openxiangda-skill-kit 2.0.0-alpha.61 → 2.0.0-alpha.63

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-skill-kit",
-  "version": "2.0.0-alpha.61",
+  "version": "2.0.0-alpha.63",
   "description": "Validation and deterministic packaging for OpenXiangda 2.0 AI skills.",
   "type": "module",
   "main": "./dist/index.js",

package/skills/openxiangda-v2/SKILL.md

@@ -9,6 +9,14 @@ Use the generated React, NestJS and Data API workspace as one application. Befor
 
 Start with `pnpm dlx openxiangda-cli@latest login`, then `pnpm dlx openxiangda-cli@latest create <directory>`. Run `pnpm openxiangda dev` for the local feedback loop and `pnpm openxiangda check` before delivery.
 
+For an AI-native development client, start the workspace MCP through the same
+pinned executable with `pnpm exec openxiangda --mcp-stdio --cwd <workspace>`.
+Read `openxiangda://workspace/contracts` or call `contract_describe` and verify
+that `aiCatalog` and `aiCatalogDigest` match the normal compiler result. This is a
+stdio transport mode, not another public CLI command. Never create an
+application-owned MCP server, Catalog file, preview store or AI authorization
+path.
+
 Keep ordinary CRUD on the platform Data API. Use NestJS only for real business actions. Page and field guards improve the interface; the platform remains authoritative for rows, fields and actions.
 
 Deploy test data first with `pnpm openxiangda deploy`. Inspect it with `pnpm openxiangda status` and `pnpm openxiangda logs`. Select production explicitly only after the same tested version succeeds. Use `pnpm openxiangda rollback --to <app-version-id>` when a verified prior version must be restored.

package/skills/openxiangda-v2/references/backend.md

@@ -62,6 +62,14 @@ calculate replacement counters in application code. Course selection is a
 locked `record-assert` plus a bounded `increment`; replay must reach the
 platform idempotency receipt even after the course becomes full.
 
+An idempotency key and the complete command payload are one immutable pair.
+Never put `new Date()`, `Date.now()`, `randomUUID()` or another changing value
+inside a controller while constructing the transaction. If a business time is
+part of the record, declare it as a required operation request field; the
+caller creates it once together with the idempotency key and reuses both on
+every retry. Platform-created record timestamps remain the source of truth
+when no separate business time is required.
+
 When declaring a lower-level transaction directly, use only the current
 contract:
 

package/skills/openxiangda-v2/references/workspace.md

@@ -12,3 +12,4 @@
 - A single directory user reference uses a `string` field; a single department or same-app resource reference uses `uuid`; every `multiple: true` reference uses `json`. Roles that consume directory-backed fields explicitly include `app:<app-code>:directory:read`.
 - Do not add compatibility aliases, migration branches or silent fallbacks for an earlier 2.0 alpha contract. Replace an incorrect contract and regenerate the application.
 - Run `pnpm openxiangda check` after contract changes. Deploy with `pnpm openxiangda deploy`, inspect with `pnpm openxiangda status` and `pnpm openxiangda logs`, and use the platform rollback command rather than mutating K3s directly.
+- AI-native clients start the workspace protocol through the same pinned binary: `pnpm exec openxiangda --mcp-stdio --cwd <workspace>`. Read `openxiangda://workspace/contracts` or call `contract_describe`, and require its `aiCatalog` and `aiCatalogDigest` to match the normal compiler output. This is a stdio transport mode, not a ninth CLI command. Never write an application MCP server, Catalog file, preview store or second authorization path.