oh-my-knowledge 0.34.0 → 0.36.0

package/dist/managed/store.js

@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, normalize } from 'node:path';
@@ -26,87 +25,22 @@ export function recordPath(dir, id) {
 export function managedRecordId(kind, name) {
     return hashString(`${kind}|${name}`);
 }
-/**
- * 不进 artifact「可分发树」的条目 —— omk 的评测 / 迭代 / VCS / 系统产物,既不该被拷进 agent
- * skill 目录,也不该计入 artifact contentHash。区分两类语义,避免误伤合法嵌套资产:
- *   - **任意层级排除**:隐藏元数据 / VCS / 系统 / 依赖目录,任何深度出现都是噪声
- *     (`.omk` = samples / managed / observations;`.git`;`node_modules`;OS 垃圾);
- *   - **仅源根第一层排除**:omk 保留的工作目录,只在 skill 根有保留语义,嵌套同名是用户合法资产
- *     (`evolve` 是 `<skillDir>/evolve/` 候选快照;但 `references/evolve/guide.md` 应正常分发并计入 hash)。
- * spec 里 artifact content hash 与 sample-set hash 是分开的证据轴,故只补样本(.omk)不该改 hash。
- */
-const GLOBAL_EXCLUDED_NAMES = new Set(['.omk', '.git', 'node_modules', '.DS_Store', 'Thumbs.db']);
-const ROOT_ONLY_EXCLUDED_NAMES = new Set(['evolve']);
-/**
- * 给定相对源根的路径分段(空数组 = 源根本身),判断是否进可分发树。hash 的 walk、copy 的 filter、
- * git 物化共用此一处,保证三者完全一致。
- *
- * 关键:检查**每一段**而非只看叶子。本地 walk / cpSync 是逐层下降、命中目录即剪枝,只看叶子也够;
- * 但 git ls-tree 给的是**扁平路径**(如 `.omk/samples.json`),只看叶子 `samples.json` 会让 `.omk`
- * 内容漏过。故:任一段命中全局排除即排除;首段命中 root-only(evolve)即排除(嵌套同名是合法资产)。
- */
-export function isDistributablePath(segments) {
-    if (segments.length === 0)
-        return true; // 源根永远算
-    for (const seg of segments) {
-        if (GLOBAL_EXCLUDED_NAMES.has(seg))
-            return false;
-    }
-    if (ROOT_ONLY_EXCLUDED_NAMES.has(segments[0]))
-        return false;
-    return true;
-}
-/**
- * artifact 内容 hash —— drift baseline 与 evidence 绑定的依据。
- *   - 文件-skill:单个 .md 的字节;
- *   - 目录-skill:覆盖**整棵可分发目录树**(SKILL.md + references/ 等资产,但排除 .omk / .git /
- *     evolve 等评测迭代产物),按相对路径排序后把每个文件的`路径 + 字节长度 + 内容`喂进同一个
- *     sha256 —— 改任意资产都会令 hash 变化、drift 不漏;只补样本则 hash 不动。
- * 用 createHash 直接喂 Buffer(字节级,二进制资产也稳;分隔符是运行时字节,源码里不引入任何不可见字符)。
- * 读时(未来 list / drift 检查)用同一函数重算比对。
- */
-export function hashArtifactSource(source, isDirectorySkill) {
-    if (!isDirectorySkill) {
-        return createHash('sha256').update(readFileSync(source)).digest('hex').slice(0, 12);
-    }
-    const rels = [];
-    const walk = (dir, segments) => {
-        for (const entry of readdirSync(dir, { withFileTypes: true })) {
-            const segs = [...segments, entry.name];
-            if (!isDistributablePath(segs))
-                continue;
-            // 软链既非 isFile 也非 isDirectory,天然跳过 —— 与 copyArtifactToTarget 的 filter 一致
-            // (hash 覆盖的 == 分发出去的),避免软链目标改变却不触发 drift,也回避软链环。
-            if (entry.isDirectory())
-                walk(join(dir, entry.name), segs);
-            else if (entry.isFile())
-                rels.push(segs.join('/'));
-        }
-    };
-    walk(source, []);
-    rels.sort();
-    const h = createHash('sha256');
-    const sep = Buffer.from([0]);
-    for (const rel of rels) {
-        const content = readFileSync(join(source, rel));
-        // 路径与内容都做长度前缀,彻底排除"不同树拼出同一串"的歧义(文件名虽不含 NUL,核心层仍按可注入防)。
-        h.update(String(Buffer.byteLength(rel)));
-        h.update(sep);
-        h.update(rel);
-        h.update(sep);
-        h.update(String(content.length));
-        h.update(sep);
-        h.update(content);
-        h.update(sep);
-    }
-    return h.digest('hex').slice(0, 12);
-}
+// 内容指纹工具已下沉到 inputs 层(install 与 eval 共用同一处,保证指纹同空间);此处 re-export
+// 保持 managed 公共入口不破(install 仍从 managed 取 hashArtifactSource / isDistributablePath)。
+export { hashArtifactSource, isDistributablePath, distributableCopyFilter } from '../inputs/content-hash.js';
 function isStringField(v) {
     return typeof v === 'string';
 }
-// 校验到元素级:记录文件是用户可手改的(透明性是设计价值),`evidence:[null]` / 缺字段的 distribution
-// 都是现实的坏手改;若只查 Array.isArray,坏元素会在 deriveManagedState / mergeManagedRecord 里
-// 解引用崩溃(且在 load 的 try/catch 之外)。这里直接判脏 → load 丢弃该文件,消费方永远拿不到半成品。
+/** 仅当字段缺省或是 string 才放行(可选 string 字段的脏值守卫,如 source.url / evidence.verdict)。 */
+function isOptionalString(v) {
+    return v === undefined || typeof v === 'string';
+}
+// 受管记录可安装的 kind(managed 记录绝不是 baseline)。
+const MANAGED_KINDS = new Set(['skill', 'prompt', 'agent', 'workflow']);
+// 校验到**运行时实际收窄**的边界,不止「字段是 string」:记录文件是用户可手改、且可能随仓库分发(被
+// loadAllManagedRecords 无 opt-in 读到)的不可信输入。若只查 string,畸形记录(如 source.url 是对象、
+// sourceKind 是任意串)会绕过 validator,在下游(omk list 的 sourceLabel ?? → dispWidth(对象) 等)
+// 抛 TypeError 让命令崩溃。这里把 source / evidence 收窄到 list 等消费方实际解引用的类型,判脏即丢弃该文件。
 function isManagedArtifactRecord(value) {
     if (!value || typeof value !== 'object')
         return false;
@@ -115,19 +49,49 @@ function isManagedArtifactRecord(value) {
         && r.schemaVersion === 2
         && isStringField(r.id)
         && isStringField(r.name)
-        && isStringField(r.kind)
+        && isStringField(r.kind) && MANAGED_KINDS.has(r.kind)
         && isStringField(r.contentHash)
         && r.source && typeof r.source === 'object'
-        && isStringField(r.source.locator)
-        && isStringField(r.source.sourceKind)
         && Array.isArray(r.distribution)
         && Array.isArray(r.evidence)
         && Array.isArray(r.decisions)))
         return false;
+    const src = r.source;
+    if (!(isStringField(src.locator)
+        && (src.sourceKind === 'file' || src.sourceKind === 'git')
+        && typeof src.isDirectorySkill === 'boolean'
+        && isOptionalString(src.url)
+        && isOptionalString(src.ref)))
+        return false;
+    // url / ref 是 git-only 字段。file 源带 url 时,list 的 sourceLabel 会显示假 url、掩盖真实被 probe /
+    // 读取的 locator(畸形但可通过上面 string 校验)→ 「读了什么」与「显示什么」不一致。判脏丢弃。
+    if (src.sourceKind === 'file' && (src.url !== undefined || src.ref !== undefined))
+        return false;
     const okDist = r.distribution.every((d) => d && typeof d === 'object'
         && isStringField(d.path) && isStringField(d.contentHash));
-    const okEv = r.evidence.every((e) => e && typeof e === 'object'
-        && isStringField(e.reportId) && isStringField(e.contentHash));
+    const okEv = r.evidence.every((e) => {
+        if (!e || typeof e !== 'object')
+            return false;
+        const ev = e;
+        if (!(isStringField(ev.reportId) && isStringField(ev.contentHash) && isStringField(ev.recordedAt)))
+            return false;
+        if (!isOptionalString(ev.verdict))
+            return false;
+        // comparability 若存在:必须是带 string cliVersion 的对象(list / promote 会读它)。可选 marker
+        // judgePromptHash / debiasMode 同样收窄到声明类型 —— 否则任意类型脏值会穿过 validator 原样进 `omk list
+        // --json`(及未来 promote gate)消费方。
+        if (ev.comparability !== undefined) {
+            const c = ev.comparability;
+            if (!c || typeof c !== 'object' || !isStringField(c.cliVersion))
+                return false;
+            if (!isOptionalString(c.judgePromptHash))
+                return false;
+            if (c.debiasMode !== undefined
+                && !(Array.isArray(c.debiasMode) && c.debiasMode.every((m) => m === 'length' || m === 'position')))
+                return false;
+        }
+        return true;
+    });
     const okDec = r.decisions.every((d) => d && typeof d === 'object'
         && isStringField(d.decisionKind));
     return okDist && okEv && okDec;
@@ -175,6 +139,19 @@ export function loadAllManagedRecords(dir = managedDir()) {
     }
     return local;
 }
+/**
+ * 哪个 managed 目录是权威(有记录的那个):项目目录非空取项目,否则全局非空取全局,都空回项目。
+ * 与 `loadAllManagedRecords` 的 project→global 回退**同口径** —— 写方(append evidence)据此写回
+ * 读方实际取记录的同一目录,避免"读全局、写项目"把证据落到空目录。
+ */
+export function resolveManagedDir(dir = managedDir()) {
+    if (readRecordsFromDir(dir).length > 0)
+        return dir;
+    const global = globalManagedDir();
+    if (dir !== global && readRecordsFromDir(global).length > 0)
+        return global;
+    return dir;
+}
 /**
  * 纯合并逻辑(无 IO):install 写的是事实,绝不动 evidence/decisions(那是 eval/promote 的地盘)。
  *   - distribution 按 path 去重(同路径以新值替换);
@@ -217,6 +194,30 @@ export function upsertManagedRecord(dir, record) {
     renameSync(tmp, path);
     return merged;
 }
+/**
+ * 追加一条评测证据(append-only)。与 install 的 upsert 路径相反——`mergeManagedRecord` 刻意**保留旧
+ * evidence、丢弃 next.evidence**(install 只写事实),所以证据写入不能走 upsert,必须独立 load→push→
+ * 原子重写。按 `(reportId, contentHash)` 去重:重跑同一份 eval 不堆重复条目(reportId 含运行身份,
+ * 同内容重测会是新 reportId → 新条目,正是要的版本史)。记录不存在(未 install / 名字不匹配)返回
+ * null —— 这是"管理是 install 显式 opt-in"的体现:eval 绝不为未纳管的 skill 凭空建记录。
+ */
+export function appendManagedEvidence(dir, recordId, evidence) {
+    const prev = loadManagedRecord(dir, recordId);
+    if (!prev)
+        return null;
+    const dup = prev.evidence.some((e) => e.reportId === evidence.reportId && e.contentHash === evidence.contentHash);
+    const merged = dup
+        ? prev
+        : { ...prev, evidence: [...prev.evidence, evidence] };
+    if (!dup) {
+        mkdirSync(dir, { recursive: true });
+        const path = recordPath(dir, recordId);
+        const tmp = `${path}.tmp.${process.pid}.${Date.now()}`;
+        writeFileSync(tmp, JSON.stringify(merged, null, 2));
+        renameSync(tmp, path);
+    }
+    return merged;
+}
 /**
  * 统一的记录构造点——所有消费方(CLI / 未来 server / SDK)经此组装,保证 schema 一致。
  * 只接收事实(身份、源、hash、分发落点);evidence/decisions 恒为空(eval/promote 的地盘)。

package/dist/observability/experience.d.ts

@@ -4,6 +4,7 @@ import type { SkillSegment } from './trace-segmenter.js';
 export { findNegativeFeedbackMatches, findPositiveFeedbackMatches, findUserCorrectionMatches, findUserGoalShiftMatches, hasNegativeFeedbackSignal, hasPositiveFeedbackSignal, hasUserCorrectionSignal, hasUserGoalShiftSignal, } from './feedback-matchers.js';
 export type { TextMatchRange } from './feedback-matchers.js';
 export type { ExperienceAssistiveInference, ExperienceAssistiveInferenceCautionCode, ExperienceAssistiveInferenceCode, ExperienceAssistiveInferenceConfidence, ExperienceChecklistContribution, ExperienceChecklistItem, ExperienceChecklistItemStatus, ExperienceEpisode, ExperienceEpisodeArtifact, ExperienceEpisodeArtifactKind, ExperienceEpisodeBoundaryReason, ExperienceEpisodeOutcome, ExperienceEpisodeRole, ExperienceEvidenceChain, ExperienceEvidenceKind, ExperienceEvidenceRef, ExperienceFeedbackAttribution, ExperienceFeedbackAttributionReason, ExperienceFeedbackAttributionRole, ExperienceFeedbackSignal, ExperienceFeedbackSignalType, ExperienceGoalEvidenceRef, ExperienceGoalSlice, ExperienceGoalSliceReasonCode, ExperienceInvocation, ExperienceMessageRange, ExperienceOrchestrationEdge, ExperienceOrchestrationEdgeKind, ExperienceOrchestrationEdgeStatus, ExperienceOutcomeClosure, ExperienceParentReason, ExperienceReviewBasisCode, ExperienceReviewIndicators, ExperienceReviewPriority, ExperienceReviewerReport, ExperienceReviewerReportFinding, ExperienceReviewerReportFindingLevel, ExperienceReviewerReportFindingSource, ExperienceReviewerReportScope, ExperienceReviewerReportStep, ExperienceReviewerReportStepStatus, ExperienceRuleFinding, ExperienceRuleFindingCode, ExperienceRuleFindingLevel, ExperienceRuntimeSkillType, ExperienceRuntimeSkillTypeSource, ExperienceSessionStory, ExperienceSessionStoryAnswer, ExperienceSessionStoryAnswerKey, ExperienceSessionStoryGoalSlice, ExperienceSessionStoryGraphEdge, ExperienceSessionStoryGraphNode, ExperienceSessionStoryNode, ExperienceSessionStoryNodeKind, ExperienceSessionStorySkillLink, ExperienceSessionStorySkillRole, ExperienceSessionStorySubagentDispatch, ExperienceSessionSummary, ExperienceSkillSegment, ExperienceSkillSummary, ExperienceTimelineBranch, ExperienceTimelineEvent, ExperienceTimelineTree, ObservationExperienceReport, ObservationReviewState, };
+export declare const OBSERVATION_EXPERIENCE_SCHEMA_VERSION = 2;
 export declare function aggregateExperienceChecklistItemStatus(statuses: ExperienceChecklistItemStatus[]): ExperienceChecklistItemStatus;
 interface BuildExperienceInput {
     sessions: CcSession[];
@@ -13,6 +14,7 @@ interface BuildExperienceInput {
     reviewState?: ObservationReviewState;
 }
 export declare function buildObservationExperienceReport(input: BuildExperienceInput): ObservationExperienceReport;
+export declare function normalizeObservationExperienceReport(value: unknown): ObservationExperienceReport | null;
 export declare function isExperienceTraceInProgress(session: ExperienceSessionSummary): boolean;
 export declare function hasRecognizableUserGoalText(value: string | undefined): boolean;
 export declare function foldExperienceChecklistItems(items: ExperienceChecklistItem[]): {

package/dist/observability/experience.js

@@ -7,6 +7,7 @@ import { durationMsBetween } from '../shared/time.js';
 import { loadExpectedToolsForSkill, loadFrontmatterSkillType, loadSkillDeclarationCheck, } from './experience-frontmatter.js';
 import { findNegativeFeedbackMatches, findPositiveFeedbackMatches, findUserCorrectionMatches, findUserGoalShiftMatches, hasNegativeFeedbackSignal, hasPositiveFeedbackSignal, hasUserCorrectionSignal, hasUserGoalShiftSignal, } from './feedback-matchers.js';
 export { findNegativeFeedbackMatches, findPositiveFeedbackMatches, findUserCorrectionMatches, findUserGoalShiftMatches, hasNegativeFeedbackSignal, hasPositiveFeedbackSignal, hasUserCorrectionSignal, hasUserGoalShiftSignal, } from './feedback-matchers.js';
+export const OBSERVATION_EXPERIENCE_SCHEMA_VERSION = 2;
 export function aggregateExperienceChecklistItemStatus(statuses) {
     if (statuses.includes('degraded'))
         return 'degraded';
@@ -131,8 +132,8 @@ export function buildObservationExperienceReport(input) {
     const sessions = summarizeExperienceSessions(invocations, sessionGroupsByKey, input.generatedAt, input.reviewState);
     const skills = summarizeExperienceSkills(sessions, invocations);
     return {
-        reportKind: 'observe-experience',
-        schemaVersion: 1,
+        kind: 'observe-experience',
+        schemaVersion: OBSERVATION_EXPERIENCE_SCHEMA_VERSION,
         scope: 'evidence-only',
         generatedAt: input.generatedAt,
         meta: {
@@ -148,6 +149,34 @@ export function buildObservationExperienceReport(input) {
         skills,
     };
 }
+export function normalizeObservationExperienceReport(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const report = value;
+    const kind = report.kind === 'observe-experience' ? report.kind : null;
+    if (!kind)
+        return null;
+    if (report.schemaVersion !== OBSERVATION_EXPERIENCE_SCHEMA_VERSION)
+        return null;
+    if (report.scope !== 'evidence-only')
+        return null;
+    if (typeof report.generatedAt !== 'string' || !report.meta || typeof report.meta !== 'object')
+        return null;
+    if (!Array.isArray(report.goalSlices) || !Array.isArray(report.invocations) || !Array.isArray(report.sessions) || !Array.isArray(report.skills)) {
+        return null;
+    }
+    return {
+        kind: 'observe-experience',
+        schemaVersion: OBSERVATION_EXPERIENCE_SCHEMA_VERSION,
+        scope: 'evidence-only',
+        generatedAt: report.generatedAt,
+        meta: report.meta,
+        goalSlices: report.goalSlices,
+        invocations: report.invocations,
+        sessions: report.sessions,
+        skills: report.skills,
+    };
+}
 function relatedObservationItems(segment, items) {
     return items.filter((item) => item.skillName === segment.skillName
         && (item.sessionId === segment.sessionId || item.recentSessionIds.includes(segment.sessionId))

package/dist/observability/inbox.js

@@ -6,10 +6,11 @@ import { extractGapSignalsFromTrace } from '../analysis/gap-analyzer.js';
 import { ccTracesToResultEntries } from './trace-adapter.js';
 import { isSearchToolCall, toolCallQuery } from '../shared/tool-search.js';
 import { durationMsBetween } from '../shared/time.js';
-import { buildObservationExperienceReport } from './experience.js';
+import { buildObservationExperienceReport, normalizeObservationExperienceReport, } from './experience.js';
 export const DEFAULT_PROJECT_OBSERVATIONS_DIR = join(process.cwd(), '.omk', 'observations');
 export const DEFAULT_GLOBAL_OBSERVATIONS_DIR = join(homedir(), '.oh-my-knowledge', 'observations');
 export const DEFAULT_OBSERVATIONS_DIR = DEFAULT_PROJECT_OBSERVATIONS_DIR;
+const OBSERVATION_INBOX_SCHEMA_VERSION = 2;
 function hashString(input) {
     return createHash('sha256').update(input).digest('hex').slice(0, 16);
 }
@@ -432,8 +433,8 @@ export function buildObservationInboxReport(tracePath, options = {}) {
     const items = finishInboxAggregation(aggregationState);
     const experience = buildObservationExperienceReport({ sessions, segments, items, generatedAt, reviewState: options.reviewState });
     const report = {
-        reportKind: 'observe-inbox',
-        schemaVersion: 1,
+        kind: 'observe-inbox',
+        schemaVersion: OBSERVATION_INBOX_SCHEMA_VERSION,
         meta: {
             tracePath,
             generatedAt,
@@ -543,7 +544,9 @@ export function loadObservationInboxReports(dir = DEFAULT_OBSERVATIONS_DIR) {
         .filter((file) => file.endsWith('-observe-inbox.json'))
         .map((file) => {
         try {
-            const report = JSON.parse(readFileSync(join(dir, file), 'utf-8'));
+            const report = normalizeObservationInboxReport(JSON.parse(readFileSync(join(dir, file), 'utf-8')));
+            if (!report)
+                return null;
             report.items = report.items.map((item) => {
                 const sourceKind = item.sourceKind;
                 return {
@@ -567,7 +570,30 @@ export function loadObservationInboxReports(dir = DEFAULT_OBSERVATIONS_DIR) {
             return null;
         }
     })
-        .filter((r) => r?.reportKind === 'observe-inbox');
+        .filter((r) => r?.kind === 'observe-inbox');
+}
+function normalizeObservationInboxReport(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const report = value;
+    const kind = report.kind === 'observe-inbox' ? report.kind : null;
+    if (!kind)
+        return null;
+    if (report.schemaVersion !== OBSERVATION_INBOX_SCHEMA_VERSION)
+        return null;
+    if (!report.meta || typeof report.meta !== 'object' || !Array.isArray(report.items))
+        return null;
+    const experience = report.experience === undefined
+        ? undefined
+        : normalizeObservationExperienceReport(report.experience) ?? undefined;
+    return {
+        kind: 'observe-inbox',
+        schemaVersion: OBSERVATION_INBOX_SCHEMA_VERSION,
+        meta: report.meta,
+        items: report.items,
+        ...(experience ? { experience } : {}),
+        ...(report.diagnostics !== undefined ? { diagnostics: report.diagnostics } : {}),
+    };
 }
 export function loadLatestObservationInboxReport(dir = DEFAULT_OBSERVATIONS_DIR) {
     const reports = loadObservationInboxReports(dir);

package/dist/observability/review-state.js

@@ -38,10 +38,11 @@ export function observationMetricAnnotationVerdict(state, ref, metricKey) {
 export function observationReviewStatePath(observationsDir) {
     return join(observationsDir, 'review-state.json');
 }
+const OBSERVATION_REVIEW_STATE_SCHEMA_VERSION = 2;
 export function emptyObservationReviewState(now = new Date().toISOString()) {
     return {
-        reportKind: 'observe-review-state',
-        schemaVersion: 1,
+        kind: 'observe-review-state',
+        schemaVersion: OBSERVATION_REVIEW_STATE_SCHEMA_VERSION,
         updatedAt: now,
         entries: {},
     };
@@ -52,15 +53,7 @@ export function loadObservationReviewState(observationsDir) {
         return emptyObservationReviewState();
     try {
         const parsed = JSON.parse(readFileSync(path, 'utf-8'));
-        if (parsed.reportKind !== 'observe-review-state' || parsed.schemaVersion !== 1 || !parsed.entries || typeof parsed.entries !== 'object') {
-            return emptyObservationReviewState();
-        }
-        return {
-            reportKind: 'observe-review-state',
-            schemaVersion: 1,
-            updatedAt: typeof parsed.updatedAt === 'string' ? parsed.updatedAt : new Date().toISOString(),
-            entries: Object.fromEntries(Object.entries(parsed.entries).filter(([, entry]) => isReviewStateEntry(entry))),
-        };
+        return normalizeObservationReviewState(parsed) ?? emptyObservationReviewState();
     }
     catch {
         return emptyObservationReviewState();
@@ -92,6 +85,24 @@ export function updateObservationReviewState(observationsDir, update, now = new
     writeFileSync(observationReviewStatePath(observationsDir), JSON.stringify(state, null, 2));
     return state;
 }
+function normalizeObservationReviewState(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const parsed = value;
+    const kind = parsed.kind === 'observe-review-state' ? parsed.kind : null;
+    if (!kind)
+        return null;
+    if (parsed.schemaVersion !== OBSERVATION_REVIEW_STATE_SCHEMA_VERSION)
+        return null;
+    if (!parsed.entries || typeof parsed.entries !== 'object')
+        return null;
+    return {
+        kind: 'observe-review-state',
+        schemaVersion: OBSERVATION_REVIEW_STATE_SCHEMA_VERSION,
+        updatedAt: typeof parsed.updatedAt === 'string' ? parsed.updatedAt : new Date().toISOString(),
+        entries: Object.fromEntries(Object.entries(parsed.entries).filter(([, entry]) => isReviewStateEntry(entry))),
+    };
+}
 export function deleteObservationReviewState(observationsDir, targetType, targetId, now = new Date().toISOString()) {
     if (!isReviewTargetType(targetType))
         throw new Error('invalid review targetType');

package/dist/observability/soft-standards/llm-extractor.js

@@ -2,7 +2,7 @@ import { mkdirSync, writeFileSync } from 'node:fs';
 import { createExecutor } from '../../executors/index.js';
 import { readPromptDocument } from '../../shared/llm-prompts/index.js';
 import { DEFAULT_LLM_ENHANCED_REVIEW_MODEL, PROMPTS_DIR, SOFT_STANDARD_PROMPT_ID, SOFT_STANDARD_PROMPT_VERSION, } from './constants.js';
-import { hashText, loadExisting, markStale, skillDerivedStandardsDir, skillDerivedStandardsPath, } from './skill-standards-store.js';
+import { hashText, loadExisting, markStale, SKILL_DERIVED_STANDARDS_SCHEMA_VERSION, skillDerivedStandardsDir, skillDerivedStandardsPath, } from './skill-standards-store.js';
 import { evaluateRuntimeStandardNodes } from './runtime-evaluator.js';
 export async function extractSkillSoftStandards(options) {
     const { observationsDir, skillChain } = options;
@@ -47,8 +47,8 @@ export async function extractSkillSoftStandards(options) {
         source: 'llm_soft_standard',
     }));
     const record = {
-        reportKind: 'observe-skill-derived-standards',
-        schemaVersion: 1,
+        kind: 'observe-skill-derived-standards',
+        schemaVersion: SKILL_DERIVED_STANDARDS_SCHEMA_VERSION,
         skillName: skillChain.skillName,
         sourceSkillPath: skillChain.definition.path,
         sourceHash,

package/dist/observability/soft-standards/skill-standards-store.d.ts

@@ -1,4 +1,5 @@
 import type { ResolveSkillStandardsOptions, ResolvedSkillStandards, SkillDerivedStandardStatus, SkillDerivedStandards } from './types.js';
+export declare const SKILL_DERIVED_STANDARDS_SCHEMA_VERSION = 2;
 export declare function skillDerivedStandardsDir(observationsDir: string): string;
 export declare function skillDerivedStandardsPath(observationsDir: string, skillName: string): string;
 export declare function loadSkillDerivedStandards(observationsDir: string): Record<string, SkillDerivedStandards>;

package/dist/observability/soft-standards/skill-standards-store.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { buildObservationSkillChain } from '../skill-chain.js';
+export const SKILL_DERIVED_STANDARDS_SCHEMA_VERSION = 2;
 export function skillDerivedStandardsDir(observationsDir) {
     return join(observationsDir, 'skill-derived');
 }
@@ -17,8 +18,8 @@ export function loadSkillDerivedStandards(observationsDir) {
         if (!file.endsWith('.json'))
             continue;
         try {
-            const parsed = JSON.parse(readFileSync(join(dir, file), 'utf-8'));
-            if (isSkillDerivedStandards(parsed))
+            const parsed = normalizeSkillDerivedStandards(JSON.parse(readFileSync(join(dir, file), 'utf-8')));
+            if (parsed)
                 out[parsed.skillName] = parsed;
         }
         catch {
@@ -51,11 +52,13 @@ export function updateSkillDerivedStandardStatus(observationsDir, skillName, sta
 }
 export function resolveSkillStandards(skillName, options) {
     const skillChain = options.skillChain ?? buildObservationSkillChain(skillName, options.cwd ?? process.cwd());
-    const derived = options.derivedStandards
-        ? isSkillDerivedStandards(options.derivedStandards)
-            ? options.derivedStandards
-            : options.derivedStandards[skillName]
-        : loadSkillDerivedStandards(options.observationsDir)[skillName];
+    const directDerived = normalizeSkillDerivedStandards(options.derivedStandards);
+    const mappedDerived = options.derivedStandards && !isSkillDerivedStandards(options.derivedStandards)
+        ? normalizeSkillDerivedStandards(options.derivedStandards[skillName])
+        : undefined;
+    const derived = directDerived
+        ?? mappedDerived
+        ?? loadSkillDerivedStandards(options.observationsDir)[skillName];
     const active = [];
     const candidates = [];
     const hasFrontmatterHardRules = skillChain.healthCheck.hardRules.declared && skillChain.healthCheck.hardRules.rules.length > 0;
@@ -112,8 +115,7 @@ export function loadExisting(path) {
     if (!existsSync(path))
         return undefined;
     try {
-        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
-        return isSkillDerivedStandards(parsed) ? parsed : undefined;
+        return normalizeSkillDerivedStandards(JSON.parse(readFileSync(path, 'utf-8')));
     }
     catch {
         return undefined;
@@ -129,13 +131,74 @@ export function markStale(record, generatedAt) {
     };
 }
 export function isSkillDerivedStandards(value) {
+    return normalizeSkillDerivedStandards(value) !== undefined;
+}
+function normalizeSkillDerivedStandards(value) {
     if (!value || typeof value !== 'object')
-        return false;
+        return undefined;
     const item = value;
-    return item.reportKind === 'observe-skill-derived-standards'
-        && item.schemaVersion === 1
-        && typeof item.skillName === 'string'
-        && Array.isArray(item.standards);
+    const kind = item.kind === 'observe-skill-derived-standards' ? item.kind : null;
+    if (!kind)
+        return undefined;
+    if (item.schemaVersion !== SKILL_DERIVED_STANDARDS_SCHEMA_VERSION)
+        return undefined;
+    if (typeof item.skillName !== 'string' || typeof item.generatedAt !== 'string' || typeof item.model !== 'string' || typeof item.executor !== 'string') {
+        return undefined;
+    }
+    if (typeof item.promptId !== 'string' || typeof item.promptVersion !== 'string' || !Array.isArray(item.standards))
+        return undefined;
+    const standards = item.standards
+        .map(normalizeSkillDerivedStandard)
+        .filter((record) => record !== null);
+    return {
+        kind: 'observe-skill-derived-standards',
+        schemaVersion: SKILL_DERIVED_STANDARDS_SCHEMA_VERSION,
+        skillName: item.skillName,
+        ...(typeof item.sourceSkillPath === 'string' ? { sourceSkillPath: item.sourceSkillPath } : {}),
+        ...(typeof item.sourceHash === 'string' ? { sourceHash: item.sourceHash } : {}),
+        generatedAt: item.generatedAt,
+        model: item.model,
+        executor: item.executor,
+        promptId: item.promptId,
+        promptVersion: item.promptVersion,
+        ...(typeof item.promptHash === 'string' ? { promptHash: item.promptHash } : {}),
+        ...(typeof item.runtimeEvidenceHash === 'string' ? { runtimeEvidenceHash: item.runtimeEvidenceHash } : {}),
+        ...(item.enhancedReview && typeof item.enhancedReview === 'object' ? { enhancedReview: item.enhancedReview } : {}),
+        standards,
+    };
+}
+function normalizeSkillDerivedStandard(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const item = value;
+    const standardKind = item.standardKind === 'hard_rule_candidate' || item.standardKind === 'workflow_candidate'
+        ? item.standardKind
+        : item.kind === 'hard_rule_candidate' || item.kind === 'workflow_candidate'
+            ? item.kind
+            : null;
+    if (!standardKind)
+        return null;
+    if (typeof item.id !== 'string' || typeof item.title !== 'string' || typeof item.body !== 'string')
+        return null;
+    if (item.status !== 'pending_review' && item.status !== 'author_confirmed' && item.status !== 'rejected' && item.status !== 'stale') {
+        return null;
+    }
+    if (item.source !== 'llm_soft_standard')
+        return null;
+    if (item.confidence !== 'low' && item.confidence !== 'medium' && item.confidence !== 'high')
+        return null;
+    if (!Array.isArray(item.evidence) || item.evidence.some((entry) => typeof entry !== 'string'))
+        return null;
+    return {
+        id: item.id,
+        standardKind,
+        status: item.status,
+        title: item.title,
+        body: item.body,
+        source: item.source,
+        confidence: item.confidence,
+        evidence: item.evidence,
+    };
 }
 function candidateRank(status) {
     if (status === 'pending_review')

package/dist/observability/soft-standards/types.d.ts

@@ -14,8 +14,8 @@ export interface SkillDerivedStandard {
     evidence: string[];
 }
 export interface SkillDerivedStandards {
-    reportKind: 'observe-skill-derived-standards';
-    schemaVersion: 1;
+    kind: 'observe-skill-derived-standards';
+    schemaVersion: 2;
     skillName: string;
     sourceSkillPath?: string;
     sourceHash?: string;

package/dist/renderer/html-renderer.js

@@ -21,7 +21,7 @@ function levelDot(level) {
     }
 }
 function isEvaluationReport(document) {
-    return document.reportKind === 'evaluation';
+    return document.kind === 'evaluation';
 }
 function scoreOf(summary) {
     return summary?.avgCompositeScore ?? summary?.avgLlmScore ?? null;
@@ -163,7 +163,7 @@ export function renderRunList(runs, lang = DEFAULT_LANG) {
             `<span class="rc-score-num rc-score-num--${cls}">${score.toFixed(2)}</span></div>`;
     };
     const cards = runs.map((run) => {
-        if (run.reportKind === 'batch-evaluation') {
+        if (run.kind === 'batch-evaluation') {
             const m = run.meta;
             const scores = run.items.length > 0
                 ? run.items.map((item) => {
@@ -652,7 +652,7 @@ export function renderBatchEvaluationDetail(report, lang = DEFAULT_LANG) {
 export function renderReportDocumentDetail(report, lang = DEFAULT_LANG) {
     if (!report)
         return renderRunDetail(null, lang);
-    return report.reportKind === 'batch-evaluation'
+    return report.kind === 'batch-evaluation'
         ? renderBatchEvaluationDetail(report, lang)
         : renderRunDetail(report, lang);
 }

package/dist/renderer/layout.js

@@ -159,7 +159,7 @@ export const I18N = {
         diffColCoverage: '覆盖',
         viewTrendLink: '查看趋势 →',
         artifactHashLabel: '版本指纹',
-        artifactHashTooltip: 'skill 文件内容的 SHA-256 前 12 位(不含路径/时间/git),用于辨别报告对应哪一版 skill;同文件多次跑指纹不变,改一字节就变——防止"改动效果"和"随机波动"混淆',
+        artifactHashTooltip: 'skill 内容指纹的 SHA-256 前 12 位(不含路径/时间/git):目录-skill(本地或 git)覆盖整棵可分发树(SKILL.md + references/ 资产,排除 .omk/.git/node_modules/evolve;改任意资产都变,git 源经隔离副本物化、整树暴露给 executor),单文件-skill 取该 .md 字节;用于辨别报告对应哪一版 skill,同输入指纹不变——防止"改动效果"和"随机波动"混淆',
         switchLang: '英文',
     },
     en: {
@@ -272,7 +272,7 @@ export const I18N = {
         diffColCoverage: 'Coverage',
         viewTrendLink: 'trend →',
         artifactHashLabel: 'Version fingerprint',
-        artifactHashTooltip: 'First 12 hex chars of SHA-256 over the skill file content (content-only: no path/time/git); identifies which version of the skill this report ran — same file = same fingerprint, any byte change = different fingerprint. Keeps "intentional change" separate from "random variance"',
+        artifactHashTooltip: 'First 12 hex chars of SHA-256 over the skill content (content-only: no path/time/git): a directory-skill (local or git) covers the whole distributable tree (SKILL.md + references/ assets, excluding .omk/.git/node_modules/evolve; any asset change flips it; git sources are materialized into an isolated copy whose whole tree is exposed to the executor), a file-skill covers the single .md bytes. Identifies which version of the skill this report ran — same input = same fingerprint. Keeps "intentional change" separate from "random variance"',
         switchLang: 'Chinese',
     },
 };

package/dist/server/report-server.js

@@ -762,7 +762,7 @@ export function createReportServer({ port, host: hostOption, reportsDir = DEFAUL
                 let evalReport = null;
                 if (entry.eval) {
                     const r = await reportStore.get(entry.eval.reportId);
-                    if (r && r.reportKind === 'evaluation')
+                    if (r && r.kind === 'evaluation')
                         evalReport = r;
                 }
                 res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });

package/dist/server/report-store.d.ts

@@ -20,7 +20,7 @@ export declare function queryJobList(jobStore: JobStore, query?: JobQuery): Prom
 export declare function queryJob(jobStore: JobStore, id: string): Promise<EvaluationJob | null>;
 export interface RunListItem {
     id: string;
-    reportKind: ReportDocument['reportKind'];
+    kind: ReportDocument['kind'];
     meta: ReportDocument['meta'];
     summary?: EvaluationReport['summary'];
     items?: BatchEvaluationReport['items'];