Replace GNU-only sed -i in test-bash-workflow.sh with mktemp+sed+mv so
BSD sed runs case-guard reject-path tests 4/5. Wire the suite into
macos-bash-compat.yml.
Closes#135
test-consolidate-evidence.ps1 printed CONSOLIDATE_ALIGN_OK but leaked exit 1:
it ran review_case.py --verify-hashes on a case whose consolidation had (by
design) rewritten E-001.md, so hash fixity could never pass. Drop --verify-hashes,
assert review_case's exit code, and wire both this and
test-bootstrap-codex-encoding.ps1 into the Windows leg of routing-tests. Both
shipped in the repo but were never run by CI.
Add skills/scripts/verify-doc-links.py (wired into the case-contract CI
job): it fails on any internal Markdown link that does not resolve to a
tracked file, skipping fenced code, the generated tool-index.md, and the
vendored src-hunter corpus. Also remove a dangling phishing-case-study.md
pointer in field-notes.md whose target was never created (analysis is inline).
* test(ci): wire remaining unwired suites (rebase of #97)
Run test-p0-friction.ps1 on Windows PS 5.1 routing-tests.
Run case-review/tests/test_review_case.py in Linux case-contract.
Title-safety is already on main; do not duplicate that step.
* docs(changelog): note remaining CI suite wiring
fix: make MCP bootstrap client-neutral by default
Owner integration: preserve all prior CI contracts, document explicit host selection on Windows, and make the Bash manifest regression UTF-8 deterministic.
fix: make case setup consistent across Windows, Linux, and macOS
Owner integration: preserve routing.json SSoT, keep reports optional by default, and require offline samples to resolve to real local files.
Keep reverse-skill a skill router, not a platform. RULES hot path is master-route then case-init then PRIMARY. MASTER-ROUTING priority is verified against routing.json. precedent-auth no longer grants. CTF is one R41 pointer, not 40 competition routes. open.ps1 never deletes .i64/.idb. Route-scope parse is line-anchored and last-match. Tests: 168 routing cases, parse-contracts, title-safety in CI.
PS 5.1 parses a BOM-less .ps1 as the system ANSI codepage, garbling the
Chinese / em-dash string literals in five scripts. verify-doc-facts.ps1
failed four checks under 5.1 (CI only ran it under pwsh). Add a BOM to the
five files and a CI guard that fails any non-ASCII .ps1 lacking one.
- New verify-doc-facts.ps1: checks RULES.md / RULES_zh.md / skills/SKILL.md
capability lists (24), MCP servicePort/servicePortRange values, and the
Burp tool count against bootstrap-manifest.json and getToolList() source
- ci.yml: run it in the routing-tests matrix (pwsh)
- Local run: 16 checks all pass
- Refactor examples/ctf-demo to satisfy the review_case.py contract:
split evidence/E-001-E-003.md into per-record E-001/E-002/E-003.md
with ### E-xxx headings and severity/status/repro_command fields
- Add evidence/checksec-output.txt artifact with matching content_hash so
--verify-hashes has a real object to verify
- Convert report.md finding/path sections to structured F-01/P-01 blocks
- New case-contract CI job runs review_case.py --verify-hashes --strict on
examples/ctf-demo; local result: PASS (0 errors, 0 warnings)
- New skills/scripts/scan-leaks.ps1: PSParser-free regex scanner for
public IPv4 (RFC1918/link-local/CGNAT/doc ranges excluded), email
(sample domains allowed), CN mobile, JWT, AWS AKIA, OpenAI sk-/sk-proj-,
GitHub/npm/Slack tokens, Google API keys, Stripe live keys
- Exit 1 on findings (CI gate); -ReportOnly for local preview
- Baseline clean: 41 field-journal files, 0 findings
- New leak-scan CI job runs the scanner on skills/field-journal
- anonymization.md now references the shipped script
- New step in sh-syntax job runs [Parser]::ParseFile over all tracked
.ps1 files (no execution, syntax-only); fails the build on any parse
error with file/line/column annotations
- Baselines clean locally: 24 tracked .ps1 files, 0 parse errors
- Closes the gap where Windows was the primary platform but only .sh
scripts had a CI syntax check
- VERSION was bumped to 1.1.0 at the v1.0.1 release commit but no 1.1.0
release exists; align to 1.0.1 so VERSION == latest CHANGELOG release
- Add version-check job to ci.yml (VERSION must match latest CHANGELOG [x.y.z])
- Add docs/RELEASE-CHECKLIST.md for release + metadata sync steps
- Fix benchmark case count in CHANGELOG: 162 -> 163 (routing-benchmark.json
actually contains 163 cases; ci.yml was already correct)
zhaoxuya520