docs: refresh rc1 release readiness evidence

Add the May 13 rc.1 publication evidence refresh and update the release-readiness/GA roadmap gates after #1846. - record current queue, security-gate, harness audit, adapter, observability, Node, markdownlint, release-surface, npm publish-surface, and ecc2 Rust evidence - update the publication-readiness checklist with the May 13 evidence artifact - normalize zh-CN CLAUDE list markers so markdownlint passes Validation: - node tests/docs/ecc2-release-surface.test.js - node tests/docs/harness-adapter-compliance.test.js - node tests/docs/stale-pr-salvage-ledger.test.js - npx markdownlint-cli '**/*.md' --ignore node_modules - git diff --check - node tests/run-all.js (2376 passed, 0 failed) - npm run harness:audit -- --format json (70/70) - npm run harness:adapters -- --check - npm run observability:ready -- --format json (16/16) - node tests/scripts/npm-publish-surface.test.js - cd ecc2 && cargo test (462 passed, 0 failed) No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.
2026-05-14 00:23:04 +08:00 · 2026-05-13 00:05:51 -04:00
parent 797f283036
commit da04a6e344
5 changed files with 138 additions and 69 deletions
--- a/docs/ECC-2.0-GA-ROADMAP.md
+++ b/docs/ECC-2.0-GA-ROADMAP.md
@@ -14,14 +14,14 @@ so the live execution truth is split across:

 ## Current Evidence

-As of 2026-05-12:
+As of 2026-05-13:

 - Public GitHub queues are clean across `affaan-m/everything-claude-code`,
  `affaan-m/agentshield`, `affaan-m/JARVIS`, `ECC-Tools/ECC-Tools`, and
  `ECC-Tools/ECC-website`.
 - Public GitHub discussions are also clean across those tracked repos:
-  `states: OPEN` returned zero discussions for every accessible discussion
-  surface on 2026-05-12.
+  the latest GraphQL sweep found only closed discussions on the trunk
+  discussion surface, and satellite discussion surfaces are disabled or empty.
 - The final open public GitHub issue, #1314, was closed as a non-actionable
  external badge/listing notification with a courtesy comment.
 - Linear issue creation for this project was re-tested after GitHub cleanup and
@@ -31,6 +31,9 @@ As of 2026-05-12:
  workspace is upgraded or issue capacity is freed.
 - `npm run harness:audit -- --format json` reports 70/70 on current `main`.
 - `npm run observability:ready` reports 16/16 readiness on current `main`.
+- PR #1846 merged as `797f283036904128bb1b348ae62019eb9f08cf39` and made
+  npm registry signature verification a durable workflow-security gate:
+  workflows that run `npm audit` now need `npm audit signatures`.
 - `docs/architecture/harness-adapter-compliance.md` maps Claude Code, Codex,
  OpenCode, Cursor, Gemini, Zed-adjacent, dmux, Orca, Superset, Ghast, and
  terminal-only support to install paths, verification commands, and risk
@@ -49,6 +52,10 @@ As of 2026-05-12:
  dry-run publication evidence pass: npm pack/publish dry-runs, temp install
  smoke, Claude plugin validation/tag preflight, Codex marketplace CLI shape,
  OpenCode build, and the remaining approval-gated release blockers.
+- `docs/releases/2.0.0-rc.1/publication-evidence-2026-05-13.md` records the
+  release-readiness evidence refresh: 70/70 harness audit, adapter compliance
+  PASS, 16/16 observability readiness, 2376/2376 root Node tests, markdownlint,
+  release-surface and npm publish-surface tests, and 462/462 `ecc2` Rust tests.
 - A detached clean worktree at
  `bfacf37715b39655cbc2c48f12f2a35c67cb0253` verified Claude plugin tag
  dry-run without `--force`, local marketplace discovery, temp-home local
@@ -211,12 +218,12 @@ is not complete unless the evidence column exists and has been freshly verified.

 | Prompt requirement | Required artifact or gate | Current evidence | Status |
 | --- | --- | --- | --- |
-| Keep public PRs below 20 | Repo-family PR recheck | 0 open PRs across the tracked public repos on 2026-05-12 | Complete for this checkpoint |
-| Keep public issues below 20 | Repo-family issue recheck | 0 open issues across the tracked public repos on 2026-05-12 after closing #1314 as non-actionable badge/listing noise | Complete for this checkpoint |
-| Manage repository discussions | Repo-family discussion recheck | 0 open discussions across the tracked public repos on 2026-05-12 via GraphQL `states: OPEN` checks | Complete for this checkpoint |
-| Manage PR discussions | PR review/comment closure plus merge/close state | #1803 was maintainer-edited and merged; no open PRs remain | Complete for this checkpoint |
+| Keep public PRs below 20 | Repo-family PR recheck | 0 open PRs across the tracked public repos on 2026-05-13 after merging #1846 | Complete for this checkpoint |
+| Keep public issues below 20 | Repo-family issue recheck | 0 open issues across the tracked public repos on 2026-05-13 | Complete for this checkpoint |
+| Manage repository discussions | Repo-family discussion recheck | Latest trunk discussion GraphQL sweep returned closed discussions only; satellite repos remain disabled or empty | Complete for this checkpoint |
+| Manage PR discussions | PR review/comment closure plus merge/close state | #1846 merged after current-head CI; no open PRs remain | Complete for this checkpoint |
 | Salvage useful stale work | `docs/stale-pr-salvage-ledger.md` | Ledger records salvaged, superseded, skipped, and manual-review tails; #1815-#1818 added cost tracking, skill scout, frontend design guidance, code-reviewer false-positive guardrails, and the May 12 gap pass | Complete except translation/manual review tail |
-| ECC 2.0 preview pack ready | Release docs, quickstart, publication readiness, release notes | `docs/releases/2.0.0-rc.1/` and readiness docs are in-tree | Needs final release evidence |
+| ECC 2.0 preview pack ready | Release docs, quickstart, publication readiness, release notes | `docs/releases/2.0.0-rc.1/` and readiness docs are in-tree; May 13 evidence refresh records harness, adapter, observability, Node, lint, release-surface, npm publish-surface, and Rust checks | Needs final clean-checkout release approval |
 | Hermes specialized skills included safely | Hermes setup/import docs and sanitized skill surface | Hermes setup and import playbook are public; secrets stay local | Needs final release review |
 | Naming and rename readiness | Naming matrix across package/plugin/docs/social surfaces | `docs/releases/2.0.0-rc.1/naming-and-publication-matrix.md` records current package, repo, Claude plugin, Codex plugin, OpenCode, and npm availability evidence | Complete for rc.1; post-rc rename remains future work |
 | Claude and Codex plugin publication | Contact/submission path with required artifacts and status | Publication readiness, naming matrix, and May 12 dry-run evidence document plugin validation, clean-checkout Claude tag/install smoke, and Codex marketplace CLI shape | Needs explicit approval for real tag/push and marketplace submission |
@@ -229,7 +236,7 @@ is not complete unless the evidence column exists and has been freshly verified.
 | Flow separation and progress tracking | Flow lanes with owner artifacts and update cadence | This roadmap defines lanes below | Active |
 | Realtime Linear sync | Project updates while issue limit is blocked; issues later | ECC-Tools #39 implements opt-in Linear API sync for deferred follow-up backlog items | Needs workspace capacity/config rollout |
 | Observability for self-use | Local readiness gate, traces, status snapshots, HUD/status contract, risk ledger | `npm run observability:ready` reports 16/16 | Complete for local gate |
-| Proper release and notifications | Release tag, npm publish state, plugin state, social posts | Publication readiness gate exists | Not complete |
+| Proper release and notifications | Release tag, npm publish state, plugin state, social posts | Publication readiness gate exists with May 12 dry-run and May 13 readiness evidence | Not complete; approval/live URLs required |

 ## Execution Lanes And Tracking Contract

--- a/docs/releases/2.0.0-rc.1/publication-evidence-2026-05-13.md
+++ b/docs/releases/2.0.0-rc.1/publication-evidence-2026-05-13.md
@@ -0,0 +1,60 @@
+# ECC v2.0.0-rc.1 Publication Evidence - 2026-05-13
+
+This is release-readiness evidence only. It does not create a GitHub release,
+npm publication, plugin tag, marketplace submission, or announcement post.
+
+## Source Commit
+
+| Field | Evidence |
+| --- | --- |
+| Upstream main base | `797f283036904128bb1b348ae62019eb9f08cf39` |
+| Evidence branch | `docs/release-readiness-20260513` |
+| Evidence scope | Current `main` after PR #1846 plus markdownlint-only zh-CN CLAUDE list-marker normalization |
+| Git remote | `https://github.com/affaan-m/everything-claude-code.git` |
+| Local status caveat | Working tree had the unrelated untracked `docs/drafts/` directory |
+
+The actual release operator should repeat these checks from the final release
+commit with a clean checkout before publishing.
+
+## Queue And Release State
+
+| Surface | Command | Result |
+| --- | --- | --- |
+| GitHub PRs and issues | `gh pr list` / `gh issue list` across trunk, AgentShield, JARVIS, ECC-Tools, ECC-website | 0 open PRs and 0 open issues across tracked repos |
+| Trunk discussions | GraphQL discussion sweep for `affaan-m/everything-claude-code` | Latest 100 discussions were closed; no open discussion backlog found |
+| npm audit signature gate | PR #1846 | Merged as `797f283`; workflows that run `npm audit` now need `npm audit signatures` |
+
+## Required Command Evidence
+
+| Evidence | Command | Result |
+| --- | --- | --- |
+| Harness audit | `npm run harness:audit -- --format json` | `overall_score: 70`, `max_score: 70`, no top actions |
+| Adapter scorecard | `npm run harness:adapters -- --check` | `Harness Adapter Compliance: PASS`; 11 adapters |
+| Observability readiness | `npm run observability:ready -- --format json` | `overall_score: 16`, `max_score: 16`, `ready: true`, no top actions |
+| Root suite | `node tests/run-all.js` | `2376` passed, `0` failed |
+| Markdown lint | `npx markdownlint-cli '**/*.md' --ignore node_modules` | Passed after normalizing two zh-CN CLAUDE docs from asterisk bullets to dash bullets |
+| Package surface | `node tests/scripts/npm-publish-surface.test.js` | Passed `2/2`; package surface still excludes Python bytecode/cache artifacts |
+| Release surface | `node tests/docs/ecc2-release-surface.test.js` | Passed `18/18` |
+| Rust surface | `cd ecc2 && cargo test` | Passed `462/462`; warnings only for unused functions/fields |
+
+## Security Gate Evidence
+
+| Surface | Command or check | Result |
+| --- | --- | --- |
+| Local npm signature audit | `npm audit signatures` before PR #1846 | 241 verified registry signatures and 30 verified attestations |
+| Local npm vulnerability audit | `npm audit --audit-level=high` before PR #1846 | 0 vulnerabilities |
+| Workflow security validator | `node scripts/ci/validate-workflow-security.js` | Validated 7 workflow files |
+| Workflow validator tests | `node tests/ci/validate-workflow-security.test.js` | Passed `11/11`, including the new signature-gate cases |
+| GitHub CI for #1846 | Current-head PR checks | Full OS/package-manager matrix passed, including `windows-latest / Node 18.x / pnpm` |
+
+## Blockers Still Requiring Approval Or External Action
+
+- Create or verify GitHub prerelease `v2.0.0-rc.1`.
+- Publish `ecc-universal@2.0.0-rc.1` with npm dist-tag `next`.
+- Create and push the Claude plugin tag only after explicit approval.
+- Confirm the live Claude/Codex/OpenCode marketplace submission path or record
+  the manual submission owner and status.
+- Verify ECC Tools billing/App/Marketplace claims before using them in launch
+  copy.
+- Refresh announcement copy with live URLs after release and package/plugin
+  URLs exist.
--- a/docs/releases/2.0.0-rc.1/publication-readiness.md
+++ b/docs/releases/2.0.0-rc.1/publication-readiness.md
@@ -8,6 +8,8 @@ For the current rc.1 naming decision and package/plugin publication path, see
 [`naming-and-publication-matrix.md`](naming-and-publication-matrix.md).
 For the May 12 dry-run evidence pass, see
 [`publication-evidence-2026-05-12.md`](publication-evidence-2026-05-12.md).
+For the May 13 release-readiness evidence refresh, see
+[`publication-evidence-2026-05-13.md`](publication-evidence-2026-05-13.md).

 ## Release Identity Matrix

@@ -24,7 +26,7 @@ For the May 12 dry-run evidence pass, see
 | Codex plugin manifest | `2.0.0-rc.1` with shared skill source | `.codex-plugin/plugin.json` | `node tests/docs/ecc2-release-surface.test.js` | `publication-evidence-2026-05-12.md` | Plugin owner | Evidence recorded |
 | OpenCode package | `ecc-universal` plugin module | `.opencode/package.json`, `.opencode/index.ts` | `npm run build:opencode` | `publication-evidence-2026-05-12.md` | Package owner | Evidence recorded |
 | Agent metadata | `2.0.0-rc.1` | `agent.yaml`, `.agents/plugins/marketplace.json` | `node tests/scripts/catalog.test.js` | `publication-evidence-2026-05-12.md` | Release owner | Evidence recorded |
-| Migration copy | rc.1 upgrade path, not GA claim | `release-notes.md`, `quickstart.md`, `HERMES-SETUP.md` | `npx markdownlint-cli docs/releases/2.0.0-rc.1/*.md` | Pending final lint on release commit | Docs owner | Pending |
+| Migration copy | rc.1 upgrade path, not GA claim | `release-notes.md`, `quickstart.md`, `HERMES-SETUP.md` | `npx markdownlint-cli '**/*.md' --ignore node_modules` | `publication-evidence-2026-05-13.md` | Docs owner | Evidence recorded |

 ## Publication Gates

@@ -44,15 +46,15 @@ Record the exact commit SHA and command output before any publication action:

 | Evidence | Command | Required result | Recorded output |
 | --- | --- | --- | --- |
-| Clean release branch | `git status --short --branch` | On intended release commit; no unrelated files | Pending |
-| Harness audit | `npm run harness:audit -- --format json` | 70/70 passing | Pending |
-| Adapter scorecard | `npm run harness:adapters -- --check` | PASS | Pending |
-| Observability readiness | `npm run observability:ready` | 16/16 passing | Pending |
-| Root suite | `node tests/run-all.js` | 0 failures | Pending |
-| Markdown lint | `npx markdownlint-cli '**/*.md' --ignore node_modules` | 0 failures | Pending |
+| Clean release branch | `git status --short --branch` | On intended release commit; no unrelated files | Pending final clean-checkout release pass; May 13 evidence branch still had unrelated untracked `docs/drafts/` |
+| Harness audit | `npm run harness:audit -- --format json` | 70/70 passing | `publication-evidence-2026-05-13.md`: 70/70 |
+| Adapter scorecard | `npm run harness:adapters -- --check` | PASS | `publication-evidence-2026-05-13.md`: PASS, 11 adapters |
+| Observability readiness | `npm run observability:ready` | 16/16 passing | `publication-evidence-2026-05-13.md`: 16/16, ready true |
+| Root suite | `node tests/run-all.js` | 0 failures | `publication-evidence-2026-05-13.md`: 2376 passed, 0 failed |
+| Markdown lint | `npx markdownlint-cli '**/*.md' --ignore node_modules` | 0 failures | `publication-evidence-2026-05-13.md`: passed after zh-CN CLAUDE list-marker normalization |
 | Package surface | `node tests/scripts/npm-publish-surface.test.js` | 0 failures; no Python bytecode in npm tarball | `2/2` passed in May 12 evidence pass |
-| Release surface | `node tests/docs/ecc2-release-surface.test.js` | 0 failures | Pending |
-| Optional Rust surface | `cd ecc2 && cargo test` | 0 failures or explicit deferral | Pending |
+| Release surface | `node tests/docs/ecc2-release-surface.test.js` | 0 failures | `publication-evidence-2026-05-13.md`: 18/18 passed |
+| Optional Rust surface | `cd ecc2 && cargo test` | 0 failures or explicit deferral | `publication-evidence-2026-05-13.md`: 462/462 passed, warnings only |

 ## Do Not Publish If

--- a/docs/zh-CN/CLAUDE.md
+++ b/docs/zh-CN/CLAUDE.md
@@ -31,40 +31,40 @@ node tests/hooks/hooks.test.js

 项目组织为以下几个核心组件：

-* **agents/** - 用于委派的专业化子代理（规划器、代码审查员、TDD 指南等）
-* **skills/** - 工作流定义和领域知识（编码标准、模式、测试）
-* **commands/** - 由用户调用的斜杠命令（/tdd, /plan, /e2e 等）
-* **hooks/** - 基于触发的自动化（会话持久化、工具前后钩子）
-* **rules/** - 始终遵循的指南（安全、编码风格、测试要求）
-* **mcp-configs/** - 用于外部集成的 MCP 服务器配置
-* **scripts/** - 用于钩子和设置的跨平台 Node.js 工具
-* **tests/** - 脚本和工具的测试套件
+- **agents/** - 用于委派的专业化子代理（规划器、代码审查员、TDD 指南等）
+- **skills/** - 工作流定义和领域知识（编码标准、模式、测试）
+- **commands/** - 由用户调用的斜杠命令（/tdd, /plan, /e2e 等）
+- **hooks/** - 基于触发的自动化（会话持久化、工具前后钩子）
+- **rules/** - 始终遵循的指南（安全、编码风格、测试要求）
+- **mcp-configs/** - 用于外部集成的 MCP 服务器配置
+- **scripts/** - 用于钩子和设置的跨平台 Node.js 工具
+- **tests/** - 脚本和工具的测试套件

 ## 关键命令

-* `/tdd` - 测试驱动开发工作流
-* `/plan` - 实施规划
-* `/e2e` - 生成并运行端到端测试
-* `/code-review` - 质量审查
-* `/build-fix` - 修复构建错误
-* `/learn` - 从会话中提取模式
-* `/skill-create` - 从 git 历史记录生成技能
+- `/tdd` - 测试驱动开发工作流
+- `/plan` - 实施规划
+- `/e2e` - 生成并运行端到端测试
+- `/code-review` - 质量审查
+- `/build-fix` - 修复构建错误
+- `/learn` - 从会话中提取模式
+- `/skill-create` - 从 git 历史记录生成技能

 ## 开发说明

-* 包管理器检测：npm、pnpm、yarn、bun（可通过 `CLAUDE_PACKAGE_MANAGER` 环境变量或项目配置设置）
-* 跨平台：通过 Node.js 脚本支持 Windows、macOS、Linux
-* 代理格式：带有 YAML 前言的 Markdown（名称、描述、工具、模型）
-* 技能格式：带有清晰章节的 Markdown（何时使用、如何工作、示例）
-* 钩子格式：带有匹配器条件和命令/通知钩子的 JSON
+- 包管理器检测：npm、pnpm、yarn、bun（可通过 `CLAUDE_PACKAGE_MANAGER` 环境变量或项目配置设置）
+- 跨平台：通过 Node.js 脚本支持 Windows、macOS、Linux
+- 代理格式：带有 YAML 前言的 Markdown（名称、描述、工具、模型）
+- 技能格式：带有清晰章节的 Markdown（何时使用、如何工作、示例）
+- 钩子格式：带有匹配器条件和命令/通知钩子的 JSON

 ## 贡献

 遵循 CONTRIBUTING.md 中的格式：

-* 代理：带有前言的 Markdown（名称、描述、工具、模型）
-* 技能：清晰的章节（何时使用、如何工作、示例）
-* 命令：带有描述前言的 Markdown
-* 钩子：带有匹配器和钩子数组的 JSON
+- 代理：带有前言的 Markdown（名称、描述、工具、模型）
+- 技能：清晰的章节（何时使用、如何工作、示例）
+- 命令：带有描述前言的 Markdown
+- 钩子：带有匹配器和钩子数组的 JSON

 文件命名：小写字母并用连字符连接（例如 `python-reviewer.md`, `tdd-workflow.md`）
--- a/docs/zh-CN/examples/CLAUDE.md
+++ b/docs/zh-CN/examples/CLAUDE.md
@@ -19,34 +19,34 @@

 ### 1. 代码组织

-* 多个小文件优于少量大文件
-* 高内聚，低耦合
-* 每个文件典型 200-400 行，最多 800 行
-* 按功能/领域组织，而非按类型
+- 多个小文件优于少量大文件
+- 高内聚，低耦合
+- 每个文件典型 200-400 行，最多 800 行
+- 按功能/领域组织，而非按类型

 ### 2. 代码风格

-* 代码、注释或文档中不使用表情符号
-* 始终使用不可变性 - 永不改变对象或数组
-* 生产代码中不使用 console.log
-* 使用 try/catch 进行适当的错误处理
-* 使用 Zod 或类似工具进行输入验证
+- 代码、注释或文档中不使用表情符号
+- 始终使用不可变性 - 永不改变对象或数组
+- 生产代码中不使用 console.log
+- 使用 try/catch 进行适当的错误处理
+- 使用 Zod 或类似工具进行输入验证

 ### 3. 测试

-* TDD：先写测试
-* 最低 80% 覆盖率
-* 工具函数进行单元测试
-* API 进行集成测试
-* 关键流程进行端到端测试
+- TDD：先写测试
+- 最低 80% 覆盖率
+- 工具函数进行单元测试
+- API 进行集成测试
+- 关键流程进行端到端测试

 ### 4. 安全

-* 不硬编码密钥
-* 敏感数据使用环境变量
-* 验证所有用户输入
-* 仅使用参数化查询
-* 启用 CSRF 保护
+- 不硬编码密钥
+- 敏感数据使用环境变量
+- 验证所有用户输入
+- 仅使用参数化查询
+- 启用 CSRF 保护

 ## 文件结构

@@ -96,14 +96,14 @@ DEBUG=false

 ## 可用命令

-* `/tdd` - 测试驱动开发工作流
-* `/plan` - 创建实现计划
-* `/code-review` - 审查代码质量
-* `/build-fix` - 修复构建错误
+- `/tdd` - 测试驱动开发工作流
+- `/plan` - 创建实现计划
+- `/code-review` - 审查代码质量
+- `/build-fix` - 修复构建错误

 ## Git 工作流

-* 约定式提交：`feat:`, `fix:`, `refactor:`, `docs:`, `test:`
-* 切勿直接提交到主分支
-* 合并请求需要审核
-* 合并前所有测试必须通过
+- 约定式提交：`feat:`, `fix:`, `refactor:`, `docs:`, `test:`
+- 切勿直接提交到主分支
+- 合并请求需要审核
+- 合并前所有测试必须通过