diff --git a/evidence/world_class/README.md b/evidence/world_class/README.md index f50106a9..91c6951f 100644 --- a/evidence/world_class/README.md +++ b/evidence/world_class/README.md @@ -29,4 +29,4 @@ The submission kit command creates editable JSON drafts plus a local README for The submission review command renders a read-only queue that compares valid packets with the source evidence checks and current ledger state. It is for reviewer triage only; it does not accept evidence or make the world-class claim true. -Accepted intake means "ready for ledger review", not "world-class complete". The ledger remains the source of truth for `ready_to_claim_world_class`. +Accepted intake means "ready for ledger review", not evidence that the final public claim is ready. The ledger remains the source of truth for `ready_to_claim_world_class`. diff --git a/registry/index.json b/registry/index.json index bc955771..a2efa714 100644 --- a/registry/index.json +++ b/registry/index.json @@ -16,7 +16,7 @@ "vscode" ], "package_metadata": "registry/packages/yao-meta-skill.json", - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" } ] } diff --git a/registry/packages/yao-meta-skill.json b/registry/packages/yao-meta-skill.json index 09f5658c..80404906 100644 --- a/registry/packages/yao-meta-skill.json +++ b/registry/packages/yao-meta-skill.json @@ -16,8 +16,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0", - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, "compatibility": { "openai": "pass", @@ -48,7 +48,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" diff --git a/reports/output_execution_runs.json b/reports/output_execution_runs.json index 77811ab2..44331d08 100644 --- a/reports/output_execution_runs.json +++ b/reports/output_execution_runs.json @@ -34,7 +34,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 26.84, + "duration_ms": 26.69, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -62,7 +62,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 25.92, + "duration_ms": 26.18, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -85,7 +85,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 26.03, + "duration_ms": 25.93, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -113,7 +113,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 27.98, + "duration_ms": 28.54, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -136,7 +136,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 29.38, + "duration_ms": 29.22, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -164,7 +164,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 27.69, + "duration_ms": 27.87, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -214,7 +214,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 25.88, + "duration_ms": 26.26, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -237,7 +237,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 25.66, + "duration_ms": 26.17, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -266,7 +266,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 26.15, + "duration_ms": 25.94, "provider": "local-output-eval-runner", "model": "", "usage": { diff --git a/reports/output_execution_runs.md b/reports/output_execution_runs.md index f528993d..2b9b7689 100644 --- a/reports/output_execution_runs.md +++ b/reports/output_execution_runs.md @@ -23,16 +23,16 @@ Command runner evidence is present. This proves the eval harness executed an ext | Case | Variant | Mode | Model | Duration ms | Tokens | Score | Status | | --- | --- | --- | --- | ---: | ---: | ---: | --- | -| skill-package-contract | baseline | command | local-output-eval-runner | 26.84 | 33 | 0.0 | pass | -| skill-package-contract | with_skill | command | local-output-eval-runner | 25.92 | 73 | 100.0 | pass | -| output-eval-expectation | baseline | command | local-output-eval-runner | 26.03 | 36 | 0.0 | pass | -| output-eval-expectation | with_skill | command | local-output-eval-runner | 27.98 | 80 | 100.0 | pass | -| ir-before-packaging | baseline | command | local-output-eval-runner | 29.38 | 33 | 0.0 | pass | -| ir-before-packaging | with_skill | command | local-output-eval-runner | 27.69 | 80 | 100.0 | pass | +| skill-package-contract | baseline | command | local-output-eval-runner | 26.69 | 33 | 0.0 | pass | +| skill-package-contract | with_skill | command | local-output-eval-runner | 26.18 | 73 | 100.0 | pass | +| output-eval-expectation | baseline | command | local-output-eval-runner | 25.93 | 36 | 0.0 | pass | +| output-eval-expectation | with_skill | command | local-output-eval-runner | 28.54 | 80 | 100.0 | pass | +| ir-before-packaging | baseline | command | local-output-eval-runner | 29.22 | 33 | 0.0 | pass | +| ir-before-packaging | with_skill | command | local-output-eval-runner | 27.87 | 80 | 100.0 | pass | | near-neighbor-boundary | baseline | command | local-output-eval-runner | 26.17 | 36 | 0.0 | pass | -| near-neighbor-boundary | with_skill | command | local-output-eval-runner | 25.88 | 65 | 100.0 | pass | -| file-backed-governed-package | baseline | command | local-output-eval-runner | 25.66 | 37 | 0.0 | pass | -| file-backed-governed-package | with_skill | command | local-output-eval-runner | 26.15 | 98 | 100.0 | pass | +| near-neighbor-boundary | with_skill | command | local-output-eval-runner | 26.26 | 65 | 100.0 | pass | +| file-backed-governed-package | baseline | command | local-output-eval-runner | 26.17 | 37 | 0.0 | pass | +| file-backed-governed-package | with_skill | command | local-output-eval-runner | 25.94 | 98 | 100.0 | pass | ## Next Fixes diff --git a/reports/package_verification.json b/reports/package_verification.json index c2436a6d..b092c9fc 100644 --- a/reports/package_verification.json +++ b/reports/package_verification.json @@ -8,7 +8,7 @@ "target_count": 4, "adapter_count": 4, "archive_present": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "archive_entry_count": 617, "failure_count": 0, "warning_count": 0 diff --git a/reports/package_verification.md b/reports/package_verification.md index 712a6465..2db01c6b 100644 --- a/reports/package_verification.md +++ b/reports/package_verification.md @@ -4,7 +4,7 @@ - Package directory: `dist` - Targets: `4 / 4` adapters present - Archive present: `True` -- Archive SHA256: `c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e` +- Archive SHA256: `6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e` - Failures: `0` - Warnings: `0` diff --git a/reports/registry_audit.json b/reports/registry_audit.json index 9a36d77c..53c9377e 100644 --- a/reports/registry_audit.json +++ b/reports/registry_audit.json @@ -21,8 +21,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0", - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, "compatibility": { "openai": "pass", @@ -53,7 +53,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" @@ -78,7 +78,7 @@ "vscode" ], "package_metadata": "registry/packages/yao-meta-skill.json", - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" } ] }, diff --git a/reports/registry_audit.md b/reports/registry_audit.md index 29bb1afe..ae4f8137 100644 --- a/reports/registry_audit.md +++ b/reports/registry_audit.md @@ -6,8 +6,8 @@ - Maturity: `governed` - Owner: `Yao Team` - License: `MIT` -- Package SHA256: `365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0` -- Archive SHA256: `c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e` +- Package SHA256: `30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e` +- Archive SHA256: `6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e` - Install simulated: `True` ## Compatibility diff --git a/reports/review-studio.html b/reports/review-studio.html index 5a7ac7e9..6a141d0c 100644 --- a/reports/review-studio.html +++ b/reports/review-studio.html @@ -676,7 +676,7 @@

核心指标

-
Skill IR2.0.0

5 targets in platform-neutral contract

Compiler5/5

target contracts compiled from Skill IR

Output Delta100.0

5 cases; 1 file-backed

Exec Runs10

command 10; model 0; recorded 0

Blind A/B5

review pairs hide baseline vs with-skill labels

Review Kit0/5

pending 5; answer key hidden

Review A/B0/5

adjudication decisions; pending 5

Public Claimblocked

4 blockers; local reproducible true

Blueprint21/21

2.0 coverage; extensions partial 0, planned 0; evidence pending 4

Runtime5/5

target conformance pass rate

Perm Probe4/4

0 native; 4 installer-enforced

Trust0

110 scripts scanned; secrets found

Py Compat0

176 files scanned for Python 3.11

Arch Debt0

899 largest lines; 8 watchlist; 64 CLI handlers; 18 in entrypoint

Atlas5

12 scanned skills; route collisions

Driftlow

1 metadata events; 0 missed triggers

Waivers0

0 gates covered; human risk decisions

Intake4/4

0 valid submissions; 0 invalid

Claim Guard0

150 public surfaces scanned

Notes0/0

0 open blocker annotations

Registry1.1.0

5 targets; MIT license

Archivepass

617 zip entries; package verification

Installpass

4 adapters; 12 permissions enforced; 0 permission failures

Upgrademinor

declared minor; 0 breaking changes

+
Skill IR2.0.0

5 targets in platform-neutral contract

Compiler5/5

target contracts compiled from Skill IR

Output Delta100.0

5 cases; 1 file-backed

Exec Runs10

command 10; model 0; recorded 0

Blind A/B5

review pairs hide baseline vs with-skill labels

Review Kit0/5

pending 5; answer key hidden

Review A/B0/5

adjudication decisions; pending 5

Public Claimblocked

4 blockers; local reproducible true

Blueprint21/21

2.0 coverage; extensions partial 0, planned 0; evidence pending 4

Runtime5/5

target conformance pass rate

Perm Probe4/4

0 native; 4 installer-enforced

Trust0

110 scripts scanned; secrets found

Py Compat0

176 files scanned for Python 3.11

Arch Debt0

899 largest lines; 8 watchlist; 64 CLI handlers; 18 in entrypoint

Atlas5

12 scanned skills; route collisions

Driftlow

1 metadata events; 0 missed triggers

Waivers0

0 gates covered; human risk decisions

Intake4/4

0 valid submissions; 0 invalid

Claim Guard0

173 public surfaces scanned

Notes0/0

0 open blocker annotations

Registry1.1.0

5 targets; MIT license

Archivepass

617 zip entries; package verification

Installpass

4 adapters; 12 permissions enforced; 0 permission failures

Upgrademinor

declared minor; 0 breaking changes

@@ -748,7 +748,7 @@
-

信任报告

Secret
0
脚本数
110
网络脚本
3
Help 失败
0
包体哈希
365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0
+

信任报告

Secret
0
脚本数
110
网络脚本
3
Help 失败
0
包体哈希
30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e

安全边界

高风险 secret、远程 inline execution、缺失依赖策略或无法解释的脚本接口应阻断 governed release。

@@ -821,18 +821,18 @@
-

声明守卫

台账可声明
台账待补
4
声明面
150
违规数
0
Overclaim Guard Active
+

声明守卫

台账可声明
台账待补
4
声明面
173
违规数
0
Overclaim Guard Active

声明边界

claim guard 扫描 README、docs 和 reports 中的完成态表述;ledger 未 ready 时,任何英文完成断言、true 状态声明或中文完成态都会阻断发布审查。

注册审计

yao-meta-skill 1.1.0; 6/6 compatibility entries pass; install pass with 4 adapters; installer permissions 12 enforced / 0 failures

-

包体元数据

名称
yao-meta-skill
版本
1.1.0
Maturity
governed
Owner
Yao Team
License
MIT
信任级别
local
目标平台
openai, claude, generic, agent-skills-compatible, vscode
兼容通过
6/6
归档哈希
c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e
+

包体元数据

名称
yao-meta-skill
版本
1.1.0
Maturity
governed
Owner
Yao Team
License
MIT
信任级别
local
目标平台
openai, claude, generic, agent-skills-compatible, vscode
兼容通过
6/6
归档哈希
6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e

发布路线

0 promote; 3 keep current; 0 blocked; upgrade minor declared / minor recommended

-

包体验证

目标数
4
Adapter
4
归档存在
Zip 条目
617
失败数
0
警告数
0
归档哈希
c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e
+

包体验证

目标数
4
Adapter
4
归档存在
Zip 条目
617
失败数
0
警告数
0
归档哈希
6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e
diff --git a/reports/review-studio.json b/reports/review-studio.json index 01b4f771..23b99723 100644 --- a/reports/review-studio.json +++ b/reports/review-studio.json @@ -1809,7 +1809,7 @@ "interactive_script_count": 0, "package_hash_scope": "source-contract-without-generated-reports", "package_hash_file_count": 197, - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" }, "skill_atlas": { "skill_count": 12, @@ -1847,8 +1847,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0", - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, "compatibility": { "openai": "pass", @@ -1879,7 +1879,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" @@ -1895,7 +1895,7 @@ "target_count": 4, "adapter_count": 4, "archive_present": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "archive_entry_count": 617, "failure_count": 0, "warning_count": 0 @@ -1974,12 +1974,12 @@ { "field": "archive_sha256", "from": "", - "to": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "to": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, { "field": "package_sha256", "from": "0000000000000000000000000000000000000000000000000000000000000000", - "to": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "to": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" } ] }, @@ -4346,7 +4346,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 26.84, + "duration_ms": 26.69, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -4374,7 +4374,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 25.92, + "duration_ms": 26.18, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -4397,7 +4397,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 26.03, + "duration_ms": 25.93, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -4425,7 +4425,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 27.98, + "duration_ms": 28.54, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -4448,7 +4448,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 29.38, + "duration_ms": 29.22, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -4476,7 +4476,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 27.69, + "duration_ms": 27.87, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -4526,7 +4526,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 25.88, + "duration_ms": 26.26, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -4549,7 +4549,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 25.66, + "duration_ms": 26.17, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -4578,7 +4578,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 26.15, + "duration_ms": 25.94, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -11412,7 +11412,7 @@ "interactive_script_count": 0, "package_hash_scope": "source-contract-without-generated-reports", "package_hash_file_count": 197, - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" }, "failures": [], "warnings": [], @@ -19676,8 +19676,10 @@ "summary": { "ledger_ready_to_claim_world_class": false, "ledger_pending_count": 4, - "claim_surface_count": 150, - "json_claim_surface_count": 72, + "claim_surface_count": 173, + "json_claim_surface_count": 85, + "metadata_claim_surface_count": 86, + "package_claim_surface_count": 17, "violation_count": 0, "overclaim_guard_active": true, "decision": "claim-guard-pass-evidence-pending" @@ -19718,6 +19720,38 @@ "path": "SKILL.md", "violation_count": 0 }, + { + "path": "agents/interface.yaml", + "violation_count": 0 + }, + { + "path": "dist/manifest.json", + "violation_count": 0 + }, + { + "path": "dist/targets/claude/README.md", + "violation_count": 0 + }, + { + "path": "dist/targets/claude/adapter.json", + "violation_count": 0 + }, + { + "path": "dist/targets/generic/adapter.json", + "violation_count": 0 + }, + { + "path": "dist/targets/openai/adapter.json", + "violation_count": 0 + }, + { + "path": "dist/targets/vscode/README.md", + "violation_count": 0 + }, + { + "path": "dist/targets/vscode/adapter.json", + "violation_count": 0 + }, { "path": "docs/README.fr-FR.md", "violation_count": 0 @@ -19738,6 +19772,34 @@ "path": "docs/migration-v2.md", "violation_count": 0 }, + { + "path": "evidence/world_class/README.md", + "violation_count": 0 + }, + { + "path": "evidence/world_class/intake.schema.json", + "violation_count": 0 + }, + { + "path": "evidence/world_class/templates/human-adjudication.intake.json", + "violation_count": 0 + }, + { + "path": "evidence/world_class/templates/native-client-telemetry.intake.json", + "violation_count": 0 + }, + { + "path": "evidence/world_class/templates/native-permission-enforcement.intake.json", + "violation_count": 0 + }, + { + "path": "evidence/world_class/templates/provider-holdout.intake.json", + "violation_count": 0 + }, + { + "path": "manifest.json", + "violation_count": 0 + }, { "path": "registry/examples/yao-meta-skill-1.0.0.json", "violation_count": 0 @@ -20302,6 +20364,38 @@ "path": "reports/yao-deploy-bridge-skill-research-plan.md", "violation_count": 0 }, + { + "path": "security/dependency_policy.md", + "violation_count": 0 + }, + { + "path": "security/network_policy.json", + "violation_count": 0 + }, + { + "path": "security/network_policy.md", + "violation_count": 0 + }, + { + "path": "security/permission_policy.json", + "violation_count": 0 + }, + { + "path": "security/permission_policy.md", + "violation_count": 0 + }, + { + "path": "security/script_policy.md", + "violation_count": 0 + }, + { + "path": "security/secret_policy.md", + "violation_count": 0 + }, + { + "path": "security/trust_policy.md", + "violation_count": 0 + }, { "path": "skill-ir/examples/yao-meta-skill.json", "violation_count": 0 @@ -20344,8 +20438,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0", - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, "compatibility": { "openai": "pass", @@ -20376,7 +20470,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" @@ -20401,7 +20495,7 @@ "vscode" ], "package_metadata": "registry/packages/yao-meta-skill.json", - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" } ] }, @@ -20424,7 +20518,7 @@ "target_count": 4, "adapter_count": 4, "archive_present": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "archive_entry_count": 617, "failure_count": 0, "warning_count": 0 @@ -21432,12 +21526,12 @@ { "field": "archive_sha256", "from": "", - "to": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "to": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, { "field": "package_sha256", "from": "0000000000000000000000000000000000000000000000000000000000000000", - "to": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "to": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" } ] }, diff --git a/reports/review-viewer.json b/reports/review-viewer.json index 8d49b7c0..a0a47cc3 100644 --- a/reports/review-viewer.json +++ b/reports/review-viewer.json @@ -1129,7 +1129,7 @@ "interactive_script_count": 0, "package_hash_scope": "source-contract-without-generated-reports", "package_hash_file_count": 197, - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" }, "skill_atlas": { "skill_count": 12, @@ -1167,8 +1167,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0", - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, "compatibility": { "openai": "pass", @@ -1199,7 +1199,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" @@ -1215,7 +1215,7 @@ "target_count": 4, "adapter_count": 4, "archive_present": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "archive_entry_count": 617, "failure_count": 0, "warning_count": 0 @@ -1294,12 +1294,12 @@ { "field": "archive_sha256", "from": "", - "to": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "to": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, { "field": "package_sha256", "from": "0000000000000000000000000000000000000000000000000000000000000000", - "to": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "to": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" } ] }, diff --git a/reports/security_trust_report.json b/reports/security_trust_report.json index 45b6cc89..f2d70b2e 100644 --- a/reports/security_trust_report.json +++ b/reports/security_trust_report.json @@ -23,7 +23,7 @@ "interactive_script_count": 0, "package_hash_scope": "source-contract-without-generated-reports", "package_hash_file_count": 197, - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" }, "failures": [], "warnings": [], diff --git a/reports/security_trust_report.md b/reports/security_trust_report.md index b3870f54..42016f4b 100644 --- a/reports/security_trust_report.md +++ b/reports/security_trust_report.md @@ -16,7 +16,7 @@ - Interactive scripts: `0` - Package hash scope: `source-contract-without-generated-reports` - Package hash files: `197` -- Package SHA256: `365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0` +- Package SHA256: `30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e` ## Failures diff --git a/reports/skill-interpretation.json b/reports/skill-interpretation.json index 70d935bd..3380b3db 100644 --- a/reports/skill-interpretation.json +++ b/reports/skill-interpretation.json @@ -1133,7 +1133,7 @@ "interactive_script_count": 0, "package_hash_scope": "source-contract-without-generated-reports", "package_hash_file_count": 197, - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" }, "skill_atlas": { "skill_count": 12, @@ -1171,8 +1171,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0", - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, "compatibility": { "openai": "pass", @@ -1203,7 +1203,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" @@ -1219,7 +1219,7 @@ "target_count": 4, "adapter_count": 4, "archive_present": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "archive_entry_count": 617, "failure_count": 0, "warning_count": 0 @@ -1298,12 +1298,12 @@ { "field": "archive_sha256", "from": "", - "to": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "to": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, { "field": "package_sha256", "from": "0000000000000000000000000000000000000000000000000000000000000000", - "to": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "to": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" } ] }, diff --git a/reports/skill-overview.json b/reports/skill-overview.json index 110c48cb..7e6d829b 100644 --- a/reports/skill-overview.json +++ b/reports/skill-overview.json @@ -1128,7 +1128,7 @@ "interactive_script_count": 0, "package_hash_scope": "source-contract-without-generated-reports", "package_hash_file_count": 197, - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" }, "skill_atlas": { "skill_count": 12, @@ -1166,8 +1166,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0", - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "package_sha256": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, "compatibility": { "openai": "pass", @@ -1198,7 +1198,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" @@ -1214,7 +1214,7 @@ "target_count": 4, "adapter_count": 4, "archive_present": true, - "archive_sha256": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e", + "archive_sha256": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e", "archive_entry_count": 617, "failure_count": 0, "warning_count": 0 @@ -1293,12 +1293,12 @@ { "field": "archive_sha256", "from": "", - "to": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "to": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, { "field": "package_sha256", "from": "0000000000000000000000000000000000000000000000000000000000000000", - "to": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "to": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" } ] }, diff --git a/reports/upgrade_check.json b/reports/upgrade_check.json index 74c10b3c..d6778ea5 100644 --- a/reports/upgrade_check.json +++ b/reports/upgrade_check.json @@ -70,12 +70,12 @@ { "field": "archive_sha256", "from": "", - "to": "c2e8d9a84e48571f8ba8d054fc462328401f64e8d335ab0078d292041d3ffb2e" + "to": "6c34f2cfa88c7a018cbe02e41c98b41d32d39293b1d1e6c75a7a780d8add3a6e" }, { "field": "package_sha256", "from": "0000000000000000000000000000000000000000000000000000000000000000", - "to": "365c0b0cafd05b0239206f84990741005c3699e1e6be3d82ccbaf903372218a0" + "to": "30502ca01a3d74140f6ad23d9d5fd499a8c80dcd4b8428ad1c9a812d2e3f9b5e" } ] }, diff --git a/reports/world_class_claim_guard.json b/reports/world_class_claim_guard.json index ac7c1087..a541ef6c 100644 --- a/reports/world_class_claim_guard.json +++ b/reports/world_class_claim_guard.json @@ -6,8 +6,10 @@ "summary": { "ledger_ready_to_claim_world_class": false, "ledger_pending_count": 4, - "claim_surface_count": 150, - "json_claim_surface_count": 72, + "claim_surface_count": 173, + "json_claim_surface_count": 85, + "metadata_claim_surface_count": 86, + "package_claim_surface_count": 17, "violation_count": 0, "overclaim_guard_active": true, "decision": "claim-guard-pass-evidence-pending" @@ -48,6 +50,38 @@ "path": "SKILL.md", "violation_count": 0 }, + { + "path": "agents/interface.yaml", + "violation_count": 0 + }, + { + "path": "dist/manifest.json", + "violation_count": 0 + }, + { + "path": "dist/targets/claude/README.md", + "violation_count": 0 + }, + { + "path": "dist/targets/claude/adapter.json", + "violation_count": 0 + }, + { + "path": "dist/targets/generic/adapter.json", + "violation_count": 0 + }, + { + "path": "dist/targets/openai/adapter.json", + "violation_count": 0 + }, + { + "path": "dist/targets/vscode/README.md", + "violation_count": 0 + }, + { + "path": "dist/targets/vscode/adapter.json", + "violation_count": 0 + }, { "path": "docs/README.fr-FR.md", "violation_count": 0 @@ -68,6 +102,34 @@ "path": "docs/migration-v2.md", "violation_count": 0 }, + { + "path": "evidence/world_class/README.md", + "violation_count": 0 + }, + { + "path": "evidence/world_class/intake.schema.json", + "violation_count": 0 + }, + { + "path": "evidence/world_class/templates/human-adjudication.intake.json", + "violation_count": 0 + }, + { + "path": "evidence/world_class/templates/native-client-telemetry.intake.json", + "violation_count": 0 + }, + { + "path": "evidence/world_class/templates/native-permission-enforcement.intake.json", + "violation_count": 0 + }, + { + "path": "evidence/world_class/templates/provider-holdout.intake.json", + "violation_count": 0 + }, + { + "path": "manifest.json", + "violation_count": 0 + }, { "path": "registry/examples/yao-meta-skill-1.0.0.json", "violation_count": 0 @@ -632,6 +694,38 @@ "path": "reports/yao-deploy-bridge-skill-research-plan.md", "violation_count": 0 }, + { + "path": "security/dependency_policy.md", + "violation_count": 0 + }, + { + "path": "security/network_policy.json", + "violation_count": 0 + }, + { + "path": "security/network_policy.md", + "violation_count": 0 + }, + { + "path": "security/permission_policy.json", + "violation_count": 0 + }, + { + "path": "security/permission_policy.md", + "violation_count": 0 + }, + { + "path": "security/script_policy.md", + "violation_count": 0 + }, + { + "path": "security/secret_policy.md", + "violation_count": 0 + }, + { + "path": "security/trust_policy.md", + "violation_count": 0 + }, { "path": "skill-ir/examples/yao-meta-skill.json", "violation_count": 0 diff --git a/reports/world_class_claim_guard.md b/reports/world_class_claim_guard.md index 23af0741..b7d0d554 100644 --- a/reports/world_class_claim_guard.md +++ b/reports/world_class_claim_guard.md @@ -7,12 +7,14 @@ Generated at: `2026-06-16` - decision: `claim-guard-pass-evidence-pending` - ledger ready to claim world-class: `false` - ledger pending evidence: `4` -- claim surfaces scanned: `150` -- JSON claim surfaces scanned: `72` +- claim surfaces scanned: `173` +- JSON claim surfaces scanned: `85` +- metadata claim surfaces scanned: `86` +- package/runtime claim surfaces scanned: `17` - violations: `0` - overclaim guard active: `true` -This guard scans public claim surfaces and machine-readable report metadata for completion language that would contradict the world-class evidence ledger. It allows evidence planning and pending-state language, but blocks completion claims until the ledger is ready. +This guard scans public claim surfaces, machine-readable reports, and package/runtime metadata for completion language that would contradict the world-class evidence ledger. It allows evidence planning and pending-state language, but blocks completion claims until the ledger is ready. ## Violations diff --git a/scripts/render_world_class_claim_guard.py b/scripts/render_world_class_claim_guard.py index 834d7d06..b809caf3 100644 --- a/scripts/render_world_class_claim_guard.py +++ b/scripts/render_world_class_claim_guard.py @@ -66,16 +66,33 @@ def resolve_claim_surface(raw_path: str, skill_dir: Path) -> Path: return path.resolve() +def should_scan_claim_surface(path: Path) -> bool: + parts = path.parts + if "release_snapshots" in parts: + return False + if path.name in {"world_class_claim_guard.md", "world_class_claim_guard.html"}: + return False + if "dist" in parts and "install-simulation" in parts: + return False + if "evidence" in parts and "world_class" in parts and "submissions" in parts: + return False + return True + + def default_claim_surfaces(skill_dir: Path) -> list[Path]: paths: list[Path] = [] - for rel in ["README.md", "SKILL.md"]: + for rel in ["README.md", "SKILL.md", "manifest.json"]: path = skill_dir / rel if path.exists(): paths.append(path) for directory, patterns in [ + (skill_dir / "agents", ["*.yaml", "*.yml", "*.json"]), (skill_dir / "docs", ["*.md"]), + (skill_dir / "evidence" / "world_class", ["*.md", "*.json"]), + (skill_dir / "dist", ["*.json", "*.md"]), (skill_dir / "reports", ["*.md", "*.html", "*.json"]), (skill_dir / "registry", ["*.json"]), + (skill_dir / "security", ["*.md", "*.json"]), (skill_dir / "skill-ir", ["*.json"]), ]: if not directory.exists(): @@ -84,9 +101,7 @@ def default_claim_surfaces(skill_dir: Path) -> list[Path]: paths.extend( path for path in directory.rglob(pattern) - if path.is_file() - and "release_snapshots" not in path.parts - and path.name not in {"world_class_claim_guard.md", "world_class_claim_guard.html"} + if path.is_file() and should_scan_claim_surface(path) ) return sorted(set(paths), key=lambda item: rel_path(item, skill_dir)) @@ -131,6 +146,15 @@ def build_guard(skill_dir: Path, generated_at: str, claim_surfaces: list[Path] | violations.append({"path": rel, **match}) ok = len(violations) == 0 json_surface_count = sum(1 for item in scanned if item["path"].endswith(".json")) + metadata_surface_count = sum( + 1 for item in scanned if item["path"].endswith((".json", ".yaml", ".yml")) + ) + package_surface_count = sum( + 1 + for item in scanned + if item["path"] == "manifest.json" + or item["path"].startswith(("agents/", "dist/", "security/")) + ) return { "schema_version": "1.0", "ok": ok, @@ -141,6 +165,8 @@ def build_guard(skill_dir: Path, generated_at: str, claim_surfaces: list[Path] | "ledger_pending_count": ledger.get("summary", {}).get("pending_count", 0), "claim_surface_count": len(scanned), "json_claim_surface_count": json_surface_count, + "metadata_claim_surface_count": metadata_surface_count, + "package_claim_surface_count": package_surface_count, "violation_count": len(violations), "overclaim_guard_active": True, "decision": ( @@ -180,10 +206,12 @@ def render_markdown(report: dict[str, Any]) -> str: f"- ledger pending evidence: `{summary['ledger_pending_count']}`", f"- claim surfaces scanned: `{summary['claim_surface_count']}`", f"- JSON claim surfaces scanned: `{summary['json_claim_surface_count']}`", + f"- metadata claim surfaces scanned: `{summary['metadata_claim_surface_count']}`", + f"- package/runtime claim surfaces scanned: `{summary['package_claim_surface_count']}`", f"- violations: `{summary['violation_count']}`", f"- overclaim guard active: `{str(summary['overclaim_guard_active']).lower()}`", "", - "This guard scans public claim surfaces and machine-readable report metadata for completion language that would contradict the world-class evidence ledger. It allows evidence planning and pending-state language, but blocks completion claims until the ledger is ready.", + "This guard scans public claim surfaces, machine-readable reports, and package/runtime metadata for completion language that would contradict the world-class evidence ledger. It allows evidence planning and pending-state language, but blocks completion claims until the ledger is ready.", "", "## Violations", "", diff --git a/tests/verify_world_class_claim_guard.py b/tests/verify_world_class_claim_guard.py index 8d39ee63..f9ca1f1e 100644 --- a/tests/verify_world_class_claim_guard.py +++ b/tests/verify_world_class_claim_guard.py @@ -43,15 +43,38 @@ def main() -> None: assert summary["ledger_pending_count"] == 4, summary assert summary["claim_surface_count"] >= 10, summary assert summary["json_claim_surface_count"] >= 10, summary + assert summary["metadata_claim_surface_count"] >= summary["json_claim_surface_count"], summary + assert summary["package_claim_surface_count"] >= 5, summary assert summary["violation_count"] == 0, summary assert summary["overclaim_guard_active"] is True, summary assert any(item["path"] == "README.md" for item in payload["scanned_surfaces"]), payload["scanned_surfaces"] + assert any(item["path"] == "manifest.json" for item in payload["scanned_surfaces"]), payload["scanned_surfaces"] + assert any(item["path"] == "evidence/world_class/README.md" for item in payload["scanned_surfaces"]), payload[ + "scanned_surfaces" + ] + assert any(item["path"] == "agents/interface.yaml" for item in payload["scanned_surfaces"]), payload[ + "scanned_surfaces" + ] + assert any(item["path"] == "dist/manifest.json" for item in payload["scanned_surfaces"]), payload[ + "scanned_surfaces" + ] + assert any(item["path"] == "dist/targets/openai/adapter.json" for item in payload["scanned_surfaces"]), payload[ + "scanned_surfaces" + ] + assert any(item["path"] == "security/permission_policy.json" for item in payload["scanned_surfaces"]), payload[ + "scanned_surfaces" + ] + assert not any( + item["path"].startswith("dist/install-simulation/") for item in payload["scanned_surfaces"] + ), payload["scanned_surfaces"] assert any(item["path"] == "reports/world_class_evidence_ledger.json" for item in payload["scanned_surfaces"]), payload["scanned_surfaces"] markdown = output_md.read_text(encoding="utf-8") assert "World-Class Claim Guard" in markdown, markdown assert "claim-guard-pass-evidence-pending" in markdown, markdown assert "world-class evidence ledger" in markdown, markdown assert "JSON claim surfaces scanned" in markdown, markdown + assert "metadata claim surfaces scanned" in markdown, markdown + assert "package/runtime claim surfaces scanned" in markdown, markdown safe_surface = TMP / "safe.md" safe_surface.write_text("ready to claim world-class: `false`\nworld-class evidence is pending.\n", encoding="utf-8")