byoungd · Oct 19, 2026 · Oct 19, 2026 · Oct 19, 2026
diff --git a/.github/ISSUE_TEMPLATE/content.yml b/.github/ISSUE_TEMPLATE/content.yml
@@ -1,7 +1,7 @@
 name: Content error
 description: Report an inaccurate, unsupported, or outdated statement.
 title: "[Content]: "
-labels: [content]
+labels: [bug]
 body:
   - type: input
     id: page

diff --git a/.github/ISSUE_TEMPLATE/method.yml b/.github/ISSUE_TEMPLATE/method.yml
@@ -1,7 +1,7 @@
 name: Learning-method proposal
 description: Propose an evidence-aware change to a learning workflow.
 title: "[Method]: "
-labels: [learning-method]
+labels: [enhancement]
 body:
   - type: textarea
     id: problem

diff --git a/.github/ISSUE_TEMPLATE/reader-field-note.yml b/.github/ISSUE_TEMPLATE/reader-field-note.yml
@@ -1,7 +1,7 @@
 name: Reader field note / 读者现场回执
 description: Share a privacy-safe reading attempt, action, delayed result, or point of confusion.
 title: "[Reader]: "
-labels: [content]
+labels: [enhancement]
 body:
   - type: input
     id: chapter

diff --git a/.github/ISSUE_TEMPLATE/site.yml b/.github/ISSUE_TEMPLATE/site.yml
@@ -1,7 +1,7 @@
 name: Site or accessibility problem
 description: Report build, route, search, responsive, keyboard, or accessibility issues.
 title: "[Site]: "
-labels: [site]
+labels: [bug]
 body:
   - type: input
     id: url

diff --git a/.github/ISSUE_TEMPLATE/translation.yml b/.github/ISSUE_TEMPLATE/translation.yml
@@ -1,7 +1,7 @@
 name: Translation issue
 description: Report missing meaning, divergence, or unnatural language between editions.
 title: "[Translation]: "
-labels: [translation]
+labels: [bug]
 body:
   - type: input
     id: pages

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -20,11 +20,16 @@ jobs:
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
       - run: npm ci
       - run: python -m pip install -r requirements-pdf.txt
       - run: python tests/pdf_layout_test.py
       - run: npm audit --audit-level=high
       - run: npm run check
+      - run: npm run book:validate
       - run: npm run docs:build
       - uses: actions/upload-artifact@v7
         with:

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -26,10 +26,15 @@ jobs:
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
       - uses: actions/configure-pages@v6
       - run: npm ci
       - run: python -m pip install -r requirements-pdf.txt
       - run: npm run check
+      - run: npm run book:validate
       - run: npm run docs:build
       - uses: actions/upload-pages-artifact@v5
         with:
@@ -40,7 +45,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
-    needs: build
+    needs: [build, smoke]
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
@@ -70,6 +75,7 @@ jobs:
               exit 1
             fi
           done
+
           downloads=(
             $'/downloads/life-level-up-guide-zh.epub|application/epub+zip|0-3|504b0304'
             $'/downloads/life-level-up-guide-en.epub|application/epub+zip|0-3|504b0304'
@@ -90,3 +96,30 @@ jobs:
               exit 1
             fi
           done
+
+  smoke:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npx playwright install --with-deps chromium
+      - run: npm run docs:build
+      - name: Start a fresh preview
+        run: |
+          npm run docs:preview -- --host 127.0.0.1 --port 4173 > /tmp/life-level-up-preview.log 2>&1 &
+          for attempt in {1..60}; do
+            if curl --fail --silent http://127.0.0.1:4173/up/ > /dev/null; then
+              break
+            fi
+            sleep 2
+          done
+          curl --fail --silent http://127.0.0.1:4173/up/ > /dev/null
+      - name: Run browser smoke tests
+        env:
+          PLAYWRIGHT_BASE_URL: http://127.0.0.1:4173/up/
+        run: npm run test:smoke
diff --git a/ATTRIBUTIONS.md b/ATTRIBUTIONS.md
@@ -1,6 +1,6 @@
 # Third-party Material and Citations
 
-Last reviewed: 2026-10-09 (homepage and author-provided QR addition; older access dates below are retained).
+Last reviewed: 2026-10-16 (AI source, MCP version, and publication metadata refresh; older access dates below remain where those pages were not rechecked).
 
 This register distinguishes repository-owned material from third-party sources. A link is not a transfer of rights. Contributors must add or update an entry when adding external media, a substantial quotation, a dataset, or a product capability claim.
 
@@ -24,8 +24,8 @@ This register distinguishes repository-owned material from third-party sources.
 | YouTube and product names/logos | Resource lists | Respective publishers and trademark owners | Links and nominative references only; no endorsement implied | 2026-08-16 |
 | `token.love` official homepage | `docs/projects.md`, `docs/en/projects.md` | China Token Cloud / site operator | Homepage capability description paraphrased with date and contract boundary; not an independent audit | 2026-08-31 |
 | `ku0.com` official homepage | `docs/projects.md`, `docs/en/projects.md` | ku0.com operator | Directory positioning paraphrased with date; availability, transactions, and compliance remain subject to current terms | 2026-08-31 |
-| `biezou.com` AI gateway homepage | Both home pages | [biezou.com](https://biezou.com/) / site operator | Clearly bounded third-party recommendation; homepage description rechecked on 2026-09-02, with no independent audit or endorsement of availability, pricing, privacy, security, compliance, or returns | 2026-09-02 |
-| `OpenHuge_ai` Telegram channel | Both home pages | [t.me/OpenHuge_ai](https://t.me/OpenHuge_ai) / user-supplied channel URL | Bounded third-party resource-channel recommendation supplied for the homepage; channel content, external links, availability, privacy, copyright, security, and operator claims are not independently endorsed | 2026-09-02 |
+| `biezou.com` AI gateway homepage | `docs/resources.md` and `docs/en/resources.md` | [biezou.com](https://biezou.com/) / site operator | Optional third-party resource entry; homepage description rechecked on 2026-09-02, with no independent audit or endorsement of availability, pricing, privacy, security, compliance, or returns | 2026-09-02 |
+| `OpenHuge_ai` Telegram channel | `docs/resources.md` and `docs/en/resources.md` | [t.me/OpenHuge_ai](https://t.me/OpenHuge_ai) / user-supplied channel URL | Optional resource-channel entry supplied by a user; channel content, external links, availability, privacy, copyright, security, and operator claims are not independently reviewed or endorsed | 2026-09-02 |
 | Human-centred generative AI in education guidance | Bilingual Family Learning chapters | [UNESCO, Guidance for generative AI in education and research](https://www.unesco.org/en/articles/guidance-generative-ai-education-and-research) | Official guidance used only for the human-centred and human-capacity framing; local school policy, platform terms, age/account rules, and professional judgment remain separately required | 2026-09-02 |
 | Current guide illustrations and brand assets | `docs/assets/logo.svg`, `docs/assets/feature.svg`, `docs/assets/feature-en.svg`, generated PNG social covers, and `docs/assets/speaking-practice.svg` | byoungd / project contributors | Used by the VitePress theme, public asset sync, social metadata, or the speaking chapter; included in the content-license scope | 2026-09-01 |
 | Noto Serif SC PDF font subsets | `book-assets/fonts/` | [Google Fonts / Noto Serif SC](https://github.com/google/fonts/tree/2e61f4355afd22b801791b0df176065082423b87/ofl/notoserifsc) | OFL-licensed 400/700 static fonts subset to the characters used by the Chinese PDF; pinned upstream commit and regeneration steps are retained in `book-assets/fonts/README.md`; license text retained as `book-assets/fonts/OFL-NotoSerifSC.txt` | 2026-09-02 |
@@ -36,11 +36,15 @@ This register distinguishes repository-owned material from third-party sources.
 | Douyin public account QR code | `docs/assets/creator-douyin.jpg` and both home pages | Author-provided media | Published with the author's permission as a public account-following entry point; EXIF, IPTC, and XMP metadata removed before publication | 2026-10-09 |
 | Workflow and agent architecture distinction | Bilingual `threads/practice/ai-workflows.md` | [Anthropic, Building effective agents](https://www.anthropic.com/engineering/building-effective-agents) | Brief architectural paraphrase only; the page's tooling-change note is acknowledged; original practice examples, no article or artwork redistributed | 2026-09-20 |
 | Agent building blocks and model-routing baseline | Bilingual `threads/practice/ai-workflows.md` | [OpenAI, A practical guide to building agents](https://cdn.openai.com/business-guides-and-resources/a-practical-guide-to-building-agents.pdf) | Model/tool/instruction, guardrail, baseline-evaluation, and cost/latency ideas paraphrased from the official guide; no product-performance claim or source text bundled | 2026-09-20 |
-| MCP interoperability and authorization principles | Bilingual AI workflow and resource-layer chapters | [Model Context Protocol Specification, 2025-06-18](https://modelcontextprotocol.io/specification/2025-06-18) | Protocol roles, resources, prompts, tools, consent, and trust boundaries paraphrased; implementation remains responsible for its own security review | 2026-09-20 |
-| Task, trial, transcript, outcome, and grading concepts | Bilingual `threads/practice/ai-evaluation.md` | [Anthropic, Demystifying evals for AI agents](https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents) | Brief conceptual paraphrase from the article published 2026-01-09; original fictional evaluation and worksheet, no product-performance claim or source text bundled | 2026-09-20 |
-| Context curation, retrieval, compaction, and structured notes | Bilingual AI trends chapters | [Anthropic, Effective context engineering for AI agents](https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents) | Article published 2025-09-29; design concepts paraphrased, with original portability exercises and no claim that platform memories transfer automatically | 2026-10-03 |
-| Evaluation trials and actual environment outcomes | Bilingual AI trends chapters | [Anthropic, Demystifying evals for AI agents](https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents) | Article published 2026-01-09; supports evaluation concepts, not a general reliability or learning-outcome guarantee | 2026-10-03 |
-| Tool authorization and progressive permission scopes | Bilingual AI trends chapters | [MCP Security Best Practices, 2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices) | Versioned security guidance; bounded original exercises, no assertion that protocol compliance eliminates prompt injection or data exposure | 2026-10-03 |
+| MCP interoperability, Tasks, and authorization principles | Bilingual AI workflow and resource-layer chapters | [Model Context Protocol Specification, 2026-07-28](https://modelcontextprotocol.io/specification/2026-07-28) | Resources, prompts, tools, optional long-running Tasks, consent, and trust boundaries paraphrased; the protocol does not perform the implementation's security review | 2026-10-16 |
+| Task, trial, transcript, outcome, and grading concepts | Bilingual `threads/practice/ai-evaluation.md` | [Anthropic, Demystifying evals for AI agents](https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents) | Brief conceptual paraphrase from the article published 2026-01-09 and updated 2026-03-18; original fictional evaluation and worksheet, no product-performance claim or source text bundled | 2026-10-16 |
+| Context curation, retrieval, compaction, and structured notes | Bilingual AI trends chapters | [Anthropic, Effective context engineering for AI agents](https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents) | Article published 2025-09-29; design concepts paraphrased, with original portability exercises and no claim that platform memories transfer automatically | 2026-10-16 |
+| Evaluation trials and actual environment outcomes | Bilingual AI trends chapters | [Anthropic, Demystifying evals for AI agents](https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents) | Article published 2026-01-09 and updated 2026-03-18; supports evaluation concepts, not a general reliability or learning-outcome guarantee | 2026-10-16 |
+| Tool authorization, token, SSRF, redirect, and scope controls | Bilingual AI workflow, evaluation, and trends chapters | [MCP Security Best Practices, 2026-07-28](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) | Versioned security guidance paraphrased; original bounded exercises, no assertion that protocol compliance eliminates prompt injection or data exposure | 2026-10-16 |
+| Observed agent autonomy and task duration | Bilingual AI trends chapter | [Anthropic, Measuring AI agent autonomy in practice](https://www.anthropic.com/research/measuring-agent-autonomy) | Anthropic's own usage sample, published 2026-02-18 and updated 2026-09-09; used to distinguish model capability, user authorization, and product design, not as a universal benchmark | 2026-10-16 |
+| Independent evaluation access and evidence | Bilingual AI trends chapter | [Anthropic, An update on independent evaluators](https://www.anthropic.com/news/an-update-on-independent-evaluators) | 2026-10-15 announcement paraphrased as a vendor-specific example of evaluator expertise, access, auditability, and publication freedom; not an industry standard or regulatory requirement | 2026-10-16 |
+| Cybersecurity evaluation environment incidents | Bilingual AI evaluation chapter | [Anthropic, Investigating three incidents in our cybersecurity evaluations](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals) | 2026-07-30 postmortem, updated 2026-09-09; used for environment isolation, network-egress, credential, and scope checks, not as a general model-risk rate | 2026-10-16 |
+| Provider policy version and effective date | Bilingual AI trends and task-brief templates | [Anthropic, 2026 Usage Policy update](https://www.anthropic.com/news/2026-usage-policy-update) | 2026-10-08 announcement effective 2026-11-12; used to teach recording provider policy, date, region, and high-risk review, not as legal advice or universal regulation | 2026-10-16 |
 | Image understanding and verification limits | Bilingual AI trends chapters | [Google, Image understanding](https://ai.google.dev/gemini-api/docs/image-understanding) | Documentation updated 2026-09-23; limited capability framing, no universal accuracy claim or provider ranking | 2026-10-03 |
 | Open weights and local execution tradeoffs | Bilingual AI trends chapters | [Google, Gemma overview](https://ai.google.dev/gemma/docs/core) and [Ollama integration](https://ai.google.dev/gemma/docs/integrations/ollama) | Living documentation without a publication date used here; licensing and local execution examples only, no guaranteed privacy, cost, or performance | 2026-10-03 |
 | Provenance versus truth | Bilingual AI trends chapters | [C2PA Explainer, version 2.2](https://c2pa.org/specifications/specifications/2.2/explainer/Explainer.html) | Brief paraphrase of provenance boundaries; credentials do not establish truth and missing credentials do not establish falsity; no third-party media redistributed | 2026-10-03 |

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,9 +2,15 @@
 
 All notable project-level changes are documented here. Content pages retain their own `updated` date.
 
+## 2026-10-16
+
+- 根据截至 2026-10-16 核验的 Anthropic 与 MCP 官方资料，更新双语 AI 工作流、评测、趋势和资源层章节：加入长时任务检查点与恢复、重复安全重试、浏览器/链接不可信输入、网络出口与凭证隔离、独立复核和供应商政策版本记录。
+- 将 MCP 规范统一到 2026-07-28，并将安全引用切换到对应的官方 Security Best Practices 教程；来源登记补充 Tasks、token passthrough、SSRF、独立评测、网络安全评测环境和政策生效日期的边界说明。
+- 扩充 AI 学习工作流专题页的具体问题、结果示例、双语离线工作表和 FAQ；同步 AI 任务简报、评测记录、趋势实验卡与学习记录模板，并为新字段保留中英文对称。
+
 ## 2026-09-20
 
-- 根据 OpenAI 智能体实践指南、2025-06-18 MCP 规范和 Anthropic 2026-01 评测文章更新 AI 实操内容：补充工具互操作、授权撤回、模型基线、过程记录与最终环境结果。
+- 根据当时的 OpenAI 智能体实践指南、MCP 2025-06-18 规范和 Anthropic 2026-01 评测文章更新 AI 实操内容；该条目保留为历史出版记录，当前 MCP 版本与安全入口以 2026-10-16 条目为准。
 - AI 任务简报与评测模板新增 MCP/外部工具范围、授权、过程记录和环境结果字段；同步中英双语核心 AI 章节与来源登记。
 
 ## 2026-09-19