fix: batch of 28 trivial/easy ROSETTA issues (CI, instructions, docs, rosetta-cli, MCP)

[isolomatov-gd]

Issues closed by merging this PR

Closes #171
Closes #195
Closes #206
Closes #212
Closes #219
Closes #220
Closes #221
Closes #228
Closes #229
Closes #232
Closes #241
Closes #257
Closes #265
Closes #274
Closes #275
Closes #287
Closes #289
Closes #291
Closes #292
Closes #304

Partially advanced, left open: Refs #262, Refs #263.
Closed separately as incorrect premises, labelled invalid: #200, #226, #233, #235, #268, #290.

Changes

CI

• timeout-minutes: e2e-testing 180, validate-test-cases 180, validate-prompts 90.
• npm/pip caching via setup-node/setup-python on the seven ci-*.yml. requirements.txt pinned explicitly, not globbed — refsrc/ holds four more.
• mypy gate on ci-rosetta-cli, scoped to src/rosetta-cli, via python -m mypy (not validate-types.sh, which exits 0 when it finds no runner).
• Concurrency: ${{ github.workflow }}-${{ github.ref }} + cancel on codeql, e2e-testing, validate-prompts, validate-test-cases; static uncancellable group on rosetta-mcp-dockerhub.
• publish-mcp-helm-chart validate cancels on pull_request only. Cancelling it on a push to main skipped publish (needs: validate) and dropped that chart version. test_publish_workflow_concurrency.py updated.
• repo-analysis runs opus at high effort with WebSearch; its prompt gained premise-validation gates.

Instructions (r3)

• Removed model:, context:, agent:, metadata: from skill frontmatter. All four exist only for the fork scenario, which Rosetta does not use; docs/schemas/skill.md documents context: "fork" alone, and agent only as its target.
• Fixed a <prerequisites> block with two opening tags and no close, a subagent="HITL" misuse, a gap log pointing at the wrong phase, and a source-code-specs reference to files no phase creates.
• requirements-authoring acceptance criteria consistently EARS; one checklist line still said Given/When/Then.
• bootstrap-alwayson requires ASD-STE100.
• READMEs record why /goal, /advisor and graphify are absent from this repo by design, so they are not "cleaned up" again.

Docs

• DEPENDENCIES.md / TECHSTACK.md: pins synced to the real pyprojects; own-version claims replaced with (in repo) markers; plugin table now lists all 7 targets and the light variants instead of 3.
• definitions/skills.md: discovery and design no longer marked (not yet) — both ship in every plugin. definitions/agents.md: analyst → requirements-engineer. ARCHITECTURE.md: 40 skills, not 38.
• Stale OAuth TODO removed (all three call sites pass True). Hooks manual-test doc corrected against executed bundle output.

rosetta-cli

• --parse-timeout reaches both wait_for_parsing call sites; the single-file path passed none and the folder-batch path defaulted to a hardcoded 300. Precedence is flag > env > default, and an unset flag no longer clobbers RAGFLOW_PARSE_TIMEOUT.
• Behaviour change: default parse timeout is 1200, not 300. from_env_vars already used 1200, so the dataclass's 300 was dead in that path.
• RAGFLOW_TIMEOUT configurable, default unchanged at 30.
• Stopped logging api_key[:10] — the ragflow- prefix is 8 chars, so it exposed secret material. __str__ narrowed to [:8]. Closes a CodeQL py/clear-text-logging-sensitive-data alert.
• Tag-in-Title docs corrected against DocumentData.from_file.

rosetta-mcp-server

• Download fallback (30s) and legacy bootstrap request (60s) honour ROSETTA_RAGFLOW_HTTP_TIMEOUT. No new config field; behaviour is byte-identical when unset.
• list_instructions parameter documented as full_path_from_root.

Dependabot — 15 alerts, via overrides in five package.json plus lock regeneration: postcss 8.5.23 (all five), hono 4.12.34 / ip-address 10.3.1 / fast-uri 3.1.5 (rosettify), js-yaml 3.15.1 (rosettify-plugins), json 2.21.2 (docs/web/Gemfile.lock). npm audit --omit=dev reports 0 for four; curiocity reports 1, the unpatched extract-zip noted below.

Versions — curiocity 0.2.6, rosettify 3.2.3, rosettify-plugins 3.3.2, rosettify-prompts 0.1.12, rosetta-cli / rosetta-mcp / ims-mcp 3.0.4 (ims-mcp pins rosetta-mcp==3.0.4), plugin + marketplace 3.1.10. Each is unpublished on npm/PyPI. src/hooks is private and versionless; it gets the override only.

Deliberately not changed

• extract-zip CVE-2026-56876 (high, symlink traversal) in curiocity. No patched release exists upstream; 2.0.1 is both latest and vulnerable. Exposure is src.zip eval fixtures, repo-local.
• /goal, /advisor, graphify — real user-enabled features, absent from this repo by design.
• repo-*.yml concurrency — none, per docs/AUTOMATION-ARCHITECTURE.md:176-180.

Validation

scripts/pre_commit.py green (3598 tests), plus 419 Python, 432 curiocity, mypy clean. plugins/ is byte-identical to a fresh two-pass regeneration (standard + --profile lightweight).

[github-actions]

Rosetta Triage Review

Summary: Batch fix closing 26 issues (partially advancing 2 more) across CI workflows, r3 instructions/generated plugins, rosetta-cli, and rosetta-mcp-server. Each fix claims a reproduce-before-fix + execution-validated workflow; 850/-353 lines across ~200 files (most are 1:1 generated plugin mirrors).

Findings:

• Instruction-quality review (mandatory for instructions/r3/** changes): all edits verified against Rosetta's own conventions — subagent prep-chain fix is consistent across all 7 agent files, USE SKILL graphify//goal removals are genuinely dead references, <prerequisites> tag and subagent="HITL"→type="HITL" fixes are correct, EARS-consistency fix closes the last Given/When/Then holdout. Verdict: clean.
• rosetta-cli timeout-precedence rework (parse_command.py, publish_command.py, rosetta_config.py) correctly uses a None-sentinel to distinguish "flag not passed" from an explicit 0, avoiding a falsy-check bug; the 300→1200 default change is threaded through a single DEFAULT_PARSE_TIMEOUT constant and guarded by a test asserting dataclass/env/template all agree. get_dataset page_size fix has a genuinely meaningful regression test (13-dataset substring-collision case).
• rosetta-mcp-server: legacy bootstrap timeout is byte-identical when ROSETTA_RAGFLOW_HTTP_TIMEOUT is unset as claimed; the download-fallback path's default silently doubles from 30s to 60s (a real behavior change beyond what the PR description implies as "byte-identical") — covered by an explicit test, but worth flagging since the PR body only calls out the legacy path as unchanged.
• CI workflow changes (timeout-minutes, npm/pip caching, mypy gate) all verified against the actual diff: cache-dependency-path targets are git-tracked, the mypy gate correctly bypasses validate-types.sh's silent warn-and-pass fallback, and the three timeout-minutes values each have distinct, sound justifications (not copy-pasted).

Caveats:

• Large single PR spanning 4 unrelated areas (CI, instructions, rosetta-cli, mcp-server) — mixes concerns per the repo's own SRP guidance, though the description explains it as 6 disjoint-fileset parallel workstreams merged together.
• Download-fallback timeout default change (30s→60s) in rosetta-mcp-server reads as a bigger behavior change than the PR description's "byte-identical" framing suggests for that specific call site — worth a release-note mention alongside the already-flagged parse-timeout default change.
• Author's own "Not closed, and why" and "Follow-ups found, not fixed" sections are thorough and self-critical (a cleanup-dataset deletion-scope risk, docs still seeding the old orchestrator-only prep chain in templates, stale pins, a stale manual-test doc) — worth turning into tracked issues rather than losing them in the PR body.

Suggestions:

• Split future batches of this size by area (CI / instructions / cli / mcp) for easier review and safer partial revert, even when the underlying issues are unrelated.
• File the four "Follow-ups found, not fixed" items as separate issues so they don't get lost once this PR merges.

Questions:

• Confirm the plugin version bump (scripts/bump_versions.sh) will happen before/at merge as noted in the PR's "Before merging" section — is that step planned as part of this PR or a follow-up commit?

Automated triage by Rosetta agent