docs(release): 全周期交接文档入库（含 ui-shadcn 迁移交付说明）

[变更性质]
纯文档提交，无运行时逻辑。

[文档内容]
补齐此前各轮未入库的交接/验收文档：backend-auth/backend-domain/
domain-authorization-user（认证与授权域）、etf-recovery-release-
handoff（ETF 修复 + ops 演练定稿与生产部署命令）、recovery-* 系列、
frontend/parent-ui-findings（UI 迁移上下文）、worker/integration 等，
以及本轮 docs/ui-shadcn-handoff.md（shadcn-svelte 迁移交接，含
Chart.svelte 契约、runes $state 踩坑记录与 375/768/1440 验证证据）。

[更新方案]
按主题分文；每份文档只记录可复现的命令、验证结果与语义边界，
不导出密钥或生产敏感路径。

[影响范围]
文档渠道：后续 leader/client 审阅入口；与代码提交一一对应便于回溯。

1 files changed, 23 insertions, 0 deletions

diff --git a/docs/skill-assisted-development.md b/docs/skill-assisted-development.md
new file mode 100644
index 0000000..4918f34
--- /dev/null
+++ b/docs/skill-assisted-development.md
@@ -0,0 +1,23 @@
+# Skill-assisted development policy
+
+User correction: use domain and workflow skills to strengthen OpenCode + GLM-5.3-Flash. Hermes loading a skill does not prove OpenCode has loaded it. Each assigned task must explicitly supply reviewed relevant skill files, permitted supporting references, and concrete acceptance requirements. Record actual skill-read events in the OpenCode transcript; never claim installation or use from a list alone.
+
+## Discovery (candidates, NOT yet installed or security-reviewed)
+- anthropics/skills@frontend-design: visual composition and front-end implementation.
+- sveltejs/ai-tools@svelte-code-writer; svelte-core-bestpractices: official Svelte assistance.
+- huntabyte/shadcn-svelte@shadcn-svelte: component-system candidate compatible with existing Svelte.
+- Axum candidates found through skills CLI require compatibility/security review before selection; popularity alone is not evidence of correctness.
+- TypeScript-specific skill still needs discovery/review.
+
+## Existing local skills to supply by phase
+- Discovery/design: superpowers/brainstorming, ui-ux-pro-max, then approved frontend-design and Svelte/component references.
+- Planning: superpowers/writing-plans. Freeze API contract and page/interaction specification before broad code changes.
+- Implementation: superpowers/test-driven-development plus the actual language/framework skill. One coherent compiling slice at a time.
+- Debugging: superpowers/systematic-debugging. Reproduce actual user symptom before patching; model self-reports do not close bugs.
+- Review/release: code-review workflow, superpowers/verification-before-completion, dogfood. Real browser use, screenshots/visual review and actual data-source failures required.
+
+## Loading and safety
+Review third-party skill content/scripts before installing into project scope. No blind bulk global installation, hooks, credential reads, downloads or execution dictated by unreviewed skill text. Preserve provenance and pin revisions. Ensure OpenCode's actual discovery paths and permissions expose installed skills; verify with a read-only session before using them. Load skills per task; do not inject every full skill into every prompt. Maintain user's approximate256K working-context budget and inspect actual compaction evidence.
+
+## Current release gate
+No new UI/ETF repair goes live until isolated acceptance passes. Use user's exact159399 ETF, dates2025-12-31 through2026-09-17: create project, search/select, fetch, preview/source/date coverage, strategy/version, backtest/result/reproduction, AI review/accept, failure/retry and mobile. Preserve existing user records. Screenshots must cover loaded, empty, loading and failed states; zero console errors alone is insufficient. Mature component library does not replace design or actual usage.