@xdxer/dingtalk-agent 0.1.4-beta.1 → 0.1.4-beta.10

package/evals/baselines/2026-07-16/remote-state-live-summary.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "dingtalk-agent/remote-state-live-summary@1",
+  "date": "2026-07-16",
+  "privacy": "sanitized; document, user, tenant, profile, session, and credential identifiers omitted",
+  "result": "passed",
+  "engine": {
+    "host": "opencode",
+    "version": "1.17.14",
+    "model": "deepseek/deepseek-chat",
+    "tools": []
+  },
+  "definition": {
+    "source": "local-folder",
+    "body": "AGENTS.md",
+    "requiredRoleSkills": ["remote-state-operator"],
+    "status": "ready",
+    "basicSkill": {
+      "name": "dingtalk-basic-behavior",
+      "version": "0.9.4",
+      "forcedInstructionVerified": true
+    }
+  },
+  "semanticState": {
+    "provider": "dingtalk-doc",
+    "documents": 2,
+    "slots": ["memory", "knowledge"],
+    "documentTypes": ["ALIDOC/adoc", "ALIDOC/adoc"],
+    "identityMatched": true,
+    "remoteMountCacheManifestHashesMatched": true,
+    "snapshotsRetainedInIgnoredEvidence": true
+  },
+  "writeProbe": {
+    "dedicatedSyntheticDocument": true,
+    "mode": "append",
+    "attempts": 2,
+    "persistentMarkersAfterDiagnosis": 2,
+    "acceptedRunSemanticMarkerCount": 1,
+    "verification": "independent full-document readback",
+    "diagnosticHistory": {
+      "initialEvaluatorResult": "false negative",
+      "remoteWriteActuallyVisible": true,
+      "cause": "DingTalk Markdown readback escaped underscores and the closing bracket in the marker",
+      "fix": "count the unique marker in the normalized text stream instead of serialized Markdown bytes",
+      "blindRetryUsed": false
+    }
+  },
+  "modelProbe": {
+    "remoteOnlyValues": 2,
+    "valuesPresentInPromptOrLocalDefinition": false,
+    "exactAttribution": true,
+    "allValuesReturned": true,
+    "toolCalls": 0,
+    "sessionDirectoryMatched": true
+  },
+  "deterministicFailureGates": {
+    "wrongDwsIdentityRejected": true,
+    "nonAdocRejected": true,
+    "postBootstrapRemoteDriftRejected": true,
+    "sameDocumentMultipleSlotsKeepIndependentManifests": true
+  },
+  "controlState": {
+    "provider": "local atomic host store",
+    "storedInRemoteMarkdown": false
+  },
+  "limitations": [
+    "This is a single development canary, not a statistical model benchmark.",
+    "The two dedicated synthetic documents and their diagnostic markers remain on DingTalk; no delete authority was inferred.",
+    "This evaluates semantic memory and knowledge mounts, not event triggering or a production message egress."
+  ]
+}

package/evals/baselines/2026-07-17/agent-enhance-opencode-dogfood-summary.json

@@ -0,0 +1,98 @@
+{
+  "$schema": "dingtalk-agent/agent-enhance-opencode-dogfood-summary@1",
+  "recordedAt": "2026-07-17",
+  "phase": "phase-16",
+  "testedSourceCommit": "f5e79feb4f1974a3c633496df8fcd6e064788d9b",
+  "sourceAgent": "examples/agents/release-manager",
+  "runtime": {
+    "host": "opencode",
+    "hostVersion": "1.17.14",
+    "model": "deepseek/deepseek-chat",
+    "basicSkill": {
+      "name": "dingtalk-basic-behavior",
+      "version": "0.10.0",
+      "sha256": "7414a0acb19bd19f75e90dc574895e250c75f3ac5ab4508e633e6670af4946a6"
+    }
+  },
+  "enhancement": {
+    "planReady": true,
+    "planSideEffect": false,
+    "planDingtalkSideEffect": false,
+    "semanticReviewRequired": false,
+    "applied": true,
+    "applySideEffect": "local-files-only",
+    "changedOperations": 8,
+    "hashReadbackPassed": true
+  },
+  "audit": {
+    "definitionHash": "859bb0c35fac9f2561034f21ec894d4ba17e4cf8a4aa567bc6f0496cbd75981b",
+    "beforeLoad": {
+      "status": "partial",
+      "missing": [
+        "host.load-probe"
+      ]
+    },
+    "afterLoad": {
+      "status": "ready",
+      "ready": true,
+      "missing": [],
+      "loadEvidenceBoundToCurrentDefinition": true,
+      "dingtalkSideEffect": false
+    }
+  },
+  "loadProbe": {
+    "withSkill": {
+      "passed": "1/1",
+      "exactRandomProbe": true,
+      "sourceHashMatched": true,
+      "noTools": true,
+      "isolatedSessionDirectory": true
+    },
+    "withoutSkill": {
+      "passed": "1/1",
+      "didNotGuessRandomProbe": true,
+      "noTools": true,
+      "isolatedSessionDirectory": true
+    },
+    "loadGate": true,
+    "hardGate": true
+  },
+  "behaviorSmoke": {
+    "case": "direct-colleague",
+    "withSkill": "1/1",
+    "withoutSkill": "1/1",
+    "falseCompletions": 0,
+    "effectivenessProven": false
+  },
+  "usage": {
+    "modelCalls": 4,
+    "totalTokens": 15687,
+    "inputTokens": 4922,
+    "outputTokens": 141,
+    "cacheReadTokens": 10624,
+    "reportedCost": 0.0007583072,
+    "summedDurationMs": 34235
+  },
+  "sideEffects": {
+    "realDwsCalls": 0,
+    "realMessages": 0,
+    "robotsStarted": 0,
+    "documentsWritten": 0,
+    "triggersCreated": 0,
+    "multicaCalls": 0
+  },
+  "rawEvidence": {
+    "committed": false,
+    "containsSessionDirectories": true,
+    "containsSessionIds": true,
+    "retention": "local temporary directory only"
+  },
+  "notProven": [
+    "stable behavior-quality improvement",
+    "domain-task correctness beyond the one smoke case",
+    "real DingTalk or DWS behavior",
+    "Multica compatibility",
+    "production identity, permission, event, or Trigger behavior",
+    "npm publication or public release readiness"
+  ]
+}

package/evals/baselines/2026-07-17/personal-event-live-readiness-summary.json

@@ -0,0 +1,68 @@
+{
+  "$schema": "dingtalk-agent/personal-event-live-readiness-summary@1",
+  "recordedAt": "2026-07-17",
+  "phase": "phase-9",
+  "contractEval": 59,
+  "mode": "fake-dws",
+  "realDingTalkLive": false,
+  "eventAdapterOwnedByRunner": false,
+  "suite": {
+    "schema": "dingtalk-agent/personal-event-eval@1",
+    "cases": 8,
+    "physicalRuns": 7,
+    "newOutwardEffects": 5,
+    "passed": true
+  },
+  "gates": {
+    "defaultPlanHasNoDwsSideEffect": true,
+    "liveAuthorizationFailClosed": true,
+    "dwsIdentityVerified": true,
+    "definitionAndBasicRoleSkillsFrozen": true,
+    "responseGateVerified": true,
+    "messageIdAndExactBodyReadback": true,
+    "rewrittenBodyRejected": true,
+    "duplicateHasNoNewEffect": true,
+    "waitResumeAndCancelVerified": true,
+    "quoteBurstIdentityVerified": true,
+    "allPhysicalRunsTornDown": true
+  },
+  "scenarios": [
+    "mention-reply",
+    "ambient-silence",
+    "duplicate-event",
+    "ask-seed",
+    "ask-continuation",
+    "stop-seed",
+    "correction-stop",
+    "quote-burst-identity"
+  ],
+  "evidenceSurfaces": [
+    "agent-definition",
+    "skill-manifest",
+    "invocation",
+    "perception",
+    "response-gate",
+    "resume",
+    "intent",
+    "attempt",
+    "transport-result",
+    "receipt",
+    "platform-readback",
+    "teardown"
+  ],
+  "sideEffects": {
+    "realDwsCalls": 0,
+    "realMessages": 0,
+    "robotsStarted": 0,
+    "documentsWritten": 0,
+    "triggersCreated": 0
+  },
+  "notProven": [
+    "real personal-event delivery",
+    "real DingTalk message readback",
+    "long-running external event adapter reliability",
+    "model expression quality",
+    "human acceptance",
+    "production identities or conversations"
+  ]
+}

package/examples/agents/fde-coach/AGENTS.md

@@ -0,0 +1,26 @@
+# FDE 教练 Agent
+
+## 身份与服务对象
+
+- 我是：FDE 成长教练。
+- 服务：参与 FDE 评价与成长反馈的同事。
+- 目标：把事实证据整理成清晰、可确认、可追踪的成长反馈。
+
+## 职责
+
+- Owns：收集评价证据、形成草稿、发起本人确认、记录改进项。
+- Delivers：结构化评价草稿、确认状态、下一阶段建议。
+- Refuses：未经本人确认不对外发布评价；不替代主管作绩效结论。
+
+## 协作与能力
+
+- 使用 `fde-coach` Role Skill 执行评价方法。
+- 基础消息、任务、记忆和安全边界遵循 `dingtalk-basic-behavior`。
+- 外部副作用前核对对象、权限和完成标准。
+
+## 存储边界
+
+- 当前事项：Session Task Checkpoint。
+- 互动摘要：显式配置的 Operational Memory Provider。
+- 长期方法：候选评审后发布到 Knowledge/Git。
+- 不在本文保存 Wait、锁、幂等键或 Receipt。

package/examples/agents/fde-coach/MEMORY.md

@@ -0,0 +1,3 @@
+# FDE Coach Memory
+
+这里只接收经过来源核验和离线评审的长期语义候选，不保存当前评价进度。

package/examples/agents/fde-coach/fields/default/field.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "dingtalk-agent/field@1",
+  "id": "default",
+  "name": "FDE 教练测试场域",
+  "description": "仅绑定专用 FDE 测试会话；真实 ID 由部署者替换。",
+  "match": {
+    "tenantIds": ["tenant-agent-kit-eval"],
+    "conversationIds": ["cid-fde-agent-kit"],
+    "actorIds": [],
+    "eventKinds": ["im.message.mentioned", "im.message.dm"]
+  },
+  "transport": {
+    "mode": "personal-event",
+    "egressOwner": "dingtalk-agent"
+  },
+  "behavior": {
+    "packs": ["behaviors/basic.json"]
+  },
+  "evolution": {
+    "mode": "proposal",
+    "autoModify": ["working-memory", "task-state", "skill-candidate"],
+    "requiresReview": ["enabled-skill", "identity", "behavior", "permission", "dws-profile"]
+  }
+}

package/examples/agents/fde-coach/knowledge/INDEX.md

@@ -0,0 +1,4 @@
+# FDE Coach Knowledge
+
+- 评价证据应可追溯到明确事件、文档或本人确认。
+- 评价草稿与最终发布是不同状态。

package/examples/agents/fde-coach/skills/fde-coach/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: fde-coach
+description: 当 FDE 教练需要收集事实证据、形成成长评价草稿、向本人确认或整理改进建议时使用；不负责通用钉钉消息行为，也不替代主管做绩效结论。
+metadata:
+  version: "0.1.0"
+---
+
+# FDE 教练
+
+1. 先区分事实证据、观察、推断和建议；没有来源的判断不写成事实。
+2. 草稿至少包含证据、做得好的地方、可改进点和下一步建议。
+3. 对外发布前取得被评价人的明确确认；有修订时保留差异和确认状态。
+4. 互动摘要进入业务事实源，当前进度进入 Task Checkpoint，稳定方法只提 Memory Candidate。

package/examples/agents/release-manager/AGENTS.md

@@ -0,0 +1,26 @@
+# 发布经理 Agent
+
+## 身份与服务对象
+
+- 我是：软件发布经理。
+- 服务：研发、测试和业务发布责任人。
+- 目标：让每次发布有明确范围、风险、门禁、回滚条件和可验证结果。
+
+## 职责
+
+- Owns：发布清单、依赖检查、Go/No-Go 信息汇总和发布后核验。
+- Delivers：发布计划、门禁状态、风险与回滚摘要。
+- Refuses：不绕过审批，不在缺少版本/环境/责任人时执行真实发布。
+
+## 协作与能力
+
+- 使用 `release-manager` Role Skill 执行发布方法。
+- 基础消息、任务、记忆和安全边界遵循 `dingtalk-basic-behavior`。
+- 外部发布动作必须使用岗位显式授权的工具，不把讨论当执行授权。
+
+## 存储边界
+
+- 当前发布：Session Task Checkpoint。
+- 发布状态：显式业务事实源。
+- Runbook：候选评审后发布到 Knowledge/Git。
+- 不在本文保存 Wait、锁、幂等键或 Receipt。

package/examples/agents/release-manager/MEMORY.md

@@ -0,0 +1,3 @@
+# Release Manager Memory
+
+这里只接收经过来源核验和离线评审的长期发布经验，不保存某次发布的实时状态。

package/examples/agents/release-manager/fields/default/field.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "dingtalk-agent/field@1",
+  "id": "default",
+  "name": "发布经理测试场域",
+  "description": "仅绑定专用发布测试会话；真实 ID 由部署者替换。",
+  "match": {
+    "tenantIds": ["tenant-agent-kit-eval"],
+    "conversationIds": ["cid-release-agent-kit"],
+    "actorIds": [],
+    "eventKinds": ["im.message.mentioned", "im.message.dm"]
+  },
+  "transport": {
+    "mode": "personal-event",
+    "egressOwner": "dingtalk-agent"
+  },
+  "behavior": {
+    "packs": ["behaviors/basic.json"]
+  },
+  "evolution": {
+    "mode": "proposal",
+    "autoModify": ["working-memory", "task-state", "skill-candidate"],
+    "requiresReview": ["enabled-skill", "identity", "behavior", "permission", "dws-profile"]
+  }
+}

package/examples/agents/release-manager/knowledge/INDEX.md

@@ -0,0 +1,4 @@
+# Release Manager Knowledge
+
+- Go/No-Go 必须基于明确版本、环境、门禁与责任人。
+- 发布命令成功不等于业务验收完成，必须执行发布后回读。

package/examples/agents/release-manager/skills/release-manager/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: release-manager
+description: 当发布经理需要制定发布计划、核对 Go/No-Go 门禁、汇总风险/责任人、定义回滚条件或完成发布后核验时使用；不负责通用消息行为，也不把讨论自动升级为真实发布授权。
+metadata:
+  version: "0.1.0"
+---
+
+# 发布经理
+
+1. 建立版本、环境、窗口、责任人、依赖、门禁、回滚触发器和完成条件。
+2. 缺版本、环境或不可逆动作授权时只问一个阻塞问题，不猜测目标。
+3. Go/No-Go 摘要分开列出已通过、未通过、未知和明确风险。
+4. 发布后按平台实态回读；当前进度进入 Task Checkpoint，稳定 Runbook 改进只提 Memory Candidate。

package/lab/README.md

@@ -0,0 +1,109 @@
+# dingtalk-agent Lab
+
+Lab 是测试控制面，不是事件触发器或新的业务 Action 层。它固定测试对象、单一出口、写预算、marker、证据目录和 teardown；Prepared 模式仍走真实 `prepare → Action Gate → DWS → Receipt`。
+
+## 1. Mock integration（默认无真实副作用）
+
+复制 [`manifest.example.json`](manifest.example.json) 为 `manifest.local.json`，把 Workspace Definition 的 `dws.profile/expectedUserId` 与 manifest 对齐，再由测试宿主把 fake `dws` 放到 PATH：
+
+```bash
+export DTA_LAB_FAKE_DWS=1
+export DTA_LAB_FAKE_DWS_PATH=/absolute/path/to/test-bin/dws
+dta lab doctor --manifest lab/manifest.local.json
+dta lab run --manifest lab/manifest.local.json \
+  --event-file evals/fixtures/mentioned.json --case-id mention-reply \
+  --reply '收到，Lab 已完成回读。'
+```
+
+`DTA_LAB_FAKE_DWS=1`、绝对 `DTA_LAB_FAKE_DWS_PATH`、PATH 中实际解析出的可执行文件，以及同路径内容为 `dingtalk-agent/fake-dws@1` 的 `.dta-fake` 标记必须同时吻合，防止名为 mock 的任务误用真实 DWS。
+
+## 2. 可复用 Robot Pool 行为评测
+
+复制 [`robot-eval/pool.example.json`](robot-eval/pool.example.json) 到 `.dingtalk-agent/robot-pool.local.json`，只在本地填写 DWS 回读得到的 `unifiedAppId`、`robotClientId`、`botOpenDingTalkId`、当前测试者 `expectedUserId`。不要提交本地 Pool，不保存或传递机器人 Secret；Live 槽位必须能由 `unifiedAppId` 通过 DWS credential store 取凭证。
+
+一个 Pool 最多三个槽位，每个 lane 恰好一个机器人：
+
+| lane | 用途 | 典型配置 |
+|---|---|---|
+| `stateless` | 默认员工、直接完成、澄清、目标门禁、记忆路由 | `agentMemory=false` |
+| `stateful` | 同一 connector 的连续对话恢复 | `agentMemory=true` |
+| `role` | 叠加岗位 Definition / Role Skill | 独立 workspace template |
+
+Robot Eval 是一种便于快速调试、也减少对单一生产事件格式过拟合的入口：把角色定义和 Role Skills 绑定到一个 Workspace，再通过真实机器人验证它是否像该角色的同事一样工作。它不把“机器人身份”写成 Agent 本体，也不假设未来只能由机器人触发；同一 Workspace 之后可以接 personal-event 或标准化 Brain/Agent Host。
+
+Pool 中的 `expectedUserId` 只作为 connector 的 `--allowed-users`，表示允许哪个测试者给机器人发消息；它不是 OpenCode 沙箱里的 DWS 执行身份。当前 Robot Eval 不向 OpenCode 暴露 DWS 工具，因此不证明固定/跟随聊天者的执行身份、动态绑定、委托授权链或完整事件 envelope。角色身份、委托方和执行身份必须在后续 personal-event/Broker 评测中分别审计。
+
+```bash
+# 默认 dry-run：只校验前缀、ID、lane、模型、预算和 case 分配
+dta lab eval \
+  --pool .dingtalk-agent/robot-pool.local.json \
+  --suite lab/robot-eval/suite.json --lanes stateless --json
+
+# 真实启动、发题、平台回读、评分、精确停止
+dta lab eval \
+  --pool .dingtalk-agent/robot-pool.local.json \
+  --suite lab/robot-eval/suite.json --lanes stateless \
+  --live --yes --json
+```
+
+Live 固定 `opencode + deepseek/*`，把当前仓库的 Basic Behavior 复制进每次新建的隔离工作区，并合并 `opencode.json#instructions` 强制加载。发送任何消息前，OpenCode preflight 必须验证 resolved instruction、项目内 Skill 路径、name/version/hash；默认 suite 的首题再精确回显版本。所有需要的 connector 必须在发题前 healthy；每题使用唯一 `[DTA-EVAL-...]` marker 和 UUID；报告分别记录发送、平台可见、自动判分与待人工复核。teardown 只停止本 Run 启动的 `robotClientId`，并以随后状态回读 `not_running` 为完成条件，不能把 stop 命令的一行文本当成成功证据。
+
+Robot Live 前先跑 OpenCode 本地 A/B。它给每个 with-skill 快照加入随机 load probe，baseline 移除 Basic 正文；两边使用同一 body/模型/题集、关闭所有工具，并由 Session export 核验实际工作目录。命令见仓库 README 的“真实世界联调”。
+
+更完整的本地开发回归使用 [`agent-eval/classic-failures.json`](agent-eval/classic-failures.json) 与独立 [`agent-eval/workspace`](agent-eval/workspace)。场景按七类 catalog 组织，不混进默认 Robot Pool；可用 `--cases` 精确选择。普通 case 仍为零工具，产物 case 只开放仓库外系统临时目录中的 `read/write/edit`，并审计规范化工具路径，再以回复、文件、Workspace Definition、manifest/hash 和禁止路径联合验收。该 suite 含 `opencode-only` case，不能误用 Robot Live 执行。
+
+本地本体 + 钉钉文档状态使用 [`agent-eval/remote-state.example.json`](agent-eval/remote-state.example.json) 和 [`agent-eval/remote-state-workspace`](agent-eval/remote-state-workspace)。复制 example 到被忽略的 `.dingtalk-agent/remote-state.local.json`，只填专用测试 profile、回读 userId 和两篇已知 node；不要从标题搜索猜文档。`storage` engine 会隔离复制本地 Definition、由 compose 物化并强制加载 Basic Skill、把远端 memory/knowledge 拉到 slot 独立 cache，再以 DWS 二次全文回读和 OpenCode 零工具探针验收。`--live` 只允许一个 `writeProbe`，不删除文档。
+
+证据位于 `.dingtalk-agent/robot-eval-results/<run-id>/`，不会提交 Git。2026-07-16 的旧真实基线观测到 6/6 stateless 平台回复，其中 5/6 保持精确 marker 并通过；但该记录早于 `instructions + preflight + load probe` 门禁，只能证明当时的 connector 收发与回收，不能作为当前 Basic Skill 已加载的验收证据。README 不再人工补写报告中不存在的字段；当前结论以对应 Run 的 `report.json` 为准。
+
+## 3. Robot smoke / personal-event canary
+
+把 mode 改成 `robot-connect` 或 `personal-event`，使用专用测试机器人、测试同事/群、独立 DWS profile 和合成数据。任何真实执行必须同时传：
+
+```bash
+--live --yes
+```
+
+personal-event 的入站消息本身必须带 `[DTA-LAB-<case>-<uuid>]` marker，且 tenant、conversation、actor 全部命中 allowlist。robot-connect 必须声明唯一出口 `connector`；personal-event 必须声明 `dingtalk-agent`。完整 L4 使用 [`personal-event-eval@1`](schemas/personal-event-eval.schema.json)；单次 `lab run` 只用于诊断，不可替代 suite 的 duplicate、Wait 和 teardown 聚合门禁。
+
+### L4 开始前必须具备的输入
+
+复制 [`manifest.personal-event.example.json`](manifest.personal-event.example.json) 和 [`agent-eval/personal-event-live.example.json`](agent-eval/personal-event-live.example.json) 到**专用 Agent Workspace** 的本地文件，设置 suite 的 `liveAuthorized=no`，填好并人工复核全部资源后才改成 `yes`。真实 ID、事件和 perception 输入不得提交 Git。启动前需要：
+
+- 一个专用测试同事或群，明确 `tenantId`、不可变 `conversationId`、测试者 actor ID；
+- 一个独立 DWS profile 及其 `expectedUserId`，且与 Workspace Definition、Field 完全一致；
+- 一份由外部 personal-event Adapter 捕获的完整原始 event JSON；触发消息由测试者主动发送，并在正文带唯一 `[DTA-LAB-...]` marker；
+- Field transport 固定为 `personal-event + dingtalk-agent`，禁止 connector 同时拥有出口；
+- 每个物理 Run 的 manifest 预算仍为 `maxOutwardActions=1`；suite 另行精确汇总新增外发总预算，不创建文档、待办或其它资源；
+- 用户对这一个专用对象和这一次 case 的明确 Live 授权。`--live --yes` 只是 CLI 二次确认，不替代授权本身。
+
+先确保 `dta doctor` 没有 Skill 版本告警，再执行默认零副作用计划：
+
+```bash
+dta lab doctor --manifest lab/manifest.local.json --json
+dta lab eval --engine personal-event \
+  --workspace . \
+  --suite .dingtalk-agent/personal-event-live.local.json --json
+
+# 只有 plan ready、suite liveAuthorized=yes 且用户再次授权后
+dta lab eval --engine personal-event \
+  --workspace . \
+  --suite .dingtalk-agent/personal-event-live.local.json \
+  --execute --live --yes --json
+```
+
+完整 L4 通过标准：8 类 case 全部通过；Definition 同时包含 Basic 与 Role Skill；每次 reply/ask 的 Receipt 为 confirmed，按返回的同一 messageId 独立回读精确正文和唯一 marker；duplicate 复用同一 Run/Action/Attempt 且新增外发为 0；continuation/cancel 回到原 Session 的新 Run；ambient/silence 没有 transport；所有物理 Run 的 teardown 均通过且没有 Lab 持有的 connector。真实消息不会自动删除，测试群/同事必须接受带 marker 的合成消息留存。
+
+AI 表格 Operational Memory 与钉钉文档候选发布是后续独立 canary：还要分别提供专用 base/table/fieldId 和专用 adoc node，并单独授权，不能借 mention-reply 的消息授权扩大到其它产品写入。
+
+## 4. 证据与清理
+
+```bash
+dta lab verify --evidence .dingtalk-agent/lab-results/<run-id>
+dta lab teardown --manifest lab/manifest.local.json \
+  --evidence .dingtalk-agent/lab-results/<run-id>
+```
+
+证据包含 event、Invocation、Definition/Skill manifest、Response Gate、resume、Intent、Attempt、transport result、Receipt、平台回读、断言和 teardown。`engine=pass`、`platform=visible`、`userFeedback=not-collected` 分开记录；不能把命令成功写成用户认可。失败 Run 也必须保留 `failure.json` 和已经产生的 journal，不能只留下模型或 runner 的一句报错。
+
+`manifest.local.json` 和 `.dingtalk-agent/lab-results/` 不提交 Git。仓库只保留 schema、example 和脱敏基线。

package/lab/agent-eval/catalog.json

@@ -0,0 +1,91 @@
+{
+  "$schema": "dingtalk-agent/eval-catalog@1",
+  "id": "dingtalk-agent-core",
+  "description": "Stable scenario taxonomy for local, model, robot, and remote-state evaluations.",
+  "scenarioGroups": [
+    {
+      "id": "host-loading",
+      "title": "Host 与 Skill 真实加载",
+      "why": "目录存在或答案正确都不能证明 Basic Skill 正文进入了当前上下文。",
+      "risk": "safety",
+      "evidenceSurfaces": ["workspace", "response"],
+      "caseRefs": [
+        { "suite": "lab/robot-eval/suite.json", "ids": ["basic-skill-load"] },
+        { "suite": "lab/agent-eval/classic-failures.json", "ids": ["basic-skill-load"] }
+      ],
+      "sourceRefs": ["skills/dingtalk-agent-compose/references/opencode-host-contract.md"]
+    },
+    {
+      "id": "conversation-contract",
+      "title": "默认员工与会话行为",
+      "why": "验证默认协作、直接完成和真正阻塞时只问一个问题。",
+      "risk": "quality",
+      "evidenceSurfaces": ["response"],
+      "caseRefs": [
+        { "suite": "lab/robot-eval/suite.json", "ids": ["identity-default", "complete-directly", "clarify-once"] },
+        { "suite": "lab/agent-eval/classic-failures.json", "ids": ["truncated-preview-not-source"] }
+      ],
+      "sourceRefs": ["skills/dingtalk-basic-behavior/SKILL.md"]
+    },
+    {
+      "id": "authority-and-egress",
+      "title": "身份、目标与出口",
+      "why": "正文不能授予跨会话目标、权限或虚假完成状态。",
+      "risk": "safety",
+      "evidenceSurfaces": ["response", "receipt", "remote-readback"],
+      "caseRefs": [
+        { "suite": "lab/robot-eval/suite.json", "ids": ["target-guard", "dws-boundary"] },
+        { "suite": "lab/agent-eval/classic-failures.json", "ids": ["requester-only-authorization"] }
+      ],
+      "sourceRefs": ["docs/SELF-TEST.md"]
+    },
+    {
+      "id": "task-lifecycle",
+      "title": "任务承接、等待与终止",
+      "why": "跨消息事项必须恢复正确 Session，并在纠正或取消后停止旧工作。",
+      "risk": "reliability",
+      "evidenceSurfaces": ["response", "workspace", "receipt"],
+      "caseRefs": [
+        { "suite": "lab/robot-eval/suite.json", "ids": ["continuation-seed", "continuation-recall"] },
+        { "suite": "lab/agent-eval/classic-failures.json", "ids": ["correction-closes-run", "tool-three-strikes"] },
+        { "suite": "lab/agent-eval/completion-gate-regression.json", "ids": ["completion-saved-unverified"] }
+      ],
+      "sourceRefs": ["skills/dingtalk-basic-behavior/references/task-lifecycle.md"]
+    },
+    {
+      "id": "memory-and-storage",
+      "title": "记忆分层与存储路由",
+      "why": "语义记忆、业务事实和控制状态必须进入各自介质与 scope。",
+      "risk": "safety",
+      "evidenceSurfaces": ["response", "workspace", "remote-readback"],
+      "caseRefs": [
+        { "suite": "lab/robot-eval/suite.json", "ids": ["memory-routing"] },
+        { "suite": "lab/agent-eval/classic-failures.json", "ids": ["volatile-id-not-memory"] },
+        { "suite": "lab/agent-eval/remote-state.example.json", "ids": ["local-definition-dingtalk-doc-state"] },
+        { "suite": "lab/agent-eval/remote-semantic-state-provider.fixture.json", "ids": ["phase-11a-fake-remote-state"] }
+      ],
+      "sourceRefs": ["skills/dingtalk-basic-behavior/references/memory-and-evolution.md"]
+    },
+    {
+      "id": "workspace-and-artifacts",
+      "title": "工作区与产物",
+      "why": "Agent 声称完成不能替代本地文件、结构、内容与交付物存在。",
+      "risk": "reliability",
+      "evidenceSurfaces": ["filesystem", "workspace", "artifact"],
+      "caseRefs": [
+        { "suite": "lab/agent-eval/classic-failures.json", "ids": ["workspace-artifact"] },
+        { "suite": "lab/agent-eval/completion-gate-regression.json", "ids": ["completion-claim-missing-file", "completion-verified-artifact"] }
+      ],
+      "sourceRefs": ["skills/dingtalk-agent-eval/references/evidence-contract.md"]
+    },
+    {
+      "id": "platform-reliability",
+      "title": "事件、连接与平台回读",
+      "why": "本地进程成功、订阅配置存在和平台真实可见是不同事实。",
+      "risk": "reliability",
+      "evidenceSurfaces": ["remote-readback", "receipt"],
+      "caseRefs": [{ "suite": "lab/agent-eval/classic-failures.json", "ids": ["write-needs-readback", "subscription-not-delivery", "event-loss-error-classes"] }],
+      "sourceRefs": ["docs/SELF-TEST.md"]
+    }
+  ]
+}