openxiangda-skill-kit 2.0.0-alpha.114 → 2.0.0-alpha.115

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-skill-kit",
-  "version": "2.0.0-alpha.114",
+  "version": "2.0.0-alpha.115",
   "description": "Validation and deterministic packaging for OpenXiangda 2.0 AI skills.",
   "type": "module",
   "main": "./dist/index.js",

package/skills/openxiangda-v2/references/workspace.md

@@ -3,6 +3,25 @@
 - Use only the workspace-pinned CLI: `pnpm openxiangda <command>`. Never invoke a bare global `openxiangda` inside a 2.0 task.
 - `appspec/` is the optional OpenXiangda 2.0 business-intent layer. Before changing observable behavior, read the bounded index with `pnpm openxiangda spec context --json`, then select only the relevant stable ID; use no ChangeSpec for L0 work, one short ChangeSpec for L1, and add permission/rollback/concurrency detail only for L2/L3. Before close, the user—not AI—confirms `currentSpec=merged` or `not-applicable`. AppSpec is advisory and never a release gate. Never read, import or migrate 1.x `openspec/` or SDD.
 - Use Vite, React Router, Refine Core and Ant Design. Do not add Umi, ProComponents or another admin shell.
+- The platform `openxiangda/react` owns the only admin `ConfigProvider` and the
+  `light`/`dark`/`system` appearance preference. Admin pages use Ant Design's
+  `defaultAlgorithm`/`darkAlgorithm`, `theme.useToken()`, or generated
+  `--oxa-antd-*` CSS variables. Do not add a nested theme provider, theme
+  store, palette editor, `--oxa-color-*`/`--oxa-shell-*` aliases, or fixed
+  white/black/neutral structural colors. Future palettes are centralized
+  platform seed configurations; alpha contracts are replaced directly without
+  compatibility aliases. User-end pages are outside this admin visual contract
+  and may use Tailwind CSS and their own product design tokens/components, but
+  must not mutate the admin provider or Seed.
+- Use the complete Ant Design Seed/Map/Alias/Component model on admin pages:
+  platform-owned Seed values feed the selected algorithm; admin code consumes
+  generated Alias values for colors, spacing, typography, control dimensions,
+  motion, shadows, z-index and breakpoints. Never hand-write Map values or
+  introduce an admin token registry. Component tokens are only for
+  platform-approved non-color dimensions and typography.
+- The template includes Tailwind CSS v4 for user-end pages. Keep its `@theme`
+  and utility classes in the user-end layer, omit Tailwind preflight from the
+  admin shell, and do not make user-end utilities depend on `--oxa-antd-*`.
 - Bind every generated `appRoutes` entry to its local page with `defineApplicationContributions`; desktop `admin` routes stay inside the platform Shell, while `user` routes render without an admin Shell for independent mobile/user experiences. Generated resource CRUD routes are compiler-owned under `/admin/resources/<resourceCode>...` and `/m/admin/resources/<resourceCode>...`; never recreate root resource paths, aliases or redirects. Explicit routes that have the same canonical shape as another explicit or generated route fail compilation, even when dynamic parameter names differ. Use only the typed `toolbar`, `row` and `detail` resource slots for generated resource actions. Declare the complete editable admin menu with `defineAdminNavigation` and its page/group helpers; the Shell renders only generated `adminNavigation` references and permissions only filter them. Do not create another router, menu store, layout, identity provider, permission store or copied CRUD page; route/action access uses capability or `allOf`/`anyOf`, while Data/App API and Workflow authorization remain server-owned.
 - Application login is optional `frontend.authentication`: existing platform users only, registration rejected, exact desktop `/login` and mobile `/m/login`. Bind generated `authenticationSurfaces` to separate PC/mobile renderers through `defineApplicationContributions`; renderers own only brand visuals and call `ApplicationLoginSurfaceProps`. The platform alone owns passwords, providers, OAuth state/callbacks, secure cookies, current identity and authorization. Never put login in protected `appRoutes`, call a v1 auth route, store tokens, create users/roles, or add another Router/identity provider. Keep QA in generated `platformAuthManifest`, outside the protected route denominator.
 - External users without platform accounts use only an exact static `surface: 'user'` route declared through `frontend.publicAccess`. Declare the one resource, bounded field sets, required operations, draft limits and named duplicate validations; consume only generated `anonymousPublicAccess` and `createAnonymousPublicClient`. `own.list`/`own.read` mean records submitted by the same platform-issued HttpOnly browser credential, not a verified natural person, and another browser or cleared cookie intentionally loses access. Never create a guest role/user, call the general Native Data API, expose an anonymous upload path, store identity locally or derive ownership from IP, user-agent or fingerprint.