@team-agent/installer 0.3.5 → 0.3.7

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -18,6 +18,45 @@ pub(super) fn quick_start_team_dir(role_doc: &str) -> PathBuf {
     team
 }
 
+/// E5 spec 迁移:spec 不再落 team_dir,而在 <team_workspace>/.team/runtime/<team_key>/。
+/// team_key = team_dir.name(quick_start_team_dir → "teamdir");workspace = team_workspace(team)。
+pub(super) fn quick_start_runtime_spec_path(team: &std::path::Path) -> PathBuf {
+    let workspace = crate::model::paths::team_workspace(team).unwrap();
+    let team_key = team.file_name().unwrap().to_string_lossy().to_string();
+    crate::model::paths::runtime_spec_path(&workspace, &team_key)
+}
+
+/// 在 team 自身或其 team_workspace 父下找 .team/runtime/*/team.spec.yaml。run_workspace 解析
+/// 可能是 team 或父、team_key 可能因 state 缺省而非 team 名,故扫整个 runtime 目录任一子目录。
+/// `team_key` 给定时优先精确命中,否则取扫到的第一个。
+pub(super) fn find_runtime_spec(team: &std::path::Path, team_key: &str) -> Option<PathBuf> {
+    let mut workspaces = vec![team.to_path_buf()];
+    if let Ok(ws) = crate::model::paths::team_workspace(team) {
+        workspaces.push(ws);
+    }
+    // 精确命中优先。
+    for ws in &workspaces {
+        let exact = crate::model::paths::runtime_spec_path(ws, team_key);
+        if exact.exists() {
+            return Some(exact);
+        }
+    }
+    // 回退:扫 .team/runtime/*/team.spec.yaml。
+    for ws in &workspaces {
+        let runtime = crate::model::paths::runtime_dir(ws);
+        let Ok(entries) = std::fs::read_dir(&runtime) else {
+            continue;
+        };
+        for entry in entries.flatten() {
+            let spec = entry.path().join("team.spec.yaml");
+            if spec.exists() {
+                return Some(spec);
+            }
+        }
+    }
+    None
+}
+
 /// A no-owner running workspace: state.json carries session_name + agents but NO team_owner →
 /// check_team_owner returns None = allowed (owner_gate.rs:48), so the owner-gated entry points can
 /// proceed PAST the owner gate. Also inits the real team.db.
@@ -46,11 +85,16 @@ fn quick_start_compiles_real_spec_to_team_spec_yaml() {
     let result = quick_start_with_transport(&team, None, true, true, None, &transport);
 
     // OBSERVABLE 1 (real compiler ran; spawn-independent): the compiled spec is written.
-    let spec_path = team.join("team.spec.yaml");
+    // E5: spec lands in .team/runtime/<team_key>/ (NOT the user team dir).
+    let spec_path = quick_start_runtime_spec_path(&team);
     assert!(
         spec_path.exists(),
-        "quick_start must compile the team dir and write team.spec.yaml (the real compiler runs \
-         before launch); the stub returns before compiling. result={result:?}"
+        "quick_start must compile the team dir and write team.spec.yaml under .team/runtime/<team_key>/ \
+         (the real compiler runs before launch); the stub returns before compiling. result={result:?}"
+    );
+    assert!(
+        !team.join("team.spec.yaml").exists(),
+        "E5: spec must NOT be written into the user team dir"
     );
     let spec_text = std::fs::read_to_string(&spec_path).unwrap_or_default();
     assert!(
@@ -94,9 +138,11 @@ fn quick_start_teamdir_under_dot_team_uses_project_workspace_for_status_and_coll
         )
         .expect("status/collect selector should resolve project root");
         assert_eq!(selected.run_workspace, workspace, "input={}", input.display());
+        // E5: selector resolves spec_path to .team/runtime/<team_key>/ (team_key="current").
+        let expected_spec = crate::model::paths::runtime_spec_path(&workspace, "current");
         assert_eq!(
             selected.spec_path.as_deref().map(std::fs::canonicalize).transpose().unwrap(),
-            Some(std::fs::canonicalize(team.join("team.spec.yaml")).unwrap()),
+            Some(std::fs::canonicalize(&expected_spec).unwrap()),
             "input={}",
             input.display()
         );
@@ -433,6 +479,164 @@ fn spine_add_agent_rejects_duplicate_agent_id() {
     );
 }
 
+// E5 Bug1 — add-agent must NOT copy the external role file into <team_dir>/agents (the
+// self-copy O_TRUNC truncation reproduced on real machine), and must still inject the new
+// agent into the compiled spec by reading the role file in place.
+#[test]
+fn e5_add_agent_does_not_copy_role_into_platform_dir_and_injects_into_spec() {
+    let team = quick_start_team_dir(QS_VALID_ROLE);
+    // External role file OUTSIDE team_dir/agents, with recognizable body content.
+    let role = team.parent().unwrap().join("w2-external-role.md");
+    let role_body = "---\nname: w2\nrole: Second Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nUNIQUE-E5-BUG1-MARKER body for w2.\n";
+    std::fs::write(&role, role_body).unwrap();
+    let transport = OfflineTransport::new();
+    // The spawn may not complete under OfflineTransport; we only assert the no-copy + spec-inject
+    // observables, which happen BEFORE spawn. Ignore the spawn-stage Result.
+    let _ = add_agent_with_transport(&team, &AgentId::new("w2"), &role, false, None, &transport);
+
+    // (1) No copy landed in the platform agents dir.
+    let copied = team.join("agents").join("w2.md");
+    assert!(
+        !copied.exists(),
+        "add-agent must NOT copy the role file into <team_dir>/agents (anti-pattern + O_TRUNC bug)"
+    );
+    // (2) The external role file is untouched (not truncated by a self-copy).
+    assert_eq!(
+        std::fs::read_to_string(&role).unwrap(),
+        role_body,
+        "external role file must be left intact (no truncating self-copy)"
+    );
+    // (3) The compiled spec (under .team/runtime/<team_key>/, NOT the user team dir) carries w2.
+    let runtime_spec = find_runtime_spec(&team, "teamdir").expect("runtime spec written");
+    let spec_text = std::fs::read_to_string(&runtime_spec).unwrap();
+    assert!(
+        spec_text.contains("w2"),
+        "compiled spec must inject the new agent w2 (read in place, not copied); spec=\n{spec_text}"
+    );
+    assert!(
+        !team.join("team.spec.yaml").exists(),
+        "E5: add_agent must NOT write spec into the user team dir"
+    );
+}
+
+// E5 task#3 / E4 — restart rebuilds the runtime spec from role docs EVERY time: editing a role
+// doc (here: rename a role) is reflected in the freshly-written runtime spec after restart.
+#[test]
+fn e5_restart_rebuilds_runtime_spec_from_role_docs() {
+    let ws = restart_ws_two_resumable_workers(); // has TEAM.md + agents/{alpha,bravo}.md + state
+    // Edit a role doc AFTER initial compile: change alpha's role text.
+    std::fs::write(
+        ws.join("agents").join("alpha.md"),
+        "---\nname: alpha\nrole: RENAMED Alpha Role\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nAlpha edited.\n",
+    )
+    .unwrap();
+    let transport = OfflineTransport::new();
+    let _ = restart_with_transport(&ws, false, None, &transport);
+    // The runtime spec (rebuilt from role docs) must carry the edited role text.
+    let runtime_spec = find_runtime_spec(&ws, "restartteam").expect("runtime spec rebuilt");
+    let spec_text = std::fs::read_to_string(&runtime_spec).unwrap();
+    assert!(
+        spec_text.contains("RENAMED Alpha Role"),
+        "restart must rebuild runtime spec from role docs (E4: TEAM.md/role edits take effect); spec=\n{spec_text}"
+    );
+    assert!(
+        !ws.join("team.spec.yaml").exists(),
+        "E5: rebuilt spec must land in .team/runtime, not the user team dir"
+    );
+}
+
+// E5 task#3 / RC-A6b — restart with role definitions MISSING explicitly refuses (lists what's
+// missing) and leaves the previous runtime spec in place (no silent path, no data destruction).
+#[test]
+fn e5_restart_missing_role_docs_refuses_and_preserves_old_spec() {
+    let ws = restart_ws_two_resumable_workers();
+    // Pre-seed a previous runtime spec so we can assert it survives the refusal.
+    let prev_spec = crate::model::paths::runtime_spec_path(&ws, "restartteam");
+    std::fs::create_dir_all(prev_spec.parent().unwrap()).unwrap();
+    std::fs::write(&prev_spec, "PREVIOUS-RUNTIME-SPEC-MARKER\n").unwrap();
+    // Remove the role definitions (TEAM.md) → role source gone.
+    std::fs::remove_file(ws.join("TEAM.md")).unwrap();
+    let transport = OfflineTransport::new();
+    let result = restart_with_transport(&ws, false, None, &transport);
+    let text = format!("{result:?}");
+    assert!(
+        text.contains("role definitions missing") || text.to_lowercase().contains("missing"),
+        "restart with missing role docs must explicitly refuse listing what's missing; got {text}"
+    );
+    // Old runtime spec preserved untouched (T2: no data destruction on refusal).
+    assert_eq!(
+        std::fs::read_to_string(&prev_spec).unwrap(),
+        "PREVIOUS-RUNTIME-SPEC-MARKER\n",
+        "previous runtime spec must be left in place on refusal"
+    );
+}
+
+// E5 §3 解耦(tester 场景2)— add-agent on a team whose runtime spec already exists must still
+// resolve team_dir to the USER role dir for compile_team (find TEAM.md/agents), not the runtime
+// spec dir. Regression: SelectedTeam.spec_workspace=runtime was used as team_dir → compile_team
+// looked for TEAM.md under .team/runtime/<key>/ → "missing TEAM.md".
+#[test]
+fn e5_add_agent_resolves_team_dir_to_role_dir_when_runtime_spec_exists() {
+    let team = quick_start_team_dir(QS_VALID_ROLE);
+    // Pre-create the runtime spec so the selector's runtime-first branch is taken (migrated team).
+    let runtime_spec = quick_start_runtime_spec_path(&team);
+    std::fs::create_dir_all(runtime_spec.parent().unwrap()).unwrap();
+    let base = crate::compiler::compile_team(&team).unwrap();
+    std::fs::write(&runtime_spec, crate::model::yaml::dumps(&base)).unwrap();
+    // External role file (relative-ish, outside agents/).
+    let role = team.join("w2-role.md");
+    std::fs::write(
+        &role,
+        "---\nname: w2\nrole: Second Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nw2.\n",
+    )
+    .unwrap();
+    let transport = OfflineTransport::new();
+    let result = add_agent_with_transport(&team, &AgentId::new("w2"), &role, false, None, &transport);
+    // Core decoupling signature: must NOT fail because compile_team looked for TEAM.md/agents under
+    // the runtime spec dir. Before the fix, team_dir=spec_workspace(runtime) → "missing TEAM.md".
+    let text = format!("{result:?}");
+    assert!(
+        !text.contains("missing TEAM.md") && !text.to_lowercase().contains("missing agents"),
+        "add-agent must resolve team_dir to the role dir for compile_team (not the runtime spec dir); got {text}"
+    );
+}
+
+// E5 grep guard G1 — writers must land spec via runtime_spec_path (.team/runtime/<team_key>/),
+// never write team.spec.yaml into the user team_dir/agents_dir. Pins the spec-demote invariant.
+#[test]
+fn e5_guard_g1_writers_use_runtime_spec_path_not_user_dir() {
+    let source = include_str!("../launch.rs");
+    let runtime_writes = source.matches("runtime_spec_path(").count();
+    assert!(
+        runtime_writes >= 2,
+        "G1: quick_start + add_agent must write spec via runtime_spec_path (found {runtime_writes})"
+    );
+    for forbidden in [
+        "let spec_path = agents_dir.join(\"team.spec.yaml\");\n    std::fs::write",
+        "let spec_path = team_dir.join(\"team.spec.yaml\");\n    std::fs::write",
+    ] {
+        assert!(
+            !source.contains(forbidden),
+            "G1: user-dir spec write idiom must be gone: {forbidden:?}"
+        );
+    }
+}
+
+// E5 grep guard G2 — launch.rs must NOT copy a role file into the platform team dir.
+// Pins the Bug1 fix: no `fs::copy` of a role file + no `materialize_added_role_file` reborn.
+#[test]
+fn e5_guard_g2_no_copy_role_into_platform_dir() {
+    let source = include_str!("../launch.rs");
+    assert!(
+        !source.contains("materialize_added_role_file"),
+        "G2: materialize_added_role_file (role copy anti-pattern) must stay deleted"
+    );
+    assert!(
+        !source.contains("copy role file"),
+        "G2: no 'copy role file' into the platform agents dir (O_TRUNC self-copy bug)"
+    );
+}
+
 // ═════════════════════════════════════════════════════════════════════════
 // SPAWN sub-phase RED — launch(dry_run=false) must REALLY spawn (unlocks the acceptance
 // framework's cheap real-machine Tier-1). Golden launch/core.py: create the session + one worker
@@ -754,8 +958,17 @@ fn add_agent_with_transport_spawns_new_worker_not_stub() {
 
     let _result = add_agent_with_transport(&team, &AgentId::new("worker2"), &role_file, false, None, &transport);
 
-    // (a) the recompiled spec was written (real subsystem step — works today).
-    assert!(team.join("team.spec.yaml").exists(), "add_agent must recompile + write team.spec.yaml under the team dir");
+    // (a) the recompiled spec was written (real subsystem step). E5: under .team/runtime/<team_key>/,
+    // NOT the user team dir.
+    let runtime_spec = find_runtime_spec(&team, "addteam");
+    assert!(
+        runtime_spec.is_some(),
+        "add_agent must recompile + write team.spec.yaml under .team/runtime/<team_key>/"
+    );
+    assert!(
+        !team.join("team.spec.yaml").exists(),
+        "E5: add_agent must NOT write spec into the user team dir"
+    );
     // (b) the new worker window was spawned (RED: stub recompiles then RequirementUnmet -> ZERO spawns).
     let recorded = transport.spawn_records();
     assert!(
@@ -839,7 +1052,8 @@ fn quick_start_state_seeds_spec_path_workspace_leader_display_backend() {
     let transport = OfflineTransport::new();
     let _ = quick_start_with_transport(&team, None, true, true, None, &transport);
     let workspace = team.parent().expect("team_workspace(<base>/teamdir) = <base>");
-    let spec_path = team.join("team.spec.yaml");
+    // E5: spec_path in state now points to .team/runtime/<team_key>/, team_dir stays the user role dir.
+    let spec_path = quick_start_runtime_spec_path(&team);
     let (raw, state) = raw_runtime_state(workspace);
     let keys = state.as_object().expect("state root object").keys().cloned().collect::<Vec<_>>();
     assert_eq!(

package/crates/team-agent/src/mcp_server/normalize.rs

@@ -16,14 +16,36 @@ use super::types::{
 // These are contract-callable: RED tests pass alias strings and assert the enum.
 // ═══════════════════════════════════════════════════════════════════════════
 
-/// `_normalize_result_status` (`normalize.py:106-123`): map ok/done/passed/… aliases
-/// onto [`ResultStatus`]; anything unrecognized → `Success`.
+/// `_normalize_result_status` (`normalize.py:106-123`) — cr verdict (refined,
+/// 2026-06-10) three-way split:
+/// * status missing/null/empty → `Success` — **parity lock** (Python :107
+///   `or "success"`: the implicit-success convention, exit-code-0 equivalent).
+/// * recognized aliases → mapped (Python alias table verbatim).
+/// * a truly UNKNOWN non-empty literal → `Partial` (uncertain ≠ silent success;
+///   MUST-NOT-13 — deliberate divergence from Python :123's fallback "success",
+///   P7-type RS-first fix; the raw literal is observable via the `_observed` variant).
 pub fn normalize_result_status(value: Option<&str>) -> ResultStatus {
-    match normalize_token(value).as_str() {
-        "blocked" | "block" => ResultStatus::Blocked,
-        "failed" | "fail" | "error" => ResultStatus::Failed,
-        "partial" | "partially_done" => ResultStatus::Partial,
-        _ => ResultStatus::Success,
+    normalize_result_status_observed(value).0
+}
+
+/// The observed variant: `.1` carries the raw unrecognized literal so ingestion
+/// boundaries (wire report_result) can emit `provider.result.unknown_status_normalized`.
+pub fn normalize_result_status_observed(value: Option<&str>) -> (ResultStatus, Option<String>) {
+    let token = normalize_token(value);
+    if token.is_empty() {
+        return (ResultStatus::Success, None);
+    }
+    match token.as_str() {
+        "success" | "ok" | "done" | "complete" | "completed" | "passed" | "pass" => {
+            (ResultStatus::Success, None)
+        }
+        "blocked" | "block" => (ResultStatus::Blocked, None),
+        "failed" | "fail" | "error" => (ResultStatus::Failed, None),
+        "partial" | "partially_done" => (ResultStatus::Partial, None),
+        _ => (
+            ResultStatus::Partial,
+            Some(value.unwrap_or_default().to_string()),
+        ),
     }
 }
 

package/crates/team-agent/src/mcp_server/tests/golden.rs

@@ -83,12 +83,14 @@
         assert_eq!(normalize_change_kind(None, "inspected it"), ChangeKind::Observed);
     }
 
-    // ── #40 normalize_result_status: 'partiallydone' (no underscore) → Success ──
-    // GOLDEN (probe_mcp_red.py STATUS partiallydone): not in mapping/canonical set → success.
+    // ── #40 normalize_result_status: 'partiallydone' (no underscore) → Partial ──
+    // Re-anchored per cr verdict (refined, 2026-06-10): the old Python golden mapped
+    // an unmatched literal to success (probe_mcp_red.py STATUS); RS deliberately
+    // normalizes a NON-EMPTY unknown literal to Partial (MUST-NOT-13, P7-type fix).
     #[test]
-    fn result_status_partiallydone_no_underscore_is_success() {
-        assert_eq!(normalize_result_status(Some("partiallydone")), ResultStatus::Success);
-        assert_eq!(normalize_result_status(Some("PartiallyDone")), ResultStatus::Success);
+    fn result_status_partiallydone_no_underscore_is_partial() {
+        assert_eq!(normalize_result_status(Some("partiallydone")), ResultStatus::Partial);
+        assert_eq!(normalize_result_status(Some("PartiallyDone")), ResultStatus::Partial);
     }
 
     // ── #35/#46/#53 normalize_changes: full alias set + empty-path SKIP ─────────

package/crates/team-agent/src/mcp_server/tests/normalize.rs

@@ -1,8 +1,11 @@
     #[test]
     fn result_status_alias_chain() {
-        // None / unknown → Success
+        // cr verdict (refined, 2026-06-10) three-way split: missing/null/empty stays
+        // the parity-locked implicit success (Python :107); a NON-EMPTY unknown
+        // literal is Partial, never silent success (MUST-NOT-13, diverges from :123).
         assert_eq!(normalize_result_status(None), ResultStatus::Success);
-        assert_eq!(normalize_result_status(Some("weird")), ResultStatus::Success);
+        assert_eq!(normalize_result_status(Some("")), ResultStatus::Success);
+        assert_eq!(normalize_result_status(Some("weird")), ResultStatus::Partial);
         // ok/done/complete/completed/passed/pass → success
         for a in ["ok", "DONE", "complete", "completed", "passed", "pass"] {
             assert_eq!(normalize_result_status(Some(a)), ResultStatus::Success, "alias {a}");

package/crates/team-agent/src/mcp_server/tools.rs

@@ -22,7 +22,9 @@ use super::helpers::{
     json_dumps_default, latest_task_for_assignee, non_empty_string, normalized_envelope_value, object_fields,
     requires_ack_for_target, tool_runtime_error,
 };
-use super::normalize::{compact_tool_result, normalize_report_envelope};
+use super::normalize::{
+    compact_tool_result, normalize_report_envelope, normalize_result_status_observed,
+};
 use super::types::{Scope, SendOutcome, ToolError, ToolErrorReason, ToolOk, ToolResult, VisiblePeers};
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -321,6 +323,14 @@ impl TeamOrchestratorTools {
                 insert_array(obj, "next_actions", next_actions);
             }
         }
+        // T3-1 cr verdict (refined): an unknown non-empty status literal normalizes to
+        // Partial and must be OBSERVABLE at this ingestion boundary (the envelope-borne
+        // path; the wire `status` arg path emits at dispatch). Never a silent swallow.
+        if let Some(raw) =
+            normalize_result_status_observed(base.get("status").and_then(Value::as_str)).1
+        {
+            self.note_unknown_result_status(&raw);
+        }
         let normalized = normalize_report_envelope(&base);
         let env_value = normalized_envelope_value(&normalized);
         let owner_team = self.canonical_owner_team_key()?;
@@ -333,6 +343,20 @@ impl TeamOrchestratorTools {
             .and_then(|value| compact_tool_result(&value))
     }
 
+    /// T3-1 cr verdict: the observable record of an unknown→Partial status
+    /// normalization (`provider.result.unknown_status_normalized`, raw literal
+    /// included) — MUST-NOT-13: the swallow is never silent.
+    pub(crate) fn note_unknown_result_status(&self, raw: &str) {
+        let _ = EventLog::new(&self.workspace).write(
+            "provider.result.unknown_status_normalized",
+            serde_json::json!({
+                "agent_id": self.agent_id.as_ref().map(AgentId::as_str),
+                "raw_status": raw,
+                "normalized": "partial",
+            }),
+        );
+    }
+
     /// `update_state` (`tools.py:316-325`): delegated through the lifecycle tools
     /// facade. S0 preserves the old placeholder behavior.
     pub fn update_state(&self, note: &str) -> ToolResult {

package/crates/team-agent/src/mcp_server/wire.rs

@@ -411,7 +411,17 @@ pub(crate) fn dispatch_tool(tools: &TeamOrchestratorTools, tool: McpTool, args:
         McpTool::ReportResult => tools.report_result(
             args.get("envelope"),
             args.get("summary").and_then(Value::as_str),
-            normalize_result_status(args.get("status").and_then(Value::as_str)),
+            // cr verdict (T3-1 refined): an unknown status literal normalizes to
+            // Partial and is OBSERVABLE at this ingestion boundary, never silent.
+            {
+                let (status, unknown) = crate::mcp_server::normalize::normalize_result_status_observed(
+                    args.get("status").and_then(Value::as_str),
+                );
+                if let Some(raw) = unknown {
+                    tools.note_unknown_result_status(&raw);
+                }
+                status
+            },
             args.get("changes").and_then(Value::as_array).map(Vec::as_slice),
             args.get("tests").and_then(Value::as_array).map(Vec::as_slice),
             args.get("risks").and_then(Value::as_array).map(Vec::as_slice),

package/crates/team-agent/src/model/paths.rs

@@ -17,6 +17,13 @@ pub fn runtime_dir(workspace: &Path) -> PathBuf {
     team_subdir(workspace, "runtime")
 }
 
+/// E5:**spec.yaml 的唯一落地点** = `<workspace>/.team/runtime/<team_key>/team.spec.yaml`。
+/// 用户终裁:角色定义(TEAM.md/agents/*.md)=第一真相源;spec=中间产物,**绝不落用户目录**。
+/// 所有 spec 读写经此单点,杜绝 `<user_dir>/team.spec.yaml`。
+pub fn runtime_spec_path(workspace: &Path, team_key: &str) -> PathBuf {
+    runtime_dir(workspace).join(team_key).join("team.spec.yaml")
+}
+
 /// `<workspace>/.team/logs`。
 pub fn logs_dir(workspace: &Path) -> PathBuf {
     team_subdir(workspace, "logs")

package/crates/team-agent/src/model/spec.rs

@@ -409,9 +409,31 @@ fn semantic_errors(spec: &Yaml, base_dir: &Path) -> Vec<String> {
     let map_agents: Vec<&Yaml> = agents.iter().filter(|a| a.is_map()).collect();
 
     // duplicate agent id(集合含 None 复刻 Python `{a.get("id") ...}`)。
+    // SMOKE-1 N38 失败可解释性:不仅报"有重复",还点出**哪个 id 重复**(可能多个),
+    // 给 operator 直接定位线索;locate.md §"Smallest likely code touch" item 3。
     let id_set: HashSet<Option<&str>> = map_agents.iter().map(|a| a.get("id").and_then(Yaml::as_str)).collect();
     if id_set.len() != map_agents.len() {
-        e.push("/agents: duplicate agent id".to_string());
+        let mut seen: HashSet<&str> = HashSet::new();
+        let mut duplicates: Vec<&str> = Vec::new();
+        for agent in &map_agents {
+            if let Some(id) = agent.get("id").and_then(Yaml::as_str) {
+                if !seen.insert(id) && !duplicates.contains(&id) {
+                    duplicates.push(id);
+                }
+            }
+        }
+        if duplicates.is_empty() {
+            e.push("/agents: duplicate agent id".to_string());
+        } else {
+            e.push(format!(
+                "/agents: duplicate agent id: {}",
+                duplicates
+                    .iter()
+                    .map(|id| format!("`{id}`"))
+                    .collect::<Vec<_>>()
+                    .join(", ")
+            ));
+        }
     }
     // all_ids:present 的 agent id + leader id(若 truthy)。
     let mut all_ids: HashSet<&str> = map_agents.iter().filter_map(|a| a.get("id").and_then(Yaml::as_str)).collect();

package/crates/team-agent/src/packaging/install.rs

@@ -21,12 +21,22 @@ pub fn install(opts: &InstallOptions) -> Result<InstallReport, PackagingError> {
         dry_run: true,
         source: default_skill_source(),
     })?;
+    // T3-6 (harvest §1): never a hardcoded DoctorStatus::Ok with no check behind it —
+    // run the real packaging doctor (schema diagnosis + gates) for the invoking
+    // workspace so the report reflects an actual result.
+    let doctor = super::migrate::doctor(&super::types::DoctorOptions {
+        workspace: std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")),
+        gate: None,
+        fix: false,
+        cleanup_orphans: false,
+        confirm: false,
+    })?;
     Ok(InstallReport {
         installed_bin,
         version: Version::current(),
         replace: None,
         skills,
-        doctor: DoctorStatus::Ok,
+        doctor,
         path_hint: diagnose_path(&bin_dir)?,
     })
 }
@@ -58,7 +68,7 @@ pub fn uninstall(opts: &UninstallOptions) -> Result<UninstallOutcome, PackagingE
 
     let home = home_dir();
     let mut removed_skill_dirs = Vec::new();
-    for target in [SkillTarget::Codex, SkillTarget::Claude] {
+    for target in SkillTarget::SINGLE_TARGETS {
         if let Some(dest) = target.dest_dir(&home) {
             if dest.0.exists() {
                 std::fs::remove_dir_all(&dest.0)?;
@@ -102,7 +112,7 @@ pub fn install_skill(opts: &SkillInstallOptions) -> Result<Vec<SkillInstallOutco
         ));
     }
     let targets: Vec<SkillTarget> = match opts.target {
-        SkillTarget::All => vec![SkillTarget::Codex, SkillTarget::Claude],
+        SkillTarget::All => SkillTarget::SINGLE_TARGETS.to_vec(),
         target => vec![target],
     };
     let home = home_dir();
@@ -116,11 +126,27 @@ pub fn install_skill(opts: &SkillInstallOptions) -> Result<Vec<SkillInstallOutco
         };
         let mut removed_stale = Vec::new();
         if !opts.dry_run {
+            // T2-1 (harvest §1): NEVER pre-wipe the user's existing skill dir — stage
+            // the copy into a sibling temp dir and only swap after the copy succeeded
+            // (write_worker_mcp_config tmp+rename 范式). A failed copy leaves the
+            // user's dir byte-identical.
+            let staging = staging_dir_for(&dest.0)?;
+            let _ = std::fs::remove_dir_all(&staging);
+            if let Err(error) = copy_tree(&opts.source, &staging) {
+                let _ = std::fs::remove_dir_all(&staging);
+                return Err(error);
+            }
             if dest.0.exists() {
                 removed_stale = collect_files(&dest.0)?;
                 std::fs::remove_dir_all(&dest.0)?;
             }
-            copy_tree(&opts.source, &dest.0)?;
+            if let Err(error) = std::fs::rename(&staging, &dest.0) {
+                let _ = std::fs::remove_dir_all(&staging);
+                return Err(PackagingError::Io(std::io::Error::other(format!(
+                    "swap staged skill dir into {}: {error}",
+                    dest.0.display()
+                ))));
+            }
         }
         out.push(SkillInstallOutcome {
             target,
@@ -260,6 +286,18 @@ fn collect_files_inner(path: &Path, out: &mut Vec<PathBuf>) -> Result<(), Packag
     Ok(())
 }
 
+/// T2-1: a sibling staging path for the atomic skill-dir swap (same parent so the
+/// final rename never crosses filesystems).
+fn staging_dir_for(dest: &Path) -> Result<PathBuf, PackagingError> {
+    let name = dest
+        .file_name()
+        .and_then(|name| name.to_str())
+        .unwrap_or("skill");
+    let parent = dest.parent().map(Path::to_path_buf).unwrap_or_else(|| PathBuf::from("."));
+    std::fs::create_dir_all(&parent)?;
+    Ok(parent.join(format!(".{name}.ta-staging-{}", std::process::id())))
+}
+
 fn copy_tree(source: &Path, dest: &Path) -> Result<(), PackagingError> {
     if !source.exists() {
         return Err(PackagingError::Io(std::io::Error::new(