tuner-testkit 4.2.0__tar.gz → 4.4.0__tar.gz

{tuner_testkit-4.2.0/tuner_testkit.egg-info → tuner_testkit-4.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tuner-testkit
-Version: 4.2.0
+Version: 4.4.0
 Summary: Shared test runtime, recorders, and DNA overlay for SUT test repos
 Author: tuner-testkit contributors
 License-Expression: MIT
@@ -138,10 +138,10 @@ uv tool upgrade tuner-testkit
 
 ```bash
 # 钉到某一发行版（推荐，和团队 lock 一致）
-uv add "tuner-testkit[db,api]==4.2.0"
+uv add "tuner-testkit[db,api]==4.3.0"
 
 # 或只抬下限，让解析器选允许范围内的最新
-# uv add "tuner-testkit[db,api]>=4.2.0"
+# uv add "tuner-testkit[db,api]>=4.3.0"
 
 uv sync
 ```
@@ -210,4 +210,8 @@ uv sync --extra all
 
 `uv sync --extra dev` 与 `--extra all` 等价（`dev` 只是引用 `[all]`）。
 
-4.2.0 发行说明见 [`docs/changelog/TEMPLATE-4.2.0.md`](docs/changelog/TEMPLATE-4.2.0.md)；3.x → 4.x 迁移见 [`TEMPLATE-4.0.0.md`](docs/changelog/TEMPLATE-4.0.0.md)。平台能力地图见 [`INDEX.md`](INDEX.md)。
+本仓是**平台仓**，不是 workspace。`dogfood/` 是用 `tuner-init scaffold dogfood --no-ai` 生成的 workspace 示范
+（被测系统 = 平台本身，uv workspace 成员，共用 `.venv`）：路线图在 `dogfood/assets/domain-notes/platform/roadmap.md`，
+验收活文档在 `dogfood/tests/features/`。见 [`dogfood/README.md`](dogfood/README.md)。
+
+4.3.0 发行说明见 [`docs/changelog/TEMPLATE-4.3.0.md`](docs/changelog/TEMPLATE-4.3.0.md)；4.2.0 见 [`TEMPLATE-4.2.0.md`](docs/changelog/TEMPLATE-4.2.0.md)；3.x → 4.x 迁移见 [`TEMPLATE-4.0.0.md`](docs/changelog/TEMPLATE-4.0.0.md)。平台能力地图见 [`INDEX.md`](INDEX.md)。

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/README.md

@@ -93,10 +93,10 @@ uv tool upgrade tuner-testkit
 
 ```bash
 # 钉到某一发行版（推荐，和团队 lock 一致）
-uv add "tuner-testkit[db,api]==4.2.0"
+uv add "tuner-testkit[db,api]==4.3.0"
 
 # 或只抬下限，让解析器选允许范围内的最新
-# uv add "tuner-testkit[db,api]>=4.2.0"
+# uv add "tuner-testkit[db,api]>=4.3.0"
 
 uv sync
 ```
@@ -165,4 +165,8 @@ uv sync --extra all
 
 `uv sync --extra dev` 与 `--extra all` 等价（`dev` 只是引用 `[all]`）。
 
-4.2.0 发行说明见 [`docs/changelog/TEMPLATE-4.2.0.md`](docs/changelog/TEMPLATE-4.2.0.md)；3.x → 4.x 迁移见 [`TEMPLATE-4.0.0.md`](docs/changelog/TEMPLATE-4.0.0.md)。平台能力地图见 [`INDEX.md`](INDEX.md)。
+本仓是**平台仓**，不是 workspace。`dogfood/` 是用 `tuner-init scaffold dogfood --no-ai` 生成的 workspace 示范
+（被测系统 = 平台本身，uv workspace 成员，共用 `.venv`）：路线图在 `dogfood/assets/domain-notes/platform/roadmap.md`，
+验收活文档在 `dogfood/tests/features/`。见 [`dogfood/README.md`](dogfood/README.md)。
+
+4.3.0 发行说明见 [`docs/changelog/TEMPLATE-4.3.0.md`](docs/changelog/TEMPLATE-4.3.0.md)；4.2.0 见 [`TEMPLATE-4.2.0.md`](docs/changelog/TEMPLATE-4.2.0.md)；3.x → 4.x 迁移见 [`TEMPLATE-4.0.0.md`](docs/changelog/TEMPLATE-4.0.0.md)。平台能力地图见 [`INDEX.md`](INDEX.md)。

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tuner-testkit"
-version = "4.2.0"
+version = "4.4.0"
 description = "Shared test runtime, recorders, and DNA overlay for SUT test repos"
 readme = "README.md"
 license = "MIT"
@@ -73,6 +73,7 @@ tuner-index-platform = "tuner_testkit.apps.index_platform.__main__:main"
 tuner-fake = "tuner_testkit.fake.cli:main"
 tuner-page-test = "tuner_testkit.page_test.__main__:main"
 tuner-action-words = "tuner_testkit.action_words.__main__:main"
+tuner-evidence = "tuner_testkit.apps.evidence.cli:main"
 
 [build-system]
 requires = ["setuptools>=77", "wheel"]
@@ -89,6 +90,10 @@ include = ["tuner_testkit*"]
 build_py = "tuner_testkit.apps.dna.build.BuildPyWithDna"
 sdist = "tuner_testkit.apps.dna.build.SdistWithDna"
 
+[tool.uv.workspace]
+# dogfood/ is a workspace scaffolded by `tuner-init` from this repo (SUT = the platform itself).
+members = ["dogfood"]
+
 [tool.tuner-testkit]
 page_objects = "packages/page_objects"
 api_objects = "packages/api_objects"

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/__init__.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "4.2.0"
+__version__ = "4.4.0"

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/api_test/__init__.py

@@ -6,7 +6,13 @@ Primary entrypoints:
 """
 
 from .client import ApiClient
-from .model import APIModel, ApiResponse, AssertOperation, ExtractVariableOperation
+from .model import (
+    APIModel,
+    ApiResponse,
+    AssertOperation,
+    ExtractVariableOperation,
+    interpolate_path,
+)
 
 __all__ = [
     "APIModel",
@@ -14,5 +20,5 @@ __all__ = [
     "AssertOperation",
     "ExtractVariableOperation",
     "ApiClient",
+    "interpolate_path",
 ]
-

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/api_test/model.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 from dataclasses import dataclass, field, replace
 from typing import Any, Dict, Iterable, List, Mapping, MutableMapping, Optional
 
@@ -102,6 +103,22 @@ def _required_file_fields(schema: Mapping[str, Any]) -> list[str]:
     return out
 
 
+_PATH_PLACEHOLDER_RE = re.compile(r"\{([A-Za-z_][A-Za-z0-9_]*)\}")
+
+
+def interpolate_path(path: str, params: Mapping[str, Any]) -> str:
+    """Replace ``{name}`` segments. Raises if any named placeholder remains."""
+    out = path
+    for key, value in params.items():
+        out = out.replace("{" + str(key) + "}", str(value))
+    leftover = _PATH_PLACEHOLDER_RE.findall(out)
+    if leftover:
+        raise SchemaValidationError(
+            f"path still has placeholders {leftover}; pass them via set_path"
+        )
+    return out
+
+
 @dataclass(frozen=True)
 class APIModel:
     # Identity
@@ -156,6 +173,9 @@ class APIModel:
     def set_headers(self, values: Optional[Mapping[str, Any]] = None) -> "APIInvocation":
         return APIInvocation(self).set_headers(values)
 
+    def set_path(self, values: Optional[Mapping[str, Any]] = None) -> "APIInvocation":
+        return APIInvocation(self).set_path(values)
+
     def override_query(self, values: Optional[Mapping[str, Any]] = None) -> "APIInvocation":
         return APIInvocation(self).override_query(values)
 
@@ -181,6 +201,7 @@ class APIInvocation:
     _set_json: Dict[str, Any] = field(default_factory=dict)
     _set_files: Dict[str, Any] = field(default_factory=dict)
     _set_headers: Dict[str, Any] = field(default_factory=dict)
+    _path_params: Dict[str, Any] = field(default_factory=dict)
     _override_query: Optional[Dict[str, Any]] = None
     _override_json: Any = None
     _override_json_set: bool = False
@@ -237,6 +258,10 @@ class APIInvocation:
         checked = _enforce_headers_policy(headers=values, allowlist=allowlist, forbidden=forbidden)
         return replace(self, _set_headers=_merge_shallow(self._set_headers, checked))
 
+    def set_path(self, values: Optional[Mapping[str, Any]] = None) -> "APIInvocation":
+        values = {str(k): v for k, v in dict(values or {}).items()}
+        return replace(self, _path_params=_merge_shallow(self._path_params, values))
+
     def override_query(self, values: Optional[Mapping[str, Any]] = None) -> "APIInvocation":
         values = dict(values or {})
         # override still must respect schema; allow autofill via set_query if needed
@@ -308,6 +333,8 @@ class APIInvocation:
         from .client import ApiClient  # local import to avoid cycles
 
         m = self._effective_model()
+        if self._path_params:
+            m = replace(m, path=interpolate_path(m.path, self._path_params))
         use_client = client or m._client or ApiClient.default()
         files = self._final_files()
         self._validate_required_files(m, files)

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/apps/dna/build.py

@@ -31,8 +31,19 @@ def _payload_ready(root: Path | None = None) -> bool:
 
 
 def _bundle() -> None:
+    """Refresh ``dna_payload`` from the template tree when building a wheel.
+
+    A leftover ``dna_payload/`` from an older build must not short-circuit:
+    that shipped stale DNA (4.3.0 payload inside a 4.4.0 wheel).
+    """
     _ensure_src_on_path()
-    if _payload_ready():
+    from tuner_testkit.project import template_source_root
+
+    if template_source_root() is None:
+        if not _payload_ready():
+            raise RuntimeError(
+                "no DNA payload in this install and no template checkout to bundle from"
+            )
         return
 
     from tuner_testkit.apps.dna.cli import cmd_bundle

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/apps/dna/cli.py

@@ -47,6 +47,7 @@ def cmd_sync(args: argparse.Namespace) -> int:
                 continue
             if dst.is_file() and not args.overwrite:
                 skipped += 1
+                print(f"skip {rel} (differs; pass --overwrite)")
                 continue
         dst.parent.mkdir(parents=True, exist_ok=True)
         shutil.copy2(src, dst)
@@ -82,7 +83,7 @@ def cmd_check(args: argparse.Namespace) -> int:
         print(f"  missing: {rel}", file=sys.stderr)
     for rel in changed:
         print(f"  changed: {rel}", file=sys.stderr)
-    print("Run `tuner-dna sync` to refresh platform DNA.", file=sys.stderr)
+    print("Run `tuner-dna sync --overwrite` to refresh platform DNA.", file=sys.stderr)
     return 1
 
 

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/apps/dna/dna_payload/.cursor/agents/bdd-asset-pipeline.md

@@ -1,6 +1,6 @@
 ---
 name: bdd-asset-pipeline
-version: 2.0.0
+version: 2.0.1
 description: Lower-half of SUT self-learning — Feature Sets + design knowledge → Reuse Analysis → Freeze API Objects → Maintain Page Objects → Maintain Steps → behave regression. Use only for behave/BDD automation assets. Do NOT use when the user explicitly requests pytest. Do NOT use this agent as the explore-first entry; start from docs/spec/sut-self-learning.md instead.
 ---
 
@@ -104,3 +104,5 @@ Before writing Then-assertions, **read `assets/design/**`**:
 - `behave --stage ui` succeeds for UI features that exist.
 - `behave --stage api` succeeds for API features that exist (or `--dry-run`
   with documented TODO).
+- Task log written to `artifacts/inbox/` per `docs/spec/agent-task-log.md`
+  (no secrets).

tuner_testkit-4.4.0/tuner_testkit/apps/dna/dna_payload/.cursor/agents/sut-self-learning.md

@@ -0,0 +1,72 @@
+---
+name: sut-self-learning
+version: 1.0.0
+description: Orchestrate explore-first SUT self-learning — accounts → Playwright MCP explore → evidence → freeze API/page objects → design knowledge → index, with an artifacts/inbox task log. Hand off to bdd-asset-pipeline only when Feature Sets are in scope. Do NOT use when the user explicitly requests pytest-only work.
+---
+
+# SUT self-learning orchestrator (upper half + optional handoff)
+
+## Purpose
+
+串起「学习被测 Web 系统并生长测试资产」的**上半程**。规格
+`docs/spec/sut-self-learning.md`。本文件是可执行编排；规格不是本 agent 的替代。
+
+**下半程**（已有 feature set → steps / behave）交给
+`.cursor/agents/bdd-asset-pipeline.md`，不要在本 agent 里硬造 Gherkin，除非用户明确要验收自动化。
+
+## When to use
+
+- 工程师说「探索 SUT / 学习某某模块 / 生成测试资产 / 再跑一轮自学习」。
+- 下游仓已有 `tuner-init` 骨架，SUT 可访问。
+
+## Inputs
+
+1. `INDEX.md` + 若存在 `INDEX.project.md`（已有切片、勿重复冻登录接口）。
+2. **账号**（只读，禁止拷进仓库/evidence/inbox）：
+   1. `data/sut-accounts.local.yaml`（gitignore，首选）
+   2. 否则 `config/env_local.py` 的 `TEST_ACCOUNT`
+   3. 都没有则停，让工程师按 `data/sut-accounts.example.yaml` 补本机文件
+3. 垂直切片（一个模块，不是全站爬）。
+4. 可选：SUT 源码根（如 Plane `apps/api`）——有则跑 `sut-source-to-design`。
+
+## Skills / agents（顺序）
+
+| 步 | 组件 | 产出 |
+| --- | --- | --- |
+| 0 | 读账号 + `explore-safety` | 登录参数（内存） |
+| 1 | `dump-ddl`（缺表才跑，禁 `--all`） | `assets/ddl/<ds>/` |
+| 2 | `explore-sut` | `artifacts/evidence/<run_id>/` + `assets/explore/` |
+| 3 | `analyze-mcp-network`（`tuner-evidence routes`） | 路由表 JSON |
+| 4 | `reuse-analysis` | 复用 vs 新建 |
+| 5 | `freeze-api-objects` | `packages/api_objects/`（跳过 sign-in） |
+| 6 | `maintain-page-objects` | `packages/page_objects/` |
+| 7 | `derive-design-knowledge`；有源码则 **`sut-source-to-design`** | `assets/design/` |
+| 8 | `maintain-index` | `INDEX.project.md` 或 `INDEX.md` |
+| 9 | **本 agent** 写 inbox | `artifacts/inbox/<utc>-sut-self-learning-<slice>.md` |
+| 10 | 仅当用户要 `.feature` | `derive-feature-sets` → **`bdd-asset-pipeline`** |
+
+每步先 **Read** 对应 `SKILL.md` / agent 正文再执行。不要跳过 evidence 落盘。
+
+## Inbox（强制）
+
+遵循 `docs/spec/agent-task-log.md`。SUT 自学习日志 **必须**含：
+
+- `## Pages explored`（url pattern / title / 按钮）
+- `## Assets added this run`（本任务新增或更新的 api/page/explore/design/ddl）
+- `run_id`；`account_id`（无密码）
+- 若这是第 N 轮 dogfood：`## Loop delta` 对比上一轮 inbox / 平台能力
+
+## Hard rules
+
+- 活体 SUT：`explore-safety`（throwaway 数据；不问不准删）。
+- 密钥不入库、不进 evidence、不进 inbox。
+- Web cookie session 的 path 占位用 `{workspace_slug}` 等，调用走 `set_path`。
+- 页面资产 app 名对齐现有 `packages/page_objects/<app>/`，勿与装饰器模块重名。
+- 未走 Gate 1 证据不得写 api/page/design。
+
+## Done
+
+- evidence 在磁盘且已脱敏。
+- 切片的 explore +（若有写操作）design 已引用 `run_id`。
+- 新路由已冻或书面说明跳过原因。
+- inbox 已落盘，页面清单与资产增量齐全。

tuner_testkit-4.4.0/tuner_testkit/apps/dna/dna_payload/.cursor/agents/sut-source-to-design.md

@@ -0,0 +1,35 @@
+---
+name: sut-source-to-design
+version: 1.0.1
+description: Walk SUT backend source (Django models/views/serializers, or equivalent) plus assets/ddl to draft assets/design/<app>/<route-slug>.md. Use when the engineer points at a source tree. Do not invent tables. Complements derive-design-knowledge; this agent is the source-channel playbook.
+---
+
+# SUT source → design knowledge
+
+## Purpose
+
+Highest-quality `writes` / `noise` / `reads` often come from **models.save / views**, not from MCP bodies. Plane dogfood: `Issue.save` showed `issue_sequences` + `_ensure_default_state` before any DB diff existed.
+
+## Inputs
+
+- Source root the user named (e.g. `C:\dev\repo\plane\apps\api`)
+- Matching `assets/ddl/<datasource>/` if present (dump missing tables rather than hallucinate)
+- Optional `artifacts/evidence/<run_id>/` to fill `api_object_ref` / `page_ref`
+
+## Workflow
+
+1. Locate the route: urls.py / router → view/serializer.
+2. Locate the model `.save()` / service function for that write.
+3. List INSERT/UPDATE/DELETE tables. Audit / `*_activities` / operation_log → `noise`.
+4. If a table is named in source but missing from DDL, run `tuner-dump-ddl <table> --datasource …` then continue. Do not skip the table.
+5. Write one `assets/design/<app>/<route-slug>.md` per **route** (not per button) using `docs/spec/design-knowledge-syntax.md` v0.1.
+6. Record schema gaps under `## notes` (conditional writes, defaulted FKs, dual identity). Do **not** invent new top-level keys yet.
+
+## Hard rules
+
+- Table/column names must appear in DDL or source. No guessed identifiers.
+- `confidence: inferred` for source-only; `observed` only with DB/log evidence.
+- No secrets.
+- Do not generate action words here.
+- Write `artifacts/inbox/<utc>-sut-source-to-design-<slice>.md` per
+  `docs/spec/agent-task-log.md` (outputs = design files; no secrets).

tuner_testkit-4.4.0/tuner_testkit/apps/dna/dna_payload/.cursor/rules/agent-task-log.mdc

@@ -0,0 +1,22 @@
+---
+description: Every agent run must leave a task log under artifacts/inbox/ (no secrets).
+alwaysApply: true
+version: 1.0.0
+---
+
+# Agent task log — `artifacts/inbox/`
+
+每次按 `.cursor/agents/*.md` 编排执行（含 SUT 自学习），结束前必须写一份任务记录。
+细则见 `docs/spec/agent-task-log.md`。
+
+## Must
+
+- 路径：`artifacts/inbox/<UTC>-<agent>-<slice>.md`（例 `20260914T031200Z-sut-self-learning-cycles.md`）。
+- 必填：`agent`、意图、输入、产出文件列表、下一步。
+- **SUT 自学习**额外必填：本次探索的页面（url pattern + 标题）、本次新增/更新的测试资产路径。
+- 只写 `account_id` / workspace slug，**禁止**密码、token、Cookie。
+
+## Must not
+
+- 用聊天摘要代替 inbox 落盘。
+- 把 inbox 当 evidence（网络 dump 仍走 `artifacts/evidence/<run_id>/`）。

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/apps/dna/dna_payload/.cursor/rules/commit-convention.mdc

@@ -1,7 +1,7 @@
 ---
 description: Commits must follow Conventional Commits with a layer-aligned scope; the declared scope must cover the layers actually changed. Single source of truth is docs/spec/commit-convention.md.
 alwaysApply: true
-version: 1.0.0
+version: 1.1.0
 ---
 
 # 提交规范（Conventional Commits + 六层 scope）
@@ -12,7 +12,8 @@ version: 1.0.0
 - `type` ∈ `feat|fix|refactor|docs|test|perf|chore|build|ci|style|revert`。
 - `scope` 用**对齐六层/资产类别**的值：`assets / apps / packages / api_objects /
   page_objects / action_words / tests / docs / rules / skills / agents / hooks /
-  init_repo / index`（多层用逗号分隔，如 `feat(apps,packages): ...`）。
+  init_repo / index / dogfood`（多层用逗号分隔，如 `feat(apps,packages): ...`；
+  `dogfood/**` 一律用 `dogfood`）。
 - **scope 必须覆盖本次真实改动涉及的层**（`packages` 是三个子资产层的上位 scope）。
 
 一眼可读优先：让人从提交信息就看出"更新了 assets、新增了 apps、录制了新的 api_objects"等。

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/apps/dna/dna_payload/.cursor/rules/index-hygiene.mdc

@@ -1,13 +1,14 @@
 ---
 description: Keep the repo-level INDEX.md current and require managed assets to leave a changelog trail; index is the discovery entry for humans and the LLM
-globs: assets/**,packages/api_objects/**,packages/page_objects/**,apps/**,tuner_testkit/apps/**
+globs: assets/**,packages/api_objects/**,packages/page_objects/**,apps/**,tuner_testkit/apps/**,dogfood/assets/**,dogfood/packages/**,dogfood/apps/**,dogfood/INDEX.project.md
 alwaysApply: false
-version: 1.1.3
+version: 1.2.0
 ---
 
 # index-hygiene — 索引与留痕纪律
 
 根 `INDEX.md` 是**平台**能力地图（发现入口）。若存在 `INDEX.project.md`，那是试验田 / 下游项目仓的**业务资产**地图；两份索引都必须与各自职责范围内的仓库状态一致。
+平台仓内的 `dogfood/` 是用 scaffold 生成的 workspace，它的业务地图是 `dogfood/INDEX.project.md`。
 
 ## 留痕（changelog trail）
 

tuner_testkit-4.4.0/tuner_testkit/apps/dna/dna_payload/.cursor/skills/analyze-mcp-network/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: analyze-mcp-network
+version: 1.0.0
+description: Turn a persisted artifacts/evidence/<run_id>/network.jsonl into a unique method+path route table (JSON) for freeze-api-objects. Prefer tuner-evidence routes (deterministic). Use after explore-sut or run-feature-playwright-mcp. Do not invent routes that are not in the JSONL.
+---
+
+# Analyze MCP network evidence
+
+## Scope
+
+- **Primary goal**: list freeze candidates from on-disk evidence.
+- **Write scope**: none (read-only). Optionally paste the JSON into the freeze handoff.
+- **Must follow**: `docs/spec/bdd-run-gherkin-in-playwrightMCP.md` sanitizer — if the JSONL still contains Cookie/Authorization, stop and re-run `tuner-evidence persist`.
+
+## Steps
+
+1. Confirm `artifacts/evidence/<run_id>/network.jsonl` exists.
+2. Run (stdout is JSON):
+
+```bash
+uv run python -m tuner_testkit.apps.evidence routes --run-id <run_id>
+```
+
+3. Hand the `routes[]` list to `freeze-api-objects`. Skip static/HTML. Skip `POST /api/sign-in/` (password body) unless the user explicitly wants a login API asset **without** persisting credentials.
+4. For slug paths that `normalize_path` left as literals (e.g. `/api/workspaces/tuner/...`), freeze with `{workspace_slug}` and tell callers to `set_path`.
+
+## Hard rules
+
+- Do not re-fetch live traffic here.
+- Do not write api_objects in this skill.

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/apps/dna/dna_payload/.cursor/skills/derive-design-knowledge/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: derive-design-knowledge
-version: 0.1.0
+version: 0.2.0
 description: Compile assets/design/<app>/<route-slug>.md from open evidence channels (MCP network, DDL, SUT source, optional logs). Schema is docs/spec/design-knowledge-syntax.md v0.1 (draft). Use after an explore session or API freeze when DB effects must ground assertions. Do not invent tables that are not in DDL or source.
 ---
 
@@ -19,9 +19,10 @@ description: Compile assets/design/<app>/<route-slug>.md from open evidence chan
 2. For each captured **non-static mutating** route (POST/PUT/PATCH/DELETE):
    - Draft front-matter (`confidence`: `observed` only if DB/log proved it; else `inferred`).
    - Fill `writes` / `noise` / `reads` from the **highest quality channel available**:
-     1. source (models/views/serializers)
-     2. SQL logs / DB diff
-     3. inference from response body + DDL names
+   1. source (models/views/serializers) — see `.cursor/agents/sut-source-to-design.md`
+   2. SQL logs / DB diff
+   3. inference from response body + DDL names
+   - If source names a table that is not in `assets/ddl`, dump it (`tuner-dump-ddl`) before writing `writes`.
    - Skip `operation_log` / `*_activities` / audit tables as `noise` unless the user says they are the assertion target.
 3. Every `writes` row must cite evidence or a source path in `## notes`.
 4. If the v0.1 schema cannot express something (multi-API button, external side effects), write it under `## notes` and do **not** invent new top-level keys yet — the draft must be stress-tested first.

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/apps/dna/dna_payload/.cursor/skills/explore-sut/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: explore-sut
-version: 1.0.0
+version: 1.2.0
 description: Explore-first Playwright MCP session against a live SUT. Produces sanitized artifacts/evidence/<run_id>/ plus assets/explore capability notes. Use when learning a web SUT, mapping pages/buttons, or gathering evidence before any .feature exists. Do NOT use when the user already has a feature to implement — use run-feature-playwright-mcp instead.
 ---
 
@@ -23,9 +23,23 @@ description: Explore-first Playwright MCP session against a live SUT. Produces s
 ## Steps
 
 1. Read `INDEX.md` and `INDEX.project.md` if present. Note base URLs from `config`.
+   Load login from **`data/sut-accounts.local.yaml`** if it exists; else
+   `config/env_local.py` `TEST_ACCOUNT`. Copy `data/sut-accounts.example.yaml`
+   when neither exists and **stop**. Never write the password into evidence,
+   explore notes, inbox, or git.
 2. Pick a **vertical slice** (e.g. workspace → project → issue), not a full-site crawl.
 3. Navigate with Playwright MCP. After each meaningful action, dump network + snapshot.
-4. Persist:
+4. Persist with **`tuner-evidence persist`** (do not leave captures only in chat):
+
+```bash
+uv run python -m tuner_testkit.apps.evidence persist \
+  --run-id YYYYMMDDTHHMMSSZ-<slice> \
+  --scenario explore:<intent> \
+  --network captures.jsonl \
+  --intent "short vertical-slice intent"
+```
+
+   Manual fallback (same files):
    - `artifacts/evidence/<run_id>/run_summary.md`
    - `artifacts/evidence/<run_id>/network.jsonl` (sanitized)
    - optional `actions.jsonl` / `snapshots/`
@@ -35,11 +49,11 @@ description: Explore-first Playwright MCP session against a live SUT. Produces s
    - primary actions (button labels)
    - APIs observed (method + path only)
    - blockers / i18n / env notes
-6. Stop. Do **not** freeze objects in this skill — tell the caller which run_id to freeze.
+6. Stop. Next: `tuner-evidence routes --run-id …` then freeze / derive-design / author feature.
 
 ## Output checklist
 
 - `run_id` and evidence directory exist.
 - Sanitizer applied statement in `run_summary.md`.
 - Explore note cites `evidence`.
-- Next-step suggestion: freeze / derive-design / author feature.
+- Next-step: `tuner-evidence routes` then freeze / derive-design / author feature.

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/apps/dna/dna_payload/.cursor/skills/freeze-api-objects/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: freeze-api-objects
-version: 1.0.0
+version: 1.1.0
 description: Freezes sanitized Playwright MCP network captures into route-aligned, deduped API Objects under packages/api_objects/ following api-objects-syntax.md and bdd-run-gherkin-in-playwrightMCP.md. Use when creating/updating APIModel assets.
 ---
 
@@ -72,4 +72,5 @@ description: Freezes sanitized Playwright MCP network captures into route-aligne
 - No forbidden header keys or raw tokens in file content.
 - No host in APIModel path/url.
 - No scenario-specific constants asserted in APIModel.
-- File path follows route-tree naming and versioning: `<METHOD>.v<MAJOR>.py`.
+- Skip `POST /api/sign-in/` (and password-bearing login routes) unless explicitly required; never persist the password body.
+- If the path contains a workspace/org **slug**, freeze `{workspace_slug}` (not the live slug) and document `set_path`..

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/apps/dna/dna_payload/.cursor/skills/run-feature-playwright-mcp/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: run-feature-playwright-mcp
-version: 1.1.0
+version: 1.2.0
 description: Runs behave Gherkin scenarios (or records an explore session) via Playwright MCP with Run→Capture→Freeze workflow and strict sanitization. Evidence always lands under artifacts/evidence/<run_id>/. Do NOT require this skill when the user explicitly requests pytest-only work with no MCP capture need.
 ---
 
@@ -49,6 +49,7 @@ description: Runs behave Gherkin scenarios (or records an explore session) via P
   - sanitizer applied statement
 - **`artifacts/evidence/<run_id>/network.jsonl`** (required, sanitized):
   - one capture per request (see spec minimum fields)
+  - Prefer writing it via `tuner-evidence persist --network captures.jsonl` so the sanitizer is deterministic.
 - **`artifacts/evidence/<run_id>/actions.jsonl`** / `snapshots/` (optional)
 
 ## Verification checklist (must include in result)

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/apps/dna/dna_payload/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- version: 1.3.0 -->
+<!-- version: 1.5.0 -->
 # AGENTS — 平台总入口（轻量 DM）
 
 > 本文件是"repo as a platform"的**稳定世界观**：只写不常变的分层结构与角色。
@@ -21,7 +21,7 @@
 | 测试层 | `tests/` | 自动化测试代码（behave `features/` + `pytest/`）。 | behave / pytest |
 | 文档层 | `docs/` | 仓库使用说明与规范（`docs/spec/**`）。 | 只读 |
 
-配套：`config/`（环境/数据源）、`.cursor/`（AI 组件，见下）、`artifacts/`·`logs/`（运行产出；MCP evidence 落 `artifacts/evidence/<run_id>/`）。
+配套：`config/`（环境/数据源）、`.cursor/`（AI 组件，见下）、`artifacts/`·`logs/`（运行产出；MCP evidence 落 `artifacts/evidence/<run_id>/`；agent 任务记录落 `artifacts/inbox/`）。SUT 登录本机文件：`data/sut-accounts.local.yaml`（gitignore）。
 
 ## 2. 三角色
 
@@ -43,7 +43,7 @@
 ```mermaid
 flowchart TD
   Start[任务到达] --> Q{任务类型?}
-  Q -->|"学习被测系统 / 探索式测试"| Learn["SUT 自学习\ndocs/spec/sut-self-learning.md"]
+  Q -->|"学习被测系统 / 探索式测试"| Learn["SUT 自学习编排\n.cursor/agents/sut-self-learning.md"]
   Q -->|"业务 UI/API 流自动化"| BDD["BDD 资产流水线（下半程）\n.cursor/agents/bdd-asset-pipeline.md"]
   Q -->|"明确要求 pytest / 性能 / DB 核对"| Pytest["pytest 路径\n复用 tuner_testkit + packages，不产出 .feature"]
   Q -->|"需要一个新的独立工具"| App["create-app skill\napps-authoring / apps-handover 规则"]
@@ -52,7 +52,7 @@ flowchart TD
   Q -->|"读/策展/索引知识"| Idx["查 INDEX.md + maintain-index skill"]
 ```
 
-- **学习被测系统** → `docs/spec/sut-self-learning.md`（explore-first：能力清单 + design 知识；证据来源开放、design 产物收敛）。
+- **学习被测系统** → `.cursor/agents/sut-self-learning.md`（编排 explore → freeze → design；规格 `docs/spec/sut-self-learning.md`；任务 log 见 `docs/spec/agent-task-log.md`）。
 - **业务 UI/API 流** → `.cursor/agents/bdd-asset-pipeline.md`（自学习的**下半程**；内部含三门禁，仅在此分支生效）。
 - **明确 pytest** → 直接写 pytest，复用 `tuner_testkit` 与本仓 `packages/**` 业务资产，不要为满足分层而硬造 Gherkin。
 - **造工具** → `create-app` skill；工具做好按 `apps-handover.mdc` 补交接文档。证据通道（日志/DB 日志取数）也落 `apps/`，遵守 CLI + JSON 输出约定。
@@ -65,11 +65,14 @@ flowchart TD
 - 不得将 token / cookie / Authorization / 密码 / session 等敏感信息写入仓库（含 capture 与 api_objects）。
 - 提交遵循 Conventional Commits + 六层 scope，见 `docs/spec/commit-convention.md`（`commit-msg` hook 会校验）。
 - DB 只走 `tuner_testkit.db`，日志只走 `tuner_testkit.logging`（见对应 rule）。
-- 密钥只放本机 `config/env_local.py` 或环境变量，**任何分支都不得提交**。多套 prd/uat/dev 写在 `env_local.ENVIRONMENTS` 里，用 `python -m tuner_testkit.config use <name>` 切换（或 `TUNER_ENV`）。
+- 密钥只放本机 `config/env_local.py`、`data/**/*.local.yaml` 或环境变量，**任何分支都不得提交**。多套 prd/uat/dev 写在 `env_local.ENVIRONMENTS` 里，用 `python -m tuner_testkit.config use <name>` 切换（或 `TUNER_ENV`）。探索账号优先 `data/sut-accounts.local.yaml`（模板 `data/sut-accounts.example.yaml`）。
 
 ## 6. 分支与下游仓
 
 本公开仓只维护**平台**：`tuner_testkit/`、`.cursor/**`、`docs/spec/**`、`INDEX.md`。
+**本仓不是 workspace**：真正的个人 workspace 是 `tuner-init scaffold` 生成的下游仓。仓内 `dogfood/`
+是用同一 scaffold 生成的 workspace 示范（被测系统 = 平台本身），存放路线图、验收剧本与活文档；
+它是 uv workspace 成员，不带自己的 `.cursor/`（根 DNA 覆盖全树），提交 scope 用 `dogfood`。
 
 | 分支 | 职责 | 谁改 |
 | --- | --- | --- |

{tuner_testkit-4.2.0 → tuner_testkit-4.4.0}/tuner_testkit/apps/dna/dna_payload/MANIFEST.txt

@@ -1,5 +1,5 @@
 {
-  "files": 47,
+  "files": 52,
   "paths": [
     ".cursor/rules",
     ".cursor/skills",