agent-pet-companion/docs/development/validation.md

Validation Profiles / 验证层级

Commands listed here define proof boundaries; they do not prove that a commit passed. Use fresh command output, CI artifacts, or Release evidence for the exact commit and artifact. / 本文只定义证明范围；具体 commit 是否通过必须以新鲜命令输出、CI artifact 或 Release 证据为准。

Profiles / 层级

Profile / 层级	Main entrypoints / 入口	Proves / 能证明	Does not prove / 不能证明
Local fast	validate_pre_push.sh	Diff hygiene, source syntax, lightweight contracts, formatting, and compilation of touched Rust/Swift inputs / diff、语法、轻量合同、格式与受影响 Rust/Swift 编译	Complete tests, App assembly, visible UI, real Agents / 全量测试、App 组装、可见 UI 与真实 Agent
CI fast/core	parallel Rust lint/test shards, complete Swift interaction proof, schema/security/overlay validators	Deterministic logic, schemas, Swift models, native overlay interaction contracts, and packaged development App / 确定性逻辑、schema、Swift 模型、悬浮层交互合同与开发版 App	Visible UI, real Agents, real App Server generation / 可见 UI、真实 Agent、真实 App Server 制作
Simulated integration	validate_portable_pet_maker.sh, validate_connectors_runtime.sh	Isolated package production, QA freshness, connector generation/normalization, library flows / 隔离宠物制作、QA 新鲜度、连接器与宠物库流程	Artistic quality or a real provider task / 艺术质量或真实服务任务
macOS runtime	build_and_run.sh --verify, bundle/overlay/window/renderer/recovery validators	The packaged App/runtime, clean-home bundled pets, persistence, rendering, and exercised recovery / 打包 App、运行时、内置宠物、持久化、渲染与恢复	Unobserved UI behavior, real provider behavior, full profiling / 未直接观察的 UI、真实服务与完整性能结论
Real connectors	validate_real_agent_connectors.sh	Current managed adapters can emit through the local runtime without reading credentials / 当前受管适配器可通过本地运行时发送事件	Authentication, model execution, complete user task / 认证、模型执行、完整任务
Real App Server	validate_real_app_server.sh, optional soak_ai_pet_maker_six_hours.sh	Native input, generation/import, PetCore restart, same-job resume, exact-turn interrupt, worker stop, and thread archive; the soak additionally proves a real task duration above six hours / 原生输入、制作导入、PetCore 重启、同任务继续、精确 turn 中断、worker 停止与 thread 归档；soak 额外证明真实任务时长超过六小时	Visible rendering of the same artifact or unattended system sleep unless the matching host-UI step is also observed / 同一产物的可见渲染；未配合主机 UI 验收时也不能证明无人值守系统睡眠
Performance	validate_event_storm.sh, renderer summaries, external profiling	Measured bounded workload and renderer budgets / 已测量负载与渲染预算	CPU/GPU conclusions without matching profiler evidence / 未采集 profiler 时的完整性能结论
GitHub Release	build_release.sh --github-release --arch all and release artifact/API validators	Exact assets, identity, checksums, ZIP safety, ad-hoc signatures, thin architectures, native packaged acceptance, downloaded-asset equality / 资产、身份、校验和、安全、签名、架构、原生验收与下载一致性	Developer identity, notarization, stapling, default Gatekeeper trust, untested hardware / 开发者身份、公证、stapling、默认 Gatekeeper 信任与未测硬件

Build and validation are separate profiles. build_and_run.sh --run and the environment Run button assemble, statically inspect, and launch a development App; they do not execute the packaged runtime acceptance suite first. Development build identity is a stable fingerprint of runtime inputs and build variant, so an unchanged second Run keeps Cargo/Swift incremental products instead of recompiling because of a timestamp-only ID. Use build_and_run.sh --verify for full packaged runtime proof. build_app_bundle.sh --validation static|full exposes the same boundary for automation. / 构建与验证是两个层级。日常 Run 只组装并静态检查开发 App 后启动；开发 build ID 绑定运行时源码与构建变体，源码不变的再次 Run 不会因时间戳变化重编译。完整打包运行时证明使用 --verify。

Local default gate / 本地默认门禁

./script/validate_pre_push.sh --plan-only
./script/validate_pre_push.sh

The local default is deliberately bounded: it checks diff and source syntax, localization and lightweight Skill/workflow contracts when touched, Rust formatting plus cargo check, and strict Swift compilation. validate_local_tests.sh is an optional domain-manifest-driven focused entrypoint; it uses explicit changed paths, rejects stale or unknown domains, and falls back conservatively when no exact focused suite exists. Neither local path runs complete Rust or Swift tests, simulated connector/producer roundtrips, App assembly, stress, or release artifact validation. Those duplicate proofs belong to required GitHub CI. The local gate never launches the GUI, mutates user LaunchAgents, invokes real Agents, or reads credentials. / 本地默认门禁刻意保持轻量；可选的领域聚焦入口根据类型化领域清单和明确改动路径生成计划，拒绝未知领域，并在无法精确命中时保守回退。两条本地路径都不重复远端全量测试、组装、压力或发布验证，也不会启动 GUI、修改 LaunchAgent、调用真实 Agent 或读取凭据。

Source syntax validation also rejects absolute RFC 3339 dates in Rust fixtures that call event-retention write APIs, including dates reached through same-file fixture helpers. Such tests must capture one current UTC base and express ordering or expiry with relative offsets; fixed dates remain valid in isolated schema, serialization, and migration fixtures that do not cross a real wall clock. / 源码语法门禁还会拒绝 Rust 测试中调用事件保留写入 API（包括经同文件 fixture helper 间接调用）时使用固定 RFC 3339 绝对日期。这类测试必须捕获一次当前 UTC 基准并用相对偏移表达顺序或过期；不接触真实时钟的独立 schema、序列化与迁移 fixture 仍可保留固定日期。

validation_scope.py is the single path classifier used by local pre-push and CI. The routing contract is: / 本地预推送与 CI 共用 validation_scope.py，范围合同如下：

Change / 变更	Automatic proof / 自动证明	Not automatic / 不自动执行
Documentation only / 仅文档	links, syntax, diff hygiene / 链接、语法、diff	Rust, Swift, App build, Computer Use
Localization resources / 本地化资源	localization parity / 本地化一致性	full Swift, App build, Computer Use
Overlay-only Swift / 仅悬浮层 Swift	local compile; CI complete Swift interaction proof, offline overlay proof, and bundle / 本地编译；CI 全量 Swift 交互证明、离线悬浮层证明与 bundle	live UI is only recommended / 可见 UI 仅按需建议
Other Swift / 其他 Swift	local compile; CI complete Swift plus bundle proof / 本地编译；CI 全量 Swift 与 bundle	Computer Use unless visible behavior needs observation
Rust package / Rust package	local format/compile; CI strict lint plus inventory-checked parallel core and integration shards / 本地格式与编译；CI 严格 lint 及带清单校验的并行核心/集成分片	unrelated live UI / 无关可见 UI
Scripts/workflows / 脚本与 workflow	syntax and release-contract tests; bundle only for bundle-owning scripts / 语法与发布契约；仅 bundle 相关脚本触发 bundle	product UI acceptance
Release / 发布	Mandatory local Computer Use basic-function acceptance bound to the exact main commit, Swift 6.2+/SDK 26+ source gate, explicit stress, parallel thin builds, SDK 26 + macOS 14 deployment + weak-link inspection, native macOS 15 acceptance for both architectures, and packaged macOS 26 acceptance / 绑定精确 main commit 的必需本地 Computer Use 基础功能验收、Swift 6.2+/SDK 26+ 源码门禁、显式压力测试、双架构并行构建、SDK 26 + macOS 14 部署目标 + 弱链接检查、双架构 macOS 15 原生验收及 macOS 26 打包验收	repeated package execution after trusted digest equality

test_all.sh --resume remains an explicit local diagnosis tool, not a pre-push requirement. It stores successful step checkpoints under this worktree's Git directory and reports wall-clock duration. Use it only to reproduce a remote failure or investigate a complete gate locally. / test_all.sh --resume 仍可用于本地完整门禁排错，但不再是推送前要求；它会在当前 worktree 的 Git 目录保存成功步骤检查点并报告耗时，仅应在复现远端失败或本地排查完整门禁时使用。

./script/test_all.sh --resume
./script/test_all.sh --clear-cache

Rust integration-test consolidation uses canonical identities of package:leaf-module:test-name. A one-time migration audit runs validate_rust_test_shards.py --compare-identities /absolute/legacy/worktree; it executes cargo test -- --list on both layouts, removes only the new aggregator prefix, and requires the complete platform-specific identity set and digest to match. Normal CI separately checks every leaf assignment and exact shard completion without relinking the legacy binary layout. / Rust 集成测试合并以 package:叶模块:test-name 作为规范 identity；一次性迁移审计通过 --compare-identities 对新旧 worktree 实际运行 cargo test -- --list，只去除新 aggregator 前缀，并要求当前平台的完整 identity 集合与摘要一致。日常 CI 继续检查全部叶模块分配和精确分片完成证明，不重新链接旧 binary 布局。

Authoritative CI never consumes local checkpoints or calls the local fast gate. Portable contracts, source fetch, Rust lint, one linked Rust test build, and the five inventory-checked Rust execution shards run on Ubuntu; a bounded macOS platform shard proves Apple-only clippy and process/lifecycle behavior. Portable pet-maker validation may create a temporary build-ID/contract-digest-bound interaction fixture, but it is never uploaded or accepted as candidate/source proof; those identities require the independent native Swift producer. Cargo source caches have one writer and compiled-target consumers use exact OS, toolchain, lockfile, profile, and target identities without fuzzy restore prefixes. The native Swift producer is the sole writer for one strict-debug cache whose identity includes the runner platform, exact toolchain, complete tracked App source tree, and validation contract. Before restore it gives that exact tree a stable old timestamp; because the tree digest is in the key, changed source can never reuse the products, while a fresh checkout of unchanged source does not invalidate every restored object by mtime alone. The complete strict suite still executes after every restore. The same job packages commit-bound products into a bounded artifact that overlay and App-bundle consumers restore in parallel. Each successful Rust shard uploads a run/attempt-scoped completion marker, and an independent aggregate requires the exact five-marker set. Title/body-only PR edits run scope and Required CI bookkeeping without recreating merge tickets; retargeting and source changes remain actionable. / 权威 CI 将可移植合同、依赖获取、Rust lint、单次链接构建与五个执行分片迁至 Ubuntu，并保留有界 macOS 平台分片。可移植宠物制作验证可创建临时且绑定 build ID/合同 digest 的交互 fixture，但绝不上传或充当 candidate/source proof；后两者必须来自独立原生 Swift producer。Cargo source cache 单写，编译缓存使用精确身份且无模糊回退；原生 Swift producer 是 strict-debug cache 的唯一 writer，key 绑定 runner 平台、精确工具链、完整受版本控制 App 源树与验证合同。restore 前会把该精确源树规范为稳定的旧时间戳；源树 digest 已进入 key，因此源码变化绝不会复用旧产物，而同内容的新 checkout 也不会仅因 mtime 让全部对象失效。每次 restore 后仍执行完整严格套件。随后同一 job 打包 commit 绑定产物，供 overlay 与 App bundle 并行复用。标题/正文编辑只运行范围与汇总记账，不重建合并票据；改目标分支和源码变更仍是 actionable。

The Required CI summary uploads a bounded, content-free engineering metrics artifact. Definitions separate initial queue time, aggregate job execution, workflow wall time, and the longest completed path in the versioned CI needs graph; they also cover Linux/macOS job-minutes, peak macOS concurrency, exact cache observations, aggregate cache restore/save step time, inventory size and 24-hour churn, proof-promotion outcome and closed fallback category, domain/Amber/Red/former-monolith hotspot counts, and development-flow coordination counters. CI resolves the exact associated PR for both PR and main runs, reads its bounded coordination marker plus GitHub ready/merge timeline, then removes that source metadata before uploading only derived numbers. Metrics contain no source contents, PR text, credentials, or user paths and are compared through CI artifacts rather than durable progress documents. / Required CI 汇总会上传有界且不含内容的工程指标 artifact；定义明确区分首次排队、job 执行总量、workflow 墙钟与版本化 CI needs 图中的最长完成路径，并覆盖 Linux/macOS job-minutes、macOS 峰值并发、精确 cache、cache restore/save、库存与 churn、proof promotion、领域/Amber/Red/旧单体热点以及 development-flow 协调计数。PR 与 main run 都会解析精确关联 PR，从有界协调标记和 GitHub ready/merge timeline 派生数字，并在上传前删除这些源元数据；artifact 不含源码、PR 正文、凭据或用户路径。

On a trusted main validation (push or exact-SHA workflow_dispatch), CI first attempts exact-tree proof promotion. The post-CI merger uses the dispatch form after its GITHUB_TOKEN squash merge because token-produced ordinary events do not start another workflow; the dispatch fails closed unless its required SHA is the checked-out main commit. Promotion requires exactly one same-repository managed PR for the squash commit, one successful pull-request workflow with a successful Required CI, one live bounded candidate artifact, a tested merge whose ordered parents are the previous main commit and PR head, and a tested tree identical to the new main tree. CI/Release workflows, proof resolvers, interaction-proof definitions, and their routing contracts must also be unchanged from the previous trusted main commit, so a control-plane PR—including the first rollout of this mechanism—must complete the full main CI once before later PRs can reuse it. Promotion rebinds only the already-proven interaction identity; any failed check leaves the promotion output unset and schedules the complete release-grade main gates instead. / 受信任的 main 验证（push 或精确 SHA 的 workflow_dispatch）会先尝试精确 tree 证明晋升。CI 后合并器使用 GITHUB_TOKEN 完成 squash 合并后会采用显式派发，因为 token 产生的普通事件不会再启动 workflow；若必填 SHA 与 checkout 的 main commit 不一致，派发会 fail closed。晋升必须存在唯一的同仓库受管 PR 对应 squash commit、唯一成功且含成功 Required CI 的 PR workflow、唯一未过期的有界候选 artifact；测试合并的有序父提交必须是前一 main commit 与 PR head，且测试 tree 必须与新 main tree 完全一致。CI/Release workflow、证明解析器、交互证明定义及其路由合同还必须相对前一个受信任 main commit 保持不变，因此控制面 PR（包括本机制的首次上线）必须先完整执行一次 main CI，之后的 PR 才能复用它。晋升只重绑已经证明的交互身份；任一检查失败都会保持晋升输出为空，并改为调度完整 Release 级 main 门禁。

After a successful trusted main validation, CI uploads exactly source-proof.json and interaction-attestation.json as release-source-proof-FULL_COMMIT. The v3 proof binds repository, full commit and tree, latest stable baseline, trusted main issuer event/run, gate inventory, toolchain-contract digest, observed toolchains, interaction bytes, and either the full main validation run or the promoted pull-request validation commit/run/ref plus candidate-proof digest. Release accepts only a successful push or workflow_dispatch run of .github/workflows/ci.yml on main from the same repository and exact commit; missing, expired, duplicate, malformed, or mismatched proof fails closed. The Release rebinds the proven interaction contract to its final build ID without repeating the complete source suites. / 受信任的 main 验证成功后，CI 会以 release-source-proof-FULL_COMMIT 上传且仅上传 source-proof.json 与 interaction-attestation.json。v3 证明绑定仓库、完整 commit/tree、latest stable 基线、受信任 main 签发事件/run、门禁清单、工具链合同摘要、已观察工具链、交互证明字节，以及“完整 main 验证 run”或“被晋升的 PR 验证 commit/run/ref 与候选证明摘要”。Release 只接受同仓库、同 commit、main 上成功的 .github/workflows/ci.yml push 或 workflow_dispatch run；缺失、过期、重复、格式错误或不匹配均 fail closed，并只将已证明交互合同重新绑定到最终 build ID，不再重复全量源码测试。

Protected delivery is owned by the repository's idempotent ruleset applicator. Protected default branch requires pull requests, squash-only linear history, resolved conversations, current-base Required CI, and blocks force-push/deletion. Protected integration trains applies the PR, squash, and Required CI contract to gd-ops/train/*, but uses non-strict status checks and permits deletion after the final train PR. The trusted post-CI merger accepts only the exact CI workflow path, same repository, managed branch, successful Required CI, current merge ticket, and matching lane proof. It checks out only the trusted main verifier. PRs touching the enumerated CI/Release/merge/proof/ruleset control plane fail closed out of auto-merge and require a trusted manual squash, preventing a PR-authored workflow from proving itself. Ordinary direct/final-train merges dispatch exact-SHA main validation with bounded retries before source cleanup; reruns safely recover an already-merged PR and skip an existing queued/running/successful dispatch. Closed recovery treats the PR-list response as discovery only and requires an authoritative single-PR response to prove the merged state, exact base/head identity, and merge commit. Only the run that transitions an open PR to merged may delete an existing source ref, and only through an atomic force-with-lease bound to the proven head SHA. A closed replay accepts an absent ref but treats every existing ref as reused and fails closed without deleting it. Task-to-train merges deliberately dispatch nothing but use the same fresh-merge-only cleanup rule. / 受保护交付由幂等 ruleset 配置器负责。默认分支要求 PR、仅 squash 的线性历史、讨论已解决、基于最新基线的 Required CI，并禁止强推与删除；train 规则对 gd-ops/train/* 要求 PR、squash 与 Required CI，但采用 non-strict 检查并允许最终合并后删除。受信任的 CI 后合并器只接受精确 CI workflow 路径、同仓库、受管分支、成功 Required CI、当前 merge ticket 与匹配的通道证明，并只 checkout 受信任的 main 验证器。触及列举的 CI/Release/合并器/证明/ruleset 控制面的 PR 会 fail closed 退出自动合并并要求受信任人工 squash，防止 PR 自写 workflow 后自证。普通 direct/最终 train 合并会在源分支清理前用有界重试派发精确 SHA 的 main 验证；重跑可安全恢复已合并 PR，并跳过已有的 queued/running/successful 派发。closed 恢复只把 PR 列表响应用于发现，并要求权威单 PR 响应证明已合并状态、精确 base/head 身份与 merge commit。只有将 open PR 转为 merged 的本次 run 才能删除仍存在的源 ref，且必须使用绑定已证明 head SHA 的原子 force-with-lease；closed replay 接受 ref 已不存在，但会把任何仍存在的 ref 视为复用并 fail closed，绝不删除。task→train 不派发验证，但采用同一套“仅新鲜合并可清理”规则。

During the initial migration, reversible repository settings may be applied first. Push the workflows and wait for the new exact main Required CI to succeed before applying either ruleset. Full apply fails closed until that trusted check exists. / 首次迁移可先应用可逆仓库设置；必须先推送 workflow 并等待新的精确 main Required CI 成功，才能应用两个 ruleset。完整 apply 在该受信任检查存在前会 fail closed。

./script/configure_main_branch_ruleset.py --settings-only --apply
./script/configure_main_branch_ruleset.py
./script/configure_main_branch_ruleset.py --apply

Branch/worktree ownership and direct/train PR coordination are defined by Parallel development. / 分支、worktree 所有权及 direct/train PR 协调见并行开发文档。

Environment-dependent gates / 环境门禁

• APC_VALIDATE_HOST_UI=1 permits repository validators that affect a packaged App runtime. It does not itself invoke Computer Use.
• APC_MAIN_UI_COLD_LAUNCH_ITERATIONS=1..100 controls the real foreground Control Center stress loop inside validate_main_window_ui.sh (default 3; Release acceptance requires at least 20). Each iteration uses an isolated owned runtime and varied launch-request timing, then proves the exact window identifier, layer, alpha, frame, nonblank ScreenCaptureKit pixels, overlay presentation, and retained key-window identity. Screen Recording and Accessibility access must be available to the executing host; an unavailable observation fails this host gate rather than being inferred as passed. / 该变量控制真实前台控制中心的冷启动压力循环（默认 3，Release 验收至少 20）；每轮使用隔离运行时与不同的展示请求时序，并验证精确窗口标识、层级、透明度、尺寸、非空白像素、悬浮层展示及持续的 key-window 身份。主机缺少录屏或辅助功能权限时门禁直接失败，不得推断为通过。
• APC_VALIDATE_REAL_AGENT_CONNECTORS=1 permits checks against installed Agent CLIs and managed connector files. It never permits reading credential stores.
• APC_VALIDATE_REAL_APP_SERVER=1 permits the real App Server lifecycle validation. It deliberately requests native input, completes one pet, interrupts and restarts its owned PetCore, resumes a second task, then strictly cancels and verifies the exact Studio thread is archived or absent from the ordinary list. APC_REQUIRE_EXTERNAL_SKILL_SOURCE=1 keeps the strict release proof; lowering it weakens the result.
• APC_RUN_SIX_HOUR_MAKER_SOAK=1 runs the non-default six-hour gate. It holds a real task in durable waiting-for-user state for just over six hours, verifies the backend-authoritative duration includes that interval, and then runs the same resume/cancel lifecycle checks.
• APC_EVENT_STORM_COUNT changes the bounded stress workload.

Computer Use is evidence for visible App, menu bar, desktop pet, bubble, focus, pointer, keyboard, window lifecycle, update handoff, and multi-instance behavior. No build, test, CI, or release script invokes it automatically. It remains recommended for scoped UI-source changes, but it is mandatory once per exact clean main commit immediately before an explicit GitHub Release dispatch. That release acceptance uses the bounded checklist in docs/release/macos-release.md; only the same host_ui_tested_commit with host_ui_result=passed may dispatch. A failure or unobservable item blocks publication and is 交由用户决定. Documentation, localization, backend, schema, CLI, workflow, packaging-only, and release-metadata changes do not otherwise require it. Record structural-only conclusions separately from directly observed UI behavior. / Computer Use 用于可见 App 与真实交互证据，且任何构建、测试、CI 或发布脚本都不会自动调用；对一般 UI 源码变更仍是按范围建议执行，但每个准备发布的精确、干净 main commit 都必须在显式触发 GitHub Release 前完成一次。该验收使用 docs/release/macos-release.md 中的有界清单，只有相同的 host_ui_tested_commit 与 host_ui_result=passed 才能触发发布；失败或无法直接观察的项目会阻断发布并交由用户决定。文档、本地化、后端、schema、CLI、workflow、纯打包与发布元数据变更在其他情况下不要求 Computer Use。结构性结论与直接观察到的 UI 行为必须分开记录。

validate_overlay_interaction.sh runs the deterministic placement, snapshot, geometry, display-width, and telemetry suites and emits the build-bound interaction attestation. --swift-scope all folds that proof into one complete Swift run for Release. Real pointer, focus, keyboard, and lifecycle behavior remains a separate visible-UI acceptance step. / 悬浮层脚本验证确定性交互契约并生成 build 绑定证明；Release 使用 --swift-scope all 将证明合并到一次完整 Swift 运行中。真实交互仍是单独的可见 UI 验收。

Useful focused commands:

APC_VALIDATE_REAL_AGENT_CONNECTORS=1 ./script/validate_real_agent_connectors.sh
APC_VALIDATE_REAL_APP_SERVER=1 ./script/validate_real_app_server.sh
APC_RUN_SIX_HOUR_MAKER_SOAK=1 ./script/soak_ai_pet_maker_six_hours.sh
APC_EVENT_STORM_COUNT=1000 ./script/validate_event_storm.sh
APC_VALIDATE_HOST_UI=1 APC_MAIN_UI_COLD_LAUNCH_ITERATIONS=20 \
  ./script/validate_main_window_ui.sh
./script/validate_overlay_performance_summary.sh /absolute/summary.json 60

Report an unavailable environment gate as skipped, never passed. / 环境不具备时标记为 skipped，不能写成 passed。

Producer capability boundary / 制作能力边界

V3 runtime accepts low 192×208, standard 384×416, and high 576×624. A producer qualifies for a tier only when every untouched decoded 12:13 source crop meets or exceeds that tier before the one permitted downscale. Prompted dimensions, upscaling, padding, super-resolution, or extra batches do not establish source capacity.

The App's Codex-backed Studio and the built-in ChatGPT/Codex image path are qualified for low and standard, not high. Another workflow may produce high only after its actual decoded source passes the repository's capacity and representative-action checks. The V3 specification owns the normative package rule; transient measurements belong in CI or task evidence. / App 内 Studio 与内置生图只支持标清和标准；高清必须由真实来源像素满足要求的外部流程制作。实验数据不写入长期文档。

Release boundary / 发布边界

Official V1 distribution uses an explicit fail-closed workflow dispatch after the exact clean main commit passes the mandatory local Computer Use acceptance, followed by the build_release.sh --github-release path. Tag pushes do not publish. Local complete candidates use --arch all; automation uses --arch arm64|x86_64 as parallel components and assembles the checksum only after both pass. Development Apps and handoff archives are not official artifacts. Native arm64 and x86_64 packaged validation plus exact downloaded-byte equality are mandatory publication dependencies. The release procedure owns the Computer Use checklist, dispatch declaration, commands, and asset contracts.

Codex plugin/Skill changes also run validate_codex_plugin_version.py against the intended release base. It proves plugin/Skill version-marker discipline and rejects unsupported Hook-template top-level fields; it does not prove convergence of a particular user's active cache.

Do not paste validation results into this file. / 不要把某次验证结果粘贴到本文。