search is unavailable it reports *"cannot verify"* — it never substitutes recollection.
+2. **Multi-source cross-checking.** Every fact point needs 2–3 mutually *independent* sources. Multiple
+   outlets reprinting one original report count as **one** source, not three.
+3. **Domestic and international in parallel.** The same claim is searched from both ecosystems and both
+   sides are reported separately, because much information exists on only one side.
+4. **Adversarial re-search.** Once a conclusion forms, it searches reverse/debunking keywords on purpose.
+   High confidence is only granted when no counter-evidence is found.
+5. **Everything traceable.** Every assertion, number, date and quotation carries a full URL, the source
+   name, and the exact citation position.
+
+The output is a **conclusion-first** report with a numbered source appendix. Partially verified findings
+are kept in their own sections — *unverified* and *undecidable* never sit in the same paragraph as
+*confirmed* — so a guess cannot be quoted as if it were settled.
+
+## Requirements
+
+| | |
+|---|---|
+| **Required** | An agent that can search the public web **and fetch page bodies** (any one working fetch chain). Without search the skill reports "cannot verify" rather than guessing. |
+| **Recommended** | Batch/multi-engine search, an archive service (Wayback), a sub-agent mechanism for parallel evidence gathering. |
+| **Optional** | [Node.js](https://nodejs.org) **≥ 18** for the two bundled tools; a TypeSafe Jev key for the decision layer. |
+
+The skill body is not bound to any host, product or tool chain: it names *capabilities*, and
+[`ADAPTING.md`](./ADAPTING.md) maps them onto your environment.
+
+## Install
+
+### As a DSH plugin
+
+```sh
+dsh plugin add github:7starsseeker/dsh-fact-check
+```
+
+Then restart DSH: the `fact-check` skill appears in the session catalogue. The plugin itself is a thin
+adapter — `lib/index.js` registers the bundled `SKILL.md` on `ctx.skills`, re-reading it on every load,
+so editing the skill needs no code change. It has **zero runtime dependencies** (only `node:` builtins).
+Because the provider registers at the *bundled* rank, a skill you keep in `~/.dsh/skills/fact-check`
+(user rank) still wins on a name collision — installing this will not shadow your own local edits.
+
+<details>
+<summary>Install from a local checkout instead</summary>
+
+```sh
+git clone https://github.com/7starsseeker/dsh-fact-check.git
+dsh plugin add ./dsh-fact-check
+```
+
+</details>
+
+### Handing the folder to any agent
+
+Copy this directory (or a zip of it) to any AI tool and say *"do what `FOR-AI.md` says"*. It detects the
+environment offline, adapts itself, and needs no human configuration. Frameworks that load skills take
+`SKILL.md` directly (frontmatter included); frameworks that take plain instructions take the generated
+[`INSTRUCTIONS.md`](./INSTRUCTIONS.md).
+
+## How it works
+
+```
+decompose the claim  →  parallel search (domestic + international + vertical + debunking)
+      →  fetch primary pages  →  cross-compare and grade sources  →  adversarial re-search
+      →  conclusion-first report: confirmed / unverified / undecidable + numbered sources
+```
+
+Two optional offline tools sit alongside it:
+
+| Tool | What it does |
+|---|---|
+| `node tools/route.mjs plan --task "…"` | Deterministic planning: which source ladder and which channels this kind of claim needs, plus the failure-action table. A pure data table — no model, no tokens. |
+| `node tools/jev-verdict.mjs` | The judgement client described below. |
+
+## The optional Jev decision layer
+
+Three judgements are inherently about facts rather than about prose, and the skill can hand them to a
+**TypeSafe Jev (System One) decision model** instead of leaving them to unaided reasoning:
+
+| Judgement | Question type | When it is asked |
+|---|---|---|
+| Does this evidence support the claim? | yes/no + probability | when cross-comparing sources |
+| Is this source primary? | yes/no + probability | when grading each candidate source |
+| Does this page carry usable body text? | yes/no + probability | after fetching — login walls, captchas and JS shells must not count as evidence |
+
+Two things about it are deliberate:
+
+- **It is optional.** With no key configured, the same three judgements are made by the deterministic
+  rules written in `SKILL.md`; nothing else changes. A key can come from `tools/local.json`, from the
+  `TYPESAFE_API_KEY` environment variable, or from `tools/jev-verdict.mjs --key-file`.
+- **A model verdict can only lower a grade, never raise it.** The conclusion tier is decided by the
+  deterministic rule *number of independent sources → tier*; a model saying "the evidence supports this"
+  promotes nothing. Only "insufficient evidence" or "contradicts the evidence" triggers an action.
+
+Measured reliability per judgement, the prompt-injection defences applied before anything reaches the
+model, and the commands to reproduce the numbers are in [`MEASUREMENTS.md`](./MEASUREMENTS.md) —
+including one judgement that is deliberately **never asked**, because its single-question accuracy
+measured 62.5%.
+
+## Verify it yourself
+
+Every command below runs offline, needs no key, and takes seconds:
+
+```sh
+node tools/smoke-plugin.mjs                          # is the plugin mounted, and does it serve SKILL.md?
+node tools/route.mjs selftest                        # deterministic routing tables
+node tools/route.mjs regress --file cases/route-cases-neutral.json
+node tools/route.mjs arms                            # dispatch-arm proxy metric (MEASUREMENTS §4.1)
+node tools/jev-verdict.mjs selftest                  # judgement layer regression assertions
+node tools/doctor.mjs                                # what this machine can and cannot do
+```
+
+`node tools/doctor.mjs --net` additionally self-tests the fetch chains and the judgement endpoint, and
+reports which capabilities are missing and how the skill degrades without them. Current status on this
+checkout: **27/27**, **25/25**, **37/37** and **26/26** assertions pass.
+
+CI runs exactly these commands on Linux and Windows, on Node 18 and 22, plus one more check: that the
+generated `INSTRUCTIONS.md` still matches `SKILL.md`.
+
+## Project layout
+
+| Path | What it is |
+|---|---|
+| [`SKILL.md`](./SKILL.md) | the skill itself — flow and rules (the single source of truth) |
+| [`INSTRUCTIONS.md`](./INSTRUCTIONS.md) | generated from `SKILL.md` for hosts that take plain instructions |
+| [`FOR-AI.md`](./FOR-AI.md) | the task brief for an AI that is handed this package |
+| [`ADAPTING.md`](./ADAPTING.md) | what to change when moving to another environment |
+| [`MEASUREMENTS.md`](./MEASUREMENTS.md) | measured numbers and how to reproduce them |
+| [`CHANGELOG.md`](./CHANGELOG.md) | net change between versions |
+| [`RELEASING.md`](./RELEASING.md) | how a release reaches npm (OIDC, no long-lived token) |
+| [`lib/index.js`](./lib/index.js) | DSH plugin entry: exposes `SKILL.md` on `ctx.skills` |
+| [`cordis.patch.yml`](./cordis.patch.yml) | bundle patch that makes the package installable via `dsh plugin add` |
+| [`tools/`](./tools) | two zero-dependency Node scripts, the machine-local config template, and the data tables |
+| [`cases/`](./cases) | de-identified regression corpora |
+| `submission/` | the entry file for the plugin-market listing (not part of the package) |
+
+## Configuration
+
+Machine-specific values — endpoints, keys, which channels actually work on your machine — live in
+`tools/local.json`, which is git-ignored and shipped only as [`tools/local.example.json`](./tools/local.example.json).
+No host path, endpoint or key is hard-coded in the code or the data tables, and `tools/*.mjs` carry
+assertions that fail if one ever appears.
+
+## Contributing
+
+Issues and pull requests are welcome — see [`CONTRIBUTING.md`](./CONTRIBUTING.md). Two rules are
+load-bearing: the skill body is the single source of truth (never hand-edit a generated file such as
+`INSTRUCTIONS.md`), and any change to the judgement layer or the routing tables must be accompanied by
+re-run regressions and updated numbers in `MEASUREMENTS.md`.
+
+## License
+
+[MIT](./LICENSE)

package/README.zh-CN.md

@@ -0,0 +1,176 @@
+# dsh-fact-check
+
+[![version](https://img.shields.io/github/v/tag/7starsseeker/dsh-fact-check?label=version)](https://github.com/7starsseeker/dsh-fact-check/tags)
+[![selftest](https://img.shields.io/github/actions/workflow/status/7starsseeker/dsh-fact-check/selftest.yml?label=selftest)](https://github.com/7starsseeker/dsh-fact-check/actions/workflows/selftest.yml)
+[![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
+[![node](https://img.shields.io/badge/node-%E2%89%A518-brightgreen.svg)](https://nodejs.org)
+[![DSH plugin](https://img.shields.io/badge/DeepSeek%20Harness-plugin-4B6BFB.svg)](https://github.com/deepseek-ai/deepseek-harness)
+[![dependencies: 0](https://img.shields.io/badge/dependencies-0-brightgreen.svg)](./package.json)
+[![last commit](https://img.shields.io/github/last-commit/7starsseeker/dsh-fact-check)](https://github.com/7starsseeker/dsh-fact-check/commits/main)
+[![stars](https://img.shields.io/github/stars/7starsseeker/dsh-fact-check?style=flat)](https://github.com/7starsseeker/dsh-fact-check/stargazers)
+[![issues](https://img.shields.io/github/issues/7starsseeker/dsh-fact-check)](https://github.com/7starsseeker/dsh-fact-check/issues)
+[![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](./CONTRIBUTING.md)
+
+> DeepSeek Harness 用的事实核查技能：不轻信模型自己的记忆，一律去公开互联网核实——多源交叉、
+> 国内外信息生态并行、对抗性反查，最后交出一份结论先行、每条论断都可溯源的核查报告。
+
+**English → [README.md](./README.md)**
+
+---
+
+## 目录
+
+- [它是什么](#它是什么)
+- [运行前提](#运行前提)
+- [安装](#安装)
+- [工作方式](#工作方式)
+- [可选的 Jev 判据层](#可选的-jev-判据层)
+- [自己验一遍](#自己验一遍)
+- [目录结构](#目录结构)
+- [配置](#配置)
+- [参与贡献](#参与贡献)
+- [许可](#许可)
+
+## 它是什么
+
+一个事实核查技能。给它一条传闻、一个数字、一则新闻或一句「这是不是真的」，它交回一份核查报告。
+它与「直接问模型」的区别在于五条**不允许跳过**的铁律：
+
+1. **知识库禁用**：即便模型「认为」自己知道答案，也必须先用搜索工具从互联网核实。搜索不可用时
+   如实报告「无法核实」，绝不用记忆顶替。
+2. **多源交叉**：每个事实点至少要有 2~3 个**相互独立**的来源。多家媒体转载同一篇原始报道**只算一个**
+   来源，不是三个。
+3. **国内外并行**：同一核查对象同时从国内、国外两套信息生态取证并分别呈现——很多信息只在某一侧出现。
+4. **对抗性核查**：结论初步成型后，主动用反向／质疑关键词再搜一轮。找不到反证才给高置信度。
+5. **全部可溯源**：每一个论断、数字、日期、引述都带完整 URL + 出处名称 + 具体引用位置。
+
+输出是**结论先行**的报告，来源进编号附录；部分核实的内容被**物理分档**——「未证实」「无法裁定」
+不会和「已证实」排在同一段里，所以一条没查清的东西没法被当成已定论引用。
+
+## 运行前提
+
+| | |
+|---|---|
+| **必需** | 一个能搜索公开互联网**并且能抓取页面正文**的 agent（抓取链任意一条可用即可）。没有搜索能力时，技能会报「无法核实」而不是猜。 |
+| **推荐** | 批量／多引擎搜索、存档服务（Wayback）、用于并行取证的子代理机制。 |
+| **可选** | [Node.js](https://nodejs.org) **≥ 18**（两个自带工具需要）；TypeSafe Jev 密钥（判据层需要）。 |
+
+技能正文不绑定任何产品、主机或工具链：它只写**能力名**，由 [`ADAPTING.md`](./ADAPTING.md) 把能力
+落到你的环境里。
+
+## 安装
+
+### 作为 DSH 插件
+
+```sh
+dsh plugin add github:7starsseeker/dsh-fact-check
+```
+
+重启 DSH 后 `fact-check` 技能即出现在会话技能目录里。插件本体是一层很薄的接线——`lib/index.js`
+把包自带的 `SKILL.md` 注册到 `ctx.skills`，每次加载都现读，所以改技能不需要改代码。它是
+**零运行时依赖**（只用 `node:` 内置模块）。因为本 provider 注册在*随包*档位，你自己放在
+`~/.dsh/skills/fact-check` 的那一份（用户档位）在同名冲突时仍然优先——装这个插件不会覆盖你的本地修改。
+
+<details>
+<summary>改用本地目录安装</summary>
+
+```sh
+git clone https://github.com/7starsseeker/dsh-fact-check.git
+dsh plugin add ./dsh-fact-check
+```
+
+</details>
+
+### 把整个文件夹交给任何 AI 工具
+
+把本目录（或它的 zip）交给你的 AI 工具，说一句「照 `FOR-AI.md` 做」即可——它会自己离线探测环境、
+自己适配，不需要人做配置。吃 skill 的框架直接给 `SKILL.md`（带 frontmatter）；吃纯指令的框架用生成的
+[`INSTRUCTIONS.md`](./INSTRUCTIONS.md)。
+
+## 工作方式
+
+```
+拆解核查项  →  并行搜索（国内 + 国外 + 垂直域 + 质疑词）
+      →  抓取一手页面  →  交叉比对与来源分级  →  对抗性反查
+      →  结论先行的报告：已证实 / 未证实 / 无法裁定 + 编号来源
+```
+
+另外附带两个可选的离线工具：
+
+| 工具 | 做什么 |
+|---|---|
+| `node tools/route.mjs plan --task "…"` | 确定性规划：这类核查该走哪条来源阶梯、哪些渠道，以及失败动作表。纯数据表，无模型、0 token。 |
+| `node tools/jev-verdict.mjs` | 下面说的判据客户端。 |
+
+## 可选的 Jev 判据层
+
+有三类判断天生是**事实判断**而非文风问题，本技能可以把它们交给 **TypeSafe Jev（System One）决策模型**，
+而不是留给「裸推理」：
+
+| 判断 | 问题类型 | 什么时候问 |
+|---|---|---|
+| 这批证据是否支持该论断 | 是/否 + 概率 | 交叉比对来源时 |
+| 该来源是否一手 | 是/否 + 概率 | 给候选来源分级时 |
+| 这个页面是否可用正文 | 是/否 + 概率 | 抓取之后——登录墙、验证码、JS 空壳不得计入证据 |
+
+两件事是刻意的：
+
+- **它是可选的。** 没配密钥时，这三件事由 `SKILL.md` 里写死的确定性规则执行，其余流程完全不变。
+  密钥可以来自 `tools/local.json`、环境变量 `TYPESAFE_API_KEY`，或 `tools/jev-verdict.mjs --key-file`。
+- **模型的判断只能降档，不能升档。** 结论档位由确定性规则「独立来源数 → 档位」裁定；模型说「支持」
+  不会让任何东西升级。只有「证据不足」或「与证据矛盾」才触发动作。
+
+每条判据的实测可靠性、喂给模型前的提示注入防御、以及复跑命令都在
+[`MEASUREMENTS.md`](./MEASUREMENTS.md)——包括一条**刻意不问**的判据，它的单题准确率实测只有 62.5%。
+
+## 自己验一遍
+
+下面每条都离线、不需要密钥、几秒跑完：
+
+```sh
+node tools/smoke-plugin.mjs                          # 插件挂载是否正确、是否真的在提供 SKILL.md
+node tools/route.mjs selftest                        # 确定性路由表
+node tools/route.mjs regress --file cases/route-cases-neutral.json
+node tools/route.mjs arms                            # 派发臂代理指标（见 MEASUREMENTS §4.1）
+node tools/jev-verdict.mjs selftest                  # 判据层回归断言
+node tools/doctor.mjs                                # 这台机器能做什么、缺什么
+```
+
+`node tools/doctor.mjs --net` 会额外自测抓取链与判据端点，并报告缺哪些能力、缺了会降级成什么样。
+本检出上的当前状态：**27/27**、**25/25**、**37/37**、**26/26** 断言全过。
+
+CI 在 Linux 与 Windows 上、Node 18 与 22 下跑的就是上面这几条，另外多一条检查：生成的
+`INSTRUCTIONS.md` 是否仍然与 `SKILL.md` 一致。
+
+## 目录结构
+
+| 路径 | 是什么 |
+|---|---|
+| [`SKILL.md`](./SKILL.md) | 技能本体——流程与规则（唯一真相源） |
+| [`INSTRUCTIONS.md`](./INSTRUCTIONS.md) | 由 `SKILL.md` 生成，给吃纯指令的宿主 |
+| [`FOR-AI.md`](./FOR-AI.md) | 拿到本包的那个 AI 的任务书 |
+| [`ADAPTING.md`](./ADAPTING.md) | 换环境要改什么 |
+| [`MEASUREMENTS.md`](./MEASUREMENTS.md) | 实测数字与复跑方法 |
+| [`CHANGELOG.md`](./CHANGELOG.md) | 版本间净变化 |
+| [`RELEASING.md`](./RELEASING.md) | 一次发布怎么发到 npm（OIDC，无长期 token） |
+| [`lib/index.js`](./lib/index.js) | DSH 插件入口：把 `SKILL.md` 挂到 `ctx.skills` |
+| [`cordis.patch.yml`](./cordis.patch.yml) | bundle patch，让本包能被 `dsh plugin add` 安装 |
+| [`tools/`](./tools) | 两个零依赖 Node 脚本、本机配置模板与数据表 |
+| [`cases/`](./cases) | 去痕后的回归语料 |
+| `submission/` | 投稿到插件市场的条目文件（不属于插件包本身） |
+
+## 配置
+
+主机相关的值——端点、密钥、你那台机器上哪些渠道真的能用——一律放 `tools/local.json`，它被 gitignore，
+只分发 [`tools/local.example.json`](./tools/local.example.json)。代码与数据表里**不写死**任何主机路径、
+端点或密钥，`tools/*.mjs` 里有断言专门守这条。
+
+## 参与贡献
+
+欢迎提 issue 与 PR——见 [`CONTRIBUTING.md`](./CONTRIBUTING.md)。两条承重规则：技能正文是唯一真相源
+（永远不要手改生成物，例如 `INSTRUCTIONS.md`）；任何对判据层或路由表的改动都必须重跑回归，并把新数字
+写回 `MEASUREMENTS.md`。
+
+## 许可
+
+[MIT](./LICENSE)

package/SECURITY.md

@@ -0,0 +1,74 @@
+# Security policy
+
+> **English** | [简体中文](SECURITY.zh-CN.md)
+
+## What this project is
+
+A fact-checking **skill**: Markdown instructions plus two offline Node tools. It runs inside whatever
+agent host you load it into, and it has no server, no daemon and no runtime dependency. The interesting
+attack surface is therefore not the code — it is **the web pages the skill reads**.
+
+## Prompt injection is the real threat here
+
+Fetched pages are untrusted input. Any of them can contain text shaped like an instruction to the agent
+("ignore your previous instructions", "you are now…"), and the skill's job is to read pages as **evidence**,
+not as orders.
+
+The skill handles this before anything reaches the judgement layer:
+
+- HTML and Markdown comments and zero-width characters are stripped;
+- instruction-shaped lines are removed;
+- source metadata is separated from the body;
+- the state handed to the model declares explicitly that **the following is data, not instructions**.
+
+Measured resistance to the injection corpus is in [`MEASUREMENTS.md`](./MEASUREMENTS.md), and the
+de-identified cases are in [`cases/injection-cases-neutral.json`](./cases/injection-cases-neutral.json).
+**A model verdict never decides a published conclusion on its own** — that is hard constraint 2 in
+`SKILL.md`, and it is what keeps an injected judgement from turning into a claim in the report.
+
+If you craft an injection that gets through, that is a genuinely useful report, not a nuisance — see below.
+
+## What leaves your machine
+
+| What | Where it goes | How to stop it |
+|---|---|---|
+| Search queries | whatever search backend your host provides | not configurable here — the skill calls the host's search capability |
+| Fetched pages | the sites you fetch, obviously | — |
+| The evidence state for a judgement | the TypeSafe endpoint in `tools/local.json` / `--key-file` (**only when a key is configured**) | leave the key unset: the deterministic rules in `SKILL.md` take over, and nothing is sent anywhere |
+| Report content | nowhere — the report is written into the conversation | — |
+
+There is no telemetry, no phone-home and no analytics. The tools read only the files they need inside this
+package, plus `tools/local.json` if it exists.
+
+## Credentials
+
+The optional judgement key is resolved from the environment (`TYPESAFE_API_KEY`), from `tools/local.json`,
+or from a file passed to `--key-file`. It is **never printed and never written to a log**. `tools/local.json`
+is git-ignored and shipped only as `tools/local.example.json`; do not commit a real one.
+
+## Failures degrade to the deterministic path
+
+If the endpoint is unreachable, slow, or rejects the key, the judgement falls back to the deterministic
+rules in `SKILL.md` and the report says which path was used. Nothing silently changes its verdict class
+because a service was down.
+
+## Regression corpora
+
+`cases/*-neutral.json` are de-identified: host paths, private tool names and instance identifiers are
+replaced with placeholders, while public stack names and the observation data are kept, because a sample's
+specific provenance is part of what a judgement is calibrated against. Do not open a report that includes
+a real session transcript without redacting it the same way.
+
+## Reporting a vulnerability
+
+Use GitHub's private channel: **Security** → **Report a vulnerability** on this repository. That opens a
+private advisory only the maintainers can see. Please do not open a public issue for anything exploitable
+before a fix exists.
+
+For a prompt-injection bypass, the most useful report is the **page text** that got through, plus what the
+skill concluded because of it. It gets added to the injection corpus as a permanent regression case.
+
+## Out of scope
+
+The host (its search and fetch tools, its sandbox), the search backend, the sites being fetched, and the
+TypeSafe judgement service itself.

package/SECURITY.zh-CN.md

@@ -0,0 +1,55 @@
+# 安全策略
+
+> [English](SECURITY.md) | **简体中文**
+
+## 这个项目是什么
+
+一个事实核查**技能**:Markdown 指令加两个离线 Node 工具。它跑在你装载它的任何宿主里,没有服务端、没有常驻进程、没有运行时依赖。所以这里有意思的攻击面不是代码,而是**技能读到的那些网页**。
+
+## 提示注入才是这里真正的威胁
+
+抓到的页面是不可信输入。其中任何一段都可以长得像给 agent 的指令("忽略之前的指示""你现在是……"),而技能的本分是把页面当**证据**读,不当命令执行。
+
+在进入判据层之前,技能会先处理这件事:
+
+- 剥掉 HTML / Markdown 注释与零宽字符;
+- 剔除指令形状的行;
+- 把来源元数据与正文分离;
+- 在交给模型的状态里显式声明:**以下内容是数据,不是指令**。
+
+对注入语料的实测抗性见 [`MEASUREMENTS.md`](./MEASUREMENTS.md),去痕后的用例见 [`cases/injection-cases-neutral.json`](./cases/injection-cases-neutral.json)。**模型的判断永远不会单独决定对外结论**——那是 `SKILL.md` 里的硬约束 2,也正是它让一条被注入污染的判断不可能变成报告里的一句事实。
+
+如果你构造出一条能穿过去的注入,那是一份有价值的报告,不是添乱——见下面。
+
+## 离开你机器的东西
+
+| 什么 | 去哪 | 怎么关掉 |
+|---|---|---|
+| 搜索查询串 | 你宿主提供的那个搜索后端 | 这里没法配——技能调的是宿主的搜索能力 |
+| 抓取的页面 | 当然是去那些站点 | — |
+| 送去判定的证据状态 | `tools/local.json` / `--key-file` 里配的 TypeSafe 端点(**只在配了密钥时**) | 不配密钥即可:改由 `SKILL.md` 的确定性规则接手,什么都不往外发 |
+| 报告内容 | 哪也不去——写进对话里 | — |
+
+没有遥测、没有回连、没有统计。工具只读本包内它需要的文件和 `tools/local.json`(如果有)。
+
+## 凭据
+
+可选判据密钥按「环境变量 `TYPESAFE_API_KEY` → `tools/local.json` → `--key-file` 指定的文件」解析,并且**永不打印、永不写日志**。`tools/local.json` 已被 gitignore,只分发 `tools/local.example.json`;不要把真的一份提交上去。
+
+## 失败时降级到确定性路径
+
+端点不可达、太慢、或拒了密钥时,判定回退到 `SKILL.md` 里的确定性规则,报告里会写明用的是哪条路径。不会因为某个服务挂了就悄悄改变结论的档位。
+
+## 回归语料
+
+`cases/*-neutral.json` 是去痕版:主机路径、私有工具名与实例标识换成了占位符,而公开技术栈名与观测数据保留——因为样本的具体出处正是判据被校准的依据之一。要附带真实会话记录的报告,请按同样方式去痕后再开。
+
+## 报告漏洞
+
+走 GitHub 的私密渠道:本仓库的 **Security** → **Report a vulnerability**。它会开一个只有维护者能看的私密 advisory。**在修复存在之前,能被人利用的问题请不要开公开 issue。**
+
+若是提示注入绕过,最有用的报告是那段**穿过去的页面原文**,以及它让技能得出了什么结论。它会作为永久回归用例进注入语料。
+
+## 不在范围内
+
+宿主(它的搜索与抓取工具、它的沙箱)、搜索后端、被抓取的那些站点,以及 TypeSafe 判定服务本身。