mirror of https://git.openapi.site/https://github.com/desirecore/market.git synced 2026-09-05 23:43:58 +08:00

Files

Yige b1f0719d40 docs: 明确 MindOpt 外部授权与部署依赖 (#80 )

## 变更说明 / Summary

### 中文

- 在 `workforce-optimization` 的发现描述、`compatibility`、中英文市场摘要和正文中明确 MindOpt
是需要独立安装/部署并取得有效许可证的外部第三方求解器。
- 明确 `MindOptSolve` 只是受治理的 Connector/Adapter，不包含 MindOpt
求解器软件、许可证、算力托管、采购或运行费用。
- 增加运行前检查：必须确认 Connector ready、capabilities 可用且部署具备当前用途所需的有效许可证；仅注册 Tool
名称不能证明依赖可用。
- 增加安全降级：外部依赖不可用时仍可完成需求澄清和建模制品，但不得调用求解器、伪造 `SolveResult` 或宣称可行/最优/收益。
- 在 `AGENTS.md` 与 `CLAUDE.md` 中固化通用的第三方商业依赖披露规则。
- Skill 版本升级到 `2.3.3`，Market 版本升级到 `1.2.24`。

MindOpt 官方文档说明运行前必须取得有效许可证，并同时提供商业许可和社区许可；适用范围与采购要求以官方条款为准：

https://opt.aliyun.com/doc/mindopt/latest/cn/html/installation/license.html

### English

- Discloses in discovery metadata, `compatibility`, localized
marketplace text, and runtime instructions that MindOpt is separately
installed/deployed third-party solver software requiring a valid
applicable license.
- Clarifies that `MindOptSolve` is only the governed connector/adapter
and does not bundle the solver, license, hosted compute, procurement, or
operating costs.
- Adds a preflight gate for connector readiness, required capabilities,
and applicable licensing.
- Defines safe degraded behavior: requirement and model artifacts may
still be produced, but no solver call or fabricated solution claim is
allowed.
- Adds a generic third-party dependency disclosure rule to both
repository instruction entrypoints.
- Bumps the Skill to `2.3.3` and the Market to `1.2.24`.

The official MindOpt documentation states that a valid license is
required and documents both commercial and community licenses;
eligibility and purchasing remain governed by those official terms:
https://opt.aliyun.com/doc/latest/en/html/installation/license.html

## 验证 / Validation

- `uv run --quiet scripts/i18n/test_validate_i18n.py` — 8 passed
- `uv run --quiet scripts/i18n/validate-i18n.py` — no issues
- `uv run --quiet scripts/i18n/translate.py --check` — current; human
translation hash aligned
- `git diff --check`
- Public-worktree customer-identity/path scan — 0 matches

2026-08-08 00:13:56 +08:00

3.4 KiB

Raw Blame History

AGENTS.md

This repository is a public marketplace. Every contribution must be reusable, customer-neutral, and safe to index publicly.

Public information boundary

Never put a tenant, customer, prospect, partner, or other confidential identity in tracked files, paths, filenames, Agent or Skill IDs, frontmatter, descriptions, examples, fixtures, memories, generated artifacts, or screenshots.
Apply the same rule to Git metadata and collaboration text: branch names, commit subjects and bodies, PR or issue titles and bodies, comments, and review replies.
Describe reusable capabilities with domain-neutral roles and entities. Put customer-specific prompts, facts, mappings, examples, data, and deployment settings only in private AgentFS homes, private repositories, or private runtime configuration.
Do not add a real confidential token to a denylist, test fixture, documentation, or example. A literal denylist in a public repository creates a second leak.

External dependency disclosure

A Skill or Agent that relies on separately licensed, purchased, hosted, or deployed third-party software must disclose that dependency in its discovery description, compatibility field, localized marketplace text, and execution instructions.
Distinguish an included connector or adapter Tool from the external product it accesses. Never imply that registering a Tool bundles, licenses, installs, pays for, or operates the third-party product.
State the operator prerequisites, applicable licensing or usage terms, separate costs when relevant, connection readiness checks, and safe degraded behavior. If the dependency is unavailable, stop before the external call and never fabricate a successful result.

Required pre-publication check

Before committing or opening/updating a PR:

Obtain the sensitive tokens through a private channel and keep them outside the repository.
Scan the complete working tree, including hidden files while excluding .git.
Scan new path names, branch names, commit subjects and bodies, and the proposed PR/issue/review text.
Review examples semantically: changing a proper noun is insufficient when an example still exposes a customer-specific organization shape or private fact.
Run the repository validation and translation-freshness checks documented in README.md.

A zero-result scan is a release requirement. Record only that the check passed; never persist the confidential search tokens or command history in the repository.

Incident response

If confidential identity or data reaches the public repository:

Stop the merge or release and neutralize all editable GitHub metadata.
Replace the public content with a genuinely reusable abstraction; do not merely rename the customer.
If reachable Git history is affected, make a mirror backup, rewrite only the affected history, verify expected tree objects, push with an exact lease, and restore branch protections immediately.
Treat pull-request refs, cached views, reviews, notifications, and search-engine caches as separate surfaces. Follow the hosting provider's sensitive-data removal process instead of claiming that a force-push removed them.
Re-run all publication checks before reopening or merging work.

Instruction synchronization

AGENTS.md and CLAUDE.md are equivalent repository policy entrypoints. Any substantive change to one must be made to the other in the same commit.

3.4 KiB Raw Blame History