fix: correct release CI scope and Skill counts

Author: rockyshi1993

changelogs/releases/v1.20.4.md

@@ -13,6 +13,8 @@
 - 普通和最小压缩投影保留经校验的 taskless pending ingress 与有界 Stop 决策，使真实新入口可以继续准入。
 - 自动检查点在没有会话环境变量时复用服务器已观察的 ContextRead/回执身份；显式环境身份仍优先，两个服务器来源冲突时拒绝续租和 CP 写入。
 - 新候选允许保留能与成功旧发行按同一提交对账的历史失败 CI；新候选自己的 CI 与最终已发布状态仍单独严格验证，不要求改写历史事实。
+- 同步 V92 校验器和公开分类说明中的 Skill 数量；源码 CI 明确区分未部署的工作区 Profile，已有工作区继续严格校验。
+- 更新两个 brace-expansion 开发依赖锁节点，修复已公告的拒绝服务漏洞；MCP 回归超时输出具体请求阶段和进程诊断。
 
 ## 兼容与验证边界
 

content/skills/portfolio.json

@@ -10,13 +10,13 @@
     "sidecarDigest": "774105d7947b340d15d17115fcb8e37b62ae545cf553f06126d529184fd74872",
     "pluginDigest": "7b4042b10fc27cb70440fef64151bc50662a2f871274749925ea0e88f38388f4",
     "publicTaxonomy": "content/skills/public-taxonomy.json",
-    "publicTaxonomyDigest": "d8f3a3e9728cd04929750e8858e100fd60a4a0afc095b0217ac0877b02f0a7f2",
+    "publicTaxonomyDigest": "7f6ee8c30f5484b8881e27099af72c69625b73a7cf3b53fe51c8c0c147d4f124",
     "portfolioEvidence": "content/skills/portfolio-evidence.json",
     "portfolioEvidenceDigest": "fddc547986599fe20672364d6432633edabeb60ee6c5f3da5f9ca083daed6e1e",
     "consumerInventoryFileCount": 722,
     "consumerInventoryDigest": "915e197c2e882223da7e45eb7f12b6c07054fc461945ae123e363170c489ec3e",
     "consumerProjectionDigest": "09e046eaea5934acc8a041c61c4b69dd9bc2e43e062395832a1d438bcc33bc28",
-    "portfolioInputDigest": "0413ef6be47fd178f3de8b9700d27f95ea0621ff335e6f63eeeef28e48a9d0fa"
+    "portfolioInputDigest": "e6c6fa9855f782f044a8c1f808ab6a186bbaf11e942bd17812e105dc13f4aeb3"
   },
   "ordering": "skills.id asc; graph edges from/to asc",
   "summary": {
@@ -49,7 +49,7 @@
       "assignmentScope": "bundled-registered-only",
       "includedInAssignments": false,
       "includedInBundledCounts": false,
-      "description": "Workspace Skills are project-scoped extensions. They are explained separately and never enter bundled Skill assignments or the 86/83/3 denominators."
+      "description": "Workspace Skills are project-scoped extensions. They are explained separately and never enter bundled Skill assignments or the 87/84/3 denominators."
     },
     "categories": [
       {

content/skills/public-taxonomy.json

@@ -7,7 +7,7 @@
     "assignmentScope": "bundled-registered-only",
     "includedInAssignments": false,
     "includedInBundledCounts": false,
-    "description": "Workspace Skills are project-scoped extensions. They are explained separately and never enter bundled Skill assignments or the 86/83/3 denominators."
+    "description": "Workspace Skills are project-scoped extensions. They are explained separately and never enter bundled Skill assignments or the 87/84/3 denominators."
   },
   "categories": [
     {

package-lock.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "PublicProductProjectionV2",
-  "generatedAt": "2026-10-10T11:31:11.818Z",
+  "generatedAt": "2026-10-10T16:48:17.854Z",
   "release": {
     "version": "1.20.4"
   },
@@ -1089,7 +1089,7 @@
       "assignmentScope": "bundled-registered-only",
       "includedInAssignments": false,
       "includedInBundledCounts": false,
-      "description": "Workspace Skills are project-scoped extensions. They are explained separately and never enter bundled Skill assignments or the 86/83/3 denominators."
+      "description": "Workspace Skills are project-scoped extensions. They are explained separately and never enter bundled Skill assignments or the 87/84/3 denominators."
     }
   },
   "capabilityScenarios": [
@@ -1194,7 +1194,7 @@
     "package": "300515260d15b4b90a1c05f110170ad2b54a367762f3b80da7cbdd94a82776b8",
     "expression": "60e525d34e5531e6b4bbbb77f8b34bb93c9ca9ebee5df4fe2812749232175c3c",
     "workflows": "d9eb7086866fe3c3815f673957ed978c1594079261009ac775bf3e1336ad44fd",
-    "portfolio": "ccc282fc1caec348531363f6acf0edd53afd6ff3a65f32c3b79a3d5e2e273a85",
-    "taxonomy": "d8f3a3e9728cd04929750e8858e100fd60a4a0afc095b0217ac0877b02f0a7f2"
+    "portfolio": "3d0fd37ac5a964a077c160983998a54ce9c23a929e3783db65023f999e112cfc",
+    "taxonomy": "7f6ee8c30f5484b8881e27099af72c69625b73a7cf3b53fe51c8c0c147d4f124"
   }
 }

public-site/data/public-product-projection.json

@@ -247,16 +247,16 @@ function buildOptimizationControlChecks(ctx) {
 
     const portfolio = buildPortfolio(ROOT)
     const portfolioErrors = validatePortfolio(portfolio)
-    if (portfolio.summary.skillCount !== 86) err(`[V92] expected 86 skills, got ${portfolio.summary.skillCount}`)
+    if (portfolio.summary.skillCount !== 87) err(`[V92] expected 87 skills, got ${portfolio.summary.skillCount}`)
     if (portfolio.summary.graySkillCount !== 3) err(`[V92] expected three gray skills, got ${portfolio.summary.graySkillCount}`)
     if (JSON.stringify(portfolio.summary.publicCategoryCounts) !== JSON.stringify({
       'workflow-routing': 20,
-      'domain-architecture': 21,
+      'domain-architecture': 22,
       'quality-delivery': 28,
       'runtime-governance': 17
     })) err('[V92] public Skill category counts drifted')
     if (portfolio.summary.dependencyEdgeCount < 1) err('[V92] explicit Skill dependency graph has no edges')
-    if (portfolio.summary.operationalEvidenceCompleteCount !== 86) err('[V92] operational lifecycle evidence is incomplete')
+    if (portfolio.summary.operationalEvidenceCompleteCount !== 87) err('[V92] operational lifecycle evidence is incomplete')
     if (portfolio.summary.triggerQuality !== 'mixed') err('[V92] trigger precision must reflect measured kernel samples')
     if (!Number.isInteger(portfolio.generatedFrom.consumerInventoryFileCount) || portfolio.generatedFrom.consumerInventoryFileCount < 50) {
       err('[V92] portfolio consumer inventory is missing or unexpectedly small')
@@ -275,7 +275,7 @@ function buildOptimizationControlChecks(ctx) {
     if (committedText !== serializePortfolio(portfolio)) err('[V92] committed Skill portfolio is stale')
 
     if (process.env.DEVCODEX_VALIDATION_SCOPE === 'source') {
-      console.log('[V92] optimization source controls checked: skills=86 gray=3; deployed runtime index deferred to profile-deploy')
+      console.log('[V92] optimization source controls checked: skills=87 gray=3; deployed runtime index deferred to profile-deploy')
       return
     }
     const runtimeState = buildRuntimeStateIndex(ACTIVE_DEVCODEX_ROOT)
@@ -286,7 +286,7 @@ function buildOptimizationControlChecks(ctx) {
       err('[V92] runtime-state index must expose transition and consumer-drift diagnostics')
     }
 
-    console.log(`[V92] optimization controls checked: skills=86 gray=3 runtimeAlerts=${runtimeState.summary.alertCount}`)
+    console.log(`[V92] optimization controls checked: skills=87 gray=3 runtimeAlerts=${runtimeState.summary.alertCount}`)
   }
 
   return { checkV92 }

scripts/lib/validate-optimization-controls.js

@@ -31,7 +31,7 @@ readline.createInterface({ input: process.stdin }).on('line', line => {
 `
 }
 
-function callClient (child, onMessage = null) {
+function callClient (child, onMessage = null, diagnosticContext = () => ({})) {
   const pending = new Map()
   readline.createInterface({ input: child.stdout }).on('line', line => {
     const message = JSON.parse(line)
@@ -46,7 +46,7 @@ function callClient (child, onMessage = null) {
     const requestId = ++id
     const timer = setTimeout(() => {
       pending.delete(requestId)
-      reject(new Error(`timeout: ${method}`))
+      reject(new Error(`timeout: ${method}; requestId=${requestId}; childPid=${child.pid}; childExitCode=${child.exitCode}; context=${JSON.stringify(diagnosticContext())}`))
     }, 5000)
     pending.set(requestId, message => {
       clearTimeout(timer)
@@ -126,7 +126,12 @@ async function main () {
     })
     child.stderr.on('data', chunk => diagnostics.push(String(chunk)))
     const observedMessages = []
-    const call = callClient(child, message => observedMessages.push(message))
+    let phase = 'initialize'
+    const call = callClient(child, message => observedMessages.push(message), () => ({
+      phase,
+      diagnostics: diagnostics.join('').slice(-4000),
+      lastResponseIds: observedMessages.slice(-5).map(message => message.id)
+    }))
     child.stdin.write('42\n')
     const invalidDeadline = Date.now() + 5000
     while (
@@ -142,10 +147,12 @@ async function main () {
     const initialized = await call('initialize', { protocolVersion: '2024-11-05', capabilities: {} })
     assert(initialized.result)
     child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized', params: {} })}\n`)
+    phase = 'initial-worker-call'
     const first = toolValue(await call('tools/call', { name: 'fixture_version', arguments: {} }))
     assert.strictEqual(first.version, 'v1')
 
     fs.writeFileSync(worker, workerSource('v2'))
+    phase = 'implementation-hot-reload'
     const second = await waitForVersion(call, 'v2')
     assert.notStrictEqual(second.pid, first.pid, 'worker PID must change while supervisor connection stays open')
 
@@ -163,14 +170,17 @@ async function main () {
       await new Promise(resolve => setTimeout(resolve, 10))
     }
     assert.strictEqual(observedMessages.find(message => message.id === 1000)?.error?.data?.errorCode, 'MCP_STDIO_FRAME_TOO_LARGE', 'internal id expansion must not produce a worker timeout')
+    phase = 'after-frame-rejection'
     assert.strictEqual(toolValue(await call('tools/call')).version, 'v2')
     process.kill(second.pid)
     await new Promise(resolve => setTimeout(resolve, 100))
+    phase = 'same-contract-crash-recovery'
     const restarted = toolValue(await call('tools/call'))
     assert.strictEqual(restarted.version, 'v2', 'same contract crash recovery must work')
 
     fs.writeFileSync(worker, workerSource('v3', 'changed_schema'))
     await new Promise(resolve => setTimeout(resolve, 150))
+    phase = 'changed-contract-hot-reload'
     const afterSchemaChange = toolValue(await call('tools/call', { name: 'fixture_version', arguments: {} }))
     assert.strictEqual(afterSchemaChange.version, 'v2', 'schema change must keep the compatible worker serving')
     await new Promise(resolve => setTimeout(resolve, 50))
@@ -180,6 +190,7 @@ async function main () {
 
     process.kill(restarted.pid)
     await new Promise(resolve => setTimeout(resolve, 100))
+    phase = 'changed-contract-crash-recovery'
     const incompatibleRestart = await call('tools/call')
     assert.strictEqual(incompatibleRestart.error?.data?.errorCode, 'MCP_SCHEMA_RESTART_REQUIRED')
     assert.strictEqual((await call('tools/list')).error?.data?.errorCode, 'MCP_SCHEMA_RESTART_REQUIRED', 'rejected crash worker cannot serve the changed contract')

scripts/test-mcp-hot-reload-supervisor.js

@@ -105,10 +105,11 @@ function runValidateAll(workspaceRoot) {
     })
 }
 
-function runValidateCurrent(workspaceRoot) {
+function runValidateCurrent(workspaceRoot, env = process.env) {
     return spawnSync(process.execPath, [ALL_SCRIPT, '--workspace', workspaceRoot, '--current-only'], {
         cwd: workspaceRoot,
-        encoding: 'utf8'
+        encoding: 'utf8',
+        env
     })
 }
 
@@ -1272,6 +1273,23 @@ function main() {
         assert.match(workspaceDebtOutput, /\[profile-all\] current-project=devcodex checked=1 errors=0 warnings=0/)
         assert.match(workspaceDebtOutput, /\[profile-all\] workspace-debt checked=2 errors=1 warnings=0/)
         assert.match(workspaceDebtOutput, /profile-standard requires 04-测试规范\.md/)
+        const bareSourceRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'devcodex-profile-source-'))
+        TEMP_ROOTS.push(bareSourceRoot)
+        const sourceEnv = { ...process.env, DEVCODEX_VALIDATION_SCOPE: 'source' }
+        const sourceWithoutWorkspace = runValidateCurrent(bareSourceRoot, sourceEnv)
+        assert.strictEqual(sourceWithoutWorkspace.status, 0, sourceWithoutWorkspace.stderr)
+        assert.match(sourceWithoutWorkspace.stdout, /\[profile-current\] N\/A: source checkout has no deployed workspace Profile/)
+        const localWithoutWorkspace = runValidateCurrent(bareSourceRoot, { ...process.env, DEVCODEX_VALIDATION_SCOPE: 'workspace' })
+        assert.strictEqual(localWithoutWorkspace.status, 1)
+        assert.match(localWithoutWorkspace.stderr, /missing \.devcodex directory/)
+        const deployedWithoutCurrent = runValidateCurrent(allProfilesRoot, sourceEnv)
+        assert.strictEqual(deployedWithoutCurrent.status, 1)
+        assert.doesNotMatch(deployedWithoutCurrent.stdout, /N\/A/)
+        writeFile(currentOnlyRoot, '.devcodex/devcodex/profile/01-项目信息.md', [currentProjectInfo(), '', '- Profile 档位：profile-standard。'].join('\n'))
+        const invalidDeployedCurrent = runValidateCurrent(currentOnlyRoot, sourceEnv)
+        assert.strictEqual(invalidDeployedCurrent.status, 1)
+        assert.match(invalidDeployedCurrent.stdout, /profile-standard requires 04-测试规范\.md/)
+        assert.doesNotMatch(invalidDeployedCurrent.stdout, /N\/A/)
         const batchEResult = spawnSync(process.execPath, [path.join(ROOT, 'scripts', 'test-v1178-batch-e.js')], {
             cwd: ROOT,
             encoding: 'utf8'

scripts/test-validate-profile.js

@@ -2245,6 +2245,7 @@ function run() {
     const profileCurrentNode = manifest.nodes.find(node => node.id === 'profile-current')
     assert(profileCurrentNode, 'manifest must expose lightweight profile-current node')
     assert.deepStrictEqual(profileCurrentNode.args, ['scripts/validate-all-profiles.js', '--current-only'])
+    assert.deepStrictEqual(profileCurrentNode.environment, { DEVCODEX_VALIDATION_SCOPE: 'source' })
     assert.strictEqual(profileCurrentNode.riskClass, 'normal')
     assert.deepStrictEqual(profileCurrentNode.writeScopes, [])
     assert(manifest.iterativeInvariantNodes.includes('profile-current'),

scripts/test-validation-dag.js

@@ -35,6 +35,10 @@ const sourceProjectRoot = path.join(workspaceRoot, path.basename(ROOT))
 
 function collectProfileTargets() {
   if (!fs.existsSync(devcodexRoot)) {
+    if (currentOnly && process.env.DEVCODEX_VALIDATION_SCOPE === 'source') {
+      console.log(`[profile-current] N/A: source checkout has no deployed workspace Profile: ${devcodexRoot}`)
+      process.exit(0)
+    }
     console.error(`[profile-all] missing .devcodex directory: ${devcodexRoot}`)
     process.exit(1)
   }