@godv61/dsh-task-engine 0.27.0 → 0.27.1

package/.acceptance.mjs

@@ -42,9 +42,14 @@ check('选流程不产生绑定', Object.keys(resolveFlow('standard', { flow: 's
 
 console.log('')
 console.log('=== 3. 采用后完全可编辑、可删除 ===')
-for (const id of ['standard', 'agile', 'minimal']) {
-  const adopted = adoptRecommendation(id)
-  check(`${id} 采用后带推荐技能`, Object.keys(adopted.stage_bindings ?? {}).length > 0)
+for (const id of ['standard', 'agile', 'minimal']) {
+  const adopted = adoptRecommendation(id)
+  check(`${id} 采用后仍不绑定业务技能`, Object.keys(adopted.stage_bindings ?? {}).length === 0)
+  const retained = adoptRecommendation(id, { flow: id, stage_bindings: {
+    开发: { skill_refs: [{ source: 'project', name: 'mine' }] },
+  } })
+  check(`${id} 采用推荐文本时保留用户技能`, retained.stage_bindings.开发.skill_refs[0].name === 'mine')
+  if (id !== 'minimal') check(`${id} 推荐提交文本实际写入`, retained.commit.message_pattern !== '')
   const replaced = resolveFlow(id, { ...adopted, stage_bindings: {} }).config
   check(`${id} 清空后为空（不补回）`, Object.keys(replaced.stage_bindings ?? {}).length === 0)
   const mine = resolveFlow(id, {
@@ -101,13 +106,13 @@ for (const id of ['standard', 'agile', 'minimal']) {
 }
 
 console.log('')
-console.log('=== 7. defaults/eng.json 是采用后的配置示例 ===')
+console.log('=== 7. defaults/eng.json 是空绑定配置示例 ===')
 const doc = JSON.parse(readFileSync('defaults/eng.json', 'utf8'))
 const merged = resolveFlow(doc.flow, doc)
 check('defaults/eng.json 可解析', merged.ok)
 if (merged.ok) {
   check('defaults/eng.json 无验证问题', validateWorkflow(merged.config).length === 0)
-  check('defaults/eng.json 含技能（是采用后的样子）', Object.keys(merged.config.stage_bindings ?? {}).length > 0)
+  check('defaults/eng.json 不含技能', Object.keys(merged.config.stage_bindings ?? {}).length === 0)
 }
 
 console.log('')
@@ -148,4 +153,4 @@ check('三者范围互不相同', new Set([r.join(), s.join(), d.join()]).size =
 
 console.log('')
 console.log(failures === 0 ? '✅ 全部验收项通过' : `❌ ${failures} 项未通过`)
-process.exit(failures === 0 ? 0 : 1)
+process.exit(failures === 0 ? 0 : 1)

package/.assessment-batch1.mjs

@@ -320,16 +320,18 @@ test('batch3: the same skill carries identical rules wherever it is bound', () =
 test('batch3: a rule shared by two skills is one resource, referenced twice', () => {
   // Reuse must not duplicate the rule body: two skills referencing one rule point
   // at the same source-qualified reference.
-  const config = adoptedFlow('standard')
-  const review = config.stage_bindings['代码审核'].skills
-  const reviewRules = review.find(entry => entry.skill.name === 'code-review').rules.map(formatResourceRef)
-  const implementRules = config.stage_bindings['开发'].skills
-    .find(entry => entry.skill.name === 'code-implement').rules.map(formatResourceRef)
+  const sharedRule = { source: 'project', name: 'shared-rule' }
+  const config = resolveFlow('standard', { flow: 'standard', stage_bindings: {
+    '开发': { skills: [{ skill: { source: 'project', name: 'implement' }, rules: [sharedRule] }] },
+    '代码审核': { skills: [{ skill: { source: 'project', name: 'review' }, rules: [sharedRule] }] },
+  } }).config
+  const reviewRules = config.stage_bindings['代码审核'].skills[0].rules.map(formatResourceRef)
+  const implementRules = config.stage_bindings['开发'].skills[0].rules.map(formatResourceRef)
   const shared = reviewRules.filter(rule => implementRules.includes(rule))
   assert.ok(shared.length > 0,
     'coding-conventions and security-redlines apply to both implementing and reviewing code, so at least one rule must be shared by reference')
-  assert.ok(shared.includes('bundled:security-redlines'),
-    `security-redlines is the clear shared case; saw ${JSON.stringify(shared)}`)
+  assert.ok(shared.includes('project:shared-rule'),
+    `the shared project rule is one reference; saw ${JSON.stringify(shared)}`)
 })
 
 test('batch3: legacy stage-level rules stay in force and are named as unassigned', async () => {
@@ -337,16 +339,17 @@ test('batch3: legacy stage-level rules stay in force and are named as unassigned
   // invent an answer the config never had; dropping them would lose a constraint.
   const f = fixture('standard', '开发', {}, {})
   const state = f.state()
-  state.flow.config.stage_bindings = { 开发: { skills: [], legacy_rules: ['security-redlines'] } }
+  state.flow.config.stage_bindings = { 开发: { skills: [], legacy_rules: ['shared-rule'] } }
+  f.records.set(join(f.cwd, '.dsh/rules/shared-rule.md'), '# shared legacy rule')
   f.records.set(join(f.cwd, '.dsh/task-LIVE-1.json'), JSON.stringify(state))
   const status = JSON.parse(await f.call({ operation: 'status' }))
   assert.ok(
-    (status.unassigned_legacy_rules ?? []).includes('security-redlines'),
+    (status.unassigned_legacy_rules ?? []).includes('shared-rule'),
     `the legacy rule must be reported as unassigned; saw ${JSON.stringify(status.unassigned_legacy_rules)}`,
   )
   // Still enforced: it resolves and appears among the rules in force.
   assert.ok(
-    (status.rules ?? []).some(rule => rule.name === 'security-redlines'),
+    (status.rules ?? []).some(rule => rule.name === 'shared-rule'),
     `a legacy rule must keep applying; saw ${JSON.stringify(status.rules)}`,
   )
 })
@@ -420,4 +423,4 @@ test('P2: an unknown review_depth is a configuration error, not a silent downgra
   const problems = validateWorkflow(config)
   assert.ok(problems.some(p => /review_depth/u.test(p)),
     `a typo must be reported; saw ${JSON.stringify(problems)}`)
-})
+})

package/.codex-project-test.mjs

@@ -0,0 +1,80 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve, sep } from 'node:path'
+import Controller from './lib/controller.js'
+import { registerDevTask } from './lib/dev-task.js'
+import { loadedSkills, skillBlockers } from './lib/skill-audit.js'
+import { resolveFlow } from './lib/workflows.js'
+import { validateWorkflow } from './lib/engine.js'
+
+function fixture(t) {
+  const root = mkdtempSync(join(tmpdir(), 'dsh-codex-project-'))
+  assert.ok(resolve(root).startsWith(resolve(tmpdir()) + sep))
+  t.after(() => rmSync(root, { recursive: true, force: true }))
+  return root
+}
+function put(path, body) {
+  mkdirSync(dirname(path), { recursive: true })
+  writeFileSync(path, body)
+}
+function diskFs() {
+  return {
+    resolve: async (path, options) => resolve(options?.cwd ?? '', path),
+    readText: async path => { try { return readFileSync(path, 'utf8') } catch { return undefined } },
+    lstat: async (path, options) => { try { return { version: String(statSync(resolve(options?.cwd ?? '', path)).mtimeMs) } } catch { return undefined } },
+    writeText: async (path, body) => put(path, body),
+    listDir: async path => readdirSync(path, { withFileTypes: true }).map(entry => ({ name: entry.name })),
+  }
+}
+
+test('Codex project Skills are discovered separately; new DSH Skills stay in .dsh', async t => {
+  const root = fixture(t)
+  const body = '---\nname: same\ndescription: Codex method\n---\nCodex body v1\n'
+  put(join(root, '.agents/skills/same/SKILL.md'), body)
+  put(join(root, '.dsh/skills/same/SKILL.md'), '---\nname: same\ndescription: DSH method\n---\nDSH body\n')
+  const receiver = { authorizedPath: async path => path }
+  const catalog = await Controller.prototype.listSkills.call(receiver, root)
+  assert.deepEqual(catalog.skills.filter(skill => skill.name === 'same').map(skill => skill.ref.source).sort(), ['codex-project', 'project'])
+  const read = await Controller.prototype.readSkill.call(receiver, { level: 'codex-project', name: 'same', path: root })
+  assert.equal(read.content, 'Codex body v1')
+  const created = await Controller.prototype.writeSkill.call(receiver, { level: 'project', name: 'new-one', description: 'New DSH method', whenToUse: '', content: 'body', path: root })
+  assert.equal(created.ok, true)
+  assert.equal(readFileSync(join(root, '.dsh/skills/new-one/SKILL.md'), 'utf8').includes('body'), true)
+})
+
+test('a bound Codex Skill loads its attached DSH Rule and reads edits next time', async t => {
+  const root = fixture(t)
+  const skillFile = join(root, '.agents/skills/sample/SKILL.md')
+  const ruleFile = join(root, '.dsh/rules/shared.md')
+  put(skillFile, '---\nname: sample\ndescription: Sample\n---\nSkill v1\n')
+  put(ruleFile, 'Rule v1')
+  const ref = { source: 'codex-project', name: 'sample' }
+  const rule = { source: 'project', name: 'shared' }
+  const project = { flow: 'minimal', stage_bindings: { '开发': { skill_refs: [ref] } }, skill_profiles: { 'codex-project:sample': { rules: [rule], evidence: 'none' } } }
+  put(join(root, '.dsh/eng.json'), JSON.stringify(project))
+  assert.deepEqual(validateWorkflow(resolveFlow('minimal', project).config), [])
+  const fs = diskFs(), tools = []
+  registerDevTask({ fs, tools: { register(tool) { tools.push(tool) } }, get() { return undefined } })
+  const execute = tools[0].execute
+  const events = []
+  const session = { id: 'test-session', header: { cwd: root }, snapshotEvents: () => events }
+  const run = (args, callId = 'call') => execute(args, { agent: { session }, callId, signal: undefined })
+  await run({ operation: 'create', task_id: 'T1', title: 'Test', branch: 'main' })
+  const first = await run({ operation: 'load_skill', task_id: 'T1', skill_name: 'codex-project:sample' }, 'load-1')
+  assert.match(first, /Skill v1/)
+  assert.match(first, /Rule v1/)
+  events.push({ type: 'tool/call', data: { name: 'dev_task', callId: 'load-1', arguments: JSON.stringify({ operation: 'load_skill', task_id: 'T1', skill_name: 'codex-project:sample' }) } })
+  events.push({ type: 'tool/result', data: { message: { content: [{ type: 'tool-result', toolCallId: 'load-1', isError: false }] } } })
+  assert.equal(loadedSkills(session).get('T1#codex-project:sample'), 'load-1')
+  const state = JSON.parse(readFileSync(join(root, '.dsh/task-T1.json'), 'utf8'))
+  assert.deepEqual(skillBlockers(state, state.flow.config, session), [])
+  assert.match(skillBlockers({ ...state, id: 'T2' }, state.flow.config, session).join('; '), /load_skill/,
+    'loading a Skill for one task must not satisfy another task with a different Rule profile')
+  put(skillFile, '---\nname: sample\ndescription: Sample\n---\nSkill v2\n')
+  put(ruleFile, 'Rule v2')
+  const second = await run({ operation: 'load_skill', task_id: 'T1', skill_name: 'codex-project:sample' }, 'load-2')
+  assert.match(second, /Skill v2/)
+  assert.match(second, /Rule v2/)
+})

package/.enforce-test.mjs

@@ -15,14 +15,13 @@ import { completionBlockers, terminalRequirements, resourceBlockers } from './li
 async function project() {
   const cwd = resolve('enforce-project')
   const adopted = adoptRecommendation('standard')
-  const skills = adopted.stage_bindings['开发'].skills.map(entry => ({
-    ...entry,
-    rules: [...entry.rules, { source: 'project', name: 'mine' }],
-  }))
+  const skills = [{ skill: { source: 'project', name: 'my-implementation' },
+    rules: [{ source: 'project', name: 'mine' }], evidence: 'none' }]
   const stage_bindings = { ...adopted.stage_bindings, '开发': { skills } }
   const records = new Map([
     [join(cwd, '.dsh/eng.json'), JSON.stringify({ ...adopted, stage_bindings })],
-    [join(cwd, '.dsh/rules/mine.md'), 'RULE'],
+    [join(cwd, '.dsh/rules/mine.md'), 'RULE'],
+    [join(cwd, '.dsh/skills/my-implementation/SKILL.md'), '---\nname: my-implementation\n---\nImplement.'],
     [join(cwd, 'a.js'), 'source'],
   ])
   const events = []

package/.evidence-test.mjs

@@ -24,7 +24,7 @@ function sessionWith(names) {
 /** A standard-flow config with one extra skill on 开发 carrying the given evidence. */
 function withEvidence(evidence) {
   const adopted = adoptRecommendation('standard')
-  const skills = [...adopted.stage_bindings['开发'].skills, { skill: { source: 'project', name: 'doc-skill' }, rules: [], ...(evidence !== undefined ? { evidence } : {}) }]
+  const skills = [{ skill: { source: 'project', name: 'doc-skill' }, rules: [], ...(evidence !== undefined ? { evidence } : {}) }]
   return resolveFlow('standard', { ...adopted, stage_bindings: { ...adopted.stage_bindings, '开发': { skills } } }).config
 }
 
@@ -42,8 +42,8 @@ function state(extra = {}) {
 }
 
 test('evidence: needsSkillReceipt honours a declared non-command kind', () => {
-  // Core skills keep their exemption; a declared kind overrides the default.
-  assert.equal(needsSkillReceipt('code-implement'), false, 'a core skill owes no separate receipt')
+  // No name-based exemption remains; a declared kind overrides the default.
+  assert.equal(needsSkillReceipt('code-implement'), true, 'skill names do not exempt command evidence')
   assert.equal(needsSkillReceipt('doc-skill'), true, 'an undeclared extra skill defaults to a command receipt')
   assert.equal(needsSkillReceipt('doc-skill', 'command'), true)
   assert.equal(needsSkillReceipt('doc-skill', 'artifact'), false)

package/.filter-test.mjs

@@ -83,11 +83,9 @@ test('filter: only-selected combined with a query still keeps what is in force',
   assert.ok(!shown.some(e => e.name === 'code-implement'), 'an unbound non-matching skill is dropped')
 })
 
-test('filter: the shipped catalog is small enough that the default view shows it all', () => {
-  // Sanity: the initial view of a fresh project is the shipped set, unfiltered.
-  const adopted = adoptRecommendation('standard')
-  const resolved = resolveFlow('standard', adopted).config
-  const binding = bindingsForStage('开发', resolved)
-  assert.ok(binding !== undefined, 'the adopted config binds 开发')
-  assert.ok((binding.skills ?? []).length > 0)
-})
+test('filter: a fresh project has no prebound business skill', () => {
+  const adopted = adoptRecommendation('standard')
+  const resolved = resolveFlow('standard', adopted).config
+  const binding = bindingsForStage('开发', resolved)
+  assert.equal(binding, undefined)
+})

package/.freeze-test.mjs

@@ -13,13 +13,23 @@ import { registerDevTask } from './lib/dev-task.js'
 import { hashText } from './lib/snapshot.js'
 
 /** Create one task through the real tool and return its frozen snapshot. */
-async function created(flow) {
-  const cwd = resolve('freeze-project')
-  const records = new Map([
+async function created(flow) {
+  const cwd = resolve('freeze-project')
+  const stage = { standard: '需求评审', agile: '需求', minimal: '开发' }[flow]
+  const shared = { source: 'project', name: 'shared-rule' }
+  const adopted = adoptRecommendation(flow)
+  const project = { ...adopted, stage_bindings: { [stage]: { skills: [
+    { skill: { source: 'project', name: 'first-skill' }, rules: [shared], evidence: 'none' },
+    { skill: { source: 'project', name: 'second-skill' }, rules: [shared], evidence: 'none' },
+  ] } } }
+  const records = new Map([
     // A project that adopted the shipped recommendation, which is what gives it
     // skills and rules to freeze. `{flow}` alone adopts nothing and therefore has
     // nothing to freeze — a legitimate state, but not the one under test.
-    [join(cwd, '.dsh/eng.json'), JSON.stringify(adoptRecommendation(flow))],
+    [join(cwd, '.dsh/eng.json'), JSON.stringify(project)],
+    [join(cwd, '.dsh/skills/first-skill/SKILL.md'), '# First skill'],
+    [join(cwd, '.dsh/skills/second-skill/SKILL.md'), '# Second skill'],
+    [join(cwd, '.dsh/rules/shared-rule.md'), '# Shared rule'],
     [join(cwd, 'a.js'), 'source'],
   ])
   const events = []
@@ -75,13 +85,13 @@ test('freeze: a frozen body carries its content and a hash of that content', asy
 })
 
 test('freeze: shared resources are stored once, not duplicated per reference', async () => {
-  // security-redlines is referenced by two skills; the body must not be copied twice.
+  // One project rule is referenced by two skills; the body is stored once.
   const state = await created('standard')
   const resources = state.flow.resources ?? []
   const hashes = resources.map(r => r.hash)
   assert.equal(new Set(hashes).size, hashes.length,
     'identical bodies must not be stored more than once')
-  assert.ok(resources.some(r => r.ref.name === 'security-redlines'),
+  assert.ok(resources.some(r => r.ref.name === 'shared-rule'),
     'the shared rule must be present')
 })
 
@@ -103,14 +113,13 @@ test('freeze: every preset freezes a complete, non-empty set', async () => {
 async function atDevelopmentWithProjectRule() {
   const cwd = resolve('freeze-live')
   const adopted = adoptRecommendation('standard')
-  const skills = adopted.stage_bindings['开发'].skills.map(entry => ({
-    ...entry,
-    rules: [...entry.rules, { source: 'project', name: 'mine' }],
-  }))
+  const skills = [{ skill: { source: 'project', name: 'my-implementation' },
+    rules: [{ source: 'project', name: 'mine' }], evidence: 'none' }]
   const project = { ...adopted, stage_bindings: { ...adopted.stage_bindings, '开发': { skills } } }
   const records = new Map([
     [join(cwd, '.dsh/eng.json'), JSON.stringify(project)],
-    [join(cwd, '.dsh/rules/mine.md'), 'ORIGINAL RULE'],
+    [join(cwd, '.dsh/rules/mine.md'), 'ORIGINAL RULE'],
+    [join(cwd, '.dsh/skills/my-implementation/SKILL.md'), '# Implementation skill'],
     [join(cwd, 'a.js'), 'source'],
   ])
   let execute

package/.p0-test.mjs

@@ -151,21 +151,21 @@ const emptied = resolveFlow('standard', { flow: 'standard', stage_bindings: { '
 assert(emptied.ok && (emptied.config.stage_bindings['开发'].skills ?? []).length === 0,
   'a project that binds nothing to a stage keeps it empty; nothing is merged back in')
 
-const adopted = adoptedFlow('standard')
-assert(adopted.stage_bindings['开发'].skills.some(entry => entry.skill.name === 'code-implement'),
-  'adopting the recommendation is what supplies the shipped skills')
+const adopted = adoptedFlow('standard')
+assert(Object.keys(adopted.stage_bindings ?? {}).length === 0,
+  'adopting the recommendation does not supply skills')
 
-// And a user who gives a shipped skill their own rule list gets that list — the
+// And a user who gives a project skill their own rule list gets that list — the
 // defect this replaces was that the entry was skipped as a duplicate reference.
 const ownRules = resolveFlow('standard', {
   flow: 'standard',
   stage_bindings: {
-    '开发': { skills: [{ skill: { source: 'bundled', name: 'code-implement' }, rules: [{ source: 'project', name: 'only-mine' }] }] },
+    '开发': { skills: [{ skill: { source: 'project', name: 'my-implementation' }, rules: [{ source: 'project', name: 'only-mine' }] }] },
   },
 }).config
-const implementBinding = ownRules.stage_bindings['开发'].skills.find(entry => entry.skill.name === 'code-implement')
+const implementBinding = ownRules.stage_bindings['开发'].skills.find(entry => entry.skill.name === 'my-implementation')
 assert(implementBinding.rules.length === 1 && implementBinding.rules[0].name === 'only-mine',
-  'a project rule list for a shipped skill is used as given, not discarded as a duplicate')
+  'a project rule list for a project skill is used as given, not discarded as a duplicate')
 
 // ── 4. newTask freezes the snapshot ────────────────────────────────────────
 const snapshot = { flow: 'standard', version: 1, config: adoptedFlow('standard') }
@@ -267,21 +267,20 @@ await assertThrows(
 // is no chain to walk and no shadowing to defend against: the same name in two
 // layers is two distinct resources, and the binding says which one it means.
 {
-  const bundled = readFileSync('./rules/security-redlines.md', 'utf8')
-  assert(bundled.includes('服务端'), 'bundled security-redlines exists as expected')
-  const fs = makeFs({
+  const fs = makeFs({
     // A project file with the same NAME but a different body. Under the old
     // bare-name lookup this would have replaced the bundled rule silently.
     '.dsh/eng.json': JSON.stringify({
       flow: 'standard',
       stage_bindings: {
         '需求评审': { skills: [{
-          skill: { source: 'bundled', name: 'requirement-analysis' },
+          skill: { source: 'project', name: 'requirement-analysis' },
           rules: [{ source: 'project', name: 'security-redlines' }],
         }] },
       },
     }),
-    '.dsh/rules/security-redlines.md': '# 弱化的安全红线，前端校验即可',
+    '.dsh/rules/security-redlines.md': '# 弱化的安全红线，前端校验即可',
+    '.dsh/skills/requirement-analysis/SKILL.md': '# Project requirement analysis',
   })
   const exe = await registered(fs)
   await exe({ operation: 'create', task_id: 'T9', title: 'x', branch: 'main' }, EXEC)
@@ -292,26 +291,24 @@ await assertThrows(
   assert(sec.content.includes('前端校验即可'), 'the PROJECT body is what gets disclosed, because the reference names the project layer')
 }
 
-// ── 11b. a bundled reference keeps resolving the bundled body ───────────────
+// ── 11b. a deleted bundled rule is reported as missing ───────────────────────
 {
   const fs = makeFs({
     '.dsh/eng.json': JSON.stringify({
       flow: 'standard',
       stage_bindings: {
         '需求评审': { skills: [{
-          skill: { source: 'bundled', name: 'requirement-analysis' },
+          skill: { source: 'project', name: 'requirement-analysis' },
           rules: [{ source: 'bundled', name: 'security-redlines' }],
         }] },
       },
     }),
-    '.dsh/rules/security-redlines.md': '# 弱化的安全红线，前端校验即可',
+    '.dsh/rules/security-redlines.md': '# 弱化的安全红线，前端校验即可',
+    '.dsh/skills/requirement-analysis/SKILL.md': '# Project requirement analysis',
   })
   const exe = await registered(fs)
-  await exe({ operation: 'create', task_id: 'T10', title: 'x', branch: 'main' }, EXEC)
-  const status = JSON.parse(await exe({ operation: 'status', task_id: 'T10' }, EXEC))
-  const sec = status.bindings.rules.find(r => r.name === 'security-redlines')
-  assert(sec !== undefined && sec.source === 'bundled', 'a bundled reference resolves to the bundled layer')
-  assert(sec.content.includes('服务端'), 'the bundled body is used, untouched by the same-named project file')
+  await assertThrows(() => exe({ operation: 'create', task_id: 'T10', title: 'x', branch: 'main' }, EXEC),
+    'unreadable', 'a reference to a removed bundled rule fails closed')
 }
 
 // ── 12. session cwd drives every relative path (init regression) ──────────
@@ -602,10 +599,10 @@ function memProbe(files) {
   const exe = await registered(fs)
   await exe({ operation: 'create', task_id: 'FP-1', title: 'x', branch: 'main' }, EXEC)
   const status = JSON.parse(await exe({ operation: 'status', task_id: 'FP-1' }, EXEC))
-  assert(status.bindings_drift === undefined, 'fresh task shows no bindings drift')
-  const record = JSON.parse(fs._files.get('.dsh/task-FP-1.json'))
-  assert(typeof record.bindings_fingerprint === 'string' && record.bindings_fingerprint.length === 64,
-    'create records the bundled-rules fingerprint')
+  assert(status.bindings_drift === undefined, 'fresh task has no bundled-rule drift marker')
+  const record = JSON.parse(fs._files.get('.dsh/task-FP-1.json'))
+  assert(record.bindings_fingerprint === undefined,
+    'create does not record a fingerprint for removed bundled rules')
 }
 
 // ── 26. 0.22-C: multi-language verify command chain + parallel tasks ────────

package/.roundtrip-test.mjs

@@ -88,17 +88,11 @@ test('one user skill profile is shared across workspaces and cannot depend on a
   }
 })
 
-test('recommendation adoption copies each shared bundled rule once and rewrites every reference', () => {
+test('recommendation adoption contains no bundled resources', () => {
   const { config, copies } = materializeBundledReferences(adoptRecommendation('standard'), 'project')
-  assert.equal(copies.filter(copy => copy.kind === 'skill').length, 6)
-  assert.equal(copies.filter(copy => copy.kind === 'rule').length, 3)
-  const refs = Object.values(config.stage_bindings).flatMap(binding => binding.skill_refs)
-  assert.ok(refs.every(ref => ref.source === 'project'))
-  const rules = Object.values(config.skill_profiles).flatMap(profile => profile.rules)
-  assert.ok(rules.every(ref => ref.source === 'project'))
-  const shared = rules.filter(ref => ref.name === 'security-redlines-copy')
-  assert.equal(shared.length, 3)
-  assert.equal(copies.filter(copy => copy.kind === 'rule' && copy.name === 'security-redlines').length, 1)
+  assert.deepEqual(copies, [])
+  assert.deepEqual(config.stage_bindings, {})
+  assert.equal(JSON.stringify(config).includes('bundled:'), false)
   assert.deepEqual(validateWorkflow(resolveFlow('standard', config).config), [])
 })
 
@@ -112,7 +106,7 @@ test('project migration leaves a global user skill profile and its bundled rules
   assert.deepEqual(copies, [])
 })
 
-test('adoption saves editable project copies, preserves edited files on repeat, and leaves legacy bundled configs alone', async () => {
+test('recommendation saves only editable project configuration, without resource copies', async () => {
   const root = mkdtempSync(join(tmpdir(), 'dsh-adopt-'))
   assert.ok(resolve(root).startsWith(resolve(tmpdir()) + sep))
   const fs = {
@@ -126,39 +120,31 @@ test('adoption saves editable project copies, preserves edited files on repeat,
     const first = await Controller.prototype.write.call(receiver,
       { path: root, ...recommended, materialize_bundled: 'project' })
     assert.equal(first.ok, true)
-    assert.equal(first.adoption.created.length, 9)
+    assert.equal(first.adoption.created.length, 0)
     const file = join(root, '.dsh', 'eng.json')
     const saved = JSON.parse(readFileSync(file, 'utf8'))
     assert.equal(JSON.stringify(saved).includes('"bundled"'), false)
-    const shared = join(root, '.dsh', 'rules', 'security-redlines-copy.md')
-    assert.ok(readFileSync(shared, 'utf8').length > 0)
-    writeFileSync(shared, 'user edited shared rule\n')
     const second = await Controller.prototype.write.call(receiver,
       { path: root, ...recommended, materialize_bundled: 'project' })
     assert.equal(second.ok, true)
     assert.equal(second.adoption.created.length, 0)
-    assert.equal(second.adoption.reused.length, 9)
-    assert.equal(readFileSync(shared, 'utf8'), 'user edited shared rule\n')
+    assert.equal(second.adoption.reused.length, 0)
     const loaded = await Controller.prototype.read.call(receiver, root)
     assert.equal(loaded.ok, true)
-    const sharedRefs = Object.values(loaded.config.skill_profiles).flatMap(profile => profile.rules)
-      .filter(rule => rule.name === 'security-redlines-copy')
-    assert.equal(sharedRefs.length, 3)
-    writeFileSync(file, JSON.stringify(compactProjectConfig(recommended)))
-    const legacy = await Controller.prototype.read.call(receiver, root)
-    assert.equal(legacy.ok, true)
-    assert.ok(JSON.stringify(legacy.config).includes('"bundled"'))
+    assert.deepEqual(loaded.config.stage_bindings, {})
   } finally {
     rmSync(root, { recursive: true, force: true })
   }
 })
 
 test('round-trip: stages store references while skill rules have one owner', () => {
-  const adopted = adoptRecommendation('standard')
+  const adopted = { ...adoptRecommendation('standard'), stage_bindings: {
+    '开发': { skill_refs: [{ source: 'project', name: 'my-implementation' }] },
+  }, skill_profiles: { 'project:my-implementation': { rules: [{ source: 'project', name: 'my-rule' }] } } }
   const compact = compactProjectConfig(adopted)
   assert.ok(compact.stage_bindings['开发'].skill_refs.length > 0)
   assert.equal(compact.stage_bindings['开发'].skills, undefined)
-  assert.ok(compact.skill_profiles['bundled:code-implement'].rules.length > 0)
+  assert.ok(compact.skill_profiles['project:my-implementation'].rules.length > 0)
   const readBack = resolveFlow('standard', JSON.parse(JSON.stringify(compact)))
   assert.deepEqual(readBack.config.stage_bindings, resolveFlow('standard', adopted).config.stage_bindings)
   const custom = { flow: 'standard', stage_bindings: {
@@ -177,13 +163,15 @@ test('remote write stores canonical skill profiles and read expands them', async
     writeText: async (_target, text) => { stored = text },
   }
   const receiver = { authorizedPath: async path => path, fs: () => fs }
-  const adopted = adoptRecommendation('standard')
+  const adopted = { ...adoptRecommendation('standard'), stage_bindings: {
+    '开发': { skill_refs: [{ source: 'project', name: 'my-implementation' }] },
+  }, skill_profiles: { 'project:my-implementation': { rules: [{ source: 'project', name: 'my-rule' }] } } }
   const written = await Controller.prototype.write.call(receiver, { path: 'project', ...adopted })
   assert.equal(written.ok, true)
   const onDisk = JSON.parse(stored)
   assert.ok(onDisk.stage_bindings['开发'].skill_refs.length > 0)
   assert.equal(onDisk.stage_bindings['开发'].skills, undefined)
-  assert.ok(onDisk.skill_profiles['bundled:code-implement'].rules.length > 0)
+  assert.ok(onDisk.skill_profiles['project:my-implementation'].rules.length > 0)
   const loaded = await Controller.prototype.read.call(receiver, 'project')
   assert.equal(loaded.ok, true)
   assert.deepEqual(loaded.config.stage_bindings, written.config.stage_bindings)

package/.workflow-test.mjs

@@ -309,11 +309,9 @@ test('记录字段来自冻结流程，精简流程不硬编码标准字段，
   assert.deepEqual(JSON.parse(await fixture('设计').call({ operation: 'status' })).artifact_requirements[0].fields, ['approach', 'risks', 'impact'])
 })
 
-test('可选内置技能回执不会因范围变更升级成额外流转门禁', async () => {
-  const f = fixture('需求评审', { artifacts: { requirement: { scope: 'device picker', acceptance_criteria: 'contract and selection' } } })
-  f.load('requirement-analysis')
-  await f.call({ operation: 'skill_result', skill_name: 'requirement-analysis', command: 'check', evidence: ['optional check'] })
-  await f.call({ operation: 'scope', files: ['app.js', 'new-vo.java'] })
+test('空绑定流程不会因范围变更产生额外技能门禁', async () => {
+  const f = fixture('需求评审', { artifacts: { requirement: { scope: 'device picker', acceptance_criteria: 'contract and selection' } } })
+  await f.call({ operation: 'scope', files: ['app.js', 'new-vo.java'] })
   await f.call({ operation: 'advance', target_stage: '设计' })
   assert.equal(f.state().stage, '设计')
 })
@@ -413,12 +411,12 @@ test('同名技能与规则在项目和个人目录各自保留管理入口', as
   assert.match(read.content, /Run tests/)
 })
 
-test('安装包的七个内置技能实际注册且可在资源目录发现', async () => {
+test('安装包只注册会话编排技能，阶段目录不展示它', async () => {
   const registered = []
   registerShippedSkills({ get: name => name === 'skills' ? { register: skill => { registered.push(skill); return () => {} } } : undefined })
-  const expected = ['code-commit', 'code-implement', 'code-review', 'code-verify', 'eng-delivery', 'requirement-analysis', 'solution-design']
+  const expected = ['eng-delivery']
   assert.deepEqual(registered.map(skill => skill.name).sort(), expected)
   assert.ok(registered.every(skill => skill.content.trim().length > 0))
   const catalog = await Controller.prototype.listSkills.call({ authorizedPath: async path => path }, '')
-  assert.deepEqual(catalog.skills.filter(skill => skill.source === 'bundled').map(skill => skill.name).sort(), expected)
+  assert.deepEqual(catalog.skills.filter(skill => skill.source === 'bundled').map(skill => skill.name).sort(), [])
 })

package/README.md

@@ -56,9 +56,9 @@ dsh plugin --profile web add @godv61/dsh-task-engine
 | **技能** | 安装、编辑技能，并集中维护每个技能唯一的规则列表。 |
 | **规则** | 选择 Markdown 文件安装规则，维护项目或个人开发约定。 |
 
-内置技能和规则是只读样本，可用“以此为模板新建”复制正文到项目或个人目录后编辑；新资源的规则和阶段绑定由你单独配置。安装、删除都会明确展示目标位置。
+插件只内置负责会话编排的 `eng-delivery`。阶段技能和规则由使用者创建或安装，可放在项目或个人目录；安装、删除都会明确展示目标位置。
 
-**流程与工作方法是两回事。** 流程只决定工作怎么流转（阶段顺序与门禁），预设不自带任何技能或提交格式。要用什么技能、遵守哪些规则、提交信息写什么，都由你配置。「采用推荐配置」并保存时，内置样本各复制一份到项目目录，配置改为引用项目资源；之后可编辑，升级不覆盖。同一条规则仍可由多个技能共享。用户级技能及其规则配置由所有项目和会话共用。任务的流程与资源引用在创建时确定；Skill/Rule 正文在每次交互读取最新版本，创建时副本仅用于审计。[配置细节](docs/configuration.md)
+**流程与工作方法是两回事。** 流程只决定工作怎么流转（阶段顺序与门禁），预设不自带任何技能或提交格式。要用什么技能、遵守哪些规则，都由你配置。「采用推荐配置」只填写可修改的提交文本、产物字段和评审深度，不改变技能与规则绑定。同一条规则可由多个技能共享。用户级技能及其规则配置由所有项目和会话共用。任务的流程与资源引用在创建时确定；Skill/Rule 正文在每次交互读取最新版本，创建时副本仅用于审计。[配置细节](docs/configuration.md)
 
 ## 选择适合这次任务的流程
 
@@ -68,7 +68,7 @@ dsh plugin --profile web add @godv61/dsh-task-engine
 | **日常迭代** `agile` | 需求 → 开发 → 交付 → 审查 | 目标明确的日常开发任务。 |
 | **快速修改** `minimal` | 开发 → 交付 | 已明确做法的小改动。 |
 
-阶段顺序和检查条件由预设固定；技能与规则由用户配置。选择流程不会强制加入内置技能；需要现成起点时可显式采用推荐配置。**可视化自定义流程不在计划内**，详见[功能规划](docs/roadmap.md)。
+阶段顺序和检查条件由预设固定；技能与规则由用户配置。空绑定也能运行流程。需要提交文本和产物字段的起点时可显式采用推荐配置。**可视化自定义流程不在计划内**，详见[功能规划](docs/roadmap.md)。
 
 ## 把自己的技能和规则带进来
 
@@ -78,9 +78,11 @@ dsh plugin --profile web add @godv61/dsh-task-engine
 
 | 安装范围 | 存放位置 | 用途 |
 | :--- | :--- | :--- |
-| 项目 | 工作区 `.dsh/skills`、`.dsh/rules` | 当前项目的工作方法与约定。 |
-| 个人 | `$DSH_HOME/skills`、`$DSH_HOME/rules` | 在这台电脑上的多个项目间复用。 |
-
+| 项目 | 工作区 `.dsh/skills`、`.dsh/rules` | 当前项目的工作方法与约定；工作台新建资源默认写在这里。 |
+| 个人 | `$DSH_HOME/skills`、`$DSH_HOME/rules` | 在这台电脑上的多个项目间复用。 |
+
+工作台也会发现同一项目 `.agents/skills/<名称>/SKILL.md` 中的 Codex 项目技能，可将它绑定到流程节点，并在技能下配置 DSH 规则；它的正文仍留在原目录。运行时使用 `dev_task` 的 `load_skill` 操作读取该技能及其规则，下一次读取会取得文件的最新内容。[Codex 项目技能说明](docs/configuration.md#技能与规则)
+
 技能的脚本、模板和附件会一并保留。文件格式、大小限制和故障处理见[技能与规则安装指南](docs/resource-install.md)。
 
 ## 使用文档