feat: M4 文风 + M5 生成/多provider/Skill + Kimi Code 订阅接入 + 本地联调修复

M4（文风）: style-auditor 双轨（提取指纹/漂移第四审）+ jobs 长任务框架(zombie reaper) + 回炉 refine + GET /style read-back。
M5（生成+扩展）: worldbuilder/character-gen（入库 continuity 409 gate + partition_writes 白名单 + schema→JSONB 形变）；
  网关多 provider 回退链/熔断/能力降级（Anthropic/Gemini 适配器）；Skill registry + 表权限沙箱 + 规则；
  前端 角色生成器/世界观/Codex/规则页/技能库/⌘K 命令面板。
K1（Kimi Code 订阅接入）: OAuth device-flow（kimi-code）+ 静态 Console key（kimi-code-key）两路径；
  coding 端点 KimiCLI 伪造头（实测 UA allow-list 门禁，缺则 403）+ JSON 模式结构化（thinking ⊥ tool_choice）。
本地联调修复: CORS 中间件；assemble 注入 premise+「写第N章」指令（修空 prompt 400）；
  GET /outline·/draft read-back + 大纲/工作台/审稿页重载；写页 client/server 常量边界 + notFound 健壮化；
  字数 toLocaleString locale 水合；审稿页终稿从已存草稿 seed（修 accept 422）。
门禁: backend ruff/mypy(157)/alembic 无漂移/pytest 451 · frontend lint/tsc/vitest/build。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/skills/pyproject.toml

@@ -0,0 +1,25 @@
+[project]
+name = "ww-skills"
+version = "0.0.0"
+requires-python = ">=3.12"
+dependencies = [
+  "pydantic>=2.7",
+  "sqlalchemy>=2.0",
+  "ww-shared",
+  "ww-db",
+  "ww-agents",
+  "ww-llm-gateway",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["ww_skills"]
+
+[tool.uv.sources]
+ww-shared = { workspace = true }
+ww-db = { workspace = true }
+ww-agents = { workspace = true }
+ww-llm-gateway = { workspace = true }

packages/skills/tests/test_skill_permissions.py

@@ -0,0 +1,130 @@
+"""T5.5 表权限沙箱单测（ARCH §5.6：声明式权限 + apply 层白名单，非进程沙箱）。
+
+纯函数、无 IO：
+- `filter_reads`：注入时只把 skill 声明 `reads` 的表数据喂给它（越权读 → 丢弃，不喂）。
+- `partition_writes`：写库时只应用 skill 声明 `writes` 的产出字段（越权写 → 丢弃 + 审计），
+  返回 `(allowed, rejected)` 两份，调用方据此落库 allowed、log rejected。
+- `validate_declaration`：加载/注册 skill 时校验其声明的 `reads/writes` 全在已知表白名单内
+  （杜绝声明指向不存在的表）；越界 → AppError(VALIDATION)。
+不变量 #3：自定义 skill 产出仍过验收 gate——本层只做白名单裁剪，不开写后门。
+"""
+
+from __future__ import annotations
+
+import pytest
+from ww_agents import AgentSpec
+from ww_shared import AppError, ErrorCode
+from ww_skills import (
+    KNOWN_TABLES,
+    filter_reads,
+    partition_writes,
+    validate_declaration,
+)
+
+
+def _spec(*, reads: list[str], writes: list[str], scope: str = "custom") -> AgentSpec:
+    return AgentSpec(
+        name="custom_skill",
+        tier="writer",
+        system_prompt="x",
+        reads=reads,
+        writes=writes,
+        scope=scope,
+    )
+
+
+# ---- filter_reads ----
+
+
+def test_filter_reads_keeps_only_declared_tables() -> None:
+    spec = _spec(reads=["world_entities"], writes=[])
+    available = {
+        "world_entities": [{"name": "灵根"}],
+        "characters": [{"name": "主角"}],  # 未声明 → 必须丢弃
+    }
+
+    fed = filter_reads(spec, available)
+
+    assert fed == {"world_entities": [{"name": "灵根"}]}
+
+
+def test_filter_reads_ignores_declared_table_absent_from_available() -> None:
+    spec = _spec(reads=["world_entities", "characters"], writes=[])
+    available = {"world_entities": [{"name": "灵根"}]}
+
+    fed = filter_reads(spec, available)
+
+    assert fed == {"world_entities": [{"name": "灵根"}]}
+
+
+def test_filter_reads_empty_declaration_feeds_nothing() -> None:
+    spec = _spec(reads=[], writes=[])
+    available = {"world_entities": [{"name": "灵根"}]}
+
+    assert filter_reads(spec, available) == {}
+
+
+# ---- partition_writes ----
+
+
+def test_partition_writes_drops_over_permission_fields() -> None:
+    spec = _spec(reads=[], writes=["world_entities"])
+    produced = {
+        "world_entities": [{"name": "新势力"}],
+        "characters": [{"name": "越权角色"}],  # 越权 → 丢弃 + 审计
+    }
+
+    allowed, rejected = partition_writes(spec, produced)
+
+    assert allowed == {"world_entities": [{"name": "新势力"}]}
+    assert rejected == ["characters"]
+
+
+def test_partition_writes_all_allowed_yields_empty_rejected() -> None:
+    spec = _spec(reads=[], writes=["world_entities", "characters"])
+    produced: dict[str, object] = {"world_entities": [], "characters": []}
+
+    allowed, rejected = partition_writes(spec, produced)
+
+    assert set(allowed) == {"world_entities", "characters"}
+    assert rejected == []
+
+
+def test_partition_writes_no_declared_writes_rejects_all() -> None:
+    spec = _spec(reads=[], writes=[])
+    produced = {"world_entities": [{"name": "x"}]}
+
+    allowed, rejected = partition_writes(spec, produced)
+
+    assert allowed == {}
+    assert rejected == ["world_entities"]
+
+
+# ---- validate_declaration ----
+
+
+def test_validate_declaration_passes_for_known_tables() -> None:
+    spec = _spec(reads=["world_entities"], writes=["world_entities"])
+    # 不抛即通过
+    validate_declaration(spec)
+
+
+def test_validate_declaration_rejects_unknown_read_table() -> None:
+    spec = _spec(reads=["secret_table"], writes=[])
+
+    with pytest.raises(AppError) as exc:
+        validate_declaration(spec)
+
+    assert exc.value.code is ErrorCode.VALIDATION
+    assert "secret_table" in str(exc.value.details)
+
+
+def test_validate_declaration_rejects_unknown_write_table() -> None:
+    # 系统表 users 不在创作表白名单 → 越权写声明被拒。
+    assert "users" not in KNOWN_TABLES
+    spec = _spec(reads=[], writes=["users"])
+
+    with pytest.raises(AppError) as exc:
+        validate_declaration(spec)
+
+    assert exc.value.code is ErrorCode.VALIDATION

packages/skills/tests/test_skill_registry.py

@@ -0,0 +1,103 @@
+"""T5.5 Skill registry loader 单测（ARCH §5.6 加载段）。
+
+`SkillRegistry` 从 `SkillRepo`（DB 行抽象）加载声明式 `AgentSpec`（builtin/custom/community），
+提供 `get(name)` / `list_scope(scope)` / `names()`。加载时跑 `validate_declaration`——
+越权声明（reads/writes 指向未知表）的 skill 直接拒绝（不入册），守 §5.6 表权限契约。
+
+纯内存 fake `SkillRepo`，无 DB：注册行只是声明数据，registry 转成 frozen AgentSpec。
+不变量 #2：行里只带 tier，registry 不解析具体 model（model 解析在网关）。
+"""
+
+from __future__ import annotations
+
+import pytest
+from ww_agents import AgentSpec
+from ww_shared import AppError, ErrorCode
+from ww_skills import SkillRecord, SkillRegistry
+
+
+def _record(
+    name: str,
+    *,
+    scope: str = "custom",
+    reads: list[str] | None = None,
+    writes: list[str] | None = None,
+) -> SkillRecord:
+    return SkillRecord(
+        name=name,
+        scope=scope,
+        tier="writer",
+        system_prompt=f"prompt for {name}",
+        reads=reads or [],
+        writes=writes or [],
+        genre=None,
+    )
+
+
+class _FakeSkillRepo:
+    def __init__(self, records: list[SkillRecord]) -> None:
+        self._records = records
+
+    async def list_all(self) -> list[SkillRecord]:
+        return list(self._records)
+
+
+@pytest.mark.asyncio
+async def test_load_builds_specs_keyed_by_name() -> None:
+    repo = _FakeSkillRepo(
+        [
+            _record(
+                "worldgen",
+                scope="builtin",
+                reads=["world_entities"],
+                writes=["world_entities"],
+            ),
+            _record("cpgen", scope="custom", reads=["characters"]),
+        ]
+    )
+
+    registry = await SkillRegistry.load(repo)
+
+    assert set(registry.names()) == {"worldgen", "cpgen"}
+    spec = registry.get("worldgen")
+    assert isinstance(spec, AgentSpec)
+    assert spec.tier == "writer"
+    assert spec.reads == ["world_entities"]
+    assert spec.scope == "builtin"
+
+
+@pytest.mark.asyncio
+async def test_get_missing_skill_raises_not_found() -> None:
+    registry = await SkillRegistry.load(_FakeSkillRepo([_record("a")]))
+
+    with pytest.raises(AppError) as exc:
+        registry.get("missing")
+
+    assert exc.value.code is ErrorCode.NOT_FOUND
+
+
+@pytest.mark.asyncio
+async def test_list_scope_filters_by_scope() -> None:
+    repo = _FakeSkillRepo(
+        [
+            _record("b1", scope="builtin"),
+            _record("c1", scope="custom"),
+            _record("c2", scope="custom"),
+        ]
+    )
+
+    registry = await SkillRegistry.load(repo)
+
+    assert {s.name for s in registry.list_scope("custom")} == {"c1", "c2"}
+    assert {s.name for s in registry.list_scope("builtin")} == {"b1"}
+
+
+@pytest.mark.asyncio
+async def test_load_rejects_over_permission_skill() -> None:
+    # 越权声明（reads 指向未知表）→ 加载即拒绝（守 §5.6），不静默入册。
+    repo = _FakeSkillRepo([_record("evil", reads=["secret_table"])])
+
+    with pytest.raises(AppError) as exc:
+        await SkillRegistry.load(repo)
+
+    assert exc.value.code is ErrorCode.VALIDATION

packages/skills/ww_skills/__init__.py

@@ -0,0 +1,35 @@
+"""Skill 运行时（T5.5 / ARCH §5.6）——声明式权限 + apply 层白名单。
+
+Skill registry loader（`skill_registry`）+ 表权限沙箱（`skill_permissions`）的**实现**就在
+本包（`packages/skills` 是 uv workspace member）。消费方（apps/api 编排/写库 apply 层）
+直接 `from ww_skills import ...`。
+
+注：§5.6 的强制点在编排/写库层；本包提供声明式 skill 的加载 + 白名单裁剪纯函数，
+调用方（生成入库端点）落 `partition_writes` 的 allowed、仍须经验收 gate 才真入库（不变量 #3）。
+"""
+
+from __future__ import annotations
+
+from ww_skills.skill_permissions import (
+    KNOWN_TABLES,
+    filter_reads,
+    partition_writes,
+    validate_declaration,
+)
+from ww_skills.skill_registry import (
+    SkillRecord,
+    SkillRegistry,
+    SkillRepo,
+    SqlSkillRepo,
+)
+
+__all__ = [
+    "KNOWN_TABLES",
+    "filter_reads",
+    "partition_writes",
+    "validate_declaration",
+    "SkillRecord",
+    "SkillRegistry",
+    "SkillRepo",
+    "SqlSkillRepo",
+]

packages/skills/ww_skills/skill_permissions.py

@@ -0,0 +1,71 @@
+"""Skill 表权限沙箱（ARCH §5.6 / PRODUCT_SPEC §5.5）——纯函数，无 IO。
+
+这**不是进程级沙箱**：声明式 Skill 不执行代码。强制点在编排/写库层（"声明式权限 +
+apply 层白名单"）：
+- `filter_reads`：注入时只把 skill 声明 `reads` 的表数据喂给它（未声明的表丢弃，不喂）。
+- `partition_writes`：写库时只应用 skill 声明 `writes` 的产出（越权字段丢弃 + 审计），
+  返回 `(allowed, rejected)`——调用方落 `allowed`、log `rejected`。不变量 #3：
+  allowed 仍须经验收 gate 才真入库，本层只裁剪白名单，不开写后门。
+- `validate_declaration`：注册/加载 skill 时校验 `reads/writes` 全在已知创作表白名单内
+  （杜绝声明指向不存在/系统表）；越界 → AppError(VALIDATION)。
+
+不可变：所有函数返回新 dict/list，从不原地改入参（全局 immutability 约定）。
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ww_agents import AgentSpec
+from ww_shared import AppError, ErrorCode
+
+# 声明式 Skill 允许声明读/写的创作表白名单（ARCH §3.1 创作表 + rules；
+# 系统/运营表 users/jobs/usage_ledger/provider_credentials/tier_routing/skills 不在此列）。
+KNOWN_TABLES: frozenset[str] = frozenset(
+    {
+        "projects",
+        "characters",
+        "world_entities",
+        "outline",
+        "chapter_digests",
+        "foreshadow",
+        "style_fingerprint",
+        "rules",
+        "chapters",
+        "chapter_reviews",
+    }
+)
+
+
+def filter_reads(spec: AgentSpec, available: dict[str, Any]) -> dict[str, Any]:
+    """注入白名单：只保留 skill 声明 `reads` 且 `available` 里确有的表（新 dict）。"""
+    declared = set(spec.reads)
+    return {table: data for table, data in available.items() if table in declared}
+
+
+def partition_writes(spec: AgentSpec, produced: dict[str, Any]) -> tuple[dict[str, Any], list[str]]:
+    """写库白名单：把产出分成 (allowed, rejected)。
+
+    `allowed`：产出表 ∈ skill 声明 `writes`（新 dict，调用方落库）。
+    `rejected`：越权产出表名（排序，调用方审计 log + 丢弃）。
+    """
+    declared = set(spec.writes)
+    allowed: dict[str, Any] = {}
+    rejected: list[str] = []
+    for table, data in produced.items():
+        if table in declared:
+            allowed[table] = data
+        else:
+            rejected.append(table)
+    return allowed, sorted(rejected)
+
+
+def validate_declaration(spec: AgentSpec) -> None:
+    """校验 skill 的 `reads/writes` 全在 `KNOWN_TABLES`；越界 → AppError(VALIDATION)。"""
+    unknown = sorted((set(spec.reads) | set(spec.writes)) - KNOWN_TABLES)
+    if unknown:
+        raise AppError(
+            ErrorCode.VALIDATION,
+            f"Skill「{spec.name}」声明了未知表：{unknown}",
+            {"skill": spec.name, "unknown_tables": unknown},
+        )

packages/skills/ww_skills/skill_registry.py

@@ -0,0 +1,131 @@
+"""Skill registry loader（ARCH §5.6 加载段 / PRODUCT_SPEC §5.5）。
+
+从 `SkillRepo`（`skills` 表的读侧抽象）加载声明式 skill 行 → 转 frozen `AgentSpec`
+（内置 builtin / 用户 custom / 社区 community 同构）。加载后按 `tier` 经 LLM 网关执行
+（复用 §5.1 的 agent 机制，本模块**不**重实现网关）。
+
+加载时对每条声明跑 `validate_declaration`：越权（reads/writes 指向未知表）的 skill
+直接拒绝（不入册），守 §5.6 表权限契约（不可信用户输入的第一道闸）。
+
+不变量 #2：行里只带 `tier`（writer/analyst/light），registry 不解析具体 model
+（model 解析在网关）。registry 加载后不可变（specs 字典只读）。
+"""
+
+from __future__ import annotations
+
+from typing import Protocol, cast, get_args
+
+from pydantic import BaseModel
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from ww_agents import AgentSpec
+from ww_db.models import Skill
+from ww_llm_gateway.types import Tier
+from ww_shared import AppError, ErrorCode
+
+from ww_skills.skill_permissions import validate_declaration
+
+_VALID_TIERS: frozenset[str] = frozenset(get_args(Tier))
+
+
+class SkillRecord(BaseModel):
+    """`skills` 表一行的声明式快照（frozen；snake_case）。
+
+    `input_schema`/`output_schema` 在 DB 里是 JSON Schema dict（用户自定义无 Python 类型），
+    registry 暂以纯声明（prompt + 表权限 + tier）执行；结构化 schema 的运行期绑定属后续，
+    故这里不携带 type[BaseModel]（内置 8 agent 仍用各自硬编码的 spec，见 ww_agents）。
+    """
+
+    model_config = {"frozen": True}
+
+    name: str
+    scope: str  # builtin / custom / community
+    tier: Tier
+    system_prompt: str
+    reads: list[str] = []
+    writes: list[str] = []
+    genre: str | None = None
+
+
+def _to_spec(record: SkillRecord) -> AgentSpec:
+    return AgentSpec(
+        name=record.name,
+        tier=record.tier,
+        system_prompt=record.system_prompt,
+        input_schema=None,
+        output_schema=None,
+        reads=list(record.reads),
+        writes=list(record.writes),
+        genre=record.genre,
+        scope=record.scope,
+    )
+
+
+class SkillRepo(Protocol):
+    """`skills` 表读侧接口（registry 加载源；测试注内存 fake）。"""
+
+    async def list_all(self) -> list[SkillRecord]: ...
+
+
+class SkillRegistry:
+    """加载后的只读 skill 注册表（name → AgentSpec）。"""
+
+    def __init__(self, specs: dict[str, AgentSpec]) -> None:
+        self._specs = dict(specs)
+
+    @classmethod
+    async def load(cls, repo: SkillRepo) -> SkillRegistry:
+        """从 repo 拉全部声明 → 校验表权限 → 建 frozen AgentSpec 字典。
+
+        越权声明（reads/writes 指向未知表）→ AppError(VALIDATION)，加载中断（不入册）。
+        """
+        specs: dict[str, AgentSpec] = {}
+        for record in await repo.list_all():
+            spec = _to_spec(record)
+            validate_declaration(spec)  # 越权 → 抛 VALIDATION
+            specs[spec.name] = spec
+        return cls(specs)
+
+    def get(self, name: str) -> AgentSpec:
+        """按名取 spec；不存在 → AppError(NOT_FOUND)。"""
+        spec = self._specs.get(name)
+        if spec is None:
+            raise AppError(ErrorCode.NOT_FOUND, f"skill not found: {name}")
+        return spec
+
+    def names(self) -> list[str]:
+        return sorted(self._specs)
+
+    def list_scope(self, scope: str) -> list[AgentSpec]:
+        """按 scope（builtin/custom/community）过滤，按 name 排序。"""
+        return [s for s in sorted(self._specs.values(), key=lambda s: s.name) if s.scope == scope]
+
+
+def _row_to_record(row: Skill) -> SkillRecord:
+    # DB `tier` 是裸 str，非法档位 → VALIDATION（不可信用户输入第一道闸）。
+    if row.tier not in _VALID_TIERS:
+        raise AppError(
+            ErrorCode.VALIDATION,
+            f"Skill「{row.name}」声明了非法档位：{row.tier}",
+            {"skill": row.name, "tier": row.tier},
+        )
+    return SkillRecord(
+        name=row.name,
+        scope=row.scope,
+        tier=cast(Tier, row.tier),
+        system_prompt=row.system_prompt,
+        reads=[str(t) for t in (row.reads or [])],
+        writes=[str(t) for t in (row.writes or [])],
+        genre=row.genre,
+    )
+
+
+class SqlSkillRepo:
+    """`skills` 表读侧 SQLAlchemy 实现（registry 加载源；只读）。"""
+
+    def __init__(self, session: AsyncSession) -> None:
+        self._s = session
+
+    async def list_all(self) -> list[SkillRecord]:
+        rows = (await self._s.execute(select(Skill))).scalars().all()
+        return [_row_to_record(r) for r in rows]