mirror of
https://git.openapi.site/https://github.com/desirecore/market.git
synced 2026-09-05 23:04:07 +08:00
Yige
b1f0719d40
## 变更说明 / Summary ### 中文 - 在 `workforce-optimization` 的发现描述、`compatibility`、中英文市场摘要和正文中明确 MindOpt 是需要独立安装/部署并取得有效许可证的外部第三方求解器。 - 明确 `MindOptSolve` 只是受治理的 Connector/Adapter，不包含 MindOpt 求解器软件、许可证、算力托管、采购或运行费用。 - 增加运行前检查：必须确认 Connector ready、capabilities 可用且部署具备当前用途所需的有效许可证；仅注册 Tool 名称不能证明依赖可用。 - 增加安全降级：外部依赖不可用时仍可完成需求澄清和建模制品，但不得调用求解器、伪造 `SolveResult` 或宣称可行/最优/收益。 - 在 `AGENTS.md` 与 `CLAUDE.md` 中固化通用的第三方商业依赖披露规则。 - Skill 版本升级到 `2.3.3`，Market 版本升级到 `1.2.24`。 MindOpt 官方文档说明运行前必须取得有效许可证，并同时提供商业许可和社区许可；适用范围与采购要求以官方条款为准： https://opt.aliyun.com/doc/mindopt/latest/cn/html/installation/license.html ### English - Discloses in discovery metadata, `compatibility`, localized marketplace text, and runtime instructions that MindOpt is separately installed/deployed third-party solver software requiring a valid applicable license. - Clarifies that `MindOptSolve` is only the governed connector/adapter and does not bundle the solver, license, hosted compute, procurement, or operating costs. - Adds a preflight gate for connector readiness, required capabilities, and applicable licensing. - Defines safe degraded behavior: requirement and model artifacts may still be produced, but no solver call or fabricated solution claim is allowed. - Adds a generic third-party dependency disclosure rule to both repository instruction entrypoints. - Bumps the Skill to `2.3.3` and the Market to `1.2.24`. The official MindOpt documentation states that a valid license is required and documents both commercial and community licenses; eligibility and purchasing remain governed by those official terms: https://opt.aliyun.com/doc/latest/en/html/installation/license.html ## 验证 / Validation - `uv run --quiet scripts/i18n/test_validate_i18n.py` — 8 passed - `uv run --quiet scripts/i18n/validate-i18n.py` — no issues - `uv run --quiet scripts/i18n/translate.py --check` — current; human translation hash aligned - `git diff --check` - Public-worktree customer-identity/path scan — 0 matches
70 lines
3.4 KiB
Markdown
70 lines
3.4 KiB
Markdown
# CLAUDE.md
|
|
|
|
This repository is a public marketplace. Every contribution must be reusable,
|
|
customer-neutral, and safe to index publicly.
|
|
|
|
## Public information boundary
|
|
|
|
- Never put a tenant, customer, prospect, partner, or other confidential identity
|
|
in tracked files, paths, filenames, Agent or Skill IDs, frontmatter, descriptions,
|
|
examples, fixtures, memories, generated artifacts, or screenshots.
|
|
- Apply the same rule to Git metadata and collaboration text: branch names, commit
|
|
subjects and bodies, PR or issue titles and bodies, comments, and review replies.
|
|
- Describe reusable capabilities with domain-neutral roles and entities. Put
|
|
customer-specific prompts, facts, mappings, examples, data, and deployment
|
|
settings only in private AgentFS homes, private repositories, or private runtime
|
|
configuration.
|
|
- Do not add a real confidential token to a denylist, test fixture, documentation,
|
|
or example. A literal denylist in a public repository creates a second leak.
|
|
|
|
## External dependency disclosure
|
|
|
|
- A Skill or Agent that relies on separately licensed, purchased, hosted, or
|
|
deployed third-party software must disclose that dependency in its discovery
|
|
description, `compatibility` field, localized marketplace text, and execution
|
|
instructions.
|
|
- Distinguish an included connector or adapter Tool from the external product it
|
|
accesses. Never imply that registering a Tool bundles, licenses, installs, pays
|
|
for, or operates the third-party product.
|
|
- State the operator prerequisites, applicable licensing or usage terms, separate
|
|
costs when relevant, connection readiness checks, and safe degraded behavior.
|
|
If the dependency is unavailable, stop before the external call and never
|
|
fabricate a successful result.
|
|
|
|
## Required pre-publication check
|
|
|
|
Before committing or opening/updating a PR:
|
|
|
|
1. Obtain the sensitive tokens through a private channel and keep them outside the
|
|
repository.
|
|
2. Scan the complete working tree, including hidden files while excluding `.git`.
|
|
3. Scan new path names, branch names, commit subjects and bodies, and the proposed
|
|
PR/issue/review text.
|
|
4. Review examples semantically: changing a proper noun is insufficient when an
|
|
example still exposes a customer-specific organization shape or private fact.
|
|
5. Run the repository validation and translation-freshness checks documented in
|
|
`README.md`.
|
|
|
|
A zero-result scan is a release requirement. Record only that the check passed;
|
|
never persist the confidential search tokens or command history in the repository.
|
|
|
|
## Incident response
|
|
|
|
If confidential identity or data reaches the public repository:
|
|
|
|
1. Stop the merge or release and neutralize all editable GitHub metadata.
|
|
2. Replace the public content with a genuinely reusable abstraction; do not merely
|
|
rename the customer.
|
|
3. If reachable Git history is affected, make a mirror backup, rewrite only the
|
|
affected history, verify expected tree objects, push with an exact lease, and
|
|
restore branch protections immediately.
|
|
4. Treat pull-request refs, cached views, reviews, notifications, and search-engine
|
|
caches as separate surfaces. Follow the hosting provider's sensitive-data
|
|
removal process instead of claiming that a force-push removed them.
|
|
5. Re-run all publication checks before reopening or merging work.
|
|
|
|
## Instruction synchronization
|
|
|
|
`AGENTS.md` and `CLAUDE.md` are equivalent repository policy entrypoints. Any
|
|
substantive change to one must be made to the other in the same commit.
|