skillpack-one 0.1.0-alpha.10

package/skills/category-software-engineering/references/index.zh-CN.md

@@ -0,0 +1,17 @@
+# 软件工程: 原子 Skill
+
+创建、修改、验证、发布或运行可执行的软件产物。
+
+## 原子 Skill
+
+- `atom-audit-source-security` — **审计源码安全**: 对边界明确的代码范围返回有证据的漏洞发现
+  - 风险: `read-only`
+  - 生命周期: analyze, verify
+- `atom-implement-code-change` — **实现代码修改**: 编辑并验证一个边界清晰的软件行为
+  - 风险: `reversible-write`
+  - 生命周期: create, verify
+- `atom-plan-code-change` — **规划代码修改**: 在不修改源码的前提下产出可实施计划
+  - 风险: `read-only`
+  - 生命周期: plan
+
+只读取最终选中的原子 Skill；若请求包含多个独立结果，请改用能力包。

package/skills/category-software-engineering/references/index.zh.md

@@ -0,0 +1,17 @@
+# 软件工程: 原子 Skill
+
+创建、修改、验证、发布或运行可执行的软件产物。
+
+## 原子 Skill
+
+- `atom-audit-source-security` — **审计源码安全**: 对边界明确的代码范围返回有证据的漏洞发现
+  - 风险: `read-only`
+  - 生命周期: analyze, verify
+- `atom-implement-code-change` — **实现代码修改**: 编辑并验证一个边界清晰的软件行为
+  - 风险: `reversible-write`
+  - 生命周期: create, verify
+- `atom-plan-code-change` — **规划代码修改**: 在不修改源码的前提下产出可实施计划
+  - 风险: `read-only`
+  - 生命周期: plan
+
+只读取最终选中的原子 Skill；若请求包含多个独立结果，请改用能力包。

package/skills/category-software-engineering/skill.contract.yaml

@@ -0,0 +1,26 @@
+schemaVersion: 1
+id: category-software-engineering
+kind: category
+version: 0.1.0
+name: { en: Software Engineering Router, zh-CN: 软件工程路由器 }
+summary: { en: Route executable software work to the smallest verified engineering atoms., zh-CN: 将可执行软件工作路由到最小且已验证的工程原子能力。 }
+outcomes: [Bounded software-engineering category decision]
+artifacts: [category-route, localized-index]
+inputs: [{ name: request, type: user-prompt, required: true }]
+outputs: [{ name: candidates, type: category-and-atom-candidates, required: true }]
+preconditions: [The versioned taxonomy and localized index are available]
+failures: [The request does not expose a stable software outcome or boundary]
+sideEffects: [filesystem-read]
+permissions: { network: none, filesystem: read, shell: none, secrets: none, externalCommunication: none }
+taxonomy:
+  primaryCategory: software-engineering
+  lifecycle: [analyze]
+  modalities: [text, structured-data]
+  dependencies: [tool-agnostic]
+  risk: read-only
+routing:
+  positiveTriggers: { en: [implement software, fix a bug, test code, design software architecture], zh-CN: [实现软件, 修复缺陷, 测试代码, 设计软件架构] }
+  negativeTriggers: { en: [security audit, general research, visual design only], zh-CN: [安全审计, 通用研究, 仅视觉设计] }
+  confusableWith: [category-security-trust, category-design-media]
+provenance: { origin: local, license: Apache-2.0 }
+evaluations: [routing-bootstrap, routing-en-test, routing-zh-cn-test, routing-adversarial]

package/skills/meta-skill-governor/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: meta-skill-governor
+description: Govern discovery, updates, optimization, learning, migration, deprecation, promotion, and rollback of other Skills and this Skill itself; use for evidence-backed lifecycle changes, never for silently rewriting active capabilities.
+---
+
+# Meta Skill Governor
+
+Treat every Skill change as a versioned software change with explicit authority.
+
+## Workflow
+
+1. Record the observation, failing examples, affected contracts, and current baseline. Search `.skill-system/knowledge/index.md` for relevant active patterns and read only those pattern records; never inject this governance knowledge into normal task execution.
+2. Create a bounded proposal. It may change only declared files, cite the motivating Evolution Knowledge pattern IDs when available, and may not expand permissions without explicit review.
+3. Build the candidate in an isolated sandbox. Do not modify active projections.
+4. Record every optimizer step as an append-only bounded evolution attempt. Permit only explicit add, delete, or replace edits within the proposal, enforce an edit budget, and reject ties. Keep attempted edits and their measured score changes even when rejected.
+5. Evaluate on train and dev suites, select only a strictly improving candidate, then evaluate on untouched held-out and adversarial suites.
+6. Reject the candidate if any protected safety metric regresses, provenance is incomplete, the edit budget is exceeded, or the improvement is not reproducible.
+7. Record approval, canary scope, release revision, and a tested rollback pointer.
+8. Monitor the canary; promote or rollback from evidence. Preserve rejected outcomes as evidence and consolidate only recurring, generalizable findings into Evolution Knowledge.
+
+Optimizer-only summaries may guide later proposals but must not be shipped inside an Atomic Skill or exposed to ordinary task execution. Treat every update as a new lifecycle admission event rather than inheriting trust from an earlier version.
+
+Read `references/knowledge-policy.en.md` or `references/knowledge-policy.zh-CN.md` when creating, updating, superseding, or archiving an Evolution Knowledge pattern.
+
+## Self-modification rule
+
+Changes to this Skill follow exactly the same workflow. The same proposal must not weaken this gate, replace its held-out set, erase its audit record, or remove its rollback path.
+
+## Deletion rule
+
+Prefer deprecation and reversible archival. Physical deletion is a separate, explicitly authorized maintenance action after dependency and retention checks.
+
+Read `references/evolution-policy.en.md` or `references/evolution-policy.zh-CN.md` for gate details.

package/skills/meta-skill-governor/agents/openai.yaml

@@ -0,0 +1,7 @@
+interface:
+  display_name: Meta Skill Governor
+  short_description: Route and apply Meta Skill Governor
+  default_prompt: Use $meta-skill-governor to handle this request within its
+    declared capability boundary.
+policy:
+  allow_implicit_invocation: true

package/skills/meta-skill-governor/references/evolution-policy.en.md

@@ -0,0 +1,8 @@
+# Evolution policy
+
+- Training evidence can motivate a patch but cannot certify it.
+- Test and adversarial examples must remain hidden from proposal generation.
+- Protected safety metrics require a perfect pass unless a stricter project policy applies.
+- Permission expansion, external communication, destructive actions, and secret access require explicit human approval.
+- Every decision is append-only and links the base revision, candidate revision, datasets, harness version, metrics, reviewer, canary, and rollback revision.
+- A failed candidate remains a learning record; it never becomes the active projection.

package/skills/meta-skill-governor/references/evolution-policy.zh-CN.md

@@ -0,0 +1,8 @@
+# 进化策略
+
+- 训练集证据可以推动修改，但不能证明修改可上线。
+- 留出集和对抗集不能暴露给提案生成过程。
+- 受保护的安全指标必须全部通过，除非项目采用更严格的规则。
+- 扩大权限、对外发送、破坏性动作和读取密钥必须由人显式批准。
+- 每条决策只追加，关联基础 revision、候选 revision、数据集、Harness 版本、指标、审查人、灰度范围与回滚 revision。
+- 失败候选可以保留为学习记录，但绝不能成为活动投影。

package/skills/meta-skill-governor/references/knowledge-policy.en.md

@@ -0,0 +1,9 @@
+# Evolution Knowledge policy
+
+- Raw task traces and run artifacts remain immutable evidence outside normal Skill context.
+- A pattern must state the problem, root cause, response, scope, confidence, and at least one traceable evidence reference.
+- Consolidate only recurring or independently useful observations; do not turn one anecdote into a universal rule.
+- Search active patterns before proposing a change, and cite relevant pattern IDs in the proposal.
+- A rejected Skill proposal remains evidence. It may refine a pattern but never activates a Skill.
+- Supersede or archive obsolete patterns instead of silently deleting them; preserve evidence and provenance.
+- Evolution Knowledge is available to Meta governance, not to ordinary task execution. This separation keeps Skill-effect evaluation from being contaminated by hidden task-solving context.

package/skills/meta-skill-governor/references/knowledge-policy.zh-CN.md

@@ -0,0 +1,9 @@
+# 进化知识策略
+
+- 原始任务轨迹和运行产物作为不可变证据保存，不进入普通 Skill 上下文。
+- 每个模式必须说明问题、根因、应对方式、适用范围、置信度，并至少关联一条可追溯证据。
+- 只沉淀重复出现或可独立复用的观察；不能把单个案例直接变成通用规则。
+- 提案前先检索活动模式，并在提案中引用相关模式 ID。
+- 被拒绝的 Skill 提案仍是证据，可以修正模式，但绝不能激活 Skill。
+- 过时模式应标记为已取代或归档，不得静默删除；证据和来源必须保留。
+- 进化知识只提供给元治理，不提供给普通任务执行，避免隐藏的解题上下文污染 Skill 效果评测。

package/skills/meta-skill-governor/skill.contract.yaml

@@ -0,0 +1,51 @@
+schemaVersion: 1
+id: meta-skill-governor
+kind: meta
+version: 0.1.0
+name:
+  en: Meta Skill Governor
+  zh-CN: 元 Skill 治理器
+summary:
+  en: Propose, evaluate, release, deprecate, and roll back governed Skill changes.
+  zh-CN: 提议、评测、发布、弃用和回滚受治理的 Skill 变更。
+outcomes:
+  - Auditable Skill lifecycle decision
+artifacts: [evolution-pattern, change-proposal, evaluation-record, release-decision, rollback-pointer]
+inputs:
+  - name: observation
+    type: evidence
+    required: true
+outputs:
+  - name: decision
+    type: governance-record
+    required: true
+preconditions:
+  - The active registry and protected evaluation baselines are available
+failures:
+  - The proposal expands authority without explicit approval
+  - Held-out or protected suites fail
+sideEffects: [filesystem-read, filesystem-write, shell-execution]
+permissions:
+  network: read
+  filesystem: workspace-write
+  shell: allowlisted
+  secrets: none
+  externalCommunication: none
+taxonomy:
+  primaryCategory: skill-agent-governance
+  lifecycle: [govern]
+  modalities: [text, structured-data, system-state]
+  dependencies: [harness-backed]
+  risk: reversible-write
+routing:
+  positiveTriggers:
+    en: [update a skill, optimize skill routing, deprecate a skill, roll back a skill, self-improve skills]
+    zh-CN: [更新 Skill, 优化 Skill, 优化 Skill 路由, 弃用 Skill, 回滚 Skill, Skill 自优化]
+  negativeTriggers:
+    en: [use the skill normally, silently delete]
+    zh-CN: [正常使用 Skill, 静默删除]
+  confusableWith: [atom-classify-capability]
+provenance:
+  origin: local
+  license: Apache-2.0
+evaluations: [governance-protected, routing-governance]

package/taxonomy/classification-standard.md

@@ -0,0 +1,44 @@
+# Capability Classification Standard
+
+Classify by the user's requested outcome, never by the repository name, author, or currently available tool.
+
+## Decision order
+
+1. Identify the durable artifact or state change.
+2. Choose the domain responsible for the correctness of that artifact.
+3. Record lifecycle, modality, dependency, and risk as secondary axes.
+4. Test the candidate category against its exclusions and boundary examples.
+5. Rank atoms inside the leading categories by positive triggers, contract fields, and negative boundaries.
+6. If leading categories remain close, preserve the ambiguity and return candidates instead of forcing certainty.
+
+## Boundary rules
+
+- A domain can use atoms indexed by another domain without taking ownership of them.
+- Product names are dependencies or tags, not top-level categories.
+- A workflow with independently useful outcomes is a capability pack, not an atom.
+- Security and trust properties take primary responsibility when they define success.
+- Governance work on Skills, agents, MCPs, or harnesses belongs to `skill-agent-governance`; normal use stays in the task domain.
+- Reclassification changes indexes, not stable capability IDs.
+
+## Shared description profile
+
+- Every first-party Category, Atomic, and Meta Skill follows the same portable `SKILL.md` shape and the same machine-readable `skill.contract.yaml` schema.
+- `SKILL.md` controls host discovery and progressive instructions. The contract controls capability identity, inputs, outputs, permissions, provenance, routing boundaries, and evaluation obligations.
+- Localized indexes may adapt terminology and examples, but they must resolve to the same stable capability IDs and authority boundaries.
+
+## Hierarchy and indexes
+
+- Keep Category trees outcome-driven and no deeper than `taxonomy.maxDepth`; this implementation fixes the maximum at three Category levels. Atomic Skills are leaves and do not count toward Category depth.
+- Every taxonomy node owns a Category Skill. Its generated `references/index.md` is the English fallback, with `index.en.md`, `index.zh-CN.md`, and `index.zh.md` as localized variants.
+- A parent index lists direct child Categories before local Atoms. Route downward one index at a time; do not load an entire subtree into context.
+- A physical nested directory tree is optional. This implementation uses flat executable Skill directories for Codex discovery and stores logical hierarchy in taxonomy parents and generated indexes.
+
+## Atomicity test
+
+An atom has one primary outcome, one dominant artifact/state transition, one permission envelope, one focused rubric, and an independent failure boundary. Split only when the resulting pieces remain independently useful.
+
+## Taxonomy evolution
+
+A category may split or merge only when versioned evaluation data shows persistent routing confusion, overload, or a new correctness boundary. Every change requires migration notes, regenerated indexes, held-out routing tests, and a rollback pointer.
+
+Meta Skills may govern the entire registry, one Category subtree, or one Skill. Scope changes authority, not the evaluation and rollback requirements.

package/taxonomy/classification-standard.zh-CN.md

@@ -0,0 +1,44 @@
+# 能力分类标准
+
+分类依据是用户要求的结果，而不是仓库名、作者或眼前可用的工具。
+
+## 决策顺序
+
+1. 找出最终要留下的产物或状态变化。
+2. 选择对该产物正确性负责的领域。
+3. 把生命周期、模态、依赖和风险记录为次级维度。
+4. 用候选分类的排除条件与边界案例反向检查。
+5. 在领先分类中，根据正向触发、能力契约与负向边界排列原子 Skill。
+6. 若领先分类仍然接近，保留歧义并返回候选，不强行假装确定。
+
+## 边界规则
+
+- 一个领域可以复用另一个领域索引的原子能力，不因此取得其所有权。
+- 产品名是依赖或标签，不是一级分类。
+- 含多个可独立复用结果的流程属于能力包，不属于原子 Skill。
+- 当安全或信任属性决定成功与否时，`security-trust` 优先负责。
+- 改进 Skill、Agent、MCP 或 Harness 属于 `skill-agent-governance`；正常使用它们仍属于任务领域。
+- 重新分类只改变索引，不改变稳定能力 ID。
+
+## 统一描述档案
+
+- 每个第一方分类、原子和元 Skill 都遵循同一套可移植 `SKILL.md` 结构和同一份机器可读 `skill.contract.yaml` Schema。
+- `SKILL.md` 负责宿主发现和渐进式指令；能力契约负责能力身份、输入输出、权限、来源、路由边界与评测责任。
+- 本地化索引可以调整术语和案例，但必须指向相同的稳定能力 ID 与权限边界。
+
+## 层级与索引
+
+- 分类树以结果为依据，深度不得超过 `taxonomy.maxDepth`；本实现最多三层分类。原子 Skill 是叶节点，不计入分类深度。
+- 每个 taxonomy 节点都对应一个分类 Skill。生成的 `references/index.md` 是英文回退版本，同时提供 `index.en.md`、`index.zh-CN.md` 和 `index.zh.md`。
+- 父分类索引先列出直接子分类，再列出本层原子能力。每次只向下读取一层索引，不能把整个子树一次性加载进上下文。
+- 物理嵌套目录不是强制要求。本实现为兼容 Codex 发现机制而保持可执行 Skill 目录扁平，通过 taxonomy 父子关系和生成索引表达逻辑层级。
+
+## 原子性检查
+
+原子能力只有一个主要结果、一个主导产物或状态变化、一个权限包络、一个聚焦评分标准和一个独立失败边界。只有拆出的每一部分仍可独立复用时才拆分。
+
+## 分类进化
+
+只有版本化评测数据持续显示路由混淆、分类过载或新的正确性边界时，才允许拆分或合并分类。每次变更都要有迁移说明、重建索引、留出路由测试和回滚指针。
+
+元 Skill 可以管理整个注册表、某个分类子树或单个 Skill。管理范围可以不同，但评测与回滚要求不能降低。

package/taxonomy/taxonomy.yaml

@@ -0,0 +1,195 @@
+schemaVersion: 1
+version: 0.2.0
+maxDepth: 3
+nodes:
+  - id: software-engineering
+    label:
+      en: Software engineering
+      zh-CN: 软件工程
+    description:
+      en: Create, change, verify, ship, or operate executable software artifacts.
+      zh-CN: 创建、修改、验证、发布或运行可执行的软件产物。
+    includes:
+      - creating or changing source code
+      - debugging and testing software behavior
+      - designing software architecture
+    excludes:
+      - general research that does not change software
+      - visual design without implementation
+    boundaryExamples:
+      - A security review routes to security-trust first even when the artifact is code.
+    keywords:
+      en: [code, software, bug, test, refactor, repository, api, application, implement, patch]
+      zh-CN: [代码, 代码修改, 软件, 修复, 测试, 重构, 仓库, 接口, 应用, 实现, 补丁]
+  - id: research-knowledge
+    label:
+      en: Research and knowledge
+      zh-CN: 研究与知识
+    description:
+      en: Discover, synthesize, cite, or maintain knowledge and evidence.
+      zh-CN: 发现、综合、引用或维护知识与证据。
+    includes:
+      - evidence-backed research
+      - literature and knowledge synthesis
+      - knowledge-base organization
+    excludes:
+      - implementing source code as the primary outcome
+      - producing a polished business document without research
+      - vulnerability review
+    boundaryExamples:
+      - A researched report routes here for evidence gathering, then to documents for production.
+    keywords:
+      en: [research, evidence, sources, literature, knowledge, citation, investigate]
+      zh-CN: [研究, 证据, 来源, 文献, 知识, 引用, 调研]
+  - id: data-analytics
+    label:
+      en: Data and analytics
+      zh-CN: 数据与分析
+    description:
+      en: Transform, query, model, calculate, or visualize structured data.
+      zh-CN: 转换、查询、建模、计算或可视化结构化数据。
+    includes:
+      - spreadsheet and database analysis
+      - statistical or quantitative modeling
+      - structured-data visualization
+    excludes:
+      - prose-only research synthesis
+      - operating a production data service
+    boundaryExamples:
+      - Creating a chart from a dataset routes here; styling a brand illustration routes to design-media.
+    keywords:
+      en: [data, spreadsheet, database, sql, statistics, chart, metrics, analysis]
+      zh-CN: [数据, 表格, 数据库, 统计, 图表, 指标, 分析]
+  - id: documents-communication
+    label:
+      en: Documents and communication
+      zh-CN: 文档与沟通
+    description:
+      en: Create or transform human-readable documents, presentations, and messages.
+      zh-CN: 创建或转换供人阅读的文档、演示和消息。
+    includes:
+      - writing and editing documents
+      - translation and summarization
+      - presentations and external messages
+    excludes:
+      - executable source-code changes
+      - image or video production as the primary artifact
+    boundaryExamples:
+      - Data analysis routes to data-analytics before its narrative is turned into a report here.
+    keywords:
+      en: [document, pdf, word, slide, presentation, translate, memo, report, email]
+      zh-CN: [文档, PDF, Word, 幻灯片, 演示, 翻译, 报告, 邮件]
+  - id: design-media
+    label:
+      en: Design and media
+      zh-CN: 设计与媒体
+    description:
+      en: Design interfaces or create and transform visual, audio, and video media.
+      zh-CN: 设计界面或创建、转换图像、音频和视频媒体。
+    includes:
+      - user interface and experience design
+      - image, audio, and video generation or editing
+      - diagrams whose primary purpose is visual communication
+    excludes:
+      - frontend implementation when code is the primary artifact
+      - data charts whose correctness is the primary goal
+    boundaryExamples:
+      - A UI specification routes here; coding the specified UI routes to software-engineering.
+    keywords:
+      en: [design, ui, ux, image, video, audio, diagram, visual, layout]
+      zh-CN: [设计, 界面, 体验, 图像, 视频, 音频, 图表, 视觉, 布局]
+  - id: business-growth
+    label:
+      en: Business and growth
+      zh-CN: 商业与增长
+    description:
+      en: Improve markets, sales, marketing, finance, and business decisions.
+      zh-CN: 改善市场、销售、营销、财务和商业决策。
+    includes:
+      - market and competitor analysis
+      - marketing, sales, and growth workflows
+      - business and investment analysis
+    excludes:
+      - generic evidence research with no business decision
+      - personal task tracking
+    boundaryExamples:
+      - Market research belongs here while the underlying web evidence collection may use research atoms.
+    keywords:
+      en: [business, market, sales, marketing, seo, customer, investment, finance, growth]
+      zh-CN: [商业, 市场, 销售, 营销, 客户, 投资, 财务, 增长]
+  - id: automation-operations
+    label:
+      en: Automation and operations
+      zh-CN: 自动化与运营
+    description:
+      en: Connect systems, schedule work, deploy services, and operate repeatable workflows.
+      zh-CN: 连接系统、调度工作、部署服务并运行可重复流程。
+    includes:
+      - workflow automation and orchestration
+      - deployment and infrastructure operations
+      - recurring jobs and monitoring
+    excludes:
+      - one-off code implementation without an operational outcome
+      - personal reminders with no system integration
+    boundaryExamples:
+      - Writing deployment code may use software atoms, but operating the deployment routes here.
+    keywords:
+      en: [automation, workflow, deploy, operations, monitor, schedule, integration, cloud]
+      zh-CN: [自动化, 工作流, 部署, 运维, 监控, 定时, 集成, 云]
+  - id: personal-productivity
+    label:
+      en: Personal productivity
+      zh-CN: 个人效率
+    description:
+      en: Manage an individual's tasks, notes, calendar, memory, and attention.
+      zh-CN: 管理个人任务、笔记、日历、记忆和注意力。
+    includes:
+      - task and calendar management
+      - personal notes and memory
+      - individual planning routines
+    excludes:
+      - organization-wide workflow automation
+      - shared knowledge governance
+    boundaryExamples:
+      - A personal recurring reminder routes here; a cross-system scheduled pipeline routes to automation-operations.
+    keywords:
+      en: [task, todo, calendar, reminder, notes, memory, productivity, personal]
+      zh-CN: [任务, 待办, 日历, 提醒, 笔记, 记忆, 效率, 个人]
+  - id: security-trust
+    label:
+      en: Security and trust
+      zh-CN: 安全与信任
+    description:
+      en: Identify, prevent, or govern security, privacy, safety, and integrity risks.
+      zh-CN: 识别、预防或治理安全、隐私、可靠性和完整性风险。
+    includes:
+      - security audits and threat analysis
+      - permission and secret review
+      - trust and provenance verification
+    excludes:
+      - ordinary functional debugging
+      - quality review without a security or trust property
+    boundaryExamples:
+      - Vulnerability review routes here even when source code is inspected.
+    keywords:
+      en: [security, vulnerability, threat, audit, permission, secret, privacy, provenance]
+      zh-CN: [安全, 漏洞, 威胁, 审计, 权限, 密钥, 隐私, 来源]
+  - id: skill-agent-governance
+    label:
+      en: Skill and agent governance
+      zh-CN: Skill 与 Agent 治理
+    description:
+      en: Classify, compose, evaluate, release, and evolve agent capabilities and harnesses.
+      zh-CN: 分类、组合、评测、发布和进化 Agent 能力与 Harness。
+    includes:
+      - creating and classifying Agent Skills
+      - evaluating routing and task completion
+      - governed self-improvement and rollback
+    excludes:
+      - using a domain Skill to perform its normal task
+      - generic model training unrelated to skills
+    boundaryExamples:
+      - Improving a coding Skill routes here; using that Skill to edit code routes to software-engineering.
+    keywords:
+      en: [skill, agent, mcp, harness, routing, evaluation, taxonomy, self-improving]
+      zh-CN: [技能, 智能体, MCP, Harness, 路由, 评测, 分类, 自优化]