@xdxer/dingtalk-agent 0.1.1 → 0.1.2

package/evals/run-contract-evals.mjs

@@ -0,0 +1,1031 @@
+#!/usr/bin/env node
+
+// 纯本地合同评测：不调用真实 DWS 写能力。
+import {
+  mkdtempSync, readFileSync, writeFileSync, mkdirSync, rmSync, chmodSync,
+  readdirSync, cpSync, existsSync, lstatSync, readlinkSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+import { init } from '../dist/src/init.js'
+import * as config from '../dist/src/config.js'
+import { ackDispatch, listPendingDispatches, prepareSession, readJson } from '../dist/src/sessions.js'
+import { previewAction, executeAction } from '../dist/src/actions.js'
+import { heartbeatEvent } from '../dist/src/driver.js'
+import { digest, normalizeEvent } from '../dist/src/events.js'
+import {
+  cancelWaitForEvent, claimWait, readWaitForEvent, waitRoot,
+} from '../dist/src/waits.js'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const ROOT = dirname(HERE)
+// 合同结果只拥有自己的子目录，不能清掉同级 Claude/live 评测证据。
+const RESULTS = join(HERE, 'results', 'contract')
+const EVALS = readJson(join(HERE, 'evals.json')).evals
+const CLI = join(ROOT, 'dist', 'bin', 'dingtalk-agent.js')
+const WORKSPACES = []
+process.on('exit', () => {
+  for (const root of WORKSPACES) rmSync(root, { recursive: true, force: true })
+})
+
+rmSync(RESULTS, { recursive: true, force: true })
+mkdirSync(RESULTS, { recursive: true })
+
+const cases = [
+  evalMentioned, evalAmbientGroup, evalDuplicate, evalTamper, evalInboxRecovery,
+  evalDwsStringData, evalSessionScope, evalSkillSnapshot, evalSingleEgress,
+  evalHeartbeatOccurrences, evalAskWaitResume, evalWaitScopeIsolation,
+  evalWaitConflict, evalWaitCancelFence, evalWaitReceiptRepair,
+  evalClaimSupersededByCancel, evalNegativeWaitRouting,
+  evalWorkspaceAuthority, evalSessionSkillBinding,
+  evalGlobalSkillInstall, evalBootstrapLocal, evalBootstrapRemote, evalOptionalInit,
+  evalManagedSkillLifecycle, evalRemoteStorageTypeGate, evalDirectActGate,
+]
+const benchmarkRuns = []
+for (let i = 0; i < cases.length; i++) {
+  const started = Date.now()
+  const result = cases[i]()
+  const expectations = EVALS[i].expectations.map((text, n) => ({
+    text,
+    passed: Boolean(result.checks[n]?.passed),
+    evidence: result.checks[n]?.evidence || '没有证据',
+  }))
+  const passed = expectations.filter((x) => x.passed).length
+  const runDir = join(RESULTS, `eval-${i + 1}`, 'with_skill')
+  mkdirSync(join(runDir, 'outputs'), { recursive: true })
+  writeJson(join(runDir, 'eval_metadata.json'), {
+    eval_id: i + 1,
+    prompt: EVALS[i].prompt,
+    expected_output: EVALS[i].expected_output,
+  })
+  writeJson(join(runDir, 'outputs', 'result.json'), result.output)
+  writeFileSync(join(runDir, 'outputs', 'summary.md'),
+    `# Eval ${i + 1}\n\n${EVALS[i].expected_output}\n\n` +
+    expectations.map((x) => `- ${x.passed ? '✅' : '❌'} ${x.text}: ${x.evidence}`).join('\n') + '\n')
+  writeJson(join(runDir, 'grading.json'), {
+    expectations,
+    summary: { passed, failed: expectations.length - passed,
+      total: expectations.length, pass_rate: passed / expectations.length },
+    execution_metrics: { tool_calls: { cli: result.toolCalls }, total_tool_calls: result.toolCalls,
+      total_steps: result.steps, errors_encountered: expectations.length - passed,
+      output_chars: JSON.stringify(result.output).length, transcript_chars: 0 },
+    timing: { executor_duration_seconds: (Date.now() - started) / 1000,
+      grader_duration_seconds: 0, total_duration_seconds: (Date.now() - started) / 1000 },
+  })
+  benchmarkRuns.push({
+    eval_id: i + 1,
+    eval_name: `Contract ${i + 1}`,
+    configuration: 'with_skill',
+    run_number: 1,
+    result: { pass_rate: passed / expectations.length, passed,
+      failed: expectations.length - passed, total: expectations.length,
+      time_seconds: (Date.now() - started) / 1000, tokens: 0,
+      tool_calls: result.toolCalls, errors: expectations.length - passed },
+    expectations,
+    notes: ['Deterministic runtime contract; no live DingTalk write was executed.'],
+  })
+}
+
+const mean = benchmarkRuns.reduce((sum, x) => sum + x.result.pass_rate, 0) / benchmarkRuns.length
+writeJson(join(RESULTS, 'benchmark.json'), {
+  metadata: { skill_name: '基础行为', skill_path: ROOT,
+    executor_model: 'deterministic-cli', analyzer_model: 'deterministic-assertions',
+    timestamp: new Date().toISOString(), evals_run: EVALS.map((x) => x.id), runs_per_configuration: 1 },
+  runs: benchmarkRuns,
+  run_summary: {
+    with_skill: {
+      pass_rate: { mean, stddev: 0, min: mean, max: mean },
+      time_seconds: { mean: 0, stddev: 0, min: 0, max: 0 },
+      tokens: { mean: 0, stddev: 0, min: 0, max: 0 },
+    },
+    delta: { pass_rate: 'n/a', time_seconds: 'n/a', tokens: 'n/a' },
+  },
+  notes: ['这是可机器判定的运行时合同评测，不做无 Skill 的主观模型对照。',
+    '全部案例禁止真实 DWS 写操作。'],
+})
+
+if (process.argv.includes('--smoke')) {
+  const pass = mean === 1
+  const mark = pass ? 'PASS' : 'FAIL'
+  console.log(`${mark} 全局 Skill 可在无 Workspace 时安全安装`)
+  console.log(`${mark} 本地/钉钉文档 Storage 可在无 init 时水合`)
+  console.log(`${mark} init 可选、幂等且不污染项目级 Agent 文件`)
+  console.log(`${mark} Prepared Run 的 Session/Wait/目标/幂等闸门通过`)
+  if (!pass) process.exitCode = 1
+} else {
+  console.log(JSON.stringify({ results: RESULTS, passRate: mean, evals: benchmarkRuns.length }, null, 2))
+}
+
+function evalMentioned() {
+  const { root, cfg } = workspace()
+  const event = fixture('mentioned.json')
+  const dispatch = prepareSession(root, cfg, event)
+  const target = readJson(join(dispatch.cwd, 'context', 'reply-target.json'))
+  return {
+    output: { dispatch, target }, toolCalls: 1, steps: 3,
+    checks: [
+      check(dispatch.eventKind === 'im.message.mentioned', `eventKind=${dispatch.eventKind}`),
+      check(sameSet(dispatch.allowedActions, ['ack', 'reply', 'ask', 'silence']),
+        `allowed=${dispatch.allowedActions.join(',')}`),
+      check(target.conversationId === 'cid-project-a' && target.messageId === 'mid-mentioned-001' &&
+        target.senderOpenDingTalkId === '$:LWCP_v1:$alice', JSON.stringify(target)),
+    ],
+  }
+}
+
+function evalAmbientGroup() {
+  const { root, cfg } = workspace()
+  const dispatch = prepareSession(root, cfg, fixture('group.json'))
+  let blocked = ''
+  try { previewAction(dispatch.cwd, 'reply', { text: '不应该发送' }) }
+  catch (e) { blocked = e.message }
+  const receipt = executeAction(dispatch.cwd, 'silence', { reason: 'unmentioned' })
+  return {
+    output: { dispatch, blocked, receipt }, toolCalls: 3, steps: 4,
+    checks: [
+      check(sameSet(dispatch.allowedActions, ['silence']), `allowed=${dispatch.allowedActions.join(',')}`),
+      check(blocked.includes('不允许 reply'), blocked),
+      check(receipt.kind === 'silence' && receipt.verified === true, JSON.stringify(receipt)),
+    ],
+  }
+}
+
+function evalDuplicate() {
+  const { root, cfg } = workspace()
+  const event = fixture('mentioned.json')
+  const first = prepareSession(root, cfg, event)
+  const second = prepareSession(root, cfg, event)
+  const pending = listPendingDispatches(root, cfg)
+  const ack = ackDispatch(root, cfg, first.eventId, first.runId, 'eval-controller')
+  const third = prepareSession(root, cfg, event)
+  return {
+    output: { first, second, pending, ack, third }, toolCalls: 5, steps: 5,
+    checks: [
+      check(first.sessionId === second.sessionId && first.runId === second.runId &&
+        pending.length === 1 && pending[0].runId === first.runId,
+      `${first.sessionId}/${first.runId}; pending=${pending.length}`),
+      check(second.duplicate === true && second.launch === true,
+        `duplicate=${second.duplicate}, launch=${second.launch}`),
+      check(ack.duplicate === false && third.duplicate === true && third.launch === false,
+        `ack=${ack.duplicate}, duplicate=${third.duplicate}, launch=${third.launch}`),
+    ],
+  }
+}
+
+function evalTamper() {
+  const { root, cfg } = workspace()
+  const dispatch = prepareSession(root, cfg, fixture('mentioned.json'))
+  const override = spawnSync(process.execPath, [CLI, 'act', 'reply', '--text', 'x',
+    '--conversation-id', 'evil'], { cwd: dispatch.cwd, encoding: 'utf8' })
+
+  const fake = join(root, 'fake-run')
+  mkdirSync(fake)
+  writeFileSync(join(fake, 'run.json'), readFileSync(join(dispatch.cwd, 'run.json')))
+  let forged = ''
+  try { previewAction(fake, 'silence') } catch (e) { forged = e.message }
+
+  const targetPath = join(dispatch.cwd, 'context', 'reply-target.json')
+  writeJson(targetPath, { conversationId: 'evil', messageId: 'evil', senderOpenDingTalkId: 'evil' })
+  let drift = ''
+  try { previewAction(dispatch.cwd, 'silence') } catch (e) { drift = e.message }
+  return {
+    output: { overrideStatus: override.status, overrideError: override.stderr.trim(), forged, drift },
+    toolCalls: 4, steps: 5,
+    checks: [
+      check(override.status !== 0 && override.stderr.includes('Unknown option'), override.stderr.trim()),
+      check(forged.includes('身份不一致'), forged),
+      check(drift.includes('投影被修改'), drift),
+    ],
+  }
+}
+
+function evalInboxRecovery() {
+  const { root, cfg } = workspace()
+  const event = fixture('mentioned.json')
+  const fieldPath = join(root, 'fields', 'default', 'field.json')
+  const field = readJson(fieldPath)
+  field.behavior.packs = ['behaviors/missing.json']
+  writeJson(fieldPath, field)
+  let failure = ''
+  try { prepareSession(root, cfg, event) } catch (e) { failure = e.message }
+  const inboxRoot = join(root, cfg.runtime.eventIndexRoot, 'inbox')
+  const retained = readdirSync(inboxRoot).filter((x) => x.endsWith('.json')).length
+
+  field.behavior.packs = ['behaviors/basic.json']
+  writeJson(fieldPath, field)
+  const pending = listPendingDispatches(root, cfg)
+  const recovered = pending.find((x) => x.type === 'dingtalk-agent.run.redelivery')
+  const remaining = readdirSync(inboxRoot).filter((x) => x.endsWith('.json')).length
+  return {
+    output: { failure, retained, pending, remaining }, toolCalls: 3, steps: 5,
+    checks: [
+      check(failure.includes('不存在') && retained === 1,
+        `failure=${failure}; retained=${retained}`),
+      check(Boolean(recovered?.launch && recovered?.runId),
+        `type=${recovered?.type}; launch=${recovered?.launch}; run=${recovered?.runId}`),
+      check(remaining === 0, `remaining=${remaining}`),
+    ],
+  }
+}
+
+function evalDwsStringData() {
+  const { root, cfg } = workspace()
+  const raw = {
+    type: 'event',
+    event_corp_id: 'tenant-a',
+    data: JSON.stringify({
+      type: 'user_im_message_receive_o2o', event_id: 'evt-dws-string-1',
+      conversation_id: 'cid-dws-dm', message_id: 'mid-dws-dm',
+      sender_open_dingtalk_id: '$:LWCP_v1:$peer', content: '你好',
+    }),
+  }
+  const dispatch = prepareSession(root, cfg, raw)
+  const normalized = readJson(join(dispatch.cwd, 'event.json'))
+  let failure = ''
+  try { prepareSession(root, cfg, { type: 'event', data: '{bad json' }) }
+  catch (e) { failure = e.message }
+  return {
+    output: { dispatch, normalized, failure }, toolCalls: 2, steps: 3,
+    checks: [
+      check(normalized.kind === 'im.message.dm' && normalized.message.text === '你好',
+        `${normalized.kind}/${normalized.message.text}`),
+      check(normalized.tenant.id === 'tenant-a' &&
+        normalized.replyTarget.conversationId === 'cid-dws-dm' &&
+        normalized.replyTarget.messageId === 'mid-dws-dm' &&
+        normalized.replyTarget.senderOpenDingTalkId === '$:LWCP_v1:$peer',
+      JSON.stringify(normalized.replyTarget)),
+      check(failure.includes('data 不是合法 JSON 字符串'), failure),
+    ],
+  }
+}
+
+function evalSessionScope() {
+  const { root, cfg } = workspace()
+  const base = fixture('mentioned.json')
+  const body = JSON.parse(base.data)
+  const messageEvent = (eventId, tenantId, messageId, extra = {}) => ({
+    event_corp_id: tenantId,
+    data: JSON.stringify({ ...body, event_id: eventId, message_id: messageId, ...extra }),
+  })
+  const firstEvent = messageEvent('evt-topic-1', 'tenant-a', 'mid-topic-1')
+  const secondEvent = messageEvent('evt-topic-2', 'tenant-a', 'mid-topic-2')
+  const followupEvent = messageEvent('evt-topic-3', 'tenant-a', 'mid-topic-3',
+    { root_message_id: 'mid-topic-1' })
+  const otherTenantEvent = messageEvent('evt-topic-4', 'tenant-b', 'mid-topic-1')
+  const first = prepareSession(root, cfg, firstEvent)
+  const second = prepareSession(root, cfg, secondEvent)
+  const followup = prepareSession(root, cfg, followupEvent)
+  const otherTenant = prepareSession(root, cfg, otherTenantEvent)
+  return {
+    output: { first, second, followup, otherTenant }, toolCalls: 4, steps: 4,
+    checks: [
+      check(first.sessionId !== second.sessionId, `${first.sessionId} != ${second.sessionId}`),
+      check(first.sessionId === followup.sessionId && first.runId !== followup.runId,
+        `${first.sessionId}/${first.runId} -> ${followup.sessionId}/${followup.runId}`),
+      check(first.sessionId !== otherTenant.sessionId,
+        `${first.sessionId} != ${otherTenant.sessionId}`),
+    ],
+  }
+}
+
+function evalSkillSnapshot() {
+  const { root, cfg } = workspace()
+  installWorkspaceSkillOverride(root)
+  const event = fixture('mentioned.json')
+  const first = prepareSession(root, cfg, event)
+  const manifestPath = join(first.cwd, 'context', 'skills', 'manifest.json')
+  const skillPath = join(first.cwd, 'context', 'skills', 'dingtalk-basic-behavior', 'SKILL.md')
+  const manifest = readJson(manifestPath)
+  const before = readFileSync(skillPath, 'utf8')
+  const source = join(root, 'skills', 'dingtalk-basic-behavior', 'SKILL.md')
+  writeFileSync(source, readFileSync(source, 'utf8') + '\n<!-- candidate change -->\n')
+  const replay = prepareSession(root, cfg, event)
+  const after = readFileSync(skillPath, 'utf8')
+  const run = readJson(join(first.cwd, 'run.json'))
+  writeFileSync(skillPath, after + '\n<!-- tampered in sandbox -->\n')
+  let tamperBlocked = ''
+  try { previewAction(first.cwd, 'silence', { reason: 'no_value' }) }
+  catch (e) { tamperBlocked = e.message }
+  return {
+    output: { first, replay, manifest, run, tamperBlocked }, toolCalls: 5, steps: 6,
+    checks: [
+      check(manifest.entries?.[0]?.name === 'dingtalk-basic-behavior' &&
+        before.includes('name: dingtalk-basic-behavior'), JSON.stringify(manifest.entries?.[0])),
+      check(run.skills?.manifestHash === manifest.hash, `${run.skills?.manifestHash}/${manifest.hash}`),
+      check(before === after && replay.runId === first.runId &&
+        tamperBlocked.includes('Skill snapshot 内容漂移'),
+      `snapshotSame=${before === after}; run=${replay.runId}; tamper=${tamperBlocked}`),
+    ],
+  }
+}
+
+function evalSingleEgress() {
+  const { root, cfg } = workspace()
+  const fieldPath = join(root, 'fields', 'default', 'field.json')
+  const field = readJson(fieldPath)
+  field.transport = { mode: 'robot-connect', egressOwner: 'connector' }
+  writeJson(fieldPath, field)
+  const dispatch = prepareSession(root, cfg, fixture('mentioned.json'))
+  const fieldSnapshot = readJson(join(dispatch.cwd, 'context', 'field.json'))
+  let blocked = ''
+  try { previewAction(dispatch.cwd, 'reply', { text: '不应由 act 发送' }) }
+  catch (e) { blocked = e.message }
+  const receipt = executeAction(dispatch.cwd, 'silence', { reason: 'policy_denied' })
+  return {
+    output: { dispatch, fieldSnapshot, blocked, receipt }, toolCalls: 3, steps: 4,
+    checks: [
+      check(fieldSnapshot.transport?.egressOwner === 'connector',
+        JSON.stringify(fieldSnapshot.transport)),
+      check(blocked.includes('出口属于 connector'), blocked),
+      check(receipt.kind === 'silence' && receipt.verified === true, JSON.stringify(receipt)),
+    ],
+  }
+}
+
+function evalHeartbeatOccurrences() {
+  const { root, cfg } = workspace()
+  const firstEvent = heartbeatEvent('duty:daily-review', 'beat-001')
+  const secondEvent = heartbeatEvent('duty:daily-review', 'beat-002')
+  const first = prepareSession(root, cfg, firstEvent)
+  const retry = prepareSession(root, cfg, firstEvent)
+  ackDispatch(root, cfg, first.eventId, first.runId, 'eval-controller')
+  const second = prepareSession(root, cfg, secondEvent)
+  return {
+    output: { firstEvent, secondEvent, first, retry, second }, toolCalls: 4, steps: 5,
+    checks: [
+      check(first.sessionId === second.sessionId,
+        `${first.sessionId} == ${second.sessionId}`),
+      check(first.runId !== second.runId && second.launch === true,
+        `${first.runId} != ${second.runId}; launch=${second.launch}`),
+      check(retry.runId === first.runId && retry.duplicate === true,
+        `retry=${retry.runId}; duplicate=${retry.duplicate}`),
+    ],
+  }
+}
+
+function evalAskWaitResume() {
+  const { root, cfg } = workspace()
+  enableFakeDws(root)
+  const firstEvent = dmEvent('evt-wait-ask-1', 'mid-wait-ask-1', 'alice', '请先给我一个草稿')
+  const first = prepareSession(root, cfg, firstEvent)
+  const receipt = withFakeDws(root, () =>
+    executeAction(first.cwd, 'ask', { text: '草稿需要偏正式还是偏口语？' }))
+  const active = readWaitForEvent(root, cfg, first.fieldId, readJson(join(first.cwd, 'event.json')))
+
+  const replyEvent = dmEvent('evt-wait-reply-1', 'mid-wait-reply-1', 'alice', '偏正式')
+  const resumed = prepareSession(root, cfg, replyEvent)
+  const resume = readJson(join(resumed.cwd, 'context', 'resume.json'))
+  const claimed = readWaitForEvent(root, cfg, resumed.fieldId, readJson(join(resumed.cwd, 'event.json')))
+  const secondReceipt = withFakeDws(root, () =>
+    executeAction(resumed.cwd, 'ask', { text: '是否还需要附上数据来源？' }))
+  const secondActive = readWaitForEvent(root, cfg, resumed.fieldId, readJson(join(resumed.cwd, 'event.json')))
+  const replay = withFakeDws(root, () =>
+    executeAction(first.cwd, 'ask', { text: '草稿需要偏正式还是偏口语？' }))
+  const afterReplay = readWaitForEvent(root, cfg, resumed.fieldId, readJson(join(resumed.cwd, 'event.json')))
+  return {
+    output: { first, receipt, active, resumed, resume, claimed,
+      secondReceipt, secondActive, replay, afterReplay }, toolCalls: 7, steps: 9,
+    checks: [
+      check(receipt.kind === 'ask' && active?.status === 'active' &&
+        active?.sourceRunId === first.runId,
+      `receipt=${receipt.outcome}; wait=${active?.id}/${active?.status}`),
+      check(resumed.sessionId === first.sessionId && resumed.runId !== first.runId &&
+        resumed.mode === 'resume',
+      `${first.sessionId}/${first.runId} -> ${resumed.sessionId}/${resumed.runId}`),
+      check(resume.waitId === active?.id && resume.sourceRunId === first.runId &&
+        resume.questionText === '草稿需要偏正式还是偏口语？' &&
+        claimed?.status === 'claimed' && claimed?.claim?.runId === resumed.runId,
+      JSON.stringify({ resume, status: claimed?.status, claim: claimed?.claim })),
+      check(replay.duplicate === true && secondActive?.id !== active?.id &&
+        afterReplay?.id === secondActive?.id && afterReplay?.status === 'active',
+      `old=${active?.id}; current=${secondActive?.id}; afterReplay=${afterReplay?.id}`),
+    ],
+  }
+}
+
+function evalWaitScopeIsolation() {
+  const { root, cfg } = workspace()
+  enableFakeDws(root)
+  const firstEvent = dmEvent('evt-wait-scope-1', 'mid-wait-scope-1', 'alice', '帮我准备材料')
+  const first = prepareSession(root, cfg, firstEvent)
+  withFakeDws(root, () => executeAction(first.cwd, 'ask', { text: '材料用于哪个会议？' }))
+
+  const otherActor = prepareSession(root, cfg,
+    dmEvent('evt-wait-scope-2', 'mid-wait-scope-2', 'bob', '用于周会'))
+  const explicit = prepareSession(root, cfg,
+    dmEvent('evt-wait-scope-3', 'mid-wait-scope-3', 'alice', '另开一个事项'),
+    { sessionKey: 'explicit-other-work' })
+  const resumed = prepareSession(root, cfg,
+    dmEvent('evt-wait-scope-4', 'mid-wait-scope-4', 'alice', '用于季度复盘会'))
+  return {
+    output: { first, otherActor, explicit, resumed }, toolCalls: 5, steps: 6,
+    checks: [
+      check(otherActor.sessionId !== first.sessionId && otherActor.mode === 'start',
+        `other=${otherActor.sessionId}/${otherActor.mode}`),
+      check(explicit.sessionId !== first.sessionId && explicit.mode === 'start',
+        `explicit=${explicit.sessionId}/${explicit.mode}`),
+      check(resumed.sessionId === first.sessionId && resumed.mode === 'resume',
+        `resumed=${resumed.sessionId}/${resumed.mode}`),
+    ],
+  }
+}
+
+function evalWaitConflict() {
+  const { root, cfg } = workspace()
+  enableFakeDws(root)
+  const firstEvent = dmEvent('evt-wait-conflict-1', 'mid-wait-conflict-1', 'alice', '事项一')
+  const first = prepareSession(root, cfg, firstEvent)
+  withFakeDws(root, () => executeAction(first.cwd, 'ask', { text: '事项一缺哪个日期？' }))
+  const resumed = prepareSession(root, cfg,
+    dmEvent('evt-wait-conflict-2', 'mid-wait-conflict-2', 'alice', '下周一'))
+  const claimed = readWaitForEvent(
+    root, cfg, first.fieldId, readJson(join(resumed.cwd, 'event.json')))
+  const second = prepareSession(root, cfg,
+    dmEvent('evt-wait-conflict-3', 'mid-wait-conflict-3', 'alice', '事项二'),
+    { sessionKey: 'parallel-work' })
+  let blocked = ''
+  try {
+    withFakeDws(root, () => executeAction(second.cwd, 'ask', { text: '事项二缺哪个负责人？' }))
+  } catch (e) { blocked = e.message }
+  const current = readWaitForEvent(root, cfg, first.fieldId, readJson(join(first.cwd, 'event.json')))
+  return {
+    output: { first, resumed, claimed, second, blocked, current }, toolCalls: 5, steps: 6,
+    checks: [
+      check(first.sessionId !== second.sessionId && resumed.sessionId === first.sessionId,
+        `${first.sessionId} != ${second.sessionId}; resumed=${resumed.sessionId}`),
+      check(blocked.includes('单链 v1 拒绝并行追问'), blocked),
+      check(claimed?.status === 'claimed' && current?.sessionId === first.sessionId &&
+        current?.status === 'claimed',
+        `${current?.sessionId}/${current?.status}`),
+    ],
+  }
+}
+
+function evalWaitCancelFence() {
+  const { root, cfg } = workspace()
+  enableFakeDws(root)
+  const firstEvent = dmEvent('evt-wait-cancel-1', 'mid-wait-cancel-1', 'alice', '请准备发布稿')
+  const first = prepareSession(root, cfg, firstEvent)
+  withFakeDws(root, () => executeAction(first.cwd, 'ask', { text: '确认按当前版本发布吗？' }))
+
+  // 下一条消息已 claim 并物化成 resumed Run，但尚未执行；/stop 仍必须能截断它。
+  const resumed = prepareSession(root, cfg,
+    dmEvent('evt-wait-cancel-2', 'mid-wait-cancel-2', 'alice', '确认'))
+  const beforeStop = readWaitForEvent(
+    root, cfg, first.fieldId, readJson(join(resumed.cwd, 'event.json')))
+
+  // 故意破坏当前 Behavior 引用，证明取消闸门先于 Field/Behavior/Skill 物化执行。
+  const fieldPath = join(root, 'fields', 'default', 'field.json')
+  const field = readJson(fieldPath)
+  writeJson(fieldPath, {
+    ...field,
+    behavior: { ...(field.behavior || {}), packs: ['behaviors/missing.json'] },
+  })
+  const stopEvent = dmEvent('evt-wait-cancel-3', 'mid-wait-cancel-3', 'alice', '/stop')
+  let interrupted = ''
+  try { prepareSession(root, cfg, stopEvent) }
+  catch (e) { interrupted = e.message }
+  const fencedBeforeMaterialize = readJson(join(first.sessionPath, 'session.json'))
+  writeJson(fieldPath, field)
+
+  // 旧 stop 尚未落 event-index 时，新事项已经在同一 scope 建立 Wait。
+  // 重放旧 stop 必须按 eventId ledger 找回旧 Wait，不能误取消这个新 head。
+  const newer = prepareSession(root, cfg,
+    dmEvent('evt-wait-cancel-4', 'mid-wait-cancel-4', 'alice', '另开一个发布事项'),
+    { sessionKey: 'post-cancel-new-work' })
+  withFakeDws(root, () => executeAction(
+    newer.cwd, 'ask', { text: '新事项按哪个版本？' }))
+  const newActiveBeforeReplay = readWaitForEvent(
+    root, cfg, newer.fieldId, readJson(join(newer.cwd, 'event.json')))
+  const cancelled = prepareSession(root, cfg, stopEvent)
+  const duplicate = prepareSession(root, cfg, stopEvent)
+  const session = readJson(join(first.sessionPath, 'session.json'))
+  const waitAfterReplay = readWaitForEvent(
+    root, cfg, newer.fieldId, readJson(join(newer.cwd, 'event.json')))
+  let fenced = ''
+  try { previewAction(resumed.cwd, 'reply', { text: '已唤醒 Run 不应再发送' }) }
+  catch (e) { fenced = e.message }
+  return {
+    output: { first, resumed, beforeStop, interrupted, fencedBeforeMaterialize,
+      newer, newActiveBeforeReplay, cancelled, duplicate, session, waitAfterReplay,
+      fenced }, toolCalls: 10, steps: 13,
+    checks: [
+      check(beforeStop?.status === 'claimed' && cancelled.sessionId === first.sessionId &&
+        cancelled.mode === 'cancel' &&
+        newActiveBeforeReplay?.sessionId === newer.sessionId &&
+        waitAfterReplay?.id === newActiveBeforeReplay?.id &&
+        waitAfterReplay?.status === 'active' &&
+        sameSet(cancelled.allowedActions, ['reply', 'silence']),
+      `before=${beforeStop?.status}; cancel=${cancelled.sessionId}/${cancelled.mode}; ` +
+        `new=${waitAfterReplay?.id}/${waitAfterReplay?.status}`),
+      check(interrupted.includes('missing.json') && fencedBeforeMaterialize.generation === 2 &&
+        session.generation === 2 && duplicate.runId === cancelled.runId,
+      `interrupted=${interrupted}; generations=${fencedBeforeMaterialize.generation}/${session.generation}`),
+      check(fenced.includes('Session generation 已失效'), fenced),
+    ],
+  }
+}
+
+function evalWaitReceiptRepair() {
+  const { root, cfg } = workspace()
+  enableFakeDws(root)
+  const firstEvent = dmEvent('evt-wait-repair-1', 'mid-wait-repair-1', 'alice', '帮我写总结')
+  const first = prepareSession(root, cfg, firstEvent)
+  withFakeDws(root, () => executeAction(first.cwd, 'ask', { text: '总结覆盖哪个时间段？' }))
+  const event = readJson(join(first.cwd, 'event.json'))
+  const active = readWaitForEvent(root, cfg, first.fieldId, event)
+
+  // 模拟进程在 Receipt 落盘后、Wait 状态更新前崩溃。
+  const crashed = {
+    ...active,
+    status: 'arming',
+    delivery: null,
+    lastAppliedReceiptActionId: undefined,
+  }
+  const authorityRoot = waitRoot(root, cfg)
+  writeJson(join(authorityRoot, `${active.scopeHash}.json`), crashed)
+  writeJson(join(authorityRoot, 'history', `${active.id}.json`), crashed)
+
+  const resumed = prepareSession(root, cfg,
+    dmEvent('evt-wait-repair-2', 'mid-wait-repair-2', 'alice', '本周'))
+  const repaired = readWaitForEvent(
+    root, cfg, resumed.fieldId, readJson(join(resumed.cwd, 'event.json')))
+  const resume = readJson(join(resumed.cwd, 'context', 'resume.json'))
+  return {
+    output: { first, active, crashed, resumed, repaired, resume }, toolCalls: 4, steps: 6,
+    checks: [
+      check(active?.status === 'active' && crashed.status === 'arming',
+        `${active?.status} -> ${crashed.status}`),
+      check(resumed.sessionId === first.sessionId && resumed.mode === 'resume' &&
+        repaired?.status === 'claimed',
+      `${resumed.sessionId}/${resumed.mode}; wait=${repaired?.status}`),
+      check(resume.waitId === active.id && resume.questionText === '总结覆盖哪个时间段？' &&
+        repaired?.claim?.runId === resumed.runId,
+      JSON.stringify({ resume, claim: repaired?.claim })),
+    ],
+  }
+}
+
+function evalClaimSupersededByCancel() {
+  const { root, cfg } = workspace()
+  enableFakeDws(root)
+  const firstEvent = dmEvent('evt-claim-race-1', 'mid-claim-race-1', 'alice', '帮我发布评价')
+  const first = prepareSession(root, cfg, firstEvent)
+  withFakeDws(root, () => executeAction(
+    first.cwd, 'ask', { text: '确认使用当前评价吗？' }))
+
+  // 精确构造：回复 E 已绑定并 claim Wait，但尚未来得及 materialize Run；/stop 抢先取消。
+  const replyRaw = dmEvent('evt-claim-race-2', 'mid-claim-race-2', 'alice', '确认')
+  const replyEvent = normalizeEvent(replyRaw)
+  const claimed = claimWait(root, cfg, first.fieldId, replyEvent)
+  // 模拟 claimed head 已落盘、event ledger 尚未落盘时 SIGKILL。
+  rmSync(join(waitRoot(root, cfg), 'events', `${digest(replyEvent.id)}.json`), { force: true })
+  const stopRaw = dmEvent('evt-claim-race-3', 'mid-claim-race-3', 'alice', '/stop')
+  const stopEvent = normalizeEvent(stopRaw)
+  const cancelled = cancelWaitForEvent(root, cfg, stopEvent)
+
+  // E 重放只能回到原 Session 的安全 no-op Run，绝不能 fallback 成新事项。
+  const suppressed = prepareSession(root, cfg, replyRaw)
+  const resume = readJson(join(suppressed.cwd, 'context', 'resume.json'))
+  let replyBlocked = ''
+  try { previewAction(suppressed.cwd, 'reply', { text: '不应发送' }) }
+  catch (e) { replyBlocked = e.message }
+  const receipt = executeAction(suppressed.cwd, 'silence', { reason: 'policy_denied' })
+  const session = readJson(join(first.sessionPath, 'session.json'))
+  return {
+    output: { first, claimed, cancelled, suppressed, resume, replyBlocked, receipt, session },
+    toolCalls: 7, steps: 9,
+    checks: [
+      check(claimed?.status === 'claimed' && cancelled?.status === 'cancelled' &&
+        session.generation === 2,
+      `claim=${claimed?.status}; cancel=${cancelled?.status}; generation=${session.generation}`),
+      check(suppressed.sessionId === first.sessionId && suppressed.mode === 'cancel' &&
+        resume.suppressedInput === true && resume.cancelEventId === stopEvent.id &&
+        sameSet(suppressed.allowedActions, ['silence']),
+      JSON.stringify({ sessionId: suppressed.sessionId, mode: suppressed.mode,
+        resume, allowed: suppressed.allowedActions })),
+      check(replyBlocked.includes('不允许 reply') && receipt.kind === 'silence' &&
+        receipt.verified === true,
+      `blocked=${replyBlocked}; receipt=${receipt.kind}/${receipt.verified}`),
+    ],
+  }
+}
+
+function evalNegativeWaitRouting() {
+  const { root, cfg } = workspace()
+  enableFakeDws(root)
+
+  // Alice 的旧消息第一次 lookup 时没有 Wait：先固化 NO_MATCH，再创建一条新 Wait。
+  const oldReplyRaw = dmEvent('evt-negative-1', 'mid-negative-1', 'alice', '旧消息')
+  const oldReplyEvent = normalizeEvent(oldReplyRaw)
+  const noClaim = claimWait(root, cfg, 'default', oldReplyEvent)
+  const aliceWork = prepareSession(root, cfg,
+    dmEvent('evt-negative-2', 'mid-negative-2', 'alice', '后来事项'),
+    { sessionKey: 'later-alice-work' })
+  withFakeDws(root, () => executeAction(
+    aliceWork.cwd, 'ask', { text: '后来事项需要哪个日期？' }))
+  const aliceBeforeReplay = readWaitForEvent(
+    root, cfg, aliceWork.fieldId, readJson(join(aliceWork.cwd, 'event.json')))
+  const oldReplyReplay = prepareSession(root, cfg, oldReplyRaw)
+  const aliceAfterReplay = readWaitForEvent(
+    root, cfg, aliceWork.fieldId, readJson(join(aliceWork.cwd, 'event.json')))
+
+  // Bob 的旧 stop 第一次没有目标；后来出现的 Wait 不能被旧 stop 重放误杀。
+  const oldStopRaw = dmEvent('evt-negative-3', 'mid-negative-3', 'bob', '/stop')
+  const noCancel = cancelWaitForEvent(root, cfg, normalizeEvent(oldStopRaw))
+  const bobWork = prepareSession(root, cfg,
+    dmEvent('evt-negative-4', 'mid-negative-4', 'bob', '后来事项'),
+    { sessionKey: 'later-bob-work' })
+  withFakeDws(root, () => executeAction(
+    bobWork.cwd, 'ask', { text: '后来事项需要哪个负责人？' }))
+  const bobBeforeReplay = readWaitForEvent(
+    root, cfg, bobWork.fieldId, readJson(join(bobWork.cwd, 'event.json')))
+  const oldStopReplay = prepareSession(root, cfg, oldStopRaw)
+  const bobAfterReplay = readWaitForEvent(
+    root, cfg, bobWork.fieldId, readJson(join(bobWork.cwd, 'event.json')))
+  return {
+    output: { noClaim, aliceWork, aliceBeforeReplay, oldReplyReplay, aliceAfterReplay,
+      noCancel, bobWork, bobBeforeReplay, oldStopReplay, bobAfterReplay },
+    toolCalls: 10, steps: 12,
+    checks: [
+      check(noClaim === null && noCancel === null, `claim=${noClaim}; cancel=${noCancel}`),
+      check(oldReplyReplay.mode === 'start' &&
+        oldReplyReplay.sessionId !== aliceWork.sessionId &&
+        aliceAfterReplay?.id === aliceBeforeReplay?.id && aliceAfterReplay?.status === 'active',
+      `oldReply=${oldReplyReplay.mode}/${oldReplyReplay.sessionId}; ` +
+        `newWait=${aliceAfterReplay?.id}/${aliceAfterReplay?.status}`),
+      check(oldStopReplay.mode === 'start' && oldStopReplay.sessionId !== bobWork.sessionId &&
+        bobAfterReplay?.id === bobBeforeReplay?.id && bobAfterReplay?.status === 'active',
+      `oldStop=${oldStopReplay.mode}/${oldStopReplay.sessionId}; ` +
+        `newWait=${bobAfterReplay?.id}/${bobAfterReplay?.status}`),
+    ],
+  }
+}
+
+function evalWorkspaceAuthority() {
+  const { root, cfg } = workspace()
+  enableFakeDws(root)
+  const workspacePath = join(root, '.dingtalk-agent', 'workspace.json')
+  const manifest = readJson(workspacePath)
+  manifest.dws = { profile: 'workspace-profile', expectedUserId: 'workspace-agent' }
+  manifest.mounts.memory = 'dingtalk-doc:node-memory'
+  writeJson(workspacePath, manifest)
+
+  const dispatch = withFakeDws(root, () =>
+    prepareSession(root, cfg, fixture('mentioned.json'), { contextId: manifest.contextId }))
+  const field = readJson(join(dispatch.cwd, 'context', 'field.json'))
+  const mounts = readJson(join(dispatch.cwd, 'context', 'mounts', 'manifest.json'))
+  const memory = readFileSync(join(dispatch.cwd, 'context', 'mounts', 'memory.md'), 'utf8')
+  const trigger = readJson(join(dispatch.cwd, 'trigger.json'))
+  let wrongContext = ''
+  try { prepareSession(root, cfg, fixture('mentioned.json'), { contextId: 'wrong-context' }) }
+  catch (e) { wrongContext = e.message }
+  return {
+    output: { dispatch, field: field.dws, mounts, memory, trigger, wrongContext },
+    toolCalls: 2, steps: 5,
+    checks: [
+      check(trigger.contextId === manifest.contextId && dispatch.contextId === manifest.contextId,
+        `${trigger.contextId}/${dispatch.contextId}`),
+      check(mounts.entries.some((x) => x.slot === 'memory' &&
+        x.provider === 'dingtalk-doc') && memory.includes('Remote Memory'),
+      `${JSON.stringify(mounts.entries)}; memory=${memory.trim()}`),
+      check(field.dws?.profile === 'workspace-profile' &&
+        field.dws?.expectedUserId === 'workspace-agent' &&
+        wrongContext.includes('不属于当前 Workspace'),
+      `${JSON.stringify(field.dws)}; wrong=${wrongContext}`),
+    ],
+  }
+}
+
+function evalSessionSkillBinding() {
+  const { root, cfg } = workspace()
+  installWorkspaceSkillOverride(root)
+  const firstRaw = fixture('mentioned.json')
+  const first = prepareSession(root, cfg, firstRaw)
+  const firstSkill = join(first.cwd, 'context', 'skills', 'dingtalk-basic-behavior', 'SKILL.md')
+  const before = readFileSync(firstSkill, 'utf8')
+  const source = join(root, 'skills', 'dingtalk-basic-behavior', 'SKILL.md')
+  writeFileSync(source, readFileSync(source, 'utf8') + '\n<!-- next-session-only -->\n')
+
+  const followBody = JSON.parse(firstRaw.data)
+  followBody.event_id = 'evt-mentioned-followup-001'
+  followBody.message_id = 'mid-mentioned-followup-001'
+  followBody.root_message_id = 'mid-mentioned-001'
+  followBody.content = '确认，继续原事项'
+  const follow = prepareSession(root, cfg, { ...firstRaw, data: JSON.stringify(followBody) })
+  const followSkill = readFileSync(join(
+    follow.cwd, 'context', 'skills', 'dingtalk-basic-behavior', 'SKILL.md'), 'utf8')
+
+  const nextBody = { ...followBody,
+    event_id: 'evt-mentioned-new-session-001',
+    message_id: 'mid-mentioned-new-session-001',
+    root_message_id: '',
+    content: '这是另一件事',
+  }
+  const next = prepareSession(root, cfg, { ...firstRaw, data: JSON.stringify(nextBody) })
+  const nextSkill = readFileSync(join(
+    next.cwd, 'context', 'skills', 'dingtalk-basic-behavior', 'SKILL.md'), 'utf8')
+  const session = readJson(join(first.sessionPath, 'session.json'))
+  return {
+    output: { first, follow, next, sessionSkills: session.skills },
+    toolCalls: 3, steps: 6,
+    checks: [
+      check(follow.sessionId === first.sessionId && follow.runId !== first.runId,
+        `${first.sessionId}/${first.runId} -> ${follow.sessionId}/${follow.runId}`),
+      check(before === followSkill && !followSkill.includes('next-session-only') &&
+        Boolean(session.skills?.manifestHash),
+      `same=${before === followSkill}; manifest=${session.skills?.manifestHash}`),
+      check(next.sessionId !== first.sessionId && nextSkill.includes('next-session-only'),
+        `${next.sessionId}; updated=${nextSkill.includes('next-session-only')}`),
+    ],
+  }
+}
+
+function evalGlobalSkillInstall() {
+  const home = mkdtempSync(join(tmpdir(), 'dta-skill-home-'))
+  const cwd = mkdtempSync(join(tmpdir(), 'dta-skill-cwd-'))
+  const foreignHome = mkdtempSync(join(tmpdir(), 'dta-skill-foreign-'))
+  WORKSPACES.push(home, cwd, foreignHome)
+  const env = { ...process.env, HOME: home }
+  const first = spawnSync(process.execPath, [CLI, 'skill', 'install', '--json'], {
+    cwd, env, encoding: 'utf8',
+  })
+  const second = spawnSync(process.execPath, [CLI, 'skill', 'install', '--json'], {
+    cwd, env, encoding: 'utf8',
+  })
+  const status = JSON.parse(second.stdout)
+  const canonical = join(home, '.agents', 'skills', 'dingtalk-basic-behavior')
+  const claude = join(home, '.claude', 'skills', 'dingtalk-basic-behavior')
+
+  const foreign = join(foreignHome, '.agents', 'skills', 'dingtalk-basic-behavior')
+  mkdirSync(foreign, { recursive: true })
+  writeFileSync(join(foreign, 'SKILL.md'), '---\nname: dingtalk-basic-behavior\ndescription: foreign\n---\n')
+  const conflict = spawnSync(process.execPath, [CLI, 'skill', 'install'], {
+    cwd, env: { ...process.env, HOME: foreignHome }, encoding: 'utf8',
+  })
+  return {
+    output: {
+      firstStatus: first.status, secondStatus: second.status, status,
+      claudeTarget: readlinkSync(claude), conflictStatus: conflict.status,
+      conflictError: conflict.stderr.trim(),
+    },
+    toolCalls: 3, steps: 6,
+    checks: [
+      check(first.status === 0 && existsSync(join(canonical, 'SKILL.md')),
+        `status=${first.status}; canonical=${canonical}`),
+      check(second.status === 0 && status.canonical.current === true &&
+        status.canonical.modified === false,
+      `status=${second.status}; current=${status.canonical.current}; modified=${status.canonical.modified}`),
+      check(lstatSync(claude).isSymbolicLink() &&
+        readlinkSync(claude) === '../../.agents/skills/dingtalk-basic-behavior',
+      `target=${readlinkSync(claude)}`),
+      check(conflict.status !== 0 && conflict.stderr.includes('拒绝覆盖'), conflict.stderr.trim()),
+    ],
+  }
+}
+
+function evalBootstrapLocal() {
+  const root = mkdtempSync(join(tmpdir(), 'dta-bootstrap-local-'))
+  WORKSPACES.push(root)
+  mkdirSync(join(root, 'knowledge'), { recursive: true })
+  writeFileSync(join(root, 'WORKSPACE.md'), '# Identity\n')
+  writeFileSync(join(root, 'MEMORY.md'), '# Memory\n')
+  writeFileSync(join(root, 'knowledge', 'INDEX.md'), '# Knowledge\n')
+  const run = spawnSync(process.execPath, [CLI, 'bootstrap', '--json'], {
+    cwd: root, encoding: 'utf8',
+  })
+  const out = JSON.parse(run.stdout)
+  return {
+    output: out, toolCalls: 1, steps: 3,
+    checks: [
+      check(run.status === 0 && out.mode === 'direct' && out.initialized === false,
+        `status=${run.status}; mode=${out.mode}; initialized=${out.initialized}`),
+      check(out.mounts.map((x) => x.slot).join(',') === 'profile,memory,knowledge',
+        JSON.stringify(out.mounts)),
+      check(!existsSync(join(root, '.dingtalk-agent')), 'bootstrap 未创建 .dingtalk-agent'),
+    ],
+  }
+}
+
+function evalBootstrapRemote() {
+  const root = mkdtempSync(join(tmpdir(), 'dta-bootstrap-remote-'))
+  WORKSPACES.push(root)
+  const bin = enableFakeDws(root)
+  const state = join(root, '.state')
+  const run = spawnSync(process.execPath, [
+    CLI, 'bootstrap', '--storage', 'dingtalk-doc:node-memory',
+    '--state-dir', state, '--json',
+  ], {
+    cwd: root,
+    env: { ...process.env, PATH: `${bin}:${process.env.PATH || ''}` },
+    encoding: 'utf8',
+  })
+  const out = JSON.parse(run.stdout)
+  const snapshot = out.mounts?.[0]?.path || ''
+  return {
+    output: { out, snapshot: snapshot ? readFileSync(snapshot, 'utf8') : '', stderr: run.stderr },
+    toolCalls: 1, steps: 4,
+    checks: [
+      check(run.status === 0 && out.mode === 'direct' && out.initialized === false,
+        `status=${run.status}; mode=${out.mode}; initialized=${out.initialized}`),
+      check(out.mounts.length === 1 && out.mounts[0].provider === 'dingtalk-doc' &&
+        readFileSync(snapshot, 'utf8').includes('Remote Memory'), JSON.stringify(out.mounts)),
+      check(existsSync(join(dirname(snapshot), 'manifest.json')) &&
+        !existsSync(join(root, '.dingtalk-agent', 'workspace.json')),
+      `manifest=${join(dirname(snapshot), 'manifest.json')}`),
+    ],
+  }
+}
+
+function evalOptionalInit() {
+  const root = mkdtempSync(join(tmpdir(), 'dta-init-optional-'))
+  WORKSPACES.push(root)
+  const first = spawnSync(process.execPath, [CLI, 'init'], { cwd: root, encoding: 'utf8' })
+  const workspaceFile = join(root, '.dingtalk-agent', 'workspace.json')
+  const before = readFileSync(workspaceFile, 'utf8')
+  const second = spawnSync(process.execPath, [CLI, 'init'], { cwd: root, encoding: 'utf8' })
+  const after = readFileSync(workspaceFile, 'utf8')
+  const manifest = JSON.parse(after)
+  return {
+    output: { first: first.stdout, second: second.stdout, manifest },
+    toolCalls: 2, steps: 4,
+    checks: [
+      check(first.status === 0 && manifest.contextId === root.split('/').pop(),
+        `status=${first.status}; context=${manifest.contextId}`),
+      check(before === after && second.stdout.includes('Workspace 已存在'),
+        `same=${before === after}; second=${second.stdout.trim()}`),
+      check(!existsSync(join(root, 'AGENTS.md')) && !existsSync(join(root, 'CLAUDE.md')) &&
+        !existsSync(join(root, 'ontology')) && !existsSync(join(root, 'skills')),
+      'init 未写 AGENTS.md/CLAUDE.md/ontology/skills'),
+      check(manifest.skills[0] === 'dingtalk-basic-behavior', JSON.stringify(manifest.skills)),
+    ],
+  }
+}
+
+function evalManagedSkillLifecycle() {
+  const home = mkdtempSync(join(tmpdir(), 'dta-skill-lifecycle-'))
+  const cwd = mkdtempSync(join(tmpdir(), 'dta-skill-lifecycle-cwd-'))
+  WORKSPACES.push(home, cwd)
+  const env = { ...process.env, HOME: home }
+  spawnSync(process.execPath, [CLI, 'skill', 'install'], { cwd, env, encoding: 'utf8' })
+  const canonical = join(home, '.agents', 'skills', 'dingtalk-basic-behavior')
+  const file = join(canonical, 'SKILL.md')
+  writeFileSync(file, readFileSync(file, 'utf8') + '\n<!-- local edit -->\n')
+  const statusRun = spawnSync(process.execPath, [CLI, 'skill', 'status', '--json'], {
+    cwd, env, encoding: 'utf8',
+  })
+  const modified = JSON.parse(statusRun.stdout)
+  const guardedUpgrade = spawnSync(process.execPath, [CLI, 'skill', 'upgrade'], {
+    cwd, env, encoding: 'utf8',
+  })
+  const guardedUninstall = spawnSync(process.execPath, [CLI, 'skill', 'uninstall'], {
+    cwd, env, encoding: 'utf8',
+  })
+  const repaired = spawnSync(process.execPath, [
+    CLI, 'skill', 'upgrade', '--discard-local-changes', '--json',
+  ], { cwd, env, encoding: 'utf8' })
+  const repairedStatus = JSON.parse(repaired.stdout)
+  const removed = spawnSync(process.execPath, [CLI, 'skill', 'uninstall', '--json'], {
+    cwd, env, encoding: 'utf8',
+  })
+  const removedStatus = JSON.parse(removed.stdout)
+  return {
+    output: {
+      modified, guardedUpgrade: guardedUpgrade.stderr.trim(),
+      guardedUninstall: guardedUninstall.stderr.trim(), repairedStatus, removedStatus,
+    },
+    toolCalls: 6, steps: 7,
+    checks: [
+      check(modified.canonical.modified === true, JSON.stringify(modified.canonical)),
+      check(guardedUpgrade.status !== 0 && guardedUpgrade.stderr.includes('本地修改'),
+        guardedUpgrade.stderr.trim()),
+      check(guardedUninstall.status !== 0 && guardedUninstall.stderr.includes('本地修改'),
+        guardedUninstall.stderr.trim()),
+      check(repaired.status === 0 && repairedStatus.canonical.current === true &&
+        removed.status === 0 && removedStatus.canonical.exists === false &&
+        removedStatus.claude.state === 'missing',
+      `repaired=${repairedStatus.canonical.current}; removed=${removedStatus.canonical.exists}; ` +
+        `claude=${removedStatus.claude.state}`),
+    ],
+  }
+}
+
+function evalRemoteStorageTypeGate() {
+  const root = mkdtempSync(join(tmpdir(), 'dta-bootstrap-wrong-type-'))
+  WORKSPACES.push(root)
+  const bin = enableFakeDws(root)
+  const run = spawnSync(process.execPath, [
+    CLI, 'bootstrap', '--storage', 'dingtalk-doc:sheet-node',
+    '--state-dir', join(root, '.state'), '--json',
+  ], {
+    cwd: root,
+    env: {
+      ...process.env,
+      PATH: `${bin}:${process.env.PATH || ''}`,
+      DTA_FAKE_DOC_EXTENSION: 'axls',
+    },
+    encoding: 'utf8',
+  })
+  return {
+    output: { status: run.status, stderr: run.stderr.trim() }, toolCalls: 1, steps: 2,
+    checks: [
+      check(run.status !== 0 && run.stderr.includes('只接受在线文档 adoc'), run.stderr.trim()),
+      check(!existsSync(join(root, '.state')), '类型不符时没有创建远端快照目录'),
+    ],
+  }
+}
+
+function evalDirectActGate() {
+  const root = mkdtempSync(join(tmpdir(), 'dta-direct-act-'))
+  WORKSPACES.push(root)
+  const run = spawnSync(process.execPath, [CLI, 'act', 'reply', '--text', '越权回复'], {
+    cwd: root, encoding: 'utf8',
+  })
+  return {
+    output: { status: run.status, stderr: run.stderr.trim() }, toolCalls: 1, steps: 2,
+    checks: [
+      check(run.status !== 0 && run.stderr.includes('找不到当前 Run'), run.stderr.trim()),
+      check(!existsSync(join(root, '.dingtalk-agent')), 'act fail closed 时不自动 init'),
+    ],
+  }
+}
+
+function dmEvent(eventId, messageId, actor, text, extra = {}) {
+  return {
+    event_corp_id: extra.tenantId || 'tenant-wait-eval',
+    data: JSON.stringify({
+      type: 'user_im_message_receive_o2o',
+      event_id: eventId,
+      conversation_id: extra.conversationId || 'cid-wait-eval',
+      message_id: messageId,
+      sender: actor,
+      sender_open_dingtalk_id: `$:LWCP_v1:$${actor}`,
+      content: text,
+    }),
+  }
+}
+
+function enableFakeDws(root) {
+  const fieldPath = join(root, 'fields', 'default', 'field.json')
+  if (existsSync(fieldPath)) {
+    const field = readJson(fieldPath)
+    field.dws = { profile: 'eval-profile', expectedUserId: 'agent-eval' }
+    writeJson(fieldPath, field)
+  }
+
+  const bin = join(root, '.fake-bin')
+  mkdirSync(bin, { recursive: true })
+  const script = join(bin, 'dws')
+  writeFileSync(script, `#!/usr/bin/env node
+const a = process.argv.slice(2)
+let data = {}
+if (a.includes('get-self')) data = { userId: 'agent-eval' }
+else if (a.includes('doc') && a.includes('read')) data = { markdown: '# Remote Memory\\n\\n来自钉钉文档。' }
+else if (a.includes('doc') && a.includes('info')) data = { contentType: 'ALIDOC', extension: process.env.DTA_FAKE_DOC_EXTENSION || 'adoc', nodeType: 'file' }
+else if (a.includes('reply')) data = { openMessageId: 'fake-sent-message' }
+else if (a.includes('list-by-ids')) data = { messages: [{ openMessageId: 'fake-sent-message' }] }
+console.log(JSON.stringify({ data }))
+`)
+  chmodSync(script, 0o755)
+  return bin
+}
+
+function withFakeDws(root, fn) {
+  const before = process.env.PATH || ''
+  process.env.PATH = `${join(root, '.fake-bin')}:${before}`
+  try { return fn() } finally { process.env.PATH = before }
+}
+
+function installWorkspaceSkillOverride(root) {
+  cpSync(
+    join(ROOT, 'skills', 'dingtalk-basic-behavior'),
+    join(root, 'skills', 'dingtalk-basic-behavior'),
+    { recursive: true },
+  )
+}
+
+function workspace() {
+  const root = mkdtempSync(join(tmpdir(), 'dta-eval-'))
+  WORKSPACES.push(root)
+  const log = console.log
+  console.log = () => {}
+  try { init(root) } finally { console.log = log }
+  return { root, cfg: config.must(root) }
+}
+
+function fixture(name) {
+  return JSON.parse(readFileSync(join(HERE, 'fixtures', name), 'utf8'))
+}
+
+function sameSet(a, b) {
+  return a.length === b.length && a.every((x) => b.includes(x))
+}
+
+function check(passed, evidence) { return { passed, evidence } }
+
+function writeJson(path, value) {
+  mkdirSync(dirname(path), { recursive: true })
+  writeFileSync(path, JSON.stringify(value, null, 2) + '\n')
+}