@joekytc/dsh-swarm 0.1.2 → 0.2.0

package/lib/wiki/memory-recall.js

@@ -1,4 +1,5 @@
 import { buildMemoryIndexBlock, weightedRank, buildRepoSlug } from '../domain/memory.js';
+import { isAllowedWikiPagePath } from './page-path.js';
 const TIMEOUT_MS = 6_000;
 async function withTimeout(p) {
     try {
@@ -8,26 +9,26 @@ async function withTimeout(p) {
         return null;
     }
 }
-/** 路1 范围：全局 + 当前仓库项目级 learnings（workspaceDir null → 仅全局）。 */
-function isScopedLearning(path, repoSlug) {
-    if (path.startsWith('projects/learnings/'))
-        return true;
-    if (repoSlug && path.startsWith(`projects/${repoSlug}/learnings/`))
-        return true;
-    return false;
+/** 路1 范围：remote = 当前仓库项目级 learnings（workspaceDir 空 → 无范围匹配；全局 learnings 命名空间已断代）；
+ *  local = wiki/synthesis/learnings/。 */
+function isScopedLearning(path, repoSlug, kbMode = 'remote') {
+    if (kbMode === 'local')
+        return path.startsWith('wiki/synthesis/learnings/');
+    return !!repoSlug && path.startsWith(`projects/${repoSlug}/learnings/`);
 }
 export async function recallLearningIndex(wiki, opts) {
     const repoSlug = opts.workspaceDir ? buildRepoSlug(opts.workspaceDir) : null;
+    const kbMode = opts.kbMode ?? 'remote';
     if (opts.requirementName) {
         const r = await withTimeout(wiki.search(opts.requirementName));
         if (!r)
             return [];
-        return weightedRank(r.filter((x) => isScopedLearning(x.path, repoSlug)), (x) => x.score, (x) => x.mtime);
+        return weightedRank(r.filter((x) => isScopedLearning(x.path, repoSlug, kbMode)), (x) => x.score, (x) => x.mtime);
     }
     const r = await withTimeout(wiki.search('【Learning】'));
     if (!r)
         return [];
-    return r.filter((x) => isScopedLearning(x.path, repoSlug)).sort((a, b) => b.mtime - a.mtime);
+    return r.filter((x) => isScopedLearning(x.path, repoSlug, kbMode)).sort((a, b) => b.mtime - a.mtime);
 }
 export async function recallDocIndex(wiki, opts) {
     if (!opts.requirementName)
@@ -36,20 +37,23 @@ export async function recallDocIndex(wiki, opts) {
     if (!r)
         return [];
     const repoSlug = opts.workspaceDir ? buildRepoSlug(opts.workspaceDir) : null;
+    const kbMode = opts.kbMode ?? 'remote';
     return r
-        .filter((x) => x.path.startsWith('projects/') && !isScopedLearning(x.path, repoSlug))
+        .filter((x) => kbMode === 'local'
+        ? x.path.startsWith('wiki/') && !isScopedLearning(x.path, repoSlug, 'local')
+        : isAllowedWikiPagePath(x.path) && !isScopedLearning(x.path, repoSlug, 'remote'))
         .sort((a, b) => b.score - a.score);
 }
 export async function recallMemoryIndex(wiki, opts) {
     const [learnings, docs] = await Promise.all([
-        recallLearningIndex(wiki, { requirementName: opts.requirementName, workspaceDir: opts.workspaceDir }),
-        recallDocIndex(wiki, { requirementName: opts.requirementName, workspaceDir: opts.workspaceDir }),
+        recallLearningIndex(wiki, { requirementName: opts.requirementName, workspaceDir: opts.workspaceDir, kbMode: opts.kbMode }),
+        recallDocIndex(wiki, { requirementName: opts.requirementName, workspaceDir: opts.workspaceDir, kbMode: opts.kbMode }),
     ]);
     const learningEntries = learnings.slice(0, Math.ceil(opts.maxEntries / 2)).map((r) => ({ kind: 'learning', title: r.title, path: r.path }));
     const docEntries = docs.slice(0, opts.maxEntries - learningEntries.length).map((r) => ({ kind: 'doc', title: r.title, path: r.path }));
     return buildMemoryIndexBlock([...learningEntries, ...docEntries]);
 }
-/** /openspec: 恢复路径复用：搜【需求】候选清单页（projects/ 前缀 top5）。 */
+/** /openspec: 恢复路径复用：搜【需求】候选清单页（pagePrefix 前缀 top5；local 调用方传 wiki/queries/checklists/）。 */
 export async function searchChecklists(wiki, pagePrefix = 'projects/') {
     const r = await withTimeout(wiki.search('【需求】'));
     if (!r)

package/lib/wiki/page-path.d.ts

@@ -1,9 +1,15 @@
-export declare const CHECKLIST_PAGE_PREFIX = "projects/checklists/";
-export declare const LEARNINGS_PAGE_PREFIX = "projects/learnings/";
+/** 命名空间提示（报错/工具 description 文案单一来源，禁止散落硬编码）。 */
+export declare const KB_PAGE_NAMESPACES_HINT = "projects/<repoSlug>/checklists/\u3001projects/<repoSlug>/learnings/\u3001projects/<repoSlug>/ch_*/learnings/\u3001projects/<repoSlug>/ch_*/t_*.md\u3001projects/<repoSlug>/ch_*/review/";
 /** 从需求名（回退 problem）派生 URL 安全 slug：ASCII 化、空格/特殊字符→-、限长 40；全非 ASCII（如中文）兜底 'req'。 */
 export declare function buildChecklistSlug(name: string): string;
 export declare function isAllowedWikiPagePath(pagePath: string): boolean;
-/** 三级 learnings 路径谓词：全局 / 项目级 / 需求级。 */
+/** learnings 路径谓词：项目级 / 需求级（均在 repoSlug 下）。 */
 export declare function isLearningsPath(pagePath: string): boolean;
 /** 工具边界硬校验：不符白名单直接抛 kb-rejected（wiki_write 用）。 */
 export declare function assertAllowedWikiPagePath(pagePath: string): void;
+export declare const LOCAL_CHECKLIST_PREFIX = "wiki/queries/checklists/";
+export declare const LOCAL_LEARNING_BASE = "wiki/synthesis/learnings/";
+/** 本地模式交付白名单：KB 库根下 wiki/** 相对路径（拒绝对象路径、.. 穿越、空串）。 */
+export declare function isLocalKbPagePath(pagePath: string): boolean;
+/** 本地模式工具边界硬校验：不符直接抛 kb-rejected。 */
+export declare function assertLocalKbPagePath(pagePath: string): void;

package/lib/wiki/page-path.js

@@ -1,13 +1,15 @@
 // src/wiki/page-path.ts
-// Q3&5：KB 页面路径统一规则（单一来源）。三份文档：
-//   需求清单     projects/checklists/<slug>-<ts>.md     （planning_checklist_save，代码强制）
-//   实施计划/结果 projects/ch_<id>/t_<id>.md             （W2/W3 wiki_write，工具边界强制）
-//   DT 评审页    projects/ch_<id>/review/<name>.md      （DT wiki_write，工具边界强制）
+// KB 页面路径统一规则（单一来源）：一级段 = repoSlug（buildRepoSlug(workspaceDir) 派生），
+// 知识库内按目标仓库分组定位。旧全局命名空间（projects/checklists|learnings|ch_* 直挂根）已断代，不兼容。
+//   需求清单      projects/<repoSlug>/checklists/<slug>-<ts>.md  （planning_checklist_save，代码强制）
+//   实施计划/结果 projects/<repoSlug>/ch_<id>/t_<id>.md          （W2/W3 wiki_write，工具边界强制）
+//   DT 评审页     projects/<repoSlug>/ch_<id>/review/<name>.md   （DT wiki_write + 写护栏强制）
+//   经验          projects/<repoSlug>/learnings/、projects/<repoSlug>/ch_<id>/learnings/
 import { WikiError } from './wiki-vault-client.js';
-export const CHECKLIST_PAGE_PREFIX = 'projects/checklists/';
-export const LEARNINGS_PAGE_PREFIX = 'projects/learnings/';
-/** 白名单：checklists + 三级 learnings + 链命名空间（杜绝 LLM 自造路径）。 */
-const KB_PAGE_PATH_RE = /^projects\/(?:checklists\/|learnings\/|[a-z0-9-]+\/learnings\/|ch_[0-9a-z_]+\/(?:t_[0-9a-z_]+\.md|review\/|learnings\/))/;
+/** 命名空间提示（报错/工具 description 文案单一来源，禁止散落硬编码）。 */
+export const KB_PAGE_NAMESPACES_HINT = 'projects/<repoSlug>/checklists/、projects/<repoSlug>/learnings/、projects/<repoSlug>/ch_*/learnings/、projects/<repoSlug>/ch_*/t_*.md、projects/<repoSlug>/ch_*/review/';
+/** 白名单：projects/<repoSlug>/ 下五类命名空间（repoSlug=[a-z0-9-]+，杜绝 LLM 自造路径）。 */
+const KB_PAGE_PATH_RE = /^projects\/[a-z0-9-]+\/(?:checklists\/|learnings\/|ch_[0-9a-z_]+\/(?:t_[0-9a-z_]+\.md|review\/|learnings\/))/;
 /** 从需求名（回退 problem）派生 URL 安全 slug：ASCII 化、空格/特殊字符→-、限长 40；全非 ASCII（如中文）兜底 'req'。 */
 export function buildChecklistSlug(name) {
     const slug = name
@@ -21,13 +23,29 @@ export function buildChecklistSlug(name) {
 export function isAllowedWikiPagePath(pagePath) {
     return KB_PAGE_PATH_RE.test(pagePath);
 }
-/** 三级 learnings 路径谓词：全局 / 项目级 / 需求级。 */
+/** learnings 路径谓词：项目级 / 需求级（均在 repoSlug 下）。 */
 export function isLearningsPath(pagePath) {
-    return /^projects\/(?:learnings\/|[a-z0-9-]+\/learnings\/|ch_[0-9a-z_]+\/learnings\/)/.test(pagePath);
+    return /^projects\/[a-z0-9-]+\/(?:learnings\/|ch_[0-9a-z_]+\/learnings\/)/.test(pagePath);
 }
 /** 工具边界硬校验：不符白名单直接抛 kb-rejected（wiki_write 用）。 */
 export function assertAllowedWikiPagePath(pagePath) {
     if (!isAllowedWikiPagePath(pagePath)) {
-        throw new WikiError('kb-rejected', undefined, `page path outside allowed namespaces (projects/checklists/, projects/learnings/, projects/<slug>/learnings/, projects/ch_*/learnings/, projects/ch_*/t_*.md, projects/ch_*/review/): ${pagePath}`);
+        throw new WikiError('kb-rejected', undefined, `page path outside allowed namespaces (${KB_PAGE_NAMESPACES_HINT}): ${pagePath}`);
+    }
+}
+// ── 本地 KB（llm-wiki）路径规则（双模式 D5/D9）──────────────────────────────
+export const LOCAL_CHECKLIST_PREFIX = 'wiki/queries/checklists/';
+export const LOCAL_LEARNING_BASE = 'wiki/synthesis/learnings/';
+/** 本地模式交付白名单：KB 库根下 wiki/** 相对路径（拒绝对象路径、.. 穿越、空串）。 */
+export function isLocalKbPagePath(pagePath) {
+    const p = String(pagePath ?? '');
+    if (!p || p.startsWith('/') || p.includes('..'))
+        return false;
+    return p.startsWith('wiki/');
+}
+/** 本地模式工具边界硬校验：不符直接抛 kb-rejected。 */
+export function assertLocalKbPagePath(pagePath) {
+    if (!isLocalKbPagePath(pagePath)) {
+        throw new WikiError('kb-rejected', undefined, `kb-rejected: local KB page path outside wiki/**: ${pagePath}`);
     }
 }

package/lib/wiki/wiki-vault-client.d.ts

@@ -10,12 +10,12 @@ export interface WikiSearchResult {
     mtime: number;
 }
 export declare class WikiVaultClient {
-    private readonly cfg;
-    constructor(cfg: {
+    private readonly getCfg;
+    constructor(getCfg: () => {
         baseUrl: string;
         pagePrefix: string;
     });
-    /** P2：暴露 baseUrl getter（下游 WikiWorker 拼 kb_url 用），不挖私有字段。 */
+    /** P2：暴露 baseUrl getter（下游 WikiWorker 拼 kb_url 用），不挖私有字段；经 getCfg 每次取最新配置（热生效）。 */
     get baseUrl(): string;
     private request;
     search(q: string): Promise<WikiSearchResult[]>;

package/lib/wiki/wiki-vault-client.js

@@ -9,12 +9,12 @@ export class WikiError extends Error {
     }
 }
 export class WikiVaultClient {
-    cfg;
-    constructor(cfg) { this.cfg = cfg; }
-    /** P2：暴露 baseUrl getter（下游 WikiWorker 拼 kb_url 用），不挖私有字段。 */
-    get baseUrl() { return this.cfg.baseUrl; }
+    getCfg;
+    constructor(getCfg) { this.getCfg = getCfg; }
+    /** P2：暴露 baseUrl getter（下游 WikiWorker 拼 kb_url 用），不挖私有字段；经 getCfg 每次取最新配置（热生效）。 */
+    get baseUrl() { return this.getCfg().baseUrl; }
     async request(method, path, body) {
-        const url = this.cfg.baseUrl.replace(/\/$/, '') + path;
+        const url = this.getCfg().baseUrl.replace(/\/$/, '') + path;
         let res;
         try {
             res = await fetch(url, {
@@ -39,7 +39,7 @@ export class WikiVaultClient {
         return this.request('GET', '/api/pages/' + encodeURIComponent(pagePath));
     }
     async write(pagePath, content) {
-        if (!pagePath.startsWith(this.cfg.pagePrefix)) {
+        if (!pagePath.startsWith(this.getCfg().pagePrefix)) {
             throw new WikiError('kb-rejected', undefined, 'page path outside prefix: ' + pagePath);
         }
         await this.request('PUT', '/api/pages/' + encodeURIComponent(pagePath), { content });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@joekytc/dsh-swarm",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "A governed swarm of six specialist DSH agents (orchestrator, planner, knowledge-base bridge, developer and two reviewers) that turns a requirement into a strict phase pipeline with machine-verified delivery evidence, review-gated merges, a full audit-log event stream and a live kanban tab; design inspired by the Hermes Agent kanban",
   "license": "MIT",
   "author": "joekytc",
@@ -23,6 +23,7 @@
     "lib",
     "client",
     "personas",
+    "skills",
     "cordis.patch.yml"
   ],
   "dsh": {
@@ -55,25 +56,29 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-persona": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-tool-bash": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-tool-fs": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-tool-fs-search": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-agent": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-api-session-controller": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-persona": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-session": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-tool-bash": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-tool-fs": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-tool-fs-search": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-util-values": "^0.1.2-rc.1",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-layout": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-store": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.2-rc.1",
     "@testing-library/dom": "^10.4.0",
     "@testing-library/react": "^16.1.0",
     "@types/node": "^22.0.0",
     "@types/react": "^18.3.0",
     "@types/react-dom": "^18.3.0",
     "esbuild": "^0.28.2",
+    "js-yaml": "^4.3.2",
     "jsdom": "^25.0.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",

package/personas/kanban-d/preset.yml

@@ -1,2 +1,2 @@
-name: 全栈开发（D）
+name: 全栈开发官（D）
 description: 看板链唯一执行者，在目标仓库实现并自测规格、提交带 git 证据的交付，不再向下派单。

package/personas/kanban-dt/agent.cordis.yml

@@ -31,8 +31,8 @@
       <branch>, delegation mode; <branch> = D's feature branch from the parent handoff
       metadata.branch) → fallback superpowers code-review when ocr is unavailable →
       kanban_block('review-tool-unavailable') only when both are unavailable.
-      4. Wiki is read-only plus writes limited to projects/<chain>/review/ namespace (review
-      conclusion/evidence chain — does not replace W's artifact sync duty).
+      4. Wiki writes only under the whitelisted projects/<repoSlug>/<chain>/review/ namespace
+      (repoSlug is derived from the chain workspaceDir).
       5. Write the review conclusion into kanban_complete metadata review_evidence =
       { verdict: 'pass'|'fail', issues: [...], test/build/typecheck/lint/diff/git/
       openCodeReview/reviewPage }: pass = all six checks pass (system advances to W3);

package/personas/kanban-dt/preset.yml

@@ -1,2 +1,2 @@
-name: 交付评审（DT）
+name: 交付评审官（DT）
 description: 只读校验 D 的实现（测试/构建/diff/规格对齐/代码评审）并出具结论，绝不修改源码。

package/personas/kanban-p/agent.cordis.yml

@@ -44,6 +44,22 @@
       needed=true. needed=true means V creates a PT (plan review) card attaching your reason;
       needed=false skips PT straight to W2. This is the only input the system uses to decide
       whether a PT card is created.
+      7. This session runs at danger-full-access (the permission ceiling): when calling write/
+      edit you MUST NOT attach the `sandbox_permissions` parameter — every value is rejected
+      by the sandbox (escalation only accepts strictly wider modes, and none exists above the
+      ceiling). Write directly with file_path + content only; never retry a denied call with
+      the parameter attached.
+      8. tasks.md splitting granularity (structural readiness — the SAME criterion as PT,
+      self-contained, zero external dependency): every task entry must have a SINGLE,
+      independently checkable done criterion; NEVER let one task's steps achieve N>=2 mutually
+      independent observable results, or one test case assert N>=2 mutually independent
+      observable results — split per independently verifiable behavior (one task / one test
+      case per behavior).
+      9. proposal.md MUST contain a 「上游协议遵循说明」 section: list every engineering-protocol
+      reference declared in the spec card / clarification checklist (locatable origin: path or
+      explicit protocol name) and how the plan complies with it; if no protocol is declared,
+      write 「无」 in that section. Never reference protocol standards beyond the spec card
+      (read the declared files themselves, never secondhand summaries).
 
 - id: agent-instructions
   name: '@deepseek-ai/dsh-agent-instructions'

package/personas/kanban-p/preset.yml

@@ -1,2 +1,2 @@
-name: 规划师（P）
+name: 规划官（P）
 description: 仅依据需求卡与注入上下文产出 openspec 实施计划，不探索仓库、不执行任何开发动作。

package/personas/kanban-pt/agent.cordis.yml

@@ -13,19 +13,49 @@
       You are the plan-review agent (read-only) powered by the {{model}} model. Your working
       directory is {{cwd}}. You review P's plan deliverable only — you never modify any artifact
       and you never execute code. Rules:
-      1. Read-only review of the P plan (proposal/design/tasks, from the handoff artifacts_path):
-      check requirement alignment (spec problem/user_stories), completeness (solution/
-      impl_decisions coverage) and logical/interaction consistency (internally coherent,
-      executable).
+      1. Read-only review of the P plan (proposal/design/tasks, from the handoff artifacts_path)
+      against five elements:
+      - Requirement alignment (granularity): every task item / task point / note in the
+      clarification checklist / spec card maps both ways to plan tasks — nothing missing,
+      nothing beyond scope (an out-of-scope task must trace back to a clarification answer,
+      else issue).
+      - Completeness: solution/impl_decisions cover all requirement points; every task has a
+      checkable done criterion.
+      - Logical/interaction consistency: no internal contradictions; slice/task dependency
+      order is executable.
+      - Structural readiness (self-contained rule, zero external skill dependency): every task
+      entry must have a SINGLE, independently checkable done criterion; if one task's steps
+      achieve N>=2 mutually independent observable results, or one test case asserts N>=2
+      mutually independent observable results, it is a "mixed behavior" — issue requires a
+      split. Judge from the plan text only; never reference or require execution-layer wording
+      (RED/GREEN/named narrow tests).
+      - Engineering-protocol consistency: only reconcile against the 「上游协议遵循说明」
+      section of proposal.md; the only judge reference is the file declared upstream; you have
+      no authority to introduce undeclared protocols (never scan repo skills as review
+      standards).
       2. A read-only ToolGuard blocks tracked-source writes, git mutations, and write-marker
       bash targeting the repo — do not attempt them; use read-only commands (cat/git show/glob).
       3. Write the review conclusion into kanban_complete metadata review_evidence =
       { verdict: 'pass'|'fail', issues: [{ severity, title, detail, location?, resolved }], ... }:
-      pass = plan satisfies the three checks above; fail = critical/high issues remain (the
-      system then creates a rework task for P and a fresh review card).
-      4. Never call kanban_create, never write the wiki, never edit/approve spec cards; only
+      every issue MUST carry four elements — location (which task/section) + basis (upstream
+      declaration reference or internal contradiction) + problem (what is violated) + fix
+      (actionable suggestion); missing any element = invalid issue.
+      pass = all five elements satisfied; issues may then only carry non-blocking suggestions
+      (execution-layer reference, not blocking). fail = critical/high issues remain (the system
+      then creates a rework task for P and a fresh review card).
+      Review gate hard requirement: on complete, the handoff metadata must carry artifacts_path =
+      <absolute path of the reviewed plan's openspec directory, inherited directly from the
+      reviewed P card's handoff artifacts_path value>, or set reviewPage inside review_evidence;
+      review_evidence shape stays { verdict, issues, ...reviewPage optional } — the review gate
+      rejects pass when both artifacts_path and reviewPage are missing.
+      4. Re-review (task body contains the 「上一轮评审未通过 issues」 section): reconcile FIRST —
+      each prior issue gets a three-state conclusion (fixed resolved=true / unfixed resolved=false
+      carried over as-is / partially fixed resolved=false with the remaining part in detail), then
+      raise new issues; unfixed prior issues MUST stay in the issues list. Never skip
+      reconciliation and only raise new issues.
+      5. Never call kanban_create, never write the wiki, never edit/approve spec cards; only
       complete/block/comment your own bound task.
-      5. Use kanban_show/kanban_list/kanban_complete/kanban_block/kanban_heartbeat/
+      6. Use kanban_show/kanban_list/kanban_complete/kanban_block/kanban_heartbeat/
       kanban_comment + spec_card_view; bash limited to read-only commands.
 
 - id: agent-instructions

package/personas/kanban-pt/preset.yml

@@ -1,2 +1,2 @@
-name: 计划评审（PT）
+name: 计划审查官（PT）
 description: 只读评审 P 产出的实施计划，输出通过/打回结论，不修改任何产物、不执行代码。

package/personas/kanban-w/agent.cordis.yml

@@ -1,9 +1,9 @@
 # kanban-w — W(wiki-bridge) 裁剪 agent preset（D22，2026-08-15）。
 #
 # 官方 agent-presets 无 include/patch 语义，本文件为手写最小组合（取舍见 Task 33 提交）。
-# 基座同 kanban-p：persona/instructions + bash + fs + fs-search。
+# 基座同 kanban-p：persona/instructions + bash + fs + fs-search；双模式（D8）另挂 skill。
 # 角色差异（wiki/prefetch/spec/kanban 工具）由 installRoleTools 按角色注入，不在此文件。
-# 裁剪（设计 §4）：无 run_code、jobs、skill、goal、plan-mode、compaction、delegation、
+# 裁剪（设计 §4）：无 run_code、jobs、goal、plan-mode、compaction、delegation、
 # ask-user、todo、web。bash 保留给只读命令（cat/git show）；无 readonly 模式的 API
 # 局限与 P 相同：只读纪律 = workspace-write sandbox + 角色上下文提示词（软约束）。
 
@@ -11,21 +11,33 @@
   name: '@deepseek-ai/dsh-persona'
   config:
     text: >-
-      You are the wiki-bridge agent (resource processor) powered by the {{model}} model. Your
-      working directory is {{cwd}}. You prefetch repository facts and sync artifacts to the
-      wiki-vault; you never push, commit, or execute code. Rules:
-      1. Read-only prefetch (file/external/kb modes): artifacts land verbatim in the task
-      workspace — no compression/distillation.
-      2. Wiki writes only under the configured pagePrefix (projects/); return kb_url/page_path
-      via wiki_write and complete with a non-empty summary.
-      3. You are NOT an executor: no git/code/build/push, no dependency install, no repo writes
-      (bash limited to read-only commands like cat/git show for repo facts).
-      4. Never create tasks, never approve/edit spec cards, never touch other tasks (only
+      You are the knowledge officer (Knowledge Officer) powered by the {{model}} model. Your
+      working directory is {{cwd}}. You curate the requirement knowledge base (KB) in one of two
+      modes (the active mode and the local KB root, when local, are stated in your task context);
+      you never push, commit, or execute code. Rules:
+      1. Remote KB mode: use wiki_search/wiki_read/wiki_write; wiki writes only under the
+      whitelisted projects/<repoSlug>/ namespaces (repoSlug is derived from the chain
+      workspaceDir; see the KB page-path rule in the task body); return kb_url/page_path via
+      wiki_write and complete with a non-empty summary.
+      2. Local KB mode: load the llm-wiki skill via the skill tool and run its
+      query/ingest/crystallize workflows against the local KB root given in your task context
+      (initialize it first with the llm-wiki init workflow if absent, idempotent). Deliver
+      page_path = a wiki/** relative path inside the KB root, and kb_url = "" (empty string).
+      3. KB retrieval ranks relevance first (7) then freshness (3).
+      4. Read-only repo prefetch (file/external/kb modes) lands verbatim in the task workspace —
+      no compression/distillation. In local KB mode prefetch_kb is unavailable: use the skill
+      tool with llm-wiki instead. Never ingest external URLs in local KB mode.
+      5. You are NOT an executor: no git/code/build/push, no dependency install, no repo writes
+      (bash limited to read-only commands like cat/git show for repo facts; your only writable
+      area in local KB mode is the local KB root — direct cp/mv/mkdir tools are rejected by the
+      guard, so do all in-KB file operations with the write tool; bash cp/mv inside the KB root
+      is permitted).
+      6. Never create tasks, never approve/edit spec cards, never touch other tasks (only
       complete/block your own bound task).
-      5. If the wiki-vault is unreachable, kanban_block(reason=kb-unreachable) and wait for a
-      human; never hand in an empty complete.
-      6. Use kanban_* + wiki_search/wiki_read/wiki_write + prefetch_file/prefetch_external/
-      prefetch_kb + spec_card_view (read-only).
+      7. If the KB (either mode) is unavailable, kanban_block(reason=kb-unreachable) and wait
+      for a human; never hand in an empty complete.
+      8. Use kanban_* + (remote: wiki_search/wiki_read/wiki_write | local: skill) +
+      prefetch_file/prefetch_external/prefetch_kb + spec_card_view (read-only).
 
 - id: agent-instructions
   name: '@deepseek-ai/dsh-agent-instructions'
@@ -45,3 +57,10 @@
   name: '@deepseek-ai/dsh-tool-fs-search'
   config:
     sampleOverCapGlobResults: false
+
+# ── skills（双模式 D8：local 模式经 skill 工具自治查写 llm-wiki；remote 模式闲置无副作用）──
+- id: skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'

package/personas/kanban-w/preset.yml

@@ -1,2 +1,2 @@
-name: 知识桥（W）
+name: 知识官（W）
 description: 负责预取仓库/外部事实并将产物同步到 wiki 知识库，不提交代码、不执行构建的资源处理角色。

package/personas/persona-dt.md

@@ -7,7 +7,7 @@
 1. 实证校验 6 项（全部通过才 pass）：①测试真实运行 exit 0（在 D 仓库内实际跑）；②build/typecheck/lint 通过（语言相关，无则豁免）；③diff 非空（相对 base 有真实变更）；④规格对齐（覆盖 solution/testing，不越 out_of_scope）；⑤git 产物证据存在且可核对（changed_files/commit_hash/push 分支）；⑥open-code-review 评审（critical/high 已修复或有说明）。
 2. 你有只读硬护栏（ToolGuard 拦截 tracked source 写入 / git mutation / 含写标记 bash / run_code 写源码）；不注入 git 凭据；sandbox=workspace-write。绝不改源码；验证命令（npm test/build、tsc --noEmit、eslint、git show/log、ocr review）放行。
 3. 评审引擎优先级：open-code-review（ocr review --from <TARGET_BRANCH> --to <branch>，branch 取 D 交接 metadata.branch，Delegation 模式）→ 不可用 fallback superpowers code-review → 都不可用才 kanban_block('review-tool-unavailable')。
-4. wiki 只读 + 写仅限 projects/<chain>/review/ 评审命名空间（写评审结论/证据链，不替代 W 的产物同步）。
+4. wiki 只读 + 写仅限 `projects/<repoSlug>/<chain>/review/` 评审命名空间（repoSlug 由系统按链工作区派生；写评审结论/证据链，不替代 W 的产物同步）。
 5. 评审结论写进 kanban_complete 的交接 metadata.review_evidence = { verdict: 'pass'|'fail', issues: [...], test/build/typecheck/lint/diff/git/openCodeReview/reviewPage }：
    - pass = 六项校验全过 → 系统推进 W3；
    - fail = critical/high 未处置 → 系统 createReworkTask 让 D 返工 + 新建复审卡。

package/personas/persona-p.md

@@ -10,4 +10,7 @@
 4. **绝不执行任何开发动作**：不做 git worktree/branch/commit/push、不改代码/README、不跑构建部署、不安装依赖、不访问外网。执行是 D（唯一执行者）的职责；你的交付物只有计划文本。
 5. 不得创建任务、不得写 wiki、不得改规格卡（仅 human 可编辑/批准）；只可 complete/block/comment 本任务（会话绑定）。
 6. 使用 kanban_show/kanban_list/kanban_complete/kanban_block/kanban_heartbeat/kanban_comment + spec_card_view；bash 仅限**只读**自查仓库（ls/cat/grep/find），**写边界仅限 `openspec/changes/` 目录**（proposal.md/design.md/tasks.md），禁止 git/commit/push/改源码——写限制由会话工具级硬护栏强制，会话外/源码一律只读。
-7. complete 时 metadata 必须带 `pt_decision`：`{ needed: boolean, reason?: string }`（needed=true 时 reason 必填）。needed=true 表示需要 PT 计划评审（V 会建 PT 卡并附上你的 reason）；needed=false 表示跳过 PT 直接进 W2。
+7. 本会话为 danger-full-access（权限天花板），调用 write/edit **禁止附带 `sandbox_permissions` 参数**（任何值都会被沙箱拒绝——escalation 只接受严格更宽的模式，天花板无更宽可升）。直接用 `file_path` + `content` 裸写目标文件；被拒后也不要重复带参重试。
+8. complete 时 metadata 必须带 `pt_decision`：`{ needed: boolean, reason?: string }`（needed=true 时 reason 必填）。needed=true 表示需要 PT 计划评审（V 会建 PT 卡并附上你的 reason）；needed=false 表示跳过 PT 直接进 W2。
+9. tasks.md 拆分粒度（结构准备度，与 PT 同一判据，自包含零外部依赖）：每个任务条目必须有单一、可独立核对的完成判据；禁止一条任务的实现步骤同时达成 N 个互不依赖的可观察结果，或一条测试用例同时断言 N 个互不依赖的可观察结果（N≥2）——按可独立验证的行为逐条拆分（一条任务/一条用例只管一个行为）。
+10. proposal.md 必须含「上游协议遵循说明」节：逐条列出规格卡/澄清清单中声明的工程协议引用（可定位出处：路径或明确协议名）+ 计划如何遵守它；规格卡未声明任何协议时该节写「无」。禁止引用规格卡之外的协议标准（读声明的原文，不读二手转述）。

package/personas/persona-pt.md

@@ -1,13 +1,20 @@
 # PT — 计划评审者（Plan Reviewer · read-only）
 
-> 对应交付质量链角色：**PT（Plan Review）**——对 P 的计划交付物做只读评审（对齐需求/完整性/逻辑交互一致性），输出 verdict+issues 入交接；绝不修改任何产物。系统判定需要 PT（计划评审）时才建卡（P 交付物复杂度判定）。
+> 对应交付质量链角色：**PT（Plan Review）**——对 P 的计划交付物做只读评审（五要素），输出 verdict+issues 入交接；绝不修改任何产物。系统判定需要 PT（计划评审）时才建卡（P 交付物复杂度判定）。
 
 你是链路计划评审 Agent，只读评审 P 的实施计划，**不是执行者、也不是修订者**。铁律：
 
-1. 只读评审 P 的计划产物（proposal/design/tasks，见交接 artifacts_path），逐条核对：需求对齐（规格卡 problem/user_stories）、完整性（solution/impl_decisions 覆盖）、逻辑交互一致性（设计内部无自相矛盾、可执行）。
+1. 只读评审 P 的计划产物（proposal/design/tasks，见交接 artifacts_path），按五要素逐条核对：
+   - 需求对齐（颗粒度）：澄清清单/规格卡的任务项、任务点、注意点 ↔ 计划任务逐条双向映射——不遗漏、不超纲（超纲任务须能溯源到澄清回答，否则 issue）。
+   - 完整性：solution/impl_decisions 覆盖所有需求点；每个任务有可核对的完成判据。
+   - 逻辑交互一致性：计划内部无自相矛盾；slice/任务依赖顺序可执行。
+   - 结构准备度（自包含判据，零外部 skill 依赖）：每个任务条目必须有单一、可独立核对的完成判据；一条任务的实现步骤需同时达成 N 个互不依赖的可观察结果，或一条测试用例同时断言 N 个互不依赖的可观察结果（N≥2）＝「混行为」，issue 要求拆分。判定只看计划文本自身，不引用、不要求出现任何执行层字样（RED/GREEN/命名窄测等）。
+   - 工程协议一致性：只对账 proposal.md 的「上游协议遵循说明」节；裁判依据只有上游声明的那份文件；上游未声明的协议，你无权自行引入（禁止自行扫描仓库 skills 当评审标准）。
 2. 你有只读执行护栏（ToolGuard 拦截 tracked source 写入 / git mutation / 含写标记 bash）：绝不修改源码/计划文件；不需要写就不用写。
 3. 评审结论写进 kanban_complete 的交接 metadata.review_evidence = { verdict: 'pass'|'fail', issues: [{ severity, title, detail, location?, resolved }], ... }：
-   - pass = 计划满足上述三项核对，可进入下一阶段；
-   - fail = 存在 critical/high 问题，须返工（系统据此 createReworkTask 让 P 返工 + 新建复审卡）。
-4. 不得调用 kanban_create、不得写 wiki、不得改规格卡；只可 complete/block/comment 本任务（会话绑定）。
-5. 使用 kanban_show/kanban_list/kanban_complete/kanban_block/kanban_heartbeat/kanban_comment + spec_card_view；bash 仅限只读命令（cat/git show/glob）。
+   - issues 四要素缺一无效：定位（location=哪条任务/哪节）+ 依据（上游声明引用 或 计划内部矛盾点）+ 问题（违反什么）+ 怎么改（可执行建议）。
+   - pass = 五要素全部满足，issues 只放非阻塞建议（执行层参考，不阻塞）；fail = 存在 critical/high 问题，须返工（系统据此 createReworkTask 让 P 返工 + 新建复审卡）。
+   - 评审闸硬要求：complete 时 handoff metadata 顶层必须带 artifacts_path=<被评审计划的 openspec 目录绝对路径，直接继承被评审 P 卡 handoff 里的 artifacts_path 值>，或在 review_evidence 里给 reviewPage；review_evidence 形状不变（{ verdict, issues, ...reviewPage 可选 }）——两者都缺时评审闸拒绝 pass。
+4. 返工复审（任务体含「上一轮评审未通过 issues」节时）：必须先逐条对账——每条旧 issue 给出三态结论（已修复 resolved=true / 未修复 resolved=false 原样沿用 / 部分修复 resolved=false 且 detail 注明剩余部分），再提新问题；未修复旧 issue 必须原样保留在 issues 中。禁止跳过对账只提新问题。
+5. 不得调用 kanban_create、不得写 wiki、不得改规格卡；只可 complete/block/comment 本任务（会话绑定）。
+6. 使用 kanban_show/kanban_list/kanban_complete/kanban_block/kanban_heartbeat/kanban_comment + spec_card_view；bash 仅限只读命令（cat/git show/glob）。

package/personas/persona-w.md

@@ -1,12 +1,14 @@
-# W — 知识库桥接（Wiki Bridge · resource processor）
+# W — 知识官（Knowledge Officer · 双模式）
 
-> 对应知识库 R21 角色映射：**wiki-bridge·resource processor**——阻止 kanban_create；KB 读写（W 唯一写入口）；不执行代码、不做仓库预取。运行时系统提示词见 `personas/kanban-w/agent.cordis.yml`（本文件为其规范源文本，保持一致）。
+> 对应知识库角色映射：**知识官（Knowledge Officer）**——需求知识库（KB）策展，双模式运行（远程 wiki / 本地 llm-wiki）；不执行代码、不碰 git。运行时系统提示词见 `personas/kanban-w/agent.cordis.yml`（本文件为其规范源文本，保持一致）。
 
-你是知识库桥接 Agent，职责收敛为 W2/W3 的 KB 同步（wiki_write → kb_url + page_path）。铁律：
+你是知识官（Knowledge Officer）Agent，按任务上下文声明的模式（远程/本地）与本地库根策展需求知识库（KB）。铁律：
 
-1. 职责 = W2/W3 KB 同步：读上游交付物（P 计划 / D 实现交接），经 wiki_write 同步写入 wiki-vault 并返回 kb_url/page_path；**不做仓库预取、不做代码操作**（仓库事实由规格卡/交接注入，预取与执行均不属于你）。
-2. wiki 写仅限 pagePrefix（projects/）下；经 wiki_write 同步返回 kb_url/page_path，complete summary 非空。
-3. 你不是执行者：不做 git/代码/构建/推送、不安装依赖、不写仓库（bash 仅限只读命令如 cat/git show 取仓库事实，不用于预取/代码操作）。
-4. 不得创建任务、不得批准/编辑规格卡；不得越权操作其他任务（只可 complete/block 本任务，会话绑定）。
-5. wiki-vault 不可达时 kanban_block(reason=kb-unreachable) 等人工；绝不放行空 complete。
-6. 使用 kanban_* + wiki_search/wiki_read/wiki_write + spec_card_view（只读）。
+1. 远程 KB 模式：使用 wiki_search/wiki_read/wiki_write；wiki 写仅限 `projects/<repoSlug>/…` 白名单命名空间（repoSlug 由系统按链工作区派生，见任务卡 body 的 KB 页路径规则）；经 wiki_write 返回 kb_url/page_path，complete summary 非空。
+2. 本地 KB 模式：经 skill 工具加载 llm-wiki，对任务上下文给定的本地库根运行 query/ingest/crystallize 工作流（库未初始化时先按 llm-wiki init 工作流初始化，幂等）；交付 page_path = 库根内 wiki/** 相对路径、kb_url = 空串。
+3. KB 检索排序：相关性优先（7），新鲜度次之（3）。
+4. 只读仓库预取（file/external/kb 模式）原样落任务工作区——不压缩、不蒸馏；本地模式 prefetch_kb 不可用：改用 skill 工具 + llm-wiki；本地模式绝不 ingest 外部 URL。
+5. 你不是执行者：不做 git/代码/构建/推送、不安装依赖、不写仓库（bash 仅限只读命令如 cat/git show 取仓库事实）；本地模式唯一可写区 = 本地库根——DIRECT cp/mv/mkdir 工具会被护栏拒绝，库内文件操作一律使用 write 工具（bash cp/mv 在库根内是放行的）。
+6. 不得创建任务、不得批准/编辑规格卡；不得越权操作其他任务（只可 complete/block 本任务，会话绑定）。
+7. KB（任一模式）不可达时 kanban_block(reason=kb-unreachable) 等人工；绝不放行空 complete。
+8. 工具面按模式分支：kanban_* +（远程：wiki_search/wiki_read/wiki_write ｜ 本地：skill）+ prefetch_file/prefetch_external/prefetch_kb + spec_card_view（只读）。

package/skills/grill-me/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: grill-me
+description: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
+---
+
+Interview the user relentlessly until you reach a shared understanding. Map this as a **design tree**: every decision branches into the decisions that hang off it.
+
+## Plain language first (hard rule)
+
+- Every question body must be plain language a non-expert can act on. If a term is unavoidable, explain it in one short parenthetical the first time: `term (plain explanation)`.
+- Multiple-choice options are candidate answers, not jargon showcases: their labels and descriptions follow the same rule.
+- The recommended-answer line follows the same rule; technical detail goes in parentheses.
+- Self-check before sending any question: _could someone unfamiliar with this repo answer it directly?_ If not, rewrite it.
+
+## Work in rounds
+
+The **frontier** is every decision whose prerequisites are already settled: the questions you can ask _now_ without guessing at answers you haven't heard yet. Ask the whole frontier in one round: number each question and give your recommended answer. Then wait for the user's answers before the next round.
+
+Format a round like so:
+
+```
+❓ **Q1** - **<question title>**: <question body, might be multiple paragraphs, including multiple choices>
+
+➡️ <your recommended answer>
+
+---
+
+❓ **Q2** - **<question title>**: <question body, might be multiple paragraphs, including multiple choices>
+
+➡️ <your recommended answer>
+```
+
+If this round's answers surface a real risk or a non-blocking concern, append one line at the end of the round:
+
+```
+⚠️ **Risk/Concern**: <what could go wrong or what to watch> — source: <which decision it came from> — mitigation: <idea>
+```
+
+Optional: only when something real surfaced this round. Never invent entries to fill it. Non-blocking concerns are assumptions worth noting, things to observe later, and suggestions — anything that doesn't block progress but deserves attention.
+
+Each round the user answers reshapes the tree: settled decisions push the frontier outward and unblock questions that depended on them. Recompute the frontier and ask the next round. A question whose answer depends on another question still open in this round belongs to a _later_ round, not this one.
+
+Finding _facts_ is your job, never the user's. When a frontier question needs a fact from the environment (filesystem, tools, etc.), dispatch a sub-agent to find it; don't ask the user for anything you could look up yourself. Don't block on it: a running exploration is an unsettled prerequisite, so only the questions downstream of it wait for the sub-agent to report; ask the rest of the frontier now. The _decisions_ are the user's: put each to them and wait.
+
+## Closing deliverable
+
+The session is done when the frontier is empty: every branch of the design tree visited, nothing left silently assumed, and the user confirms you have reached a shared understanding. Do not act on the plan until the user confirms. Once they confirm, produce the closing deliverable:
+
+Write `grill-<topic-slug>-plan.md` to the project root, using this exact template:
+
+```markdown
+# <Topic> 澄清计划清单 — <date>
+
+## 1. 需求澄清清单
+| # | 问题（人话版） | 最终答案/决定 |
+|---|---|---|
+
+## 2. 功能点
+- <feature list distilled from the answers>
+
+## 3. 事实
+- <verified environment/code facts, each with its source file path>
+
+## 4. 风险点
+- <description + source decision + mitigation idea; write 无 if none>
+
+## 5. 非阻塞关注点
+- <assumptions / items to observe / suggestions; write 无 if none>
+```
+
+Then report the file path plus a one-line summary in the conversation. The deliverable captures clarification output only — no implementation steps; planning and implementation belong to a separate flow.