@xdxer/dingtalk-agent 0.1.4-beta.9 → 0.1.5-beta.1

package/CHANGELOG.md

@@ -2,6 +2,235 @@
 
 All notable changes to `@xdxer/dingtalk-agent` are documented here. The project follows semantic versioning; prerelease entries describe release candidates and do not imply that Live canaries or registry publication have completed.
 
+## 0.1.5-beta.1 - 2026-07-20
+
+Documentation and evaluation-tooling release. **No runtime code changes** — `bin/` and `src/` behavior is identical to 0.1.4; the only `bin/` edit is a header comment. Ships on the `beta` dist-tag; `latest` stays at 0.1.4.
+
+### Changed
+
+- **Contract evaluations are tiered, and the default regression is 18 seconds instead of 12 minutes.** `npm run eval:contract` now runs only the 29 `core` scenarios (kernel behavior: Session/Run/Wait, Action Gate, response eligibility, perception, task checkpoint, completion gate). The 33 `extended` scenarios — Multica/OpenCode simulation, real tarball offline install, CLI install/upgrade, robot pool, L2/L3 memory providers, live-readiness runners — run under `npm run eval:contract:full`, which is what CI and `release:check` use. `--only=<id>` overrides the tier and can name any scenario. Four README string assertions were removed from the heaviest end-to-end scenarios; document integrity now belongs to `scripts/check-docs.mjs`, which covers every link and anchor in under a second instead of seven magic strings.
+- The `dingtalk-agent-eval` skill teaches running the smallest useful slice first. Without `--cases`, a suite runs every case on every lane, and each case costs a model call — that is time and money. The skill now gives a four-step widening order and distinguishes `--runs 1` (did it break?) from `--runs 3` (did it actually improve?).
+- The `dingtalk-agent-compose` skill no longer claims `dingtalk-agent-eval` is outside the default suite. It joined the default suite in 0.1.4-beta.17, so that sentence was telling users to install a skill they already had.
+
+### Fixed
+
+- Contract scenario 60 (`AgentEnhancement`) hardcoded a CLI version for its in-process call while the spawned CLI read the real one from `package.json`. Because the generated `dingtalk-agent.json` embeds `dtaVersion: ^${version}`, the two plans produced different `planId`s the moment the package version left the 0.1.4 line — so the scenario would have failed on *any* future version bump, not just this one. The scenario now derives the version from `package.json`, and was verified to pass under an unrelated synthetic version.
+
+- **Documentation restructured around three named models.** `docs/ARCHITECTURE.md` now answers four questions in order — what a digital employee is, what an Agent is *composed of* (model A), what it *depends on* (model B), and how this repository is *divided* (model C, six parts). Four mutually contradicting "layer" models previously coexisted across `README.md`, `docs/ARCHITECTURE.md`, `CLAUDE.md` and the `bin/` header comment; they are now one. Model C is a verified partition: every `src/` file belongs to exactly one part, with no overlap and no omission.
+- **README is a signpost, not a preview.** Three tables that were byte-identical to sections of `docs/ARCHITECTURE.md` were replaced by prose plus links, removing duplicate sources of truth. Normative rule restatements across the main documents dropped from 32 to 23, and the verification command block now has a single home in `AGENTS.md`.
+- **Scenario counts are no longer hardcoded.** Documents point at `node evals/run-contract-evals.mjs --list` instead of a number that was already stale in three places.
+- **DWS is now defined where it first appears**, and the quick start no longer calls bare `dta` before the PATH block takes effect.
+- `docs/plans/` (17 completed phase records) removed; the two unfinished items and one fixture-referenced design derivation moved to `docs/roadmap/`. `内网实相.md` → `docs/DWS-FIELD-NOTES.md`, `OPEN-SOURCE-REFERENCES.md` → `docs/PRIOR-ART.md`.
+- `examples/agents/` gained an index, and both example bodies now follow the four-block `AGENTS.md` contract that the Compose skill mandates.
+
+### Package contents
+
+- **Added**: `docs/ARCHITECTURE.md`, `docs/SELF-TEST.md`, `docs/PRIOR-ART.md`. Eight already-published files linked to the first two, so those links were broken inside the installed package.
+- **Removed**: `docs/SECOND-AGENT-ACCEPTANCE.md` (its unique content merged into `docs/SELF-TEST.md`) and six unreferenced PNG diagrams. The SVG originals remain.
+- Packed tarball drops from roughly 3.1 MB to 0.86 MB.
+
+### Added
+
+- `scripts/check-docs.mjs`, wired into `release:check`: fails on dead relative links, dead anchors, a packaged file referencing an unpackaged `docs/*.md`, or structural drift between the two READMEs. The middle check exists because that exact class of breakage had already reached the published package.
+
+## 0.1.4 - 2026-07-20
+
+First stable release of the 0.1.4 line. It promotes the beta series to the `latest` dist-tag, which until now still pointed at 0.1.2. No code changes relative to `0.1.4-beta.19`; the entries below describe what accumulated across the beta line.
+
+### Highlights since 0.1.2
+
+- **Agent definition is harness-agnostic.** The minimal Agent directory holds only `AGENTS.md`, storage bindings, memory/knowledge, Role Skills and the Field. Host configuration and skill exposure are appended per chosen host, not part of the body. The loading contract is stated as four host-agnostic invariants; OpenCode remains the only host with a complete adapter, and the documentation says so rather than implying broader support.
+- **Skill versioning and update gates.** Installed skills report `missing / current / modified / outdated / ahead / unknown` against a whole-tree content hash. Upgrades refuse to downgrade without `--allow-downgrade` and re-read the canonical copy afterwards, so an exit code of 0 with a non-current readback is an error. A release-time guard fails the build when a skill's body changed without a version bump.
+- **Testing methods consolidated into `dingtalk-agent-eval`.** Three interactive channels for a delivered Agent, the local connector smoke route for one that is not yet deployed, the L0–L4 tier table, the hard-gate checklist, and the failure-to-case iteration path all ship inside the skill instead of living in repository docs that the package does not contain.
+- **`platform trace` as an evidence surface**, alongside response, filesystem, workspace, artifact and remote readback.
+- **`doctor` reports locally installed coding agents** — binary path, version and config roots — with CLI presence and skill visibility as separate fields.
+
+### Release boundary
+
+- Published to the public npm `latest` dist-tag as `0.1.4`; the `beta` dist-tag continues to point at `0.1.4-beta.19`.
+- **Live gates remain waived.** The Live waivers carried since beta.9 are unchanged: no real DingTalk egress, personal-event canary, remote semantic state Live run, or Multica acceptance was executed for this release. Stable here means the deterministic contract and assembly gates hold and the public interfaces are settled — it does not mean the Live evidence chain has been exercised.
+- Verification used targeted contract scenarios per the project's fast-verification discipline, not the full suite.
+
+## 0.1.4-beta.19 - 2026-07-20
+
+### Added
+
+- `references/host-loading-contract.md`: the loading contract stated as four host-agnostic invariants — the Definition is loaded by the host's native project rule and must not also enter custom instructions; the Basic Skill's body is the single resolved forced instruction of every session, not merely "discoverable"; the Basic exposure must be materialized as a whole tree matching the canonical hash; Role Skills stay discoverable-and-authorized without joining the forced set. The three evidence classes are described in general form, with the binding fields (host name, host version, model, raw trace) supplied by each host adapter.
+- `references/hosts/claude-code.md`: Claude Code's mechanism differences, most importantly that it does **not** natively read `AGENTS.md` (the body must be referenced via `@AGENTS.md` in `CLAUDE.md` or a symlink) and that its skill exposure root `.claude/skills` is not shared with `.agents/skills`. The file states plainly that the adapter is unimplemented and that choosing Claude Code therefore caps the verdict at `partial`.
+- `src/host-detect.ts` and a `hosts` section in `doctor`: which coding agent CLIs are installed locally, with binary path, version, config roots (honoring `CLAUDE_CONFIG_DIR`, `CODEX_HOME`, `XDG_CONFIG_HOME`) and skill exposure root reported separately.
+
+### Changed
+
+- The minimal Agent directory is now harness-agnostic: `opencode.json` and `.agents/skills/` are no longer part of the core, matching what `examples/agents/*` have always contained. Host config and exposure directories are listed as "appended per chosen host, not part of the body". Compose gains a step for letting the user choose the Agent Host instead of defaulting silently.
+- OpenCode-specific material moved to `references/hosts/opencode.md` and `assets/hosts/opencode/`. OpenCode remains the only host with a complete adapter, and the documentation says so rather than implying broader support.
+- Not selecting a host is not an exemption: an unselected host, or one without an adapter, yields `partial` and never `ready`.
+- `doctor` no longer derives Codex and OpenCode status from one shared boolean. `cli.found` (binary on PATH) and skill visibility are separate fields, so a machine with neither client installed no longer reports both as `ok`. The `hosts` array is additive and does not participate in `ready`; the three existing client checks keep their level semantics.
+- `scripts/check-skill-versions.mjs` compares the baseline tree against the working tree instead of `base...HEAD`, which only saw committed changes and passed vacuously before a commit.
+- Host lists, per-host directory conventions and multi-host installation continue to be delegated to the upstream `skills` CLI rather than reimplemented; this repository only owns the loading contract and the loading evidence, which upstream does not provide.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag and a Git tag. No DingTalk write, robot binding, or Live canary was executed. The Claude Code adapter is documented but not implemented, and no evidence class is claimed for it. Verification used targeted contract scenarios (24/27/28/30/34/50/56/60/62).
+
+## 0.1.4-beta.18 - 2026-07-20
+
+### Added
+
+- `dingtalk-agent-eval/references/local-connector-smoke.md`: the local route for an Agent that is **not yet deployed** — a dedicated test robot driven by a `dws dev connect` connector against a local workspace. Covers egress ownership (`robot-connect`/`connector`), the workspace constraints that must hold before starting, a five-step runbook, `status=not_running` as the only teardown truth, and how it differs from the Robot Pool. It is explicitly not a fourth interactive channel: the other three test deployed artifacts.
+- `dingtalk-agent-eval/references/failure-to-case.md`: how a real failure becomes a regression case — the iteration path, the CLI-versus-Skill discrimination rule ("would bypassing this produce a worse reply, or a wrong side effect?"), and how to set up the with/without and current/previous comparisons without letting ordering effects read as gains.
+- The L0–L4 tier table with promotion rules now lives in the eval SKILL; the eight-item hard-gate checklist and the sandbox containment audit now live in `evidence-contract.md`; egress ownership and the Role Principal / Execution Subject / Input Channel split now live in `eval-topology.md`.
+
+### Changed
+
+- Testing methods are consolidated into the eval skill as the single source of truth. `docs/SELF-TEST.md` loses 191 lines of method content and keeps only this repository's own evidence, baselines and historical conclusions; `docs/ARCHITECTURE.md` and the Multica `PLATFORM.md` converge to pointers. This fixes a real defect: `docs/` is not part of the npm tarball, so shipped skill text was pointing users at files their installation does not contain.
+- The local smoke route no longer hardcodes `--channel claudecode`. It selects by whichever coding agent is actually installed, and states plainly that the Robot Pool still pins a single channel.
+- Fixed an error in the eval SKILL channel table: channel B's egress owner is the platform-side Agent, not the connector.
+- `dingtalk-agent-eval` 0.6.0 → 0.7.0.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag and a Git tag. No DingTalk write, robot binding, or Live canary was executed. Verification used targeted contract scenarios (20/28/34/56/62) plus a link check over the packaged skill tree, per the repository's current fast-verification discipline.
+
+## 0.1.4-beta.17 - 2026-07-20
+
+### Added
+
+- Interactive debug channels for a delivered Agent (`dingtalk-agent-eval/references/interactive-debug-channels.md`): three channels — platform CLI dispatch, your own DingTalk identity to a bound robot, and digital-employee identity (in development) — each with what it proves and explicitly does not prove, an A→B→C one-way escalation rule, and a four-way attribution tree for "no reply" (eligibility silence / channel not connected / runtime or task failure / genuinely wrong answer). The Compose skill hands off to eval after assembly instead of improvising acceptance criteria.
+- `platform trace` as a first-class evidence surface: the managed platform's persisted execution trace (task and session id, reasoning, every tool call, `failure_reason`, the skills actually in effect) is the only surface that reliably catches "the reply reads correctly but the assembly is broken". Synced across the eval SKILL, the evidence contract, the topology table and the lab catalog schema enum.
+- Skill version state model replacing a single boolean: `missing / current / modified / outdated / ahead / unknown`, backed by a whole-tree `contentHash` so a body edit that skips a version bump is still detected. `skill status` reports `installedVersion → skillVersion (state)`; `doctor` prints the same and folds already-installed platform skills into the report without letting opt-in skills affect `ready`; `dta upgrade` reports before/after/bundled/state per skill.
+- `scripts/check-skill-versions.mjs`, wired into `release:check`: a skill whose body changed against the baseline without a version bump, or whose version regressed, fails the gate.
+- Contract scenario 62 `SkillVersionDrift` covering the four drift states, the downgrade refusal and its `--allow-downgrade` recovery, doctor grading, and content-hash detection.
+
+### Changed
+
+- `dingtalk-agent-eval` joins the default skill suite. Testing methods are consolidated into that skill, so a machine without it has no path to any testing guidance; `setup` and `skill install` now install three skills.
+- Skill updates fail closed: a local copy newer than the bundled one is refused unless `--allow-downgrade`, and every install/upgrade re-reads the canonical copy afterwards — exit code 0 with a non-`current` readback is now an error rather than a silent success.
+- `multica-external` declares `metadata.version` for the first time. Without it the empty-string comparison was always true, so the skill reported `current` permanently and could never be upgraded.
+- `src/version.ts` extracted so the npm package and skills share one semver implementation; prerelease comparison changed from whole-string collation to dot-identifier segments.
+- OpenCode/Multica real acceptance chain (from the branch's earlier work): JSON-stringified prompts accepted, `agent.displayName` added, and the skill load smoke verified against a strict structured allowlist.
+- Stale `skills/<name>/` paths left by the core/platforms reorganization corrected in AGENTS.md, CLAUDE.md, CONTRIBUTING.md, the eval catalog template and three lab fixtures; the frozen 2026-07-16 baselines are deliberately left untouched.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag and a Git tag. No DingTalk write, robot binding, or Live canary was executed for this release: the interactive-channel documentation is verified against source and CLI help output only, and the version mechanism is verified by deterministic contract scenarios. Live waivers from beta.9 remain unchanged.
+
+## 0.1.4-beta.16 - 2026-07-20
+
+### Added
+
+- Contract eval runner terminal UI: per-scenario progress lines with duration on stderr (live line rewriting and colors on a TTY, plain append-only lines in CI), a closing summary with the slowest scenarios, and a failure block per failed scenario listing the unmet expectations with truncated evidence plus actionable hints — the exact rerun command, the implementing function, the grading/output artifact paths, and the scenario fixtures. A scenario that throws now counts as all-expectations-failed and the suite keeps running, so one run surfaces every failure. stdout stays byte-stable (default JSON, `--smoke` four lines).
+- Runner ergonomics: `--list` prints the scenario catalog; `--only` now accepts scenario names as well as ids (`--only=20,CliErrorHints`); malformed `--only` values fail with `错误:/提示:` guidance instead of running nothing.
+- `evals/README.md` documenting the evals directory layout and the subset-first regression discipline (the full 61-scenario suite is a minutes-long deep-regression gate, not a per-change loop).
+- Creation-inheritance contract from main: the four-part agent body template gains a Basic boot declaration, identity/authorization/privacy/completion bottom lines and a standard loop; the Compose skill and deterministic assertions are synced.
+
+### Changed
+
+- Basic Behavior 0.11 / Compose 0.9 layered contracts: a slimmer entry point plus risk-authorization, privacy, fact-recovery and forgetting boundaries; the Compose agent body is fixed to definition, bottom lines, paradigm and common mistakes with Role/Gate layering and template audits.
+- Inheritance and assembly gates hardened with OpenCode-native AGENTS rules, full Basic-tree integrity and isolated load probes, least-privilege defaults, raw-evidence retention and drift re-verification.
+- The contract runner clears `evals/results/contract` only after arguments validate, so `--list` or a mistyped `--only` no longer wipes the previous run's evidence; result artifacts now carry scenario names in `summary.md` headers and `benchmark.json` eval names.
+- README (zh/en) converged to positioning, quick start, core model, support scope and documentation entries; the multi-platform agent lifecycle narrative is completed and the three-step delivery path is redrawn as a native SVG, replacing the previous JPG assets.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. The eval-runner terminal UI is repository tooling and does not ship in the package; the shipped deltas relative to beta.15 are the skill/template/README commits from main summarized above. Live waivers from beta.9 remain unchanged.
+
+## 0.1.4-beta.15 - 2026-07-19
+
+### Added
+
+- Multica endpoint resolution and display: `agent-platform show|use` now print the resolved endpoint and its source unconditionally — even when multica is not installed or logged in — so you always know where you'd connect and how to switch. `resolveEndpoint()` uses a single source of truth aligned with the executor (`multica_ext.py` reads `MULTICA_SERVER_URL`/`--profile`): `MULTICA_SERVER_URL` env > project config (`dingtalk-agent.json#multicaEndpoint` or `.dingtalk-agent/agent-platform.json.endpoint`) > exactly one logged-in profile's server_url (multiple = ambiguous, never auto-picked) > the platform's suggested endpoint (pre, flagged unconfirmed, never a silent direct-connect). The login readiness hint emits a full copyable `multica login --server-url <resolved> --token ...` with the source annotated.
+- The project manifest gains an optional `multicaEndpoint` field (schema + validation) for a persistent per-project endpoint override.
+
+### Changed
+
+- Scattered pre-fde endpoint literals in `PLATFORM.md` and the compose skill now point to `dta agent-platform show` as the single source instead of hardcoding the URL, so docs cannot drift from the resolver.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. The suggested endpoint is an explicitly-unconfirmed hint only; the executor stays fail-closed and deploy-time confirmation is unchanged. Live waivers from beta.9 remain unchanged.
+
+## 0.1.4-beta.14 - 2026-07-19
+
+### Added
+
+- Per-platform `PLATFORM.md`: switching to a platform now loads a document explaining what each bundled skill does. `agent-platform use|show` print the doc path, and `list|show` display every skill's role and purpose (the registry skill bindings gained a `purpose` field). `multica-dingtalk`'s doc covers the three skills by role, the delivery chain, readiness, the dws-first robot-binding priority (including `--allow-unbound` for connect-to-customers mode), DWS-conversation acceptance, and both unbind paths; `deap` is a coming-soon stub.
+
+### Fixed
+
+- `multica-external`'s `dingtalk-bind` now sends `robot_code` (defaulting to `client_id`, with a `--robot-code` flag). Manual robot binding previously failed with `400 robot_code is required`, blocking real DingTalk robot delivery; a live 10-chain regression on the pre environment now confirms real DWS→robot→agent replies.
+
+### Validated
+
+- End-to-end regression on the dedicated pre environment (authorized): from-zero token login, ten role-diverse agents each carrying basic-behavior (verified silent on un-@mentioned group messages), DWS-created robots bound via the dws path with credentials, and acceptance by real DWS conversation. Five robots were reused via revoke+rebind, confirming messages reroute to the newly bound agent. Both unbind APIs (robot `dingtalk-revoke`, account `dingtalk-account-unbind`) were confirmed.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. The regression's platform side effects (agents, robot bindings, messages) occurred only on the user-authorized pre environment with dedicated test objects. Live waivers from beta.9 remain unchanged.
+
+## 0.1.4-beta.13 - 2026-07-19
+
+### Changed
+
+- Bundled skills reorganize by platform: `skills/core/` carries the universal suite (basic-behavior, compose, eval) and `skills/platforms/multica-dingtalk/` carries the platform pack, with a `deap` coming-soon placeholder; all code resolves sources through the `bundledSkillPath` registry. Installed canonical layout stays flat.
+- Platform skill names disclose their platform: `dingtalk-agent-deploy` → `dingtalk-agent-deploy-multica`, `multica-fde-external` → `multica-external`. The platform registry binds roles to exact skills (deploy/boot/ops); `agent-platform list|show` display the mapping, `platformSkillForRole` exposes it programmatically, and `deploy`/`promote`/`observe` disclose the carrying skill on stderr.
+- `agent-platform show|use` list local Multica login targets (profile, server URL, workspace — never tokens), and compose 0.8.0 makes user confirmation of endpoint/workspace/agent-name the first hard rule of the Multica publish chain, alongside plain-Markdown instructions with readback, empty `--model` by default, mandatory basic-behavior push/attach with a boot declaration, two-probe chat acceptance, and the dws-first robot-binding priority (list or user-confirmed create + `dingtalk-bind`, reuse existing installs, scan-QR as fallback, never a blocking `--wait`).
+- The contract runner gains `--only=<ids>` for targeted verification; AGENTS.md reserves the full 61-scenario suite and `release:check` for deep regression and release acceptance.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. The renamed skill was also pushed to the dedicated pre-environment registry with explicit user authorization; no robot, webhook, schedule, Trigger, or other DingTalk/Multica side effect is created. Live waivers from beta.9 remain unchanged.
+
+## 0.1.4-beta.12 - 2026-07-19
+
+### Added
+
+- The `multica-fde-external` skill is bundled verbatim from the pre-fde registry into the `multica-dingtalk` platform pack: a self-contained Python wrapper (stdlib only, Python ≥3.9) covering the full delivery chain — workspace/runtime/agent provisioning, skill push/pull, DingTalk robot and account binding, the `chat-send --wait` DingTalk-free test channel, `task-trace` observability, autopilot scheduling, and `agent-check` health checks. Selecting `multica-dingtalk` now installs three platform skills.
+- `agent-platform show|use` emit advisory readiness checks for the selected platform: multica CLI presence (with the official install command), login state (with `multica login --server-url <endpoint>` guidance), and a proxy-environment warning with an `env -u` workaround.
+
+### Changed
+
+- Compose Skill 0.6.0: the workflow now requires offering the user a managed-agent-platform choice (multica-dingtalk / deap coming-soon / local-only) before assembly, guides through readiness gaps, and documents the two paths to a DingTalk robot — local `dta listen` streaming debugging versus publishing through Multica (`dingtalk-begin`/`dingtalk-bind` plus the `chat-send --wait` acceptance channel). Creating a bare DingTalk app via `dws dev app robot submit` without asking the user is explicitly forbidden.
+- Contract case 61 now verifies the three-skill lazy install for `multica-dingtalk`.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. No robot, webhook, schedule, Trigger, or DingTalk/Multica side effect is created by the release itself. The end-to-end evidence recorded for this line was produced on the dedicated pre environment with explicit user authorization.
+
+## 0.1.4-beta.11 - 2026-07-19
+
+### Added
+
+- A managed agent platform abstraction: `dta agent-platform list|show|use` with a fixed resolution order (`DTA_AGENT_PLATFORM` env > `dingtalk-agent.json#agentPlatform` > `.dingtalk-agent/agent-platform.json` > inference from declared Multica providers). `multica-dingtalk` is supported; `deap` is registered as coming-soon and fails closed everywhere.
+- Platform skill packs load lazily: selecting `multica-dingtalk` installs `dingtalk-agent-deploy` and `dingtalk-agent-boot-multica`; they are no longer implied by the default install. Platform-specific methodology ships in these packs, not in the CLI.
+- `deploy`, `promote`, and `observe` now pass a fail-closed platform-membership gate; missing, unknown, or coming-soon platforms are rejected with guidance.
+- Contract case 61 covers the registry, the gate, the coming-soon rejection, membership writing, and lazy skill installation; `agent-platform@1` schema added and `project@1` gains the optional `agentPlatform` field.
+
+### Changed
+
+- `dta skill install|status|upgrade|uninstall` without a name now operate on all default bundled Skills (basic-behavior + compose) with a `skill-status-suite@1` JSON envelope; an explicit name keeps the single-skill contract. `setup` installs the full default suite and `doctor` aggregates per-client discovery across it.
+- The compose Skill (0.5.1) names 创建/新建/装配 Agent triggers and drops its placeholder wording, so "帮我创建一个 Agent" reaches it on OpenCode and other hosts.
+- Isolated-HOME eval and release environments strip host `CLAUDE_*` variables so the upstream skills CLI cannot escape the sandbox into the real Claude config directory.
+- Unknown-command suggestions now include `lab`, `listen`, `deploy`, `promote`, `observe`, and `agent-platform`.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag, a Git tag, and a GitHub pre-release. No robot, webhook, schedule, Trigger, or DingTalk/Multica side effect is created. The Live waivers recorded for beta.9 remain unchanged.
+
+## 0.1.4-beta.10 - 2026-07-19
+
+### Removed
+
+- Legacy pre-kernel modules `src/boot.ts`, `src/duty.ts`, `src/kb.ts`, `src/runs.ts` and the unused `templates/ontology/` tree. They were dead code outside the current CLI, were already excluded from the published package, and `runs.ts` conflicted with the documented "Markdown is not a lock, idempotency store, or Receipt" boundary.
+- The `kb`/`duties`/`eval` fields from the default AgentConfig. Existing workspace configs keep unknown fields through passthrough normalization; no migration is required.
+
+### Changed
+
+- Entry documents now match repository reality: CLAUDE.md gains run-mode criteria, the eval-Skill reading path, and an annotated command list; README lists all five bundled Skills; the English README is marked as a condensed overview; SECURITY.md states the actually maintained dist-tag; the eval Skill's L1 wording matches the real `dta lab eval` plan/`--execute --yes` flow (Skill 0.5.1).
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag. No robot, webhook, schedule, Trigger, or DingTalk/Multica side effect is created. The Live waivers recorded for beta.9 remain unchanged.
+
 ## 0.1.4-beta.9 - 2026-07-19
 
 ### Added