@boyingliu01/xp-gate 0.22.0 → 0.24.0

package/scripts/delphi-external-review.cjs

@@ -421,6 +421,132 @@ function describePromptBudgetFailure({ bytes, maxBytes, expert }) {
   );
 }
 
+// ── Seat prompt calibration (#481) ─────────────────────────────────────
+// The R1-R4 sprint review proved the ceiling is a seat × model route
+// property: g-glm-5.3-flash dropped 32-39 KB requests six times with
+// "Network error." while the same gateway served 36 KB to a differently
+// routed seat, and a ~60 byte smoke probe on the "dead" seat passed in 7s.
+// The optional per-seat `prompt_calibration` record carries the measured
+// bounds so failures can be classified against evidence instead of guessed.
+function resolveSeatCalibration(expertConfig) {
+  const raw = expertConfig && expertConfig.prompt_calibration;
+  if (raw === undefined) return { calibration: null };
+  const warn = (detail) => {
+    console.error(`[delphi-review] WARNING: prompt_calibration ${detail}; ignoring the record.`);
+  };
+  if (!isPlainObject(raw)) {
+    warn('must be an object');
+    return { calibration: null, warning: 'prompt_calibration_malformed' };
+  }
+  const hasPass = Number.isFinite(raw.last_pass_bytes) && raw.last_pass_bytes > 0;
+  const hasFail = raw.last_fail_bytes === undefined
+    || (Number.isFinite(raw.last_fail_bytes) && raw.last_fail_bytes > 0);
+  const ordered = hasPass && hasFail
+    && (raw.last_fail_bytes === undefined || raw.last_fail_bytes > raw.last_pass_bytes);
+  if (!hasPass || !hasFail || typeof raw.measured_at !== 'string' || raw.measured_at.trim() === '' || !ordered) {
+    warn(raw.last_fail_bytes !== undefined && hasPass && raw.last_fail_bytes <= raw.last_pass_bytes
+      ? 'has last_fail_bytes <= last_pass_bytes'
+      : 'needs measured_at and a finite last_pass_bytes > 0 (last_fail_bytes, if present, must be larger)');
+    return { calibration: null, warning: 'prompt_calibration_malformed' };
+  }
+  return {
+    calibration: {
+      measured_at: raw.measured_at,
+      model_id: typeof raw.model_id === 'string' ? raw.model_id : undefined,
+      gateway: typeof raw.gateway === 'string' ? raw.gateway : undefined,
+      last_pass_bytes: Math.trunc(raw.last_pass_bytes),
+      last_fail_bytes: raw.last_fail_bytes !== undefined ? Math.trunc(raw.last_fail_bytes) : undefined,
+    },
+  };
+}
+
+// Classify a failed expert call. A drop before any response on a payload above
+// the seat's calibrated passing size is a size ceiling, not a transient fault:
+// retrying the same payload cannot succeed, and reporting "Network error."
+// sends operators chasing a cause that is not there (#481). Everything else
+// gets a stable error_type so orchestrators can assert on the class instead of
+// parsing prose.
+function classifySeatFailure({ result, promptBytes, calibration }) {
+  if (!result || !result.error) return result;
+  const threshold = calibration && Number.isFinite(calibration.last_pass_bytes)
+    ? calibration.last_pass_bytes
+    : null;
+  // `error_kind` is the primary signal; the message literal stays as a
+  // backward-compatible fallback for callers that hand-build results.
+  const isPreResponseDrop = !result.retryable
+    && (result.error_kind === 'pre_response_drop' || result.message === 'Network error.');
+  if (isPreResponseDrop && threshold !== null && Number.isFinite(promptBytes) && promptBytes > threshold) {
+    return {
+      ...result,
+      error_type: 'SIZE_EXCEEDED',
+      retryable: false,
+      bytes: promptBytes,
+      calibrated_pass_bytes: threshold,
+      message: `Request dropped before any response: ${promptBytes} bytes exceeds this seat's calibrated passing size `
+        + `(${threshold} bytes). Classified SIZE_EXCEEDED, not a network fault — trim the payload or recalibrate the seat.`,
+    };
+  }
+  if (isPreResponseDrop && threshold === null && Number.isFinite(promptBytes)
+    && promptBytes >= DEFAULT_PROMPT_BUDGET_BYTES) {
+    // No calibration means no evidence to reclassify on — but an uncalibrated
+    // seat dying on a full-budget payload is exactly how #481 started. Keep the
+    // class honest (network_error) and point the operator at the protocol.
+    return {
+      ...result,
+      error_type: 'network_error',
+      bytes: promptBytes,
+      message: `${result.message} Note: this seat has no prompt_calibration record and the payload is at the `
+        + 'default budget — this pattern matches an uncalibrated size ceiling. Recalibrate per the #481 protocol.',
+    };
+  }
+  return { ...result, error_type: result.retryable ? 'retryable_error' : 'network_error' };
+}
+
+// ── Schema retry (#414 REQ-5) ──────────────────────────────────────────
+// g-qwen3.8-flash occasionally answers in prose or malformed JSON (measured
+// during the 2026-09-17 Qoder walkthrough). One retry whose system prompt
+// restates the JSON schema explicitly recovers those; a same-prompt retry
+// does not. Exactly one: a model that cannot echo the schema after being
+// shown it will not improve on a third attempt.
+const SCHEMA_RESTATEMENT = '\n\n【输出格式强制重申 — 上一次回复无法解析为合法评审 JSON】\n'
+  + '你的回复必须且只能是一个 JSON 对象，不得包含任何解释、markdown 代码块或前后缀文字。字段与类型：\n'
+  + '{\n'
+  + '  "verdict": "APPROVED" | "REQUEST_CHANGES" | "REJECTED",\n'
+  + '  "confidence": <1-10 的整数>,\n'
+  + '  "critical_issues": ["字符串", ...],\n'
+  + '  "major_concerns": ["字符串", ...],\n'
+  + '  "minor_concerns": ["字符串", ...],\n'
+  + '  "summary": "字符串"\n'
+  + '}\n'
+  + '三个 concern 数组的每一项都必须是字符串（可含 "CI-01: " 等前缀），绝不能是对象。';
+
+async function callExpertWithSchemaRetry({ provider, model, systemPrompt, userPrompt, timeoutMs, maxRetries = 2, callFn } = {}) {
+  const call = callFn || callWithRetry;
+  const result = await call(provider, model, systemPrompt, userPrompt, maxRetries, timeoutMs);
+  // An API failure keeps its own retry loop (callWithRetry); the schema path
+  // must not turn an exhausted transport into an extra model round.
+  if (result.error) return result;
+  const parsed = parseExpertVerdict(extractJsonFromResponse(result.content));
+  if (parsed.valid) return { ...result, verdict: parsed.verdict };
+
+  const retryResult = await call(
+    // maxRetries=0 means the transport loop runs exactly one attempt
+    // (callWithRetry iterates `attempt <= maxRetries`) — the schema path adds
+    // one model round, never an extra transport-retry chain. The 7th argument
+    // is a tag consumed by injectable callFn stubs in tests.
+    provider, model, systemPrompt + SCHEMA_RESTATEMENT, userPrompt, 0, timeoutMs, 'schema-retry:1',
+  );
+  if (retryResult.error) return { ...retryResult, retry: 1 };
+  const retryParsed = parseExpertVerdict(extractJsonFromResponse(retryResult.content));
+  if (retryParsed.valid) return { ...retryResult, verdict: retryParsed.verdict, retry: 1 };
+  return {
+    error: true,
+    message: `Expert response could not be parsed as a valid verdict after one schema retry: ${parsed.message}`,
+    retry: 1,
+    resolved_model: typeof retryResult.resolved_model === 'string' ? retryResult.resolved_model : result.resolved_model,
+  };
+}
+
 // ── API call ───────────────────────────────────────────────────────────
 async function callModelAPI(providerConfig, model, systemPrompt, userPrompt, options = {}) {
   const url = `${providerConfig.base_url.replace(/\/$/, '')}/chat/completions`;
@@ -530,8 +656,11 @@ async function callModelAPI(providerConfig, model, systemPrompt, userPrompt, opt
     }
     // Deliberately do NOT surface the underlying cause here. Provider errors can
     // carry mutable metadata (tokens, keys, hostnames) that must not leak into the
-    // evidence file; the test suite asserts this redaction. Keep the generic form.
-    return { error: true, message: 'Network error.' };
+    // evidence file; the test suite asserts this redaction. The structured
+    // `error_kind` is what classifySeatFailure keys on — matching the human
+    // message would make every future wording change silently disable the
+    // size-ceiling classification (#414 R1 FC-01).
+    return { error: true, error_kind: 'pre_response_drop', message: 'Network error.' };
   } finally {
     clearTimeout(timeout);
   }
@@ -658,6 +787,9 @@ async function main() {
   const userPrompt = buildUserPrompt(reviewContent, otherExpertsContent, args.round);
 
   // Refuse before the request, not after the gateway kills it.
+  // resolveSeatCalibration already printed its own warning, if any — do not
+  // echo it a second time (#414 R1 MN-03).
+  const seatCalibration = resolveSeatCalibration(expertConfig);
   const budget = checkPromptBudget({
     systemPrompt,
     userPrompt,
@@ -680,33 +812,49 @@ async function main() {
     process.exit(1);
   }
 
-  // Call API with retry
+  // Call API with retry; one schema-restating retry recovers malformed JSON
+  // without ever faking a verdict (#414 REQ-5).
   const timeoutMs = resolveTimeoutMs(args, provider);
-  const result = await callWithRetry(provider, expertConfig.model, systemPrompt, userPrompt, 2, timeoutMs);
+  const outcome = await callExpertWithSchemaRetry({
+    provider,
+    model: expertConfig.model,
+    systemPrompt,
+    userPrompt,
+    timeoutMs,
+  });
 
-  if (result.error) {
+  if (outcome.error) {
+    const classified = classifySeatFailure({
+      result: outcome,
+      promptBytes: budget.bytes,
+      calibration: seatCalibration.calibration,
+    });
     const errorOutput = {
       error: true,
+      error_type: classified.error_type,
       expert_role: args.expert,
-      message: result.message,
-      retryable: result.retryable || false,
+      message: classified.message,
+      retryable: classified.retryable || false,
     };
+    if (classified.bytes !== undefined) {
+      errorOutput.bytes = classified.bytes;
+      errorOutput.calibrated_pass_bytes = classified.calibrated_pass_bytes;
+    }
     console.log(JSON.stringify(errorOutput));
     process.exit(1);
   }
 
-  // Extract JSON from response
-  const verdict = extractJsonFromResponse(result.content);
-
-  if (verdict.parse_error) {
-    console.error(`[delphi-review] WARNING: Could not parse model response as JSON.`);
+  // Extract JSON from response (already parsed-and-validated, possibly after
+  // one schema retry — the retry is surfaced so the evidence is never silent).
+  if (outcome.retry === 1) {
+    console.error('[delphi-review] WARNING: first response was not a valid verdict; accepted after one schema retry (retry:1).');
   }
 
   // Enrich output
-  const output = buildReviewOutput(verdict, args, {
+  const output = buildReviewOutput(outcome.verdict, args, {
     provider: expertConfig.provider,
     requested_model: expertConfig.model,
-    resolved_model: result.resolved_model,
+    resolved_model: outcome.resolved_model,
     // This runner only ever reaches an external provider; local/offline
     // fallbacks are recorded by a different path (#423).
     channel: 'external',
@@ -732,6 +880,10 @@ if (require.main !== module) {
     checkPromptBudget,
     describePromptBudgetFailure,
     DEFAULT_PROMPT_BUDGET_BYTES,
+    resolveSeatCalibration,
+    classifySeatFailure,
+    callExpertWithSchemaRetry,
+    SCHEMA_RESTATEMENT,
     checkNodeVersion,
     callModelAPI,
     callWithRetry,

package/skills/delphi-review/.delphi-config.json.example

@@ -66,5 +66,28 @@
     "max_review_rounds": 5,
     "distinct_models_required": true,
     "cross_provider_required": true
-  }
+  },
+
+  "$comment_seat_fields": [
+    "Optional per-seat fields (#481). The prompt ceiling is a seat x model route",
+    "property, not a global constant: max_prompt_bytes (UTF-8 bytes, default 40000)",
+    "is the hard pre-send gate; prompt_calibration carries the measured bounds used",
+    "to classify a pre-response drop as SIZE_EXCEEDED instead of a network fault.",
+    "Recalibrate (binary search 3-5 probes in [last_pass, last_fail]) whenever the",
+    "model or gateway changes. See docs/plans/2026-10-14-sprint-c-design.md section 2.",
+    "Example expert entry:",
+    "  \"architecture\": {",
+    "    \"provider\": \"bailian-tp\",",
+    "    \"model\": \"qwen-plus\",",
+    "    \"seat_id\": \"architecture\",",
+    "    \"max_prompt_bytes\": 26624,",
+    "    \"prompt_calibration\": {",
+    "      \"measured_at\": \"2026-10-05\",",
+    "      \"model_id\": \"qwen-plus\",",
+    "      \"gateway\": \"bailian\",",
+    "      \"last_pass_bytes\": 26624,",
+    "      \"last_fail_bytes\": 36897",
+    "    }",
+    "  }"
+  ]
 }

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/delphi-review/SKILL.md

@@ -329,6 +329,15 @@ Each round MUST output a structured round marker:
 
 #### Qoder 平台（Custom Agent 模式 — 只能做到同模型三角色）
 
+**通道契约（native-first + external fallback，#414）**：每轮评审开始先探测 native 通道——三个 Custom Agent（`delphi-architecture/technical/feasibility`）是否存在且绑定互异（`xp-gate doctor delphi` 一条命令给出全部判定）。但 **native 通道已被实测证伪**（见下）：subagent 派发采纳 agent 提示词、丢弃 model 绑定，三席永远是会话模型。因此 Qoder 的通道决策表实际收敛为：
+
+| 探测结果 | 通道 | 处置 |
+|---|---|---|
+| 需要 distinct-models 证据的评审 | **external** | `.delphi-config.json` + `scripts/delphi-external-review.cjs`（外部 provider 三模型） |
+| 仅需同模型三角色自查（不计入共识证据） | native | 三 Custom Agent 并行，报告中注明「同模型自查，不构成多模型凭据」 |
+
+降级证据落盘 `delphi-reviewed.json`：`channel`（native/external）、`fallback_reason`（如 `qoder_native_drops_model_binding`）、`probe_evidence`（doctor/日志摘录）。两通道同不变量：三专家齐全、`requested_model` 互异（external）、consensus ≥90%、**无单专家路径**。
+
 Qoder 的内置模型**没有本地推理端点**：推理请求由 Qoder 客户端经服务端代理发出，凭证是一次性 job token。所以不能照搬 OpenCode 的 `base_url + api_key` 直连方式；Qoder 侧内置模型的唯一入口是 **Custom Agent** —— 每个专家一个独立 agent 文件，frontmatter 用 `model` 字段声明模型。
 
 **契约结论（先说结论）**：这条路径**不满足**"三个不同可执行模型 ID"契约。2026-09-23 做过一次排除混杂因素的复测：先把 `~/.qoder/agents/delphi-*.md` 三份文件绑成三个不同的 0.1× 内置模型（`qfmodel` / `dfmodel` / `gfmodel`；架构角与会话模型同名，所以真正有判别力的是技术角与可行性角），**再**新开会话——新 CLI 进程，`session.config.loaded` 记录 `model: "qfmodel"`，注册表加载的必然是已修好的绑定——然后只派发三个 subagent，各回一句话、不调工具。结果：三个独立的 `is_subagent: true` turn，`turn.started` / `model.request.started` / `model.response.completed` 三处的 `model` 全为会话模型 `qfmodel`，`dfmodel` / `gfmodel` 出现 0 次；同时三份回复分别命中架构 / 技术 / 可行性视角，说明角色提示词确实生效、agent 也确实被加载。即 `subagent_type` 派发路径采纳 Custom Agent 的提示词，但**丢弃**它的 `model` 绑定。
@@ -408,6 +417,20 @@ delphi-review(
 > (1) `dsh-tool-subagent` 的 `modelSelectionSettings: true`（仅能力开关），
 > (2) 宿主设置 `SubagentModelSelectionConfig.enabled = true` 且 `allowedModels` ≥3 个不同模型。
 > 该路线依赖宿主配置，CI / 一次性会话不可靠，故不作为默认路径。
+
+**DSH 双通道契约（native-first + external fallback，#443）**：评审开始先探测 native 通道，两层开关缺一不可——
+
+| 探测步骤 | 方法 | 判定 |
+|---|---|---|
+| ① 工具 schema | 当前会话 `subagent` 工具的参数里是否暴露 `provider` / `model` 字段 | 无 → native 不可用（`enabled` 默认 `false`） |
+| ② 模型清单 | `list_subagent_models` 工具是否注册；可用时返回条数是否 ≥3 且互异 | 未注册或 <3 条 → native 不可用 |
+| ③ 运行时兜底 | 上述任一不满足时调用 subagent 会抛 `child model selection is disabled` | 直接判定，不试错 |
+
+- **native 可用**：三个专家并行派发，每个显式传 `model`（取自 `allowedModels` 三个互异条目）；`resolved_model` 以平台日志/回执为准，无日志时按 #437 过渡标准注明「执行层验证待平台支持」。
+- **native 不可用**：降级 **external**（本 skill 的 `delphi-review` 插件工具，或 `.delphi-config.json` + `scripts/delphi-external-review.cjs`）。缺 API key 时必须给出明确指引（导出环境变量），不得静默失败。
+- 降级证据落盘 `delphi-reviewed.json`：`channel`、`fallback_reason`（如 `dsh_subagent_model_selection_disabled`）、`probe_evidence`（①②③ 的实测摘录）。
+- 两通道同不变量：三专家齐全、`requested_model` 互异、consensus ≥90%、**无单专家路径**。
+- 可用性探测可用 `xp-gate doctor delphi` 复核（DSH 环境下含 `subagentModelSelection` 持久化设置检查）。
 #### WorkBuddy 平台（Expert 团队模式）
 
 WorkBuddy 侧以 Team 型专家团（示例：`delphi-review-team`，安装在 `~/.workbuddy/plugins/marketplaces/my-experts/plugins/`，创建方式见 [docs/platform-workbuddy.md](../../docs/platform-workbuddy.md)）承载评审，触发本技能后按此路由执行：
@@ -432,6 +455,26 @@ WorkBuddy 侧以 Team 型专家团（示例：`delphi-review-team`，安装在 `
 
 **成本**：3 专家合计 x0.17/轮；主理人选 local 会话模型则零 credits。
 
+### 席位 prompt 上限与降序裁剪（强制 — #481）
+
+prompt 字节上限是 **席位×模型路由 属性**，不是全局安全值（2026-10-05 实测：同一网关下
+`g-glm-5.3-flash` 席 32-39KB 连续 6 次断连，他席 36KB 一次通过）。编排规则：
+
+1. **发送前硬闸**：runner 按 expert 条目的 `max_prompt_bytes`（默认 40000 字节，UTF-8 计）
+   拒发超限请求，输出 `error_type: "prompt_budget_exceeded"`。
+2. **失败分类**：响应前断连且字节数超过该席位标定的 `last_pass_bytes` →
+   `error_type: "SIZE_EXCEEDED"`（不是网络故障，重试同一 payload 无意义）；
+   其余失败输出 `network_error` / `retryable_error`，编排层按 `error_type` 字段断言，不解析散文。
+3. **超限时按降序裁剪，每步只做一步**：
+   ① 去附录（探针填充、日志附录、非必需长引用）→ ② 去非本轮 AC 原文 →
+   ③ 去测试清单（枚举 → 计数）→ ④ 拆分两次调用（按 diff 对半，同报告合并）→
+   ⑤ 仍失败 → `PROCESS_BLOCK` 交人裁定。**不得以两席结果冒充 3/3 共识。**
+4. **标定**：上限按「固定语义核心 + 确定性填充附录」构造探针，在
+   `[last_pass, last_fail]` 区间二分 3-5 次测得；记录行含
+   `seat_id × model_id × gateway × max_passing_bytes × measured_at`；
+   模型或网关变更即重标。协议全文与种子标定表见
+   [docs/plans/2026-10-14-sprint-c-design.md](../../docs/plans/2026-10-14-sprint-c-design.md) §2。
+
 ### 共识阈值
 
 | 阈值 | 说明 |

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.