@xdxer/dingtalk-agent 0.1.4-beta.8 → 0.1.4

package/CHANGELOG.md

@@ -0,0 +1,233 @@
+# Changelog
+
+All notable changes to `@xdxer/dingtalk-agent` are documented here. The project follows semantic versioning; prerelease entries describe release candidates and do not imply that Live canaries or registry publication have completed.
+
+## 0.1.4 - 2026-07-20
+
+First stable release of the 0.1.4 line. It promotes the beta series to the `latest` dist-tag, which until now still pointed at 0.1.2. No code changes relative to `0.1.4-beta.19`; the entries below describe what accumulated across the beta line.
+
+### Highlights since 0.1.2
+
+- **Agent definition is harness-agnostic.** The minimal Agent directory holds only `AGENTS.md`, storage bindings, memory/knowledge, Role Skills and the Field. Host configuration and skill exposure are appended per chosen host, not part of the body. The loading contract is stated as four host-agnostic invariants; OpenCode remains the only host with a complete adapter, and the documentation says so rather than implying broader support.
+- **Skill versioning and update gates.** Installed skills report `missing / current / modified / outdated / ahead / unknown` against a whole-tree content hash. Upgrades refuse to downgrade without `--allow-downgrade` and re-read the canonical copy afterwards, so an exit code of 0 with a non-current readback is an error. A release-time guard fails the build when a skill's body changed without a version bump.
+- **Testing methods consolidated into `dingtalk-agent-eval`.** Three interactive channels for a delivered Agent, the local connector smoke route for one that is not yet deployed, the L0–L4 tier table, the hard-gate checklist, and the failure-to-case iteration path all ship inside the skill instead of living in repository docs that the package does not contain.
+- **`platform trace` as an evidence surface**, alongside response, filesystem, workspace, artifact and remote readback.
+- **`doctor` reports locally installed coding agents** — binary path, version and config roots — with CLI presence and skill visibility as separate fields.
+
+### Release boundary
+
+- Published to the public npm `latest` dist-tag as `0.1.4`; the `beta` dist-tag continues to point at `0.1.4-beta.19`.
+- **Live gates remain waived.** The Live waivers carried since beta.9 are unchanged: no real DingTalk egress, personal-event canary, remote semantic state Live run, or Multica acceptance was executed for this release. Stable here means the deterministic contract and assembly gates hold and the public interfaces are settled — it does not mean the Live evidence chain has been exercised.
+- Verification used targeted contract scenarios per the project's fast-verification discipline, not the full suite.
+
+## 0.1.4-beta.19 - 2026-07-20
+
+### Added
+
+- `references/host-loading-contract.md`: the loading contract stated as four host-agnostic invariants — the Definition is loaded by the host's native project rule and must not also enter custom instructions; the Basic Skill's body is the single resolved forced instruction of every session, not merely "discoverable"; the Basic exposure must be materialized as a whole tree matching the canonical hash; Role Skills stay discoverable-and-authorized without joining the forced set. The three evidence classes are described in general form, with the binding fields (host name, host version, model, raw trace) supplied by each host adapter.
+- `references/hosts/claude-code.md`: Claude Code's mechanism differences, most importantly that it does **not** natively read `AGENTS.md` (the body must be referenced via `@AGENTS.md` in `CLAUDE.md` or a symlink) and that its skill exposure root `.claude/skills` is not shared with `.agents/skills`. The file states plainly that the adapter is unimplemented and that choosing Claude Code therefore caps the verdict at `partial`.
+- `src/host-detect.ts` and a `hosts` section in `doctor`: which coding agent CLIs are installed locally, with binary path, version, config roots (honoring `CLAUDE_CONFIG_DIR`, `CODEX_HOME`, `XDG_CONFIG_HOME`) and skill exposure root reported separately.
+
+### Changed
+
+- The minimal Agent directory is now harness-agnostic: `opencode.json` and `.agents/skills/` are no longer part of the core, matching what `examples/agents/*` have always contained. Host config and exposure directories are listed as "appended per chosen host, not part of the body". Compose gains a step for letting the user choose the Agent Host instead of defaulting silently.
+- OpenCode-specific material moved to `references/hosts/opencode.md` and `assets/hosts/opencode/`. OpenCode remains the only host with a complete adapter, and the documentation says so rather than implying broader support.
+- Not selecting a host is not an exemption: an unselected host, or one without an adapter, yields `partial` and never `ready`.
+- `doctor` no longer derives Codex and OpenCode status from one shared boolean. `cli.found` (binary on PATH) and skill visibility are separate fields, so a machine with neither client installed no longer reports both as `ok`. The `hosts` array is additive and does not participate in `ready`; the three existing client checks keep their level semantics.
+- `scripts/check-skill-versions.mjs` compares the baseline tree against the working tree instead of `base...HEAD`, which only saw committed changes and passed vacuously before a commit.
+- Host lists, per-host directory conventions and multi-host installation continue to be delegated to the upstream `skills` CLI rather than reimplemented; this repository only owns the loading contract and the loading evidence, which upstream does not provide.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag and a Git tag. No DingTalk write, robot binding, or Live canary was executed. The Claude Code adapter is documented but not implemented, and no evidence class is claimed for it. Verification used targeted contract scenarios (24/27/28/30/34/50/56/60/62).
+
+## 0.1.4-beta.18 - 2026-07-20
+
+### Added
+
+- `dingtalk-agent-eval/references/local-connector-smoke.md`: the local route for an Agent that is **not yet deployed** — a dedicated test robot driven by a `dws dev connect` connector against a local workspace. Covers egress ownership (`robot-connect`/`connector`), the workspace constraints that must hold before starting, a five-step runbook, `status=not_running` as the only teardown truth, and how it differs from the Robot Pool. It is explicitly not a fourth interactive channel: the other three test deployed artifacts.
+- `dingtalk-agent-eval/references/failure-to-case.md`: how a real failure becomes a regression case — the iteration path, the CLI-versus-Skill discrimination rule ("would bypassing this produce a worse reply, or a wrong side effect?"), and how to set up the with/without and current/previous comparisons without letting ordering effects read as gains.
+- The L0–L4 tier table with promotion rules now lives in the eval SKILL; the eight-item hard-gate checklist and the sandbox containment audit now live in `evidence-contract.md`; egress ownership and the Role Principal / Execution Subject / Input Channel split now live in `eval-topology.md`.
+
+### Changed
+
+- Testing methods are consolidated into the eval skill as the single source of truth. `docs/SELF-TEST.md` loses 191 lines of method content and keeps only this repository's own evidence, baselines and historical conclusions; `docs/ARCHITECTURE.md` and the Multica `PLATFORM.md` converge to pointers. This fixes a real defect: `docs/` is not part of the npm tarball, so shipped skill text was pointing users at files their installation does not contain.
+- The local smoke route no longer hardcodes `--channel claudecode`. It selects by whichever coding agent is actually installed, and states plainly that the Robot Pool still pins a single channel.
+- Fixed an error in the eval SKILL channel table: channel B's egress owner is the platform-side Agent, not the connector.
+- `dingtalk-agent-eval` 0.6.0 → 0.7.0.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag and a Git tag. No DingTalk write, robot binding, or Live canary was executed. Verification used targeted contract scenarios (20/28/34/56/62) plus a link check over the packaged skill tree, per the repository's current fast-verification discipline.
+
+## 0.1.4-beta.17 - 2026-07-20
+
+### Added
+
+- Interactive debug channels for a delivered Agent (`dingtalk-agent-eval/references/interactive-debug-channels.md`): three channels — platform CLI dispatch, your own DingTalk identity to a bound robot, and digital-employee identity (in development) — each with what it proves and explicitly does not prove, an A→B→C one-way escalation rule, and a four-way attribution tree for "no reply" (eligibility silence / channel not connected / runtime or task failure / genuinely wrong answer). The Compose skill hands off to eval after assembly instead of improvising acceptance criteria.
+- `platform trace` as a first-class evidence surface: the managed platform's persisted execution trace (task and session id, reasoning, every tool call, `failure_reason`, the skills actually in effect) is the only surface that reliably catches "the reply reads correctly but the assembly is broken". Synced across the eval SKILL, the evidence contract, the topology table and the lab catalog schema enum.
+- Skill version state model replacing a single boolean: `missing / current / modified / outdated / ahead / unknown`, backed by a whole-tree `contentHash` so a body edit that skips a version bump is still detected. `skill status` reports `installedVersion → skillVersion (state)`; `doctor` prints the same and folds already-installed platform skills into the report without letting opt-in skills affect `ready`; `dta upgrade` reports before/after/bundled/state per skill.
+- `scripts/check-skill-versions.mjs`, wired into `release:check`: a skill whose body changed against the baseline without a version bump, or whose version regressed, fails the gate.
+- Contract scenario 62 `SkillVersionDrift` covering the four drift states, the downgrade refusal and its `--allow-downgrade` recovery, doctor grading, and content-hash detection.
+
+### Changed
+
+- `dingtalk-agent-eval` joins the default skill suite. Testing methods are consolidated into that skill, so a machine without it has no path to any testing guidance; `setup` and `skill install` now install three skills.
+- Skill updates fail closed: a local copy newer than the bundled one is refused unless `--allow-downgrade`, and every install/upgrade re-reads the canonical copy afterwards — exit code 0 with a non-`current` readback is now an error rather than a silent success.
+- `multica-external` declares `metadata.version` for the first time. Without it the empty-string comparison was always true, so the skill reported `current` permanently and could never be upgraded.
+- `src/version.ts` extracted so the npm package and skills share one semver implementation; prerelease comparison changed from whole-string collation to dot-identifier segments.
+- OpenCode/Multica real acceptance chain (from the branch's earlier work): JSON-stringified prompts accepted, `agent.displayName` added, and the skill load smoke verified against a strict structured allowlist.
+- Stale `skills/<name>/` paths left by the core/platforms reorganization corrected in AGENTS.md, CLAUDE.md, CONTRIBUTING.md, the eval catalog template and three lab fixtures; the frozen 2026-07-16 baselines are deliberately left untouched.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag and a Git tag. No DingTalk write, robot binding, or Live canary was executed for this release: the interactive-channel documentation is verified against source and CLI help output only, and the version mechanism is verified by deterministic contract scenarios. Live waivers from beta.9 remain unchanged.
+
+## 0.1.4-beta.16 - 2026-07-20
+
+### Added
+
+- Contract eval runner terminal UI: per-scenario progress lines with duration on stderr (live line rewriting and colors on a TTY, plain append-only lines in CI), a closing summary with the slowest scenarios, and a failure block per failed scenario listing the unmet expectations with truncated evidence plus actionable hints — the exact rerun command, the implementing function, the grading/output artifact paths, and the scenario fixtures. A scenario that throws now counts as all-expectations-failed and the suite keeps running, so one run surfaces every failure. stdout stays byte-stable (default JSON, `--smoke` four lines).
+- Runner ergonomics: `--list` prints the scenario catalog; `--only` now accepts scenario names as well as ids (`--only=20,CliErrorHints`); malformed `--only` values fail with `错误:/提示:` guidance instead of running nothing.
+- `evals/README.md` documenting the evals directory layout and the subset-first regression discipline (the full 61-scenario suite is a minutes-long deep-regression gate, not a per-change loop).
+- Creation-inheritance contract from main: the four-part agent body template gains a Basic boot declaration, identity/authorization/privacy/completion bottom lines and a standard loop; the Compose skill and deterministic assertions are synced.
+
+### Changed
+
+- Basic Behavior 0.11 / Compose 0.9 layered contracts: a slimmer entry point plus risk-authorization, privacy, fact-recovery and forgetting boundaries; the Compose agent body is fixed to definition, bottom lines, paradigm and common mistakes with Role/Gate layering and template audits.
+- Inheritance and assembly gates hardened with OpenCode-native AGENTS rules, full Basic-tree integrity and isolated load probes, least-privilege defaults, raw-evidence retention and drift re-verification.
+- The contract runner clears `evals/results/contract` only after arguments validate, so `--list` or a mistyped `--only` no longer wipes the previous run's evidence; result artifacts now carry scenario names in `summary.md` headers and `benchmark.json` eval names.
+- README (zh/en) converged to positioning, quick start, core model, support scope and documentation entries; the multi-platform agent lifecycle narrative is completed and the three-step delivery path is redrawn as a native SVG, replacing the previous JPG assets.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. The eval-runner terminal UI is repository tooling and does not ship in the package; the shipped deltas relative to beta.15 are the skill/template/README commits from main summarized above. Live waivers from beta.9 remain unchanged.
+
+## 0.1.4-beta.15 - 2026-07-19
+
+### Added
+
+- Multica endpoint resolution and display: `agent-platform show|use` now print the resolved endpoint and its source unconditionally — even when multica is not installed or logged in — so you always know where you'd connect and how to switch. `resolveEndpoint()` uses a single source of truth aligned with the executor (`multica_ext.py` reads `MULTICA_SERVER_URL`/`--profile`): `MULTICA_SERVER_URL` env > project config (`dingtalk-agent.json#multicaEndpoint` or `.dingtalk-agent/agent-platform.json.endpoint`) > exactly one logged-in profile's server_url (multiple = ambiguous, never auto-picked) > the platform's suggested endpoint (pre, flagged unconfirmed, never a silent direct-connect). The login readiness hint emits a full copyable `multica login --server-url <resolved> --token ...` with the source annotated.
+- The project manifest gains an optional `multicaEndpoint` field (schema + validation) for a persistent per-project endpoint override.
+
+### Changed
+
+- Scattered pre-fde endpoint literals in `PLATFORM.md` and the compose skill now point to `dta agent-platform show` as the single source instead of hardcoding the URL, so docs cannot drift from the resolver.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. The suggested endpoint is an explicitly-unconfirmed hint only; the executor stays fail-closed and deploy-time confirmation is unchanged. Live waivers from beta.9 remain unchanged.
+
+## 0.1.4-beta.14 - 2026-07-19
+
+### Added
+
+- Per-platform `PLATFORM.md`: switching to a platform now loads a document explaining what each bundled skill does. `agent-platform use|show` print the doc path, and `list|show` display every skill's role and purpose (the registry skill bindings gained a `purpose` field). `multica-dingtalk`'s doc covers the three skills by role, the delivery chain, readiness, the dws-first robot-binding priority (including `--allow-unbound` for connect-to-customers mode), DWS-conversation acceptance, and both unbind paths; `deap` is a coming-soon stub.
+
+### Fixed
+
+- `multica-external`'s `dingtalk-bind` now sends `robot_code` (defaulting to `client_id`, with a `--robot-code` flag). Manual robot binding previously failed with `400 robot_code is required`, blocking real DingTalk robot delivery; a live 10-chain regression on the pre environment now confirms real DWS→robot→agent replies.
+
+### Validated
+
+- End-to-end regression on the dedicated pre environment (authorized): from-zero token login, ten role-diverse agents each carrying basic-behavior (verified silent on un-@mentioned group messages), DWS-created robots bound via the dws path with credentials, and acceptance by real DWS conversation. Five robots were reused via revoke+rebind, confirming messages reroute to the newly bound agent. Both unbind APIs (robot `dingtalk-revoke`, account `dingtalk-account-unbind`) were confirmed.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. The regression's platform side effects (agents, robot bindings, messages) occurred only on the user-authorized pre environment with dedicated test objects. Live waivers from beta.9 remain unchanged.
+
+## 0.1.4-beta.13 - 2026-07-19
+
+### Changed
+
+- Bundled skills reorganize by platform: `skills/core/` carries the universal suite (basic-behavior, compose, eval) and `skills/platforms/multica-dingtalk/` carries the platform pack, with a `deap` coming-soon placeholder; all code resolves sources through the `bundledSkillPath` registry. Installed canonical layout stays flat.
+- Platform skill names disclose their platform: `dingtalk-agent-deploy` → `dingtalk-agent-deploy-multica`, `multica-fde-external` → `multica-external`. The platform registry binds roles to exact skills (deploy/boot/ops); `agent-platform list|show` display the mapping, `platformSkillForRole` exposes it programmatically, and `deploy`/`promote`/`observe` disclose the carrying skill on stderr.
+- `agent-platform show|use` list local Multica login targets (profile, server URL, workspace — never tokens), and compose 0.8.0 makes user confirmation of endpoint/workspace/agent-name the first hard rule of the Multica publish chain, alongside plain-Markdown instructions with readback, empty `--model` by default, mandatory basic-behavior push/attach with a boot declaration, two-probe chat acceptance, and the dws-first robot-binding priority (list or user-confirmed create + `dingtalk-bind`, reuse existing installs, scan-QR as fallback, never a blocking `--wait`).
+- The contract runner gains `--only=<ids>` for targeted verification; AGENTS.md reserves the full 61-scenario suite and `release:check` for deep regression and release acceptance.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. The renamed skill was also pushed to the dedicated pre-environment registry with explicit user authorization; no robot, webhook, schedule, Trigger, or other DingTalk/Multica side effect is created. Live waivers from beta.9 remain unchanged.
+
+## 0.1.4-beta.12 - 2026-07-19
+
+### Added
+
+- The `multica-fde-external` skill is bundled verbatim from the pre-fde registry into the `multica-dingtalk` platform pack: a self-contained Python wrapper (stdlib only, Python ≥3.9) covering the full delivery chain — workspace/runtime/agent provisioning, skill push/pull, DingTalk robot and account binding, the `chat-send --wait` DingTalk-free test channel, `task-trace` observability, autopilot scheduling, and `agent-check` health checks. Selecting `multica-dingtalk` now installs three platform skills.
+- `agent-platform show|use` emit advisory readiness checks for the selected platform: multica CLI presence (with the official install command), login state (with `multica login --server-url <endpoint>` guidance), and a proxy-environment warning with an `env -u` workaround.
+
+### Changed
+
+- Compose Skill 0.6.0: the workflow now requires offering the user a managed-agent-platform choice (multica-dingtalk / deap coming-soon / local-only) before assembly, guides through readiness gaps, and documents the two paths to a DingTalk robot — local `dta listen` streaming debugging versus publishing through Multica (`dingtalk-begin`/`dingtalk-bind` plus the `chat-send --wait` acceptance channel). Creating a bare DingTalk app via `dws dev app robot submit` without asking the user is explicitly forbidden.
+- Contract case 61 now verifies the three-skill lazy install for `multica-dingtalk`.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. No robot, webhook, schedule, Trigger, or DingTalk/Multica side effect is created by the release itself. The end-to-end evidence recorded for this line was produced on the dedicated pre environment with explicit user authorization.
+
+## 0.1.4-beta.11 - 2026-07-19
+
+### Added
+
+- A managed agent platform abstraction: `dta agent-platform list|show|use` with a fixed resolution order (`DTA_AGENT_PLATFORM` env > `dingtalk-agent.json#agentPlatform` > `.dingtalk-agent/agent-platform.json` > inference from declared Multica providers). `multica-dingtalk` is supported; `deap` is registered as coming-soon and fails closed everywhere.
+- Platform skill packs load lazily: selecting `multica-dingtalk` installs `dingtalk-agent-deploy` and `dingtalk-agent-boot-multica`; they are no longer implied by the default install. Platform-specific methodology ships in these packs, not in the CLI.
+- `deploy`, `promote`, and `observe` now pass a fail-closed platform-membership gate; missing, unknown, or coming-soon platforms are rejected with guidance.
+- Contract case 61 covers the registry, the gate, the coming-soon rejection, membership writing, and lazy skill installation; `agent-platform@1` schema added and `project@1` gains the optional `agentPlatform` field.
+
+### Changed
+
+- `dta skill install|status|upgrade|uninstall` without a name now operate on all default bundled Skills (basic-behavior + compose) with a `skill-status-suite@1` JSON envelope; an explicit name keeps the single-skill contract. `setup` installs the full default suite and `doctor` aggregates per-client discovery across it.
+- The compose Skill (0.5.1) names 创建/新建/装配 Agent triggers and drops its placeholder wording, so "帮我创建一个 Agent" reaches it on OpenCode and other hosts.
+- Isolated-HOME eval and release environments strip host `CLAUDE_*` variables so the upstream skills CLI cannot escape the sandbox into the real Claude config directory.
+- Unknown-command suggestions now include `lab`, `listen`, `deploy`, `promote`, `observe`, and `agent-platform`.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. No robot, webhook, schedule, Trigger, or DingTalk/Multica side effect is created. The Live waivers recorded for beta.9 remain unchanged.
+
+## 0.1.4-beta.10 - 2026-07-19
+
+### Removed
+
+- Legacy pre-kernel modules `src/boot.ts`, `src/duty.ts`, `src/kb.ts`, `src/runs.ts` and the unused `templates/ontology/` tree. They were dead code outside the current CLI, were already excluded from the published package, and `runs.ts` conflicted with the documented "Markdown is not a lock, idempotency store, or Receipt" boundary.
+- The `kb`/`duties`/`eval` fields from the default AgentConfig. Existing workspace configs keep unknown fields through passthrough normalization; no migration is required.
+
+### Changed
+
+- Entry documents now match repository reality: CLAUDE.md gains run-mode criteria, the eval-Skill reading path, and an annotated command list; README lists all five bundled Skills; the English README is marked as a condensed overview; SECURITY.md states the actually maintained dist-tag; the eval Skill's L1 wording matches the real `dta lab eval` plan/`--execute --yes` flow (Skill 0.5.1).
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag. No robot, webhook, schedule, Trigger, or DingTalk/Multica side effect is created. The Live waivers recorded for beta.9 remain unchanged.
+
+## 0.1.4-beta.9 - 2026-07-19
+
+### Added
+
+- A general Agent kernel with frozen Agent Definitions, invocation context, employee response gates, durable Session/Run/Wait state, and host-verified completion evidence.
+- Three-layer semantic memory with local and DingTalk document/table routing, candidate review/publish flow, and cold-start recovery contracts.
+- Reusable Compose, Eval, Boot, and Deploy Skills plus two independently auditable example Agents.
+- A Provider-bound Agent Project model with isolated OpenCode and Multica Development Workspaces.
+- OpenCode managed create/run/eval with random Basic Skill load probes and Response/Filesystem/Workspace/Artifact evidence.
+- Multica read-only inspection, plan-bound Agent/Skill deployment, independent readback, load smoke, recovery, rollback, and retire contracts.
+- Policy-bound Promotion Receipts linking local Eval evidence to Multica deployment evidence, plus redacted review-only feedback candidates.
+- Deterministic release-readiness checks that install the generated tarball into an isolated HOME and exercise setup, doctor, bootstrap, eval planning, upgrade, and rollback planning without real DingTalk or Multica access.
+- Default-safe Phase 9 personal-event and Phase 11B remote-state Live runners with explicit resource authorization, fake-DWS contracts, independent readback, and gitignored raw evidence.
+- Plan-bound `dta agent enhance` for existing repositories, with operation-scoped backups, semantic config merging, hash readback, source-drift protection, and zero DingTalk/Trigger side effects.
+- A sanitized local dogfood record proving that an enhanced release-manager Agent reaches `ready` only after a real OpenCode/DeepSeek random Basic load probe.
+
+### Changed
+
+- Basic Behavior advanced to 0.10.0 with evidence-gated task completion. The recorded controlled-regression sample passed its safety and artifact gates, but does not prove a stable behavior-quality gain over 0.9.4.
+- Completion grading now detects contradictory positive claims while preserving negated, conditional, and corrected statements; effectiveness requires a predeclared multi-run policy instead of any single positive delta.
+- Agent audit now keeps generated body and Role Skill templates partial until identity, responsibilities, SOPs, and acceptance placeholders are replaced with real semantics.
+- The deterministic contract suite now covers 60 independent scenarios.
+
+### Live waivers and release boundary
+
+- The user explicitly waived real Multica apply/promotion, personal-event canary, and remote semantic-state Live as release gates for this beta. The release does not relabel local or fake-Provider evidence as real platform proof.
+- Distribution is limited to the public npm `beta` dist-tag, Git tag, and GitHub pre-release. It does not create a robot, webhook, schedule, Trigger, or DingTalk/Multica side effect.
+
+## 0.1.4-beta.8 - 2026-07-16
+
+- Published beta baseline preceding the general Agent kernel and Provider-bound Workspace series.

package/README.en.md

@@ -0,0 +1,167 @@
+<div align="center">
+
+# dingtalk-agent
+
+**A verifiable behavior foundation for DingTalk digital employees.**
+
+[![npm](https://img.shields.io/npm/v/%40xdxer%2Fdingtalk-agent?logo=npm&color=cb3837)](https://www.npmjs.com/package/@xdxer/dingtalk-agent)
+[![CI](https://github.com/D1-2004/dingtalk-agent/actions/workflows/ci.yml/badge.svg)](https://github.com/D1-2004/dingtalk-agent/actions/workflows/ci.yml)
+[![Node.js](https://img.shields.io/node/v/%40xdxer%2Fdingtalk-agent)](https://nodejs.org/)
+[![License](https://img.shields.io/badge/license-MIT-2ea44f)](LICENSE)
+
+[Quick start](#quick-start) · [How it works](#how-it-works) · [Support](#support) · [Docs](#docs)
+
+English · [简体中文](README.md)
+
+</div>
+
+`dingtalk-agent` (`dta`) is a **Skill-first behavior kernel and delivery toolchain** for DingTalk digital employees. It assembles role definition, shared behavior, role capabilities, and execution gates into an Agent Project that can be created, tested, promoted, and audited.
+
+> **Skills advise. The CLI gates. DWS acts.** Skills decide when and why to act; the CLI pins identity, target, budget, idempotency, and readback; DWS executes DingTalk capabilities.
+
+![The complete path from Agent definition to delivery through two identity types](docs/assets/agent-delivery-lifecycle.svg)
+
+## Quick start
+
+Requires Node.js 18.3+.
+
+```bash
+npm install --global --prefix "$HOME/.local" \
+  --registry=https://registry.npmjs.org @xdxer/dingtalk-agent@beta
+
+"$HOME/.local/bin/dta" setup --skip-cli-install
+dta doctor
+```
+
+`setup` installs the Basic Behavior and Compose Skills, then checks DWS authentication and common Agent Hosts. Normal sessions do not require Workspace initialization.
+
+## Why it exists
+
+A model that can talk is not yet a reliable digital employee. `dta` turns the parts most likely to drift into inherited, verifiable contracts:
+
+- **Response judgment:** decide whether to respond before deciding what to say; stay silent in an unmentioned group chat by default.
+- **Authority boundaries:** never infer identity, target, permission, authorization, or reply channel from message text or model memory.
+- **Evidence-backed completion:** command success, platform visibility, delivery, and human acceptance are different states.
+- **Reuse:** new Agents inherit shared behavior and add only role-specific differences instead of copying a giant prompt.
+
+## How it works
+
+An Agent is assembled from four contract layers:
+
+| Layer | Responsibility |
+|---|---|
+| **`AGENTS.md`** | Role, role-specific boundaries, operating pattern, common mistakes, and the Basic startup anchor |
+| **Basic Behavior** | Shared response eligibility, scope, authorization, privacy, completion, and memory behavior |
+| **Role Skills** | Domain judgment, procedure, prohibited actions, and acceptance criteria |
+| **Gate + Receipt** | Hard constraints for identity, target, budget, idempotency, state transitions, and platform readback |
+
+The Prompt keeps only what must remain resident and precisely defined. The full behavior tree belongs in Skills. Constraints that cannot rely on model discretion belong in the Gate.
+
+### Create → test → promote
+
+| Stage | Main artifact | Gate |
+|---|---|---|
+| **Create** | `AGENTS.md`, Basic, Role Skills, bindings | Unresolved placeholders keep the project `partial` |
+| **Test** | Isolated Workspace, load probe, behavior eval, four evidence surfaces | A project cannot become ready without proven Definition/Skill loading |
+| **Promote** | Platform preflight, deployment Receipt, remote readback | Missing designated Eval evidence or identity chain blocks promotion |
+| **Operate** | Digital-employee account or robot entry point, task trace | No claim of write, delivery, or completion without matching evidence |
+
+```bash
+# 1. Generate a zero-write plan, then apply it explicitly
+dta agent enhance --project-name release-agent --role-skill release-manager --dry-run --json
+dta agent enhance --project-name release-agent --role-skill release-manager \
+  --plan-id <plan-id> --yes --json
+
+# 2. Audit, run, and evaluate
+dta agent audit --bindings agent.bindings.json --require-skill release-manager --json
+dta workspace run local-dev --json
+dta workspace eval local-dev --json
+
+# 3. Inspect, promote, and observe
+dta workspace inspect multica-dev --execute --yes --json
+dta workspace remote-list multica-dev --execute --yes --json
+dta promote --source local-dev --target multica-dev --dry-run --json
+dta observe --promotion-id <promotion-id> --input <observation.json> --dry-run --json
+```
+
+Plans are zero-write by default. Remote writes require an explicit target, the current `planId`, and confirmation.
+
+## Support
+
+### Platforms, Harnesses, and runtimes
+
+These are separate concepts:
+
+- A **Managed Agent Platform** owns Workspace, Runtime, Agent, Skill, identity binding, and observation.
+- An **Agent Harness** loads Definition/Skills, isolates execution, and captures evidence.
+- The **dta Kernel** depends on a shared contract, not a specific Harness prompt or private directory layout.
+
+| Dimension | Current support |
+|---|---|
+| **Managed Platform** | Multica (DingTalk) supported; DEAP coming soon; additional platforms through registry + adapters |
+| **Local runtime** | Direct/Mounted sessions in Claude Code, Codex, OpenCode, and similar Hosts; OpenCode is the current complete local managed-Harness reference |
+| **Cloud runtime** | Multica Workspace / Runtime / Agent with the same Definition, Skills, Gate, and evidence contract |
+| **Delivery identity** | Digital-employee/account identity or robot-app identity; neither expands the Agent role or authority |
+
+OpenCode is not a runtime dependency, and Multica is not a privileged bypass. Any promotable Harness must prove the same outcomes: loaded Definition and Skills, pinned identity and isolation, retrievable execution trace, and independent readback.
+
+“Multi-platform” means the architecture, registry, and adapter contract are extensible. It does not claim that unopened platforms have been deployed or Live-verified.
+
+### Runtime modes
+
+| Mode | Use | Boundary |
+|---|---|---|
+| **Direct Session** | Normal interactive work | Never guess an outbound target without a trusted event |
+| **Mounted Session** | Mount local or DingTalk semantic content | Locks, idempotency, and Receipts do not live in Markdown |
+| **Prepared Run** | Reliable event-driven side effects | Actions go only through the typed Broker or `dta act` |
+
+Prepared Runs expose four message atoms: `ack`, `reply`, `ask`, and `silence`. An acknowledgement is not task acceptance, and a reply is not human acceptance.
+
+## What a generated Agent inherits
+
+```text
+my-agent/
+├── AGENTS.md                     Role constitution + Basic inheritance anchor
+├── agent.bindings.json           Definition and storage routing
+├── dingtalk-agent.json           Agent Project desired state
+├── .agents/skills/
+│   ├── dingtalk-basic-behavior/  Complete shared behavior tree
+│   └── <role>/                   Host-discoverable Role Skill
+├── skills/<role>/SKILL.md        Versioned role capability source
+└── .dingtalk-agent/              Private state, evidence, and Receipts
+```
+
+The generated `AGENTS.md` keeps four atomic contracts: **definition, non-negotiable boundaries, operating pattern, and common mistakes**. It also says to apply `dingtalk-basic-behavior` before loading task-relevant Role Skills.
+
+File presence is not inheritance evidence. `agent audit --verify-load` binds real load results to Definition/Skill hashes, Host/model versions, isolated probes, and raw run/export evidence:
+
+```bash
+dta agent audit \
+  --bindings agent.bindings.json \
+  --require-skill <role-skill-name> \
+  --verify-load --yes --json
+```
+
+## Non-negotiable boundaries
+
+- Normal sessions never auto-run `dingtalk-agent init`.
+- Target, actor, conversation, DWS profile, and permissions come only from a trusted Host or event.
+- Prepared Run messaging goes only through a typed Broker or `dta act`; it cannot bypass the Gate.
+- An online Run may propose memory or Skill candidates, but cannot hot-modify current identity, permission, or policy.
+- Model claims, process exit 0, platform-visible writes, delivery, and human acceptance require separate evidence.
+
+## Docs
+
+| Goal | Start here |
+|---|---|
+| Understand architecture and state | [Architecture](docs/ARCHITECTURE.md) |
+| Install, upgrade, or troubleshoot | [Installation](docs/INSTALLATION.md) |
+| Understand evaluation and evidence levels | [Self-test](docs/SELF-TEST.md) |
+| Create or audit an Agent | [Compose Skill](skills/core/dingtalk-agent-compose/SKILL.md) |
+| Test or debug a delivered Agent | [Eval Skill](skills/core/dingtalk-agent-eval/SKILL.md) |
+| Read the shared behavior protocol | [Basic Behavior Skill](skills/core/dingtalk-basic-behavior/SKILL.md) |
+| Copy a complete example | [Example Agents](examples/agents) |
+
+Behavior assets come from observable contracts, counterexample-driven revision, and deployable verification. This project does not claim access to any product's hidden system prompt.
+
+MIT License