fix: make Skill portfolio scan git-tracked only for V92 CI parity

Stop listConsumerDocuments full-tree walks that pull untracked clutter into consumers. Scan git ls-files only, regenerate portfolio, and add untracked pollution regression test so clean CI matches local.

Author: rockyshi1993

changelogs/releases/v1.15.1.md

@@ -11,6 +11,7 @@
 ## 变更
 
 - `ENTRY_MODULE_LINE_BUDGETS`：V93 与 `test-control-plane-module-contracts` 单源共享（index 预算 460）
+- **V92 根治**：`listConsumerDocuments` 仅扫描 **git-tracked** 文本文件，脏树 untracked 杂项不再污染 portfolio；干净 CI 与本地一致
 - `ComponentTransparencyTopologyGate` + `classifyComponentTransparencyTopology`（V97 / brand tests）
 - PI-119：自引入 CI 主动修 + commit/push 当前消息授权（execution-contract / release-verification R6）
 - GR-044：`ValidationLifecycleTraceabilityGate`（audit-requirements / review-checklist）

scripts/generate-skill-portfolio.js

@@ -24,10 +24,12 @@ if (check) {
   const current = fs.existsSync(OUTPUT) ? fs.readFileSync(OUTPUT, 'utf8') : ''
   if (current !== desired) {
     console.error('Skill portfolio is stale. Run: node scripts/generate-skill-portfolio.js')
+    console.error('V92 parity: consumers/skills are git-tracked only (untracked files ignored).')
     process.exit(1)
   }
   console.log(`✓ Skill portfolio is deterministic and current (${portfolio.summary.skillCount} skills)`)
 } else {
   fs.writeFileSync(OUTPUT, desired)
   console.log(`✓ Wrote ${path.relative(ROOT, OUTPUT)} (${portfolio.summary.skillCount} skills)`)
+  console.log('  source=git-tracked-files-only (CI clean-checkout parity)')
 }

scripts/lib/skill-portfolio-utils.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const crypto = require('crypto')
+const { execFileSync } = require('child_process')
 const fs = require('fs')
 const path = require('path')
 
@@ -93,25 +94,92 @@ function classifyConsumer(relativePath) {
   return 'current'
 }
 
+function gitLsFiles(root, pathspecs = []) {
+  try {
+    const args = ['-C', root, 'ls-files', '-z', '--']
+    if (pathspecs.length) args.push(...pathspecs)
+    else args.push('.')
+    const out = execFileSync('git', args, {
+      encoding: 'buffer',
+      maxBuffer: 64 * 1024 * 1024,
+      windowsHide: true
+    })
+    return out.toString('utf8').split('\0').filter(Boolean).map(rel => rel.replace(/\\/g, '/'))
+  } catch {
+    return null
+  }
+}
+
+function isPortfolioConsumerExcluded(relativePath) {
+  const rel = relativePath.replace(/\\/g, '/')
+  const excludedPrefixes = [
+    'skills/',
+    'node_modules/',
+    'coverage/',
+    'dist/',
+    '.git/',
+    '.devcodex/',
+    'website/doc_build/',
+    'website/dist/'
+  ]
+  if (excludedPrefixes.some(prefix => rel === prefix.slice(0, -1) || rel.startsWith(prefix))) return true
+  const base = path.posix.basename(rel)
+  if (base === 'portfolio.json' || base === 'portfolio-evidence.json') return true
+  return !TEXT_EXTENSIONS.has(path.extname(rel).toLowerCase())
+}
+
+/**
+ * Consumer scan for Skill portfolio.
+ * MUST use git-tracked paths only when git is available so dirty/untracked worktrees
+ * match CI clean checkouts (V92). Untracked reports/tmp/backup files must never change consumers.
+ */
 function listConsumerDocuments(root) {
-  const excludedTop = new Set(['.git', '.devcodex', 'coverage', 'dist', 'node_modules', 'skills'])
+  const tracked = gitLsFiles(root)
   const files = []
-  function visit(dir, depth = 0) {
-    if (!fs.existsSync(dir)) return
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-      if (entry.isDirectory() && ((depth === 0 && excludedTop.has(entry.name)) || entry.name === 'node_modules' || entry.name === 'dist')) continue
-      const full = path.join(dir, entry.name)
-      if (entry.isDirectory()) visit(full, depth + 1)
-      else if (TEXT_EXTENSIONS.has(path.extname(entry.name).toLowerCase())) files.push(full)
+
+  if (tracked && tracked.length) {
+    for (const rel of tracked) {
+      if (isPortfolioConsumerExcluded(rel)) continue
+      const full = path.join(root, rel)
+      if (!fs.existsSync(full) || !fs.statSync(full).isFile()) continue
+      files.push(full)
     }
+  } else {
+    // Fallback for non-git unpack / pack install smoke: filesystem walk with same exclusions.
+    const excludedTop = new Set(['.git', '.devcodex', 'coverage', 'dist', 'node_modules', 'skills', 'doc_build'])
+    function visit(dir, depth = 0) {
+      if (!fs.existsSync(dir)) return
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (entry.isDirectory() && ((depth === 0 && excludedTop.has(entry.name)) || entry.name === 'node_modules' || entry.name === 'dist' || entry.name === 'doc_build')) continue
+        const full = path.join(dir, entry.name)
+        if (entry.isDirectory()) visit(full, depth + 1)
+        else if (TEXT_EXTENSIONS.has(path.extname(entry.name).toLowerCase())) files.push(full)
+      }
+    }
+    visit(root)
   }
-  visit(root)
-  return files.sort().map(file => ({
+
+  return files.sort((a, b) => a.localeCompare(b)).map(file => ({
     path: normalizePath(root, file),
     content: fs.readFileSync(file, 'utf8')
   }))
 }
 
+/** List SKILL.md paths: git-tracked only when available (ignore untracked skill drafts). */
+function listSkillMarkdownFiles(root) {
+  const tracked = gitLsFiles(root, ['skills'])
+  if (tracked && tracked.length) {
+    return tracked
+      .filter(rel => rel.replace(/\\/g, '/').endsWith('/SKILL.md') || /^skills\/[^/]+\/SKILL\.md$/.test(rel.replace(/\\/g, '/')))
+      .map(rel => path.join(root, rel))
+      .filter(full => fs.existsSync(full) && fs.statSync(full).isFile())
+      .sort((a, b) => a.localeCompare(b))
+  }
+  return walk(path.join(root, 'skills'))
+    .filter(file => path.basename(file) === 'SKILL.md')
+    .sort((a, b) => a.localeCompare(b))
+}
+
 function percentile(values, ratio) {
   if (!values.length) return 0
   const sorted = [...values].sort((a, b) => a - b)
@@ -234,9 +302,7 @@ function buildPortfolio(root) {
     throw new Error('invalid skills/portfolio-evidence.json header')
   }
   const registered = new Map((plugin.skills || []).map(item => [item.id, item]))
-  const skillFiles = walk(path.join(root, 'skills'))
-    .filter(file => path.basename(file) === 'SKILL.md')
-    .sort()
+  const skillFiles = listSkillMarkdownFiles(root)
   const knownNames = new Set(skillFiles.map(file => path.basename(path.dirname(file))))
   const consumers = listConsumerDocuments(root)
   const sourceRows = []
@@ -429,6 +495,10 @@ module.exports = {
   canonicalizeTextForDigest,
   collectDependencies,
   detectCycles,
+  gitLsFiles,
+  isPortfolioConsumerExcluded,
+  listConsumerDocuments,
+  listSkillMarkdownFiles,
   parseFrontmatter,
   serializePortfolio,
   validatePortfolio

scripts/test-skill-portfolio.js

@@ -10,6 +10,7 @@ const {
   canonicalizeTextForDigest,
   collectDependencies,
   detectCycles,
+  listConsumerDocuments,
   serializePortfolio,
   validatePortfolio
 } = require('./lib/skill-portfolio-utils')
@@ -19,6 +20,31 @@ const first = buildPortfolio(ROOT)
 const second = buildPortfolio(ROOT)
 
 assert.strictEqual(serializePortfolio(first), serializePortfolio(second), 'portfolio generation must be byte-identical')
+// V92 parity: consumers must come from git-tracked paths only when git is available.
+const consumers = listConsumerDocuments(ROOT)
+assert.ok(consumers.length > 50, 'expected a non-trivial tracked consumer set')
+assert.ok(!consumers.some(item => item.path.startsWith('skills/')), 'skills/ must not be scanned as consumers')
+assert.ok(!consumers.some(item => item.path.includes('.devcodex/')), '.devcodex must not be scanned as consumers')
+
+// Untracked pollution must not change portfolio serialization (CI clean parity).
+const fs = require('fs')
+const pollution = path.join(ROOT, `_portfolio_pollution_${process.pid}.md`)
+const beforePollution = serializePortfolio(first)
+fs.writeFileSync(pollution, [
+  '# pollution',
+  'accessibility-i18n intent memory load-profile brand-visual-quality execution-contract',
+  'This untracked file must not become a Skill consumer.'
+].join('\n'), 'utf8')
+try {
+  const polluted = buildPortfolio(ROOT)
+  assert.strictEqual(
+    serializePortfolio(polluted),
+    beforePollution,
+    'untracked files must not change Skill portfolio (V92 clean-checkout parity)'
+  )
+} finally {
+  fs.unlinkSync(pollution)
+}
 assert.strictEqual(canonicalizeTextForDigest('a\r\nb\rc\n'), 'a\nb\nc\n', 'portfolio digests must canonicalize CRLF/CR/LF')
 assert.strictEqual(first.summary.skillCount, 78)
 assert.strictEqual(first.schemaVersion, 2)