@xdxer/dingtalk-agent 0.1.4-beta.15 → 0.1.4-beta.17

package/dist/src/agent-audit.js

@@ -1,12 +1,26 @@
 import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync, } from 'node:fs';
-import { dirname, join, relative, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, parse, relative, resolve } from 'node:path';
 import { bootstrap } from './bootstrap.js';
 import { digest, stableStringify } from './events.js';
-import { runOpenCodeEvaluation } from './opencode-evals.js';
+import { prepareOpenCodeEvalAgent, resolveOpenCodeEvalAgent, readOpenCodeVersion, runOpenCodeEvaluation, runOpenCodePrompt, loadProbeCorePassed, OPENCODE_LOAD_PROBE_PROMPT, } from './opencode-evals.js';
+import { bindRequiredBasicSkill, verifyRequiredBasicSkill } from './opencode-workspace.js';
+import { countInstructionsForPath } from './instruction-path.js';
 import { resolvePackageRoot } from './package-root.js';
 import { bundledSkillPath } from './skill-manager.js';
-const COMPOSE_TEMPLATE_MARKER = /<(?:Agent 名称|岗位\/角色|人群、团队或工作场域|长期目标|主动负责的事项|可观察的交付物|明确不做或必须升级确认的事项|Role Skill names|role-skill-name|Role Skill 名称|岗位职责或工作流|领域判断、输入与交付物|领域输入|领域方法\/SOP|可观察结果 [12]|route)>/u;
+import { createIsolatedOpenCodeHost } from './opencode-isolation.js';
+const COMPOSE_TEMPLATE_MARKER = /<(?:Agent 名称|岗位\/角色|人群、团队或工作场域|长期目标|主动负责的事项|可观察的交付物|明确不做或必须升级确认的事项|岗位稳定的输入、判断、交付与验收范式|何时自行推进、何时交给谁|本体级常见错误 [12]|纠偏动作 [12]|Role Skill names|role-skill-name|Role Skill 名称|岗位职责或工作流|领域判断、输入与交付物|相邻职责或明确交接边界|岗位特有的禁区或必须升级条件|领域输入|领域方法\/SOP|领域常见错误|领域纠偏动作|可观察结果 [12]|route)>/u;
+const BASIC_INSTRUCTION = '.agents/skills/dingtalk-basic-behavior/SKILL.md';
+const DEFINITION_PROBE_PROMPT = '这是 Agent Definition 继承探针。只依据已强制加载的角色宪法末尾注释回答；' +
+    '严格输出纯文本 dta-definition-probe=<值>，若看不到则输出纯文本 ' +
+    'dta-definition-probe=not-loaded。不要使用反引号或代码块；禁止猜测、调用工具或解释。';
+const REFERENCE_PROBE_PROMPT = '这是 Basic Behavior 场景 reference 继承探针。当前事项涉及外部副作用与授权；' +
+    '按 Basic 入口给出的唯一目标文件路径，直接用一次从首行开始且覆盖全文的 read 完整读取该文件，' +
+    '不要试读目录或其它路径。从文件首尾 HTML 注释中只提取冒号后的两个 UUID，' +
+    '再严格输出纯文本 dta-reference-probe=<首 UUID>:<尾 UUID>。不要输出 HTML 注释、反引号或代码块；' +
+    '禁止读取其它文件、写入、Shell、网络、外部产品动作或补充解释。';
 export function auditAgent(root, options = {}) {
     const rootReal = realpathSync(resolve(root));
     // Audit is a local inspection. Remote state is proven separately by storage eval
@@ -22,20 +36,21 @@ export function auditAgent(root, options = {}) {
     const knowledgeMounted = definition.storage.knowledge.startsWith('dingtalk-doc:') ||
         hydrated.mounts.some((item) => item.slot === 'knowledge');
     const artifacts = inspectLocalDirectoryRoute(rootReal, definition.storage.artifacts);
-    const controlStatePath = resolve(definition.storage.state);
-    const controlStateInside = isInside(rootReal, controlStatePath) && controlStatePath !== rootReal;
+    const controlState = inspectContainedPath(rootReal, definition.storage.state);
+    const controlStateInside = controlState.valid && controlState.path !== rootReal;
     add('definition.body', 'definition', definition.body ? 'pass' : 'fail', true, definition.body ? 'Agent 本体已绑定' : '缺少 Agent 本体', { body: definition.body });
     if (definition.body) {
         const semantic = inspectSemanticContract(definition.body.path);
         add('definition.semantic-contract', 'definition', semantic.complete ? 'pass' : 'fail', true, semantic.complete ? 'Agent 本体不含 compose 模板占位符'
-            : 'Agent 本体仍含身份、职责、交付物或存储路由占位符', semantic);
+            : 'Agent 本体仍含定义、岗位底线、做事范式或常犯错误占位符', semantic);
     }
     add('storage.memory', 'storage', memoryMounted ? 'pass' : 'fail', true, memoryMounted ? '工作记忆路由可水合' : '工作记忆本地文件缺失或路由无效', { route: definition.storage.memory, mounted: memoryMounted });
     add('storage.knowledge', 'storage', knowledgeMounted ? 'pass' : 'fail', true, knowledgeMounted ? '长期知识路由可水合' : '长期知识本地文件缺失或路由无效', { route: definition.storage.knowledge, mounted: knowledgeMounted });
     add('storage.artifacts', 'storage', artifacts.valid ? 'pass' : 'fail', true, artifacts.valid ? '产物路由是 Agent 根目录内的本地目录'
         : '产物路由缺失、越界或目录尚未创建', artifacts);
     add('storage.control-state', 'storage', controlStateInside ? 'pass' : 'fail', true, controlStateInside ? '控制状态保留在 Agent 根目录内的宿主本地目录'
-        : '宿主控制状态目录越出 Agent 根目录', { route: definition.storage.state, insideAgentRoot: controlStateInside, remoteProjection: false });
+        : '宿主控制状态目录越出 Agent 根目录', { route: definition.storage.state, insideAgentRoot: controlStateInside,
+        reason: controlState.reason, remoteProjection: false });
     const remoteSlots = [definition.storage.memory, definition.storage.knowledge]
         .filter((item) => item.startsWith('dingtalk-doc:'));
     const localSlots = [definition.storage.memory, definition.storage.knowledge]
@@ -52,7 +67,6 @@ export function auditAgent(root, options = {}) {
     const roleSkills = new Map(definition.skills
         .filter((item) => item.name !== 'dingtalk-basic-behavior')
         .map((item) => [item.name, item]));
-    const roleExposureHashes = {};
     for (const name of requiredSkills) {
         const skill = roleSkills.get(name);
         add(`skill.role.${name}`, 'skills', skill?.path && skill.hash ? 'pass' : 'fail', true, skill?.path && skill.hash ? `Role Skill ${name} 已进入 Definition` : `缺少 Role Skill ${name}`, { source: skill?.source || '', path: skill?.path || '', hash: skill?.hash || '' });
@@ -63,13 +77,28 @@ export function auditAgent(root, options = {}) {
         }
     }
     const basic = readCanonicalBasicSkill();
-    const basicExposure = inspectSkill(join(rootReal, '.agents', 'skills', 'dingtalk-basic-behavior', 'SKILL.md'));
+    const basicExposurePath = join(rootReal, '.agents', 'skills', 'dingtalk-basic-behavior', 'SKILL.md');
+    const basicExposure = inspectSkill(basicExposurePath);
+    const basicExposureTree = inspectSkillTree(basicExposurePath);
     add('host.basic-exposure', 'host', basicExposure.exists && basicExposure.name === basic.name &&
-        basicExposure.version === basic.version && basicExposure.hash === basic.hash ? 'pass' : 'fail', true, basicExposure.exists && basicExposure.hash === basic.hash
-        ? 'OpenCode Basic Skill exposure 与 canonical source 一致'
-        : 'OpenCode Basic Skill exposure 缺失或发生漂移', { expected: basic, actual: basicExposure });
+        basicExposure.version === basic.version && basicExposure.hash === basic.hash &&
+        basicExposureTree.hash === basic.treeHash ? 'pass' : 'fail', true, basicExposure.exists && basicExposure.hash === basic.hash &&
+        basicExposureTree.hash === basic.treeHash
+        ? 'OpenCode Basic Skill 全树 exposure 与 canonical source 一致'
+        : 'OpenCode Basic Skill 入口、references 或 assets 缺失或发生漂移', { expected: basic, actual: { ...basicExposure, treeHash: basicExposureTree.hash,
+            files: basicExposureTree.files, error: basicExposureTree.error } });
     const config = inspectOpenCodeConfig(rootReal);
-    const instructionCount = config.instructions.filter((item) => item === '.agents/skills/dingtalk-basic-behavior/SKILL.md').length;
+    const definitionInstruction = definition.body?.path
+        ? relative(rootReal, definition.body.path).split('\\').join('/') : '';
+    const definitionInstructionCount = countInstructionsForPath(rootReal, config.instructions, definitionInstruction);
+    const definitionRuleReady = !config.error && definitionInstruction === 'AGENTS.md' &&
+        definitionInstructionCount === 0;
+    add('host.definition-rule', 'host', definitionRuleReady
+        ? 'pass' : 'fail', true, definitionRuleReady
+        ? 'OpenCode 使用项目根 AGENTS.md 原生 rule，且未重复声明 custom instruction'
+        : 'Agent Definition 必须是项目根 AGENTS.md，且不能重复加入 opencode instructions', { path: config.path, error: config.error, instruction: definitionInstruction,
+        instructionCount: definitionInstructionCount });
+    const instructionCount = countInstructionsForPath(rootReal, config.instructions, '.agents/skills/dingtalk-basic-behavior/SKILL.md');
     add('host.basic-instruction', 'host', !config.error && instructionCount === 1 &&
         config.permissions['dingtalk-basic-behavior'] === 'allow' ? 'pass' : 'fail', true, !config.error && instructionCount === 1 &&
         config.permissions['dingtalk-basic-behavior'] === 'allow'
@@ -80,7 +109,6 @@ export function auditAgent(root, options = {}) {
         const source = roleSkills.get(name);
         const exposure = inspectSkill(join(rootReal, '.agents', 'skills', name, 'SKILL.md'));
         const permission = config.permissions[name] || '';
-        roleExposureHashes[name] = exposure.hash || '';
         const matched = Boolean(source?.hash && exposure.exists && exposure.name === name &&
             exposure.hash === source.hash && permission === 'allow');
         add(`host.role-exposure.${name}`, 'host', matched ? 'pass' : 'fail', true, matched ? `Role Skill ${name} exposure 与 Definition 一致`
@@ -89,26 +117,23 @@ export function auditAgent(root, options = {}) {
     const staticPrerequisitesReady = checks
         .filter((item) => item.blocking)
         .every((item) => item.level === 'pass');
-    const loadTargetHash = digest(stableStringify({
-        definitionHash: definition.hash,
-        bindingsHash: options.bindings?.hash || '',
-        canonicalBasicHash: basic.hash,
-        exposedBasicHash: basicExposure.hash || '',
-        opencodeConfigHash: config.hash,
-        requiredSkills,
-        roleExposureHashes,
-    }));
+    const effectiveModel = options.model || 'deepseek/deepseek-chat';
+    const loadTargetHash = currentLoadTargetHash(rootReal, options, requiredSkills, effectiveModel);
     let loadReport = null;
     let loadReportPath = '';
+    let verifiedReportPath = '';
+    let currentHostVersion = '';
     let loadReportError = '';
     let sideEffect = false;
     if (options.verifyLoad) {
         if (!options.yes)
             throw new Error('agent audit --verify-load 会调用 OpenCode；必须同时传 --yes');
         if (staticPrerequisitesReady) {
-            const execution = executeLoadAudit(rootReal, options, loadTargetHash);
+            const execution = executeLoadAudit(rootReal, options, loadTargetHash, definitionInstruction, effectiveModel, () => currentLoadTargetHash(rootReal, options, requiredSkills, effectiveModel));
             loadReport = execution.report;
             loadReportPath = execution.evidencePath;
+            verifiedReportPath = execution.reportPath;
+            currentHostVersion = execution.currentHostVersion;
             sideEffect = 'local-opencode-eval';
         }
     }
@@ -117,21 +142,25 @@ export function auditAgent(root, options = {}) {
             const loaded = readLoadEvidence(rootReal, options.loadReport, loadTargetHash);
             loadReport = loaded.report;
             loadReportPath = loaded.path;
+            verifiedReportPath = loaded.reportPath;
+            currentHostVersion = readOpenCodeVersion(process.env.DTA_OPENCODE_BIN || 'opencode', rootReal);
         }
         catch (error) {
             loadReportError = error.message;
+            loadReport = null;
+            verifiedReportPath = '';
             const candidate = resolve(rootReal, options.loadReport);
             loadReportPath = isInside(rootReal, candidate) ? candidate : '';
         }
     }
-    const load = loadReport ? verifyLoadReport(loadReport, basic) : {
+    const load = loadReport ? verifyLoadReport(rootReal, verifiedReportPath, loadReport, basic, definitionInstruction, effectiveModel, currentHostVersion) : {
         passed: false, evidence: {
             reason: loadReportError || (staticPrerequisitesReady
                 ? 'missing-report' : 'static-prerequisites-failed'),
         },
     };
-    add('host.load-probe', 'load', load.passed ? 'pass' : 'fail', true, load.passed ? '随机 load probe、resolved config 与 Session directory 均通过'
-        : '尚未取得与当前 Basic hash 绑定的随机 load probe 证据', { report: loadReportPath ? relative(rootReal, loadReportPath) : '',
+    add('host.load-probe', 'load', load.passed ? 'pass' : 'fail', true, load.passed ? 'Agent Definition 原生 rule canary、Basic load probe 与 Session directory 均通过'
+        : '尚未取得与当前 Definition、Basic 全树 hash 绑定的 Host load 证据', { report: loadReportPath ? relative(rootReal, loadReportPath) : '',
         targetHash: loadTargetHash, ...load.evidence });
     let remoteReportPath = '';
     if (remote) {
@@ -200,7 +229,13 @@ function readCanonicalBasicSkill() {
     if (!inspected.exists || inspected.name !== 'dingtalk-basic-behavior' || !inspected.version) {
         throw new Error('包内 canonical dingtalk-basic-behavior 非法');
     }
-    return { name: inspected.name, version: inspected.version, path, hash: inspected.hash };
+    const tree = inspectSkillTree(path);
+    if (!tree.hash)
+        throw new Error(`包内 canonical dingtalk-basic-behavior 全树非法: ${tree.error}`);
+    return {
+        name: inspected.name, version: inspected.version, path,
+        hash: inspected.hash, treeHash: tree.hash,
+    };
 }
 function inspectSkill(path) {
     if (!existsSync(path) || !statSync(path).isFile()) {
@@ -212,63 +247,694 @@ function inspectSkill(path) {
     const version = frontmatter.match(/^metadata:\s*\n(?:^[ \t]+.*\n)*?^[ \t]+version:\s*["']?([^"'\n]+)["']?\s*$/m)?.[1]?.trim() || '';
     return { exists: true, path: realpathSync(path), name, version, hash: digest(body) };
 }
+function inspectSkillTree(skillPath) {
+    const directory = dirname(skillPath);
+    if (!existsSync(directory) || !lstatSync(directory).isDirectory() ||
+        lstatSync(directory).isSymbolicLink()) {
+        return { hash: '', files: [], error: 'missing-or-not-regular-directory' };
+    }
+    const index = [];
+    try {
+        const visit = (current) => {
+            for (const entry of readdirSync(current, { withFileTypes: true })
+                .sort((a, b) => a.name.localeCompare(b.name))) {
+                const candidate = join(current, entry.name);
+                const path = relative(directory, candidate).split('\\').join('/');
+                if (entry.isSymbolicLink())
+                    throw new Error(`symlink:${path}`);
+                if (entry.isDirectory())
+                    visit(candidate);
+                else if (entry.isFile()) {
+                    index.push({ path, hash: digest(readFileSync(candidate).toString('base64')) });
+                }
+                else
+                    throw new Error(`unsupported-entry:${path}`);
+            }
+        };
+        visit(directory);
+        index.sort((a, b) => a.path.localeCompare(b.path));
+        if (!index.some((item) => item.path === 'SKILL.md')) {
+            return { hash: '', files: index.map((item) => item.path), error: 'missing-SKILL.md' };
+        }
+        return {
+            hash: digest(stableStringify(index)),
+            files: index.map((item) => item.path),
+            error: '',
+        };
+    }
+    catch (error) {
+        return { hash: '', files: index.map((item) => item.path), error: error.message };
+    }
+}
 function inspectOpenCodeConfig(root) {
     const path = join(root, 'opencode.json');
-    if (!existsSync(path))
+    if (!pathEntryExists(path)) {
         return { path, hash: '', instructions: [], permissions: {}, error: 'missing' };
+    }
     try {
+        const info = lstatSync(path);
+        if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) {
+            throw new Error('opencode.json 必须是非 symlink、非 hardlink 的普通文件');
+        }
+        const extraSources = [join(root, 'opencode.jsonc'), join(root, '.opencode')]
+            .filter(pathEntryExists).map((item) => relative(root, item).split('\\').join('/'));
+        if (extraSources.length) {
+            throw new Error(`受管 Agent 不允许额外 OpenCode project config source: ${extraSources.join(', ')}`);
+        }
         const raw = readFileSync(path, 'utf8');
-        const value = JSON.parse(raw);
-        const instructions = Array.isArray(value.instructions)
-            ? value.instructions.filter((item) => typeof item === 'string') : [];
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('opencode.json 必须是 JSON object');
+        }
+        const value = parsed;
+        const objectFields = [
+            'permission', 'provider', 'mcp', 'agent', 'tools', 'skills', 'formatter', 'lsp',
+        ];
+        for (const key of objectFields) {
+            if (value[key] !== undefined &&
+                (!value[key] || typeof value[key] !== 'object' || Array.isArray(value[key]))) {
+                throw new Error(`opencode.json#${key} 必须是 object`);
+            }
+        }
+        if (value.plugin !== undefined && !Array.isArray(value.plugin)) {
+            throw new Error('opencode.json#plugin 必须是 array');
+        }
+        if (Array.isArray(value.plugin) && value.plugin.length > 0) {
+            throw new Error('受管 Agent load gate 不允许项目级 OpenCode plugin');
+        }
+        if (value.provider && Object.keys(value.provider).length > 0) {
+            throw new Error('受管 Agent load gate 不允许项目级 OpenCode provider');
+        }
+        if (value.mcp && Object.keys(value.mcp).length > 0) {
+            throw new Error('受管 Agent load gate 不允许项目级 OpenCode MCP');
+        }
+        for (const key of ['formatter', 'lsp']) {
+            if (value[key] && Object.keys(value[key]).length > 0) {
+                throw new Error(`受管 Agent load gate 不允许项目级 OpenCode ${key}`);
+            }
+        }
+        if (value.agent?.['dta-eval'] !== undefined) {
+            throw new Error('原项目不得预置 dta-eval；该 Agent 仅由隔离评测器生成');
+        }
+        if (value.skills && Object.keys(value.skills).length > 0) {
+            throw new Error('受管 Agent load gate 不允许项目级 OpenCode skills.paths/urls');
+        }
+        if (value.instructions !== undefined &&
+            (!Array.isArray(value.instructions) ||
+                value.instructions.some((item) => typeof item !== 'string'))) {
+            throw new Error('opencode.json#instructions 必须是 string array');
+        }
+        const instructions = value.instructions || [];
+        const unsafeInstruction = instructions.find((item) => {
+            const raw = item.trim();
+            return !raw || /^https?:\/\//i.test(raw) || raw.startsWith('~/') ||
+                isAbsolute(raw) || raw.split(/[\\/]/).includes('..');
+        });
+        if (unsafeInstruction) {
+            throw new Error(`受管 Agent load gate 的 instruction 必须留在项目内: ${unsafeInstruction}`);
+        }
         const skill = value.permission?.skill;
-        const permissions = skill && typeof skill === 'object' && !Array.isArray(skill)
+        if (skill !== undefined && (!skill || typeof skill !== 'object' || Array.isArray(skill))) {
+            throw new Error('opencode.json#permission.skill 必须是 object');
+        }
+        const permissions = skill
             ? Object.fromEntries(Object.entries(skill).map(([key, item]) => [key, String(item)])) : {};
         return { path, hash: digest(raw), instructions, permissions, error: '' };
     }
     catch (error) {
-        return { path, hash: '', instructions: [], permissions: {}, error: error.message };
+        let hash = '';
+        try {
+            hash = digest(readFileSync(path, 'utf8'));
+        }
+        catch { /* unreadable config */ }
+        return { path, hash, instructions: [], permissions: {}, error: error.message };
     }
 }
-function executeLoadAudit(root, options, targetHash) {
+function currentLoadTargetHash(root, options, requiredSkills, model) {
+    const hydrated = bootstrap(root, { ...(options.bootstrap || {}), deferRemote: true });
+    const definition = hydrated.definition;
+    const basic = readCanonicalBasicSkill();
+    const exposedPath = join(root, '.agents', 'skills', 'dingtalk-basic-behavior', 'SKILL.md');
+    const exposed = inspectSkill(exposedPath);
+    const exposedTree = inspectSkillTree(exposedPath);
+    const config = inspectOpenCodeConfig(root);
+    const roleSkills = new Map(definition.skills
+        .filter((item) => item.name !== 'dingtalk-basic-behavior')
+        .map((item) => [item.name, item]));
+    const roleExposureHashes = Object.fromEntries(requiredSkills.map((name) => [
+        name,
+        inspectSkill(join(root, '.agents', 'skills', name, 'SKILL.md')).hash || '',
+    ]));
+    const roleSourceHashes = Object.fromEntries(requiredSkills.map((name) => [
+        name, roleSkills.get(name)?.hash || '',
+    ]));
+    const bindingsPath = options.bindings?.path ? resolve(root, options.bindings.path) : '';
+    const bindingsFileHash = bindingsPath && existsSync(bindingsPath)
+        ? digest(readFileSync(bindingsPath, 'utf8')) : '';
+    return digest(stableStringify({
+        definitionHash: definition.hash,
+        bindingsHash: options.bindings?.hash || '',
+        bindingsFileHash,
+        canonicalBasicHash: basic.hash,
+        canonicalBasicTreeHash: basic.treeHash,
+        exposedBasicHash: exposed.hash || '',
+        exposedBasicTreeHash: exposedTree.hash,
+        opencodeConfigHash: config.hash,
+        requiredSkills,
+        roleSourceHashes,
+        roleExposureHashes,
+        model,
+    }));
+}
+function executeLoadAudit(root, options, targetHash, definitionInstruction, model, revalidate) {
     const runId = `agent_audit_${Date.now()}_${randomUUID().slice(0, 8)}`;
-    const suitePath = join(root, '.dingtalk-agent', 'agent-audit', 'suites', `${runId}.json`);
-    const output = options.out || join('.dingtalk-agent', 'agent-audit', 'results', runId);
-    writeAtomic(suitePath, JSON.stringify({
-        $schema: 'dingtalk-agent/robot-eval-suite@1',
-        id: 'developer-golden-path-load',
-        markerPrefix: '[DTA-EVAL-',
-        evidenceRoot: output,
-        cases: [{
-                id: 'direct-colleague',
-                category: '完整输入直接工作',
-                scenario: 'host-loading',
-                risk: 'safety',
-                lane: 'stateless',
-                capability: 'basic-skill',
-                execution: { host: 'opencode-only', tools: 'none' },
-                prompt: '这是装配验收。保留评测 marker，并用一句话确认已进入直接工作状态；不要提问。',
-                expectations: [{ id: 'no-question', type: 'maxQuestions', max: 0 }],
-                sourceRefs: ['skills/core/dingtalk-agent-compose/references/opencode-host-contract.md'],
-                manualChecks: [],
-            }],
-    }, null, 2) + '\n');
-    const report = runOpenCodeEvaluation(root, '.', relative(root, suitePath), {
-        model: options.model || 'deepseek/deepseek-chat',
-        runs: 1,
-        execute: true,
-        yes: true,
-        out: output,
+    const outputInspection = inspectContainedPath(root, options.out || join('.dingtalk-agent', 'agent-audit', 'results', runId));
+    const outputRoot = outputInspection.path;
+    if (!outputInspection.valid || outputRoot === root) {
+        throw new Error(`Agent audit output 必须是 Agent 根目录内无 symlink 的独立目录: ${outputInspection.reason}`);
+    }
+    if (pathEntryExists(outputRoot) && !lstatSync(outputRoot).isDirectory()) {
+        throw new Error('Agent audit output 必须是普通目录或尚未创建的目录');
+    }
+    const auditWorkspace = join(outputRoot, `.probe-workspace-${runId}`);
+    const evidenceRoot = join(outputRoot, 'evidence');
+    if (existsSync(auditWorkspace) || existsSync(evidenceRoot)) {
+        throw new Error(`Agent audit output 已存在，拒绝覆盖: ${relative(root, outputRoot)}`);
+    }
+    const host = createIsolatedOpenCodeHost(model.split('/')[0]);
+    try {
+        const command = process.env.DTA_OPENCODE_BIN || 'opencode';
+        const sourcePreflight = inspectSourceOpenCodeRuntime(command, root, host.environment, definitionInstruction);
+        materializeAuditProbeWorkspace(root, auditWorkspace, definitionInstruction);
+        const suitePath = join(auditWorkspace, 'suite.json');
+        writeAtomic(suitePath, JSON.stringify({
+            $schema: 'dingtalk-agent/robot-eval-suite@1',
+            id: 'developer-golden-path-load',
+            markerPrefix: '[DTA-EVAL-',
+            evidenceRoot: 'evidence',
+            cases: [{
+                    id: 'direct-colleague',
+                    category: '完整输入直接工作',
+                    scenario: 'host-loading',
+                    risk: 'safety',
+                    lane: 'stateless',
+                    capability: 'basic-skill',
+                    execution: { host: 'opencode-only', tools: 'none' },
+                    prompt: '这是装配验收。保留评测 marker，并用一句话确认已进入直接工作状态；不要提问。',
+                    expectations: [{ id: 'no-question', type: 'maxQuestions', max: 0 }],
+                    sourceRefs: ['skills/core/dingtalk-agent-compose/references/opencode-host-contract.md'],
+                    manualChecks: [],
+                }],
+        }, null, 2) + '\n');
+        const report = runOpenCodeEvaluation(auditWorkspace, '.', relative(auditWorkspace, suitePath), {
+            model,
+            runs: 1,
+            execute: true,
+            yes: true,
+            out: 'evidence',
+            environment: host.environment,
+            loadOnly: true,
+        });
+        const generatedEvidence = join(auditWorkspace, report.evidencePath);
+        mkdirSync(outputRoot, { recursive: true });
+        renameSync(generatedEvidence, evidenceRoot);
+        report.evidencePath = relative(root, evidenceRoot).split('\\').join('/');
+        const reportPath = join(evidenceRoot, 'report.json');
+        const inheritance = executeInheritanceProbe(auditWorkspace, model, command, 120_000, evidenceRoot, definitionInstruction, host.environment);
+        report.inheritanceProbe = inheritance.result;
+        report.inheritanceEvidence = inheritance.evidence;
+        report.sourceConfigPreflight = sourcePreflight.summary;
+        const sourcePreflightPath = join(evidenceRoot, 'source-config-preflight.json');
+        writeAtomic(sourcePreflightPath, JSON.stringify(sourcePreflight.summary, null, 2) + '\n');
+        report.sourceConfigEvidence = {
+            path: relative(evidenceRoot, sourcePreflightPath).split('\\').join('/'),
+            hash: digest(readFileSync(sourcePreflightPath, 'utf8')),
+            rawHash: sourcePreflight.rawHash,
+        };
+        const currentTargetHash = revalidate();
+        if (currentTargetHash !== targetHash) {
+            throw new Error('Agent Definition、Bindings、Host config 或 Skill 在加载评测期间发生漂移');
+        }
+        const currentHostVersion = readOpenCodeVersion(command, root, host.environment);
+        if (currentHostVersion !== report.engine?.version) {
+            throw new Error('OpenCode Host version 在加载评测期间发生漂移');
+        }
+        writeAtomic(reportPath, JSON.stringify(report, null, 2) + '\n');
+        const evidencePath = join(evidenceRoot, 'agent-audit-load-evidence.json');
+        writeAtomic(evidencePath, JSON.stringify({
+            $schema: 'dingtalk-agent/agent-audit-load-evidence@1',
+            targetHash,
+            reportPath: relative(root, reportPath),
+            reportHash: digest(readFileSync(reportPath, 'utf8')),
+        }, null, 2) + '\n');
+        return { report, evidencePath, reportPath, currentHostVersion };
+    }
+    finally {
+        host.dispose();
+        rmSync(auditWorkspace, { recursive: true, force: true });
+    }
+}
+function materializeAuditProbeWorkspace(sourceRoot, targetRoot, definitionInstruction) {
+    if (definitionInstruction !== 'AGENTS.md') {
+        throw new Error('OpenCode 原生 Definition 探针只接受项目根 AGENTS.md');
+    }
+    mkdirSync(targetRoot, { recursive: true });
+    writeAtomic(join(targetRoot, 'AGENTS.md'), readFileSync(join(sourceRoot, 'AGENTS.md'), 'utf8'));
+    const sourceBasic = join(sourceRoot, '.agents', 'skills', 'dingtalk-basic-behavior');
+    const targetBasic = join(targetRoot, '.agents', 'skills', 'dingtalk-basic-behavior');
+    mkdirSync(dirname(targetBasic), { recursive: true });
+    cpSync(sourceBasic, targetBasic, { recursive: true });
+    const config = {
+        $schema: 'https://opencode.ai/config.json',
+        instructions: [BASIC_INSTRUCTION],
+        permission: { skill: { 'dingtalk-basic-behavior': 'allow' } },
+        plugin: [],
+        mcp: {},
+        share: 'disabled',
+        autoupdate: false,
+    };
+    writeAtomic(join(targetRoot, 'opencode.json'), JSON.stringify(config, null, 2) + '\n');
+}
+function inspectSourceOpenCodeRuntime(command, root, environment, definitionInstruction) {
+    const parent = mkdtempSync(join(tmpdir(), 'dta-source-config-preflight-'));
+    const workspace = join(parent, 'workspace');
+    let stdout = '';
+    try {
+        mkdirSync(workspace, { recursive: true });
+        cpSync(join(root, 'opencode.json'), join(workspace, 'opencode.json'));
+        if (existsSync(join(root, 'AGENTS.md'))) {
+            cpSync(join(root, 'AGENTS.md'), join(workspace, 'AGENTS.md'));
+        }
+        const basic = join(root, '.agents', 'skills', 'dingtalk-basic-behavior');
+        if (existsSync(basic)) {
+            const target = join(workspace, '.agents', 'skills', 'dingtalk-basic-behavior');
+            mkdirSync(dirname(target), { recursive: true });
+            cpSync(basic, target, {
+                recursive: true,
+            });
+        }
+        initializeProbeWorktree(workspace);
+        const child = spawnSync(command, ['debug', 'config', '--pure'], {
+            cwd: workspace,
+            env: { ...environment, PWD: workspace },
+            encoding: 'utf8',
+            timeout: 30_000,
+            maxBuffer: 8 * 1024 * 1024,
+        });
+        if (child.error || child.status !== 0) {
+            throw new Error(`OpenCode 无法解析原项目 config: ${child.error?.message || String(child.stderr || child.stdout || '').trim()}`);
+        }
+        stdout = String(child.stdout || '');
+    }
+    finally {
+        rmSync(parent, { recursive: true, force: true });
+    }
+    let value;
+    try {
+        const parsed = JSON.parse(stdout);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            throw new Error('not object');
+        value = parsed;
+    }
+    catch (error) {
+        throw new Error(`OpenCode 原项目 resolved config 非法: ${error.message}`);
+    }
+    const instructions = value.instructions === undefined ? [] : value.instructions;
+    if (!Array.isArray(instructions) || instructions.some((item) => typeof item !== 'string')) {
+        throw new Error('OpenCode 原项目 resolved instructions 不是 string array');
+    }
+    const definitionCount = countInstructionsForPath(root, instructions, definitionInstruction);
+    const basicCount = countInstructionsForPath(root, instructions, BASIC_INSTRUCTION);
+    if (definitionInstruction !== 'AGENTS.md' || definitionCount !== 0 || basicCount !== 1) {
+        throw new Error(`OpenCode 原项目 resolved config 未形成原生 AGENTS.md + 唯一 Basic: ` +
+            `definition=${definitionCount} basic=${basicCount}`);
+    }
+    if (value.agent?.['dta-eval'] !== undefined) {
+        throw new Error('原项目不得预置 dta-eval；该 Agent 仅由隔离评测器生成');
+    }
+    return {
+        rawHash: digest(stdout),
+        summary: {
+            passed: true,
+            definitionInstruction,
+            definitionInstructionCount: definitionCount,
+            basicInstructionCount: basicCount,
+            instructions,
+            pluginCount: Array.isArray(value.plugin) ? value.plugin.length : 0,
+            mcpCount: value.mcp && typeof value.mcp === 'object' && !Array.isArray(value.mcp)
+                ? Object.keys(value.mcp).length : 0,
+            rawHash: digest(stdout),
+        },
+    };
+}
+function executeInheritanceProbe(sourceRoot, model, command, timeoutMs, reportEvidenceRoot, definitionInstruction, environment) {
+    const referenceInstruction = '.agents/skills/dingtalk-basic-behavior/references/risk-authority-and-privacy.md';
+    const definitionProbe = randomUUID();
+    const referenceProbeStart = randomUUID();
+    const referenceProbeEnd = randomUUID();
+    const parent = mkdtempSync(join(tmpdir(), 'dta-agent-inheritance-probe-'));
+    const sandbox = join(parent, 'workspace');
+    try {
+        mkdirSync(sandbox, { recursive: true });
+        initializeProbeWorktree(sandbox);
+        const sourceDefinitionPath = resolve(sourceRoot, definitionInstruction);
+        const definitionPath = resolve(sandbox, definitionInstruction);
+        const sourceBasicPath = join(sourceRoot, '.agents', 'skills', 'dingtalk-basic-behavior');
+        const basicPath = join(sandbox, '.agents', 'skills', 'dingtalk-basic-behavior');
+        const referencePath = resolve(sandbox, referenceInstruction);
+        if (!isInside(sourceRoot, sourceDefinitionPath) || !existsSync(sourceDefinitionPath) ||
+            !isInside(sandbox, definitionPath) || !existsSync(sourceBasicPath)) {
+            throw new Error('隔离继承探针缺少 Agent Definition 或 Basic reference');
+        }
+        writeAtomic(definitionPath, `${readFileSync(sourceDefinitionPath, 'utf8').trimEnd()}\n\n<!-- dta-definition-probe:${definitionProbe} -->\n`);
+        mkdirSync(dirname(basicPath), { recursive: true });
+        cpSync(sourceBasicPath, basicPath, { recursive: true });
+        if (!isInside(sandbox, referencePath) || !existsSync(referencePath)) {
+            throw new Error('隔离继承探针缺少风险/授权 reference');
+        }
+        const referenceBody = readFileSync(referencePath, 'utf8');
+        if (referenceBody.split(/\r?\n/).some((line) => line.length > 2_000)) {
+            throw new Error('Basic reference 含超过 OpenCode read 单行上限的内容，无法证明全文读取');
+        }
+        writeFileSync(referencePath, `<!-- dta-reference-probe:${referenceProbeStart} -->\n\n` +
+            `${referenceBody.trimEnd()}\n\n` +
+            `<!-- dta-reference-probe:${referenceProbeEnd} -->\n`);
+        const referenceLineCount = readFileSync(referencePath, 'utf8').split(/\r?\n/).length;
+        const sourceConfig = JSON.parse(readFileSync(join(sourceRoot, 'opencode.json'), 'utf8'));
+        const permission = sourceConfig.permission && typeof sourceConfig.permission === 'object' &&
+            !Array.isArray(sourceConfig.permission) ? sourceConfig.permission : {};
+        const skill = permission.skill && typeof permission.skill === 'object' &&
+            !Array.isArray(permission.skill) ? permission.skill : {};
+        sourceConfig.instructions = [BASIC_INSTRUCTION];
+        delete sourceConfig.provider;
+        sourceConfig.plugin = [];
+        sourceConfig.mcp = {};
+        sourceConfig.permission = {
+            ...permission,
+            external_directory: 'deny',
+            skill: { ...skill, 'dingtalk-basic-behavior': 'allow' },
+        };
+        writeAtomic(join(sandbox, 'opencode.json'), JSON.stringify(sourceConfig, null, 2) + '\n');
+        const probeEnvironment = { ...environment, PWD: sandbox };
+        const preflight = verifyRequiredBasicSkill(bindRequiredBasicSkill(sandbox), command, probeEnvironment);
+        const basicResolvedCount = countInstructionsForPath(sandbox, preflight.resolvedInstructions, BASIC_INSTRUCTION);
+        prepareOpenCodeEvalAgent(sandbox, 'none');
+        const definitionEvalAgent = resolveOpenCodeEvalAgent(command, sandbox, probeEnvironment);
+        const definitionPermissionPassed = zeroToolPermission(definitionEvalAgent);
+        const definitionExecution = runOpenCodePrompt(command, sandbox, model, DEFINITION_PROBE_PROMPT, 'DTA Agent Definition inheritance probe', timeoutMs, '', probeEnvironment);
+        prepareOpenCodeEvalAgent(sandbox, 'workspace-read', [referenceInstruction]);
+        const referenceEvalAgent = resolveOpenCodeEvalAgent(command, sandbox, probeEnvironment);
+        const referencePermissionPassed = targetReadPermission(referenceEvalAgent, sandbox, referenceInstruction);
+        const referenceExecution = runOpenCodePrompt(command, sandbox, model, REFERENCE_PROBE_PROMPT, 'DTA Basic reference inheritance probe', timeoutMs, '', probeEnvironment);
+        const expectedDefinition = `dta-definition-probe=${definitionProbe}`;
+        const expectedReference = `dta-reference-probe=${referenceProbeStart}:${referenceProbeEnd}`;
+        const referenceReal = realpathSync(referencePath);
+        const referenceRead = referenceExecution.toolTrace.some((item) => item.name === 'read' && item.status === 'completed' &&
+            item.paths.some((path) => realpathIfExists(path) === referenceReal));
+        const completedReferenceReads = referenceExecution.toolTrace.filter((item) => item.name === 'read' && item.status === 'completed');
+        const referenceFullRead = completedReferenceReads.length === 1 &&
+            fullReadWindow(completedReferenceReads[0].readWindow, referenceLineCount);
+        const referenceToolsScoped = referenceExecution.toolCalls === 1 &&
+            referenceExecution.toolTrace.length === referenceExecution.toolCalls &&
+            referenceExecution.toolNames.length === 1 &&
+            referenceExecution.toolNames[0] === 'read' &&
+            referenceExecution.toolTrace.every((item) => item.name === 'read' && item.paths.length === 1 &&
+                item.paths.every((path) => realpathIfExists(path) === referenceReal)) &&
+            referenceExecution.toolPaths.length === 1 &&
+            realpathIfExists(referenceExecution.toolPaths[0]) === referenceReal;
+        const definitionRaw = persistProbeExecution(reportEvidenceRoot, 'definition', definitionExecution);
+        const referenceRaw = persistProbeExecution(reportEvidenceRoot, 'reference', referenceExecution);
+        const result = {
+            passed: definitionInstruction === 'AGENTS.md' && basicResolvedCount === 1 &&
+                definitionPermissionPassed && referencePermissionPassed &&
+                definitionExecution.exitCode === 0 && definitionExecution.directoryMatched &&
+                definitionExecution.toolCalls === 0 &&
+                definitionExecution.answer.trim() === expectedDefinition &&
+                referenceExecution.exitCode === 0 && referenceExecution.directoryMatched &&
+                referenceExecution.answer.trim() === expectedReference &&
+                referenceRead && referenceFullRead && referenceToolsScoped,
+            definition: executionProbeSummary(definitionExecution, expectedDefinition, {
+                nativeRule: definitionInstruction,
+                permissionPassed: definitionPermissionPassed,
+                evalAgent: definitionEvalAgent,
+                raw: definitionRaw,
+            }, sandbox),
+            reference: executionProbeSummary(referenceExecution, expectedReference, {
+                path: referenceInstruction, read: referenceRead, toolsScoped: referenceToolsScoped,
+                fullRead: referenceFullRead,
+                requiredLines: referenceLineCount,
+                permissionPassed: referencePermissionPassed,
+                evalAgent: referenceEvalAgent,
+                raw: referenceRaw,
+            }, sandbox),
+            host: {
+                model,
+                openCodeVersion: preflight.openCodeVersion,
+                basicResolvedCount,
+            },
+        };
+        const resultPath = join(reportEvidenceRoot, 'inheritance-probes', 'result.json');
+        writeAtomic(resultPath, JSON.stringify(result, null, 2) + '\n');
+        return {
+            result,
+            evidence: {
+                resultPath: relative(reportEvidenceRoot, resultPath).split('\\').join('/'),
+                resultHash: digest(readFileSync(resultPath, 'utf8')),
+            },
+        };
+    }
+    finally {
+        rmSync(parent, { recursive: true, force: true });
+    }
+}
+function initializeProbeWorktree(workspace) {
+    const command = process.env.DTA_GIT_BIN ||
+        (existsSync('/usr/bin/git') ? '/usr/bin/git' : 'git');
+    const child = spawnSync(command, ['init', '--quiet'], {
+        cwd: workspace, encoding: 'utf8', timeout: 30_000, maxBuffer: 1024 * 1024,
     });
-    const reportPath = join(root, report.evidencePath, 'report.json');
-    const evidencePath = join(root, report.evidencePath, 'agent-audit-load-evidence.json');
-    writeAtomic(evidencePath, JSON.stringify({
-        $schema: 'dingtalk-agent/agent-audit-load-evidence@1',
-        targetHash,
-        reportPath: relative(root, reportPath),
-        reportHash: digest(readFileSync(reportPath, 'utf8')),
-    }, null, 2) + '\n');
-    return { report, evidencePath };
+    if (child.error || child.status !== 0) {
+        throw new Error(`继承探针无法初始化隔离 git worktree: ${child.error?.message || String(child.stderr || child.stdout || '').trim()}`);
+    }
+}
+function executionProbeSummary(execution, expected, extra, sandbox) {
+    return {
+        passed: execution.exitCode === 0 && execution.directoryMatched &&
+            execution.answer.trim() === expected,
+        exact: execution.answer.trim() === expected,
+        expected,
+        answer: execution.answer.trim(),
+        exitCode: execution.exitCode,
+        directoryMatched: execution.directoryMatched,
+        sessionId: execution.sessionId,
+        sessionDirectory: execution.sessionDirectory,
+        toolCalls: execution.toolCalls,
+        toolNames: execution.toolNames,
+        toolPaths: execution.toolPaths.map((path) => normalizedProbePath(sandbox, path)),
+        toolTrace: execution.toolTrace.map((item) => ({
+            ...item,
+            paths: item.paths.map((path) => normalizedProbePath(sandbox, path)),
+        })),
+        durationMs: execution.durationMs,
+        ...extra,
+    };
+}
+function persistProbeExecution(reportRoot, name, execution) {
+    const evidenceRoot = join(reportRoot, 'inheritance-probes');
+    mkdirSync(evidenceRoot, { recursive: true });
+    const stdoutPath = join(evidenceRoot, `${name}.stdout.ndjson`);
+    const stderrPath = join(evidenceRoot, `${name}.stderr.log`);
+    const exportStdoutPath = join(evidenceRoot, `${name}.export.stdout.json`);
+    const exportStderrPath = join(evidenceRoot, `${name}.export.stderr.log`);
+    writeAtomic(stdoutPath, execution.stdout);
+    writeAtomic(stderrPath, execution.stderr);
+    writeAtomic(exportStdoutPath, execution.sessionExport.stdout);
+    writeAtomic(exportStderrPath, execution.sessionExport.stderr);
+    return {
+        stdoutPath: relative(reportRoot, stdoutPath).split('\\').join('/'),
+        stdoutHash: digest(execution.stdout),
+        stderrPath: relative(reportRoot, stderrPath).split('\\').join('/'),
+        stderrHash: digest(execution.stderr),
+        exportStdoutPath: relative(reportRoot, exportStdoutPath).split('\\').join('/'),
+        exportStdoutHash: digest(execution.sessionExport.stdout),
+        exportStderrPath: relative(reportRoot, exportStderrPath).split('\\').join('/'),
+        exportStderrHash: digest(execution.sessionExport.stderr),
+        exportExitCode: execution.sessionExport.exitCode,
+    };
+}
+function normalizedProbePath(sandbox, path) {
+    const candidate = realpathIfExists(path);
+    return isInside(realpathSync(sandbox), candidate)
+        ? relative(realpathSync(sandbox), candidate).split('\\').join('/')
+        : candidate;
+}
+function zeroToolPermission(agent) {
+    const tools = agent.tools;
+    const permission = agent.permission;
+    return Boolean(tools && typeof tools === 'object' && tools['*'] === false &&
+        Object.values(tools).every((allowed) => allowed === false) &&
+        permission && typeof permission === 'object' && permission['*'] === 'deny' &&
+        permission.external_directory === 'deny');
+}
+function targetReadPermission(agent, workspace, target) {
+    const tools = agent.tools;
+    const permission = agent.permission;
+    const read = permission?.read;
+    if (!tools || typeof tools !== 'object' || tools['*'] !== false || tools.read !== true ||
+        Object.entries(tools).some(([name, allowed]) => !['*', 'read'].includes(name) || allowed !== (name === 'read')) ||
+        !permission || typeof permission !== 'object' || permission['*'] !== 'deny' ||
+        permission.external_directory !== 'deny' || !read || typeof read !== 'object' ||
+        Array.isArray(read) || read['*'] !== 'deny')
+        return false;
+    const allowed = Object.entries(read).filter(([pattern, action]) => pattern !== '*' && action === 'allow');
+    const absolute = resolve(workspace, target);
+    const expected = new Set([target, absolute].map(normalizedInstructionPattern));
+    const canonicalAbsolute = normalizedInstructionPattern(absolute);
+    expected.add(normalizedInstructionPattern(relative(parse(canonicalAbsolute).root, canonicalAbsolute)));
+    if (existsSync(absolute)) {
+        const real = realpathSync(absolute);
+        expected.add(normalizedInstructionPattern(real));
+        expected.add(normalizedInstructionPattern(relative(parse(real).root, real)));
+    }
+    const actual = new Set(allowed.map(([pattern]) => normalizedInstructionPattern(pattern)));
+    return actual.size === expected.size && [...actual].every((pattern) => expected.has(pattern)) &&
+        Object.entries(read).every(([pattern, action]) => pattern === '*' ? action === 'deny' : action === 'allow');
+}
+function normalizedInstructionPattern(pattern) {
+    const normalized = pattern.replace(/\\/g, '/').replace(/^\.\//, '');
+    if (!normalized.startsWith('/') && !/^[a-zA-Z]:\//.test(normalized))
+        return normalized;
+    const original = resolve(normalized);
+    let ancestor = original;
+    while (!existsSync(ancestor) && dirname(ancestor) !== ancestor)
+        ancestor = dirname(ancestor);
+    try {
+        const suffix = relative(ancestor, original);
+        return resolve(realpathSync(ancestor), suffix).replace(/\\/g, '/');
+    }
+    catch {
+        return original.replace(/\\/g, '/');
+    }
+}
+function fullReadWindow(window, requiredLines) {
+    const offset = window?.offset;
+    const limit = window?.limit;
+    return (offset === null || offset === undefined || offset === 0 || offset === 1) &&
+        (limit === null || limit === undefined ||
+            (Number.isInteger(limit) && Number(limit) >= requiredLines));
+}
+function validRandomProbe(value, name) {
+    if (typeof value !== 'string')
+        return false;
+    const uuid = '[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}';
+    const count = name === 'dta-reference-probe' ? 2 : 1;
+    return new RegExp(`^${name}=${uuid}${count === 2 ? `:${uuid}` : ''}$`).test(value);
+}
+function verifyLoadProbeSet(root, reportPath, report, primaryName, comparisonName, basic, expectedRuns) {
+    const all = Array.isArray(report.loadProbes) ? report.loadProbes : [];
+    const declaredRuns = Number(report.summary?.runsPerConfiguration);
+    const primary = all.filter((item) => item.configuration === primaryName);
+    const comparison = all.filter((item) => item.configuration === comparisonName);
+    const version = String(report.engine?.version || '');
+    const runNumbersValid = (items) => items.length === expectedRuns &&
+        new Set(items.map((item) => item.runNumber)).size === expectedRuns &&
+        items.every((item) => Number.isInteger(item.runNumber) &&
+            item.runNumber >= 1 && item.runNumber <= expectedRuns);
+    const common = (item) => {
+        const expectedInstructions = item.expectsLoad === true ? [BASIC_INSTRUCTION] : [];
+        return loadProbeCorePassed(item, version) &&
+            stableStringify(item.resolvedInstructions) === stableStringify(expectedInstructions) &&
+            verifyLoadProbeRaw(root, reportPath, item, String(report.engine?.model || ''));
+    };
+    const primaryPassed = primary.filter((item) => common(item) && item.skill?.hash === basic.hash);
+    const comparisonPassed = comparison.filter((item) => common(item));
+    const knownConfigurations = new Set([primaryName, comparisonName]);
+    const uniqueNonEmpty = (values) => values.every((value) => typeof value === 'string' && Boolean(value)) && new Set(values).size === values.length;
+    const rawStdoutPaths = all.map((item) => item.raw?.stdoutPath);
+    const rawStdoutHashes = all.map((item) => item.raw?.stdoutHash);
+    const rawExportPaths = all.map((item) => item.raw?.exportStdoutPath);
+    const rawExportHashes = all.map((item) => item.raw?.exportStdoutHash);
+    const configurationGates = report.summary?.configurationLoadGates || {};
+    const gatesRecomputed = [primaryName, comparisonName].every((name) => {
+        const gate = configurationGates[name];
+        return gate?.passed === true && gate?.totalRuns === expectedRuns &&
+            gate?.passedRuns === expectedRuns;
+    });
+    const shapeValid = Number.isInteger(expectedRuns) && expectedRuns > 0 &&
+        declaredRuns === expectedRuns &&
+        all.length === expectedRuns * 2 &&
+        all.every((item) => knownConfigurations.has(item.configuration)) &&
+        runNumbersValid(primary) && runNumbersValid(comparison) && gatesRecomputed &&
+        uniqueNonEmpty(all.map((item) => item.challenge)) &&
+        uniqueNonEmpty(all.map((item) => item.sessionId)) &&
+        uniqueNonEmpty(rawStdoutPaths) && uniqueNonEmpty(rawStdoutHashes) &&
+        uniqueNonEmpty(rawExportPaths) && uniqueNonEmpty(rawExportHashes);
+    return {
+        passed: shapeValid && primaryPassed.length === expectedRuns &&
+            comparisonPassed.length === expectedRuns,
+        primary,
+        comparison,
+        passedPrimary: primaryPassed.length,
+        passedComparison: comparisonPassed.length,
+        expectedRuns,
+    };
+}
+function verifyLoadProbeRaw(root, reportPath, probe, model) {
+    const raw = probe.raw;
+    if (!raw || typeof raw !== 'object')
+        return false;
+    const reportRoot = dirname(reportPath);
+    const stdout = readBoundEvidenceFile(root, reportRoot, raw.stdoutPath, raw.stdoutHash);
+    const stderr = readBoundEvidenceFile(root, reportRoot, raw.stderrPath, raw.stderrHash);
+    const exportStdout = readBoundEvidenceFile(root, reportRoot, raw.exportStdoutPath, raw.exportStdoutHash);
+    const exportStderr = readBoundEvidenceFile(root, reportRoot, raw.exportStderrPath, raw.exportStderrHash);
+    if (stdout === null || stderr === null || exportStdout === null || exportStderr === null ||
+        raw.exportExitCode !== 0)
+        return false;
+    const parsed = parsePersistedProbeOutput(stdout);
+    let exported;
+    try {
+        exported = JSON.parse(exportStdout);
+    }
+    catch {
+        return false;
+    }
+    return parsed.valid && parsed.answer === String(probe.answer || '').trim() &&
+        parsed.toolTrace.length === 0 && parsed.sessionIds.length === 1 &&
+        parsed.sessionIds[0] === probe.sessionId &&
+        verifyExportedSession(exported, probe.sessionId, probe.sessionDirectory, model, OPENCODE_LOAD_PROBE_PROMPT) &&
+        !OPENCODE_LOAD_PROBE_PROMPT.includes(String(probe.challenge || ''));
+}
+function verifyExportedSession(exported, sessionId, directory, model, expectedPrompt) {
+    if (String(exported?.info?.id || '') !== sessionId ||
+        String(exported?.info?.directory || '') !== directory ||
+        !Array.isArray(exported?.messages) || !model.includes('/'))
+        return false;
+    const [providerID, ...modelParts] = model.split('/');
+    const modelID = modelParts.join('/');
+    const userTexts = exported.messages
+        .filter((message) => message?.info?.role === 'user')
+        .flatMap((message) => Array.isArray(message.parts) ? message.parts : [])
+        .filter((part) => part?.type === 'text')
+        .map((part) => String(part.text || ''));
+    const modelMatched = exported.messages.some((message) => message?.info?.role === 'assistant' &&
+        String(message.info.providerID || '') === providerID &&
+        String(message.info.modelID || '') === modelID);
+    // OpenCode 1.17.x may persist a positional CLI prompt as its JSON string
+    // representation (including the surrounding quotes). Accept only that exact
+    // encoding in addition to the historical verbatim form so evidence remains
+    // strict while supporting both export formats.
+    const promptMatched = userTexts.length === 1 &&
+        (userTexts[0] === expectedPrompt || userTexts[0] === JSON.stringify(expectedPrompt));
+    return promptMatched && modelMatched;
+}
+function realpathIfExists(path) {
+    try {
+        return existsSync(path) ? realpathSync(path) : resolve(path);
+    }
+    catch {
+        return resolve(path);
+    }
 }
 function readLoadEvidence(root, input, expectedTargetHash) {
     const loaded = readReport(root, input, 'Agent audit load evidence');
@@ -283,31 +949,241 @@ function readLoadEvidence(root, input, expectedTargetHash) {
     if (digest(readFileSync(report.path, 'utf8')) !== value.reportHash) {
         throw new Error('OpenCode load report hash 不一致');
     }
-    return { path: loaded.path, report: report.value };
+    return { path: loaded.path, reportPath: report.path, report: report.value };
 }
-function verifyLoadReport(report, basic) {
-    const configuration = report.skills?.current_skill ? 'current_skill' : 'with_skill';
-    const probes = Array.isArray(report.loadProbes)
-        ? report.loadProbes.filter((item) => item.configuration === configuration) : [];
+function verifyLoadReport(root, reportPath, report, basic, definitionInstruction, model, currentHostVersion) {
+    const configuration = 'with_skill';
+    const comparison = 'without_skill';
+    const probeSet = verifyLoadProbeSet(root, reportPath, report, configuration, comparison, basic, 1);
+    const probes = probeSet.primary;
     const source = report.skills?.[configuration];
     const gate = report.summary?.configurationLoadGates?.[configuration];
+    const definition = report.inheritanceProbe?.definition || {};
+    const reference = report.inheritanceProbe?.reference || {};
+    const definitionPassed = validRandomProbe(definition.expected, 'dta-definition-probe') &&
+        definition.answer === definition.expected && definition.exitCode === 0 &&
+        definition.directoryMatched === true && definition.toolCalls === 0 &&
+        Array.isArray(definition.toolNames) && definition.toolNames.length === 0 &&
+        Array.isArray(definition.toolPaths) && definition.toolPaths.length === 0 &&
+        Array.isArray(definition.toolTrace) && definition.toolTrace.length === 0 &&
+        definition.nativeRule === 'AGENTS.md' && definitionInstruction === 'AGENTS.md' &&
+        definition.permissionPassed === true &&
+        zeroToolPermission(definition.evalAgent || {});
+    const referenceTrace = Array.isArray(reference.toolTrace) ? reference.toolTrace : [];
+    const referenceRead = referenceTrace.some((item) => item?.name === 'read' && item?.status === 'completed' &&
+        Array.isArray(item.paths) && item.paths.length === 1 &&
+        item.paths[0] === reference.path);
+    const completedReferenceReads = referenceTrace.filter((item) => item?.name === 'read' && item?.status === 'completed');
+    const referenceFullRead = Number.isInteger(reference.requiredLines) &&
+        reference.requiredLines > 0 && completedReferenceReads.length === 1 &&
+        fullReadWindow(completedReferenceReads[0]?.readWindow, reference.requiredLines);
+    const referenceToolsScoped = reference.toolCalls === 1 &&
+        referenceTrace.length === 1 &&
+        Array.isArray(reference.toolNames) && reference.toolNames.length === 1 &&
+        reference.toolNames[0] === 'read' &&
+        referenceTrace.every((item) => item?.name === 'read' &&
+            Array.isArray(item.paths) && item.paths.length === 1 && item.paths[0] === reference.path) &&
+        Array.isArray(reference.toolPaths) && reference.toolPaths.length === 1 &&
+        reference.toolPaths[0] === reference.path;
+    const referencePassed = reference.path ===
+        '.agents/skills/dingtalk-basic-behavior/references/risk-authority-and-privacy.md' &&
+        validRandomProbe(reference.expected, 'dta-reference-probe') &&
+        reference.answer === reference.expected && reference.exitCode === 0 &&
+        reference.directoryMatched === true && referenceRead && referenceFullRead &&
+        reference.fullRead === true && referenceToolsScoped &&
+        reference.permissionPassed === true &&
+        targetReadPermission(reference.evalAgent || {}, String(reference.sessionDirectory || ''), reference.path);
+    const inheritanceEvidenceValid = verifyInheritanceEvidence(root, reportPath, report.inheritanceProbe, report.inheritanceEvidence);
+    const sourceConfigEvidenceValid = verifySourceConfigEvidence(root, reportPath, report.sourceConfigPreflight, report.sourceConfigEvidence);
+    const hostMatched = report.engine?.model === model &&
+        typeof report.engine?.version === 'string' && Boolean(report.engine.version) &&
+        report.engine.version === currentHostVersion &&
+        report.inheritanceProbe?.host?.model === report.engine.model &&
+        report.inheritanceProbe?.host?.openCodeVersion === report.engine.version &&
+        report.inheritanceProbe?.host?.basicResolvedCount === 1;
     const passed = report.$schema === 'dingtalk-agent/opencode-eval-report@1' &&
+        report.passed === true && report.summary?.hardGate === true &&
         report.dingtalkSideEffect === false && source?.name === basic.name &&
         source?.version === basic.version && source?.hash === basic.hash &&
-        report.summary?.loadGate === true && gate?.passed === true && probes.length > 0 &&
-        probes.every((item) => item.exactLoaded === true && item.noTools === true &&
-            item.directoryMatched === true && item.skill?.hash === basic.hash);
+        report.summary?.loadGate === true && gate?.passed === true && probeSet.passed &&
+        definitionPassed && referencePassed && inheritanceEvidenceValid &&
+        sourceConfigEvidenceValid && hostMatched;
     return {
         passed,
         evidence: {
             schema: report.$schema || '', configuration, sourceHash: source?.hash || '',
             expectedHash: basic.hash, loadGate: report.summary?.loadGate === true,
-            passedProbes: probes.filter((item) => item.exactLoaded && item.noTools &&
-                item.directoryMatched).length,
+            passedProbes: probeSet.passedPrimary,
+            baselineAntiGuessProbes: probeSet.passedComparison,
+            expectedRunsPerConfiguration: probeSet.expectedRuns,
+            definitionInstruction,
+            definitionNativeRule: definition.nativeRule === 'AGENTS.md',
             totalProbes: probes.length,
+            definitionProbePassed: definitionPassed,
+            referenceProbePassed: referencePassed,
+            inheritanceProbePassed: definitionPassed && referencePassed &&
+                inheritanceEvidenceValid && hostMatched,
+            inheritanceEvidenceValid,
+            sourceConfigEvidenceValid,
+            hostMatched,
+            inheritanceDefinition: definition,
+            inheritanceReference: reference,
         },
     };
 }
+function verifySourceConfigEvidence(root, reportPath, summary, evidence) {
+    if (!summary || typeof summary !== 'object' || Array.isArray(summary) ||
+        !evidence || typeof evidence !== 'object' || Array.isArray(evidence))
+        return false;
+    const value = summary;
+    const manifest = evidence;
+    if (value.passed !== true || value.definitionInstruction !== 'AGENTS.md' ||
+        value.definitionInstructionCount !== 0 || value.basicInstructionCount !== 1 ||
+        typeof value.rawHash !== 'string' || !value.rawHash ||
+        manifest.rawHash !== value.rawHash)
+        return false;
+    const body = readBoundEvidenceFile(root, dirname(reportPath), manifest.path, manifest.hash);
+    if (body === null)
+        return false;
+    try {
+        return stableStringify(JSON.parse(body)) === stableStringify(value);
+    }
+    catch {
+        return false;
+    }
+}
+function verifyInheritanceEvidence(root, reportPath, probe, evidence) {
+    if (!reportPath || !probe || typeof probe !== 'object' || !evidence ||
+        typeof evidence !== 'object' || Array.isArray(evidence))
+        return false;
+    const manifest = evidence;
+    const reportRoot = dirname(reportPath);
+    const result = readBoundEvidenceFile(root, reportRoot, manifest.resultPath, manifest.resultHash);
+    if (!result)
+        return false;
+    try {
+        if (stableStringify(JSON.parse(result)) !== stableStringify(probe))
+            return false;
+    }
+    catch {
+        return false;
+    }
+    const value = probe;
+    const rawBodies = {};
+    const rawValid = ['definition', 'reference'].every((name) => {
+        const raw = value[name]?.raw;
+        if (!raw || typeof raw !== 'object')
+            return false;
+        const stdout = readBoundEvidenceFile(root, reportRoot, raw.stdoutPath, raw.stdoutHash);
+        const stderr = readBoundEvidenceFile(root, reportRoot, raw.stderrPath, raw.stderrHash);
+        const exportStdout = readBoundEvidenceFile(root, reportRoot, raw.exportStdoutPath, raw.exportStdoutHash);
+        const exportStderr = readBoundEvidenceFile(root, reportRoot, raw.exportStderrPath, raw.exportStderrHash);
+        if (stdout === null || stderr === null || exportStdout === null || exportStderr === null ||
+            raw.exportExitCode !== 0)
+            return false;
+        try {
+            const exported = JSON.parse(exportStdout);
+            const expectedPrompt = name === 'definition'
+                ? DEFINITION_PROBE_PROMPT : REFERENCE_PROBE_PROMPT;
+            if (!verifyExportedSession(exported, String(value[name]?.sessionId || ''), String(value[name]?.sessionDirectory || ''), String(value.host?.model || ''), expectedPrompt))
+                return false;
+        }
+        catch {
+            return false;
+        }
+        rawBodies[name] = stdout;
+        return true;
+    });
+    if (!rawValid)
+        return false;
+    const definitionRaw = parsePersistedProbeOutput(rawBodies.definition);
+    const referenceRaw = parsePersistedProbeOutput(rawBodies.reference);
+    const summaryReferenceTrace = Array.isArray(value.reference?.toolTrace)
+        ? value.reference.toolTrace : [];
+    const rawCompletedReads = referenceRaw.toolTrace.filter((item) => item.name === 'read' && item.status === 'completed');
+    return definitionRaw.valid && definitionRaw.answer === value.definition?.answer &&
+        definitionRaw.sessionIds.length === 1 &&
+        definitionRaw.sessionIds[0] === value.definition?.sessionId &&
+        definitionRaw.toolTrace.length === 0 &&
+        referenceRaw.valid && referenceRaw.answer === value.reference?.answer &&
+        referenceRaw.sessionIds.length === 1 &&
+        referenceRaw.sessionIds[0] === value.reference?.sessionId &&
+        referenceRaw.toolTrace.length === value.reference?.toolCalls &&
+        referenceRaw.toolTrace.length === summaryReferenceTrace.length &&
+        referenceRaw.toolTrace.every((item, index) => stableStringify(item.readWindow) ===
+            stableStringify(summaryReferenceTrace[index]?.readWindow)) &&
+        rawCompletedReads.length === 1 &&
+        fullReadWindow(rawCompletedReads[0].readWindow, value.reference?.requiredLines) &&
+        referenceRaw.toolTrace.every((item) => item.name === 'read' &&
+            item.paths.length === 1 && item.paths[0] === value.reference?.path);
+}
+function parsePersistedProbeOutput(body) {
+    const events = [];
+    for (const line of body.split(/\r?\n/)) {
+        if (!line.trim())
+            continue;
+        try {
+            events.push(JSON.parse(line));
+        }
+        catch {
+            return { valid: false, answer: '', sessionIds: [], toolTrace: [] };
+        }
+    }
+    const answer = events.filter((event) => event.type === 'text' && event.part?.type === 'text')
+        .map((event) => String(event.part.text || '')).join('\n').trim();
+    const toolEvents = events.filter((event) => String(event.type || '').includes('tool') || event.part?.type === 'tool');
+    return {
+        valid: events.length > 0,
+        answer,
+        sessionIds: [...new Set(events.map((event) => String(event.sessionID || ''))
+                .filter(Boolean))],
+        toolTrace: toolEvents.map((event) => ({
+            name: String(event.part?.tool || event.part?.name || event.tool || event.name || ''),
+            status: String(event.part?.state?.status || event.status || ''),
+            paths: persistedToolPaths(event),
+            readWindow: persistedReadWindow(event),
+        })),
+    };
+}
+function persistedReadWindow(event) {
+    const input = event.part?.state?.input;
+    return {
+        offset: Number.isInteger(input?.offset) ? Number(input.offset) : null,
+        limit: Number.isInteger(input?.limit) ? Number(input.limit) : null,
+    };
+}
+function persistedToolPaths(event) {
+    const paths = [];
+    for (const candidate of [event.part?.state?.input, event.part?.state?.metadata]) {
+        if (!candidate || typeof candidate !== 'object')
+            continue;
+        for (const [key, value] of Object.entries(candidate)) {
+            if (!['filePath', 'filepath', 'path', 'directory'].includes(key) ||
+                typeof value !== 'string')
+                continue;
+            const normalized = value.replace(/\\/g, '/').replace(/^\.\//, '');
+            const target = '.agents/skills/dingtalk-basic-behavior/references/' +
+                'risk-authority-and-privacy.md';
+            paths.push(normalized === target || normalized.endsWith(`/${target}`)
+                ? target : normalized);
+        }
+    }
+    return [...new Set(paths)];
+}
+function readBoundEvidenceFile(root, reportRoot, input, expectedHash) {
+    if (typeof input !== 'string' || !input || typeof expectedHash !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(expectedHash))
+        return null;
+    const candidate = resolve(reportRoot, input);
+    if (!isInside(root, candidate) || !isInside(reportRoot, candidate) || !existsSync(candidate)) {
+        return null;
+    }
+    const path = realpathSync(candidate);
+    if (!isInside(root, path) || !isInside(reportRoot, path) || !statSync(path).isFile())
+        return null;
+    const body = readFileSync(path, 'utf8');
+    return digest(body) === expectedHash ? body : null;
+}
 function verifyRemoteReport(report, definitionHash, routes, basic) {
     const mounts = Array.isArray(report.mounts) ? report.mounts : [];
     const expected = Object.entries(routes)
@@ -350,12 +1226,12 @@ function readReport(root, input, label) {
 function repairFor(id) {
     if (id === 'definition.semantic-contract')
         return {
-            id, why: '结构化模板不能替代真实的身份、职责、交付物和拒绝边界。',
+            id, why: '结构化模板不能替代真实的本体定义、岗位底线、做事范式和常犯错误。',
             actions: ['评审并替换 AGENTS.md 中所有 <...> 占位符，再复跑 audit。'],
         };
     if (id === 'definition.body')
         return {
-            id, why: 'Agent 必须有长期身份、职责、交付物和拒绝边界。',
+            id, why: 'Agent 必须有长期定义、岗位底线、做事范式和常犯错误。',
             actions: ['从 compose Skill 的 AGENTS.template.md 创建 AGENTS.md，再复跑 audit。'],
         };
     if (id === 'storage.memory')
@@ -390,8 +1266,13 @@ function repairFor(id) {
         };
     if (id === 'host.basic-exposure')
         return {
-            id, why: 'OpenCode 只能从项目 exposure 加载本次装配的 Basic Skill。',
-            actions: ['把 canonical dingtalk-basic-behavior 物化到 .agents/skills/dingtalk-basic-behavior。'],
+            id, why: 'OpenCode 只能从项目 exposure 完整继承本次装配的 Basic Skill 入口、references 与 assets。',
+            actions: ['把 canonical dingtalk-basic-behavior 全树物化到 .agents/skills/dingtalk-basic-behavior。'],
+        };
+    if (id === 'host.definition-rule')
+        return {
+            id, why: 'OpenCode 只会把项目根 AGENTS.md 作为本地原生 rule；重复 custom instruction 会形成冗余通道。',
+            actions: ['把项目本体统一为根目录 AGENTS.md，并从 opencode.json#instructions 删除其等价路径。'],
         };
     if (id === 'host.basic-instruction')
         return {
@@ -405,8 +1286,8 @@ function repairFor(id) {
         };
     if (id === 'host.load-probe')
         return {
-            id, why: '静态目录和配置不能证明模型真的读到 Basic 正文。',
-            actions: ['执行 dta agent audit --verify-load --yes --json，保留随机 probe 与 Session directory 证据。'],
+            id, why: '静态目录和配置不能证明 Host 已解析 Agent Definition 并让模型读到 Basic 正文。',
+            actions: ['执行 dta agent audit --verify-load --yes --json，保留 resolved instructions、随机 probe 与 Session directory 证据。'],
         };
     if (id === 'authority.dws')
         return {
@@ -458,4 +1339,47 @@ function isInside(root, candidate) {
     const rel = relative(root, candidate);
     return rel === '' || (rel !== '..' && !rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`));
 }
+function inspectContainedPath(root, input) {
+    const rootReal = realpathSync(resolve(root));
+    const candidate = resolve(rootReal, input);
+    if (!isInside(rootReal, candidate)) {
+        return { valid: false, path: candidate, reason: 'outside-agent-root' };
+    }
+    const rel = relative(rootReal, candidate);
+    let cursor = rootReal;
+    for (const segment of rel.split(/[\\/]/).filter(Boolean)) {
+        cursor = join(cursor, segment);
+        if (!pathEntryExists(cursor))
+            break;
+        const info = lstatSync(cursor);
+        if (info.isSymbolicLink()) {
+            return { valid: false, path: candidate, reason: `symlink:${relative(rootReal, cursor)}` };
+        }
+        if (cursor !== candidate && !info.isDirectory()) {
+            return { valid: false, path: candidate, reason: `non-directory-ancestor:${relative(rootReal, cursor)}` };
+        }
+    }
+    let ancestor = candidate;
+    while (!pathEntryExists(ancestor) && dirname(ancestor) !== ancestor)
+        ancestor = dirname(ancestor);
+    try {
+        const projected = resolve(realpathSync(ancestor), relative(ancestor, candidate));
+        if (!isInside(rootReal, projected)) {
+            return { valid: false, path: candidate, reason: 'realpath-outside-agent-root' };
+        }
+    }
+    catch (error) {
+        return { valid: false, path: candidate, reason: `realpath-error:${error.message}` };
+    }
+    return { valid: true, path: candidate, reason: '' };
+}
+function pathEntryExists(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 //# sourceMappingURL=agent-audit.js.map