feat: release ContentCloud v0.7.0

.agents/plugins/evaluations/contentcloud-video-production-0.7.0.json

@@ -0,0 +1,82 @@
+{
+  "$schema": "../../../contracts/plugin-evaluation-1.0.schema.json",
+  "schema_version": "1.0",
+  "plugin": {
+    "id": "contentcloud-video-production",
+    "version": "0.7.0",
+    "digest": "sha256:59c80e26a2d0161f28f309d6f1b909d7261e9d933508f7398600f1d40de36bc9"
+  },
+  "scope": "deterministic_release_contract",
+  "status": "passed",
+  "scenarios": [
+    {
+      "id": "codex-plugin-transaction",
+      "requirement": "Pinned Marketplace and Plugin plans remain read-only until confirmation, validate after install, roll back only owned changes, and open a new Codex chat through the documented fallback.",
+      "command": ["go", "test", "-v", "./internal/codexplugin", "-run", "^(TestPlanIsReadOnlyAndPinsMarketplaceAndPlugin|TestDetectClassifiesCurrentOutdatedAndBroken|TestApplyRequiresConfirmation|TestApplyInstallsAndValidates|TestApplyRollsBackOnlyMarketplaceAddedByThisRun|TestNewChatDeepLinkContainsWorkspaceAndPluginMention|TestLaunchNewChatFallsBackToWorkspaceCommand)$"],
+      "evidence": ["TestPlanIsReadOnlyAndPinsMarketplaceAndPlugin", "TestApplyRequiresConfirmation", "TestApplyInstallsAndValidates", "TestApplyRollsBackOnlyMarketplaceAddedByThisRun", "TestLaunchNewChatFallsBackToWorkspaceCommand"],
+      "status": "passed"
+    },
+    {
+      "id": "bootstrap-confirmation",
+      "requirement": "Bootstrap uses a deterministic plan_id, performs no mutation before exact confirmation, binds one browser authorization attempt to one session, runs doctor before registration, and preserves recoverability on failure.",
+      "command": ["go", "test", "-v", "./internal/cli", "./internal/app", "-run", "^(TestBootstrapPlanIsReadOnlyAndUsesOnlyPublicSessionID|TestBootstrapPlanIDIsStableUntilInputsChange|TestBootstrapApplyInstallsInitializesDoctorsAndRegisters|TestBootstrapApplyAuthorizationFailureDoesNotMutatePluginOrWorkspace|TestBootstrapApplyRejectsUnconfirmedPlanID|TestBootstrapApplyRequiresPlanIDBeforeMutation|TestBootstrapApplyRejectsPlanAfterCodexStateChanges|TestBootstrapAuthorizationRequiresApprovalAndMatchingVerifier|TestBootstrapAuthorizationAllowsOnlyOneActiveAttemptPerSession)$"],
+      "evidence": ["TestBootstrapPlanIsReadOnlyAndUsesOnlyPublicSessionID", "TestBootstrapApplyInstallsInitializesDoctorsAndRegisters", "TestBootstrapApplyRejectsUnconfirmedPlanID", "TestBootstrapApplyRejectsPlanAfterCodexStateChanges", "TestBootstrapAuthorizationRequiresApprovalAndMatchingVerifier", "TestBootstrapAuthorizationAllowsOnlyOneActiveAttemptPerSession"],
+      "status": "passed"
+    },
+    {
+      "id": "cross-conversation-handoff",
+      "requirement": "New conversations recover persisted state and atomically transfer one exact Run revision without reading prior transcripts.",
+      "command": ["go", "test", "-v", "./internal/localworkspace", "./internal/cli", "-run", "^(TestConversationContextReadsPersistedOfflineState|TestRunClaimIsSingleWriterAndExpiredTakeoverIsExplicit|TestHandoffAcceptIsAtomicAcrossConversations|TestHandoffRejectsChangedInputDigest|TestMCPRunsCrossConversationHandoffLifecycle)$"],
+      "evidence": ["TestConversationContextReadsPersistedOfflineState", "TestRunClaimIsSingleWriterAndExpiredTakeoverIsExplicit", "TestHandoffAcceptIsAtomicAcrossConversations", "TestHandoffRejectsChangedInputDigest", "TestMCPRunsCrossConversationHandoffLifecycle"],
+      "status": "passed"
+    },
+    {
+      "id": "governed-publish",
+      "requirement": "Publish binds exact files, disclosures, message, idempotency key, and environment to a confirmed plan_id and performs no cloud write for a missing, stale, or unconfirmed plan.",
+      "command": ["go", "test", "-v", "./internal/cli", "-run", "^(TestPublishPlanIDIsStableAndBindsExactInputs|TestPublishCLIRejectsMissingOrStalePlanBeforeCloudWrite|TestMCPPublishApplyRequiresExactConfirmationBeforeCloudWrite|TestPublishReadersRejectSymlinksOutsideWorkspace)$"],
+      "evidence": ["TestPublishPlanIDIsStableAndBindsExactInputs", "TestPublishCLIRejectsMissingOrStalePlanBeforeCloudWrite", "TestMCPPublishApplyRequiresExactConfirmationBeforeCloudWrite", "TestPublishReadersRejectSymlinksOutsideWorkspace"],
+      "status": "passed"
+    },
+    {
+      "id": "review-and-approved-resume",
+      "requirement": "Review feedback and ApprovedSnapshots are explicitly pulled, stored immutably, verified, and reused by later credential-free conversations without cloud reads.",
+      "command": ["go", "test", "-v", "./internal/localworkspace", "./internal/cli", "-run", "^(TestReviewFeedbackInboxKeepsImmutableRevisionsOfOneSubmissionRevision|TestReviewFeedbackInboxRejectsDigestMismatch|TestMCPFeedbackPullCreatesImmutableInboxForNewConversation|TestApprovedSnapshotCacheKeepsImmutableVersions|TestApprovedSnapshotCacheRejectsTamperingAndUnverifiedLegacyEntry|TestMCPApprovedSnapshotPullSupportsOfflineCrossConversationRead|TestWorkspaceApprovedCommandsReadCacheWithoutCredential)$"],
+      "evidence": ["TestReviewFeedbackInboxKeepsImmutableRevisionsOfOneSubmissionRevision", "TestMCPFeedbackPullCreatesImmutableInboxForNewConversation", "TestApprovedSnapshotCacheKeepsImmutableVersions", "TestApprovedSnapshotCacheRejectsTamperingAndUnverifiedLegacyEntry", "TestMCPApprovedSnapshotPullSupportsOfflineCrossConversationRead"],
+      "status": "passed"
+    },
+    {
+      "id": "knowledge-contract",
+      "requirement": "Knowledge candidates remain evidence-bound, reject invented or out-of-workspace inputs, and become eligible only through a verified ApprovedSnapshot.",
+      "command": ["go", "test", "-v", "./internal/localworkspace", "-run", "^(TestKnowledgeCandidateFlowToApprovedQueryAndPack|TestKnowledgeImportRejectsInventedEvidence|TestKnowledgeImportRejectsSymlinkOutsideWorkspace|TestKnowledgeImportRejectsInvalidCandidatePackageShapes)$"],
+      "evidence": ["TestKnowledgeCandidateFlowToApprovedQueryAndPack", "TestKnowledgeImportRejectsInventedEvidence", "TestKnowledgeImportRejectsSymlinkOutsideWorkspace", "TestKnowledgeImportRejectsInvalidCandidatePackageShapes"],
+      "status": "passed"
+    },
+    {
+      "id": "content-contract",
+      "requirement": "ContentItem and ContentBatch contracts enforce explicit arrays, blocked reasons, approved references, and declared revision drift before publish or export.",
+      "command": ["go", "test", "-v", "./internal/localworkspace", "./internal/cli", "-run", "^(TestContentItemRevisionDiffRejectsUndeclaredDrift|TestContentItemLintRequiresExplicitArraysAndBlockedReasons|TestPublishPreflightUsesContentBatchManifestAndAllowsBlockedItems|TestPublishPreflightRejectsBriefThatSkippedLocalLint)$"],
+      "evidence": ["TestContentItemRevisionDiffRejectsUndeclaredDrift", "TestContentItemLintRequiresExplicitArraysAndBlockedReasons", "TestPublishPreflightUsesContentBatchManifestAndAllowsBlockedItems", "TestPublishPreflightRejectsBriefThatSkippedLocalLint"],
+      "status": "passed"
+    },
+    {
+      "id": "browser-navigation-safety",
+      "requirement": "View intent remains read-only, arbitrary targets and page-provided instructions are rejected, Tool success is distinct from verified Browser success, and unavailable Browser/link outcomes do not rewrite the underlying business result.",
+      "command": ["go", "test", "-v", "./plugins/contentcloud-video-production/skills", "./internal/cli", "-run", "^(TestWorkspaceSkillBrowserSafetyContract|TestWorkspaceSkillBrowserEvalCases|TestMCPOpenProjectViewReturnsTrustedResourceLink|TestMCPOpenProjectViewRejectsUnsafeInputs|TestMCPWorkspaceToolLinkFailureDoesNotReverseBusinessSuccess|TestMCPProjectViewTargetSelectionDoesNotInventObjectPrecision)$"],
+      "evidence": ["TestWorkspaceSkillBrowserSafetyContract", "TestWorkspaceSkillBrowserEvalCases", "TestMCPOpenProjectViewReturnsTrustedResourceLink", "TestMCPOpenProjectViewRejectsUnsafeInputs", "TestMCPWorkspaceToolLinkFailureDoesNotReverseBusinessSuccess", "TestMCPProjectViewTargetSelectionDoesNotInventObjectPrecision"],
+      "status": "passed"
+    },
+    {
+      "id": "environment-control-plane",
+      "requirement": "Project-bound Manifests and Execution Bundles are signed and expiry-checked; Registry, local Lock, Pack, capability digest, subject binding, Automation pre-lease resolution, and attempt-scoped execution workspaces all fail closed without leaking run credentials or leaving an unfinished attempt.",
+      "command": ["go", "test", "-v", "./internal/environment", "./internal/app", "./internal/localworkspace", "./internal/capabilitycatalog", "./internal/serverconfig", "./internal/automationworkspace", "./internal/agentadapter", "./internal/cli", "-run", "^(TestManifestSignatureBindsPayloadProjectExpiryAndTrust|TestBuildManifestUsesOnlyExactPublishedCompatibleRegistryEntries|TestRevokedEntryBlocksNewUseButRemainsHistoricallyAuditable|TestLocalResolverIntersectsManifestRegistryAndLock|TestPreparationPlanBindsSignedPermissionsCostAndExecutionPlan|TestPreparedLockAddsOnlyExactConfirmedTaskPack|TestRegistryCanonicalPayloadMatchesNodeConformanceVector|TestCreativeExecutionBundleIsDeterministicAndBindsSubjectEnvironmentAndTrust|TestCreativeExecutionBundleFailsClosedForPackRegistryLockAndCapabilityDrift|TestBrowserBootstrapReturnsProjectBoundSignedEnvironmentManifest|TestAutomationPollRequiresVerifiedEnvironmentPackAndCapabilityBeforeLease|TestEnvironmentStateStoresAndVerifiesSignedManifestAndExactLock|TestEnvironmentStateFailsClosedForWrongProjectMissingPluginAndTampering|TestEnvironmentLockCompareAndSwapRejectsConcurrentChange|TestEnvironmentPreparationAndRunClaimAreMutuallyExclusive|TestBuiltinsUseDeterministicSHA256Digests|TestLoadEnvironmentBuildsVerifiedControlPlaneAndAutomationPolicy|TestLoadEnvironmentFailsClosedForPartialOrUnsafeConfiguration|TestMCPEnvironmentExecutionPlanUsesVerifiedOfflineState|TestMCPEnvironmentPreparationRequiresExactConfirmationAndReachesReady|TestWorkspacePrepareCLIPlanAndApplyUseTheSameDeterministicPlan|TestEnvironmentPreparationFailureRollsBackOnlyTheNewPack|TestAttemptWorkspaceFreezesInputsWithoutRunCredentialAndUsesExclusiveLease|TestAttemptWorkspaceRejectsInteractiveOverlapAndRecoversOnlyExpiredOwnedLease|TestAttemptWorkspaceRenewsExclusiveLeaseFromServerExpiry|TestAdapterLoadsOnlyFrozenAutomationWorkspaceResources|TestAgentEnvironmentDoesNotInheritUnrelatedSecret|TestDaemonFixtureUsesAttemptScopedWorkspaceWithoutPersistingRunCredential|TestDaemonFinishesAttemptWhenWorkspaceIsolationFails)$"],
+      "evidence": ["TestManifestSignatureBindsPayloadProjectExpiryAndTrust", "TestBuildManifestUsesOnlyExactPublishedCompatibleRegistryEntries", "TestRevokedEntryBlocksNewUseButRemainsHistoricallyAuditable", "TestLocalResolverIntersectsManifestRegistryAndLock", "TestPreparationPlanBindsSignedPermissionsCostAndExecutionPlan", "TestPreparedLockAddsOnlyExactConfirmedTaskPack", "TestRegistryCanonicalPayloadMatchesNodeConformanceVector", "TestCreativeExecutionBundleIsDeterministicAndBindsSubjectEnvironmentAndTrust", "TestCreativeExecutionBundleFailsClosedForPackRegistryLockAndCapabilityDrift", "TestBrowserBootstrapReturnsProjectBoundSignedEnvironmentManifest", "TestAutomationPollRequiresVerifiedEnvironmentPackAndCapabilityBeforeLease", "TestEnvironmentStateStoresAndVerifiesSignedManifestAndExactLock", "TestEnvironmentStateFailsClosedForWrongProjectMissingPluginAndTampering", "TestEnvironmentLockCompareAndSwapRejectsConcurrentChange", "TestEnvironmentPreparationAndRunClaimAreMutuallyExclusive", "TestBuiltinsUseDeterministicSHA256Digests", "TestLoadEnvironmentBuildsVerifiedControlPlaneAndAutomationPolicy", "TestLoadEnvironmentFailsClosedForPartialOrUnsafeConfiguration", "TestMCPEnvironmentExecutionPlanUsesVerifiedOfflineState", "TestMCPEnvironmentPreparationRequiresExactConfirmationAndReachesReady", "TestWorkspacePrepareCLIPlanAndApplyUseTheSameDeterministicPlan", "TestEnvironmentPreparationFailureRollsBackOnlyTheNewPack", "TestAttemptWorkspaceFreezesInputsWithoutRunCredentialAndUsesExclusiveLease", "TestAttemptWorkspaceRejectsInteractiveOverlapAndRecoversOnlyExpiredOwnedLease", "TestAttemptWorkspaceRenewsExclusiveLeaseFromServerExpiry", "TestAdapterLoadsOnlyFrozenAutomationWorkspaceResources", "TestAgentEnvironmentDoesNotInheritUnrelatedSecret", "TestDaemonFixtureUsesAttemptScopedWorkspaceWithoutPersistingRunCredential", "TestDaemonFinishesAttemptWhenWorkspaceIsolationFails"],
+      "status": "passed"
+    }
+  ],
+  "limitations": [
+    "The deterministic Browser trace evaluation does not replace model-sampled Skill behavior or the ChatGPT Desktop Browser W4-01 host gate.",
+    "Codex Desktop host loading, Deep Link behavior, authentication profile, and session boundaries remain separate W4 smoke-test gates.",
+    "The report does not use production credentials, publish release artifacts, or contact production services.",
+    "Optional future Skill and Provider Packs require their own creative-quality evaluations under W5-06."
+  ]
+}

.agents/plugins/registry.json

@@ -5,18 +5,18 @@
     {
       "id": "contentcloud-video-production",
       "kind": "scene_plugin",
-      "version": "0.6.0",
+      "version": "0.7.0",
       "source": {
         "repository": "https://github.com/limecloud/contentcloud",
-        "ref": "v0.6.0"
+        "ref": "v0.7.0"
       },
       "license": "Apache-2.0",
-      "digest": "sha256:14076c0a2dd8031589e6e5904cc13bd63f14fe8ad23d54b208aa4dbde7bbb326",
+      "digest": "sha256:59c80e26a2d0161f28f309d6f1b909d7261e9d933508f7398600f1d40de36bc9",
       "signature": {
         "status": "verified",
         "algorithm": "ed25519",
         "key_id": "contentcloud-plugin-release-2026-07",
-        "value": "Gl1+uaUsqYUQ13Rsm+8jVEPs5u7rb3nwTkVaRc9gutHeOSTz+xdjCKdR2EQ5+eePcEMxesO3dzEK5yyxZCNfBw=="
+        "value": "2isc7SsECz2dgNTvJJQ4myNlAO3RrQeFfVG7+0iEF1gu5+8GxxxuMt83xK/tImzwRwvWLLfJg8dbmTcm0vzhBw=="
       },
       "compatible_profiles": [
         "contentcloud.video-production"
@@ -32,7 +32,8 @@
         "cloud_actions": [
           "bootstrap.authorization.complete",
           "workspace.register",
-          "explicit publish and review synchronization"
+          "explicit publish and review synchronization",
+          "trusted project-view navigation"
         ]
       },
       "cost": {
@@ -41,20 +42,24 @@
       },
       "output_schemas": [
         "contracts/knowledge-candidates-1.0.schema.json",
-        "contracts/script-package-2.0.schema.json"
+        "contracts/knowledge-page-3.0.schema.json",
+        "contracts/content-batch-3.0.schema.json",
+        "contracts/content-item-3.0.schema.json",
+        "contracts/handoff-1.0.schema.json"
       ],
       "evaluation": {
         "status": "passed",
-        "report": ".agents/plugins/evaluations/contentcloud-video-production-0.6.0.json",
-        "digest": "sha256:63eda3784fca5467e5c7ef066986ebc18f439988848ae0e3926b91b542772d28",
+        "report": ".agents/plugins/evaluations/contentcloud-video-production-0.7.0.json",
+        "digest": "sha256:a9e5603a116a18526437a3990bf66b696729f728f7eb9395a8028976f674c39c",
         "evidence": [
           "codex-plugin-transaction",
           "bootstrap-confirmation",
           "cross-conversation-handoff",
           "governed-publish",
           "review-and-approved-resume",
           "knowledge-contract",
-          "script-contract",
+          "content-contract",
+          "browser-navigation-safety",
           "environment-control-plane"
         ]
       },

CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ContentCloud 的重要变更记录在此文件中。
 
+## [0.7.0] - 2026-07-27
+
+### Added
+
+- 增加 V3 Workspace、Source Registry、Markdown Knowledge Page/Pack、Brief、ContentBatch/ContentItem、LocalRun 和 Handoff 契约，并提供可重复生成完整项目状态的脱敏 Fixture。
+- 增加统一的 SubmissionRevision、Decision、ApprovedSnapshot 和 ProjectProjection 主链，覆盖七类 Submission、两阶段审批、交付、结果回流及 12 个 Web 项目视图。
+- 增加 Page Contract、项目与 Revision 深链、`/codex` 双模接入、Web 到 Codex 恢复入口及只读 Browser 导航安全评测。
+- 增加 PostgreSQL V3 空库基线、RLS/不可变约束集成测试和旧事实源回流治理守卫。
+
+### Changed
+
+- 本地创作事实源统一为 V3 数字目录和 `.contentcloud` 状态；云端正式事实统一为 Revision、Decision、Snapshot 与投影。
+- Plugin Skills、MCP、CLI、Web、Environment Profile 和 npm 安装器统一升级到 `0.7.0`，内容生产从 ScriptPackage 收敛为 ContentBatch/ContentItem。
+- Delivery、Artifact、Result 和 Learning 只绑定 ApprovedSnapshot；导出选择统一使用 `content_item_id`。
+- Web 项目工作台改为消费服务端 ProjectProjection，并使用共享 Page Contract 校验 view、focus、digest 和登录返回路径。
+
+### Fixed
+
+- 将 Submission 内审批准、退回修改和客户审批前置状态切换收紧为基于当前 Revision 与预期旧状态的原子更新，避免并发决定生成互相矛盾的 ApprovedSnapshot 与 Submission 状态。
+
+### Removed
+
+- 移除 V1/V2 Strategy、Brief、ScriptVersion、ReviewCycle、Artifact Presentation/local-open 等平行运行时与兼容入口。
+- 移除累计旧迁移并改为唯一 `00001_v3_baseline.sql`。这是破坏性数据库边界：`0.7.0` 只支持新建 V3 数据库，不提供现有 V1/V2/`0.6.0` 数据库的在线升级或回填。
+
 ## [0.6.0] - 2026-07-27
 
 ### Added