TraceworkBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

写周报
# 或
/tracework:weekly

codex plugin marketplace add KKenny0/Tracework
codex plugin add tracework@tracework

claude plugin marketplace add KKenny0/Tracework
claude plugin install tracework@tracework

Agent 工作
-> 收工,留下关键事实
-> 写日报 / 写周报 / 写月报

profile:
project_name: My Project
reporting_group: work   # 也可以是 personal、open-source、consulting

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: capture
description: >
  Adaptive-depth session recap and low-friction checkpoint capture for
  report-ready Tracework memory. Use this skill for "/tracework:capture" or when
  the user signals end of a work session, such as "收工", "今天到这", "done",
  "wrap up", "that's it for today", "好了", or "先这样". Also trigger on
  explicit checkpoint or logging requests like "记录变更", "log changes",
  "记一下今天做了什么", "记一下当前进展", or "checkpoint". The skill dynamically
  routes the session to lite, standard, or deep capture depth; explicit
  "/tracework:capture lite|standard|deep" wording overrides that route. Use day
  mode for "/tracework:capture day", "扫描今天的会话", "补录今天", or "capture
  today". Also use for explicit correction of a stored fact ("原记录记错了",
  "更正这条记录"). Do NOT trigger when the user is simply saying goodbye or switching
  topics.
---

# Adaptive-Depth Session Recap

Capture session-end or checkpoint signals into Tracework raw entries. The goal
is not a chronological diary. Preserve the lightest durable work signal that
can improve Daily, Weekly, and Monthly and support evidence drill-down when needed.

Tracework is reporting-first: Daily, Weekly, and Monthly can still produce
direct value without a fresh capture. Capture improves their evidence boundary
and preserves the facts behind their conclusions.

## Progressive References

Keep this file focused on routing and workflow. Read these references only when
needed:

- `references/capture-routing.md`: choose `capture_depth` and handle explicit
  lite/standard/deep overrides. Read before finalizing entries.
- `references/capture-entry-writing.md`: build a standalone explanation before
  filling raw fields; check source fidelity, then add evidence, artifact context,
  reporting metadata, and Markdown fallback. Read for every entry.
- `references/capture-operations.md`: resolve config, call `tracework_raw.py`,
  write artifact dossiers, and format quiet receipts.
- `references/capture-corrections.md`: explicit correction of a stored fact only.
- `references/capture-day.md`: scan indexed Codex and Claude sessions for one
  date without mixing reporting groups. Read for day mode only.
- `references/tracework-storage-convention.md`: shared schema and storage rules.

## Zero-Config Mode

This skill works with or without a configured knowledge vault:

- With a vault: write entries to
  `{vault}/raw/weeks/{ISO-week}/{project-slug}.json`; write artifact dossiers
  to `{vault}/raw/artifacts/{project-slug}.json` only when the routed capture
  depth and session signal justify it. Keep output quiet by default.
- Without a vault: return structured Markdown in the conversation. Do not write
  files or create directories. Add a one-line setup hint.

Zero-config mode is best-effort. Fill fields that are supported by the
conversation and local evidence, but do not interrogate the user just to enrich
optional fields.

## Workflow

1. **Detect mode and depth.**
   - For a mistaken stored fact, follow `references/capture-corrections.md`.
     Wording edits change reports only; later real changes use lifecycle_transition.
   - Default mode is session-end capture.
   - Use checkpoint mode for "checkpoint", "记一下当前进展", or
     `/tracework:capture checkpoint`.
   - Use day mode for `/tracework:capture day [YYYY-MM-DD] [scope]` or its
     natural-language triggers. Read `references/capture-day.md` and follow it
     instead of extracting only the current conversation.
   - Read `references/capture-routing.md`, then choose one session-level
     `capture_depth`: `lite`, `standard`, or `deep`.
   - Respect explicit depth overrides such as `/tracework:capture deep` or
     "简单记一下". If no override exists, route from the session evidence.

2. **Extract signals.**
   - Read `references/capture-entry-writing.md`.
   - Classify the primary archetype: `decision`, `repair`, `investigation`,
     `build`, or `maintenance`.
   - Build the supported explanation before filling fields, following the
     entry-writing reference: goal, key cause or constraint, chosen action and
     reason, result, and remaining gate. Preserve material changes of direction.
   - Group related work into 1-3 entries. Use at most 5 entries for unusually
     broad sessions.
   - For normal session-end or checkpoint capture, resolve one immutable
     committed-tree snapshot for code-backed entries as described in
     `references/capture-entry-writing.md`. Never backfill Capture Day with the
     repository's current `HEAD`.

3. **Generate raw entries.**
   - Include `capture_depth` on every new `session-recap` entry.
   - Add the minimal `reporting` object only when the report boundary is clear.
     Keep `work_stream` at the top level and do not pre-write channel-specific
     Daily/Weekly/Monthly carry-forward prose.
   - Add `artifact_context` and artifact dossier side effects only when the
     session materially changed durable artifacts or routed to `deep`.
   - For a durable design or architecture artifact, preserve a compact
     recoverable digest in existing entry and dossier fields: why it exists,
     its goal, final choice and shortest rationale, core objects and
     relationships, material path or fallback, current-versus-target boundary,
     and remaining gate. Do not copy the full document.
   - When a local design source moved to a cloud document, keep the last local
     path for provenance and add a typed `doc` source ref with the stable URL
     and document or revision id when known.
   - Do not assign report-local `O#`, `W#`, `D#`, or `E#` labels.

4. **Write or fallback.**
   - Apply the standalone-reading and source-fidelity checks in
     `references/capture-entry-writing.md` before persistence.
   - Read `references/capture-operations.md`.
   - Use `tracework_raw.py append-entry` as the canonical write path.
   - Upsert artifact dossiers when warranted and enabled.
   - Register the project as a best-effort side effect.
   - If config or helper calls fail, return the Mark

BLOCKgrade D · trust 61/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

declared (4 observation(s))

Dependencies

not all pinned

Secrets in source

none-found

Findings (11)

return yaml.load(match[1]);

return yaml.load(fs.readFileSync(metadataPath, 'utf-8'));

return yaml.load(raw) as TraceworkConfig;

const projectCfg = yaml.load(raw) as TraceworkConfig;

group = bytes.fromhex(key[1]).decode('utf-8')

group = bytes.fromhex(group_hex).decode('utf-8')

group = bytes.fromhex(key[1]).decode('utf-8')

group = bytes.fromhex(group_hex).decode('utf-8')

chalk, commander, js-yaml, @types/js-yaml, @types/node, typescript

vitepress, vue, vitepress-plugin-llms

Gates applied: no_behavioural_pass, no_license.