@stofone/dsh-agent-roster 0.6.2 → 0.8.0

package/lib/tools.js

@@ -1,8 +1,8 @@
 /**
- * 五个模型可见工具：列档案、看成员、生成桥接调用、核对运行时、读公共档案源。
- * （roster_list / roster_show / roster_create / roster_verify / roster_index）
+ * 六个模型可见工具：列档案、看成员、生成桥接调用、核对运行时、比对两代档案、读公共档案源。
+ * （roster_list / roster_show / roster_create / roster_verify / roster_diff / roster_index）
  *
- * 只读优先：`roster_list` / `roster_show` / `roster_verify` 只读文件系统；
+ * 只读优先：`roster_list` / `roster_show` / `roster_verify` / `roster_diff` 只读文件系统；
  * `roster_create` 也不写任何东西——它输出的是**参数**，真正的成员创建仍由队长调用
  * dsh-agent-teams 的工具完成。插件不替运行时做决定，也不在背后改别人的状态。
  *
@@ -10,15 +10,29 @@
  */
 import { defineTool } from "@deepseek-ai/dsh-tools";
 
-import { buildMemberBinding, describeField, summarizeBinding } from "./bridge.js";
+import nodePath from "node:path";
+
+import { buildMemberBinding, describeField, provenanceLine, summarizeBinding } from "./bridge.js";
+import { CAPABILITY_HINTS, capabilityRequirements, checkCapabilities } from "./capabilities.js";
+import { diffRosters } from "./diff.js";
 import { LIMITS } from "./format.js";
 import { resolveDirSpec } from "./home.js";
 import { lossless } from "./json.js";
-import { scanRosterLibrary, findRoster } from "./registry.js";
-import { renderBridgePlan, renderCaptainVerification, renderRosterDetail, renderRosterList, renderVerifyReport } from "./render.js";
+import { findRoster, loadRosterAt, scanRosterLibrary } from "./registry.js";
+import {
+  renderBridgePlan,
+  renderCapabilityGate,
+  renderCapabilityReport,
+  renderCapabilityRequirements,
+  renderCaptainVerification,
+  renderRosterDetail,
+  renderRosterDiff,
+  renderRosterList,
+  renderVerifyReport,
+} from "./render.js";
 import { readDeployedCaptains, verifyCaptain } from "./captain.js";
 import { readTeamStates, resolveStateDir } from "./teams-state.js";
-import { filterChecks, verifyBindings } from "./verify.js";
+import { filterChecks, memberVerdict, verifyBindings } from "./verify.js";
 
 /** 工具输出统一的对象 schema：结构字段给程序，`text` 给人读。 */
 const OUTPUT = { type: "object", additionalProperties: true };
@@ -47,6 +61,14 @@ export function registerRosterTools(ctx, config, meta) {
   // args.path 是显式的档案库覆盖；没有就给配置里的 rosterDirs[0]。
   const resolve = (exec, override) => resolvePaths(config, exec, override);
   const scanAt = (rootDir) => scanRosterLibrary({ rootDir, knownToolPolicies: config.knownToolPolicies ?? null });
+  // 档案文件内容的哈希：只有重新读一次那份文件才拿得到（扫描结果里不带字节）。
+  const shaOf = (rootDir, roster) => {
+    const loaded = loadRosterAt(nodePath.join(rootDir, roster.id), {
+      expectedId: roster.id,
+      knownToolPolicies: config.knownToolPolicies ?? null,
+    });
+    return loaded.ok && typeof loaded.contentSha === "string" ? loaded.contentSha : null;
+  };
 
   ctx.effect(
     () =>
@@ -72,6 +94,7 @@ export function registerRosterTools(ctx, config, meta) {
             const text = [
               statusLine("roster_list", {
                 rootDir: rosterDir,
+                organization: scan.organization === null ? "none" : scan.organization.id,
                 total: scan.stats.total,
                 ok: scan.stats.ok,
                 failed: scan.stats.failed,
@@ -84,6 +107,8 @@ export function registerRosterTools(ctx, config, meta) {
               workspace,
               rootDir: rosterDir,
               stats: scan.stats,
+              organization: scan.organization,
+              organizationCheck: scan.organizationCheck,
               rosters: scan.rosters.map((roster) => ({
                 id: roster.id,
                 version: roster.version,
@@ -126,7 +151,7 @@ export function registerRosterTools(ctx, config, meta) {
           },
           output: { schema: OUTPUT, render: (_args, value) => [{ type: "text", text: value.text }] },
           async execute(args, exec) {
-            const { rosterDir } = resolve(exec, args.path);
+            const { rosterDir, workspace } = resolve(exec, args.path);
             const scan = scanAt(rosterDir);
             const hit = findRoster(scan.rosters, args.ref);
             if (hit === null) {
@@ -163,16 +188,20 @@ export function registerRosterTools(ctx, config, meta) {
                 const { binding } = buildMemberBinding(roster, member);
                 return { member, fields: binding.fields, summary: summarizeBinding(binding) };
               });
-            const text = [
+            const capabilities = scan.capabilities?.[roster.id] ?? null;
+            const blocks = [
               statusLine("roster_show", {
                 found: true,
                 roster: roster.id,
                 version: roster.version,
                 members: members.length,
                 matchedBy: hit.via,
+                requires: capabilityRequirements(capabilities).length,
               }),
               renderRosterDetail(roster, only),
-            ].join("\n\n");
+            ];
+            if (capabilities !== null) blocks.push(renderCapabilityRequirements(roster, capabilities));
+            const text = blocks.join("\n\n");
             return lossless({
               found: true,
               matchedBy: hit.via,
@@ -202,6 +231,7 @@ export function registerRosterTools(ctx, config, meta) {
                 bindingSummary: summary,
               })),
               captain: roster.captain ?? null,
+              capabilities,
               diagnostics: scan.diagnostics,
               text,
             });
@@ -238,7 +268,7 @@ export function registerRosterTools(ctx, config, meta) {
           },
           output: { schema: OUTPUT, render: (_args, value) => [{ type: "text", text: value.text }] },
           async execute(args, exec) {
-            const { rosterDir } = resolve(exec, args.path);
+            const { rosterDir, workspace } = resolve(exec, args.path);
             const scan = scanAt(rosterDir);
             const hit = findRoster(scan.rosters, args.ref);
             const fail = (message) =>
@@ -259,7 +289,44 @@ export function registerRosterTools(ctx, config, meta) {
                 `档案 ${roster.id} 里没有成员 ${[...(wanted ?? [])].join(", ")}；可用：${roster.members.map((m) => m.name).join(", ")}`,
               );
             }
+            // 能力闸门：档案只声明"要用到什么"，这里核对"这台机器有没有"。
+            // 缺了就拒绝出参数（onMissing 默认 refuse）——先建了再补，等于让假绿换个位置住下来。
+            const capabilities = scan.capabilities?.[roster.id] ?? null;
+            let gate = null;
+            if (capabilities !== null) {
+              const knownSkills = await readKnownSkills(ctx, workspace);
+              gate = checkCapabilities([roster], { [roster.id]: capabilities }, {
+                knownSkills,
+                knownToolPolicies: config.knownToolPolicies ?? null,
+              }).entries[0] ?? null;
+              if (gate !== null && gate.blocked) {
+                return lossless({
+                  ok: false,
+                  blocked: true,
+                  rosterId: roster.id,
+                  rosterVersion: roster.version,
+                  capabilities: gate,
+                  diagnostics: scan.diagnostics,
+                  text: [
+                    statusLine("roster_create", {
+                      ok: false,
+                      blocked: true,
+                      roster: roster.id,
+                      missing: gate.missing.length,
+                    }),
+                    renderCapabilityGate(roster, gate, CAPABILITY_HINTS),
+                    "档案没有被改动；补齐上面列出的能力后重新调用即可。\n" +
+                      "若确有应急需要（先有人干活），在该档案目录的 capabilities.yaml 里写 onMissing: degraded——" +
+                      "但那会在每次核对时留下 \"degraded\" 记录，不会被当成通过。",
+                  ].join("\n\n"),
+                });
+              }
+            }
             const entries = selected.map((member) => ({ member, ...buildMemberBinding(roster, member) }));
+            // 团队状态里没有"由哪一版档案建成"，只能把出处写进 description。
+            // 插件仍然不写 team.json：它只给出建议的那一行，由队长传进 agent_teams_create。
+            const contentSha = shaOf(rosterDir, roster);
+            const provenance = provenanceLine(roster, contentSha ?? undefined);
             const text = [
               statusLine("roster_create", {
                 ok: true,
@@ -268,11 +335,19 @@ export function registerRosterTools(ctx, config, meta) {
                 calls: entries.length,
               }),
               renderBridgePlan({ roster, entries }),
-            ].join("\n\n");
+              `建团队时把这一行放进 agent_teams_create 的 description（插件不写团队状态）：\n  ${provenance}\n` +
+                "之后 roster_verify 会把团队声明的这一行与当前档案内容比对；对不上就说明档案在建团队之后改过。",
+            ];
+            if (gate !== null && gate.missing.length > 0) {
+              text.push(renderCapabilityGate(roster, gate, CAPABILITY_HINTS));
+            }
+            const textBlocks = text.join("\n\n");
             return lossless({
               ok: true,
               rosterId: roster.id,
               rosterVersion: roster.version,
+              provenance: { line: provenance, rosterId: roster.id, version: roster.version, contentSha },
+              capabilities: gate,
               calls: entries.map((entry) => ({ tool: "agent_teams_add_member", arguments: entry.args })),
               planMembers: entries.map((entry) => entry.planMember),
               bindings: entries.map((entry) => ({
@@ -282,7 +357,7 @@ export function registerRosterTools(ctx, config, meta) {
               })),
               nextStep: "把每个 calls[].arguments 原样传给 agent_teams_add_member；随后用 roster_verify 核对运行时实际值",
               diagnostics: scan.diagnostics,
-              text,
+              text: textBlocks,
             });
           },
           presentCall: (args) => ({ card: "generic", title: `桥接档案 ${args.ref}` }),
@@ -350,7 +425,17 @@ export function registerRosterTools(ctx, config, meta) {
             const state = readTeamStates({ stateDir, teamId: args.team });
             // 技能是声明层：只有宿主真的能列出技能目录时才核对，否则如实记成"无法核对"。
             const knownSkills = await readKnownSkills(ctx, workspace);
-            let report = verifyBindings(rosters, state.teams, { knownSkills });
+            const rosterShas = {};
+            for (const roster of rosters) {
+              const sha = shaOf(rosterDir, roster);
+              if (sha !== null) rosterShas[roster.id] = sha;
+            }
+            let report = verifyBindings(rosters, state.teams, {
+              knownSkills,
+              rosterShas,
+              knownToolPolicies: config.knownToolPolicies ?? null,
+              capabilitiesById: scan.capabilities ?? {},
+            });
             // 队长不是成员行：只能拿实际的部署配置去比档案里的声明，读不到就记成“无法核对”。
             const deployedCaptains = readDeployedCaptains();
             const captainReports = rosters
@@ -359,21 +444,39 @@ export function registerRosterTools(ctx, config, meta) {
             if (Array.isArray(args.members) && args.members.length > 0) {
               report = filterChecks(report, args.members);
             }
-            const ok = report.summary.degraded === 0 && state.available;
+            // `ok` 只判"部署侧有没有漂移"。人设拿不到回执是上游 team.json 不持久化该键，
+            // 那不是部署做错了——所以它单列成 unverified，绝不混进 ok，也不许悄悄消失。
+            // 能力缺失只有在 onMissing: refuse 时才翻红：degraded 是"明知缺、仍要建"的显式选择，
+            // 那笔账记在 summary.capabilityMissing 里，不该被伪装成通过，也不该被伪装成失败。
+            const ok =
+              report.summary.drift === 0 &&
+              report.summary.missing === 0 &&
+              report.summary.capabilityBlocked === 0 &&
+              state.available;
+            const summary = report.summary;
             const text = [
               statusLine("roster_verify", {
                 ok,
                 state: state.available ? "available" : "unavailable",
-                members: report.summary.members,
-                deployed: report.summary.deployed,
-                faithful: report.summary.faithful,
-                degraded: report.summary.degraded,
-                missing: report.summary.missing,
-                unmanaged: report.summary.unmanaged,
-                skills: `${report.summary.skillsMissing}/${report.summary.skillsDeclared}`,
+                members: summary.members,
+                deployed: summary.deployed,
+                faithful: summary.faithful,
+                unverified: summary.unverified,
+                drift: summary.drift,
+                missing: summary.missing,
+                unmanaged: summary.unmanaged,
+                toolFilter: `${summary.toolFilterChecked}/${summary.toolFilterChecked + summary.toolFilterMissing}`,
+                policyDrift: summary.policyDrift,
+                provenance: `${summary.provenanceAbsent}absent/${summary.provenanceDiffer}differ`,
+                skills: `${summary.skillsMissing}/${summary.skillsDeclared}`,
+                requires: `${summary.capabilityMissing}missing/${summary.capabilityDeclared}`,
+                capabilityBlocked: summary.capabilityBlocked,
                 captain: captainReports.length,
               }),
               renderVerifyReport(report, { rosterIds: refRosterIds }),
+              ...(report.capabilities.entries.length === 0
+                ? []
+                : [renderCapabilityReport(report.capabilities.entries, CAPABILITY_HINTS)]),
               ...(captainReports.length === 0
                 ? []
                 : [
@@ -385,7 +488,13 @@ export function registerRosterTools(ctx, config, meta) {
             return lossless({
               ok,
               stateDir,
-              teams: state.teams.map((team) => ({ id: team.id, name: team.name, phase: team.phase, file: team.file })),
+              teams: state.teams.map((team) => ({
+                id: team.id,
+                name: team.name,
+                phase: team.phase,
+                file: team.file,
+                description: typeof team.description === "string" ? team.description : "",
+              })),
               summary: report.summary,
               checks: report.checks.map((check) => ({
                 rosterId: check.rosterId,
@@ -394,15 +503,21 @@ export function registerRosterTools(ctx, config, meta) {
                 found: check.found,
                 teamId: check.teamId,
                 faithful: check.faithful,
+                verdict: memberVerdict(check),
+                toolPolicy: check.toolPolicy ?? null,
+                toolFilter: check.toolFilter ?? null,
                 fields: check.binding === null ? [] : check.binding.fields,
               })),
               unmanaged: report.unmanaged,
+              policyDrift: report.policyDrift,
+              provenance: report.provenance,
               captain: captainReports.map(({ roster, verified }) => ({
                 rosterId: roster.id,
                 ok: verified.ok,
                 checks: verified.checks,
               })),
               skills: report.skills,
+              capabilities: report.capabilities,
               diagnostics: [...scan.diagnostics, ...state.diagnostics],
               text,
             });
@@ -414,6 +529,119 @@ export function registerRosterTools(ctx, config, meta) {
     "dsh-agent-roster: roster_verify",
   );
 
+  ctx.effect(
+    () =>
+      ctx.tools.register(
+        defineTool({
+          name: "roster_diff",
+          description:
+            "比较两份档案的语义差异：换班时回答\"新一代改了什么\"。" +
+            "成员按 name 对齐（aliases 只作提示，不自动合并，改名会显示成删一个、加一个）；" +
+            "比的是有效值（defaults 已合进成员），并标注这个值来自成员还是 defaults。" +
+            "人设只比长度与内容哈希，不把整段文字贴出来。本工具只读，不写任何东西。",
+          parameters: {
+            from: { type: "string", required: true, description: "旧档案所在目录：档案目录本身，或包含它的档案库目录" },
+            to: { type: "string", required: true, description: "新档案所在目录：档案目录本身，或包含它的档案库目录" },
+            id: {
+              type: "string",
+              description: "目录里有不止一份档案时，指明要比较哪一份（档案 id）；省略时要求目录里恰好只有一份",
+            },
+          },
+          output: { schema: OUTPUT, render: (_args, value) => [{ type: "text", text: value.text }] },
+          async execute(args, exec) {
+            const { workspace } = resolve(exec, undefined);
+            const fail = (message, diagnostics = []) =>
+              lossless({
+                ok: false,
+                text: [statusLine("roster_diff", { ok: false, from: args.from, to: args.to }), message].join("\n\n"),
+                diagnostics,
+              });
+
+            const load = (spec) => {
+              const dir = resolveDirSpec(spec, workspace);
+              const direct = loadRosterAt(dir, { knownToolPolicies: config.knownToolPolicies ?? null });
+              if (direct.ok) return { ok: true, dir, roster: direct.roster, contentSha: direct.contentSha, diagnostics: direct.diagnostics };
+              const scan = scanRosterLibrary({ rootDir: dir, knownToolPolicies: config.knownToolPolicies ?? null });
+              const candidates = args.id === undefined ? scan.rosters : scan.rosters.filter((item) => item.id === args.id);
+              const diagnostics = [...direct.diagnostics, ...scan.diagnostics];
+              if (candidates.length === 0) {
+                return {
+                  ok: false,
+                  dir,
+                  diagnostics,
+                  reason:
+                    `目录 "${dir}" 里没有可用的档案` +
+                    (args.id === undefined ? "。" : `（id=${args.id}）。`) +
+                    "请指向档案目录本身，或指向包含它的档案库目录。",
+                };
+              }
+              if (candidates.length > 1) {
+                return {
+                  ok: false,
+                  dir,
+                  diagnostics,
+                  reason: `目录 "${dir}" 里有 ${candidates.length} 份档案，请用 id 指明要比较哪一份：${candidates.map((item) => item.id).join(", ")}`,
+                };
+              }
+              const only = candidates[0];
+              const loaded = loadRosterAt(nodePath.join(dir, only.id), {
+                expectedId: only.id,
+                knownToolPolicies: config.knownToolPolicies ?? null,
+              });
+              return {
+                ok: loaded.ok,
+                dir,
+                roster: loaded.roster,
+                contentSha: loaded.contentSha,
+                diagnostics: [...diagnostics, ...loaded.diagnostics],
+                reason: loaded.ok ? undefined : `档案 ${only.id} 校验不通过，无法比较。`,
+              };
+            };
+
+            const left = load(args.from);
+            if (left.ok !== true) return fail(left.reason ?? "旧档案读不出来。", left.diagnostics);
+            const right = load(args.to);
+            if (right.ok !== true) return fail(right.reason ?? "新档案读不出来。", right.diagnostics);
+
+            const diff = diffRosters(left.roster, right.roster);
+            const labels = {
+              from: { id: left.roster.id, version: left.roster.version, sha: left.contentSha },
+              to: { id: right.roster.id, version: right.roster.version, sha: right.contentSha },
+            };
+            const sameFile =
+              typeof left.contentSha === "string" && left.contentSha === right.contentSha
+                ? "（两份是逐字节相同的文件）"
+                : "";
+            const text = [
+              statusLine("roster_diff", {
+                ok: true,
+                from: `${left.roster.id}@${left.roster.version}`,
+                to: `${right.roster.id}@${right.roster.version}`,
+                added: diff.counts.added,
+                removed: diff.counts.removed,
+                changed: diff.counts.changed,
+              }),
+              renderRosterDiff(diff, labels) + (sameFile === "" ? "" : `\n${sameFile}`),
+            ].join("\n\n");
+            return lossless({
+              ok: true,
+              from: labels.from,
+              to: labels.to,
+              rosters: diff.rosters,
+              members: diff.members,
+              skills: diff.skills,
+              counts: diff.counts,
+              diagnostics: [...left.diagnostics, ...right.diagnostics],
+              text,
+            });
+          },
+          presentCall: (args) => ({ card: "generic", title: `比较档案 ${args.from} → ${args.to}` }),
+          presentResult: (_args, result) => ({ card: "generic", title: result.isError ? "比较失败" : "档案差异" }),
+        }),
+      ),
+    "dsh-agent-roster: roster_diff",
+  );
+
   ctx.effect(
     () =>
       ctx.tools.register(

package/lib/verify.js

@@ -10,23 +10,44 @@
  * - `skills` 是声明层字段，运行时不会帮你加载技能；宿主把技能目录传进来时，
  *   这里只负责回答"声明了但没装"这一件事，不假装已生效。
  *
+ * 两条可见性规则（issue #2）：
+ * - 每个成员带出 `toolFilter` 的规范化摘要。只比 `toolPolicy` 这个 id 的话，
+ *   部署侧改了策略定义、旧成员还拿着旧列表时，核对永远是绿的。
+ * - 每个团队带出溯源结论。`team.json` 没有"由哪一版档案建成"的字段，只能读 description
+ *   里 `roster:<id>@<version>#<sha8>` 这一行，再与档案文件现在的哈希对比。
+ *
  * @module dsh-agent-roster/verify
  */
-import { buildMemberBinding, isBindingFaithful, reconcileBinding, summarizeBinding } from "./bridge.js";
+import {
+  buildMemberBinding,
+  isBindingFaithful,
+  parseProvenanceLine,
+  reconcileBinding,
+  summarizeBinding,
+} from "./bridge.js";
+import { checkCapabilities } from "./capabilities.js";
+import { shortSha, toolFilterDigest } from "./digest.js";
 
 /**
  * 逐个成员核对档案与团队状态。
  *
  * @param {object[]} rosters 已校验档案
  * @param {object[]} teams `readTeamStates` 产出的团队记录
- * @param {{ knownSkills?: string[] }} [options] 宿主已知技能目录；缺省表示无法核对技能
- * @returns {{ checks: object[], unmanaged: object[], skills: object[], summary: object }}
+ * @param {{ knownSkills?: string[], rosterShas?: Record<string, string>,
+ *   knownToolPolicies?: string[], capabilitiesById?: Record<string, object> }} [options]
+ *   `knownSkills`：宿主已知技能目录，缺省表示无法核对技能；
+ *   `rosterShas`：档案 id → 档案文件内容的 sha256，用于核对团队溯源串；
+ *   `knownToolPolicies`：部署已声明的策略 id，缺省表示无法核对能力要求里的策略；
+ *   `capabilitiesById`：档案 id → 能力要求（`capabilities.yaml`），缺省表示没有声明要求。
+ * @returns {{ checks: object[], unmanaged: object[], skills: object[], policyDrift: object[],
+ *   provenance: object[], capabilities: { entries: object[], summary: object }, summary: object }}
  */
 export function verifyBindings(rosters, teams, options = {}) {
   const knownSkills =
     Array.isArray(options.knownSkills) && options.knownSkills.length > 0
       ? new Set(options.knownSkills.filter((name) => typeof name === "string" && name !== ""))
       : null;
+  const rosterShas = options.rosterShas ?? {};
 
   const checks = [];
   const managedNames = new Set();
@@ -56,6 +77,8 @@ export function verifyBindings(rosters, teams, options = {}) {
           teamName: null,
           matchedAs: null,
           binding: null,
+          toolPolicy: "",
+          toolFilter: null,
           faithful: false,
           summary: null,
         });
@@ -84,6 +107,8 @@ export function verifyBindings(rosters, teams, options = {}) {
           teamName: team.name,
           matchedAs: teamMember.name,
           binding,
+          toolPolicy: typeof teamMember.toolPolicy === "string" ? teamMember.toolPolicy : "",
+          toolFilter: toolFilterDigest(teamMember.toolFilter),
           faithful: isBindingFaithful(binding),
           summary: summarizeBinding(binding),
         });
@@ -122,19 +147,113 @@ export function verifyBindings(rosters, teams, options = {}) {
     }
   }
 
+  // 同一个 toolPolicy 在同一支团队里必须物化成同一份 deny 列表。
+  // 这条不变量今天成立，所以它恰恰最该被断言——一旦部署侧改了策略定义、
+  // 而旧成员仍拿着旧列表，只比 id 的核对永远看不出来。
+  const policyDrift = [];
+  for (const team of teams) {
+    const byPolicy = new Map();
+    for (const member of team.members) {
+      const policy = typeof member.toolPolicy === "string" ? member.toolPolicy : "";
+      if (policy === "") continue;
+      const digest = toolFilterDigest(member.toolFilter);
+      if (digest === null) continue;
+      if (!byPolicy.has(policy)) byPolicy.set(policy, new Map());
+      const bySha = byPolicy.get(policy);
+      if (!bySha.has(digest.sha)) bySha.set(digest.sha, { sha: digest.sha, deny: digest.deny, members: [] });
+      bySha.get(digest.sha).members.push(typeof member.name === "string" ? member.name : "");
+    }
+    for (const [policy, bySha] of byPolicy) {
+      if (bySha.size < 2) continue;
+      policyDrift.push({
+        teamId: team.id,
+        teamName: team.name,
+        toolPolicy: policy,
+        variants: [...bySha.values()].sort((left, right) => right.members.length - left.members.length),
+      });
+    }
+  }
+
+  // 溯源：团队是哪一版档案建的。只读 description，不改它。
+  const provenance = teams.map((team) => {
+    const parsed = parseProvenanceLine(team.description ?? "");
+    const base = { teamId: team.id, teamName: team.name, declared: parsed === null ? null : parsed.raw };
+    if (parsed === null) return { ...base, status: "absent", rosterId: null, version: null, sha: null, currentSha: null };
+    const current = typeof rosterShas[parsed.id] === "string" ? rosterShas[parsed.id] : null;
+    if (current === null) {
+      return { ...base, status: "unknown-roster", rosterId: parsed.id, version: parsed.version, sha: parsed.sha, currentSha: null };
+    }
+    const currentSha = shortSha(current);
+    if (parsed.sha === null) {
+      return { ...base, status: "id-only", rosterId: parsed.id, version: parsed.version, sha: null, currentSha };
+    }
+    return {
+      ...base,
+      status: parsed.sha === currentSha ? "match" : "differ",
+      rosterId: parsed.id,
+      version: parsed.version,
+      sha: parsed.sha,
+      currentSha,
+    };
+  });
+
+  // 能力要求是档案级（不是成员级），单独一栏：它回答"这台机器有没有条件把这支队伍建起来"。
+  const capabilityReport = checkCapabilities(rosters, options.capabilitiesById ?? {}, {
+    knownSkills: options.knownSkills ?? null,
+    knownToolPolicies: options.knownToolPolicies ?? null,
+  });
+
+  // 三个互斥的判读桶，加未部署：每个成员只会落进一个桶，避免"忠实 3 + 降级 2"这种加起来对不上的账。
+  const buckets = { faithful: 0, drift: 0, unverified: 0, missing: 0 };
+  for (const check of checks) buckets[memberVerdict(check)] += 1;
+
   const summary = {
     members: checks.length,
     deployed: checks.filter((check) => check.found).length,
-    faithful: checks.filter((check) => check.found && check.faithful).length,
-    degraded: checks.filter((check) => check.found && !check.faithful).length,
-    missing: checks.filter((check) => !check.found).length,
+    faithful: buckets.faithful,
+    /** 真降级：运行时换了值，或团队里根本没有这个成员。 */
+    drift: buckets.drift,
+    /** 只有"发了却没留痕"的字段（今天只有 systemPrompt）：无法核对，不等于没生效。 */
+    unverified: buckets.unverified,
+    /** 不忠实总数 = drift + unverified，保留旧字段名供旧调用方使用。 */
+    degraded: buckets.drift + buckets.unverified,
+    missing: buckets.missing,
     unmanaged: unmanaged.length,
     skillsDeclared: skills.length,
     skillsMissing: skills.filter((item) => item.missing.length > 0).length,
     skillsUnverified: skills.filter((item) => !item.checked).length,
+    toolFilterChecked: checks.filter((check) => check.found && check.toolFilter !== null).length,
+    toolFilterMissing: checks.filter((check) => check.found && check.toolFilter === null).length,
+    policyDrift: policyDrift.length,
+    provenanceAbsent: provenance.filter((item) => item.status === "absent").length,
+    provenanceDiffer: provenance.filter((item) => item.status === "differ").length,
+    /** 能力要求总数 / 缺失 / 核对不到 / 会拦住建队的档案数。 */
+    capabilityDeclared: capabilityReport.summary.declared,
+    capabilityMissing: capabilityReport.summary.missing,
+    capabilityUnknown: capabilityReport.summary.unknown,
+    capabilityBlocked: capabilityReport.summary.blocked,
   };
 
-  return { checks, unmanaged, skills, summary };
+  return { checks, unmanaged, skills, policyDrift, provenance, capabilities: capabilityReport, summary };
+}
+
+/**
+ * 一个成员的判读结论，四个互斥取值。
+ *
+ * - `faithful`：被运行时承载的字段全部拿到回执且一致；
+ * - `unverified`：只有"发了却没留痕"的字段（今天只有 systemPrompt），无法核对，但没看到漂移；
+ * - `drift`：运行时换了值，或团队里根本没有这个成员——这才是要动手修的；
+ * - `missing`：档案定义了、运行时没有同名成员。
+ *
+ * @param {object} check `verifyBindings` 产出的单条核对记录
+ * @returns {"faithful" | "unverified" | "drift" | "missing"}
+ */
+export function memberVerdict(check) {
+  if (check === null || check.found !== true) return "missing";
+  if (check.faithful === true) return "faithful";
+  const summary = check.summary ?? { counts: {}, unverified: 0 };
+  const realDrift = (summary.counts.overridden ?? 0) > 0 || (summary.counts.unconfirmed ?? 0) > 0;
+  return realDrift ? "drift" : "unverified";
 }
 
 /**
@@ -152,13 +271,19 @@ export function filterChecks(report, names) {
   const checks = report.checks.filter(
     (check) => wanted.has(check.member) || (check.matchedAs !== null && wanted.has(check.matchedAs)),
   );
+  const buckets = { faithful: 0, drift: 0, unverified: 0, missing: 0 };
+  for (const check of checks) buckets[memberVerdict(check)] += 1;
   const summary = {
     ...report.summary,
     members: checks.length,
     deployed: checks.filter((check) => check.found).length,
-    faithful: checks.filter((check) => check.found && check.faithful).length,
-    degraded: checks.filter((check) => check.found && !check.faithful).length,
-    missing: checks.filter((check) => !check.found).length,
+    faithful: buckets.faithful,
+    drift: buckets.drift,
+    unverified: buckets.unverified,
+    degraded: buckets.drift + buckets.unverified,
+    missing: buckets.missing,
+    toolFilterChecked: checks.filter((check) => check.found && check.toolFilter !== null).length,
+    toolFilterMissing: checks.filter((check) => check.found && check.toolFilter === null).length,
   };
   return { ...report, checks, summary };
 }