- TickShield app skills now follow the app-<action> naming convention
(e.g. app-publish); dev-app kept as the legacy grandfathered name
- convention recorded in AGENTS.md + README skills table; skill-forge
step 0 enforces app-<action> for future TickShield app skills
- cross-references between dev-app and app-publish updated
- publish-app: convert/add Gitea Actions deploy job to publish TickShield
apps to the marketplace via aigrego-release (Go static binary) —
--store auto-publish + --wait review gate; local-first CLI fetch
(ensure-cli.sh) with minIO platform-matrix download + sha256 verify;
workflow template and 12-item check script
- rename dev-app to app-dev per app-centric naming convention (no
tickshield- prefix), documented in AGENTS.md and README
- app-dev boundary routes CI publish workflow work to publish-app;
both skills are project-level installs only
A skill call with no task input now strictly means: audit the repo, deliver
the report and fix/scaffold plan, then stop — never create/modify files or
run write operations until the user confirms. Stated in the flow header,
the review step, the human/agent authority section, and promoted to the
top red line.
Guides and constrains eco-app development in independent repos against the
TickShield platform contract: listingKey identity, app.manifest.json fields,
tickshield-node-runtime base image, guard four-gate authz, tenant_id isolation,
portal-sdk host bridge for micro frontends, release-cli publish and store
deployment. Ships copy-ready templates (manifest/Dockerfile/server.js/web
skeleton/Gitea release workflow/PRD) plus a zero-dependency static checker
(scripts/check-app.sh) covering die/warn contract items.
Add boundary routing, pre-flight step, per-step acceptance criteria,
reasoned hard constraints, red lines, troubleshooting table, and a
fixed report structure.
sunjunzhao