fix: make MCP bootstrap client-neutral by default
Owner integration: preserve all prior CI contracts, document explicit host selection on Windows, and make the Bash manifest regression UTF-8 deterministic.
fix: make case setup consistent across Windows, Linux, and macOS
Owner integration: preserve routing.json SSoT, keep reports optional by default, and require offline samples to resolve to real local files.
Keep reverse-skill a skill router, not a platform. RULES hot path is master-route then case-init then PRIMARY. MASTER-ROUTING priority is verified against routing.json. precedent-auth no longer grants. CTF is one R41 pointer, not 40 competition routes. open.ps1 never deletes .i64/.idb. Route-scope parse is line-anchored and last-match. Tests: 168 routing cases, parse-contracts, title-safety in CI.
PS 5.1 parses a BOM-less .ps1 as the system ANSI codepage, garbling the
Chinese / em-dash string literals in five scripts. verify-doc-facts.ps1
failed four checks under 5.1 (CI only ran it under pwsh). Add a BOM to the
five files and a CI guard that fails any non-ASCII .ps1 lacking one.
- New verify-doc-facts.ps1: checks RULES.md / RULES_zh.md / skills/SKILL.md
capability lists (24), MCP servicePort/servicePortRange values, and the
Burp tool count against bootstrap-manifest.json and getToolList() source
- ci.yml: run it in the routing-tests matrix (pwsh)
- Local run: 16 checks all pass
- Refactor examples/ctf-demo to satisfy the review_case.py contract:
split evidence/E-001-E-003.md into per-record E-001/E-002/E-003.md
with ### E-xxx headings and severity/status/repro_command fields
- Add evidence/checksec-output.txt artifact with matching content_hash so
--verify-hashes has a real object to verify
- Convert report.md finding/path sections to structured F-01/P-01 blocks
- New case-contract CI job runs review_case.py --verify-hashes --strict on
examples/ctf-demo; local result: PASS (0 errors, 0 warnings)
- New skills/scripts/scan-leaks.ps1: PSParser-free regex scanner for
public IPv4 (RFC1918/link-local/CGNAT/doc ranges excluded), email
(sample domains allowed), CN mobile, JWT, AWS AKIA, OpenAI sk-/sk-proj-,
GitHub/npm/Slack tokens, Google API keys, Stripe live keys
- Exit 1 on findings (CI gate); -ReportOnly for local preview
- Baseline clean: 41 field-journal files, 0 findings
- New leak-scan CI job runs the scanner on skills/field-journal
- anonymization.md now references the shipped script
- New step in sh-syntax job runs [Parser]::ParseFile over all tracked
.ps1 files (no execution, syntax-only); fails the build on any parse
error with file/line/column annotations
- Baselines clean locally: 24 tracked .ps1 files, 0 parse errors
- Closes the gap where Windows was the primary platform but only .sh
scripts had a CI syntax check
- VERSION was bumped to 1.1.0 at the v1.0.1 release commit but no 1.1.0
release exists; align to 1.0.1 so VERSION == latest CHANGELOG release
- Add version-check job to ci.yml (VERSION must match latest CHANGELOG [x.y.z])
- Add docs/RELEASE-CHECKLIST.md for release + metadata sync steps
- Fix benchmark case count in CHANGELOG: 162 -> 163 (routing-benchmark.json
actually contains 163 cases; ci.yml was already correct)
zhaoxuya520