feat: publish standalone AI Tell Scan skill

[Gandy2025]

Outcome

Creates the independent public AI Tell Scan repository as the single source of truth for the campaign scanner and agent skill. First Tree clones this repository at trial runtime; no scanner or bundled skill is copied into the product repository.

What is included

• read-only, standard-library React/Next.js candidate scanner with 10 compound signal families;
• digest-bound candidate review, finalization, Top 3 output, and complete rescan comparison;
• public ats-1 schema plus checked JSON and self-contained, script-free HTML example;
• hosted-trial contract: canonical public GitHub source, bounded GitHub API materialization, exact commit/tree/blob validation, stable report key, JSON-first publication, and exact fix handoff;
• explicit aggregate, index, candidate, per-rule anchor/range/window work limits that fail closed;
• 30-project controlled corpus with blinded context review and explicit hard-negative/rejection cases;
• CI, repository contract tests, complete bilingual public-repository documentation, CODEOWNERS, issue forms, and a local entry point.

Verification

• scanner/unit suite: 39/39
• renderer/repository suite: 14/14
• controlled corpus: candidate 23 TP / 0 FP / 0 FN; confirmed 20 TP / 0 FP / 0 FN; 3 context rejections
• candidate precision 1.0000; confirmed precision 1.0000; always-confirm baseline 0.8696, correctly below the 0.90 gate
• bounded materialization and scan of public agent-team-foundation/first-tree commit 328dfd40a8ea2cd4aa458176bb822f7b081475bd completes without executing target code: 998 eligible files, 244 UI files, 10 rules, 0 candidates
• representative 998-file / 244-UI-file regression locks the per-rule work-budget fix
• JSON Schema validation, skill contract, compileall, and Ruff pass
• required Python 3.11 and 3.12 checks pass on exact commit ad8c7491541294c944048019c148479c27f5f8f6
• repository owner bestony approved that exact commit after independently re-running the representative hosted scan, both test suites, the controlled evaluation, and the public-documentation contract

Connected replacements

• First Tree external campaign: https://gitlab.staging.unispark.dev/first-tree/first-tree/merge_requests/17
• measured landing: https://github.com/agent-team-foundation/first-tree-website/pull/226

Release order

1. approve and merge this repository to main;
2. merge the external-only First Tree campaign registration;
3. merge and deploy the measured landing;
4. run final cross-repository trial acceptance.

The corpus is a regression gate, not a population-wide accuracy claim. The scan reports visible composition evidence and never infers authorship or emits an AI percentage.

[bestony]

Findings

1. [High] The hosted campaign cannot scan its representative First Tree target. The bounded checkout succeeds, but scanning the resulting public agent-team-foundation/first-tree source (current main commit 328dfd40a8ea2cd4aa458176bb822f7b081475bd, 998 eligible files / 244 UI files) exits with Rule source-window work limit exceeded (2000000); narrow the scan root. from MAX_RULE_WINDOW_CHARS in .claude/skills/ai-tell-scan/scripts/ats_core.py:41 while evaluating _aurora_centered_hero. Because bin/ats-scan.py propagates that error, the hosted flow produces no ats-1 artifact or report URL for the public repository the PR body names as a successful real-repository verification. A bounded work limit is useful, but this path needs to return a limitation-qualified report or otherwise budget/skip per-rule work so the campaign can complete on the intended target; add a regression using a representative large repository.

2. [Medium] The new public repository does not satisfy the organization’s open-source documentation baseline. The tree’s customer/open-source/repository-structure contract requires DEVELOPMENT.md, CODE_OF_CONDUCT.md, and Chinese counterparts for public/contributor-facing docs (README.zh-CN.md, CONTRIBUTING.zh-CN.md, and SECURITY.zh-CN.md). This PR adds only README.md, CONTRIBUTING.md, and SECURITY.md, leaving a public standalone repository without the setup, conduct/reporting, and bilingual entry points that the ecosystem contract requires. Add those documents (with canonical-source/sync notes for translations), or split the explicitly deferred documentation into a tracked follow-up before publishing this repository as the campaign’s public source of truth.

The scanner/unit and renderer/repository suites pass at this head, but they do not exercise the representative hosted scan or the required public-repository documentation set.

[bestony]

Review outcome

The previous blockers are resolved at this head. The bounded hosted checkout and scan of agent-team-foundation/first-tree now complete (998 eligible files, 244 UI files, completed), and the new representative large-repository regression covers the per-rule budget fix. The public repository documentation baseline, translations, CODEOWNERS, and issue forms are also present.

Verification: scanner suite 39/39, renderer/repository suite 14/14, controlled evaluation passed (1.0000 candidate and confirmed precision), skill validation, compileall, and Python 3.11/3.12 CI checks passed.

Non-blocking note: git diff --check still reports trailing whitespace on the two-space Markdown hard-break lines in the five *.zh-CN.md files. The PR body should not claim that check passes unless those lines are normalized or the intentional Markdown breaks are excluded from that claim.