* docs(ito-compute): document ito accept and ito_accept MCP workflow
Updates the canonical ECC skill to cover the new quote acceptance path:
- CLI: ecc ito accept <ticket-id>
- MCP: ito_accept tool
- Explicit buyer-authority guard before accepting
- Clear statement that accept routes to desk, does not purchase
* test(ito-compute): assert the four-tool MCP boundary including ito_accept
The exact-boundary test pinned the three-tool description. Runtime
ito-compute-cli now exposes ito_accept (Ito-Markets/ito-cloud-runtime#1453),
so the template boundary assertion moves to four tools.
* docs(ito-compute): drop the firm-quote gate from the accept workflow
Desk quotes are indicative_paper in production (a firm quote requires the
separate human-held signing path and cannot reach the client), so gating
accept on 'a firm quote is ready' described an unfireable condition. Align
with the runtime contract: accept routes the current desk quote to human
review and the result carries quote_class (ito-cloud-runtime#1453).
Extends scripts/ci/validate-skills.js to also scan docs/{locale}/skills/
translated mirrors, not just curated skills/. Adds detection for the
YAML defect classes from #2630 without a parser dependency: unquoted
values containing ": " (glued next key / dropped quoting), values
starting with the reserved '@'/'`' indicators, and missing frontmatter
blocks entirely (required only for docs mirrors; curated skills/ keeps
its existing tolerant behavior).
Greptile flagged that the env-access guard in
gateguard-env-documented.test.js could be bypassed via reflective reads
of process.env (Reflect.get/has/set/deleteProperty/defineProperty/
getOwnPropertyDescriptor/ownKeys), since none of the existing
UNSUPPORTED_ACCESS patterns matched that form.
Add a rule that rejects Reflect.get/has/set/deleteProperty/
defineProperty/getOwnPropertyDescriptor/ownKeys(process.env, ...) and
three self-check fixture cases (Reflect.get, Reflect.has,
Reflect.ownKeys) so the guard is pinned against silently missing them
again.
Negative control: commenting out only the new rule reproduces exactly
the reported gap (the 3 new fixture cases fail with "access guard
missed: Reflect.get, Reflect.has, Reflect.ownKeys"); restoring it goes
back to 10/10.
The documentation surface test scanned the hook's raw source with two
regexes. That had two holes, both confirmed against the shipped parser:
- a GATEGUARD_* name appearing only in a comment or a string was counted
as a real read, and
- destructured, aliased and computed reads were invisible, so an
undocumented knob added in one of those forms would pass silently.
Blank comments, string literals, template-literal text and regex literals
before scanning, so only real code contributes. Blanking preserves length,
so `process.env[...]` keys are located in the blanked code and read back
from the raw source at the same offset.
Rather than chase every possible access form with regexes, the supported
forms are now enforced: destructuring, aliasing, spreading, enumerating
and computed keys fail the guard with instructions to either keep the
convention or extend the parser. Six self-checks cover the blanker and
the guard, including a regex literal containing a slash.
Refs #2573
CodeRabbit review on #2611, all four findings:
- GATEGUARD_DISABLED sat in a table introduced as 'these do not disable the gate'. Moved to its own full-disable section with ECC_GATEGUARD, and corrected the accepted values against ECC_DISABLE_VALUES (0/false/off/disabled/disable - the earlier draft would have implied 'no' works, which it does not).
- Documented that a leading **/ compiles to .*/ and so needs a preceding separator: verified by reproducing the hook's glob->regex translation, **/tests/** matches /repo/tests/foo.js but not a bare relative tests/foo.js. Docs now say so and the example carries both forms. Matcher behaviour deliberately unchanged - widening it is a behaviour change, not a docs fix.
- Reverse-drift check now compares documented names against the parsed env reads instead of hookSource.includes(), so a name surviving only in a comment or error string no longer satisfies it.
- readGateguardEnvNames builds one Set from collected matches instead of mutating via Set#add, per the repo's no-in-place-mutation guideline.
GateGuard reads five GATEGUARD_* environment variables that were absent
from skills/gateguard/SKILL.md, so the only discoverable escape hatch was
ECC_GATEGUARD=off - disabling the load-bearing destructive-Bash gate
along with the noisy ones (#2573).
Documented, with defaults and exact accepted values read from the hook:
- GATEGUARD_BASH_ROUTINE_DISABLED (was undocumented everywhere)
- GATEGUARD_EXEMPT_GLOBS (previously only in a 2.1.0 release note)
- GATEGUARD_BASH_EXTRA_DESTRUCTIVE (was undocumented)
- GATEGUARD_DISABLED (was undocumented)
- GATEGUARD_STATE_DIR (was undocumented; named in a runtime warning)
- GATEGUARD_FACT_FORCE_FULL_DENIALS (already documented; folded into the
same table for one lookup point)
Adds tests/ci/gateguard-env-documented.test.js, which asserts every
GATEGUARD_* variable the hook reads appears in the skill doc, and that the
doc names no variable the hook has stopped reading. That surface test is
what found the three knobs beyond the two the issue reported.
Docs and test only; no hook behaviour changes.
Refs #2573
Review feedback on #2879. stdout is async when it is a pipe, which is exactly
how tests/run-all.js runs these files, and process.exit() does not wait for
pending writes — so exiting that way can drop the Passed:/Failed: lines the
aggregator totals, defeating the point of printing them. The sibling
tests/ci/ito-*-skill.test.js files already use process.exitCode.
Still exits 1 on drift and 0 when clean.
Review feedback on #2879, citing rules/common/coding-style.md ("Immutability
(CRITICAL): ALWAYS create new objects, NEVER mutate existing ones"). Build one
list of locale entries, then derive the matched and orphaned sets from it with
filter/map, and build the canonical Map the same way.
Behaviour is unchanged and both mutations still fail: reintroducing the drift in
one locale file gives `Passed: 4, Failed: 3`, an orphan gives `Passed: 6,
Failed: 1`, both exit 1.
Review feedback on #2879: a locale file with no counterpart in `agents/` was
skipped, so every other case here silently passed over it. Retiring an agent
would leave its seven translations behind with nothing to compare against and
nothing to report it.
Collect those files while building the list and assert the collection is empty.
Zero today across 199 locale docs, so this changes no current result; planting
one orphan takes the file to `Passed: 6, Failed: 1` and exit 1.
`scripts/ci/validate-agents.js` reads only `agents/`, so the translated copies
under `docs/<locale>/agents/` were never validated against the agent they
describe — and drifted.
Two kinds of drift, both machine-checkable and both wrong in the same
direction (the translations were made from an older revision and never
re-synced):
- **Model tier, 39 files.** Every one names a costlier tier than ships:
haiku -> sonnet, sonnet -> opus. `security-reviewer` reads `opus` in ja-JP
and zh-TW; it ships `sonnet`.
- **Tool set, 15 files.** `security-reviewer` and `database-reviewer` list
`Write` and `Edit` in **all seven locales** — both agents ship read-only
(`Read, Grep, Glob, Bash`). `seo-specialist` in zh-CN adds a `Bash` the
canonical agent does not have. Documenting a reviewer as able to write is
the kind of inaccuracy someone auditing what these agents can touch would
act on.
Sync `model` and the `tools` set to canonical, preserving each locale's
existing list style so the diff is only the values that were wrong. The
`["a", "b"]` vs `a, b` formatting difference is left alone: it is consistent
per locale and carries no meaning.
Add `tests/ci/locale-agent-frontmatter.test.js` so this cannot drift back.
`tools` is compared as a set, not a string, so the style difference stays
legal; prose is not compared at all. The last case pins the specific failure:
a canonical read-only agent may never be documented with Write or Edit.
`.kiro/agents/` is deliberately excluded — it uses a different schema
(`allowedTools: [read, shell]`, no `model`), not a translation of this one.
Curated skill delegating to the canonical tasteforge package in
Ito-Markets/ito-video: taste interviews, style-pack validation, offline
distillation with measured grounding, deterministic cadence application to
local footage, EDL/FCPXML export, and generated-media provenance audits.
Provider (Fal) generation requires explicit separately authorized execution
and fails closed in ECC; local references never mean a saved provider
workflow. Registered in the opt-in media-generation install module, npm
files, and catalog counts via scripts/ci/catalog.js. Contract tests cover
frontmatter/triggers, the fail-closed boundary, manifest and npm-packed
discoverability (real tarball check opt-in via ECC_TEST_NPM_PACK=1).
Use no-follow file descriptors for legacy Codex snapshots, verification, restoration, and marker cleanup. Quarantine candidate removals and verify inode identity before deletion.
Carry the lifecycle runner as a verified artifact so privileged release workflows never dynamically check out and execute an output-selected revision.
dajiaohuang