audit: integrate 2026-07-25 remediation plan

.codex/skills/create-codex-theme/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: create-codex-theme
-description: 为 Awesome Codex Theme 创建、补全或校验原创主题或明确披露的非官方 Fan Art。适用于把一句视觉想法变成双语 theme brief、用 OpenAI image job 生成安全留白的源图、写入 themes/catalog.json 与 source-art/jobs.json、导出明暗模式并运行 ACT Registry 校验。Use when a user asks to create, adapt, package, validate, or contribute a Codex theme in this repository.
+description: 为 Awesome Codex Theme 创建、补全或校验原创主题或明确披露的非官方 Fan Art。适用于把一句视觉想法变成双语 theme brief、用 OpenAI image job 生成带焦点构图与安全区的 16:9 源图、写入 themes/catalog.json 与 source-art/jobs.json、导出明暗模式并运行 ACT Registry 校验。Use when a user asks to create, adapt, package, validate, or contribute a Codex theme in this repository.
 ---
 
 # 创建 Codex 主题
@@ -31,7 +31,7 @@ description: 为 Awesome Codex Theme 创建、补全或校验原创主题或明
 - 中文主名称与英文辅助名称
 - 一句话场景 brief
 - `original` 或 `fan-art` 权利轨道与相应声明
-- 左侧或右侧安全留白
+- 左侧、右侧、中部或无安全区，以及与主体对应的焦点位置
 - 明暗模式 token
 
 中文文案先写，英文随后补齐。描述具体画面，不使用“震撼”“极致”“重新定义”等宣传套话。
@@ -57,6 +57,8 @@ node .codex/skills/create-codex-theme/scripts/scaffold-theme.mjs \
 
 ### 4. 生成并审查源图
 
+新主题的 source art 必须为 2560×1440 或更高的 16:9 图像。`themes/source-art/jobs.json` 中现有 1536×1024 的具名历史例外只覆盖已列出的 ID，不能复制给新主题。
+
 使用仓库的 image job 流程：
 
 ```bash
@@ -69,10 +71,17 @@ npm run art:generate -- --ids=<theme-id>
 - 画面没有文字、签名、水印、Logo 或 UI
 - 原创轨道的人物和物件不像现成 IP；Fan Art 只出现 brief 已声明的角色
 - Fan Art 没有复制官方截图、海报、镜头、Logo 或宣传素材
-- 16:9 中心裁切不会截断主体
+- 焦点裁切在 16:9 输出中不会截断主体
 - 图片达到主题 Gallery 的完成度
 
-任何一项不合格，就改 job prompt 后重跑 `--force`。具体命令和检查顺序见 [references/image-job-playbook.md](references/image-job-playbook.md)。
+任何一项不合格，就改 job prompt 后重跑 `--force`。通过源图检查后运行：
+
+```bash
+npm run art:review:write
+npm run art:review
+```
+
+打开联系表和安全区夹具，确认焦点输出与 `left`、`right`、`center`、`none` 四种阅读区都符合 brief。具体命令和检查顺序见 [references/image-job-playbook.md](references/image-job-playbook.md)。
 
 ### 5. 生成主题包
 

.codex/skills/create-codex-theme/references/image-job-playbook.md

@@ -12,6 +12,8 @@
 
 ## 生成一张
 
+新主题的 job 输出必须为 2560×1440 或更高的 16:9 图像。`themes/source-art/jobs.json` 中的 1536×1024 历史例外只适用于列出的现有主题，不能复制给新 ID。
+
 ```bash
 npm run art:generate -- --ids=qinglan-odyssey
 ```
@@ -38,15 +40,17 @@ npm run art:generate -- --ids=theme-a,theme-b --concurrency=2
 - 城市或幻想世界靠什么气质被识别
 - 哪些具体元素不要出现
 
+同时写明主体对应的 `focusX`、`focusY` 与阅读安全区。新源图已是 16:9，不能依赖后续中心裁切来修正构图。
+
 不要重复 common prompt，也不要写具体画师或工作室。原创 job 不写作品名；Fan Art job 只写 brief 已声明的作品、角色、道具和新构图。
 
 ## 失败处理
 
-- 构图挤占安全区：明确把主体推到右侧三分之一，并让左侧保持雾、天空或水面。
+- 构图挤占安全区：根据 `left`、`right`、`center` 或 `none` 选择阅读区。把主体放到对应的非阅读区，并让阅读区保持雾、天空或水面。
 - 出现文字或 Logo：在场景 brief 中点名移除，再用 `--force` 重做。
 - 原创角色像现成 IP：更改轮廓、服装结构、配色和道具，不能只换颜色。
 - Fan Art 出现未声明角色或复制镜头：移除多余角色，改换机位、动作、景别和环境叙事后重做。
 - 画面像概念草图：要求完成的动画背景、可信材质和环境细节。
-- 3:2 好看但 16:9 被截：把重要内容收进垂直中间 82%。
+- 16:9 焦点裁切仍会截断主体：调整 `focusX`、`focusY` 或重做画面，把重要内容收进垂直中间 82%。
 
-源图通过后运行 `npm run check`。生成器会完成裁切、明暗分级、哈希、包和预览。
+源图通过后运行 `npm run art:review:write`，人工检查联系表和安全区夹具，再运行 `npm run art:review` 与 `npm run check`。生成器会完成焦点裁切、明暗分级、哈希、包和预览。

.codex/skills/create-codex-theme/references/theme-authoring.md

@@ -10,7 +10,7 @@
 - `cinematic`、`chibi`、`cityscape` 或 `scene` variant
 - 左右焦点、安全区和任务模式
 - 符合对比度门槛的明暗 token
-- 一张 1536×1024 已审查源图及 provenance
+- 一张 2560×1440 或更高的 16:9 已审查源图及 provenance
 
 `cinematic-chibi` collection 要求同一 `pair` 同时有原画版和 Q 版。新增此类主题时准备两份 brief，并在运行完整校验前把两个 variant 都加入 catalog。`standalone` collection 可以一次加入一套。
 
@@ -32,11 +32,12 @@
 
 ## 工作区构图
 
-源图不是实机截图，但会生成 Full Skin 使用的 2560×1440 背景。Codex Native 回退仍然只改变配色。安全区要同时照顾左侧导航、主标题、建议卡片和底部 composer，不能只为了 Gallery 卡片好看。
+源图不是实机截图，但会生成 Full Skin 使用的 2560×1440 背景。新主题必须使用 16:9、2560×1440 或更高的源图。当前 1536×1024 源图只能通过 `themes/source-art/jobs.json` 的具名历史例外保留给现有 ID，不能复制到新 job。Codex Native 回退仍然只改变配色。安全区要同时照顾左侧导航、主标题、建议卡片和底部 composer，不能只为了 Gallery 卡片好看。
 
-- `safeArea: left` 时，左侧约 46% 保持低对比、低细节。
-- 主体放在右侧三分之一，不能贴边。
-- 重要内容放在垂直中间 82%，以适应 3:2 到 16:9 的裁切。
+- `focusX` 和 `focusY` 是归一化焦点。生成器在源图可移动时以该点为中心生成 16:9 焦点裁切，并在边缘夹紧。
+- `safeArea: left` 时，左侧约 46% 保持低对比、低细节；`right` 反转该阅读区；`center` 保留中部阅读区；`none` 不追加阅读区叠色。
+- 主体放在与安全区相反的区域，不能贴边。`center` 安全区需要把主体分布到两侧，或使用 `none`。
+- 重要内容留在垂直中间 82%，即使源图已经是 16:9，也要为不同预览尺寸留余量。
 - 避免满屏人脸、强烈放射光、碎片和密集文字形状。
 - Q 版角色要有完整剪影和可信材质，不能像随机贴纸。
 
@@ -60,12 +61,12 @@
 
 校验器要求：
 
-- text/surface ≥ 4.5
-- muted/surface ≥ 4.5
-- accent/background ≥ 3.0
+- text/surface 和 text/surfaceAlt 都 ≥ 4.5
+- muted/surface 和 muted/surfaceAlt 都 ≥ 4.5
+- accent/background、accent/surface 和 accent/surfaceAlt 都 ≥ 3.0
 - accentContrast/accent ≥ 4.5
 
-不要只看色卡。把预览放进 Gallery 和安装弹窗后再判断。
+`border` 只作装饰，不能作为键盘焦点或可点击状态的唯一边界。不要只看色卡。把预览放进 Gallery 和安装弹窗后再判断。
 
 ## 来源与授权
 

.codex/skills/create-codex-theme/scripts/scaffold-theme.mjs

@@ -91,7 +91,10 @@ function validateBrief(brief, catalog) {
     requireValue(brief.fanArt?.commercialUse === false, "fan art must prohibit commercial use");
     requireValue(brief.fanArt?.officialAssetsUsed === false, "fan art must disclose that no official assets were used");
   }
-  requireValue(brief.art?.safeArea === "left", "v1 Gallery themes must use a left safe area");
+  requireValue(Number.isFinite(brief.art?.focusX) && brief.art.focusX >= 0 && brief.art.focusX <= 1, "art.focusX must be a number from 0 to 1");
+  requireValue(Number.isFinite(brief.art?.focusY) && brief.art.focusY >= 0 && brief.art.focusY <= 1, "art.focusY must be a number from 0 to 1");
+  requireValue(["left", "right", "center", "none"].includes(brief.art?.safeArea), "unsupported art.safeArea");
+  requireValue(["ambient", "banner", "off"].includes(brief.art?.taskMode), "unsupported art.taskMode");
   validateTokens("light", brief.light?.tokens);
   validateTokens("dark", brief.dark?.tokens);
 }

.github/ISSUE_TEMPLATE/accessibility-report.yml

@@ -0,0 +1,44 @@
+name: Accessibility report / 无障碍报告
+description: Report a keyboard, focus, contrast, screen-reader, zoom, motion, or forced-colors barrier.
+title: "[Accessibility] "
+labels: ["accessibility"]
+body:
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Surface / 受影响部分
+      options:
+        - Gallery website
+        - Theme Manager
+        - Theme Manager installer or update UI
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment / 环境
+      description: OS, browser/WebView, assistive technology when relevant, zoom or display scaling, and color/motion settings.
+    validations:
+      required: true
+
+  - type: textarea
+    id: barrier
+    attributes:
+      label: Barrier and expected outcome / 障碍与预期结果
+      description: Include the control or content, current behavior, expected behavior, and why it blocks the task.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps / 复现步骤
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Privacy-safe evidence / 脱敏证据
+      description: Screenshots, a short recording, or screen-reader output are welcome after private content is removed.

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,63 @@
+name: Bug report / 缺陷报告
+description: Report a reproducible Gallery, generator, Theme Manager, or Native fallback defect.
+title: "[Bug] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not include credentials, private chats, account names, local home paths, or unredacted screenshots. For a security vulnerability, follow SECURITY.md instead of opening a public issue.
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Surface / 受影响部分
+      options:
+        - Gallery
+        - Theme generator or validator
+        - Theme Manager
+        - Full Skin runtime
+        - Native fallback
+        - Installer or release artifact
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment / 环境
+      description: Include OS, architecture, browser or Theme Manager version, and the exact Codex version only when relevant.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps / 复现步骤
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected_actual
+    attributes:
+      label: Expected and actual result / 预期与实际结果
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Privacy-safe evidence / 脱敏证据
+      description: Add a redacted error, screenshot, or a minimal trace. Do not attach private application data.
+
+  - type: checkboxes
+    id: confirmation
+    attributes:
+      label: Confirmation / 确认
+      options:
+        - label: I removed private data, secrets, and personal paths from this report. / 我已移除私有数据、密钥和个人路径。
+          required: true

.github/ISSUE_TEMPLATE/compatibility-report.yml

@@ -0,0 +1,55 @@
+name: Compatibility report / 兼容性报告
+description: Report a platform, package-version, or supported-runtime compatibility result.
+title: "[Compatibility] "
+labels: ["compatibility"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Compatibility is version-bound. Please do not run a Full Skin probe against a personal or production session just to fill this form. Remove private paths, user names, chats, and account data.
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform / 平台
+      options:
+        - Windows x64
+        - macOS Apple silicon
+        - macOS Intel
+        - Other or unsupported platform
+    validations:
+      required: true
+
+  - type: dropdown
+    id: path
+    attributes:
+      label: Feature path / 功能路径
+      options:
+        - Full Skin apply and restore
+        - Native fallback import
+        - Persistent replay
+        - Theme Manager build or launch
+        - App update channel
+    validations:
+      required: true
+
+  - type: textarea
+    id: identity
+    attributes:
+      label: Version and target identity / 版本与目标身份
+      description: State exact app and Theme Manager versions. Redact personal installation paths; package family/channel is enough.
+    validations:
+      required: true
+
+  - type: textarea
+    id: result
+    attributes:
+      label: Result and verification boundary / 结果与验证边界
+      description: Describe what worked or failed, what direct evidence you observed, and any step you intentionally did not run.
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Privacy-safe evidence / 脱敏证据

.github/ISSUE_TEMPLATE/performance-report.yml

@@ -0,0 +1,51 @@
+name: Performance report / 性能报告
+description: Report measurable slowness, memory pressure, rendering jank, or generator regressions.
+title: "[Performance] "
+labels: ["performance"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use privacy-safe measurements. Do not upload full process dumps, private pages, account data, or credentials.
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Surface / 受影响部分
+      options:
+        - Gallery load, search, or filter
+        - Theme generator
+        - Theme Manager interface
+        - Full Skin apply or restore
+        - Persistent replay
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment and build / 环境与构建
+      description: OS, architecture, app/browser version, catalog revision, and hardware class. Omit serial numbers and private paths.
+    validations:
+      required: true
+
+  - type: textarea
+    id: measurement
+    attributes:
+      label: Measurement / 测量结果
+      description: State baseline, observed time or memory, sample count, and how you measured it.
+      placeholder: "Baseline: ...\nObserved: ...\nSamples: ...\nMethod: ..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction path / 复现路径
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Privacy-safe trace or screenshot / 脱敏追踪或截图

.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: npm
+    directory: /apps/theme-manager
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: cargo
+    directory: /apps/theme-manager/src-tauri
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7