@boyingliu01/xp-gate 0.23.0 → 0.24.0

package/lib/doctor.js

@@ -2643,8 +2643,276 @@ function formatDoctorJson(checks, issues) {
   };
 }
 
+// ── doctor delphi (#414 REQ-3/REQ-6) ───────────────────────────────────
+// Diagnoses the Delphi review chain end to end. Each check exists because a
+// real failure was silent: drifted agent bindings looked like a working setup
+// (B2), a stale skill copy made reinstall = downgrade (B4), and a missing
+// runner script surfaced only as a failed review (B3).
+async function doctorDelphi(options = {}) {
+  const { configPath, npmLatest } = options;
+  const checks = [];
+  const add = (name, status, detail) => checks.push({ name, status, detail });
+
+  // 1. Node >= 18: the runner gates on it and exits 1 mid-review otherwise.
+  const nodeMajor = parseInt(process.versions.node.split('.')[0], 10);
+  add('Node.js >= 18', nodeMajor >= 18 ? 'PASS' : 'FAIL',
+    `current: ${process.versions.node}`);
+
+  // 2. Qoder agent bindings: present, parseable, three distinct ids, matching
+  // what this version ships. A stale binding is a repair, not an error to
+  // retype: the detail names delphi-setup. Project-level agents (from
+  // `delphi-setup --local --project`) take precedence when a complete set
+  // exists there, so the doctor agrees with the repair command (#414 R1 FC-09).
+  const { readQoderModelId } = require('./init.js');
+  const roles = ['architecture', 'technical', 'feasibility'];
+  const homeAgentsDir = path.join(HOME_DIR, '.qoder', 'agents');
+  // Injectable for tests; defaults to the cwd the doctor runs from.
+  const projectAgentsDir = path.join(options.projectDir || process.cwd(), '.qoder', 'agents');
+  const homeComplete = roles.every((r) => fs.existsSync(path.join(homeAgentsDir, `delphi-${r}.md`)));
+  const projectComplete = roles.every((r) => fs.existsSync(path.join(projectAgentsDir, `delphi-${r}.md`)));
+  const agentsDir = projectComplete ? projectAgentsDir : homeAgentsDir;
+  const agentsSource = projectComplete
+    ? `project-level ${agentsDir}`
+    : `user-level ${agentsDir}`;
+  const agentIds = [];
+  let agentsStatus = 'PASS';
+  const agentDetails = [agentsSource];
+  for (const role of roles) {
+    const agentPath = path.join(agentsDir, `delphi-${role}.md`);
+    if (!fs.existsSync(agentPath)) {
+      agentsStatus = 'FAIL';
+      agentDetails.push(`delphi-${role}.md missing (run: xp-gate init --global, or delphi-setup --local --project for project scope)`);
+      continue;
+    }
+    const id = readQoderModelId(agentPath);
+    if (id === null) {
+      agentsStatus = 'FAIL';
+      agentDetails.push(`delphi-${role}.md has no quoted model binding (repair: xp-gate delphi-setup)`);
+      continue;
+    }
+    const bundledId = readQoderModelId(path.join(PKG_DIR, 'plugins', 'qoder', 'agents', `delphi-${role}.md`));
+    if (bundledId === null) {
+      // A bundle without a parseable template is install corruption: skipping
+      // the comparison would hide it behind a healthy-looking id (#414 R1 FC-08).
+      agentsStatus = 'FAIL';
+      agentDetails.push(`delphi-${role}: bundled template missing/unreadable — reinstall xp-gate`);
+      continue;
+    }
+    if (bundledId !== id) {
+      agentDetails.push(`delphi-${role}: ${id} (this version ships ${bundledId} — repair: xp-gate delphi-setup)`);
+    } else {
+      agentDetails.push(`delphi-${role}: ${id}`);
+    }
+    agentIds.push(id);
+  }
+  // Report every problem class independently: missing files, unparseable
+  // bindings and duplicates can coexist, and each has a different remedy
+  // (#414 R1 MI-02).
+  if (agentIds.length !== roles.length) agentsStatus = 'FAIL';
+  if (new Set(agentIds).size !== agentIds.length) {
+    agentsStatus = 'FAIL';
+    agentDetails.push('duplicate model binding across experts — three DISTINCT ids are required');
+  }
+  add('Qoder Delphi agent bindings', agentsStatus, agentDetails.join('; ') || 'all three bound');
+
+  // 3. Skill install parity: a drifted installed copy is how "reinstall from
+  // an old local repo" became a downgrade (#414 B4). Every bundled file is
+  // compared, not just SKILL.md — the install script copies *.json and
+  // references/ too, and B4-style drift hits those equally (#414 R1 MI-03).
+  const platform = detectPlatform();
+  const installedSkillDir = platform === 'qoder'
+    ? path.join(HOME_DIR, '.qoder', 'skills', 'delphi-review')
+    : platform === 'claude-code'
+      ? path.join(HOME_DIR, '.claude', 'skills', 'delphi-review')
+      : path.join(HOME_DIR, '.config', 'opencode', 'skills', 'delphi-review');
+  // Injectable for tests (#414 R3 FC-01/FC-02): the empty-bundle branch is a
+  // real failure mode and must be drivable without mutating the package.
+  const bundledSkillDir = options.bundledSkillDir || path.join(PKG_DIR, 'skills', 'delphi-review');
+  const sha256 = (p) => require('crypto').createHash('sha256').update(fs.readFileSync(p)).digest('hex');
+  const listBundledSkillFiles = (dir, base = dir, out = []) => {
+    if (!fs.existsSync(dir)) return out;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const p = path.join(dir, entry.name);
+      if (entry.isDirectory()) listBundledSkillFiles(p, base, out);
+      else out.push(path.relative(base, p));
+    }
+    return out;
+  };
+  if (!fs.existsSync(path.join(installedSkillDir, 'SKILL.md'))) {
+    add('Delphi skill install parity', 'FAIL',
+      `not installed at ${installedSkillDir} (install: xp-gate install-skill delphi-review)`);
+  } else {
+    const bundledFiles = listBundledSkillFiles(bundledSkillDir);
+    if (bundledFiles.length === 0) {
+      // An installed copy next to an empty bundle is install corruption —
+      // "0 files match" must never read as healthy (#414 R2 MN-R2-01). The
+      // bundled dir ships inside the installed package itself, so an
+      // unreachable one is a broken install, not a transient condition
+      // (#414 R3 FC-05): FAILing is the doctor's job here.
+      add('Delphi skill install parity', 'FAIL',
+        `bundled skill directory missing or empty: ${bundledSkillDir} — reinstall xp-gate`);
+    } else {
+      const drifted = [];
+      for (const rel of bundledFiles) {
+        const installedPath = path.join(installedSkillDir, rel);
+        const bundledPath = path.join(bundledSkillDir, rel);
+        if (!fs.existsSync(installedPath)) {
+          drifted.push(`${rel}: missing`);
+        } else if (sha256(installedPath) !== sha256(bundledPath)) {
+          drifted.push(`${rel}: differs from bundle`);
+        }
+      }
+      if (drifted.length > 0) {
+        add('Delphi skill install parity', 'FAIL',
+          `${drifted.length} file(s) differ from the ${getCliVersionSafe()} bundle: `
+          + `${drifted.slice(0, 5).join('; ')}${drifted.length > 5 ? '; ...' : ''} `
+          + '(reinstall: xp-gate install-skill delphi-review --force)');
+      } else {
+        add('Delphi skill install parity', 'PASS',
+          `${bundledFiles.length} file(s) match the bundle`);
+      }
+    }
+  }
+
+  // 4. Runner script locate: the runner must be findable from the places a
+  // review actually starts.
+  const runnerCandidates = [
+    ['package bundle', path.join(PKG_DIR, 'scripts', 'delphi-external-review.cjs')],
+    ['project', path.join(process.cwd(), 'scripts', 'delphi-external-review.cjs')],
+    ['installed skill', path.join(installedSkillDir, 'scripts', 'delphi-external-review.cjs')],
+  ];
+  const foundRunner = runnerCandidates.filter(([, p]) => fs.existsSync(p));
+  add('delphi-external-review runner', foundRunner.length > 0 ? 'PASS' : 'FAIL',
+    foundRunner.length > 0
+      ? foundRunner.map(([label, p]) => `${label}: ${p}`).join('; ')
+      : 'not found in package bundle, project, or installed skill');
+
+  // 5. Config ping: parseable, three distinct callable models. A duplicate
+  // model here is a review that will BLOCK later — say so now.
+  const cfgPath = configPath || path.join(process.cwd(), '.delphi-config.json');
+  if (!fs.existsSync(cfgPath)) {
+    add('Delphi config (.delphi-config.json)', 'FAIL',
+      `${cfgPath} not found (copy .delphi-config.json.example from the skill directory)`);
+  } else {
+    try {
+      const raw = JSON.parse(fs.readFileSync(cfgPath, 'utf8'));
+      const profileName = raw.active_profile || 'default';
+      const profile = raw.profiles && raw.profiles[profileName];
+      if (!profile) {
+        add('Delphi config (.delphi-config.json)', 'FAIL', `profile "${profileName}" not found`);
+      } else {
+        const experts = profile.experts || {};
+        const models = roles.map((r) => experts[r] && experts[r].model);
+        const providers = profile.providers || {};
+        const missingRoles = roles.filter((r, i) => !models[i]);
+        const duplicates = models.filter((m, i) => m && models.indexOf(m) !== i);
+        const badProviders = roles.filter((r) => {
+          const e = experts[r];
+          return !e || !providers[e.provider]
+            || !providers[e.provider].base_url
+            || String(providers[e.provider].base_url).indexOf('http') !== 0;
+        });
+        if (missingRoles.length > 0 || duplicates.length > 0 || badProviders.length > 0) {
+          const problems = [];
+          if (missingRoles.length > 0) problems.push(`missing experts: ${missingRoles.join(', ')}`);
+          if (duplicates.length > 0) problems.push(`duplicate models: ${[...new Set(duplicates)].join(', ')}`);
+          if (badProviders.length > 0) problems.push(`unusable provider binding: ${badProviders.join(', ')}`);
+          add('Delphi config (.delphi-config.json)', 'FAIL', problems.join('; '));
+        } else {
+          add('Delphi config (.delphi-config.json)', 'PASS',
+            `profile "${profileName}": ${models.join(' / ')}`);
+        }
+      }
+    } catch (err) {
+      add('Delphi config (.delphi-config.json)', 'FAIL', `unparseable: ${err.message}`);
+    }
+  }
+
+  // 6. Version consistency (#414 REQ-6): local files first. The npm-latest
+  // probe is opt-in (options.probeNpmLatest) or pre-supplied
+  // (options.npmLatest) — the doctor never blocks on the network, which is
+  // what an offline CI or restricted shell would otherwise hit (#414 R1 FC-03).
+  const localVersion = getCliVersionSafe();
+  let versionStatus = 'PASS';
+  let versionDetail = `xp-gate ${localVersion}`;
+  if (npmLatest === undefined && options.probeNpmLatest === true) {
+    try {
+      versionDetail += `; npm latest probe: ${execWithTimeout('npm view @boyingliu01/xp-gate version', 8000).trim()}`;
+    } catch {
+      versionStatus = 'SKIP';
+      versionDetail += '; npm latest probe unavailable (offline?) — skipped';
+    }
+  } else if (typeof npmLatest === 'string' && npmLatest !== localVersion) {
+    versionStatus = 'FAIL';
+    versionDetail += `; npm latest ${npmLatest} differs from local ${localVersion} — update (npm install -g @boyingliu01/xp-gate@latest) or verify which side is stale`;
+  } else if (npmLatest === null || options.probeNpmLatest !== true) {
+    versionDetail += '; npm latest probe skipped (pass --npm-check or options.probeNpmLatest to run it)';
+  }
+  add('Delphi version consistency', versionStatus, versionDetail);
+
+  // 7. DSH native-channel readiness (#443 REQ-6): only meaningful when a DSH
+  // home exists. The two-layer switch (preset capability + host setting)
+  // defaults to disabled, and a review that assumes native will silently run
+  // three same-model seats.
+  const dshHome = path.join(HOME_DIR, '.dsh');
+  if (!fs.existsSync(dshHome)) {
+    add('DSH subagent model selection', 'SKIP', `no ${dshHome} — not a DSH environment`);
+  } else {
+    const settingsCandidates = [
+      path.join(dshHome, 'settings.json'),
+      path.join(dshHome, 'settings', 'settings.json'),
+      path.join(dshHome, 'config.json'),
+    ];
+    const settingsFile = settingsCandidates.find((p) => fs.existsSync(p));
+    if (!settingsFile) {
+      add('DSH subagent model selection', 'FAIL',
+        `${dshHome} exists but no settings file found — subagent model selection defaults to disabled (#443)`);
+    } else {
+      try {
+        const settings = JSON.parse(fs.readFileSync(settingsFile, 'utf8'));
+        const selection = settings.subagentModelSelection;
+        const allowed = selection && Array.isArray(selection.allowedModels) ? selection.allowedModels : [];
+        const ids = allowed.map((m) => (typeof m === 'string' ? m : m && m.id)).filter(Boolean);
+        if (selection && selection.enabled === true && new Set(ids).size >= 3) {
+          add('DSH subagent model selection', 'PASS', `${settingsFile}: enabled, ${new Set(ids).size} distinct allowed models`);
+        } else if (selection && selection.enabled === true) {
+          add('DSH subagent model selection', 'FAIL',
+            `${settingsFile}: enabled but only ${new Set(ids).size} distinct allowedModels (need ≥3) — native channel unusable`);
+        } else {
+          // The switch shipping off is the platform default, not a defect:
+          // only an operator who explicitly enables it and under-provisions
+          // allowedModels has a real misconfiguration (#414 R1 FC-07).
+          add('DSH subagent model selection', 'SKIP',
+            `${settingsFile}: native model selection disabled (platform default) — the external channel is the contract path (#443)`);
+        }
+      } catch (err) {
+        add('DSH subagent model selection', 'SKIP', `${settingsFile} unparseable: ${err.message}`);
+      }
+    }
+  }
+
+  for (const check of checks) {
+    const mark = check.status === 'PASS' ? '✓' : check.status === 'SKIP' ? '○' : '✗';
+    console.log(`  ${mark} ${check.name}: ${check.detail || check.status}`);
+  }
+  const failed = checks.filter((c) => c.status === 'FAIL').length;
+  console.log('');
+  console.log(failed === 0
+    ? '  Delphi review chain: healthy.'
+    : `  Delphi review chain: ${failed} check(s) FAILED.`);
+  return failed === 0 ? 0 : 1;
+}
+
+function getCliVersionSafe() {
+  try {
+    return require('../package.json').version || '0.0.0';
+  } catch {
+    return '0.0.0';
+  }
+}
+
 module.exports = {
-  doctor, isXpGateFile, SIGNATURES,
+  doctor, doctorDelphi, isXpGateFile, SIGNATURES,
   fixVersionMismatch,
   fixTemplateDirMismatch,
   fixMissingHooks,

package/lib/init.js

@@ -922,4 +922,7 @@ function injectKarpathyPrinciples(projectRoot) {
   }
 }
 
-module.exports = { init, promptBootstrap, installModuleRuntimeDeps, deployQoderDelphiAgents, configureQoderDelphiAgents, readQoderModelId };
+// setupGlobal is exported so the global-install wiring (agents deployed to the
+// real HOME) can be audited under a sandboxed HOME, not just asserted to exist
+// — the historical miss was "local deployed, global did not" (#417, #429).
+module.exports = { init, promptBootstrap, installModuleRuntimeDeps, deployQoderDelphiAgents, configureQoderDelphiAgents, readQoderModelId, setupGlobal };

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-14T05:31:48.350Z",
+  "checked_at": "2026-10-14T09:00:41.434Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.21.0",
+  "version": "0.24.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/.delphi-config.json.example

@@ -66,5 +66,28 @@
     "max_review_rounds": 5,
     "distinct_models_required": true,
     "cross_provider_required": true
-  }
+  },
+
+  "$comment_seat_fields": [
+    "Optional per-seat fields (#481). The prompt ceiling is a seat x model route",
+    "property, not a global constant: max_prompt_bytes (UTF-8 bytes, default 40000)",
+    "is the hard pre-send gate; prompt_calibration carries the measured bounds used",
+    "to classify a pre-response drop as SIZE_EXCEEDED instead of a network fault.",
+    "Recalibrate (binary search 3-5 probes in [last_pass, last_fail]) whenever the",
+    "model or gateway changes. See docs/plans/2026-10-14-sprint-c-design.md section 2.",
+    "Example expert entry:",
+    "  \"architecture\": {",
+    "    \"provider\": \"bailian-tp\",",
+    "    \"model\": \"qwen-plus\",",
+    "    \"seat_id\": \"architecture\",",
+    "    \"max_prompt_bytes\": 26624,",
+    "    \"prompt_calibration\": {",
+    "      \"measured_at\": \"2026-10-05\",",
+    "      \"model_id\": \"qwen-plus\",",
+    "      \"gateway\": \"bailian\",",
+    "      \"last_pass_bytes\": 26624,",
+    "      \"last_fail_bytes\": 36897",
+    "    }",
+    "  }"
+  ]
 }

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/delphi-review/SKILL.md

@@ -329,6 +329,15 @@ Each round MUST output a structured round marker:
 
 #### Qoder 平台（Custom Agent 模式 — 只能做到同模型三角色）
 
+**通道契约（native-first + external fallback，#414）**：每轮评审开始先探测 native 通道——三个 Custom Agent（`delphi-architecture/technical/feasibility`）是否存在且绑定互异（`xp-gate doctor delphi` 一条命令给出全部判定）。但 **native 通道已被实测证伪**（见下）：subagent 派发采纳 agent 提示词、丢弃 model 绑定，三席永远是会话模型。因此 Qoder 的通道决策表实际收敛为：
+
+| 探测结果 | 通道 | 处置 |
+|---|---|---|
+| 需要 distinct-models 证据的评审 | **external** | `.delphi-config.json` + `scripts/delphi-external-review.cjs`（外部 provider 三模型） |
+| 仅需同模型三角色自查（不计入共识证据） | native | 三 Custom Agent 并行，报告中注明「同模型自查，不构成多模型凭据」 |
+
+降级证据落盘 `delphi-reviewed.json`：`channel`（native/external）、`fallback_reason`（如 `qoder_native_drops_model_binding`）、`probe_evidence`（doctor/日志摘录）。两通道同不变量：三专家齐全、`requested_model` 互异（external）、consensus ≥90%、**无单专家路径**。
+
 Qoder 的内置模型**没有本地推理端点**：推理请求由 Qoder 客户端经服务端代理发出，凭证是一次性 job token。所以不能照搬 OpenCode 的 `base_url + api_key` 直连方式；Qoder 侧内置模型的唯一入口是 **Custom Agent** —— 每个专家一个独立 agent 文件，frontmatter 用 `model` 字段声明模型。
 
 **契约结论（先说结论）**：这条路径**不满足**"三个不同可执行模型 ID"契约。2026-09-23 做过一次排除混杂因素的复测：先把 `~/.qoder/agents/delphi-*.md` 三份文件绑成三个不同的 0.1× 内置模型（`qfmodel` / `dfmodel` / `gfmodel`；架构角与会话模型同名，所以真正有判别力的是技术角与可行性角），**再**新开会话——新 CLI 进程，`session.config.loaded` 记录 `model: "qfmodel"`，注册表加载的必然是已修好的绑定——然后只派发三个 subagent，各回一句话、不调工具。结果：三个独立的 `is_subagent: true` turn，`turn.started` / `model.request.started` / `model.response.completed` 三处的 `model` 全为会话模型 `qfmodel`，`dfmodel` / `gfmodel` 出现 0 次；同时三份回复分别命中架构 / 技术 / 可行性视角，说明角色提示词确实生效、agent 也确实被加载。即 `subagent_type` 派发路径采纳 Custom Agent 的提示词，但**丢弃**它的 `model` 绑定。
@@ -408,6 +417,20 @@ delphi-review(
 > (1) `dsh-tool-subagent` 的 `modelSelectionSettings: true`（仅能力开关），
 > (2) 宿主设置 `SubagentModelSelectionConfig.enabled = true` 且 `allowedModels` ≥3 个不同模型。
 > 该路线依赖宿主配置，CI / 一次性会话不可靠，故不作为默认路径。
+
+**DSH 双通道契约（native-first + external fallback，#443）**：评审开始先探测 native 通道，两层开关缺一不可——
+
+| 探测步骤 | 方法 | 判定 |
+|---|---|---|
+| ① 工具 schema | 当前会话 `subagent` 工具的参数里是否暴露 `provider` / `model` 字段 | 无 → native 不可用（`enabled` 默认 `false`） |
+| ② 模型清单 | `list_subagent_models` 工具是否注册；可用时返回条数是否 ≥3 且互异 | 未注册或 <3 条 → native 不可用 |
+| ③ 运行时兜底 | 上述任一不满足时调用 subagent 会抛 `child model selection is disabled` | 直接判定，不试错 |
+
+- **native 可用**：三个专家并行派发，每个显式传 `model`（取自 `allowedModels` 三个互异条目）；`resolved_model` 以平台日志/回执为准，无日志时按 #437 过渡标准注明「执行层验证待平台支持」。
+- **native 不可用**：降级 **external**（本 skill 的 `delphi-review` 插件工具，或 `.delphi-config.json` + `scripts/delphi-external-review.cjs`）。缺 API key 时必须给出明确指引（导出环境变量），不得静默失败。
+- 降级证据落盘 `delphi-reviewed.json`：`channel`、`fallback_reason`（如 `dsh_subagent_model_selection_disabled`）、`probe_evidence`（①②③ 的实测摘录）。
+- 两通道同不变量：三专家齐全、`requested_model` 互异、consensus ≥90%、**无单专家路径**。
+- 可用性探测可用 `xp-gate doctor delphi` 复核（DSH 环境下含 `subagentModelSelection` 持久化设置检查）。
 #### WorkBuddy 平台（Expert 团队模式）
 
 WorkBuddy 侧以 Team 型专家团（示例：`delphi-review-team`，安装在 `~/.workbuddy/plugins/marketplaces/my-experts/plugins/`，创建方式见 [docs/platform-workbuddy.md](../../docs/platform-workbuddy.md)）承载评审，触发本技能后按此路由执行：
@@ -432,6 +455,26 @@ WorkBuddy 侧以 Team 型专家团（示例：`delphi-review-team`，安装在 `
 
 **成本**：3 专家合计 x0.17/轮；主理人选 local 会话模型则零 credits。
 
+### 席位 prompt 上限与降序裁剪（强制 — #481）
+
+prompt 字节上限是 **席位×模型路由 属性**，不是全局安全值（2026-10-05 实测：同一网关下
+`g-glm-5.3-flash` 席 32-39KB 连续 6 次断连，他席 36KB 一次通过）。编排规则：
+
+1. **发送前硬闸**：runner 按 expert 条目的 `max_prompt_bytes`（默认 40000 字节，UTF-8 计）
+   拒发超限请求，输出 `error_type: "prompt_budget_exceeded"`。
+2. **失败分类**：响应前断连且字节数超过该席位标定的 `last_pass_bytes` →
+   `error_type: "SIZE_EXCEEDED"`（不是网络故障，重试同一 payload 无意义）；
+   其余失败输出 `network_error` / `retryable_error`，编排层按 `error_type` 字段断言，不解析散文。
+3. **超限时按降序裁剪，每步只做一步**：
+   ① 去附录（探针填充、日志附录、非必需长引用）→ ② 去非本轮 AC 原文 →
+   ③ 去测试清单（枚举 → 计数）→ ④ 拆分两次调用（按 diff 对半，同报告合并）→
+   ⑤ 仍失败 → `PROCESS_BLOCK` 交人裁定。**不得以两席结果冒充 3/3 共识。**
+4. **标定**：上限按「固定语义核心 + 确定性填充附录」构造探针，在
+   `[last_pass, last_fail]` 区间二分 3-5 次测得；记录行含
+   `seat_id × model_id × gateway × max_passing_bytes × measured_at`；
+   模型或网关变更即重标。协议全文与种子标定表见
+   [docs/plans/2026-10-14-sprint-c-design.md](../../docs/plans/2026-10-14-sprint-c-design.md) §2。
+
 ### 共识阈值
 
 | 阈值 | 说明 |

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.21.0",
+  "version": "0.24.0",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/.delphi-config.json.example

@@ -66,5 +66,28 @@
     "max_review_rounds": 5,
     "distinct_models_required": true,
     "cross_provider_required": true
-  }
+  },
+
+  "$comment_seat_fields": [
+    "Optional per-seat fields (#481). The prompt ceiling is a seat x model route",
+    "property, not a global constant: max_prompt_bytes (UTF-8 bytes, default 40000)",
+    "is the hard pre-send gate; prompt_calibration carries the measured bounds used",
+    "to classify a pre-response drop as SIZE_EXCEEDED instead of a network fault.",
+    "Recalibrate (binary search 3-5 probes in [last_pass, last_fail]) whenever the",
+    "model or gateway changes. See docs/plans/2026-10-14-sprint-c-design.md section 2.",
+    "Example expert entry:",
+    "  \"architecture\": {",
+    "    \"provider\": \"bailian-tp\",",
+    "    \"model\": \"qwen-plus\",",
+    "    \"seat_id\": \"architecture\",",
+    "    \"max_prompt_bytes\": 26624,",
+    "    \"prompt_calibration\": {",
+    "      \"measured_at\": \"2026-10-05\",",
+    "      \"model_id\": \"qwen-plus\",",
+    "      \"gateway\": \"bailian\",",
+    "      \"last_pass_bytes\": 26624,",
+    "      \"last_fail_bytes\": 36897",
+    "    }",
+    "  }"
+  ]
 }

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/delphi-review/SKILL.md

@@ -329,6 +329,15 @@ Each round MUST output a structured round marker:
 
 #### Qoder 平台（Custom Agent 模式 — 只能做到同模型三角色）
 
+**通道契约（native-first + external fallback，#414）**：每轮评审开始先探测 native 通道——三个 Custom Agent（`delphi-architecture/technical/feasibility`）是否存在且绑定互异（`xp-gate doctor delphi` 一条命令给出全部判定）。但 **native 通道已被实测证伪**（见下）：subagent 派发采纳 agent 提示词、丢弃 model 绑定，三席永远是会话模型。因此 Qoder 的通道决策表实际收敛为：
+
+| 探测结果 | 通道 | 处置 |
+|---|---|---|
+| 需要 distinct-models 证据的评审 | **external** | `.delphi-config.json` + `scripts/delphi-external-review.cjs`（外部 provider 三模型） |
+| 仅需同模型三角色自查（不计入共识证据） | native | 三 Custom Agent 并行，报告中注明「同模型自查，不构成多模型凭据」 |
+
+降级证据落盘 `delphi-reviewed.json`：`channel`（native/external）、`fallback_reason`（如 `qoder_native_drops_model_binding`）、`probe_evidence`（doctor/日志摘录）。两通道同不变量：三专家齐全、`requested_model` 互异（external）、consensus ≥90%、**无单专家路径**。
+
 Qoder 的内置模型**没有本地推理端点**：推理请求由 Qoder 客户端经服务端代理发出，凭证是一次性 job token。所以不能照搬 OpenCode 的 `base_url + api_key` 直连方式；Qoder 侧内置模型的唯一入口是 **Custom Agent** —— 每个专家一个独立 agent 文件，frontmatter 用 `model` 字段声明模型。
 
 **契约结论（先说结论）**：这条路径**不满足**"三个不同可执行模型 ID"契约。2026-09-23 做过一次排除混杂因素的复测：先把 `~/.qoder/agents/delphi-*.md` 三份文件绑成三个不同的 0.1× 内置模型（`qfmodel` / `dfmodel` / `gfmodel`；架构角与会话模型同名，所以真正有判别力的是技术角与可行性角），**再**新开会话——新 CLI 进程，`session.config.loaded` 记录 `model: "qfmodel"`，注册表加载的必然是已修好的绑定——然后只派发三个 subagent，各回一句话、不调工具。结果：三个独立的 `is_subagent: true` turn，`turn.started` / `model.request.started` / `model.response.completed` 三处的 `model` 全为会话模型 `qfmodel`，`dfmodel` / `gfmodel` 出现 0 次；同时三份回复分别命中架构 / 技术 / 可行性视角，说明角色提示词确实生效、agent 也确实被加载。即 `subagent_type` 派发路径采纳 Custom Agent 的提示词，但**丢弃**它的 `model` 绑定。
@@ -408,6 +417,20 @@ delphi-review(
 > (1) `dsh-tool-subagent` 的 `modelSelectionSettings: true`（仅能力开关），
 > (2) 宿主设置 `SubagentModelSelectionConfig.enabled = true` 且 `allowedModels` ≥3 个不同模型。
 > 该路线依赖宿主配置，CI / 一次性会话不可靠，故不作为默认路径。
+
+**DSH 双通道契约（native-first + external fallback，#443）**：评审开始先探测 native 通道，两层开关缺一不可——
+
+| 探测步骤 | 方法 | 判定 |
+|---|---|---|
+| ① 工具 schema | 当前会话 `subagent` 工具的参数里是否暴露 `provider` / `model` 字段 | 无 → native 不可用（`enabled` 默认 `false`） |
+| ② 模型清单 | `list_subagent_models` 工具是否注册；可用时返回条数是否 ≥3 且互异 | 未注册或 <3 条 → native 不可用 |
+| ③ 运行时兜底 | 上述任一不满足时调用 subagent 会抛 `child model selection is disabled` | 直接判定，不试错 |
+
+- **native 可用**：三个专家并行派发，每个显式传 `model`（取自 `allowedModels` 三个互异条目）；`resolved_model` 以平台日志/回执为准，无日志时按 #437 过渡标准注明「执行层验证待平台支持」。
+- **native 不可用**：降级 **external**（本 skill 的 `delphi-review` 插件工具，或 `.delphi-config.json` + `scripts/delphi-external-review.cjs`）。缺 API key 时必须给出明确指引（导出环境变量），不得静默失败。
+- 降级证据落盘 `delphi-reviewed.json`：`channel`、`fallback_reason`（如 `dsh_subagent_model_selection_disabled`）、`probe_evidence`（①②③ 的实测摘录）。
+- 两通道同不变量：三专家齐全、`requested_model` 互异、consensus ≥90%、**无单专家路径**。
+- 可用性探测可用 `xp-gate doctor delphi` 复核（DSH 环境下含 `subagentModelSelection` 持久化设置检查）。
 #### WorkBuddy 平台（Expert 团队模式）
 
 WorkBuddy 侧以 Team 型专家团（示例：`delphi-review-team`，安装在 `~/.workbuddy/plugins/marketplaces/my-experts/plugins/`，创建方式见 [docs/platform-workbuddy.md](../../docs/platform-workbuddy.md)）承载评审，触发本技能后按此路由执行：
@@ -432,6 +455,26 @@ WorkBuddy 侧以 Team 型专家团（示例：`delphi-review-team`，安装在 `
 
 **成本**：3 专家合计 x0.17/轮；主理人选 local 会话模型则零 credits。
 
+### 席位 prompt 上限与降序裁剪（强制 — #481）
+
+prompt 字节上限是 **席位×模型路由 属性**，不是全局安全值（2026-10-05 实测：同一网关下
+`g-glm-5.3-flash` 席 32-39KB 连续 6 次断连，他席 36KB 一次通过）。编排规则：
+
+1. **发送前硬闸**：runner 按 expert 条目的 `max_prompt_bytes`（默认 40000 字节，UTF-8 计）
+   拒发超限请求，输出 `error_type: "prompt_budget_exceeded"`。
+2. **失败分类**：响应前断连且字节数超过该席位标定的 `last_pass_bytes` →
+   `error_type: "SIZE_EXCEEDED"`（不是网络故障，重试同一 payload 无意义）；
+   其余失败输出 `network_error` / `retryable_error`，编排层按 `error_type` 字段断言，不解析散文。
+3. **超限时按降序裁剪，每步只做一步**：
+   ① 去附录（探针填充、日志附录、非必需长引用）→ ② 去非本轮 AC 原文 →
+   ③ 去测试清单（枚举 → 计数）→ ④ 拆分两次调用（按 diff 对半，同报告合并）→
+   ⑤ 仍失败 → `PROCESS_BLOCK` 交人裁定。**不得以两席结果冒充 3/3 共识。**
+4. **标定**：上限按「固定语义核心 + 确定性填充附录」构造探针，在
+   `[last_pass, last_fail]` 区间二分 3-5 次测得；记录行含
+   `seat_id × model_id × gateway × max_passing_bytes × measured_at`；
+   模型或网关变更即重标。协议全文与种子标定表见
+   [docs/plans/2026-10-14-sprint-c-design.md](../../docs/plans/2026-10-14-sprint-c-design.md) §2。
+
 ### 共识阈值
 
 | 阈值 | 说明 |

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-13
-**Commit:** 05a08fcf
+**Generated:** 2026-10-14
+**Commit:** e466ce16
 **Branch:** main
-**Version:** 0.21.0.0
+**Version:** 0.24.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.21.0",
+  "version": "0.24.0",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",