fix: block P1 writes after assertion unknown

Author: Saitamasans

.github/workflows/ci.yml

@@ -110,7 +110,7 @@ jobs:
       - run: python scripts/generate_supply_chain_docs.py
       - run: python scripts/build_skill_bundle.py --platform windows-x64
       - run: python scripts/verify_checksums.py build/release/SHA256SUMS.txt build/release
-      - run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/ci_bundle_smoke.ps1 -BundleZip build/release/multi-api-test-executor-0.1.1-windows-x64.zip
+      - run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/ci_bundle_smoke.ps1 -BundleZip build/release/multi-api-test-executor-0.1.2-windows-x64.zip
       - uses: actions/upload-artifact@v4
         with: {name: bundle-windows-x64, path: build/release/*}
 
@@ -128,7 +128,7 @@ jobs:
       - run: python scripts/generate_supply_chain_docs.py
       - run: python scripts/build_skill_bundle.py --platform linux-x64
       - run: python scripts/verify_checksums.py build/release/SHA256SUMS.txt build/release
-      - run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.1-linux-x64.zip
+      - run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.2-linux-x64.zip
       - uses: actions/upload-artifact@v4
         with: {name: bundle-linux-x64, path: build/release/*}
 
@@ -146,6 +146,6 @@ jobs:
       - run: python scripts/generate_supply_chain_docs.py
       - run: python scripts/build_skill_bundle.py --platform macos-x64
       - run: python scripts/verify_checksums.py build/release/SHA256SUMS.txt build/release
-      - run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.1-macos-x64.zip
+      - run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.2-macos-x64.zip
       - uses: actions/upload-artifact@v4
         with: {name: bundle-macos-x64, path: build/release/*}

.github/workflows/release.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: Existing v0.1.1 tag to build
+        description: Existing v0.1.2 tag to build
         required: true
         type: string
   push:
@@ -79,10 +79,10 @@ jobs:
       - run: python scripts/build_skill_bundle.py --platform ${{ matrix.platform }}
       - run: python scripts/verify_checksums.py build/release/SHA256SUMS.txt build/release
       - if: runner.os == 'Windows'
-        run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/ci_bundle_smoke.ps1 -BundleZip build/release/multi-api-test-executor-0.1.1-${{ matrix.platform }}.zip
+        run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/ci_bundle_smoke.ps1 -BundleZip build/release/multi-api-test-executor-0.1.2-${{ matrix.platform }}.zip
       - if: runner.os != 'Windows'
-        run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.1-${{ matrix.platform }}.zip
-      - run: python scripts/package_release_asset.py --bundle build/release/multi-api-test-executor-0.1.1-${{ matrix.platform }}.zip --platform ${{ matrix.platform }} --tag ${{ inputs.tag || github.ref_name }}
+        run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.2-${{ matrix.platform }}.zip
+      - run: python scripts/package_release_asset.py --bundle build/release/multi-api-test-executor-0.1.2-${{ matrix.platform }}.zip --platform ${{ matrix.platform }} --tag ${{ inputs.tag || github.ref_name }}
       - uses: actions/upload-artifact@v4
         with:
           name: release-${{ matrix.platform }}
@@ -116,6 +116,6 @@ jobs:
       - uses: softprops/action-gh-release@v2
         with:
           files: artifacts/*
-          body_path: docs/release-notes-v0.1.1.md
+          body_path: docs/release-notes-v0.1.2.md
           prerelease: ${{ contains(inputs.tag || github.ref_name, '-') }}
           fail_on_unmatched_files: true

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.2 - 2026-07-22
+
+- Block `assertion_unknown` continuation before every later P0 or P1 write, including ordinary POST, PUT, and PATCH requests even when P1 is approved.
+- Added integration and installed-CLI offline E2E coverage proving that a prior HTTP-only assertion never sends a later ordinary P1 write.
+
 ## 0.1.1 - 2026-07-21
 
 - Made empty and HTTP-only assertions `assertion_unknown`, stopped dependencies by default, and made auto-generated skeletons preview-only.

README.md

@@ -4,7 +4,7 @@
 
 > 第十个 Skill｜ATIR 多接口执行与证据回填
 
-执行人工、项目 Pack 或 Skill 生成的 ATIR 多接口工作流，完成动态参数传递、确定性断言、证据保存和结果回填。v0.1.1 的确定性 compile 主要生成单接口骨架；不能仅凭 OpenAPI 自动可靠生成完整业务链路，登录识别、动态依赖以及 token/order_id 链路仍需项目规则或人工确认。
+执行人工、项目 Pack 或 Skill 生成的 ATIR 多接口工作流，完成动态参数传递、确定性断言、证据保存和结果回填。v0.1.2 的确定性 compile 主要生成单接口骨架；不能仅凭 OpenAPI 自动可靠生成完整业务链路，登录识别、动态依赖以及 token/order_id 链路仍需项目规则或人工确认。
 
 ## 它解决什么问题
 
@@ -109,6 +109,7 @@ multi-api cache clear
 ## 执行、断言与风险
 
 - 模式字段支持 quick/standard/deep；v0.1 Runner 共享同一确定性执行内核。
+- `assertion_unknown` 默认阻断依赖步骤；仅在显式开启 continuation、测试环境、必需提取成功且所有剩余步骤都是安全只读时才可继续。任何后续 P0/P1 写操作（包括普通 POST/PUT/PATCH）均不得发送，即使已批准 P1。
 - 请求支持 GET/POST/PUT/PATCH/DELETE、JSON、query、header、form、Cookie/session，以及 JMESPath/header/cookie/regex 提取。
 - 断言支持 HTTP、JSON 存在/值/类型、JSON Schema、跨步骤期望解析和有限 eventual 轮询。
 - 只有网络/超时和 502/503/504 可有限重试；400 和业务响应不重试。
@@ -140,7 +141,7 @@ evidence/RUN_ID/
 - `post_checks` 可对 SQLite 执行真实只读参数化查询，并对行数、字段值断言；PostgreSQL/MySQL 适配使用只读事务并配置 CI service 验证。
 - 首次 Ctrl+C 优雅取消并保存部分证据、summary 和 manifest；第二次写最小标记后退出。退出码 4。
 - cleanup 是独立审计阶段，只接受本次步骤提取的资源 ID；404 为 `already_absent`，失败不覆盖 `business_status`。
-- PluginLoader 与 Protocol 已存在，但 v0.1.1 的 auth、crypto、verifier、data_factory、cleanup 尚未全部接入 Runner 项目配置；当前插件能力为 SDK Preview，不宣传为成熟可直接配置的插件系统，完整接入计划放在 v0.2。
+- PluginLoader 与 Protocol 已存在，但 v0.1.2 的 auth、crypto、verifier、data_factory、cleanup 尚未全部接入 Runner 项目配置；当前插件能力为 SDK Preview，不宣传为成熟可直接配置的插件系统，完整接入计划放在 v0.2。
 - HTML 展示 readiness、冲突、数据库、cleanup、插件、人工核验、取消和截断并自动转义。Codex 默认仅读取受限的 `summary_for_ai.json`。
 
 退出码：`0` 通过，`1` 测试/断言/cleanup 失败，`2` 输入或 preflight 错误，`3` 基础设施错误，`4` 用户取消，`5` 部分完成/预算耗尽，`6` 内部错误。

README_EN.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/Saitamasans/skill-multi-api-test-executor/actions/workflows/ci.yml/badge.svg)](https://github.com/Saitamasans/skill-multi-api-test-executor/actions/workflows/ci.yml)
 
-## V0.1.1 capabilities and limits
+## V0.1.2 capabilities and limits
 
 The runner supports real read-only SQLite post-checks, PostgreSQL/MySQL adapters, graceful cancellation with partial evidence, audited cleanup, an allowlisted plugin SDK, escaped RC HTML reports, and compact `summary_for_ai.json` output. Security controls include local-only OpenAPI refs, Postman script non-execution, SSRF policies, bounded evidence, Excel formula neutralization, and installer SHA-256 checks.
 
@@ -14,7 +14,9 @@ An execution Skill that runs ATIR multi-API workflows authored by people, projec
 
 Postman is a basic request-outline import. Markdown extracts Method/Path conservatively without inventing parameters or assertions. Excel provides basic case mapping and copy-only result backfill. Apifox deterministic support is limited to OpenAPI exports. Automatically compiled HTTP-only skeletons stop at preview with `business_assertion_missing`.
 
-PluginLoader and the plugin Protocols exist, but auth, crypto, verifier, data_factory, and cleanup are not all wired into Runner project configuration. Plugins are an SDK Preview in v0.1.1; complete integration is planned for v0.2.
+An `assertion_unknown` stops dependent steps by default. Explicit continuation is limited to fully extracted, non-production safe reads; every later P0 or P1 write, including an ordinary POST, PUT, or PATCH, is blocked even when P1 was approved.
+
+PluginLoader and the plugin Protocols exist, but auth, crypto, verifier, data_factory, and cleanup are not all wired into Runner project configuration. Plugins are an SDK Preview in v0.1.2; complete integration is planned for v0.2.
 
 It is not a report generator. HTTP 200 is transport evidence, not automatic business success. The Runner never derives expectations from observed responses, never claims execution without evidence, never retries business failures, and blocks production by default.
 

SKILL.md

@@ -20,13 +20,14 @@ This is an execution Skill. Use the installed deterministic `multi-api` Runner f
 
 ## Plugin status
 
-PluginLoader and Protocol definitions exist, but auth, crypto, verifier, data_factory, and cleanup are not all connected to Runner project configuration. Treat plugins as SDK Preview in v0.1.1; do not present them as a mature directly configurable system. Complete integration is deferred to v0.2.
+PluginLoader and Protocol definitions exist, but auth, crypto, verifier, data_factory, and cleanup are not all connected to Runner project configuration. Treat plugins as SDK Preview in v0.1.2; do not present them as a mature directly configurable system. Complete integration is deferred to v0.2.
 9. Report the concise verdict, business and cleanup status, failed assertion source, evidence/HTML paths, missing materials, conflicts, manual checks, and known truncation. Do not paste raw logs or full responses.
 
 ## Integrity Rules
 
 - 没有证据不得声称执行完成。A generated plan or report is not execution evidence.
 - HTTP 200 is transport success only. It is never sufficient for business success unless an independent sourced business assertion also passes.
+- `assertion_unknown` blocks dependent steps by default. Explicit continuation may cross only safe reads; never send a later P0 or P1 write, including ordinary POST, PUT, or PATCH, even when its risk is approved.
 - Distinguish `failed` from `infrastructure_error`, `blocked`, `cancelled`, and manual checks.
 - Do not treat source code or actual responses as product truth when sources conflict. Mark affected rules `rule_conflict` and suspend or downgrade only impacted business assertions.
 - Never execute production by default, mutate databases, delete unknown data, retry business failures, poll indefinitely, or persist unredacted credentials.

docs/release-notes-v0.1.2.md

@@ -0,0 +1,19 @@
+# Multi-API Test Executor v0.1.2
+
+v0.1.2 is a narrowly scoped safety release for the deterministic ATIR workflow Runner.
+
+## Unknown assertion continuation
+
+- `assertion_unknown` stops dependent steps by default.
+- The optional continuation path remains limited to a successful, fully extracted, non-production safe-read chain.
+- A later P0 or P1 write now blocks continuation before any later request is sent. This includes ordinary POST, PUT, and PATCH endpoints automatically classified as P1, even when P1 approval is supplied.
+
+## Verification and distribution
+
+- Integration coverage exercises HTTP-only `GET /lookup` followed by a safe read and an ordinary P1 POST or PATCH; only `/lookup` is sent.
+- Installed offline CLI E2E coverage verifies the same ordinary P1 POST is not sent.
+- Windows x64, Linux x64, and macOS x64 Bundles retain offline installation, driver imports, doctor, repeated E2E, checksum, manifest, and security-scan gates.
+
+## Compatibility
+
+The ATIR protocol remains `version: "0.1"`. This release changes the Runner/package version to `0.1.2` only. Existing v0.1.0 and v0.1.1 tags and GitHub Releases remain immutable.

docs/security.md

@@ -6,6 +6,7 @@ RC adds read-only database transactions, rooted `query_ref` and OpenAPI refs, di
 - For `public`, `strict`, and `enterprise_internal`, list each permitted DNS name in `project.confirmed_hosts`; `project.production_hosts` is blocked even when an ATIR environment label is incorrect.
 - Public/strict requests use their validated DNS answer for the actual TCP connection, preventing a later resolver answer from redirecting the socket to an internal address.
 - P1 and P0 workflows require explicit matching approval; P2/P3 retain preview visibility.
+- After `assertion_unknown`, optional continuation is allowed only when every remaining step is a safe read. Any later P0 or P1 write, including an ordinary POST, PUT, or PATCH, blocks continuation even if that risk level was approved.
 - SQL is parsed and limited to one SELECT or WITH...SELECT statement. Use bound parameters; credentials remain outside ATIR.
 - No `eval`, dynamic Python import from ATIR, shell command, package installation or updater exists in Runner source.
 - Only infrastructure failures receive finite retries. Business requests are not duplicated automatically.

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "multi-api-test-executor"
-version = "0.1.1"
+version = "0.1.2"
 description = "Deterministic multi-API workflow execution with evidence and result backfill"
 readme = "README.md"
 requires-python = ">=3.11,<3.14"

scripts/build_skill_bundle.py

@@ -10,7 +10,7 @@
 from pathlib import Path
 
 ROOT = Path(__file__).parents[1]
-VERSION = "0.1.1"
+VERSION = "0.1.2"
 INCLUDE = [
     "SKILL.md",
     "README.md",