feat: expose risk taxonomy schema resource

Author: cuNuo

.codex/skills/keepa-agent-research/SKILL.md

@@ -55,7 +55,7 @@ With MCP, call structured tools instead of CLI strings:
 
 Use `tools/list` with `toolset=research` by default. Switch to `audit` for `keepa.audit_cost` and cassette tools, `reports` for local report/browse builders, and `tracking-readonly` only for read-only tracking state. Add `profile=offline_fixture_only` or `profile=dry_run_default` during early research; inactive tools include `x-keepa.active=false`, and `tools/call` returns `inactive_tool` before service execution when a profile disallows a tool.
 
-Use `resources/list` before loading long docs. Stable resources are `keepa://context/policy`, `keepa://schema/products-agent-view`, `keepa://schema/workflow-runtime-contract`, `keepa://fixtures/manifest`, `keepa://guides/cassette-promotion`, `keepa://evidence/recent`, and `keepa://workflow/runtime-contract`. Use `resources/templates/list` to discover `keepa://schema/{name}`, `keepa://fixtures/{name}`, `keepa://workflow/{encoded_params}/policy`, `keepa://research/{cache_key}`, `keepa://research/{cache_key}/brief`, `keepa://research/{cache_key}/graph`, `keepa://graphs/{root}`, `keepa://chunk/{encoded_path}`, and `keepa://output/{encoded_path}`. Use `keepa://workflow/runtime-contract` to discover resolver-enabled tools and follow its `schema_resource_uri` for validation, `keepa://workflow/{encoded_params}/policy` to read compact workflow execution policy from base64url JSON workflow params, `keepa://research/{cache_key}` to audit same-session cached results, `keepa://research/{cache_key}/brief` to reload an exported brief, and `keepa://graphs/{root}` to audit graph sources before writing conclusions. For tool results with `mcp_resource_manifest`, load `keepa://chunk/...` or `keepa://output/...` only when the summary is insufficient.
+Use `resources/list` before loading long docs. Stable resources are `keepa://context/policy`, `keepa://schema/products-agent-view`, `keepa://schema/risk-taxonomy`, `keepa://schema/workflow-runtime-contract`, `keepa://fixtures/manifest`, `keepa://guides/cassette-promotion`, `keepa://evidence/recent`, and `keepa://workflow/runtime-contract`. Use `resources/templates/list` to discover `keepa://schema/{name}`, `keepa://fixtures/{name}`, `keepa://workflow/{encoded_params}/policy`, `keepa://research/{cache_key}`, `keepa://research/{cache_key}/brief`, `keepa://research/{cache_key}/graph`, `keepa://graphs/{root}`, `keepa://chunk/{encoded_path}`, and `keepa://output/{encoded_path}`. Use `keepa://schema/risk-taxonomy` to validate risk codes, severity, and evidence paths, `keepa://workflow/runtime-contract` to discover resolver-enabled tools and follow its `schema_resource_uri` for validation, `keepa://workflow/{encoded_params}/policy` to read compact workflow execution policy from base64url JSON workflow params, `keepa://research/{cache_key}` to audit same-session cached results, `keepa://research/{cache_key}/brief` to reload an exported brief, and `keepa://graphs/{root}` to audit graph sources before writing conclusions. For tool results with `mcp_resource_manifest`, load `keepa://chunk/...` or `keepa://output/...` only when the summary is insufficient.
 
 ## Research Agent Start
 

.codex/skills/keepa-cli/SKILL.md

@@ -53,7 +53,7 @@ Use `keepa.products_get` for single-product research and `keepa.products_compare
 
 MCP `tools/list` defaults to `toolset=research`. Use `toolset=audit` for `keepa.audit_cost` and cassette tools, `toolset=reports` for local report/browse/brief export tools, `toolset=tracking-readonly` for read-only tracking, and `toolset=all` only when debugging schema discovery. Add `profile=offline_fixture_only`, `dry_run_default`, `live_read_allowed`, `tracking_readonly`, or `fixture_curation` when a client supports staged tool discovery. Inactive tools are marked with `x-keepa.active=false`, and `tools/call` with the same profile returns `inactive_tool` before service execution. Research tools include `keepa.categories_finder_selection`, `keepa.research_graph_merge`, and `keepa.research_brief_export`.
 
-MCP `resources/list` exposes `keepa://context/policy`, `keepa://schema/products-agent-view`, `keepa://schema/workflow-runtime-contract`, `keepa://fixtures/manifest`, `keepa://guides/cassette-promotion`, `keepa://evidence/recent`, and `keepa://workflow/runtime-contract`. `resources/templates/list` exposes `keepa://schema/{name}`, `keepa://fixtures/{name}`, `keepa://workflow/{encoded_params}/policy`, `keepa://research/{cache_key}`, `keepa://research/{cache_key}/brief`, `keepa://research/{cache_key}/graph`, `keepa://graphs/{root}`, `keepa://chunk/{encoded_path}`, and `keepa://output/{encoded_path}`. Use `keepa://workflow/runtime-contract` to discover resolver-enabled tools and follow its `schema_resource_uri` for validation, `keepa://workflow/{encoded_params}/policy` to read a compact `workflow_policy` from base64url JSON workflow params, `keepa://research/{cache_key}` to audit same-session cached results, `keepa://research/{cache_key}/brief` to reload an exported brief, and `keepa://graphs/{root}` to audit graph sources before writing conclusions. If a tool text fallback includes `mcp_resource_manifest`, load `keepa://chunk/...` or `keepa://output/...` with `resources/read` instead of asking for the whole raw body again.
+MCP `resources/list` exposes `keepa://context/policy`, `keepa://schema/products-agent-view`, `keepa://schema/risk-taxonomy`, `keepa://schema/workflow-runtime-contract`, `keepa://fixtures/manifest`, `keepa://guides/cassette-promotion`, `keepa://evidence/recent`, and `keepa://workflow/runtime-contract`. `resources/templates/list` exposes `keepa://schema/{name}`, `keepa://fixtures/{name}`, `keepa://workflow/{encoded_params}/policy`, `keepa://research/{cache_key}`, `keepa://research/{cache_key}/brief`, `keepa://research/{cache_key}/graph`, `keepa://graphs/{root}`, `keepa://chunk/{encoded_path}`, and `keepa://output/{encoded_path}`. Use `keepa://schema/risk-taxonomy` when an Agent needs to validate risk codes, severity, and evidence paths without loading the full product schema; use `keepa://workflow/runtime-contract` to discover resolver-enabled tools and follow its `schema_resource_uri` for validation, `keepa://workflow/{encoded_params}/policy` to read a compact `workflow_policy` from base64url JSON workflow params, `keepa://research/{cache_key}` to audit same-session cached results, `keepa://research/{cache_key}/brief` to reload an exported brief, and `keepa://graphs/{root}` to audit graph sources before writing conclusions. If a tool text fallback includes `mcp_resource_manifest`, load `keepa://chunk/...` or `keepa://output/...` with `resources/read` instead of asking for the whole raw body again.
 
 For general research Agents, read `keepa://context/policy`, call `keepa.resolve_research_target`, then call `keepa.query_research_context` before running live-capable product/category tools. `tools/list` accepts `allow_tools`, `exclude_tools`, and `profile` filters for small per-workflow schemas; use `profile=offline_fixture_only` when the Agent must not execute live-capable tools.
 

README.md

@@ -287,7 +287,7 @@ MCP JSON-RPC over stdio:
 
 MCP defaults to the compact `research` toolset and accepts structured JSON arguments, not CLI strings. Use `tools/list` with `toolset` set to `research`, `docs`, `audit`, `reports`, `tracking-readonly`, or `all` to control context size; `allow_tools` and `exclude_tools` can further narrow the per-workflow schema. `profile` can mark tools inactive for a session stage (`offline_fixture_only`, `dry_run_default`, `live_read_allowed`, `tracking_readonly`, `fixture_curation`); `tools/call` returns `inactive_tool` before service execution when a profile disallows a tool. Research tools include context policy, target resolution, local context query, product, category, local Finder scaffold, Finder, Deals, seller, ranking, workflow planning, docs index/read, `keepa.research_graph_merge`, and `keepa.research_brief_export`; audit tools include cost estimation plus cassette sanitize/promote and `keepa.cassettes_promote_and_verify`; reports tools expose graph merge, local report, browse snapshot, and brief export builders; tracking exposes read-only tracking plus cost audit. Agent results include `risk_taxonomy` where applicable and a cross-command `research_graph`; tool envelopes include `structuredContent`, compact JSON text fallback, `cache_key`, `cache_hit`, and `budget_ledger`.
 
-MCP resources expose stable reference material without enlarging `tools/list`: `keepa://context/policy`, `keepa://schema/products-agent-view`, `keepa://schema/workflow-runtime-contract`, `keepa://fixtures/manifest`, `keepa://guides/cassette-promotion`, `keepa://evidence/recent`, `keepa://tools/index`, `keepa://prompts/index`, `keepa://zread/wiki/current`, `keepa://zread/wiki/toc`, and `keepa://zread/wiki/pages`. `resources/templates/list` also advertises `keepa://schema/{name}`, `keepa://fixtures/{name}`, `keepa://cache-key/{command}/{encoded_params}`, `keepa://workflow/{encoded_params}/policy`, `keepa://research/{cache_key}`, `keepa://research/{cache_key}/brief`, `keepa://research/{cache_key}/graph`, `keepa://graphs/{root}`, `keepa://toolsets/{toolset}`, `keepa://tools/{name}`, `keepa://prompts/{name}`, `keepa://asin/{asin}/fixture`, `keepa://evidence/{encoded_logical_path}`, `keepa://zread/wiki/page/{slug_or_file}`, `keepa://chunk/{encoded_path}`, and `keepa://output/{encoded_path}` so Agents can discover resource URI shapes instead of hard-coding them. `keepa://workflow/{encoded_params}/policy` reads the compact `workflow_policy` and step summary from base64url JSON plan params; `keepa://workflow/runtime-contract` now points to `keepa://schema/workflow-runtime-contract` for client-side validation; `keepa://research/{cache_key}` audits a same-session cached result; `keepa://research/{cache_key}/brief` reloads an exported brief; `keepa://graphs/{root}` finds graph summaries in session cache and local fixtures. Large tool responses keep the full payload in `structuredContent`; the text fallback returns a summary plus `mcp_resource_manifest` entries so Agents can load heavy sections only when needed. MCP prompts include product research, category research, deal comparison, project onboarding, and `keepa.research_agent_start` playbooks.
+MCP resources expose stable reference material without enlarging `tools/list`: `keepa://context/policy`, `keepa://schema/products-agent-view`, `keepa://schema/risk-taxonomy`, `keepa://schema/workflow-runtime-contract`, `keepa://fixtures/manifest`, `keepa://guides/cassette-promotion`, `keepa://evidence/recent`, `keepa://tools/index`, `keepa://prompts/index`, `keepa://zread/wiki/current`, `keepa://zread/wiki/toc`, and `keepa://zread/wiki/pages`. `resources/templates/list` also advertises `keepa://schema/{name}`, `keepa://fixtures/{name}`, `keepa://cache-key/{command}/{encoded_params}`, `keepa://workflow/{encoded_params}/policy`, `keepa://research/{cache_key}`, `keepa://research/{cache_key}/brief`, `keepa://research/{cache_key}/graph`, `keepa://graphs/{root}`, `keepa://toolsets/{toolset}`, `keepa://tools/{name}`, `keepa://prompts/{name}`, `keepa://asin/{asin}/fixture`, `keepa://evidence/{encoded_logical_path}`, `keepa://zread/wiki/page/{slug_or_file}`, `keepa://chunk/{encoded_path}`, and `keepa://output/{encoded_path}` so Agents can discover resource URI shapes instead of hard-coding them. `keepa://schema/risk-taxonomy` gives external Agents the stable risk enum and evidence-bearing item contract; `keepa://workflow/{encoded_params}/policy` reads the compact `workflow_policy` and step summary from base64url JSON plan params; `keepa://workflow/runtime-contract` now points to `keepa://schema/workflow-runtime-contract` for client-side validation; `keepa://research/{cache_key}` audits a same-session cached result; `keepa://research/{cache_key}/brief` reloads an exported brief; `keepa://graphs/{root}` finds graph summaries in session cache and local fixtures. Large tool responses keep the full payload in `structuredContent`; the text fallback returns a summary plus `mcp_resource_manifest` entries so Agents can load heavy sections only when needed. MCP prompts include product research, category research, deal comparison, project onboarding, and `keepa.research_agent_start` playbooks.
 
 Contracts:
 

README.zh-CN.md

@@ -199,7 +199,7 @@ kc --json domains list
 
 MCP 默认只返回紧凑的 `research` toolset，使用结构化 JSON 参数，不解析 CLI 字符串。`tools/list` 可传 `toolset=research/docs/audit/reports/tracking-readonly/all` 控制上下文大小；`profile` 可按会话阶段标记 inactive tools（`offline_fixture_only`、`dry_run_default`、`live_read_allowed`、`tracking_readonly`、`fixture_curation`），被 profile 禁用的 `tools/call` 会在 service 执行前返回 `inactive_tool`。research 覆盖产品、类目、本地 Finder scaffold、Finder、Deals、Seller、榜单、workflow plan、docs index/read、`keepa.research_graph_merge` 与 `keepa.research_brief_export`；audit 覆盖 cost、cassette sanitize/promote 与 `keepa.cassettes_promote_and_verify`；reports 覆盖图谱合并、本地报告、浏览快照与 brief export；tracking 覆盖只读 tracking 与 cost audit。Agent 结果会尽量提供统一 `research_graph`，工具 envelope 包含 `structuredContent`、JSON text fallback、`cache_key`、`cache_hit` 与 `budget_ledger`。
 
-MCP resources 用于减少 `tools/list` 上下文：`keepa://context/policy`、`keepa://schema/products-agent-view`、`keepa://schema/workflow-runtime-contract`、`keepa://fixtures/manifest`、`keepa://guides/cassette-promotion`、`keepa://evidence/recent`、`keepa://tools/index`、`keepa://workflow/runtime-contract`、`keepa://prompts/index`、`keepa://zread/wiki/current`、`keepa://zread/wiki/toc`、`keepa://zread/wiki/pages`。`resources/templates/list` 会暴露 `keepa://schema/{name}`、`keepa://fixtures/{name}`、`keepa://cache-key/{command}/{encoded_params}`、`keepa://workflow/{encoded_params}/policy`、`keepa://research/{cache_key}`、`keepa://research/{cache_key}/brief`、`keepa://research/{cache_key}/graph`、`keepa://graphs/{root}`、`keepa://toolsets/{toolset}`、`keepa://tools/{name}`、`keepa://prompts/{name}`、`keepa://asin/{asin}/fixture`、`keepa://evidence/{encoded_logical_path}`、`keepa://zread/wiki/page/{slug_or_file}`、`keepa://chunk/{encoded_path}`、`keepa://output/{encoded_path}`，让 Agent 能发现 URI 形状而不是硬编码。`keepa://workflow/runtime-contract` 可直接读取哪些 MCP tool 支持 `resource_uri/artifact/workflow_inputs` 运行时解析，并通过 `schema_resource_uri=keepa://schema/workflow-runtime-contract` 指向可校验 schema；`keepa://workflow/{encoded_params}/policy` 可从 base64url JSON 计划参数读取紧凑的 `workflow_policy` 和步骤摘要；`keepa://research/{cache_key}` 审计同一 MCP session 内缓存结果；`keepa://research/{cache_key}/brief` 回读已导出的 brief；`keepa://graphs/{root}` 从 session cache 和本地 fixture 查研究图来源。大响应仍完整保留在 `structuredContent`，text fallback 只返回摘要和 `mcp_resource_manifest`，其中 `keepa://chunk/...` / `keepa://output/...` 可按需读取具体分块。MCP prompts 提供 product research、category research、deal compare 与 project onboarding 起手式。
+MCP resources 用于减少 `tools/list` 上下文：`keepa://context/policy`、`keepa://schema/products-agent-view`、`keepa://schema/risk-taxonomy`、`keepa://schema/workflow-runtime-contract`、`keepa://fixtures/manifest`、`keepa://guides/cassette-promotion`、`keepa://evidence/recent`、`keepa://tools/index`、`keepa://workflow/runtime-contract`、`keepa://prompts/index`、`keepa://zread/wiki/current`、`keepa://zread/wiki/toc`、`keepa://zread/wiki/pages`。`resources/templates/list` 会暴露 `keepa://schema/{name}`、`keepa://fixtures/{name}`、`keepa://cache-key/{command}/{encoded_params}`、`keepa://workflow/{encoded_params}/policy`、`keepa://research/{cache_key}`、`keepa://research/{cache_key}/brief`、`keepa://research/{cache_key}/graph`、`keepa://graphs/{root}`、`keepa://toolsets/{toolset}`、`keepa://tools/{name}`、`keepa://prompts/{name}`、`keepa://asin/{asin}/fixture`、`keepa://evidence/{encoded_logical_path}`、`keepa://zread/wiki/page/{slug_or_file}`、`keepa://chunk/{encoded_path}`、`keepa://output/{encoded_path}`，让 Agent 能发现 URI 形状而不是硬编码。`keepa://schema/risk-taxonomy` 提供稳定风险枚举和带证据路径的 risk item 契约；`keepa://workflow/runtime-contract` 可直接读取哪些 MCP tool 支持 `resource_uri/artifact/workflow_inputs` 运行时解析，并通过 `schema_resource_uri=keepa://schema/workflow-runtime-contract` 指向可校验 schema；`keepa://workflow/{encoded_params}/policy` 可从 base64url JSON 计划参数读取紧凑的 `workflow_policy` 和步骤摘要；`keepa://research/{cache_key}` 审计同一 MCP session 内缓存结果；`keepa://research/{cache_key}/brief` 回读已导出的 brief；`keepa://graphs/{root}` 从 session cache 和本地 fixture 查研究图来源。大响应仍完整保留在 `structuredContent`，text fallback 只返回摘要和 `mcp_resource_manifest`，其中 `keepa://chunk/...` / `keepa://output/...` 可按需读取具体分块。MCP prompts 提供 product research、category research、deal compare 与 project onboarding 起手式。
 
 跨命令研究图可本地合并，不访问 Keepa：