feat: 五方向认知升级定稿实装 — E安全模块 + C集成模块 + 验证体系 + 设计资产

[Liber1917]

概要

基于「Agent 认知升级」五方向(A 联网/B 环境/C 具身/D 控制/E 安全)调研定稿的首次大规模实装。

变更内容

1. setup-opencode.sh 新增步骤 12「安全与能力增强」(SKIP_SECURITY=1 可跳过)

• 部署 e-modules 到 ~/.config/opencode/opencode-setup-modules/
• 权限红线合并(53 条 bash 规则: 18 deny / 7 ask / 23 allow + edit 9)
• 审计初始化(JSONL + 密钥脱敏 + 熔断器 + 30 天轮转)
• 安全自检(密钥治理/offline/provenance/注入扫描)+ AGENT-CARD 生成
• 合规文档(CN/EU 双地区)

2. e-modules/ — E 方向六模块落地

模块	文件	实测
权限红线	gen-permissions.sh	✅ 53 规则 JSON 合法
审计	audit-init.sh	✅ 脱敏+熔断验证通过
安全自检+AGENT-CARD	security-check.sh	✅ 4通过/3警告/0失败
合规	gen-compliance.sh	✅ CN/EU 双版
devcontainer(C 档)	devcontainer/	静态验证
bwrap(B 档)	bwrap-setup.sh	静态验证

3. c-modules/ — C 方向集成(集成而非自研)

• 通道① 用户偏好 recall → mem0(Apache-2.0, 原生支持 OpenCode)
• 通道② 流程改进 → SkillOpt-Sleep(MIT, 官方支持 OpenCode transcripts)
• 双通道审批设计(轻/重审批分离, spec C-2)

4. benchmarks/ — 验证体系 + 实测报告

• VERIFICATION-PIPELINE.md(四关验证: 静态碰撞/动态帕累托/碰撞裁决/泛化)
• skill-overlap(38×38 矩阵)/ triple-gate(33 skill 三关)/ collision-bench(碰撞裁决 3 次采样)/ graphify-vs-codegraph(五仓光谱)

5. preset-skills/ — ai-communication 沟通协议

6. docs/design/ — 五方向规格 + 调研报告(HTML+MD)

测试

• ✅ bash -n 全部脚本语法通过
• ✅ Docker ubuntu:22.04 干净容器实测: 权限合并/审计初始化/安全自检全链路
• ✅ 降级路径(无 python3)不崩
• ⚠️ 完整 12 步安装流程未在本 PR 重跑(与 main 的 1-11 步无变更, 仅追加 12)

设计文档

见 docs/design/harness-env-awareness-spec.md(五方向定稿)与 docs/design/VERIFICATION-PIPELINE.md(验证体系)

[ecc-tools]

Analyzing 200 commits...

[ecc-tools]

Analysis Complete

Generated ECC bundle from 3 commits | Confidence: 60%

View Pull Request #3

Repository Profile

Attribute	Value
Language	TypeScript
Framework	Not detected
Commit Convention	conventional
Test Directory	separate

Changed Files (63)

Metric	Value
Files changed	63
Additions	14930
Deletions	12

Top hotspots

Path	Status	+/-
benchmarks/skill-overlap/skill-data/jaccard_pairs.json	added	+705 / -0
benchmarks/skill-overlap/skill-data/superpowers/writing-skills.md	added	+679 / -0
docs/design/agent-cognition-report.html	added	+602 / -0
benchmarks/skill-overlap/skill-data/superpowers/subagent-driven-development.md	added	+568 / -0
benchmarks/skill-overlap/skill-data/agent-skills/security-and-hardening.md	added	+499 / -0

Top directories

Directory	Files	Total changes
benchmarks/skill-overlap/skill-data/agent-skills	24	7208
benchmarks/skill-overlap/skill-data/superpowers	14	3377
docs/design	6	1761
benchmarks/skill-overlap/skill-data	3	835
e-modules	5	493

Analysis Depth Readiness (evidence-backed, 50%)

ECC Tools uses this to decide whether recommendations should stay at commit-history/setup guidance or expand into CI, security, harness, reference-set, AI-routing, and team backlog work.

Area	Status	Evidence / Next Step
Commit history	Partial	3 commits sampled
CI/CD signals	Missing	Add workflow files or CI troubleshooting evidence so ECC Tools can reason about pipeline setup.
Security evidence	Ready	benchmarks/skill-overlap/skill-data/agent-skills/security-and-hardening.md, e-modules/audit-init.sh, e-modules/security-check.sh
Harness configuration	Missing	Add Claude, Codex, OpenCode, Zed, dmux, MCP, plugin, or cross-harness config evidence for harness-agnostic recommendations.
Reference/eval evidence	Ready	benchmarks/VERIFICATION-PIPELINE.md, benchmarks/collision-bench/report.md, benchmarks/graphify-vs-codegraph/report.md
AI routing and cost controls	Ready	benchmarks/skill-overlap/skill-data/agent-skills/planning-and-task-breakdown.md, benchmarks/skill-overlap/skill-data/superpowers/executing-plans.md, benchmarks/skill-overlap/skill-data/superpowers/writing-plans.md
Team handoff and project tracking	Missing	Add roadmap, runbook, project, Linear, or follow-up tracking docs so generated work can land in a team queue.

Reference Set Readiness (2/7, 29%)

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Present	benchmarks/VERIFICATION-PIPELINE.md, benchmarks/collision-bench/report.md, benchmarks/graphify-vs-codegraph/report.md
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Missing	Add cross-harness, adapter-compliance, or harness-audit evidence for Claude, Codex, OpenCode, Zed, dmux, and agent surfaces.
Security evidence	Present	benchmarks/skill-overlap/skill-data/agent-skills/security-and-hardening.md, e-modules/audit-init.sh, e-modules/security-check.sh
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Generated Instincts (6)

Domain	Count
git	2
code-style	3
testing	1

After merging, import with:

/instinct-import .claude/homunculus/instincts/inherited/opencode-setup-instincts.yaml

Files

• .claude/ecc-tools.json
• .claude/skills/opencode-setup/SKILL.md
• .agents/skills/opencode-setup/SKILL.md
• .agents/skills/opencode-setup/agents/openai.yaml
• .claude/identity.json
• .codex/config.toml
• .codex/AGENTS.md
• .codex/agents/explorer.toml
• .codex/agents/reviewer.toml
• .codex/agents/docs-researcher.toml
• .claude/homunculus/instincts/inherited/opencode-setup-instincts.yaml

---

_{ECC Tools | Everything Claude Code}