[8syncdev]

Summary

Owner request (2026-10-27): "enhance skills deep-research và auto research tham khảo feynman … command r&d … phải mạnh nhất". The base is Feynman v0.5.58 (MIT, commit 87a4567). It was reviewed by 3 independent adversarial lenses: fidelity, platform and org rules. Their 1 FATAL and ~15 MAJOR findings are fixed.

• deep-research v3:
  • Pipeline:
    • plan with 6 sections;
    • scale table from 0 to 6 researchers (4 at once);
    • claim sweep with decision claims (D) that need 2 sources;
    • verifier before review;
    • FATAL/MAJOR/MINOR, with one re-review;
    • -revised.md;
    • provenance with defined PASS / PASS WITH NOTES / BLOCKED;
    • degraded mode.
  • Large sources are read whole via references/large-sources.md, using cross-platform curl -fsSL --create-dirs and line windows. Chunks count toward the researcher cap.
  • Templates and the status vocabulary are in references/templates.md.
• /autoresearch is a new owner-only skill (disable-model-invocation):
  • a Start card with budget (CI minutes and USD);
  • its own worktree, with patch files instead of in-loop commits;
  • a % keep rule with combined noise and an A/B remeasure;
  • frozen benchmark and tests, plus a correctness gate;
  • plateau, time and budget stops;
  • a held-out A/B check;
  • the best patch is committed once via /ship.
• Agents:
  • research-reviewer is new: it opens sources behind (D) claims and writes the verification file.
  • verifier removes unsourced claims, turns numbers without an artifact into TODO, and writes a cite-audit file.
  • researcher gets S#/C# IDs, reworded queries, coverage status, a privacy rule for queries, and no running of downloaded code.
  • The diff reviewer is unchanged.
• License: the MIT notice now ships with the skill (skills/deep-research/LICENSE-feynman.md, KIT_FILES). THIRD_PARTY_NOTICES lists the source and commit per file.
• Strict-YAML frontmatter:
  • Fixes 8 shipped files: pm's description was being cut at #owner-desk; : in 4 descriptions; unquoted [ in 3 argument hints.
  • New guard test plus a negative test that covers the exact "Nested mappings are not allowed" case the owner hit in a workspace skill.
• The managed .gitignore block now ignores outputs/.notes/ and outputs/autoresearch/.
• Closes the hq-ui-port / hq-ui-next-cve ship loops (fix(hq-ui): pnpm dev / pnpm start work on Windows #234, fix(hq-ui): bump next to 16.4.1 (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr, GHSA-p3m5-59mp-jv5r) #235 merged, v0.110.84 released).

Evidence

• cargo test -p su-code --bin 8sync -- bundled_tests kit plugin_manifest frontmatter gitignore: 33 passed (local, nice -j2).
• Full suite + 3-OS build: CI on this PR.

Gates

/sec (gitleaks staged + branch: no leaks; test-only Rust; no dependency changes) · /rules ALLOWED (MIT notice shipped) · /aup-audit clean · 8sync ccc risk medium.

trail check reports one conflict at CHANGELOG.md:10. It is a false match: that learning is about Hugging Face model cleanup ("models code pins by commit"), while this line says autoresearch makes no commits inside its loop.

🤖 Generated with Claude Code