## 变更 / Changes
mail-operations 1.0.6 → 1.1.0：补充客户端新增的「标记为垃圾邮件 / 不是垃圾邮件」接口。
Adds the client's new mark-as-junk / not-junk endpoints to
mail-operations (1.0.6 → 1.1.0).
- 「单封邮件操作」表新增两行：Gmail、IMAP 用 `POST …/{id}/spam`、`…/not-spam`，Outlook 用
`POST /outlook/message/spam?id=`、`…/not-spam?id=`。
Two rows in the single-message table.
- 补充使用说明：返回 `result: {id, folder}`；Outlook、IMAP 移动后 `id` 会变；IMAP
没有垃圾邮件文件夹时返回 409
`imap_spam_folder_not_found`，不要重试；「不是垃圾邮件」一次一封；移回收件箱不触发规则。
Usage notes: new id after Outlook/IMAP moves, 409 when an IMAP account
has no junk folder, Not junk one at a time, no rule re-trigger.
- `market.required_client_version` 与 sidecar 的
`compatibility.requiredClientVersion` 同步改为
`10.0.178`。内置技能同步会按它拦截，旧客户端继续使用 1.0.6，不会拿到调用后返回 404 的接口说明。
Client gate raised to 10.0.178 so older clients keep 1.0.6.
- 中文是源语言；英文译文（`translated_by: human`）已人工同步，`source_hash` 用
`translate.py` 的 `compute_source_hash` 重新计算。
zh-CN source and human en-US translation updated together; `source_hash`
recomputed with the repository's own function.
## 合并时机 / Merge timing
客户端实现在 desirecore/desirecore#4205，它依赖 desirecore/desirecore#4195。**请在
#4205 合入、确认随 10.0.178 发布之后再合并本 PR。** 如果实际发布的版本号不是 10.0.178，先把两处
`required_client_version` 改成实际版本再合并。合并后，客户端仓库需要运行 `npm run sync-market`
刷新内置的 `market.zip`。
The client side is desirecore/desirecore#4205 (depends on #4195). Merge
this after #4205 lands and ships in 10.0.178; adjust both version gates
if the release number differs. Afterwards regenerate the client's
bundled `market.zip` with `npm run sync-market`.
## 校验 / Checks
- `validate-i18n.py`：0 error，123 warning（与改动前相同；mail-operations 的两条
license / review evidence 警告原来就有）。
- `validate_catalog_metadata.py --require-complete`：0 error。
- `translate.py --check skills/mail-operations`：en-US 为
human-locked，与源一致。
-
公开信息检查：改动内容只有通用的接口说明，不含任何租户、客户或合作方信息。**未用私有敏感词清单做全量扫描**：本次没有拿到这份清单，合并前请维护者补跑一次。
Public-information review: generic API text only. The private-token scan
was not run because the token list was not available; please run it
before merging.
Upstream health checks could select a different branch ending in `main`,
index internal skills or lowercase reference documents, treat a valid
pinned path as broken after an upstream move, and close the tracking
issue while unpinned or unknown entries remained. Resolve exact refs and
tracked filenames, compare the installed snapshot, and drive issue
decisions from structured results.
Refresh 26 reviewed pointers, pin DingTalk and Matt Pocock collections,
remove the deleted merge-conflict skill, and add the six new public
children with reviewed translations. Synchronize sidecars, observed
release facts, license evidence and external dependency disclosures.
Identical-tree Agent pins and their versions remain unchanged. The
per-entry review is recorded in
`docs/upstream-health-189-remediation.md`.
Validation: 99 unit tests pass; all nine pinned collections reproduce;
catalog/i18n and translation-freshness checks pass; online health checks
all 41 external entries with zero broken, actionable or unknown results.
Existing catalog warnings decrease from 123 to 105 with no new warning
groups. Python/workflow shell syntax and whitespace checks pass.
Closes#189.
## 变更说明 / Description
加载 workforce-optimization 后，隐藏工具 OptimizationEngineCatalog 和
OptimizationEvidenceLedger 仍不可发现，因为 provides.tools 遗漏了它们。本 PR
补齐共用声明，将技能版本提升至 2.9.1，并同步目录 sidecar 的版本与更新日期。中英文正文均不变，共用 frontmatter
对两种语言同时生效。
Loading workforce-optimization leaves OptimizationEngineCatalog and
OptimizationEvidenceLedger unavailable because its provides.tools
declaration omits these hidden tools. Add both declarations, bump the
skill to 2.9.1, and keep the catalog sidecar aligned. Both localized
bodies share this metadata and remain unchanged. Existing external
solver prerequisites and licensing disclosures remain applicable.
## 验证 / Validation
- 隔离 Electron dev：补声明前 EngineCatalog 为
notFound；补声明并刷新、加载技能后，两工具均可发现，EngineCatalog 实际执行成功。EvidenceLedger
仅验证发现，执行由客户端夹具覆盖。
- Isolated Electron dev: EngineCatalog changed from notFound to
discoverable and executable after the declaration update; EvidenceLedger
discovery was verified without writing ledger data.
- Skill i18n validation and strict complete catalog validation: 0
errors, 123 existing metadata warnings.
- Translation freshness check for workforce-optimization: current; both
bodies unchanged.
- git diff --check passed. Changes and collaboration text contain only
reusable tool identifiers and catalog metadata; no private runtime
evidence is included.
此 PR 仅更新 Market 源数据；客户端 bootstrap ZIP 未手工修改。/ This updates Market source
data only; client bootstrap archives are not hand-edited.
Co-authored-by: Yige <a@wyr.me>
## 中文
启用两支审查团队的中英文完整介绍与隐私说明，保留微信支付上游原始版本 `1.0`，市场版本更新为 `1.5.9`。
解决标书介绍与最新 main 的冲突，保留成员默认收纳说明和用户选择优先的行为。同步条目与 canonical 目录的本地化描述，补齐模型服务配置、可用性、处理授权、条款与费用责任，以及前提不满足时停止相关外部调用的规则。
标书团队 `0.2.3` 引用已合并的 [上游 #7](https://github.com/desirecore-agent/biao-shu-lian-he-shen-cha/pull/7)，合同团队 `0.1.40` 引用已合并的 [上游 #51](https://github.com/desirecore-agent/contract-review-team/pull/51)。source、provenance 与 reviewedRef 对齐；成员版本、头像与 `requiredClientVersion: 10.0.178` 保持一致。
本地化字段和原始版本格式所依赖的 desirecore/desirecore#3183 已包含于正式 [v10.0.177](https://github.com/desirecore/desirecore/releases/tag/v10.0.177)。团队自身的 10.0.178 安装要求继续有效。Schema 保持闭集，并明确记录两个分支的本地扩展来源。
验证：84 个市场单元测试通过；完整目录与 i18n、翻译及生成合集新鲜度检查通过，0 错误、123 个既有告警。新增测试覆盖两种 Schema 分支的字段边界和未知属性拒绝。上游静态检查与 11 项收集器回归通过；18 次真实模型回合包含 15 个前提缺失的停止案例和 3 个全部前提确认的正向案例。模型回合验证请求意图和停止信号，未执行完整 Agent Service、市场安装、真实合同或 DOCX 验收。
此前审查意见已处理；Copilot 账户审查额度用尽，最终改动采用人工复核，并遵循仓库已有的检查门禁。
## English
Enable localized full descriptions and privacy disclosures for both review teams, preserve WeChat Pay's original release identifier `1.0`, and advance the Market to `1.5.9`.
Resolve the tender-description conflict against current main while retaining nested member display and user preference precedence. Align entry and canonical localized descriptions, disclose model-service prerequisites and operator responsibilities, and stop affected external calls when prerequisites fail.
Point Tender `0.2.3` and Contract `0.1.40` to the merged revisions from [upstream #7](https://github.com/desirecore-agent/biao-shu-lian-he-shen-cha/pull/7) and [upstream #51](https://github.com/desirecore-agent/contract-review-team/pull/51), keeping source, provenance and reviewed refs aligned. Preserve members, avatars and the separate `10.0.178` installation requirement. The catalog-format dependency shipped in stable v10.0.177; the closed schema documents its deliberate local i18n extension.
Validation: 84 Market unit tests and full catalog/i18n, translation and collection freshness checks pass; zero errors and 123 existing warnings. Upstream static checks and 11 collector regressions pass. Eighteen live model turns include 15 blocked prerequisite cases and three positive controls with all prerequisites confirmed. These turns check request intent and stopping signals; full Agent Service integration, marketplace installation, real-contract acceptance and DOCX acceptance were not performed.
Earlier review findings are addressed. Copilot's account quota is exhausted, so final changes received manual review under the repository's existing check policy.
desirecore/desirecore#3899 把 BrowserAct 的 21 个开发者工具类动作拆到独立工具 BrowserDevtools，它不随本技能注入。技能在工具表后说明：需要时先 DiscoverTools(query="select:BrowserDevtools") 加载，参数与 BrowserAct 相同；查不到说明客户端早于拆分，同样的 action 与参数在 BrowserAct 上调用。写法不依赖客户端版本，所以不设 required_client_version，也不把 BrowserDevtools 加进 provides.tools。
references/browser-tools.md 新增 BrowserDevtools 一节，cdp.raw 的已知边界、错误处理与调用链路同步更新。技能版本 3.4.5，sidecar 的 release.version 与 catalogUpdatedAt 同步，i18n source_hash 重算。
English: Point web-access's developer-tool actions at BrowserDevtools, the
tool split out of BrowserAct in desirecore/desirecore#3899. The skill loads
it on demand through DiscoverTools and falls back to the same action on
BrowserAct for clients that predate the split, so no client version floor
is needed. Bump to 3.4.5 with synced sidecar metadata and a recomputed i18n
source hash.
验证 / Validation: i18n validation and catalog metadata checks report zero
errors (existing repository warnings remain); translation freshness check
passes.
更新标书联合审查与合同审查团队的已审核发布指针，分别对应 0.2.2 和 0.1.39，并补充成员默认收纳、用户显示偏好优先的说明。
两条 entry 与目录元数据统一要求 DesireCore 10.0.178 或更新且支持 `team.json.memberDisplay`
的客户端。目录可提前发布；10.0.177（包括仍标为该版本的开发构建）会在市场安装前提示升级。该版本下限不表示兼容客户端已经发布。
同时将 Market 版本提升到 1.5.8，更新目录日期及两个 Agent
管理技能的目录更新时间。成员名册、成员锁版本和头像映射保持与上游发布一致。
验证：完整目录和 i18n 校验零错误、无新增警告；翻译新鲜度检查通过；最新团队配置通过当前 schema 校验，旧版 schema
拒绝该字段；安装版本门控确认拦截 10.0.177。
English: Update the reviewed Tender Review Team and Contract Review Team
pointers to 0.2.2 and 0.1.39. Document the nested member display default
and explicit user preferences. Set the client installation floor to
10.0.178 with memberDisplay support so older clients receive an upgrade
notice before importing incompatible manifests. This floor does not
claim that a compatible release is already available. Bump the catalog
to 1.5.8 and correct catalog timestamps. Catalog, localization,
source-manifest and version-gate checks pass with no new warnings.
## Summary / 摘要
- Add a pinned Market pointer for the upstream `browser-use/video-use`
skill, with English and Chinese discovery text.
- Add catalog metadata for its MIT license, source provenance,
Python/ffmpeg prerequisites, and ElevenLabs Scribe API key and
usage-cost requirement.
- Keep the listing discovery-only until installation and governance
review are completed.
- Add the entry to Market statistics. No upstream skill code is
vendored.
- 新增固定到上游提交的 `browser-use/video-use` 市场入口及中英文介绍。
- 补充 MIT 许可、来源、Python/ffmpeg 前置条件，以及 ElevenLabs Scribe 密钥和可能产生的 API 费用。
- 完成安装与治理审查前，条目标记为仅供发现。
- 更新 Market 条目统计，不复制上游技能代码。
## Validation / 校验
- `uv run scripts/i18n/validate-i18n.py skills/video-use` — passed with
0 errors (existing catalog warnings remain).
- `uv run scripts/catalog/validate_catalog_metadata.py
--require-complete` — passed with 0 errors.
- `uv run scripts/i18n/translate.py --check` — passed.
- `git diff --check` — passed.
## 中文
补齐已有 owner 与已锁定上游内容可证明的许可证、技能类型和收录版本。保留 Anthropic Source Available
和其他附加条件，不把所有内容统一标为 MIT，不提升 listing-only 的安装准入。
README 保留最新的双语结构及以 manifest 为准的数量口径，增加静态目录不存访问量、下载量、评分或 Stars 的边界。
发布兼容性：**本 PR 不包含**两支团队新增的本地化字段，也不包含微信支付 `latestVersion:
1.0`；旧客户端会拒绝这些新字段，另以待发布 PR 保留，等匹配客户端发布后再合并。
验证：47 项目录校验测试、19 项 i18n 测试、5 项合集生成测试通过；完整目录/i18n/翻译新鲜度检查通过，6
个固定来源合集的生成检查通过，2 个浮动来源按既有规则明确跳过。发现并修复了生成器在 Windows 使用反斜杠造成的误报：输出改为 POSIX
路径，比较规则不放宽、不重写合集数据。
## English
Fill only license, type and listed-release facts supported by existing
owners or pinned upstream content. Preserve custom license restrictions
and acquisition eligibility. Keep the current bilingual README and
manifest-derived inventory; do not author usage analytics.
This PR deliberately excludes localized team fields and the two-part
WeChat Pay version that older clients reject. Those changes remain
pending a compatible client release.
Validation passes: 47 catalog-validator tests, 19 i18n tests, five
collection-generator tests, complete catalog and translation checks, and
generated inventory checks for six pinned collections. Two mutable
sources remain explicitly skipped. Fix Windows-generated path separators
without weakening comparison or changing declared children.
## 变更 / Changes
新增 Control 1.4.0 中英文市场安装指南及 README 应用入口，指向真正的应用数据源
desirecore/registry；同步 registering-services / using-services 到 1.0.4，明确
native-app 的对外 MCP 不可注册为内部服务。
Add bilingual marketplace documentation and update both service skills
without duplicating an App as an MCP service. Fixed native application
listing and lifecycle live in Registry; open-source implementation lives
in desirecore-agent/desirecore-cdp-mcp.
## 兼容 / Compatibility
Requires native-app-aware desktop (catalog minimum 10.0.169) and
app-install-manager >=1.4.0. Catalog publication does not upgrade the
desktop or Agent.
## 验证 / Verification
- i18n/catalog validation: 0 errors, 129 existing governance/freshness
warnings retained.
- scoped translation hash check: both skills up to date; no model API
invoked by checks.
- git diff --check passed; unrelated market entries preserved.
## 中文
补齐官方市场里唯一缺失的主流 IM CLI 条目：**钉钉官方命令行工具 `dws`**（npm 包
`dingtalk-workspace-cli`，Apache-2.0，Copyright 2026 Alibaba Group），与已有的
`wecom-cli`、`larksuite-cli` 形成对称。市场此前只有社区的 `dingtalk-api`，覆盖面远小于官方 CLI。
### 变更
| 文件 | 说明 |
| --- | --- |
| `skills/dingtalk-cli/entry.json` | 合集指针条目 + 14 个官方子技能 `children` |
| `skills/dingtalk-cli/catalog-metadata.v1.json` | 治理 sidecar |
| `manifest.json` | `stats.totalSkills` 62 → 63；`version` 1.2.30 →
1.2.31；`lastUpdated` |
| `README.md` | 外部条目计数与清单同步 |
### 14 个子技能
`dingtalk-aisearch`、`dingtalk-aitable`、`dingtalk-calendar`、`dingtalk-chat`、`dingtalk-contact`、`dingtalk-doc`、`dingtalk-drive`、`dingtalk-event`、`dingtalk-mail`、`dingtalk-minutes`、`dingtalk-misc`、`dingtalk-shared`、`dingtalk-todo`、`dingtalk-wiki`
### 外部依赖披露
CLI 是**独立分发的第三方软件**，本条目只是市场登记，四处均已声明：
- **discovery description**（`entry.json#i18n.<locale>.shortDesc`）：需自行用
npm 安装 `dingtalk-workspace-cli`，需完成钉钉 OAuth
授权登录（**不支持账号密码登录**），DesireCore 不打包、不授权、不安装也不代运营钉钉或该 CLI
- **`compatibility.requirements`**（4 条）：CLI 需在 PATH 上、Node.js >=
16.7.0、`dws auth login` 建立的授权会话（缺失时必须在外部调用前停止，禁止编造成功结果）、能力覆盖取决于组织授予的
OAuth 范围与钉钉权益
- **本地化市场文案**：sidecar `presentation.i18n` 与 `entry.json#i18n` 逐字一致，zh-CN
/ en-US 双语
- **执行说明**：随 CLI 分发的上游 `SKILL.md`，不在本仓库
`redistribution: verify-package-terms` 会让客户端在安装响应里带出条款提示。
### 来源与治理的取舍（诚实声明）
上游 git 仓库 `https://github.com/open-dingtalk/dingtalk-workspace-cli`（该
URL 是发布方在 npm `package.json#repository` 里自己声明的）**当前对外返回 404，不可公开访问**，因此：
- `source` 用 `kind: git` + 该声明 URL，**不写 `ref`**——没有可观察的 commit，不编造固定版本
- 相应地 `provenance.content` 不可变，`governance.availability` 只能是
`listing-only`（`validate_catalog_metadata.py` 的 installable 强证据门禁要求不可变
ref + 已知 license + `reviewedAt` + `compliance`，本条目一样都拿不出）
- `governance.license` 保持 `{state: "unknown"}`（`entry.json#license:
"Apache-2.0"` 取自发布方声明与包内 LICENSE/NOTICE，但仓库内没有许可证据文件，只产生既有的
`legacy-license-unverified` warning）
- `timestamps.reviewedAt` / `releasePublishedAt` 保持 `unknown`；只有
`catalogUpdatedAt` 与 `upstreamObservedAt` 写入真实观察时刻
- `branding` 声明 `independent-listing` / `nominative` /
`not-used`：独立登记、名称为指代性使用、未使用对方 Logo（图标是通用终端窗形）
- 因为来源未固定，`gen-collection-children.py --check` 会输出 `SKIP`（与既有的
`mattpocock-skills` 同一路径），`children` 由人工按分发件内实际布局 `multi/<id>/` 撰写
### 校验（已实际执行，全部 exit 0）
```
uv run --quiet scripts/i18n/test_validate_i18n.py exit=0
uv run --quiet scripts/catalog/test_validate_catalog_metadata.py exit=0
uv run --quiet scripts/catalog/test_collection_generator.py exit=0
uv run --quiet scripts/catalog/validate_catalog_metadata.py --require-complete
0 error(s), 117 warning(s). agents=1, builtinSkills=34, pointerSkills=29,
publishableSkills=63, collections=8, collectionChildren=161, sidecars=64 exit=0
uv run --quiet scripts/i18n/validate-i18n.py 0 error(s) exit=0
uv run --quiet scripts/i18n/translate.py --check exit=0
uv run --quiet scripts/gen-collection-children.py --check exit=0
```
本条目产生的唯一 warning 是 `legacy-license-unverified`，与其余全部 pointer
条目一致。`entry.json` 另经客户端 `marketSkillEntrySchema` 的 Ajv 校验通过。
发布前公开信息边界检查已按 `CLAUDE.md` 执行并通过（工作树全量扫描含隐藏文件、路径名、分支名、commit 文案与本 PR
文本，零结果；令牌清单保存在仓库之外）。
---
## English
Adds the one mainstream IM CLI the official market was still missing:
the **official DingTalk CLI `dws`** (npm package
`dingtalk-workspace-cli`, Apache-2.0, Copyright 2026 Alibaba Group),
making it symmetric with the existing `wecom-cli` and `larksuite-cli`
entries. Until now the market only carried the community `dingtalk-api`,
whose surface is far smaller.
### Changes
| File | Purpose |
| --- | --- |
| `skills/dingtalk-cli/entry.json` | Collection pointer entry with 14
official sub-skill `children` |
| `skills/dingtalk-cli/catalog-metadata.v1.json` | Governance sidecar |
| `manifest.json` | `stats.totalSkills` 62 → 63; `version` 1.2.30 →
1.2.31; `lastUpdated` |
| `README.md` | External-entry count and list kept in sync |
### External dependency disclosure
The CLI is **separately distributed third-party software**; this entry
is a marketplace listing only. The dependency is disclosed in all four
required places:
- **Discovery description** (`entry.json#i18n.<locale>.shortDesc`): the
operator installs `dingtalk-workspace-cli` from npm and completes
DingTalk OAuth sign-in (**no username-and-password login**); DesireCore
does not bundle, license, install or operate DingTalk or this CLI.
- **`compatibility.requirements`** (4 entries): the `dws` binary on
PATH, Node.js >= 16.7.0, an operator-authorized session from `dws auth
login` (without it the skills must stop before the external call and
must never fabricate a successful result), and the fact that capability
coverage depends on the organization's granted OAuth scopes and DingTalk
entitlements.
- **Localized marketplace text**: sidecar `presentation.i18n` matches
`entry.json#i18n` verbatim, in both zh-CN and en-US.
- **Execution instructions**: the upstream `SKILL.md` files shipped with
the CLI, outside this repository.
`redistribution: verify-package-terms` makes the client surface a terms
notice on install.
### Source and governance trade-off (stated plainly)
The upstream git repository
`https://github.com/open-dingtalk/dingtalk-workspace-cli` — the URL the
publisher itself declares in the npm `package.json#repository` —
**currently returns 404 and is not publicly readable**. Therefore:
- `source` uses `kind: git` with that declared URL and **no `ref`**:
there is no observable commit, and inventing a pinned one is not
acceptable.
- Content provenance is consequently not immutable, so
`governance.availability` can only be `listing-only` (the installable
evidence gate in `validate_catalog_metadata.py` requires an immutable
ref, a known license, `reviewedAt` and `compliance`; none of these exist
here).
- `governance.license` stays `{state: "unknown"}`. `entry.json#license:
"Apache-2.0"` reflects the publisher's declaration and the
LICENSE/NOTICE shipped in the package, but there is no license evidence
file in this repository, so only the existing
`legacy-license-unverified` warning is produced.
- `timestamps.reviewedAt` and `releasePublishedAt` stay `unknown`; only
`catalogUpdatedAt` and `upstreamObservedAt` carry real observed values.
- `branding` declares `independent-listing` / `nominative` / `not-used`:
an independent listing, nominative use of the product name, and no
third-party logo (the icon is a generic terminal-window glyph).
- Because the source is unpinned, `gen-collection-children.py --check`
reports `SKIP` (the same path the existing `mattpocock-skills` entry
takes). The `children` list was written by hand against the
`multi/<id>/` layout actually observed in the distributed skill bundle.
### Validation (actually executed, all exit 0)
All seven checks from `.github/workflows/i18n-validate.yml` were run
locally and passed; the only warning attributable to this entry is
`legacy-license-unverified`, matching every other pointer entry.
`entry.json` additionally validates against the client's
`marketSkillEntrySchema` under Ajv.
The pre-publication public-information-boundary check in `CLAUDE.md` was
performed and passed with a zero-result scan across the working tree
(hidden files included), path names, branch name, commit text and this
PR text. The search tokens are kept outside the repository.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: yi-ge <jackyoncode@gmail.com>
## 摘要 / Summary
补问、原话解释与真人确认分离；增加版本能力预检、sourceField/evidenceLinks、有限语义用例及正确工件依赖顺序。
Separate answers, interpretation and human confirmation; add capability
discovery, explicit source/evidence bindings, finite semantic checks and
artifact ordering.
发现描述覆盖“仅澄清”入口；有歧义的原话保持缺口，不把“不确定”塞入精确枚举或规范化值。按当前对话语言加载框架与固定事实门尾注。
当前请求中已唯一确定的值会写成类型化、待真人确认的 `node.value`；只有未知或仍有歧义的事实才保持 `needs_input`。
Discovery covers clarify-only requests. Ambiguous raw answers remain
unresolved, rather than becoming exact placeholder values. The framework
and fixed fact-gate footer follow the current conversation language.
Exact values uniquely supplied by the current request become typed,
human-reviewable `node.value` proposals; only genuinely unknown or
ambiguous facts remain `needs_input`.
应用/服务重启或重试 fork 后，入口必须在当前父轮重新加载 Skill，并在委派前用 ToolCatalog 核实阶段工具；子 Agent
不得突破未激活父级的能力上限。
After an app/service restart or retry fork, the entry Agent reloads the
Skill in the current parent turn and verifies stage tools before
delegation; a child never expands an unactivated parent ceiling.
新的 decision-grade `OptimizationSpec` 强制使用 v2，并完整声明 `semantic_contract`
中的 solve intent 及所有 objective/variable/constraint/data reference
的单位/维度；legacy v1 仅只读兼容。
New decision-grade `OptimizationSpec` artifacts use v2 and a complete
semantic contract for solve intent plus every material objective,
variable, constraint and data reference; legacy v1 remains read-only
compatibility.
## 验证 / Validation
- Scoped Skill/i18n/catalog check passes with zero errors. Existing
repository warnings remain.
- Publication safety check passed, including hidden working-tree files,
new paths, branch/commit metadata and collaboration text.
- 双语说明与 source hash 已同步，版本更新为 2.7.0；缺少新平台契约时保持普通澄清，不模拟缺失门禁。
- Bilingual bodies and source hashes are synchronized at version 2.7.0.
Older clients stay in plain-text clarification when capability discovery
fails.
## 状态 / Status
Runtime acceptance is still in progress; draft only. No customer data,
credentials, solver software or deployment settings are included.
真机验收仍在进行，本 PR 暂为草稿。保留外部求解器许可证、部署和费用披露；本变更不包含求解器、客户数据或凭据。
---------
Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
## 背景 / Background
desirecore/desirecore#2248：真机测试中 code-intelligence 技能被绕过——模型未加载技能、未解锁
`Lsp`，直接用 Glob/Grep 文本检索回答语义导航问题，用户无从知道拿到的不是语义结果。
In real-device testing the skill was bypassed entirely: the model
answered semantic-navigation questions from Glob/Grep text matching
without loading the skill or unlocking `Lsp`, with no disclosure to the
user.
## 变更 / Changes
- **description（根级 + i18n 双语）改为命令式**：语义导航请求必须先加载本技能解锁隐藏的 `Lsp` 工具，禁止未尝试
`Lsp` 就用文本检索作答（配合主仓库的技能目录 provides.tools 附注，模型在决策点即可看到该指令）
- **L1 新增「硬性规则」**（双语）：`Lsp`
优先；限定允许回退的三种情形；任何回退到文本检索的回答必须向用户显式声明「结果来自文本匹配而非语义分析」及原因
- **L2 降级策略**同步引用硬性规则
- version 1.0.0 → 1.1.0；重算 i18n `source_hash`（`translated_by: human`
保持锁定）
## 校验 / Validation
- `uv run scripts/i18n/validate-i18n.py` → OK
- `uv run scripts/i18n/translate.py --check` → code-intelligence 两
locale 均无 stale
## 中文
- 将 `debug_port_closed` 的模型可见字段从 `launchCommand` 收紧为
`manualLaunchCommand`
- 明确 `requiredAction=wait_for_user_to_launch_browser` 与
`commandPolicy=display_only_never_execute`
- 中英 Skill 与 CDP 参考文档同步要求结束回合，禁止交给 Bash、PowerShell、终端或脚本执行
## English
- Rename the model-facing closed-port suggestion to
`manualLaunchCommand`
- Define `requiredAction=wait_for_user_to_launch_browser` and
`commandPolicy=display_only_never_execute`
- Keep the English/Chinese skill and CDP reference aligned: end the turn
and never pass the suggestion to an execution tool
## Validation
- i18n validator: pass
- translation freshness check: pass
- Windows real-device evidence: the previous contract correctly detected
`debug_port_closed` but attempted a Bash launch; approval was denied
before execution
## 中文
### 背景
L3-external 过去只用 curl 判断 9222，无法区分浏览器未安装、端口未开启、错误产品或伪 CDP
服务，也可能静默回落内置浏览器。
### 变更
- web-access 升级到 3.4.0，并要求先调用 BrowserExternalProbe
- 结构化处理未安装、端口关闭、多候选、产品不匹配、无效 CDP 与宿主不可用
- 显式浏览器不可自动替换；泛指 external 在多候选且无 ready 端口时先询问
- 所有 Playwright 配方使用 probe 返回端口和 DesireCore 隔离 Profile
- 纳入并修复 #93 的浏览器收尾规则与重复编号 finding
### 验证
- validate-i18n：通过
- translate --check：通过
- validate-i18n --online：通过
- source hash：sha256:1704b973e3a90e89
- 双语结构：31 个标题、20 个代码围栏
取代 #93；关联 desirecore/desirecore#2369。
## English
### Background
L3-external previously relied on curl against port 9222, which could not
distinguish a missing browser, a closed debug port, a different product,
or a fake CDP service, and could silently fall back to the built-in
browser.
### Changes
- Bump web-access to 3.4.0 and require BrowserExternalProbe before CDP
attach
- Handle missing installation, closed port, multiple candidates, product
mismatch, invalid CDP, and unavailable host as separate states
- Never replace an explicitly requested browser; ask when a generic
external request has multiple candidates and no ready endpoint
- Use the probe result port and a DesireCore-isolated profile in all
Playwright recipes
- Incorporate #93 browser wrap-up guidance and fix its duplicate
numbering review finding
### Validation
- i18n validation passed
- translation freshness check passed
- online validation passed
- source hash: sha256:1704b973e3a90e89
- bilingual structure: 31 headings and 20 code fences
Supersedes #93; related to desirecore/desirecore#2369.
---------
Co-authored-by: xieyuanxiang <124608760@qq.com>
## 中文
### 变更
- 将 manage-teams 升级到 1.3.0，并设置最低客户端版本 10.0.108
- 补齐 ManageTeam 全部 14 个 action 的用途、参数与风险边界
- 增加创建前检查、工作目录选择、Smart 成员路由、组织更新、头像、团队仓库、远程同步与失败恢复流程
- 明确远程操作必须经过 ManageTeam 的原因是供应链校验与审批，而不是假设 Agent 永远拿不到凭据
- 保持 disable-model-invocation: true，只在需要管理团队时按需加载
### 测试
- uv run --quiet scripts/i18n/test_validate_i18n.py
- uv run --quiet scripts/i18n/validate-i18n.py
- uv run --quiet scripts/i18n/translate.py --check
- git diff --check
## English
### Changes
- Upgrade manage-teams to 1.3.0 and require client 10.0.108
- Cover all 14 ManageTeam actions with their parameters and risk
boundaries
- Add preflight checks, workdir selection, Smart member routing,
organization updates, avatars, team repositories, remote
synchronization, and failure recovery
- Clarify that remote operations must use ManageTeam for supply-chain
validation and approval, not because Agents can never access credentials
- Keep disable-model-invocation: true so the Skill is loaded only when
team management is needed
### Tests
- uv run --quiet scripts/i18n/test_validate_i18n.py
- uv run --quiet scripts/i18n/validate-i18n.py
- uv run --quiet scripts/i18n/translate.py --check
- git diff --check
## 背景 / Background
v3.0（#85）以「它存在的每一条技术理由（无批量取文通道、evaluate 不可用、截图必须串行
activate）都已被内置浏览器覆盖」为由，删除了 Python Playwright 那一层。
**作为「内置浏览器不够用时的兜底」，这个判断是对的。**
但删除时顺带丢掉了一个完全不同的用例：用户想用**他自己那个**浏览器——他的登录态在他自己的 Chrome
里，他想亲眼看着操作、随时接管。这跟能力够不够无关，内置浏览器替代不了。
真实案例：用户要求「请你操作我本地机器的外部浏览器来完成一个示例报关过程」。技能里已无此路径，模型自己也查出「无独立的 Browser*
外部浏览器工具」，仍用内置浏览器做完全程，并以「本地受管浏览器」「已启动本地浏览器」描述——用户拿到的和要的不是一回事，却无从分辨。
v3.0 (#85) removed the Python Playwright layer on the grounds that every
technical reason it existed for is now covered by the built-in browser.
**As a fallback, that judgement was right.** But the deletion also took
a different use case with it: the user wanting *their own* browser —
their login state, their window, theirs to watch and take over. That has
nothing to do with capability, and the built-in browser cannot stand in
for it.
## 改动 / Changes
把 L3-external 作为**由用户意图触发的平级选择**恢复（**不再是 fallback**）：
- 恢复 `references/cdp-browser.md`（v3.0 删除，含 `connect_over_cdp` 模板与站点配方）
- 恢复 `Prerequisites: Chrome CDP Setup`，重新定位为「**仅 L3-external
需要**」，内置浏览器仍零前置条件
- 决策树的实时交互分支改为双路：用户点名外部 → L3-external；其余 → 内置（默认）
- 新增「两个浏览器，按用户意图选」对照表：是什么 / 登录态 / 用户能否看到 / 前置条件 / 是否默认
- 分层表加回 L3-external，并说明它**刻意不在默认排序里**——判据是用户点名，不是能力够不够
- 明确：CDP attach 时严禁 `browser.close()`（会关掉用户自己的 Chrome）
- 无论走哪条，措辞必须让用户能分辨实际用了哪个；禁止「本地浏览器」这类两边都像的说法
version 3.0.1 → 3.2.0
## 校验 / Validation
- `python3 scripts/i18n/validate-i18n.py` → OK: no i18n issues found
- `python3 scripts/i18n/translate.py --check` → web-access en-US
`human-locked, skipping`（无 source_hash 漂移）
- 双语同步；en-US 为 human-locked 翻译，已手工同步并按 `compute_source_hash` 重算对齐
## 公开信息边界 / Public information boundary
改动仅涉及浏览器能力边界的技术描述，无租户、客户或其他机密身份信息。
---------
Co-authored-by: Yige <a@wyr.me>
## 变更说明 / Summary
### 中文
- 在 `workforce-optimization` 的发现描述、`compatibility`、中英文市场摘要和正文中明确 MindOpt
是需要独立安装/部署并取得有效许可证的外部第三方求解器。
- 明确 `MindOptSolve` 只是受治理的 Connector/Adapter，不包含 MindOpt
求解器软件、许可证、算力托管、采购或运行费用。
- 增加运行前检查：必须确认 Connector ready、capabilities 可用且部署具备当前用途所需的有效许可证；仅注册 Tool
名称不能证明依赖可用。
- 增加安全降级：外部依赖不可用时仍可完成需求澄清和建模制品，但不得调用求解器、伪造 `SolveResult` 或宣称可行/最优/收益。
- 在 `AGENTS.md` 与 `CLAUDE.md` 中固化通用的第三方商业依赖披露规则。
- Skill 版本升级到 `2.3.3`，Market 版本升级到 `1.2.24`。
MindOpt 官方文档说明运行前必须取得有效许可证，并同时提供商业许可和社区许可；适用范围与采购要求以官方条款为准：
https://opt.aliyun.com/doc/mindopt/latest/cn/html/installation/license.html
### English
- Discloses in discovery metadata, `compatibility`, localized
marketplace text, and runtime instructions that MindOpt is separately
installed/deployed third-party solver software requiring a valid
applicable license.
- Clarifies that `MindOptSolve` is only the governed connector/adapter
and does not bundle the solver, license, hosted compute, procurement, or
operating costs.
- Adds a preflight gate for connector readiness, required capabilities,
and applicable licensing.
- Defines safe degraded behavior: requirement and model artifacts may
still be produced, but no solver call or fabricated solution claim is
allowed.
- Adds a generic third-party dependency disclosure rule to both
repository instruction entrypoints.
- Bumps the Skill to `2.3.3` and the Market to `1.2.24`.
The official MindOpt documentation states that a valid license is
required and documents both commercial and community licenses;
eligibility and purchasing remain governed by those official terms:
https://opt.aliyun.com/doc/latest/en/html/installation/license.html
## 验证 / Validation
- `uv run --quiet scripts/i18n/test_validate_i18n.py` — 8 passed
- `uv run --quiet scripts/i18n/validate-i18n.py` — no issues
- `uv run --quiet scripts/i18n/translate.py --check` — current; human
translation hash aligned
- `git diff --check`
- Public-worktree customer-identity/path scan — 0 matches
## Summary / 摘要
Normalize the Configure Compute, Using Services, and Register Services
source SVG icons to pure white.
将“配置算力”、“使用服务”和“注册服务”的源 SVG 图标统一为纯白。
## Version / 版本
- Market: `1.2.16` → `1.2.17`
- Each affected skill: `1.0.2` → `1.0.3`
## Validation / 验证
- `uv run scripts/i18n/validate-i18n.py`
- `uv run scripts/i18n/translate.py --check`
- Parsed all three SVGs and asserted their only hex color is `#FFFFFF`
- `git diff --check`
