Merge pull request #1 from Saitamasans/fix/v0.1.1-safety-correctness

fix: harden v0.1.1 execution safety and release

Author: Saitamasans

.github/workflows/ci.yml

@@ -14,7 +14,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: {python-version: "3.11", cache: pip}
-      - run: python -m pip install -e ".[dev]"
+      - run: python -m pip install --require-hashes -r requirements.lock
+      - run: python -m pip install --no-deps --no-build-isolation .
       - run: ruff format --check .
       - run: ruff check .
       - run: python -m pytest tests/unit -q
@@ -33,7 +34,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: {python-version: "${{ matrix.python }}", cache: pip}
-      - run: python -m pip install -e ".[dev]"
+      - run: python -m pip install --require-hashes -r requirements.lock
+      - run: python -m pip install --no-deps --no-build-isolation .
       - run: python -m pytest -q
       - run: python -m multi_api_executor.cli --help
       - run: python -m multi_api_executor.cli version
@@ -56,7 +58,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: {python-version: "3.12", cache: pip}
-      - run: python -m pip install -e ".[dev,database-postgresql]"
+      - run: python -m pip install --require-hashes -r requirements.lock
+      - run: python -m pip install --no-deps --no-build-isolation .
       - run: python -m pytest tests/integration/test_external_database_adapters.py tests/integration/test_database_checks.py -q
         env:
           TEST_POSTGRES_URL: postgresql+psycopg://postgres:test@127.0.0.1:5432/executor
@@ -75,7 +78,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: {python-version: "3.12", cache: pip}
-      - run: python -m pip install -e ".[dev,database-mysql]"
+      - run: python -m pip install --require-hashes -r requirements.lock
+      - run: python -m pip install --no-deps --no-build-isolation .
       - run: python -m pytest tests/integration/test_external_database_adapters.py tests/integration/test_database_checks.py -q
         env:
           TEST_MYSQL_URL: mysql+pymysql://root:test@127.0.0.1:3306/executor
@@ -86,7 +90,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: {python-version: "3.12", cache: pip}
-      - run: python -m pip install -e ".[dev]"
+      - run: python -m pip install --require-hashes -r requirements.lock
+      - run: python -m pip install --no-deps --no-build-isolation .
       - run: python -m pytest --cov=multi_api_executor --cov-branch --cov-report=xml:coverage.xml --cov-report=html:htmlcov -q
       - uses: actions/upload-artifact@v4
         with: {name: coverage-report, path: "coverage.xml\nhtmlcov"}
@@ -97,14 +102,15 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: {python-version: "3.11", cache: pip}
-      - run: python -m pip install -e ".[dev]" build pyinstaller
-      - run: python -m build
-      - run: python -m pip download --dest wheelhouse .
+      - run: python -m pip install --require-hashes -r requirements.lock
+      - run: python -m pip install --no-deps --no-build-isolation .
+      - run: python -m build --no-isolation
+      - run: python -m pip download --require-hashes --dest wheelhouse -r requirements-runtime.lock
       - run: python scripts/build_binary.py
       - run: python scripts/generate_supply_chain_docs.py
       - run: python scripts/build_skill_bundle.py --platform windows-x64
       - run: python scripts/verify_checksums.py build/release/SHA256SUMS.txt build/release
-      - run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/ci_bundle_smoke.ps1 -BundleZip build/release/multi-api-test-executor-0.1.0-windows-x64.zip
+      - run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/ci_bundle_smoke.ps1 -BundleZip build/release/multi-api-test-executor-0.1.1-windows-x64.zip
       - uses: actions/upload-artifact@v4
         with: {name: bundle-windows-x64, path: build/release/*}
 
@@ -114,14 +120,15 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: {python-version: "3.11", cache: pip}
-      - run: python -m pip install -e ".[dev]" build pyinstaller
-      - run: python -m build
-      - run: python -m pip download --dest wheelhouse .
+      - run: python -m pip install --require-hashes -r requirements.lock
+      - run: python -m pip install --no-deps --no-build-isolation .
+      - run: python -m build --no-isolation
+      - run: python -m pip download --require-hashes --dest wheelhouse -r requirements-runtime.lock
       - run: python scripts/build_binary.py
       - run: python scripts/generate_supply_chain_docs.py
       - run: python scripts/build_skill_bundle.py --platform linux-x64
       - run: python scripts/verify_checksums.py build/release/SHA256SUMS.txt build/release
-      - run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.0-linux-x64.zip
+      - run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.1-linux-x64.zip
       - uses: actions/upload-artifact@v4
         with: {name: bundle-linux-x64, path: build/release/*}
 
@@ -131,13 +138,14 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: {python-version: "3.11", cache: pip}
-      - run: python -m pip install -e ".[dev]" build pyinstaller
-      - run: python -m build
-      - run: python -m pip download --dest wheelhouse .
+      - run: python -m pip install --require-hashes -r requirements.lock
+      - run: python -m pip install --no-deps --no-build-isolation .
+      - run: python -m build --no-isolation
+      - run: python -m pip download --require-hashes --dest wheelhouse -r requirements-runtime.lock
       - run: python scripts/build_binary.py
       - run: python scripts/generate_supply_chain_docs.py
       - run: python scripts/build_skill_bundle.py --platform macos-x64
       - run: python scripts/verify_checksums.py build/release/SHA256SUMS.txt build/release
-      - run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.0-macos-x64.zip
+      - run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.1-macos-x64.zip
       - uses: actions/upload-artifact@v4
         with: {name: bundle-macos-x64, path: build/release/*}

.github/workflows/release-verification.yml

@@ -18,7 +18,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: {python-version: "3.11", cache: pip}
-      - run: python -m pip install -e ".[dev]"
+      - run: python -m pip install --require-hashes -r requirements.lock
+      - run: python -m pip install --no-deps --no-build-isolation .
       - name: Download and verify published assets
         shell: powershell
         env:
@@ -33,4 +34,3 @@ jobs:
         with:
           name: release-verification-${{ inputs.tag }}
           path: ${{ runner.temp }}/release-verification-${{ github.run_id }}/release-verification.json
-

.github/workflows/release.yml

@@ -2,6 +2,11 @@ name: Release
 
 on:
   workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing v0.1.1 tag to build
+        required: true
+        type: string
   push:
     tags: ["v*"]
 
@@ -13,16 +18,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref_name }}
+          fetch-depth: 0
       - uses: actions/setup-python@v5
         with: {python-version: "3.11", cache: pip}
-      - run: python -m pip install -e ".[dev]" build
+      - name: Verify checkout equals release tag
+        env:
+          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+        run: test "$(git rev-parse HEAD)" = "$(git rev-list -n 1 "$RELEASE_TAG")"
+      - run: python -m pip install --require-hashes -r requirements.lock
+      - run: python -m pip install --no-deps --no-build-isolation .
       - run: ruff format --check .
       - run: ruff check .
       - run: python -m pytest tests/unit -q
       - run: python scripts/validate_schemas.py
       - run: python scripts/validate_skill.py .
       - run: python scripts/security_scan.py .
-      - run: python -m build
+      - run: python -m build --no-isolation
       - run: python scripts/generate_supply_chain_docs.py
       - name: Stage flat source assets
         run: |
@@ -47,20 +60,29 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref_name }}
+          fetch-depth: 0
       - uses: actions/setup-python@v5
         with: {python-version: "3.11", cache: pip}
-      - run: python -m pip install -e ".[dev]" build pyinstaller
-      - run: python -m build
-      - run: python -m pip download --dest wheelhouse .
+      - name: Verify checkout equals release tag
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+        run: test "$(git rev-parse HEAD)" = "$(git rev-list -n 1 "$RELEASE_TAG")"
+      - run: python -m pip install --require-hashes -r requirements.lock
+      - run: python -m pip install --no-deps --no-build-isolation .
+      - run: python -m build --no-isolation
+      - run: python -m pip download --require-hashes --dest wheelhouse -r requirements-runtime.lock
       - run: python scripts/build_binary.py
       - run: python scripts/generate_supply_chain_docs.py
       - run: python scripts/build_skill_bundle.py --platform ${{ matrix.platform }}
       - run: python scripts/verify_checksums.py build/release/SHA256SUMS.txt build/release
       - if: runner.os == 'Windows'
-        run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/ci_bundle_smoke.ps1 -BundleZip build/release/multi-api-test-executor-0.1.0-${{ matrix.platform }}.zip
+        run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/ci_bundle_smoke.ps1 -BundleZip build/release/multi-api-test-executor-0.1.1-${{ matrix.platform }}.zip
       - if: runner.os != 'Windows'
-        run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.0-${{ matrix.platform }}.zip
-      - run: python scripts/package_release_asset.py --bundle build/release/multi-api-test-executor-0.1.0-${{ matrix.platform }}.zip --platform ${{ matrix.platform }} --tag ${{ github.ref_name }}
+        run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.1-${{ matrix.platform }}.zip
+      - run: python scripts/package_release_asset.py --bundle build/release/multi-api-test-executor-0.1.1-${{ matrix.platform }}.zip --platform ${{ matrix.platform }} --tag ${{ inputs.tag || github.ref_name }}
       - uses: actions/upload-artifact@v4
         with:
           name: release-${{ matrix.platform }}
@@ -74,9 +96,11 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref_name }}
       - uses: actions/download-artifact@v4
         with: {path: artifacts, merge-multiple: true}
-      - run: python scripts/validate_release_assets.py artifacts --tag ${{ github.ref_name }}
+      - run: python scripts/validate_release_assets.py artifacts --tag ${{ inputs.tag || github.ref_name }}
       - name: Write aggregate checksums
         run: |
           python - <<'PY'
@@ -92,6 +116,6 @@ jobs:
       - uses: softprops/action-gh-release@v2
         with:
           files: artifacts/*
-          body_path: docs/release-notes-v0.1.0.md
-          prerelease: ${{ contains(github.ref_name, '-') }}
+          body_path: docs/release-notes-v0.1.1.md
+          prerelease: ${{ contains(inputs.tag || github.ref_name, '-') }}
           fail_on_unmatched_files: true

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.1 - 2026-07-21
+
+- Made empty and HTTP-only assertions `assertion_unknown`, stopped dependencies by default, and made auto-generated skeletons preview-only.
+- Added conservative multilingual risk classification, final-host DNS protection, runtime/evidence variable separation, structural URL/Cookie redaction, and default-deny uploads.
+- Added Markdown CLI import, structured Excel manual conversion, copy-only `multi-api backfill`, default PostgreSQL/MySQL drivers, and Windows Python 3.11-3.13 discovery.
+- Locked Release dependencies and expanded Bundle manifests, offline driver imports, documentation limits, and RC verification.
+
 ## 0.1.0 RC - 2026-07-21
 
 - Added real read-only SQLite checks with PostgreSQL/MySQL adapters, limits, assertions, and redacted evidence.

README.md

@@ -2,9 +2,9 @@
 
 [![CI](https://github.com/Saitamasans/skill-multi-api-test-executor/actions/workflows/ci.yml/badge.svg)](https://github.com/Saitamasans/skill-multi-api-test-executor/actions/workflows/ci.yml)
 
-> 第十个 Skill｜多接口自动化执行与证据回填
+> 第十个 Skill｜ATIR 多接口执行与证据回填
 
-从接口文档出发，自动生成并真实执行多接口业务链路，完成动态参数传递、确定性断言、证据保存和结果回填。
+执行人工、项目 Pack 或 Skill 生成的 ATIR 多接口工作流，完成动态参数传递、确定性断言、证据保存和结果回填。v0.1.1 的确定性 compile 主要生成单接口骨架；不能仅凭 OpenAPI 自动可靠生成完整业务链路，登录识别、动态依赖以及 token/order_id 链路仍需项目规则或人工确认。
 
 ## 它解决什么问题
 
@@ -39,14 +39,14 @@ LLM 可以分析非结构化资料并提出候选规则；它不发送请求、
 |---|---|---|
 | L1 | 接口文档 | 路径/参数/结构、连通性、明确 HTTP 状态与 Schema；不编造业务码 |
 | L2 | L1 + 需求 | 主流程、边界、权限、状态与有来源业务断言；冲突标记 |
-| L3 | L2 + 环境/账号/成功样例 | 自动登录、动态变量、多接口真实执行与证据 |
+| L3 | L2 + 环境/账号/成功样例 | 执行已确认的登录、动态变量与多接口工作流并保存证据 |
 | L4 | L3 + 源码/数据库/产品确认 | 只读数据库、状态/副作用/幂等与更高可信断言 |
 
-当前确定性输入支持 OpenAPI 3/Swagger、Postman 2.1、Apifox OpenAPI 导出、通用 JSON、基础 Markdown 与基础 Excel 用例映射。
+当前确定性输入支持 OpenAPI 3/Swagger、Postman 2.1、Apifox OpenAPI 导出、通用 JSON、基础 Markdown 与基础 Excel 用例映射。Postman 是基础请求轮廓导入；Markdown 是 Method/Path 保守提取，不生成虚假参数或断言；Excel 是基础用例映射与结果副本回填，不能直接编译时返回 `manual_conversion_required`；Apifox 确定性支持 OpenAPI 导出。
 
 ## 安装一次
 
-要求 Python 3.11+。安装阶段创建隔离环境并安装 Runner 与全部依赖；后续执行不会运行 `pip install`、自动更新或下载组件。
+要求 Python 3.11-3.13。安装阶段创建隔离环境并安装 Runner 与全部依赖；后续执行不会运行 `pip install`、自动更新或下载组件。
 当前发布包不提供自动安装钩子：下载或安装 Skill Bundle 后，用户需要手动执行一次对应平台的安装命令；之后 Skill 复用已安装 Runner，不会重复安装。
 
 Windows PowerShell：
@@ -78,9 +78,9 @@ Release 离线包包含 wheel、依赖 wheelhouse、Schema、模板、Skill 和
 
 ```powershell
 .\.venv\Scripts\multi-api.exe doctor --quick
-.\.venv\Scripts\multi-api.exe preflight examples\login-create-query\workflow.yaml --approve-risk P1
+.\.venv\Scripts\multi-api.exe preflight examples\login-create-query\workflow.yaml --approve-risk P0
 .\.venv\Scripts\multi-api.exe preview examples\login-create-query\workflow.yaml
-.\.venv\Scripts\multi-api.exe run examples\login-create-query\workflow.yaml --approve-risk P1
+.\.venv\Scripts\multi-api.exe run examples\login-create-query\workflow.yaml --approve-risk P0
 ```
 
 真实路径为：登录 → token → 用户 → 创建订单 → order_id → 查询 → 支付 → 有限轮询 paid → 脱敏证据 → JSON/HTML/JUnit。
@@ -104,7 +104,7 @@ multi-api cache status
 multi-api cache clear
 ```
 
-若 `auto` 缺少环境或变量，它完成 detect/import/readiness/compile/preview 后输出 `compile-only`，不伪造执行。
+`auto` 对确定性生成的 HTTP-only 骨架始终停在 preview，并输出 `{"status":"compile_only","reason":"business_assertion_missing"}`；它不会自动发送后续写请求或把 HTTP 成功描述成业务通过。
 
 ## 执行、断言与风险
 
@@ -140,7 +140,7 @@ evidence/RUN_ID/
 - `post_checks` 可对 SQLite 执行真实只读参数化查询，并对行数、字段值断言；PostgreSQL/MySQL 适配使用只读事务并配置 CI service 验证。
 - 首次 Ctrl+C 优雅取消并保存部分证据、summary 和 manifest；第二次写最小标记后退出。退出码 4。
 - cleanup 是独立审计阶段，只接受本次步骤提取的资源 ID；404 为 `already_absent`，失败不覆盖 `business_status`。
-- allowlist 插件 SDK 提供 auth、crypto、verifier、data_factory、cleanup Protocol、版本、超时、分类和脱敏结果；内置静态认证、AES ECB PKCS7、可复现数据和本地 cleanup。
+- PluginLoader 与 Protocol 已存在，但 v0.1.1 的 auth、crypto、verifier、data_factory、cleanup 尚未全部接入 Runner 项目配置；当前插件能力为 SDK Preview，不宣传为成熟可直接配置的插件系统，完整接入计划放在 v0.2。
 - HTML 展示 readiness、冲突、数据库、cleanup、插件、人工核验、取消和截断并自动转义。Codex 默认仅读取受限的 `summary_for_ai.json`。
 
 退出码：`0` 通过，`1` 测试/断言/cleanup 失败，`2` 输入或 preflight 错误，`3` 基础设施错误，`4` 用户取消，`5` 部分完成/预算耗尽，`6` 内部错误。
@@ -153,7 +153,7 @@ GitHub Actions 已在 Windows、Linux、macOS 的 Python 3.11–3.13 上真实
 
 - v0.1 聚焦 REST，不支持 UI、gRPC 或 WebSocket 执行。
 - Windows 合作式取消已覆盖；GitHub Windows Runner 无法可靠完成原生双 Ctrl+C E2E，因此该项仍为已知限制。
-- Postman JavaScript 不执行；远程 OpenAPI `$ref` 默认关闭；插件未经 allowlist 配置不执行。
+- Postman 仅导入基础请求轮廓且 JavaScript 不执行；远程 OpenAPI `$ref` 默认关闭；插件为 SDK Preview，尚未全部接入 Runner 项目配置。
 - Markdown 是保守的 Method/Path 提取，不理解任意自然语言表格。
 - Excel 仅支持基础列映射和结果副本回填。
 - Apifox 仅确定性支持其 OpenAPI 导出格式。
@@ -188,6 +188,6 @@ GitHub Actions 已在 Windows、Linux、macOS 的 Python 3.11–3.13 上真实
 
 ## 路线图与贡献
 
-高价值后续：multipart/文件上传、资源锁并发、数据库驱动证据、项目插件 SDK、Ctrl+C 跨平台验证、签名离线包。贡献请先增加失败测试，保持 ATIR 向后兼容，禁止提交真实密钥、伪造证据或虚假 benchmark。
+高价值后续：v0.2 完整项目插件接入、更强的业务链路规则、Ctrl+C 跨平台验证与签名离线包。贡献请先增加失败测试，保持 ATIR 向后兼容，禁止提交真实密钥、伪造证据或虚假 benchmark。
 
 许可证：MIT。详见 [架构](docs/architecture.md)、[协议](docs/execution-protocol.md)、[断言策略](docs/assertion-policy.md)、[安全](docs/security.md) 与 [安装](docs/installation.md)。