v2.10.0 — purity-audit skill + product-icon guideline + self-purity audit

新增

• purity-audit skill (09-operate) — 把 16 点 purity checklist 操作化为技能。grep 驱动的 A/B/C 扫描（溯源残留 / 装饰冗余 / 死内容）+ 人工判断的 D/E（doc-impl 裂隙 / 语言平台残留）;大目标可选 5 子 agent 扇出审计（只读审计并行、修复串行回主 agent,避免编辑竞态）;产物 docs/audit/YYYY-MM-DD-purity.md。含完整子 agent 派发示例（构造上下文模板 + Category A 实例 + mermaid 流程）。
• references/product-icon.md — 产品 icon 生成准则:不简单图形 + 简单配色（单一原始形状 + 平涂 = 占位符,非上线产品 icon）。准则落地于真实 OSS icon 系统——Phosphor（duotone 多层）、Material Symbols（可变轴）、Fluent UI（光学平衡）、Lucide/Heroicons（UI glyph 边界:单色线图标做 UI 控件对、做产品标错）。从 imagegen + frontend-design 链入。

自纯净审计（践行所传之道）

对整个包做 16 点自审（196 md + 4 脚本）。包整体干净,修了 2 个真实问题:

• A1/A2 — docs/TODO.md 溯源残留:日期化来源块、已完成项版本标签（v2.7.0/v2.6.0/v2.0.0）、"收割版"版本词、日期化评估快照 → 外科式剥离（结构/路线图不动）
• C9 — brand-mode.md 死链 anti-tells.md（文件在 frontend-design/references/,validator 只查 SKILL.md 链漏了）→ 改为 ${CLAUDE_PLUGIN_ROOT} 跨技能路径

审计报告:docs/audit/2026-09-01-purity.md

根因修（一致部署生命周期）

• validate-skills.sh 6 处 open() 未指定 encoding="utf-8" → GBK 区读含 →/— 的 plugin.json 崩溃。已全补 UTF-8。
• gen-agents-yaml.py write_text() 未指定 newline → Windows 写 CRLF,与 .gitattributes 的 LF 要求冲突,47 个无关适配器被标"已修改"。已加 newline="\n",重跑后 47 个预存适配器恢复干净。

接线

manifest 47 → 48、版本 2.9.0 → 2.10.0、5 处路由面（README×2 / AGENTS / using-skills / phase-tree）、产物矩阵、validator 期望计数同步。

验证器:48/48 skills,0 errors。

---

Full changelog: v2.9.0...v2.10.0

v2.9.0 — purity-checklist reference + full-park purity audit

What's new

v2.9.0 combines two pieces: a new shared purity-checklist reference, and a full-park purity audit that applies it.

1. New reference: references/purity-checklist.md

An audit checklist for the purity principle — 16 checks across 5 categories (溯源残留 / 装饰冗余 / 死内容 / doc-impl 裂隙 / 语言平台残留). Complements engineering-principles.md (behavior discipline) with a "what to check" audit tool. Generic — applies to code, skill docs, README, any reference.

2. Full-park purity audit — 24 findings fixed

12 parallel agents audited all 47 skills against the checklist. 24 findings across 8 skills, all fixed:

Category	Count	Highlights
A 溯源残留	2	frontend-design merge-history & past-state narratives removed
B 装饰/冗余	4	tdd Not-for/Exceptions conflict resolved; verbatim trigger copies dropped; duplicated 'Faster is safer' removed
C 死内容	1	observability dead cross-skill link fixed (../incident-response/ → ${CLAUDE_PLUGIN_ROOT}/skills/09-operate/incident-response/)
D doc/impl 裂隙	13	research §9.1 enum drift; burn-rate window mismatch; brand-mode missing anti-tells ref; ADR path; styles count 18→21; auth/i18n/e2e/simplify/cost Verify-Steps gaps; using-skills phase-tree drift; ci-cd canary thresholds
E 语言/平台残留	4	跨-row→cross-row; 实战→'a later run'; popularity justification dropped; project-specific 'Default for this project' removed

Method

Per the skill's own clone-to-archive discipline, 3 deep-research frameworks (gpt-researcher, open_deep_research, STORM) were cloned into archive/ and analyzed to validate the research skill's spine — that analysis informed the genre boundary declaration in v2.8.1. The purity checklist then applied uniformly across all 47 skills via 12 parallel audit agents.

Files

• references/purity-checklist.md — NEW (16-check audit tool)
• 32 files across 8 skills — purity fixes (see commit de6e0a1 for the full breakdown)
• plugin.json, README.md, README.zh-CN.md — 2.8.1 → 2.9.0

Validator green: 47/47, 0 errors.

Full diff: v2.8.1...v2.9.0

v2.8.1 — research skill: purity cleanup + genre boundary

What's new

Two fixes to the research skill after v2.8.0.

1. pressure-scenarios.md — purity cleanup

Section headers carried batch/version provenance labels (RED 基线失败（已观测） / 原有基线失败（保留） / （DeepSeek 事件新增） / （v2.8.0 spine 重构新增）). The grouping was organized by when scenarios were added — violating the purity principle (files read as if written for the first time; provenance belongs in git log). Regrouped by failure dimension: 报告产出失败 / 流程与校验失败 / 源策略与验证失败 / 结论优先与 provenance 失败. Removed a dead line too.

2. report-spine.md — genre boundary declaration

Added a Scope section: the spine covers decision-oriented reports (selection / market / survey-for-action), not the expository-encyclopedia genre (e.g. STORM Wikipedia-style). A conclusion-first TL;DR, decision flowchart, and 避坑清单 serve a decision; an encyclopedia has none and should not be forced into this spine.

Validation: cloned 3 frameworks into archive/

Per the skill's own clone-to-archive discipline, analyzed gpt-researcher / open_deep_research / STORM source. Findings:

• gpt-researcher + open_deep_research: validate §3-§7 body + parallel fan-out, but are conclusion-last with invisible/no fact-checking — the anti-pattern the spine improves on.
• STORM: different genre (Wikipedia-style expository) — legitimately outside the spine's scope, motivating the genre boundary.

The spine's §1/§2/§8/§9 are novel bets filling gaps in these frameworks (silent source drops, invisible fact-checking, conclusion-last), not conventions borrowed from them. Added ## Contents TOC (file crossed 100 lines).

Files (5 changed, +27/−8)

• references/pressure-scenarios.md — regrouped by failure dimension
• references/report-spine.md — Scope (genre boundary) + Contents TOC
• plugin.json, README.md, README.zh-CN.md — 2.8.0 → 2.8.1

Full diff: v2.8.0...v2.8.1

v2.8.0 — research skill: conclusion-first 9-section spine

What's new

A bold redesign of the research skill. All three modes (general / market / tech-selection) now share a conclusion-first 9-section spine, extracted to a new report-spine.md to prevent drift and keep SKILL.md lean.

The spine (fixed across modes)

§1 TL;DR (conclusion bullets)
  → §2 核心认知 (mental models + ONE main thread + decision flowchart)
  → §3-§7 主体 (mode-specific)
  → §8 避坑清单 (numbered negative claims with falsification trails)
  → §9 源附录与核查记录 (sources + 负面断言核查记录 + UNVERIFIED + 访问限制与缺口)

Why

The old templates were process-first (§1 = 目标 + 调研方法, conclusion buried at §6/§7) and inconsistent (general 7-section / market mislabeled 6 / tech-selection 10-section). The user's own reference report (2026-08-19-ai-research-tools.md) proved conclusion-first reads better — it opens with "选什么" TL;DR, establishes a single decision main thread in §2, and makes verification visible (避坑清单 + 核查记录) instead of buried.

Key decisions (6 blind spots fixed via pressure-test)

• Spine extracted to report-spine.md (not inlined in Step 5) — keeps SKILL.md at 136 lines (<150), prevents three-mode drift, follows progressive disclosure.
• §6 评估 redefined to "per-dimension evidence-backed analysis" — resolves overlap with §1 TL;DR.
• tech-selection 10→9 — "效果如何" folds into §7 维度核心结论; validation plan moves to §9.4.
• Dropped mermaid "mixing flowchart/sequenceDiagram" requirement — the reference report uses flowchart-only and is excellent; new rule: ≥1 decision flowchart in §2, general ≥3, each serves information.
• Glossary optional — inline-explain all jargon; aggregate in §9 only if not all were inline-explained.
• Fixed pre-existing drift bug — SKILL.md said "6-section market" but market-mode.md had 7; all three now uniformly 9-section.

Also added

• Step 3: source-code material → git clone --depth 1 into archive/ (gitignored provenance) rather than remote fetch.
• pressure-scenarios.md: synced scenarios 2/3/5/11 + added 4 new failure modes (结论后置 / 避坑缺失 / 核查记录缺失 / 源码远程读取).

Files (9 changed, +363/−128)

• references/report-spine.md — NEW (shared spine + skeleton shell)
• SKILL.md — Step 3 clone note, Step 5 spine pointer, Verify checks, References
• general-mode.md — 7→9 section + TOC
• tech-selection-mode.md — 10→9 section, mirrors reference report
• market-mode.md — 7→9 section
• pressure-scenarios.md — sync + 4 new scenarios
• plugin.json, README.md, README.zh-CN.md — version bump 2.7.1 → 2.8.0

Codex adapter (agents/openai.yaml) unchanged — frontmatter description was not modified.

Full diff: v2.7.1...v2.8.0

v2.7.1 — research skill: web-tool-fallback reference

What's new

• research skill — new reference web-tool-fallback.md: tiered retrieval-tool fallback by quota dependency (Tier 0 GitHub source fetch → Tier 1 indexed docs lookup → Tier 2 full-page scrape → discovery layer), orthogonal to Step 3's page-level retries.

Why

When a fetch tool is blocked by network policy or a search tool's scrape quota is exhausted, the research skill had page-level retry guidance but no tool-level switch strategy. This reference encodes the fallback ladder without coupling to any environment's specific blocked domains or quota state — generic tiers only, tool names given as role examples.

Files

• skills/02-research/research/references/web-tool-fallback.md — new (~60 lines)
• skills/02-research/research/SKILL.md — Step 3 + References list link the new ref
• .claude-plugin/plugin.json, README.md, README.zh-CN.md — version bump 2.7.0 → 2.7.1

Full diff: v2.7.0...v2.7.1

v2.7.0 — 47 skills, validator hardening, full content audit

v2.7.0 — 47 skills, validator hardening, full content audit

Covers all changes since v2.2.0 (tag flow was interrupted; v2.7.0 restores it).

New skills (45 → 47)

• auth-implementation (04-develop) — correct auth implementation: session vs token, password hashing, JWT/refresh rotation, OAuth2/OIDC+PKCE, RBAC/ABAC. Builds what security-review audits. + token-patterns.md + oauth-flows.md
• error-handling (04-develop) — error propagation strategy: classification, throw-vs-return, retry/circuit-breaker/fallback, error-to-user mapping. Implementation-level companion to architecture/error-resilience.md. + retry-patterns.md

Validator hardening (Tier A)

• A1 security scan — scans all bundled files (not just SKILL.md) for reverse shell, obfuscated exec, hardcoded secrets, bare-IP, cloud cred paths, persistence, unofficial sources, system-path rm, prompt-injection phrases. Context-aware: POST-body exfil, global install, nohup, suspicious domains — 0 false positives on the clean pack.
• A2 structural drift — frontmatter name == dir, kebab-case, description ≤1024 chars.
• A3/A4 router — no-skill-hit fallback chain + anti-rationalization red-flag table.

Content audit fixes (Tier F, ~40 defects)

• HIGH (10): OWASP 2017→2021, git push over-block comment, flyway undo paid-only, oss-polish hardcoded script scope, drift grep false-negatives, refactoring empty refs (new catalog), TTI→INP, RSC i18n (new ref), ADR format contradiction unified.
• MEDIUM/LOW (~30): Chinese→English translations, CC BY-NC-SA→BY 4.0, X-Request-ID→Idempotency-Key, P95→P99, Cursor→real OSS cases, CONCURRENTLY INVALID warning, WCAG subset note, 400/422 disambiguation, k8s FinOps section, caching depth, platform rollback commands, + more.

Depth refs (Tier B, 6 new)

sql-optimization · design-system-audit · openapi-lifecycle · changelog-and-release-notes · slo-implementation · on-call-shift

Anatomy guidance (Tier D)

Reference depth (one level), on-demand load table, pressure-test scenario files, rationalization table, optional CREATION-LOG — written into skill-anatomy.md.

Behavioral eval harness (experimental / 待完善)

RED-GREEN harness built (Phase 2) with artifact persistence + partial-transcript recovery. Formal runs on GLM-5.2 do not yet discriminate (strong model passes without the skill). CI workflow deleted; tuning roadmap in docs/TODO.md A5. See the 8-system reference table (SWE-bench, skill-creator, obra, addyosmani, CR-Bench, OpenRCA, DashBench, c-CRAB).

Purity audit

Count sync (43→47 everywhere), dead fields removed (runs/fixture_setup), doc↔impl contradictions fixed (eval-tiers claims vs validator reality, performance Output declaration, grader schema), no residual artifacts.

Validator: 47 skills, 0 errors.