fix: refresh skill portfolio and clear pack/validate hygiene blockers

Regenerate portfolio for V92 parity; strip comment-only requires from pack
dependency scans; extract cli-console-utils so index.js stays under V93 budget;
include the new module in package files and record unreleased notes.

Author: rockyshi1993

changelogs/unreleased.md

@@ -5,6 +5,7 @@
 
 ## 当前未发布实现候选（2026-07-21）
 
+- 卫生包 O1 + 验证修复：刷新 `skills/portfolio.json`；V6/pack-clean 扫描忽略注释内伪 `require`；抽出 `cli-console-utils.js` 使 `index.js` 回到 V93 行预算；`package.json#files` 纳入该模块；台账 VL-010/012 时间线对齐；Profile CLI 脚本计数 154。验证：`generate-skill-portfolio --check`、`npm run test:core`、`npm run test:package-release`（40/40）、`npm run test:audit` 均 exit 0。
 - Dependabot #17 / CVE-2026-13149：`website` 经 `overrides` 固定 `brace-expansion@5.0.7`（GHSA-3jxr-9vmj-r5cp DoS）；`npm audit` 清零。
 - PF-173：Claude MCP 部署补齐 `scripts/lib` 运行时依赖 allowlist（`cp-digest.js` / `host-parity-scorecard.js`）→ `.claude/scripts/lib/`，与 `mcp/*.js` 的 `require('../scripts/lib/…')` 对齐；接入 `cmdInitClaude` + managed descriptors；`test-host-installation` / `test-mcp-servers` 回归。
 - 专家质量探针与实测标准收口：`MeasuredVerificationStandard` 写入 `compliance` SC14、`analyze-default` PCV-2a、`report`、`expert-output-quality`、`test-router`（`expertOutputQuality`）；V84 增加 raw-text 最小锚点区分力（防止 canonical reader 掩盖完全缺失），修正 profile skillCount 探针，不再要求所有薄消费者堆完整 Gate 长清单。

index.js

@@ -39,30 +39,9 @@ const {
   resolveActiveRuntimeRoot: sharedResolveActiveRuntimeRoot,
   resolveProfileDir: sharedResolveProfileDir
 } = require('./hooks/_runtime/workspace-layout.cjs')
-
-// ─── Tiny ANSI helpers ────────────────────────────────────────────────────────
-const c = {
-  green: s => `\x1b[32m${s}\x1b[0m`,
-  yellow: s => `\x1b[33m${s}\x1b[0m`,
-  cyan: s => `\x1b[36m${s}\x1b[0m`,
-  red: s => `\x1b[31m${s}\x1b[0m`,
-  bold: s => `\x1b[1m${s}\x1b[0m`,
-  dim: s => `\x1b[2m${s}\x1b[0m`,
-}
-
-// ─── Helpers ──────────────────────────────────────────────────────────────────
-
-/** Walk a directory recursively, return all file paths */
-function walkDir(dir) {
-  if (!fs.existsSync(dir)) return []
-  const results = []
-  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    const full = path.join(dir, entry.name)
-    if (entry.isDirectory()) results.push(...walkDir(full))
-    else results.push(full)
-  }
-  return results
-}
+const { createAnsiHelpers, walkDir: walkDirFs } = require('./scripts/lib/cli-console-utils.js')
+const c = createAnsiHelpers()
+const walkDir = dir => walkDirFs(fs, dir)
 
 // ─── Source directories (inside the npm package) ─────────────────────────────
 const PKG_ROOT = __dirname
@@ -90,9 +69,9 @@ const CLAUDE_SOURCES = [
 ]
 
 /**
- * MCP under `.claude/mcp/` resolves `require('../scripts/lib/…')` → `.claude/scripts/lib/…`.
- * Keep this allowlist tight: only modules actually required by `mcp/*.js` (today: memory + profile).
- * Do not ship the entire package `scripts/lib` tree into consumer projects.
+ * Allowlist of scripts/lib modules deployed next to Claude MCP servers.
+ * Keep tight: only modules actually required by mcp/*.js (today: memory + profile).
+ * Do not ship the entire package scripts/lib tree into consumer projects.
  */
 const CLAUDE_MCP_RUNTIME_SCRIPT_DEPS = Object.freeze([
   'scripts/lib/cp-digest.js',

package.json

@@ -186,6 +186,7 @@
     "scripts/lib/host-adapter-scope.js",
     "scripts/lib/grok-workspace-launcher.js",
     "scripts/lib/cli-host-utils.js",
+    "scripts/lib/cli-console-utils.js",
     "scripts/lib/cli-runtime-utils.js",
     "scripts/lib/profile-bootstrap-utils.js",
     "scripts/lib/cli-install-commands.js",

scripts/lib/cli-console-utils.js

@@ -0,0 +1,30 @@
+'use strict'
+
+/** Shared ANSI helpers and recursive directory walk for CLI entry modules. */
+
+function createAnsiHelpers () {
+  return {
+    green: s => `\x1b[32m${s}\x1b[0m`,
+    yellow: s => `\x1b[33m${s}\x1b[0m`,
+    cyan: s => `\x1b[36m${s}\x1b[0m`,
+    red: s => `\x1b[31m${s}\x1b[0m`,
+    bold: s => `\x1b[1m${s}\x1b[0m`,
+    dim: s => `\x1b[2m${s}\x1b[0m`
+  }
+}
+
+function walkDir (fs, dir) {
+  if (!fs.existsSync(dir)) return []
+  const results = []
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = require('path').join(dir, entry.name)
+    if (entry.isDirectory()) results.push(...walkDir(fs, full))
+    else results.push(full)
+  }
+  return results
+}
+
+module.exports = {
+  createAnsiHelpers,
+  walkDir
+}

scripts/lib/cli-install-commands.js

@@ -484,7 +484,7 @@ function buildCliInstallCommands(ctx) {
       }
     }
 
-    // 2b. MCP runtime script deps: .claude/mcp require('../scripts/lib/…') → .claude/scripts/lib/…
+    // 2b. MCP runtime script deps: copy scripts/lib helpers for Claude MCP (mcp/*.js relative require path)
     for (const relRaw of CLAUDE_MCP_RUNTIME_SCRIPT_DEPS) {
       const rel = String(relRaw || '').replace(/\\/g, '/')
       if (!rel) continue

scripts/lib/deployment-descriptors.js

@@ -42,7 +42,7 @@ function buildDeploymentDescriptors(packageRoot, surfaces, {
   }
   if (selected.has('claude')) {
     descriptors.push(...CLAUDE_SOURCES.map(item => descriptor('claude', item.from, path.join('.claude', item.to))))
-    // MCP runtime require('../scripts/lib/…') from .claude/mcp → .claude/scripts/lib/…
+    // MCP runtime script deps for Claude: map package scripts/lib into .claude/scripts/lib
     for (const rel of CLAUDE_MCP_RUNTIME_SCRIPT_DEPS) {
       const portable = String(rel || '').replace(/\\/g, '/')
       if (!portable) continue

scripts/lib/validate-governance-package-deployment.js

@@ -84,7 +84,10 @@ function buildGovernancePackageDeploymentChecks(ctx) {
         seen.add(file)
         const fullPath = path.join(ROOT, file)
         if (!fs.existsSync(fullPath)) return [file]
+        // Strip line/block comments so doc examples like require('../scripts/lib/...') are not scanned.
         const content = read(fullPath)
+          .replace(/\/\*[\s\S]*?\*\//g, '')
+          .replace(/^\s*\/\/.*$/gm, '')
         const deps = []
         for (const match of content.matchAll(/require\(['"](\.{1,2}\/[^'"]+)['"]\)/g)) {
           deps.push(resolveLocalDependency(file, match[1]))

scripts/test-mcp-servers.js

@@ -152,7 +152,7 @@ function setupConfiguredMcpTarget() {
   fs.copyFileSync(path.join(ROOT, 'mcp', 'profile-contract.js'), path.join(targetRoot, '.claude', 'mcp', 'profile-contract.js'))
   fs.copyFileSync(path.join(ROOT, 'mcp', 'profile-section-selector.cjs'), path.join(targetRoot, '.claude', 'mcp', 'profile-section-selector.cjs'))
   fs.copyFileSync(path.join(ROOT, 'mcp', 'agent-identity.cjs'), path.join(targetRoot, '.claude', 'mcp', 'agent-identity.cjs'))
-  // MCP require('../scripts/lib/…') from .claude/mcp → .claude/scripts/lib/…
+  // Deploy MCP runtime script deps under .claude/scripts/lib
   for (const rel of ['scripts/lib/cp-digest.js', 'scripts/lib/host-parity-scorecard.js']) {
     const dest = path.join(targetRoot, '.claude', ...rel.split('/'))
     fs.mkdirSync(path.dirname(dest), { recursive: true })

scripts/test-pack-clean.js

@@ -24,7 +24,10 @@ function collectRuntimeDependencies(file, seen = new Set()) {
   const fullPath = path.join(ROOT, file)
   if (!fs.existsSync(fullPath)) return [file]
 
+  // Strip comments so doc examples like require('../scripts/lib/...') are not treated as deps.
   const content = fs.readFileSync(fullPath, 'utf8')
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/^\s*\/\/.*$/gm, '')
   const deps = []
 
   for (const match of content.matchAll(/require\(['"](\.{1,2}\/[^'"]+)['"]\)/g)) {

skills/portfolio.json

@@ -5,14 +5,14 @@
   "generatedFrom": {
     "skillsPattern": "skills/*/SKILL.md",
     "registry": "plugin.json",
-    "sourceDigest": "d625bd7c306d0ce79c03af88471c8bf6323ba41cd590fb44abb7ab27a8ec5d89",
+    "sourceDigest": "0941b1520cd18739d2799722c11dfd5432da2639524a61238f9dd3817011a68f",
     "pluginDigest": "3e417180688c359025e64d584c098b5ef5ba112cf2ef8ca970f1c5589fe3d2bb",
     "portfolioEvidence": "skills/portfolio-evidence.json",
     "portfolioEvidenceDigest": "85229c1463a5068750d5417e5ebf960907532dccf99b1cd3da0a88f7007792b4",
     "consumerInventoryFileCount": 506,
     "consumerInventoryDigest": "eca8fd6129fe2ca143fc95be77ee37d4692e004b9e2519a979401c7484bf6ba4",
-    "consumerProjectionDigest": "348b40443eabd0fb949885e1eb80505b034e26795665b64c238abd25a15bc910",
-    "portfolioInputDigest": "e4e5d4d4b64a5ad98e968d1c5f2ed2ab93e4c30590623dd9cb6da42bcf41927e"
+    "consumerProjectionDigest": "c6df0ba0a96c3f3f417591af7f6147984f17eb901263518c9e449d5010bda4cf",
+    "portfolioInputDigest": "e7edf8a9327a0230d91c7f0ab08112708b4080ccc55169cda253e312ec136165"
   },
   "ordering": "skills.id asc; graph edges from/to asc",
   "summary": {
@@ -26,7 +26,7 @@
     "conflictReviewedCount": 81,
     "operationalEvidenceCompleteCount": 81,
     "triggerPrecisionMeasuredCount": 0,
-    "instructionBudgetP95Bytes": 19856,
+    "instructionBudgetP95Bytes": 21062,
     "triggerQuality": "structural-only"
   },
   "dependencyGraph": {
@@ -3544,8 +3544,8 @@
         "skills/audit-requirements/SKILL.md"
       ],
       "source": "skills/audit-requirements/SKILL.md",
-      "hash": "0f88d12cb1d57dbee7dfb2a49412c610436175d795cddd553a5331b534b8c06a",
-      "sourceBytes": 8345,
+      "hash": "155f1793aeba13925ce4d04c3422ad82e3aeab0a142081f71c5855dd9accdc74",
+      "sourceBytes": 12518,
       "version": "1.15.2",
       "lifecycleState": "active",
       "dependencies": [],
@@ -4833,8 +4833,8 @@
         "skills/compliance/SKILL.md"
       ],
       "source": "skills/compliance/SKILL.md",
-      "hash": "06c07a30a3b42a10037b767cf7f0e682af0a672a2ffd7939db35ab9db6c50e1f",
-      "sourceBytes": 15359,
+      "hash": "1fc935163d257cc7d9a5739c2c713d22444cce85537b244b1d06db5662f787b4",
+      "sourceBytes": 17554,
       "version": "1.15.2",
       "lifecycleState": "active",
       "dependencies": [],
@@ -5617,8 +5617,8 @@
         "skills/cp-gate/SKILL.md"
       ],
       "source": "skills/cp-gate/SKILL.md",
-      "hash": "62393ede67a997bbb31f26d8b0b5c2a952e2486009ca2bf931c02a3757b019f3",
-      "sourceBytes": 19856,
+      "hash": "a0a7f5871a0a06b4e39cb90def4cf32f8d55089d1a3eace528afb29ab5637ef9",
+      "sourceBytes": 21062,
       "version": "1.15.2",
       "lifecycleState": "active",
       "dependencies": [],
@@ -7358,8 +7358,8 @@
         "skills/dev-plan-review/SKILL.md"
       ],
       "source": "skills/dev-plan-review/SKILL.md",
-      "hash": "8740d0a1224b7accd893b6843c6ba78efe246e8b508e2874ab9fb29ab12593b7",
-      "sourceBytes": 20978,
+      "hash": "4aeb0e9a48d81dc2757f105c047a12b5eaa5264b017efd2fee6be2a0366e7caa",
+      "sourceBytes": 21152,
       "version": "1.15.2",
       "lifecycleState": "active",
       "dependencies": [],
@@ -9305,8 +9305,8 @@
         "skills/expert-output-quality/SKILL.md"
       ],
       "source": "skills/expert-output-quality/SKILL.md",
-      "hash": "b28894f105ecd9e6a712d6a7cf9c1f660011fdeace3ef9894c6597b1ab325fdf",
-      "sourceBytes": 8735,
+      "hash": "b3376ac14d1ee1a4452e8c66d42dbb0d3e04b2753c1b58940f502ce8ade77341",
+      "sourceBytes": 9075,
       "version": "1.15.2",
       "lifecycleState": "active",
       "dependencies": [],
@@ -12307,6 +12307,10 @@
           "path": "scripts/lib/cp-digest.js",
           "role": "current"
         },
+        {
+          "path": "scripts/lib/discipline-execution-probe.js",
+          "role": "current"
+        },
         {
           "path": "scripts/lib/host-parity-scorecard.js",
           "role": "current"
@@ -13470,6 +13474,10 @@
           "path": "scripts/test-control-plane-module-contracts.js",
           "role": "current"
         },
+        {
+          "path": "scripts/test-discipline-execution-probe.js",
+          "role": "current"
+        },
         {
           "path": "scripts/test-execution-chain-evolution.js",
           "role": "current"
@@ -13772,6 +13780,7 @@
         "scripts/test-context-read-contract.js",
         "scripts/test-control-plane-contracts.js",
         "scripts/test-control-plane-module-contracts.js",
+        "scripts/test-discipline-execution-probe.js",
         "scripts/test-execution-chain-evolution.js",
         "scripts/test-governance-intake.js",
         "scripts/test-governance-status-summary.js",
@@ -13845,6 +13854,7 @@
           "scripts/test-context-read-contract.js",
           "scripts/test-control-plane-contracts.js",
           "scripts/test-control-plane-module-contracts.js",
+          "scripts/test-discipline-execution-probe.js",
           "scripts/test-execution-chain-evolution.js",
           "scripts/test-governance-intake.js",
           "scripts/test-governance-status-summary.js",
@@ -15619,8 +15629,8 @@
         "skills/report/SKILL.md"
       ],
       "source": "skills/report/SKILL.md",
-      "hash": "2b42ffb7fa51db6d0195206e8d731cc670e08bf4c7be346397d93f4484ddd7ba",
-      "sourceBytes": 14746,
+      "hash": "ff59c642395e3a4f71bdbe31b030a560bd9095bd60d36889eccc199b27cee317",
+      "sourceBytes": 15174,
       "version": "1.15.2",
       "lifecycleState": "active",
       "dependencies": [],