From be7300b78c3bc4f5247ea6b7c9a5a3c89df1abd7 Mon Sep 17 00:00:00 2001 From: modusensus Date: Thu, 12 Nov 2026 03:13:59 +0800 Subject: [PATCH] fix(skills): keep every path reference inside the bundle ClawHub's security scan resolves code-quoted paths in SKILL.md against the skill bundle; the three docs/*.md pointers (fact-contract, stop-gate, positioning, both editions) name repository files the bundle does not ship, and the 0.11.0 listings have sat at security.status_not_clean for two days because of them. Repoint fact-contract to references/fact-contract.md, which the bundle carries, and name the other two documents in prose instead of a broken-looking path. --- .agents/skills/euthyna-en/SKILL.md | 10 +++++----- .agents/skills/euthyna/SKILL.md | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.agents/skills/euthyna-en/SKILL.md b/.agents/skills/euthyna-en/SKILL.md index 622c499..52c2a5c 100644 --- a/.agents/skills/euthyna-en/SKILL.md +++ b/.agents/skills/euthyna-en/SKILL.md @@ -182,7 +182,7 @@ reproduce/verification command: ## The fact contract (the interface between measurement and adjudication) This skill defines the interface between the measurement layer and the adjudication layer: -`docs/fact-contract.md`. +`references/fact-contract.md`. Key points: @@ -218,8 +218,8 @@ BUG #N INCONCLUSIVE — [reason it cannot be decided] **The third state `INCONCLUSIVE` must exist.** Trail of Bits' original fp-check has only two states because it uses a Stop hook to force infinite continuation until completion; -**DSH cannot do that** (the Stop hook must rate-limit itself or it loops forever, see -`docs/dsh-stop-gate.md`). So this honest exit must exist — "not finished" must never be +**DSH cannot do that** (the Stop hook must rate-limit itself or it loops forever; the measured +record lives in the project repository's DSH stop-gate document). So this honest exit must exist — "not finished" must never be written as `FALSE POSITIVE`. --- @@ -319,6 +319,6 @@ effective in long sessions. | Delivery gate mechanisms (`dsh-doublecheck`, `formalswarm`) | mechanisms worth borrowing; euthyna's gate content is the **security-specific** six gates | | Evidence lifecycle and PoC lab (`dsh-omv`) | can coexist: `dsh-omv` can be a **consumer** of the fact contract | -**euthyna only supplies the two deterministic measurements nobody else does** (see -`docs/positioning.md` §7.2): the mechanical adjudication of git security regressions, and +**euthyna only supplies the two deterministic measurements nobody else does** (the argument +lives in section 7.2 of the project repository's positioning document): the mechanical adjudication of git security regressions, and the "symbol × real execution coverage" join. diff --git a/.agents/skills/euthyna/SKILL.md b/.agents/skills/euthyna/SKILL.md index d7cdc78..8a7290a 100644 --- a/.agents/skills/euthyna/SKILL.md +++ b/.agents/skills/euthyna/SKILL.md @@ -160,7 +160,7 @@ node /bin/euthyna.js coverage --coverage <覆盖率文件绝对 ## 事实契约（测量与判定之间的接口） -本技能定义的是**测量层与判定层之间的接口**：`docs/fact-contract-zh.md`。 +本技能定义的是**测量层与判定层之间的接口**：`references/fact-contract.md`。 要点： @@ -196,7 +196,7 @@ BUG #N INCONCLUSIVE — [无法判定的原因] **第三态 `inconclusive` 必须存在。** Trail of Bits 的原始 fp-check 只有两态，因为它靠 Stop hook 无限强制继续直到补完； -**DSH 上做不到**（Stop hook 必须自带限流，见 `docs/dsh-stop-gate-zh.md`）。 +**DSH 上做不到**（Stop hook 必须自带限流；实测记录在项目仓库的 DSH stop-gate 文档）。 所以必须有这个诚实出口——不许把「没查完」写成 `FALSE POSITIVE`。 --- @@ -284,5 +284,5 @@ node /bin/euthyna.js gate <报告文件> --verify --cwd <被审 | 交付门禁机制（`dsh-doublecheck`、`formalswarm`） | 机制可借鉴；euthyna 的门禁内容是**安全专属**的 6 门禁 | | 证据生命周期与 PoC 实验室（`dsh-omv`） | 可并存：`dsh-omv` 可作为事实契约的**消费方** | -**euthyna 只补两件没人做的确定性测量**（见 `docs/positioning-zh.md` §7.2）： +**euthyna 只补两件没人做的确定性测量**（论证见项目仓库定位文档的第 7.2 节）： git 安全回归的机械判定，以及「符号 × 真实执行覆盖」的 join。