AI 原生开放教材

外观

Agent Skills for Context Engineering技能与配置库·英文原文 ↗原件 ↓仓库 ↗

Public export boundary ​

The exporter turns explicitly classified private or restricted JSON records into new public projection artifacts. It is an allowlist projector, not a claim that arbitrary files can be made safe by scanning.

The record sequence is immutable:

  1. ExportRequest selects source-relative paths and registered transforms.
  2. ExportPlan privately binds the exact source bytes and policy version.
  3. ExportManifest publicly binds only projection IDs, transform digests, output paths, and output digests.
  4. ExportValidation proves the staged tree matches its manifest and supported detectors.
  5. Human approval, merge receipt, correction, and tombstone records are separate later lifecycle records. Earlier records are never edited in place.

Private input digests, storage locators, source paths, capability material, and notification destinations never appear in the public manifest. A public projection receives a new proj_ identity. Possessing that identity does not grant access to the private source.

Commands ​

bash
python researcher/scripts/validate_export.py plan \
  --request researcher/fixtures/export/restricted-request.json \
  --private-root researcher/fixtures/export/private-root \
  --plan-out researcher/exports/private/example-plan.json

python researcher/scripts/validate_export.py render \
  --plan researcher/exports/private/example-plan.json \
  --private-root researcher/fixtures/export/private-root \
  --staging-dir researcher/exports/staging/example \
  --receipt-out researcher/exports/private/example-receipt.json

python researcher/scripts/validate_export.py check \
  --staging-dir researcher/exports/staging/example

researcher/exports/examples/restricted-citation-v1/ is a committed deterministic example. Local private/ and staging/ directories are ignored.

Supported guarantee ​

Supported rendering paths reject unknown request and manifest fields, unknown artifact kinds, unregistered transforms, secret-reference sources, path traversal, symlinks, path collisions, source mutation, extra staged files, digest drift, private metadata fields, supplied canaries in plain/hex/base64 forms, and a small set of high-confidence secret structures. The structural field allowlist is the primary boundary. Supplementary scanning cannot prove absence of every possible semantic disclosure.