@boyingliu01/opencode-plugin 0.21.0 → 0.24.0

package/README.md

@@ -9,7 +9,8 @@ OpenCode plugin exposing xp-gate quality gates and AI workflow skills.
 - **gate-principles** ⇄ `xp-gate principles <path>`: Run Clean Code + SOLID
   principles checker (Gate 4 standalone).
 - **gate-arch** ⇄ `xp-gate arch`: Run architecture validation (Gate 6
-  standalone, layer boundary checks).
+  standalone) with the pinned local @archlinter/cli built-in rules and baseline
+  ratchet; an optional config file opts into archlint's own `--config` path.
 - **session-reload-model**: Reload session model from config. After switching
   provider configs (opencode.json + oh-my-openagent.json via switch-coding-plan.sh),
   updates the session model in OpenCode DB to match the new config, so restarted
@@ -67,7 +68,9 @@ Or via local path (development):
 - One of:
   - `xp-gate` CLI installed globally (`npm install -g @boyingliu01/xp-gate`) — **preferred**, or
   - the xp-gate repo checked out locally with `src/principles/index.ts` reachable — **fallback** (the tool will shell out via `npx -y tsx`)
-- `architecture.yaml` in repo root (for `gate-arch` only)
+- `@archlinter/cli` installed locally or on PATH (for `gate-arch` only; the
+  default built-in-rules path needs no `architecture.yaml` — passing one opts
+  into archlint's own `--config` schema validation, which rejects pre-0.16 files)
 
 ## Graceful Degradation
 

package/index.ts

@@ -319,175 +319,226 @@ function extractTitleFromText(text: string): string {
 
 // ── Plugin definition ──
 
+const SQLITE_TIMEOUT_MS = 5_000
+
+// Boy Scout (#447): XpGatePlugin used to inline five tool({...}) definitions
+// (191 lines, 7-8 brace levels). Each tool now lives in its own factory;
+// XpGatePlugin is pure wiring.
+function gateCheckTool(directory: string) {
+  return tool({
+    description: "Run xp-gate quality gates (Gate 4 + Gate 6) on a file or directory. Prefers global xp-gate CLI; falls back to direct checker source.",
+    args: {
+      path: z.string().describe("File or directory path (absolute or relative to workspace)"),
+      gates: z.array(z.string()).optional().describe("Optional gate subset (e.g. ['principles', 'arch'])"),
+    },
+    async execute(args, ctx) {
+      const cwd = ctx.directory || directory
+      const target = args.path.startsWith("/") ? args.path : `${cwd}/${args.path}`
+      const gatesFlag = args.gates?.length ? ` --gates ${args.gates.join(",")}` : ""
+      const result = await runXpGate(`check "${target}"${gatesFlag}`, cwd)
+      if (result) {
+        const upgrade = await getUpgradeSuggestion(cwd)
+        return upgrade ? `${result}\n${upgrade}` : result
+      }
+      const cmd = `node ${directory}/src/npm-package/bin/xp-gate.js check "${target}"${gatesFlag}`
+      return runCmd(cmd, cwd)
+    },
+  })
+}
+
+function gatePrinciplesTool(directory: string) {
+  return tool({
+    description: "Run Clean Code + SOLID principles checker (Gate 4 standalone) on a file or directory.",
+    args: {
+      path: z.string().describe("Source file or directory path to check"),
+    },
+    async execute(args, ctx) {
+      const cwd = ctx.directory || directory
+      const target = args.path.startsWith("/") ? args.path : `${cwd}/${args.path}`
+      const result = await runXpGate(`principles "${target}"`, cwd)
+      if (result) {
+        const upgrade = await getUpgradeSuggestion(cwd)
+        return upgrade ? `${result}\n${upgrade}` : result
+      }
+      const cmd = `npx -y tsx ${directory}/src/principles/index.ts --files "${target}" --format console`
+      return runCmd(cmd, cwd)
+    },
+  })
+}
+
+function gateArchTool(directory: string) {
+  return tool({
+    description:
+      "Run architecture validation (Gate 6 standalone) on the repository with the pinned local @archlinter/cli built-in rules and baseline ratchet.",
+    args: {
+      config: z
+        .string()
+        .optional()
+        .describe(
+          "Optional architecture config file (opts into archlint --config; pre-0.16 schemas are rejected by archlint itself)",
+        ),
+    },
+    async execute(args, ctx) {
+      const cwd = ctx.directory || directory
+      // #447: default to the built-in-rules path — no --config. Forcing
+      // `--config architecture.yaml` hit the pre-0.16 schema archlint rejects.
+      const archArgs = args.config ? `arch --use-config ${args.config}` : "arch"
+      const result = await runXpGate(archArgs, cwd)
+      if (result) {
+        const upgrade = await getUpgradeSuggestion(cwd)
+        return upgrade ? `${result}\n${upgrade}` : result
+      }
+      const fallback = args.config
+        ? `npx -y @archlinter/cli scan . --config ${args.config}`
+        : `npx -y @archlinter/cli scan .`
+      return runCmd(fallback, cwd)
+    },
+  })
+}
+
+function readCurrentSessionModel(dbPath: string, sessionId: string): string {
+  try {
+    const escapedId = sessionId.replace(/'/g, "''")
+    const currentRaw = execSync(
+      `sqlite3 "${dbPath}" "SELECT model FROM session WHERE id = '${escapedId}'"`,
+      { encoding: "utf8", timeout: SQLITE_TIMEOUT_MS }
+    ).trim()
+    if (!currentRaw) return "unknown"
+    try {
+      const parsed = JSON.parse(currentRaw)
+      return `${parsed.providerID || "?"}/${parsed.id || "?"}`
+    } catch {
+      return currentRaw
+    }
+  } catch {
+    return "unknown"
+  }
+}
+
+function writeSessionModel(dbPath: string, sessionId: string, modelJson: string): void {
+  const escapedId = sessionId.replace(/'/g, "''")
+  const escapedModel = modelJson.replace(/'/g, "''")
+  const sql = `UPDATE session SET model = '${escapedModel}', time_updated = ${Date.now()} WHERE id = '${escapedId}'`
+  try {
+    execSync(`sqlite3 "${dbPath}" "${sql}"`, { timeout: SQLITE_TIMEOUT_MS })
+  } catch (err) {
+    // Contract is to propagate: the caller renders the failure as
+    // "Session reload failed: <message>". Wrapped so the IO sits inside
+    // error handling (Boy Scout), not to swallow anything.
+    throw err
+  }
+}
+
+// Boy Scout (#447): the tool's execute() body inlined 40+ lines at 5 brace
+// levels (tool → execute → try → JSON.stringify options). The logic lives at
+// module scope; execute() is pure wiring.
+function reloadSessionModel(sessionId: string): string {
+  const dbPath = join(homedir(), ".local", "share", "opencode", "opencode.db")
+  const configDir = join(homedir(), ".config", "opencode")
+  const omoConfigPath = join(configDir, "oh-my-openagent.json")
+
+  if (!existsSync(dbPath)) {
+    return "Session reload failed: OpenCode database not found at " + dbPath
+  }
+  if (!existsSync(omoConfigPath)) {
+    return "Session reload failed: oh-my-openagent.json not found at " + omoConfigPath
+  }
+
+  let omoConfig: Record<string, unknown>
+  try {
+    omoConfig = JSON.parse(readFileSync(omoConfigPath, "utf8"))
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err)
+    return "Session reload failed: could not parse oh-my-openagent.json: " + msg
+  }
+
+  const agents = omoConfig?.["agents"] as Record<string, { model?: string }> | undefined
+  const sisyphusModel = agents?.["sisyphus"]?.["model"]
+  if (!sisyphusModel || typeof sisyphusModel !== "string") {
+    return "Session reload failed: could not find sisyphus.model in oh-my-openagent.json"
+  }
+
+  const slashIdx = sisyphusModel.indexOf("/")
+  if (slashIdx === -1) {
+    return `Session reload failed: model "${sisyphusModel}" is not in provider/model format`
+  }
+  const providerID = sisyphusModel.substring(0, slashIdx)
+  const modelID = sisyphusModel.substring(slashIdx + 1)
+
+  const oldModel = readCurrentSessionModel(dbPath, sessionId)
+  try {
+    writeSessionModel(dbPath, sessionId, JSON.stringify({ id: modelID, providerID }))
+    return `Session model reloaded: ${oldModel} → ${providerID}/${modelID}`
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err)
+    return `Session reload failed: ${msg}`
+  }
+}
+
+function sessionReloadModelTool() {
+  return tool({
+    description: "Reload session model from config. After switching provider configs (opencode.json + oh-my-openagent.json via switch-coding-plan.sh), updates the session model in OpenCode DB to match the new config. This ensures restarted sessions use the current provider/model.",
+    args: {
+      sessionId: z.string().optional().describe("Session ID to reload (defaults to current session)"),
+    },
+    async execute(args, ctx) {
+      return reloadSessionModel(args.sessionId || ctx.sessionID)
+    },
+  })
+}
+
+// Boy Scout (#447): same treatment as reloadSessionModel — logic at module
+// scope, execute() is pure wiring.
+function renameSession(sessionId: string, newTitle?: string): string {
+  const dbPath = join(homedir(), ".local", "share", "opencode", "opencode.db")
+
+  if (!existsSync(dbPath)) {
+    return "Session rename failed: OpenCode database not found at " + dbPath
+  }
+
+  // `||` (not `??`): an explicitly empty title falls back to auto-generation,
+  // matching the original if/else.
+  const title = newTitle || generateSessionTitle(dbPath, sessionId)
+  if (!title || title.trim().length === 0) {
+    return "Session rename failed: could not generate a title (no user messages found)"
+  }
+
+  const trimmed = title.trim().substring(0, 120)
+  const escapedTitle = trimmed.replace(/'/g, "''")
+  const escapedId = sessionId.replace(/'/g, "''")
+  const sql = `UPDATE session SET title = '${escapedTitle}', time_updated = ${Date.now()} WHERE id = '${escapedId}'`
+  try {
+    execSync(`sqlite3 "${dbPath}" "${sql}"`, { timeout: SQLITE_TIMEOUT_MS })
+    return `Session renamed to: "${trimmed}"`
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err)
+    return `Session rename failed: ${msg}`
+  }
+}
+
+function sessionRenameTool() {
+  return tool({
+    description: "Rename an OpenCode session. When called without newTitle, analyzes the session's recent conversation and auto-generates a descriptive title based on the work done.",
+    args: {
+      sessionId: z.string().optional().describe("Session ID to rename (defaults to current session)"),
+      newTitle: z.string().optional().describe("New session title. If omitted, auto-generate from conversation content."),
+    },
+    async execute(args, ctx) {
+      return renameSession(args.sessionId || ctx.sessionID, args.newTitle)
+    },
+  })
+}
+
 export const XpGatePlugin = async (input: OpenCodePluginInput) => {
   const { directory } = input
 
   return {
     tool: {
-      "gate-check": tool({
-        description: "Run xp-gate quality gates (Gate 4 + Gate 6) on a file or directory. Prefers global xp-gate CLI; falls back to direct checker source.",
-        args: {
-          path: z.string().describe("File or directory path (absolute or relative to workspace)"),
-          gates: z.array(z.string()).optional().describe("Optional gate subset (e.g. ['principles', 'arch'])"),
-        },
-        async execute(args, ctx) {
-          const cwd = ctx.directory || directory
-          const target = args.path.startsWith("/") ? args.path : `${cwd}/${args.path}`
-          const gatesFlag = args.gates?.length ? ` --gates ${args.gates.join(",")}` : ""
-          const result = await runXpGate(`check "${target}"${gatesFlag}`, cwd)
-          if (result) {
-            const upgrade = await getUpgradeSuggestion(cwd)
-            return upgrade ? `${result}\n${upgrade}` : result
-          }
-          const cmd = `node ${directory}/src/npm-package/bin/xp-gate.js check "${target}"${gatesFlag}`
-          return runCmd(cmd, cwd)
-        },
-      }),
-      "gate-principles": tool({
-        description: "Run Clean Code + SOLID principles checker (Gate 4 standalone) on a file or directory.",
-        args: {
-          path: z.string().describe("Source file or directory path to check"),
-        },
-        async execute(args, ctx) {
-          const cwd = ctx.directory || directory
-          const target = args.path.startsWith("/") ? args.path : `${cwd}/${args.path}`
-          const result = await runXpGate(`principles "${target}"`, cwd)
-          if (result) {
-            const upgrade = await getUpgradeSuggestion(cwd)
-            return upgrade ? `${result}\n${upgrade}` : result
-          }
-          const cmd = `npx -y tsx ${directory}/src/principles/index.ts --files "${target}" --format console`
-          return runCmd(cmd, cwd)
-        },
-      }),
-      "gate-arch": tool({
-        description: "Run architecture validation (Gate 6 standalone, layer boundary checks) on the repository.",
-        args: {
-          config: z.string().describe("Path to architecture config file").default("architecture.yaml"),
-        },
-        async execute(args, ctx) {
-          const cwd = ctx.directory || directory
-          const config = args.config || "architecture.yaml"
-          const result = await runXpGate(`arch --config ${config}`, cwd)
-          if (result) {
-            const upgrade = await getUpgradeSuggestion(cwd)
-            return upgrade ? `${result}\n${upgrade}` : result
-          }
-          const cmd = `npx -y @archlinter/cli scan . --config ${config}`
-          return runCmd(cmd, cwd)
-        },
-      }),
-      "session-reload-model": tool({
-        description: "Reload session model from config. After switching provider configs (opencode.json + oh-my-openagent.json via switch-coding-plan.sh), updates the session model in OpenCode DB to match the new config. This ensures restarted sessions use the current provider/model.",
-        args: {
-          sessionId: z.string().optional().describe("Session ID to reload (defaults to current session)"),
-        },
-        async execute(args, ctx) {
-          const sessionId = args.sessionId || ctx.sessionID
-          const dbPath = join(homedir(), ".local", "share", "opencode", "opencode.db")
-          const configDir = join(homedir(), ".config", "opencode")
-          const omoConfigPath = join(configDir, "oh-my-openagent.json")
-
-          if (!existsSync(dbPath)) {
-            return "Session reload failed: OpenCode database not found at " + dbPath
-          }
-          if (!existsSync(omoConfigPath)) {
-            return "Session reload failed: oh-my-openagent.json not found at " + omoConfigPath
-          }
-
-          let omoConfig: Record<string, unknown>
-          try {
-            omoConfig = JSON.parse(readFileSync(omoConfigPath, "utf8"))
-          } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err)
-            return "Session reload failed: could not parse oh-my-openagent.json: " + msg
-          }
-
-          const agents = omoConfig?.["agents"] as Record<string, { model?: string }> | undefined
-          const sisyphusModel = agents?.["sisyphus"]?.["model"]
-          if (!sisyphusModel || typeof sisyphusModel !== "string") {
-            return "Session reload failed: could not find sisyphus.model in oh-my-openagent.json"
-          }
-
-          const slashIdx = sisyphusModel.indexOf("/")
-          if (slashIdx === -1) {
-            return `Session reload failed: model "${sisyphusModel}" is not in provider/model format`
-          }
-          const providerID = sisyphusModel.substring(0, slashIdx)
-          const modelID = sisyphusModel.substring(slashIdx + 1)
-
-          let oldModel = "unknown"
-          try {
-            const escapedId = sessionId.replace(/'/g, "''")
-            const currentRaw = execSync(
-              `sqlite3 "${dbPath}" "SELECT model FROM session WHERE id = '${escapedId}'"`,
-              { encoding: "utf8", timeout: 5000 }
-            ).trim()
-            if (currentRaw) {
-              try {
-                const parsed = JSON.parse(currentRaw)
-                oldModel = `${parsed.providerID || "?"}/${parsed.id || "?"}`
-              } catch {
-                oldModel = currentRaw
-              }
-            }
-          } catch {
-            oldModel = "unknown"
-          }
-
-          const newModelJson = JSON.stringify({ id: modelID, providerID })
-          const escapedId = sessionId.replace(/'/g, "''")
-          const escapedModel = newModelJson.replace(/'/g, "''")
-          const sql = `UPDATE session SET model = '${escapedModel}', time_updated = ${Date.now()} WHERE id = '${escapedId}'`
-
-          try {
-            execSync(`sqlite3 "${dbPath}" "${sql}"`, { timeout: 5000 })
-            return `Session model reloaded: ${oldModel} → ${providerID}/${modelID}`
-          } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err)
-            return `Session reload failed: ${msg}`
-          }
-        },
-      }),
-      "session-rename": tool({
-        description: "Rename an OpenCode session. When called without newTitle, analyzes the session's recent conversation and auto-generates a descriptive title based on the work done.",
-        args: {
-          sessionId: z.string().optional().describe("Session ID to rename (defaults to current session)"),
-          newTitle: z.string().optional().describe("New session title. If omitted, auto-generates from conversation content."),
-        },
-        async execute(args, ctx) {
-          const sessionId = args.sessionId || ctx.sessionID
-          const dbPath = join(homedir(), ".local", "share", "opencode", "opencode.db")
-
-          if (!existsSync(dbPath)) {
-            return "Session rename failed: OpenCode database not found at " + dbPath
-          }
-
-          let title: string
-          if (args.newTitle) {
-            title = args.newTitle
-          } else {
-            title = generateSessionTitle(dbPath, sessionId)
-          }
-
-          if (!title || title.trim().length === 0) {
-            return "Session rename failed: could not generate a title (no user messages found)"
-          }
-
-          title = title.trim().substring(0, 120)
-
-          const escapedTitle = title.replace(/'/g, "''")
-          const escapedId = sessionId.replace(/'/g, "''")
-          const sql = `UPDATE session SET title = '${escapedTitle}', time_updated = ${Date.now()} WHERE id = '${escapedId}'`
-          try {
-            execSync(`sqlite3 "${dbPath}" "${sql}"`, { timeout: 5000 })
-            return `Session renamed to: "${title}"`
-          } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err)
-            return `Session rename failed: ${msg}`
-          }
-        },
-      }),
+      "gate-check": gateCheckTool(directory),
+      "gate-principles": gatePrinciplesTool(directory),
+      "gate-arch": gateArchTool(directory),
+      "session-reload-model": sessionReloadModelTool(),
+      "session-rename": sessionRenameTool(),
     },
     "chat.message": async (_input: { message: string }) => {
       if (!checked) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.21.0",
+  "version": "0.24.0",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/skills/delphi-review/.delphi-config.json.example

@@ -66,5 +66,28 @@
     "max_review_rounds": 5,
     "distinct_models_required": true,
     "cross_provider_required": true
-  }
+  },
+
+  "$comment_seat_fields": [
+    "Optional per-seat fields (#481). The prompt ceiling is a seat x model route",
+    "property, not a global constant: max_prompt_bytes (UTF-8 bytes, default 40000)",
+    "is the hard pre-send gate; prompt_calibration carries the measured bounds used",
+    "to classify a pre-response drop as SIZE_EXCEEDED instead of a network fault.",
+    "Recalibrate (binary search 3-5 probes in [last_pass, last_fail]) whenever the",
+    "model or gateway changes. See docs/plans/2026-10-14-sprint-c-design.md section 2.",
+    "Example expert entry:",
+    "  \"architecture\": {",
+    "    \"provider\": \"bailian-tp\",",
+    "    \"model\": \"qwen-plus\",",
+    "    \"seat_id\": \"architecture\",",
+    "    \"max_prompt_bytes\": 26624,",
+    "    \"prompt_calibration\": {",
+    "      \"measured_at\": \"2026-10-05\",",
+    "      \"model_id\": \"qwen-plus\",",
+    "      \"gateway\": \"bailian\",",
+    "      \"last_pass_bytes\": 26624,",
+    "      \"last_fail_bytes\": 36897",
+    "    }",
+    "  }"
+  ]
 }

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/delphi-review/SKILL.md

@@ -329,6 +329,15 @@ Each round MUST output a structured round marker:
 
 #### Qoder 平台（Custom Agent 模式 — 只能做到同模型三角色）
 
+**通道契约（native-first + external fallback，#414）**：每轮评审开始先探测 native 通道——三个 Custom Agent（`delphi-architecture/technical/feasibility`）是否存在且绑定互异（`xp-gate doctor delphi` 一条命令给出全部判定）。但 **native 通道已被实测证伪**（见下）：subagent 派发采纳 agent 提示词、丢弃 model 绑定，三席永远是会话模型。因此 Qoder 的通道决策表实际收敛为：
+
+| 探测结果 | 通道 | 处置 |
+|---|---|---|
+| 需要 distinct-models 证据的评审 | **external** | `.delphi-config.json` + `scripts/delphi-external-review.cjs`（外部 provider 三模型） |
+| 仅需同模型三角色自查（不计入共识证据） | native | 三 Custom Agent 并行，报告中注明「同模型自查，不构成多模型凭据」 |
+
+降级证据落盘 `delphi-reviewed.json`：`channel`（native/external）、`fallback_reason`（如 `qoder_native_drops_model_binding`）、`probe_evidence`（doctor/日志摘录）。两通道同不变量：三专家齐全、`requested_model` 互异（external）、consensus ≥90%、**无单专家路径**。
+
 Qoder 的内置模型**没有本地推理端点**：推理请求由 Qoder 客户端经服务端代理发出，凭证是一次性 job token。所以不能照搬 OpenCode 的 `base_url + api_key` 直连方式；Qoder 侧内置模型的唯一入口是 **Custom Agent** —— 每个专家一个独立 agent 文件，frontmatter 用 `model` 字段声明模型。
 
 **契约结论（先说结论）**：这条路径**不满足**"三个不同可执行模型 ID"契约。2026-09-23 做过一次排除混杂因素的复测：先把 `~/.qoder/agents/delphi-*.md` 三份文件绑成三个不同的 0.1× 内置模型（`qfmodel` / `dfmodel` / `gfmodel`；架构角与会话模型同名，所以真正有判别力的是技术角与可行性角），**再**新开会话——新 CLI 进程，`session.config.loaded` 记录 `model: "qfmodel"`，注册表加载的必然是已修好的绑定——然后只派发三个 subagent，各回一句话、不调工具。结果：三个独立的 `is_subagent: true` turn，`turn.started` / `model.request.started` / `model.response.completed` 三处的 `model` 全为会话模型 `qfmodel`，`dfmodel` / `gfmodel` 出现 0 次；同时三份回复分别命中架构 / 技术 / 可行性视角，说明角色提示词确实生效、agent 也确实被加载。即 `subagent_type` 派发路径采纳 Custom Agent 的提示词，但**丢弃**它的 `model` 绑定。
@@ -408,6 +417,20 @@ delphi-review(
 > (1) `dsh-tool-subagent` 的 `modelSelectionSettings: true`（仅能力开关），
 > (2) 宿主设置 `SubagentModelSelectionConfig.enabled = true` 且 `allowedModels` ≥3 个不同模型。
 > 该路线依赖宿主配置，CI / 一次性会话不可靠，故不作为默认路径。
+
+**DSH 双通道契约（native-first + external fallback，#443）**：评审开始先探测 native 通道，两层开关缺一不可——
+
+| 探测步骤 | 方法 | 判定 |
+|---|---|---|
+| ① 工具 schema | 当前会话 `subagent` 工具的参数里是否暴露 `provider` / `model` 字段 | 无 → native 不可用（`enabled` 默认 `false`） |
+| ② 模型清单 | `list_subagent_models` 工具是否注册；可用时返回条数是否 ≥3 且互异 | 未注册或 <3 条 → native 不可用 |
+| ③ 运行时兜底 | 上述任一不满足时调用 subagent 会抛 `child model selection is disabled` | 直接判定，不试错 |
+
+- **native 可用**：三个专家并行派发，每个显式传 `model`（取自 `allowedModels` 三个互异条目）；`resolved_model` 以平台日志/回执为准，无日志时按 #437 过渡标准注明「执行层验证待平台支持」。
+- **native 不可用**：降级 **external**（本 skill 的 `delphi-review` 插件工具，或 `.delphi-config.json` + `scripts/delphi-external-review.cjs`）。缺 API key 时必须给出明确指引（导出环境变量），不得静默失败。
+- 降级证据落盘 `delphi-reviewed.json`：`channel`、`fallback_reason`（如 `dsh_subagent_model_selection_disabled`）、`probe_evidence`（①②③ 的实测摘录）。
+- 两通道同不变量：三专家齐全、`requested_model` 互异、consensus ≥90%、**无单专家路径**。
+- 可用性探测可用 `xp-gate doctor delphi` 复核（DSH 环境下含 `subagentModelSelection` 持久化设置检查）。
 #### WorkBuddy 平台（Expert 团队模式）
 
 WorkBuddy 侧以 Team 型专家团（示例：`delphi-review-team`，安装在 `~/.workbuddy/plugins/marketplaces/my-experts/plugins/`，创建方式见 [docs/platform-workbuddy.md](../../docs/platform-workbuddy.md)）承载评审，触发本技能后按此路由执行：
@@ -432,6 +455,26 @@ WorkBuddy 侧以 Team 型专家团（示例：`delphi-review-team`，安装在 `
 
 **成本**：3 专家合计 x0.17/轮；主理人选 local 会话模型则零 credits。
 
+### 席位 prompt 上限与降序裁剪（强制 — #481）
+
+prompt 字节上限是 **席位×模型路由 属性**，不是全局安全值（2026-10-05 实测：同一网关下
+`g-glm-5.3-flash` 席 32-39KB 连续 6 次断连，他席 36KB 一次通过）。编排规则：
+
+1. **发送前硬闸**：runner 按 expert 条目的 `max_prompt_bytes`（默认 40000 字节，UTF-8 计）
+   拒发超限请求，输出 `error_type: "prompt_budget_exceeded"`。
+2. **失败分类**：响应前断连且字节数超过该席位标定的 `last_pass_bytes` →
+   `error_type: "SIZE_EXCEEDED"`（不是网络故障，重试同一 payload 无意义）；
+   其余失败输出 `network_error` / `retryable_error`，编排层按 `error_type` 字段断言，不解析散文。
+3. **超限时按降序裁剪，每步只做一步**：
+   ① 去附录（探针填充、日志附录、非必需长引用）→ ② 去非本轮 AC 原文 →
+   ③ 去测试清单（枚举 → 计数）→ ④ 拆分两次调用（按 diff 对半，同报告合并）→
+   ⑤ 仍失败 → `PROCESS_BLOCK` 交人裁定。**不得以两席结果冒充 3/3 共识。**
+4. **标定**：上限按「固定语义核心 + 确定性填充附录」构造探针，在
+   `[last_pass, last_fail]` 区间二分 3-5 次测得；记录行含
+   `seat_id × model_id × gateway × max_passing_bytes × measured_at`；
+   模型或网关变更即重标。协议全文与种子标定表见
+   [docs/plans/2026-10-14-sprint-c-design.md](../../docs/plans/2026-10-14-sprint-c-design.md) §2。
+
 ### 共识阈值
 
 | 阈值 | 说明 |

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.