A skill call with no task input now strictly means: audit the repo, deliver
the report and fix/scaffold plan, then stop — never create/modify files or
run write operations until the user confirms. Stated in the flow header,
the review step, the human/agent authority section, and promoted to the
top red line.
Guides and constrains eco-app development in independent repos against the
TickShield platform contract: listingKey identity, app.manifest.json fields,
tickshield-node-runtime base image, guard four-gate authz, tenant_id isolation,
portal-sdk host bridge for micro frontends, release-cli publish and store
deployment. Ships copy-ready templates (manifest/Dockerfile/server.js/web
skeleton/Gitea release workflow/PRD) plus a zero-dependency static checker
(scripts/check-app.sh) covering die/warn contract items.
Add boundary routing, pre-flight step, per-step acceptance criteria,
reasoned hard constraints, red lines, troubleshooting table, and a
fixed report structure.
sunjunzhao