Must be calibrated first
Whenever writing/modifying platform configuration, or executing build/deploy/release, first read and execute references/spec-sync.md. Confirm the target system and CLI version, obtain the official source text, check the local snapshot and report differences; when offline, explicitly state the risks, and do not treat a failed request or an error page as the "official latest".
LPK V2 requires at least lzcos 1.5.0 + lzc-cli 2.0.0. package.yml manages static metadata/permissions/import_resources, manifest manages the runtime structure; build manages building, and dev keeps only the differences. New fields do not mean support on old devices.
Requirement Routing
Use file-reading tools to read documents within the same skill on demand, without relying on the user having other skills installed at the same time:
| Requirement | Required Reading |
|---|---|
| Docker/source porting, packaging acceptance | references/lpk-builder.md |
| Metadata, permissions/version thresholds | references/package-spec.md |
| Services, entries, run_as, VT, runtime fields | references/manifest-spec.md |
| build/dev, embed images, development machine proxy | references/build-spec.md |
| HTTP/prefix domain/Host/L4 forwarding | references/advanced-routing.md |
| Installation parameters, Go template, three-stage inject | references/dynamic-deploy.md |
| OIDC, trusted identity Header, API Token, public_path | references/auth-integration.md |
| Access one's own/other applications on behalf of the user | references/app-interconnect.md |
| Discovery/import/export of static resources such as Skill/MCP | references/resource-export.md |
| Permissions, initialization, probes, persistence issues | references/troubleshooting.md |
| Store submission and the eight review items | references/store-publish.md |
Mandatory Boundaries
- Do not default to root/privileged/public network access; generate configuration according to least privilege, image entrypoint, and target version.
- Store internal data, cache, and user files separately; design data migration first before changing the instance mode or paths.
- Automatic prefix domain, upstream.domain_prefix, inject.prefix_domain, and entry.prefix_domain must not be conflated into nonexistent fields.
- API Token consumption does not mean requests cannot be forwarded to the application; Header identity must come from a trusted platform entrypoint; user delegation tickets are a version-restricted specialized capability.
- #@build, Go template, and runtime JS are different stages; validate the source text, preprocessing result, and final YAML separately.
- buildscript does not call project build; installation, release, privilege escalation, and credential changes require user authorization.
- Application status uses
lzc-cli docker; when the microservice name is needed, executelzc-cli box default。
Only load summaries/source text relevant to the requirement, output the calibration record, actual execution results, and unverified items, and do not equate static example checks with successful real deployment.