Commit Graph

34 Commits

Author SHA1 Message Date
7d0d047f3e Publish contract review team 0.1.27 (#171)
## Why

The contract review team now uses the merged `clause-extractor` 1.1.0
bounded checkpoint workflow. The official market entry still pointed at
team release 0.1.26 and clause-extractor 1.0.6.

## Change

- Publish team version 0.1.27.
- Point the source ref to merged team commit
`cb25d73a0dfbfc319df6eac2d254b3dbcc790e6e`.
- Update the member projection to clause-extractor 1.1.0.
2026-09-14 15:50:58 -04:00
c03cc5da49 Publish outcome-quality tender team 0.2.0 (#169)
Ordinary tender review was blocked by mandatory TaskSpec preparation,
metadata preflight, fixed report packages and runtime receipts, while
the business quality of delivered opinions remained insufficiently
explicit.

This release accepts clear natural-language assignments and defines
concrete goals, good and bad outcomes, evidence expectations and focused
corrections for each role. Chat, tables and files are valid
deliverables. Specialist calculations and legacy structured-export
validators remain available for their specific purposes. It removes
obsolete business input contracts and updates the corresponding
bilingual guides.

Validation was performed after the full multi-repository modification:
JSON/configuration and document-link checks, targeted calculation
regressions, independent content review, and eight synthetic
paper-evaluation scenarios (8/8 after fixing informational-only entry
handling and residual visual preflight/human gates). Paper evaluation is
not a live DesireCore/Qwen or real-tender accuracy result. No real bid
package was tested.

---------

Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
2026-09-12 14:36:45 -04:00
d18cdbf253 Docs: publish tender project guide release (#164)
Advance the team source pointer and matching catalog provenance/review
reference to the merged bilingual project-guide commit.

Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
2026-09-11 05:35:25 -04:00
5b6ea80f6b Pin tender-review team evidence-delivery release (#163)
Update the published team pointer to the reviewed team revision that
locks Lead and Evidence 0.1.1. Preview wording remains until
clean-install end-to-end acceptance is complete.

Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
2026-09-11 04:59:53 -04:00
dabdcc4b99 Publish tender review team and usage docs
Publish the reviewed tender review team pointer, bilingual usage docs, and provenance sidecar after catalog/i18n/Copilot checks pass.
2026-09-10 16:42:52 -04:00
18f2f2243e feat: add tender review team preview (#160)
## What this changes

Adds the tender-review team and its onboarding entry to the official
Market catalog as an immutable source pointer, plus bilingual catalog
sidecars.

- `teams/biao-shu-lian-he-shen-cha/entry.json` points to the published
team commit `7ee5650b066cdee385288a722b8cbd8e1947d0fe`.
- `agents/tender-review-assistant/entry.json` points to assistant commit
`4b6855d2edb535f81c29847e06145c0da87942d0`.
- Both entries include bilingual descriptions, privacy boundaries and
`requiredClientVersion: 10.0.155`.
- The listing is deliberately `pointer` / preview. It does not claim the
v10.0.155 release is fully green or production-certified; newcomer
qualification remains pending.

## Validation

- `python3 scripts/catalog/validate_catalog_metadata.py --json` — 0
errors (existing catalog warnings unchanged).
- Market entry and both `catalog-metadata.v1.json` sidecars validate
against the current client/catalog schemas.
- Published source repositories and full commit pins were checked before
creating this branch.

---------

Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
2026-09-10 15:45:40 -04:00
e111eb31f8 release: publish contract review team 0.1.26 (#159)
发布合同审查团队 v0.1.26 市场元数据。

团队版本、成员版本、来源提交和审阅引用均锁定至已合并的 Team 提交;发布时间和远端观测时间以可复核 Git 事实更新。

验证:catalog/i18n 校验通过,JSON 与空白检查通过;独立审阅 P0--P3 均为零。

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: yi-ge <6657330+yi-ge@users.noreply.github.com>
2026-09-08 07:56:50 -04:00
06929d16d6 release: publish contract review team 0.1.25 (#158)
问题:合同审查 Team 已发布 0.1.25 并锁定统筹官 1.0.13;市场仍指向 0.1.24,新用户无法安装经过推理兼容性修复的版本。

改动:将市场 entry 与 catalog sidecar 更新为 0.1.25,并以 Team 合并提交
0ce23190297d2b5918a91f2053a5ee2a9de264a7 作为唯一发布指针。

验证:JSON、catalog/i18n、镜像字段与公开信息扫描通过;独立 Terra review 通过。全局 collection
检查仍有4个未改外部集合陈旧项,和本发布无关,未将其记为通过。
2026-09-08 03:20:26 -04:00
8d0cedaeeb fix: publish contract review team 0.1.24 (#157)
## Why

The C02 newcomer test exposed a missing-material preflight defect in the
contract-review lead. The corrected team release is already merged as
0.1.24; this PR publishes the exact team ref to the market.

## What changed

- Update the market pointer and catalog sidecar to contract-review-team
0.1.24.
- Pin both metadata surfaces to
`e096a74a482b55266753b3b93e179f9cac2f0ecd`.
- Publish contract-review-lead 1.0.12 in the team roster.

## Validation

- Parsed both market JSON files.
- Verified pointer, provenance, and reviewed refs are identical.
- Verified the remote team `main` ref matches the published pointer.
- Ran the catalog and i18n validators successfully; they reported only
pre-existing catalog warnings outside this team.
- Ran `git diff --check`.

## 中文说明

将市场中的合同审查团队发布指针升级到 0.1.24,并锁定已合并的团队提交。该版本包含统筹官 1.0.12
的无材料零工具咨询修复;entry、sidecar 的来源与审阅提交已一致,市场校验通过。
2026-09-07 23:32:33 -04:00
4940c8a82d 发布合同审查团队 0.1.23
## 中文

### 背景
合同审查团队已发布 0.1.23,锁定 `contract-intake` 1.0.2 的 YAML 安全与解析声明治理修复。市场条目仍指向团队
0.1.22,导致新用户安装不到修复版本。

### 变更
- 市场条目 `latestVersion` 与 metadata release version 更新为 `0.1.23`。
- source、provenance 与 reviewedRef 更新为团队合并提交
`67805f39bae1e76a726fcbeef766c743cc020bc7`。
- 条目成员版本同步 `contract-intake` 1.0.2。
- 更新时间戳更新至本次团队发布。

### 验证
- 市场 i18n 校验:0 errors(既有 129 warnings)。
- catalog metadata 单元测试:47 tests,全部通过。
- collection generator 单元测试:4 tests,全部通过。
- catalog metadata validator:0 errors(既有 warning)。
- translate `--check`:通过。
- `git diff --check` 与凭据扫描:通过。
- `gen-collection-children.py --check` 发现 4 个既有外部 collection
stale(baoyu-skills、larksuite-cli、marketingskills、wecom-cli),本次未修改这些目录。

## English

### Background
Contract Review Team 0.1.23 is released with the `contract-intake` 1.0.2
YAML safety and parser-claim governance fix. The market listing still
pointed to 0.1.22, so new installs would miss the fix.

### Changes
- Update the market entry and metadata release version to `0.1.23`.
- Update source, provenance, and reviewedRef to team merge commit
`67805f39bae1e76a726fcbeef766c743cc020bc7`.
- Sync the entry member version for `contract-intake` to 1.0.2.
- Refresh release timestamps.

### Validation
- Market i18n validation: 0 errors (129 pre-existing warnings).
- Catalog metadata unit tests: 47 passed.
- Collection generator unit tests: 4 passed.
- Catalog metadata validator: 0 errors (pre-existing warnings).
- `translate --check`: passed.
- `git diff --check` and credential scan: passed.
- `gen-collection-children.py --check` reports four pre-existing stale
external collections; none are touched by this change.
2026-09-07 11:18:54 -04:00
d46d1a77d3 发布合同审查团队 0.1.22
市场校验、翻译检查与 Copilot review 全部通过。
2026-09-07 09:36:30 -04:00
12a70d4418 release: contract review team 0.1.21
Publish corrected member content hashes.
2026-09-06 21:59:08 -04:00
5934e479fd release: contract review team 0.1.20
Publish market metadata for team 0.1.20.
2026-09-06 21:36:13 -04:00
d4952e82f4 release: contract review team 0.1.19
GPT-Reserve review PASS; market validators and Copilot gate passed.
2026-09-06 20:25:50 -04:00
0683e1bf31 release: contract review team 0.1.18 (#151)
## Why
Publish the reviewed contract review team fix that was validated by a
fresh final18 real run. The prior run correctly fail-closed when
reporter artifacts escaped the lead case root and clauses.yaml was not
parseable.

## Changes
- bump marketplace entry/catalog to team 0.1.18
- point source/provenance/governance refs to merged team commit
6aa93bf11a6e37cc9d0444e3335ba953bee0a61f
- expose lead 1.0.10, clause 1.0.5, reporter 1.0.4 member versions
- retain legal disclaimer and source-pointer-only distribution

## Validation
- catalog validator exit 0
- i18n validator exit 0
- targeted JSON/ref assertions
- git diff --check
2026-09-06 19:20:54 -04:00
e9c1048a6a release: publish contract review team 0.1.15
Independent GPT-Reserve review passed; targeted validators and ref assertions passed.
2026-09-06 17:37:27 -04:00
3160e703d9 release: publish contract review team 0.1.14
Merged after independent GPT-Reserve review (P0/P1/P2/P3=0) and all market checks passed.
2026-09-06 16:32:55 -04:00
be1904d567 release: publish contract review team 0.1.13 (#148)
## 变更

- 更新合同审查团队市场条目至 `0.1.13`。
- `source.ref`、provenance content ref、governance reviewedRef 统一锁定团队合并提交
`91f576d8d5a30984d138752d32cc74929771a213`。
- roster 将 `review-reporter` 更新至 `1.0.2`。
- 对外说明评分回执的完整回读与 `REJECT-SCORECARD-YAML` fail-closed 闸门。

## 验证

- `uv run scripts/catalog/validate_catalog_metadata.py --json`:exit 0,0
errors(保留既有 warnings)。
- `uv run python scripts/catalog/test_validate_catalog_metadata.py`:47
passed。
- `uv run python scripts/i18n/test_validate_i18n.py`:19 passed。
- `uv run python scripts/catalog/test_collection_generator.py`:4 passed。
- entry/catalog JSON、ref/version 一致性断言与 `git diff --check` 通过。
- 团队 PR #26 与 reporter PR #3 已由 GPT-Reserve 独立复审并合并。
2026-09-06 14:50:12 -04:00
45cdff4923 release: publish contract review team 0.1.12 (#147)
Publish Contract Review Team 0.1.12. Update entry/catalog to the merged
team ref d85b9244244c3b69718b2525b8ef4b8b7296f144, lead 1.0.8, and
current timestamps. Focused validators: metadata 47 passed, i18n 19
passed, collection 4 passed, JSON parse and diff-check pass; existing
catalog warnings unchanged.
2026-09-06 13:27:44 -04:00
5025a7322f chore(contract-review-team): publish 0.1.11
GPT-Reserve review PASS (P0=0, P1=0, P2=0, P3=0). Metadata, i18n, collection, and Copilot checks passed.
2026-09-06 12:50:43 -04:00
41c0badfcb chore(contract-review-team): publish 0.1.10 (#145)
## Change\n- publish contract-review-team 0.1.10\n- point source,
provenance, and governance review to team commit
1950e3b117e11b9208ed38fe6d64abfa87ea1adc\n- expose contract-review-lead
1.0.6\n\n## Validation\n- catalog metadata validator: 0 errors\n-
test_validate_catalog_metadata.py: 47 passed\n- git diff --check
passed\n- team PR #23 and lead PR #7 independently reviewed by
GPT-Reserve\n
2026-09-06 12:08:37 -04:00
5750c48556 release: contract review team 0.1.9 market entry
All checks passed after rebasing onto market main; independent reserve review PASS, schema/i18n validation passed, and review conversation resolved.
2026-09-06 10:57:58 -04:00
d3a81f1cb8 release: publish contract review team 0.1.8 (#135)
## Summary
- publish contract review team v0.1.8 from upstream team commit
98dcaf365c17fce25928dcdaf4a90739229617a5
- refresh the roster to match the team lock, including intake 1.0.1 and
risk 1.0.3
- preserve installable governance, privacy, and Work Context metadata

## Validation
- metadata validator: 0 errors (129 pre-existing warnings)
- metadata tests: 47 passed
- i18n tests: 19 passed
- collection tests: 4 passed
- JSON parse and git diff --check
- independent GPT-Reserve review: PASS (P0/P1/P2/P3 = 0)
2026-09-06 08:56:55 -04:00
18ce1c7798 fix(market): publish contract review team v0.1.6 (#134)
## Why / 背景

The market entry still pointed at team v0.1.5. Its pinned member lock
used stale agent manifests whose `command_authority.allowed_targets` did
not match the installed runtime IDs, so a fresh newcomer install could
pass catalog discovery but block the first delegation. The upstream team
main is now v0.1.6 with the corrected lock and member versions.

市场条目仍指向 v0.1.5。其成员锁引用了旧 Agent
manifest,`command_authority.allowed_targets` 与安装后的 runtime ID
不一致,导致新人实例虽然能发现团队,却会在首次委派时被阻断。上游团队 main 已更新到 v0.1.6,成员锁和版本已修正。

## What changed / 变更

- bump `latestVersion` and `release.version` to `0.1.6`;
- point entry source, catalog provenance, and compliance `reviewedRef`
to upstream team commit `3a4736e31ff5bf4299fde17fdde682a179d898b2`;
- align all six listed member versions with the upstream
`members.lock.json` (lead 1.0.4, intake 1.0.1, clause 1.0.2, risk 1.0.2,
jurisdiction 1.2.1, reporter 1.0.1);
- update release and upstream observation timestamps.

- 将 `latestVersion` 与 `release.version` 更新为 `0.1.6`;
- 将 entry source、catalog provenance 和 compliance `reviewedRef` 对齐上游团队
commit `3a4736e31ff5bf4299fde17fdde682a179d898b2`;
- 六名成员版本与上游 `members.lock.json` 对齐(统筹 1.0.4、输入 1.0.1、条款 1.0.2、风险
1.0.2、法域 1.2.1、报告 1.0.1);
- 更新发布时间与上游观察时间。

## Validation / 验证

- `uv run scripts/catalog/validate_catalog_metadata.py --json` — exit 0,
0 errors, 129 existing warnings;
- `uv run scripts/i18n/validate-i18n.py` — exit 0;
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47
passed;
- `uv run scripts/i18n/test_validate_i18n.py` — 19 passed;
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed;
- independent GPT-Reserve reviews — PASS, P0/P1/P2/P3=0;
- `git diff --check` — passed.

- `uv run scripts/catalog/validate_catalog_metadata.py --json`:exit 0,0
errors,129 个既有 warnings;
- `uv run scripts/i18n/validate-i18n.py`:exit 0;
- `uv run scripts/catalog/test_validate_catalog_metadata.py`:47 passed;
- `uv run scripts/i18n/test_validate_i18n.py`:19 passed;
- `uv run scripts/catalog/test_collection_generator.py`:4 passed;
- 两次独立 GPT-Reserve 复审:PASS,P0/P1/P2/P3=0;
- `git diff --check`:通过。
2026-09-06 08:07:04 -04:00
39258c79dd chore: publish contract review team 0.1.5 (#133)
## Changes\n- publish contract-review-team v0.1.5\n- point entry and
catalog metadata at merged team main commit
2a45d9fc031ba7d63d3ec15552ef0bc4c3a2b46e\n- align clause-extractor
roster version to 1.0.2\n- advance release timestamps to
2026-09-06T10:02:16Z, after team lock resolvedAt
2026-09-06T09:56:11.162Z\n- preserve Work Context description and all
unrelated metadata\n\n## Validation\n- team entry schema: PASS\n-
catalog metadata validator: PASS (existing repository warnings only)\n-
i18n validator: PASS (0 errors, 129 existing warnings)\n- collection
generator tests: 4 passed\n- git diff --check: PASS\n\nPlease review
independently; do not merge automatically.
2026-09-06 06:11:33 -04:00
e670a84b71 chore: publish contract review team 0.1.4
Publish team 0.1.4 with the merged lead manifest version/hash lock. Independent GPT-Reserve review PASS; Copilot approval recommended; market validators/tests PASS.
2026-09-06 04:14:18 -04:00
c5dc96c474 chore: publish contract review team 0.1.3
Publish contract review team 0.1.3 with Work Context orchestration compatibility and aligned publication provenance timestamps. Independent GPT-Reserve review PASS; market validators and tests PASS; Copilot concern resolved with timestamp fix.
2026-09-06 03:55:34 -04:00
435b338db3 fix: align jurisdiction member roster version (#129)
Align the market roster jurisdiction-auditor version with the published
team lock. Independent GPT-Reserve review passed; canonical market
validators and tests pass.
2026-09-06 03:09:10 -04:00
ded3acbffe fix: publish contract review team authority targets (#128)
Publish contract review team 0.1.2 with runtime Agent IDs in command
authority and update the catalog metadata to the merged team lock
commit. Independent GPT-Reserve review passed; canonical market
validators report 0 errors.
2026-09-06 02:45:02 -04:00
a1a0901d08 fix(teams): align jurisdiction member with pinned release (#126)
## Why / 背景

The pinned team release `73cd87a9901cc548871927e9d5dbec8e4cc6c2b1`
contains `jurisdiction-auditor` version `1.0.0`, but the merged market
entry advertised `1.2.0`. That metadata mismatch makes a valid pinned
release fail exact roster validation during newcomer installation.

团队发布锁 `73cd87a9901cc548871927e9d5dbec8e4cc6c2b1` 中的
`jurisdiction-auditor` 实际版本为 `1.0.0`,已合并的市场条目却写成
`1.2.0`。该元数据不一致会让新人安装时的精确 roster 校验拒绝有效的 pinned release。

## What changed / 变更

- Set only the market roster version for `jurisdiction-auditor` back to
`1.0.0`.
- Keep the pinned source ref, member commits, content hashes, governance
sidecar, and all other members unchanged.

- 仅将市场 roster 中 `jurisdiction-auditor` 的版本恢复为 `1.0.0`。
- pinned source ref、成员 commit、content hash、治理 sidecar 与其他成员均保持不变。

## Validation / 验证

- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47 passed
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed
- `uv run scripts/i18n/validate-i18n.py` — 0 errors, existing warnings
only
- public-tree sensitive-pattern scan — zero matches
2026-09-06 07:00:40 +08:00
a0f0d03878 fix(teams): match jurisdiction auditor release version (#125)
## Why

The team source lock declares `jurisdiction-auditor` at version `1.2.0`,
while the market roster still said `1.0.0`. DesireCore correctly
rejected the install because market member versions must match the
pinned team release.

## What changed

- update the market roster entry for `jurisdiction-auditor` to `1.2.0`;
- leave the pinned team source, commit, governance evidence, and all
other members unchanged.

## Validation

- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- public-tree sensitive-pattern scan — zero matches
2026-09-06 06:20:54 +08:00
6f8589ccda fix(teams): align contract review client compatibility (#124)
## Why

The published pointer advertises client version `10.0.137`, while the
current DesireCore release is `10.0.136`. The newcomer instance
therefore correctly blocks installation even though the team source is
compatible with the current client.

## What changed

- align the team pointer's `requiredClientVersion` with the current
client version;
- align the catalog sidecar's compatibility declaration with the same
version.

No source pointer, team member, capability, privacy, or governance claim
changed.

## Validation

- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47 passed
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed
- public-tree sensitive-pattern scan — zero matches
2026-09-06 06:15:31 +08:00
00540f7d44 feat(teams): publish installable contract review team pointer (#123)
## Why

The contract review team already has a reproducible public Git source,
but its market pointer is still listing-only and uses the legacy
display-only shape. The current DesireCore client contract requires
explicit members, capabilities, privacy, an immutable source ref, and
installability evidence.

## What changed

- publish the contract review team as an installable,
source-pointer-only team entry;
- add the six-member roster, capability boundaries, privacy notice, and
update date;
- record review and license evidence in the catalog sidecar;
- keep the legacy team-entry schema branch while adding the current
client contract, so existing public pointers remain valid during
migration.

The source remains a public HTTPS Git pointer locked to commit
`73cd87a9901cc548871927e9d5dbec8e4cc6c2b1`. The team output is
supporting review material, not legal advice, and still requires
qualified human review.

## Validation

- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47 passed
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed
- `uv run scripts/i18n/validate-i18n.py` — no errors; existing catalog
freshness warnings remain
- public-tree sensitive-pattern scan — zero matches
2026-09-06 06:09:14 +08:00
e77c658958 feat: 市场支持团队条目类型并上架合同审查团队 (#110)
## 变更 / What

市场此前只有 `agents` 与 `skills` 两类条目。本 PR 加入**团队(teams)**条目类型,并上架第一条真实团队
listing。

The market supported only `agents` and `skills`. This PR adds a
**teams** entry type and lists the first real team.

## 一、支持团队条目类型

「支持一种新条目类型」实际涉及 4 组共 11 个文件,比表面看到的多:

**客户端契约快照**
- 新增 `schemas/market-team-entry.client.schema.json`,用 esbuild 打包客户端
`packages/schemas/src/market.ts` 后导出生成。用同样方法重新生成
`market-agent-entry.client.schema.json` 验证过管线——字节完全一致(含属性顺序),确认不是手工誊抄。

**Sidecar schema**
- `identity.kind` 枚举加 `team`;新增 `$defs.teamSpec`;接入 `spec.oneOf` 与
kind→spec 派发

**校验器(工作量主要在这里)**
- `scripts/catalog/validate_catalog_metadata.py`:`load_legacy`
原先硬编码只认两个根目录。抽出 `CATALOG_ROOTS` 常量同时驱动允许的父目录集合与错误文案;按 kind 分派客户端 schema
校验;`teams` 进 stats 与 `--require-complete` 覆盖统计;把**严格 provenance
比对**与「可安装 pointer 必须自带不可变 ref」两道门禁扩展到团队
- `scripts/i18n/validate-i18n.py`:**它独立重算计数并逐个校验 `entry.json`**,不接团队会漏校
- `.github/workflows/i18n-validate.yml`:变更检测的 grep 不含 `teams/`——**一个只改
teams 的 PR 会报「无 i18n 相关变更,跳过校验」然后零校验通过**
- 测试:`test_validate_catalog_metadata.py` 29→47,`test_validate_i18n.py`
9→17

**顺带修正一条本就不对的规则**:`icon` 此前被要求「每个 entry.json 都必须有非空内联 SVG」,但运行时 schema 里
`marketAgentSchema` 与 `marketTeamSchema` **都没有 `icon` 字段**(只有 skill
有)。也就是说这条规则对 Agent pointer 同样在强加死重量,只因本仓库暂无 agent pointer 条目而未暴露。改为
`ICON_RENDERED_KINDS = {"skill"}`,agent/team 声明 icon
时给**警告**而非错误,文案说明「下一个维护者会以为改它能改变卡片」。

## 二、上架合同审查团队

`teams/contract-review-team/`(`entry.json` + sidecar)。

**团队条目是 fork 指针卡,不分发正文**:市场只存展示元数据 + git-only `source`,真实定义(`team.json`
/ `members.json` / `shared/`)在 `source.repoUrl` 指向的仓库里。安装即
`forkTeam`,更新即 `git pull`——组合固定,因此**没有** `installPolicy` /
`updatePolicy`。

| 字段 | 值 | 依据 |
|---|---|---|
| `source.ref` | `73cd87a9901cc548871927e9d5dbec8e4cc6c2b1` | v0.1.1
的**完整 SHA**。tag 不是可复现 pin,validator 有测试专门拒绝 |
| `latestVersion` | `0.1.1` | 上游真实 tag,与 `release.version` 交叉校验 |
| `license` | `MIT` | 上游仓库真有 LICENSE,已在 pinned ref 的快照中复验 |
| `redistribution` | `source-pointer-only` |
市场从不打包团队正文,只给指针——这是交付形态,与许可证宽松与否无关 |
| `requiredClientVersion` | `10.0.137` | 六个成员都声明了 `FileDigest`
内置工具,它随该版本发布 |
| `memberCount` / `memberNames` | 6 / 5 名 | schema 规定前者**含**组长、后者**不含**
|
| `availability` | `listing-only` | 见下 |

**`availability` 为什么不是 `installable`**:四项证据满足两项(不可变 pin ✓、已知 license
✓),缺的 `reviewedAt` 与 `governance.compliance`
本质是**一次尚未发生的治理审查**——需要具名方在具体日期针对这个确切 ref 审过许可合规、第三方内容与商标使用。没发生的事不能写进目录。

补充一个事实:本仓库**零个 sidecar 有 `compliance` 块,29 个 pointer 条目全是
listing-only**,`installable` 路径从未在任何真实条目上走过。这不阻止安装——fork 由 `source` 驱动。

**`license.evidencePath` 的基准此前是未定义的**:schema 只说
`safeRelativePath`,没规定相对谁。仓库里仅有的两个先例(`guizang-ppt`、`presentation-forge`)都是
vendored 技能,LICENSE 物理上在条目目录里。按那个读法,pointer 条目写 `evidencePath`
断言的是市场目录下有该文件——对 pointer 永远不成立。新增 `license-evidence` 规则按条目形态分派:vendored
要求文件存在(error),pointer 要求条目已 pin(warning),两种读法写进 README。

## 校验 / Validation

```
test_validate_catalog_metadata.py    47 tests  OK
test_validate_i18n.py                17 tests  OK
test_collection_generator.py         exit 0
validate_catalog_metadata.py --require-complete
  0 error, 116 warning   (agents=1, teams=1, publishableSkills=62, sidecars=64)
validate-i18n.py / --online          0 error, 116 warning
translate.py --check                 exit 0
gen-collection-children.py --check   exit 0
```

116 warnings 即加入团队之前的基线——**本条 listing 贡献 0 个警告**。

真实条目上的反向控制(跑在 rsync 副本上,仓库保持干净):

```
source.kind=zip                 → team-entry-schema (error)
install/updatePolicy 出现       → team-entry-schema (error)
requiredClientVersion 漂移      → legacy-consistency (error)
memberCount 漂移                → legacy-consistency (error)
provenance ref 漂移             → legacy-consistency (error)
可安装但无不可变 ref            → installable-evidence (error)
evidencePath 在未 pin 的 pointer → license-evidence (warning)
```

另用**客户端真实校验器**(`parseMarketTeamEntry`,不是快照)验证条目通过,且多写一个字段会被拒。

## 公开信息边界 / Public information boundary

全树扫描无新增命中。团队内容使用「某某科技(北京)有限公司」这类标准中文占位。

---------

Co-authored-by: yi-ge <mizan57533@gmail.com>
2026-09-01 04:15:45 -04:00