@xdxer/dingtalk-agent 0.1.5-beta.1 → 0.1.5-beta.10

package/dist/src/multica-deploy.js

@@ -3,11 +3,10 @@ import { spawnSync } from 'node:child_process';
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join, relative, resolve } from 'node:path';
-import { WORKSPACE_STATE_ROOT, inspectAgentProject, showDevelopmentWorkspace, } from './development-workspace.js';
+import { WORKSPACE_STATE_ROOT, inspectAgentProject, projectSkillRef, showDevelopmentWorkspace, } from './development-workspace.js';
 import { digest, stableStringify } from './events.js';
-import { MULTICA_BOOT_SKILL, MULTICA_EVIDENCE_ROOT, inspectMulticaWorkspace, planMulticaWorkspace, statusMulticaWorkspace, } from './multica-provider.js';
-import { resolvePackageRoot } from './package-root.js';
-import { bundledSkillPath } from './skill-manager.js';
+import { MULTICA_EVIDENCE_ROOT, emitProviderDiagnostic, inspectMulticaWorkspace, planMulticaWorkspace, sanitizeProviderEnv, statusMulticaWorkspace, } from './multica-provider.js';
+import { allRuntimeVocabularies, commandInvokesDws, forbiddenSmokeTool, skillsLoadedInContent, vocabulariesForRuntimeProvider, } from './multica-runtime-vocabulary.js';
 export const MULTICA_DEPLOYMENT_SCHEMA = 'dingtalk-agent/multica-deployment-receipt@1';
 const MAX_DEPLOY_SKILLS = 32;
 const MAX_SKILL_SUPPORTING_FILES = 128;
@@ -15,14 +14,293 @@ const deploymentWriteBudgets = new WeakMap();
 class DeploymentFailure extends Error {
     category;
     ambiguous;
-    constructor(category, ambiguous = false) {
+    detail;
+    constructor(category, ambiguous = false, detail) {
         super(category);
         this.category = category;
         this.ambiguous = ambiguous;
+        this.detail = detail;
     }
 }
+export function runMulticaWorkspaceIssue(start, name, prompt, options = {}) {
+    const normalizedPrompt = prompt.trim();
+    if (!normalizedPrompt)
+        throw new Error('workspace run prompt 不能为空');
+    if (Buffer.byteLength(normalizedPrompt, 'utf8') > 64 * 1024) {
+        throw new Error('workspace run prompt 不能超过 65536 bytes');
+    }
+    rejectCredentialMaterial(normalizedPrompt, 'workspace run prompt');
+    const env = options.env || process.env;
+    const cliVersion = options.cliVersion || '';
+    const info = inspectAgentProject(start, cliVersion);
+    requireMulticaWorkspace(info.root, name, cliVersion);
+    const providerPlan = planMulticaWorkspace(info.root, name, { env, cliVersion });
+    const blocking = [...providerPlan.blocking];
+    if (!providerPlan.expected.agentId)
+        blocking.push('agent-id.missing');
+    const plan = {
+        $schema: 'dingtalk-agent/multica-workspace-run-plan@1',
+        workspace: name,
+        provider: 'multica',
+        profile: providerPlan.profile,
+        workspaceId: providerPlan.expected.workspaceId,
+        runtimeId: providerPlan.expected.runtimeId,
+        agentId: providerPlan.expected.agentId,
+        promptHash: sha256(normalizedPrompt),
+        operations: ['scope.inspect', 'issue.create', 'issue.runs', 'issue.run-messages', 'evidence.persist'],
+        blocking: [...new Set(blocking)].sort(),
+        requiresExecute: true,
+        requiresExplicitYes: true,
+        remoteRead: false,
+        remoteWrite: false,
+        triggerWrite: false,
+        sideEffect: false,
+        dingtalkSideEffect: false,
+    };
+    if (!options.execute)
+        return plan;
+    if (!options.yes) {
+        throw new Error('Multica workspace run 会创建远端 Issue；必须同时传 --execute --yes');
+    }
+    if (plan.blocking.length) {
+        throw new Error(`Multica workspace run 前置条件不完整: ${plan.blocking.join(', ')}`);
+    }
+    const command = options.command || env.DTA_MULTICA_BIN || 'multica';
+    // A real Issue-channel run does agent work plus issue get/comment/status side-tasks and
+    // routinely needs minutes; the old 30s default timed out on almost every honest run. Wait
+    // 4 minutes by default (still capped at 5). A run that overruns is resumable via
+    // `workspace run --status --run-id` against the same Issue — no duplicate Issue.
+    const timeoutMs = positiveTimeout(options.timeoutMs, 240_000, 300_000);
+    const calls = [];
+    const inspection = inspectMulticaWorkspace(info.root, name, {
+        execute: true, yes: true, persist: false, command, env,
+        timeoutMs: Math.min(timeoutMs, 30_000), cliVersion,
+    });
+    appendInspectionCalls(inspection, 'run.preflight', calls);
+    const assignedSkills = inspection.resources.assignedSkills
+        .filter((item) => item.enabled).map((item) => item.name).sort();
+    const expectedSkills = [...providerPlan.expected.skills].sort();
+    if (!inspection.passed || inspection.resources.workspace?.id !== plan.workspaceId ||
+        inspection.resources.runtime?.id !== plan.runtimeId ||
+        inspection.resources.agent?.id !== plan.agentId ||
+        inspection.diff.includes('agent.runtime-drift') ||
+        stableStringify(assignedSkills) !== stableStringify(expectedSkills)) {
+        throw new Error('Multica workspace run scope 或 Skill assignment 与 Project 不一致；未创建 Issue');
+    }
+    const runId = `multica_workspace_run_${Date.now()}_${randomUUID().slice(0, 8)}`;
+    const marker = `DTA-WORKSPACE-RUN-${randomUUID()}`;
+    const issue = jsonObject(runProvider(command, scopedArgs({ profile: plan.profile, expected: { workspaceId: plan.workspaceId } }, [
+        'issue', 'create', '--title', `[DTA workspace run] ${marker}`,
+        '--description', normalizedPrompt, '--assignee-id', plan.agentId, '--output', 'json',
+    ]), 'workspace-run.issue.create', 'write', info.root, env, Math.min(timeoutMs, 30_000), calls).stdout, 'workspace run issue');
+    const issueId = resourceId(issue.id, 'workspace run issue.id');
+    return readbackWorkspaceRun({
+        root: info.root, name, plan, issueId, runId, command, env, timeoutMs, calls, out: options.out,
+        runtimeProvider: inspection.resources.runtime?.provider || '',
+    });
+}
+/**
+ * Poll an existing Issue's assignee-agent task to a terminal state, then reconstruct the
+ * run report from its trace. Shared by the initial `workspace run` (right after it creates the
+ * Issue) and `workspace run --status --run-id` (resume against the SAME Issue, no new write) so
+ * a timed-out run reconciles instead of spawning a duplicate Issue.
+ */
+function readbackWorkspaceRun(ctx) {
+    const { root, name, plan, issueId, runId, command, env, timeoutMs, calls } = ctx;
+    const started = Date.now();
+    const pollIntervalMs = 2_000;
+    const pollCalls = [];
+    let pollAttempts = 0;
+    let task;
+    while (Date.now() - started < timeoutMs) {
+        pollAttempts += 1;
+        const runs = jsonArray(runProvider(command, scopedArgs({ profile: plan.profile, expected: { workspaceId: plan.workspaceId } }, [
+            'issue', 'runs', issueId, '--full-id', '--output', 'json',
+        ]), 'workspace-run.issue.runs', 'read', root, env, Math.min(timeoutMs, 30_000), pollCalls).stdout, 'workspace run issue runs');
+        task = runs.filter((item) => !optionalString(item.agent_id) ||
+            optionalString(item.agent_id) === plan.agentId)
+            .sort((a, b) => optionalString(b.created_at).localeCompare(optionalString(a.created_at)))[0];
+        const status = optionalString(task?.status);
+        if (['completed', 'failed', 'cancelled'].includes(status))
+            break;
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, pollIntervalMs);
+    }
+    calls.push(...uniqueCalls(pollCalls));
+    const taskId = task?.id ? resourceId(task.id, 'workspace run task.id') : '';
+    const taskStatus = optionalString(task?.status) || 'not-created';
+    let messages = [];
+    if (taskId && ['completed', 'failed', 'cancelled'].includes(taskStatus)) {
+        messages = jsonArray(runProvider(command, scopedArgs({ profile: plan.profile, expected: { workspaceId: plan.workspaceId } }, [
+            'issue', 'run-messages', taskId, '--issue', issueId, '--output', 'json',
+        ]), 'workspace-run.issue.messages', 'read', root, env, Math.min(timeoutMs, 30_000), calls).stdout, 'workspace run messages');
+    }
+    const toolUses = messages.filter((item) => optionalString(item.type) === 'tool_use');
+    const toolNames = toolUses.map((item) => optionalString(item.tool)).filter(Boolean);
+    // Skill 装载与文件写入按 runtime 词汇解读（并集），并叠加 tool_result 的
+    // `**Skill loaded**` 正向证据 —— 与 smoke 判定同一套词汇，不再假定工具名叫 skill。
+    const vocabularies = ctx.runtimeProvider
+        ? vocabulariesForRuntimeProvider(ctx.runtimeProvider) : [];
+    const active = vocabularies.length
+        ? vocabularies : allRuntimeVocabularies();
+    const loadedSet = new Set();
+    const runBannerTools = new Set(active.flatMap((item) => [...item.skillResultTools]));
+    for (const item of messages) {
+        const type = optionalString(item.type);
+        const tool = optionalString(item.tool);
+        if (type === 'tool_use') {
+            const message = { tool, input: smokeToolInput(item) };
+            for (const vocabulary of active) {
+                const name = vocabulary.skillLoadFromToolUse(message);
+                if (name)
+                    loadedSet.add(name);
+            }
+        }
+        else if (type === 'tool_result' && runBannerTools.has(tool)) {
+            for (const name of skillsLoadedInContent(optionalString(item.content)))
+                loadedSet.add(name);
+        }
+    }
+    const loadedSkills = [...loadedSet].sort();
+    const texts = messages.filter((item) => optionalString(item.type) === 'text')
+        .map((item) => optionalString(item.content)).filter(Boolean);
+    const replyWrites = toolUses.flatMap((item) => {
+        const message = {
+            tool: optionalString(item.tool), input: smokeToolInput(item),
+        };
+        return active.map((vocabulary) => vocabulary.writeEvidence(message))
+            .filter((write) => Boolean(write))
+            // 裸文件名与 ./、绝对路径等价（平台常见写法，与 smoke 白名单同一课）。
+            .filter((write) => write.path === 'reply.md' || write.path.endsWith('/reply.md'))
+            .map((write) => write.content);
+    }).filter(Boolean);
+    const answer = safeRemoteOutput(replyWrites.at(-1) || texts.at(-1) || '', 64 * 1024);
+    const issueReadback = jsonObject(runProvider(command, scopedArgs({ profile: plan.profile, expected: { workspaceId: plan.workspaceId } }, [
+        'issue', 'get', issueId, '--output', 'json',
+    ]), 'workspace-run.issue.readback', 'read', root, env, Math.min(timeoutMs, 30_000), calls).stdout, 'workspace run issue readback');
+    const issueStatus = optionalString(issueReadback.status);
+    const failures = [];
+    if (!task)
+        failures.push('task.not-created');
+    else if (!['completed', 'failed', 'cancelled'].includes(taskStatus))
+        failures.push('task.timeout');
+    else if (taskStatus !== 'completed')
+        failures.push(`task.${taskStatus}`);
+    if (!answer)
+        failures.push('answer.missing');
+    const taskDiagnostic = task
+        ? remoteTaskDiagnostic(task)
+        : `未发现关联 task；Issue 状态=${issueStatus || 'unknown'}，已轮询 ${pollAttempts} 次`;
+    const report = {
+        $schema: 'dingtalk-agent/multica-workspace-run@1',
+        passed: failures.length === 0,
+        runId,
+        workspace: name,
+        provider: 'multica',
+        profile: plan.profile,
+        workspaceId: plan.workspaceId,
+        runtimeId: plan.runtimeId,
+        agentId: plan.agentId,
+        promptHash: plan.promptHash,
+        issueId,
+        issueStatus,
+        taskId,
+        taskStatus,
+        taskDiagnostic,
+        pollAttempts,
+        pollIntervalMs,
+        answer,
+        answerHash: sha256(answer),
+        toolNames,
+        loadedSkills,
+        failures,
+        calls,
+        evidencePath: '',
+        remoteRead: true,
+        remoteWrite: calls.some((call) => call.kind === 'write'),
+        triggerWrite: false,
+        sideEffect: 'multica-issue-read-write',
+        dingtalkSideEffect: false,
+    };
+    const defaultEvidence = join(MULTICA_EVIDENCE_ROOT, safeName(name), 'multica-runs', `${runId}.json`);
+    report.evidencePath = relative(root, safeProjectPath(root, ctx.out || defaultEvidence, false));
+    assertReportRedacted(report);
+    atomicJson(safeProjectPath(root, report.evidencePath, false), report);
+    return report;
+}
+/**
+ * Resume a `workspace run` by re-reading the SAME Issue's task instead of creating a new one.
+ * Loads the persisted run evidence by runId, confirms the workspace scope still resolves to the
+ * same target (fail closed on drift), then polls that Issue's assignee-agent task to a terminal
+ * state and rewrites the run report. Read-only against Multica — never enqueues a second Issue.
+ */
+export function statusMulticaWorkspaceRun(start, name, options = {}) {
+    const env = options.env || process.env;
+    const cliVersion = options.cliVersion || '';
+    const runId = String(options.runId || '').trim();
+    if (!/^multica_workspace_run_[0-9]+_[a-f0-9]{8}$/.test(runId)) {
+        throw new Error('workspace run --status 需要一个合法的 --run-id（来自上次 run 的 runId）');
+    }
+    if (!options.execute) {
+        throw new Error('workspace run --status 会向 Multica 独立回读同一 Issue；必须传 --execute');
+    }
+    if (!options.yes)
+        throw new Error('workspace run --status 远端回读必须同时传 --execute --yes');
+    const info = inspectAgentProject(start, cliVersion);
+    requireMulticaWorkspace(info.root, name, cliVersion);
+    // The original run persists evidence to `--out` when given, else the default runId path. Resume
+    // must look where the run actually wrote, so honor the same `--out` (and rewrite back to it).
+    const evidenceRel = options.out || join(MULTICA_EVIDENCE_ROOT, safeName(name), 'multica-runs', `${runId}.json`);
+    const evidenceAbs = safeProjectPath(info.root, evidenceRel, false);
+    if (!existsSync(evidenceAbs)) {
+        throw new Error(`找不到 run 证据 ${evidenceRel}；--run-id 必须是本 Workspace 已有的 runId` +
+            `${options.out ? '' : '（若原 run 用了 --out，请对 --status 传相同 --out）'}`);
+    }
+    const prior = JSON.parse(readFileSync(evidenceAbs, 'utf8'));
+    if (prior.$schema !== 'dingtalk-agent/multica-workspace-run@1' ||
+        prior.provider !== 'multica' || prior.workspace !== name || !prior.issueId) {
+        throw new Error('run 证据不是本 Workspace 的 multica run，或缺少 issueId；已 fail closed');
+    }
+    // The evidence file must belong to THIS runId. Two runs sharing one --out overwrite each
+    // other, so resuming the first runId against that path would otherwise read the second run's
+    // Issue while reporting the first runId — cross-wiring answer and run. Fail closed on mismatch.
+    if (prior.runId !== runId) {
+        throw new Error(`run 证据 ${evidenceRel} 属于 runId ${prior.runId}，与 --run-id ${runId} 不一致；已 fail closed` +
+            `（同一 --out 被后一次 run 覆盖时会这样）`);
+    }
+    // Re-resolve scope offline and refuse unless the WHOLE frozen target still matches: an env
+    // pointing at a different runtime/agent/profile (or an invalid ref surfacing in blocking) must
+    // not let the resume mis-record the old task or overwrite the frozen values. workspaceId alone
+    // is not enough.
+    const providerPlan = planMulticaWorkspace(info.root, name, { env, cliVersion });
+    const scopeDrift = providerPlan.blocking.length ? ['blocking:' + providerPlan.blocking.join(',')] : [];
+    if (providerPlan.profile !== prior.profile)
+        scopeDrift.push('profile');
+    if (providerPlan.expected.workspaceId !== prior.workspaceId)
+        scopeDrift.push('workspace');
+    if (providerPlan.expected.runtimeId !== prior.runtimeId)
+        scopeDrift.push('runtime');
+    if (providerPlan.expected.agentId !== prior.agentId)
+        scopeDrift.push('agent');
+    if (scopeDrift.length) {
+        throw new Error(`workspace run --status: 当前 workspace scope 与 run 证据不一致 [${scopeDrift.join(', ')}]；已 fail closed`);
+    }
+    const command = options.command || env.DTA_MULTICA_BIN || 'multica';
+    const timeoutMs = positiveTimeout(options.timeoutMs, 240_000, 300_000);
+    const plan = {
+        profile: providerPlan.profile,
+        workspaceId: providerPlan.expected.workspaceId,
+        runtimeId: providerPlan.expected.runtimeId,
+        agentId: providerPlan.expected.agentId,
+        promptHash: prior.promptHash,
+    };
+    return readbackWorkspaceRun({
+        root: info.root, name, plan, issueId: prior.issueId, runId,
+        command, env, timeoutMs, calls: [], out: options.out,
+    });
+}
 export function planMulticaDeployment(start, name, options = {}) {
     const action = options.action || 'apply';
+    const rebindRuntime = Boolean(options.rebindRuntime) && action === 'apply';
     const env = options.env || process.env;
     const cliVersion = options.cliVersion || '';
     const info = inspectAgentProject(start, cliVersion);
@@ -31,12 +309,21 @@ export function planMulticaDeployment(start, name, options = {}) {
     const readPlan = planMulticaWorkspace(info.root, name, { env, cliVersion });
     const blocking = [...readPlan.blocking];
     let inspectionId = '';
+    let previousRuntimeId = '';
     try {
         const status = statusMulticaWorkspace(info.root, name, cliVersion);
         inspectionId = status.inspectionId;
         if (!status.readyForApply || !status.evidenceIntegrity || !status.stateMatched) {
             blocking.push(...status.failures.map((item) => `inspection.${item}`));
         }
+        // Runtime 归属漂移只挡「普通 apply」：没有显式 --rebind-runtime 时不允许悄悄把
+        // Agent 搬到新 runtime。retire 是收敛动作，不受漂移阻挡（否则 deploy 与 retire
+        // 会被同一把锁一起锁死）。
+        if (status.diff.includes('agent.runtime-drift')) {
+            previousRuntimeId = status.observedAgentRuntimeId || '';
+            if (action === 'apply' && !rebindRuntime)
+                blocking.push('agent.runtime-drift');
+        }
     }
     catch {
         blocking.push('inspection.invalid');
@@ -45,26 +332,30 @@ export function planMulticaDeployment(start, name, options = {}) {
         blocking.push('inspection.missing');
     if (action === 'retire' && !readPlan.expected.agentId)
         blocking.push('agent-id.missing');
+    if (rebindRuntime && !readPlan.expected.agentId)
+        blocking.push('rebind.agent-id-missing');
     const expectedSkills = source.skills.map((skill) => ({
         name: skill.name, hash: skill.hash, files: skill.files.length + 1,
     }));
     const operations = action === 'retire'
         ? ['scope.reinspect', 'agent.archive', 'agent.readback', 'receipt.persist']
         : [
-            'scope.reinspect', 'skills.readback', 'skills.reconcile', 'agent.reconcile',
+            'scope.reinspect', 'skills.readback', 'skills.reconcile',
+            ...(rebindRuntime ? ['agent.rebind-runtime'] : []), 'agent.reconcile',
             'skills.assign-exact', 'provider.readback', 'load-smoke.create',
-            'load-smoke.readback', 'receipt.persist',
+            'load-smoke.recover-if-unstarted', 'load-smoke.readback', 'receipt.persist',
         ];
     const writeBudget = action === 'retire'
         ? { forward: 1, rollback: 0 }
         : {
-            forward: source.skills.length * (1 + MAX_SKILL_SUPPORTING_FILES * 2) + 4,
+            // +3 on top of the base 5: bounded skills-not-visible smoke retries (cold sandbox).
+            forward: source.skills.length * (1 + MAX_SKILL_SUPPORTING_FILES * 2) + 8,
             rollback: source.skills.length * (1 + MAX_SKILL_SUPPORTING_FILES * 2) + 3,
         };
     const planId = `multica_deploy_plan_${digest(stableStringify({
         action, workspace: name, profile: readPlan.profile, inspectionId,
         desiredHash: workspace.desiredHash, deploymentHash: source.deploymentHash,
-        expected: readPlan.expected, operations, writeBudget,
+        expected: readPlan.expected, operations, writeBudget, rebindRuntime, previousRuntimeId,
         blocking: [...new Set(blocking)].sort(),
     })).slice(0, 24)}`;
     return {
@@ -85,7 +376,9 @@ export function planMulticaDeployment(start, name, options = {}) {
             skills: expectedSkills,
             definitionHash: source.definitionHash,
             instructionsHash: source.instructionsHash,
+            ...(rebindRuntime ? { previousRuntimeId } : {}),
         },
+        rebindRuntime,
         operations,
         writeBudget,
         blocking: [...new Set(blocking)].sort(),
@@ -106,9 +399,12 @@ export function applyMulticaDeployment(start, name, options = {}, action = 'appl
         throw new Error('dta deploy 必须传 dry-run 返回的 --plan-id');
     const env = options.env || process.env;
     const cliVersion = options.cliVersion || '';
-    const plan = planMulticaDeployment(start, name, { action, env, cliVersion });
+    const rebindRuntime = Boolean(options.rebindRuntime) && action === 'apply';
+    const plan = planMulticaDeployment(start, name, { action, env, cliVersion, rebindRuntime });
     if (options.planId !== plan.planId) {
-        throw new Error(`deploy plan 已失效；期望当前 planId ${plan.planId}`);
+        throw new Error(`deploy plan 已失效；期望当前 planId ${plan.planId}。` +
+            'plan 对中间状态敏感：dry-run 之后、apply 之前不要插入 workspace inspect 等操作；' +
+            '重跑 --dry-run 取新 planId 后立即 apply');
     }
     if (plan.blocking.length)
         throw new Error(`deploy 前置条件不完整: ${plan.blocking.join(', ')}`);
@@ -126,7 +422,12 @@ export function applyMulticaDeployment(start, name, options = {}, action = 'appl
         preflight.profile !== plan.profile ||
         preflight.expected.workspaceId !== plan.expected.workspaceId ||
         preflight.expected.runtimeId !== plan.expected.runtimeId) {
-        throw new Error('deploy scope/readback 与冻结 plan 不一致；未执行任何远端写入');
+        throw new Error('deploy scope/readback 与冻结 plan 不一致；未执行任何远端写入' +
+            '（dry-run 与 apply 之间若插入过 inspect 或远端有变化，重跑 --dry-run 后立即 apply）');
+    }
+    if (action === 'apply' && !rebindRuntime && preflight.diff.includes('agent.runtime-drift')) {
+        throw new Error('deploy 前置条件不完整: agent.runtime-drift' +
+            '（Agent 当前绑定在其他 runtime；显式迁移用 --rebind-runtime，退役用 --retire）');
     }
     appendInspectionCalls(preflight, 'preflight', calls);
     const operationId = `multica_operation_${Date.now()}_${randomUUID().slice(0, 12)}`;
@@ -144,7 +445,7 @@ export function applyMulticaDeployment(start, name, options = {}, action = 'appl
             receipt = retireDeployment(info.root, workspace, source, plan, preflight, operation, command, env, timeoutMs, calls);
         }
         else {
-            receipt = executeApply(info.root, workspace, source, plan, preflight, operation, command, env, timeoutMs, positiveTimeout(options.smokeTimeoutMs, 30_000, 60_000), Boolean(options.noWait), calls, rollback, temp);
+            receipt = executeApply(info.root, workspace, source, plan, preflight, operation, command, env, timeoutMs, positiveTimeout(options.smokeTimeoutMs, 30_000, 300_000), Boolean(options.noWait), calls, rollback, temp);
         }
     }
     catch (error) {
@@ -159,7 +460,7 @@ export function applyMulticaDeployment(start, name, options = {}, action = 'appl
         operation.calls = calls;
         operation.failures = [failure.category, ...rollbackReport.failures];
         operation.updatedAt = new Date().toISOString();
-        receipt = failureReceipt(info.root, workspace, source, plan, preflight, operation, calls, rollbackReport, status, failure.category);
+        receipt = failureReceipt(info.root, workspace, source, plan, preflight, operation, calls, rollbackReport, status, failure.category, failure.detail);
     }
     finally {
         rmSync(temp, { recursive: true, force: true });
@@ -187,6 +488,7 @@ function executeApply(root, workspace, source, plan, preflight, operation, comma
             calls: [...calls],
             agent: { ...previous.agent, action: 'noop' },
             skills: previous.skills.map((skill) => ({ ...skill, action: 'noop' })),
+            failureDetails: Array.isArray(previous.failureDetails) ? previous.failureDetails : [],
             evidencePath: receiptRelativePath(workspace.name, receiptId),
             remoteWrite: false,
             sideEffect: 'multica-read',
@@ -235,9 +537,12 @@ function executeApply(root, workspace, source, plan, preflight, operation, comma
         throw new DeploymentFailure('readback.deployment-mismatch');
     }
     const observedHash = deploymentObservedHash(finalSnapshot, readback.inspectionId);
-    const smoke = createAndReadSmoke(root, plan, source, agentId, command, env, timeoutMs, smokeTimeoutMs, noWait, calls);
+    const smoke = createAndReadSmoke(root, plan, source, agentId, readback.resources.runtime?.provider || '', command, env, timeoutMs, smokeTimeoutMs, noWait, calls);
+    // skills-not-visible 是冷沙箱竞态（推送的 Skill 尚未物化），不是真实部署失败：落
+    // verifying 而非 failed，避免把一次正常部署误判成失败、把人推去改本体换模板。
     const status = smoke.status === 'passed'
-        ? 'ready' : smoke.status === 'pending' ? 'verifying' : 'failed';
+        ? 'ready' : smoke.status === 'pending' ? 'verifying'
+        : smoke.classification === 'skills-not-visible' ? 'verifying' : 'failed';
     const receiptId = `multica_receipt_${digest(stableStringify({
         operationId: operation.operationId, planId: plan.planId, observedHash,
         smoke: { markerHash: smoke.markerHash, issueId: smoke.issueId, taskId: smoke.taskId },
@@ -274,6 +579,13 @@ function executeApply(root, workspace, source, plan, preflight, operation, comma
         smoke,
         rollback: emptyRollback(false),
         failures: [...smoke.failures],
+        failureDetails: [...smoke.failureDetails],
+        ...(plan.rebindRuntime && plan.expected.previousRuntimeId ? {
+            rebind: {
+                fromRuntimeId: plan.expected.previousRuntimeId,
+                toRuntimeId: plan.expected.runtimeId,
+            },
+        } : {}),
         evidencePath: receiptRelativePath(workspace.name, receiptId),
         remoteRead: true,
         remoteWrite: calls.some((call) => call.kind === 'write'),
@@ -328,6 +640,7 @@ function retireDeployment(root, workspace, source, plan, preflight, operation, c
         smoke: emptySmoke('not-run', source.skills.map((item) => item.name)),
         rollback: emptyRollback(false),
         failures: [],
+        failureDetails: [],
         evidencePath: receiptRelativePath(workspace.name, receiptId),
         remoteRead: true,
         remoteWrite: calls.some((call) => call.kind === 'write'),
@@ -344,15 +657,9 @@ function loadDeploymentSource(root) {
     const definitionHash = sha256(definition);
     const skillRoots = [];
     for (const name of info.project.skills) {
-        const ref = name === 'dingtalk-basic-behavior'
-            ? `.agents/skills/${name}` : `skills/${name}`;
+        const ref = projectSkillRef(info.project, name);
         skillRoots.push({ name, root: safeProjectPath(root, ref, true) });
     }
-    const packageRoot = resolvePackageRoot(import.meta.url);
-    skillRoots.push({
-        name: MULTICA_BOOT_SKILL,
-        root: safeExternalSkillRoot(bundledSkillPath(packageRoot, MULTICA_BOOT_SKILL)),
-    });
     if (skillRoots.length > MAX_DEPLOY_SKILLS) {
         throw new Error(`Multica deploy 最多支持 ${MAX_DEPLOY_SKILLS} 个受管 Skills`);
     }
@@ -361,26 +668,17 @@ function loadDeploymentSource(root) {
     if (new Set(skills.map((item) => item.name)).size !== skills.length) {
         throw new Error('Multica deploy required Skills 不能重名');
     }
-    const required = skills.map((item) => ({ name: item.name, sha256: item.hash }));
-    const deploymentSourceHash = digest(stableStringify({ definitionHash, required }));
-    const instructions = [
-        '<!-- DTA Multica Boot: managed; do not edit remotely -->',
-        `definition_sha256=${definitionHash}`,
-        `deployment_sha256=${deploymentSourceHash}`,
-        `required_skills=${JSON.stringify(required)}`,
-        'Before every task, use dingtalk-agent-boot-multica and follow its startup order.',
-        'Never create a robot, webhook, autopilot, schedule, or other Trigger as part of deployment.',
-        '<!-- /DTA Multica Boot -->',
-        '',
-        definition.trimEnd(),
-        '',
-    ].join('\n');
+    // Agent instructions are the human-authored Definition, byte for byte. Deployment
+    // hashes and the managed Skill set belong to the control plane and its Receipt;
+    // injecting them into the System Prompt makes the role unreadable and creates a
+    // second runtime protocol beside the Host's native Skill assignment.
+    const instructions = definition;
     const instructionsHash = sha256(instructions);
     const deploymentHash = digest(stableStringify({
         definitionHash, instructionsHash,
         skills: skills.map((item) => ({ name: item.name, hash: item.hash })),
     }));
-    return { definition, definitionHash, instructions, instructionsHash, skills, deploymentHash };
+    return { definitionHash, instructions, instructionsHash, skills, deploymentHash };
 }
 function loadSkillBundle(name, root) {
     const actual = realpathSync(root);
@@ -557,73 +855,277 @@ function upsertSkillFile(root, plan, skillId, path, contentFile, command, env, t
         '--content-file', contentFile, '--output', 'json',
     ]), `skill.file.upsert:${path}`, 'write', root, env, timeoutMs, calls);
 }
-function createAndReadSmoke(root, plan, source, agentId, command, env, timeoutMs, smokeTimeoutMs, noWait, calls) {
+function createAndReadSmoke(root, plan, source, agentId, runtimeProvider, command, env, timeoutMs, smokeTimeoutMs, noWait, calls) {
     const marker = `DTA-MULTICA-LOAD-${randomUUID()}`;
     const requiredSkills = source.skills.map((item) => item.name).sort();
+    const expectedResponse = JSON.stringify({
+        schema: 'dta-multica-load-smoke@1', marker, loaded: requiredSkills,
+    });
     const issue = jsonObject(runProvider(command, scopedArgs(plan, [
         'issue', 'create', '--title', `[DTA load smoke] ${marker}`,
         '--description', [
             'DTA_MULTICA_LOAD_SMOKE@1', `marker=${marker}`,
-            'Use only the trusted DTA Multica Boot required_skills list.',
-            'Do not call DWS, Shell, network, or write tools.',
+            `required_skills=${JSON.stringify(requiredSkills)}`,
+            'This is a deployment control-plane verification task.',
+            'Load every required skill above through the Host skill mechanism, in the listed order.',
+            'Do not call DWS, network, or business tools. Only the Host Issue control-plane calls needed to read this Issue and persist the exact result are exempt.',
+            `Post exactly this JSON as an Issue comment (and nothing else): ${expectedResponse}`,
         ].join('\n'),
         '--assignee-id', agentId, '--output', 'json',
     ]), 'smoke.issue.create', 'write', root, env, timeoutMs, calls).stdout, 'smoke issue');
     const issueId = resourceId(issue.id, 'smoke issue.id');
+    const read = () => readSmoke(root, plan, marker, issueId, agentId, requiredSkills, runtimeProvider, command, env, timeoutMs, calls);
+    let smoke = read();
+    // Multica persists the Issue before attempting the initial agent enqueue. If
+    // that enqueue loses a transient readiness race, the API still returns a
+    // valid assigned todo Issue but issue runs remains empty forever. Recover
+    // exactly that observable state once through an explicit ID-bound mention on
+    // the same Issue. A visible task — queued, running or terminal — is never
+    // duplicated. The mention route is used instead of issue rerun because it is
+    // the platform's normal first-run trigger and does not require a prior task.
+    if (smoke.status === 'pending' && !smoke.taskId) {
+        try {
+            runProvider(command, scopedArgs(plan, [
+                'issue', 'comment', 'add', issueId,
+                '--content', `[@DTA load smoke](mention://agent/${agentId}) Execute the deployment verification exactly as specified in this Issue description.`,
+                '--output', 'json',
+            ]), 'smoke.issue.recover', 'write', root, env, timeoutMs, calls);
+            smoke = read();
+        }
+        catch {
+            // 与重试 mention 同一不变量：部署本体已回读验证，一次评论写入的抖动只让 smoke
+            // 停在 pending（收敛为 verifying，由 --status 收口），不允许升级为回滚。
+        }
+    }
     if (noWait)
-        return readSmoke(root, plan, marker, issueId, agentId, requiredSkills, command, env, timeoutMs, calls);
+        return smoke;
     const started = Date.now();
-    let smoke = readSmoke(root, plan, marker, issueId, agentId, requiredSkills, command, env, timeoutMs, calls);
-    while (smoke.status === 'pending' && Date.now() - started < smokeTimeoutMs) {
-        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 250);
-        smoke = readSmoke(root, plan, marker, issueId, agentId, requiredSkills, command, env, timeoutMs, calls);
+    const pollToTerminal = () => {
+        while (smoke.status === 'pending' && Date.now() - started < smokeTimeoutMs) {
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2_000);
+            smoke = read();
+        }
+    };
+    pollToTerminal();
+    // 冷沙箱竞态：推送的 Skill 要数分钟才对运行时可见，任务报 `Skill not found` 不是
+    // 真失败。在预算内用 mention 触发新 task（新沙箱有机会看到新 Skill），有限次重试。
+    // 默认 30s 预算下基本轮不到重试；--wait / --smoke-timeout 放宽后才生效。
+    const retryDelayMs = Math.min(20_000, Math.max(500, Math.floor(smokeTimeoutMs / 12)));
+    let retries = 0;
+    while (smoke.status === 'failed' && smoke.classification === 'skills-not-visible' &&
+        retries < 3 && Date.now() - started < smokeTimeoutMs) {
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, retryDelayMs);
+        try {
+            runProvider(command, scopedArgs(plan, [
+                'issue', 'comment', 'add', issueId,
+                '--content', `[@DTA load smoke](mention://agent/${agentId}) Skills were not yet visible in the sandbox; re-run the deployment verification exactly as specified in this Issue description.`,
+                '--output', 'json',
+            ]), 'smoke.issue.retry', 'write', root, env, timeoutMs, calls);
+        }
+        catch {
+            // 一次评论写入的抖动不允许升级为对已验证部署的回滚：失败已记入 calls，
+            // 停止重试并保持当前 smoke 判定（skills-not-visible → verifying）。
+            break;
+        }
+        retries += 1;
+        // mention 触发的新 run 在平台上是异步创建的：只有当最新 run 的 taskId 变化后
+        // 才重新判定；等不到新 run 就停手——绝不因为还读到旧终态 run 而重复 mention。
+        const staleTaskId = smoke.taskId;
+        let sawNewRun = false;
+        while (Date.now() - started < smokeTimeoutMs) {
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2_000);
+            smoke = read();
+            if (smoke.taskId && smoke.taskId !== staleTaskId) {
+                sawNewRun = true;
+                break;
+            }
+        }
+        if (!sawNewRun)
+            break;
+        pollToTerminal();
+    }
+    if (smoke.status === 'pending' && !smoke.taskDiagnostic) {
+        const detail = smoke.taskId
+            ? `task ${smoke.taskId} 在 ${smokeTimeoutMs}ms 内未进入终态（当前 ${smoke.taskStatus || 'unknown'}）`
+            : `Issue ${issueId} 在 ${smokeTimeoutMs}ms 内未创建关联 task`;
+        return { ...smoke, taskDiagnostic: detail };
     }
     return smoke;
 }
-function readSmoke(root, plan, marker, issueId, agentId, requiredSkills, command, env, timeoutMs, calls) {
+/**
+ * Judge a smoke run from positive evidence instead of a tool-name whitelist. The old judge
+ * required every tool_use to match hardcoded `skill`/`write`/`bash` shapes, so a healthy
+ * cloud runtime emitting `read_file`/`terminal` could never reach ready — and one extra
+ * harmless tool failed the whole trace. Now: each required skill needs load evidence
+ * (vocabulary tool_use or host-generated `**Skill loaded**` tool_result), the response is
+ * taken from the Issue comments themselves first (platform readback, vocabulary-independent),
+ * and only the explicit dws denylist is fatal. Unknown tool names are recorded, not judged.
+ */
+function readSmoke(root, plan, marker, issueId, agentId, requiredSkills, runtimeProvider, command, env, timeoutMs, calls) {
+    const provider = runtimeProvider || '';
+    const registered = vocabulariesForRuntimeProvider(provider);
+    const active = registered.length
+        ? registered : allRuntimeVocabularies();
+    const vocabularyIds = active.map((item) => item.id);
+    const base = {
+        ...emptySmoke('pending', requiredSkills), marker, markerHash: sha256(marker), issueId,
+        runtimeProvider: provider, vocabularyIds,
+    };
     const runs = jsonArray(runProvider(command, scopedArgs(plan, ['issue', 'runs', issueId, '--full-id', '--output', 'json']), 'smoke.issue.runs', 'read', root, env, timeoutMs, calls).stdout, 'smoke runs');
     const candidates = runs.filter((item) => !optionalString(item.agent_id) ||
         optionalString(item.agent_id) === agentId);
     const run = candidates.sort((a, b) => optionalString(b.created_at).localeCompare(optionalString(a.created_at)))[0];
     if (!run)
-        return {
-            ...emptySmoke('pending', requiredSkills), marker, markerHash: sha256(marker), issueId,
-        };
+        return base;
     const taskId = resourceId(run.id, 'smoke task.id');
     const taskStatus = optionalString(run.status);
     if (!['completed', 'failed', 'cancelled'].includes(taskStatus))
         return {
-            ...emptySmoke('pending', requiredSkills), marker, markerHash: sha256(marker), issueId, taskId, taskStatus,
+            ...base, taskId, taskStatus,
         };
     const messages = jsonArray(runProvider(command, scopedArgs(plan, [
         'issue', 'run-messages', taskId, '--issue', issueId, '--output', 'json',
     ]), 'smoke.issue.messages', 'read', root, env, timeoutMs, calls).stdout, 'smoke messages');
     const toolUses = messages.filter((item) => optionalString(item.type) === 'tool_use');
-    const skillToolUses = toolUses.filter((item) => optionalString(item.tool) === 'skill');
-    const skillNames = skillToolUses.map((item) => smokeToolInput(item).name)
-        .filter((item) => typeof item === 'string' && Boolean(item)).sort();
-    const loadedSkills = requiredSkills.filter((name) => skillNames.includes(name)).sort();
+    const toolNames = [...new Set(toolUses.map((item) => optionalString(item.tool))
+            .filter(Boolean))].sort();
+    // Skill-load evidence: a native skill tool_use (the host mechanism itself), or the
+    // host-generated `**Skill loaded**` banner in a skill-capable tool's tool_result. Two
+    // things are deliberately NOT evidence: model text (a reply can claim anything), and
+    // load ATTEMPTS — a failed cold-sandbox load emits the same "Loading skill" tool_use
+    // before its error result, and a terminal/bash result echoes whatever the model printed.
+    const evidence = new Set();
+    const attempted = new Set();
+    const evidenceTools = new Set();
+    const bannerTools = new Set(active.flatMap((item) => [...item.skillResultTools]));
+    for (const item of messages) {
+        const type = optionalString(item.type);
+        const tool = optionalString(item.tool);
+        if (type === 'tool_use') {
+            const message = { tool, input: smokeToolInput(item) };
+            for (const vocabulary of active) {
+                const name = vocabulary.skillLoadFromToolUse(message);
+                if (name) {
+                    evidence.add(name);
+                    evidenceTools.add(tool);
+                }
+                const attempt = vocabulary.skillAttemptFromToolUse(message);
+                if (attempt) {
+                    attempted.add(attempt);
+                    evidenceTools.add(tool);
+                }
+            }
+        }
+        else if (type === 'tool_result' && bannerTools.has(tool)) {
+            for (const name of skillsLoadedInContent(optionalString(item.content))) {
+                evidence.add(name);
+                evidenceTools.add(tool);
+            }
+        }
+    }
+    const loadedSkills = requiredSkills.filter((name) => evidence.has(name)).sort();
+    const skillEvidencePassed = loadedSkills.length === requiredSkills.length;
+    // dws is the DingTalk side-effect boundary: as a named tool or shelled out in a command.
+    const commandTexts = toolUses.flatMap((item) => {
+        const message = {
+            tool: optionalString(item.tool), input: smokeToolInput(item),
+        };
+        return active.map((vocabulary) => vocabulary.commandText(message)).filter(Boolean);
+    });
+    const forbiddenTools = toolNames.filter((name) => forbiddenSmokeTool(name));
+    const forbiddenCommands = commandTexts.some((text) => commandInvokesDws(text));
+    const knownTools = new Set(active.flatMap((item) => [...item.tools]));
+    const unrecognizedTools = toolNames.filter((name) => !knownTools.has(name) && !evidenceTools.has(name) && !forbiddenSmokeTool(name));
+    // Response evidence, most stable source first: the Issue's own comments (platform
+    // readback — no tool vocabulary involved), then trace texts, writes and shell heredocs.
+    const matchesResponse = (value) => smokeResponseMatches(value, marker, requiredSkills);
+    let commentContents = [];
+    try {
+        commentContents = jsonArray(runProvider(command, scopedArgs(plan, [
+            'issue', 'comment', 'list', issueId, '--recent', '20', '--output', 'json',
+        ]), 'smoke.issue.comments', 'read', root, env, timeoutMs, calls).stdout, 'smoke comments').map((item) => optionalString(item.content)).filter(Boolean);
+    }
+    catch {
+        commentContents = []; // 旧版 provider CLI 可能没有 comment list；回退 trace 内取证
+    }
     const texts = messages.filter((item) => optionalString(item.type) === 'text')
         .map((item) => optionalString(item.content)).filter(Boolean);
     const finalText = texts.at(-1) || '';
-    const matchesResponse = (value) => smokeResponseMatches(value, marker, requiredSkills);
-    const replyWrites = toolUses.filter((item) => optionalString(item.tool) === 'write')
-        .map((item) => smokeToolInput(item)).filter((input) => optionalString(input.filePath).endsWith('/reply.md'))
-        .map((input) => optionalString(input.content)).filter(Boolean);
-    const responseEvidence = [...texts, ...replyWrites].find(matchesResponse) || '';
+    const responseWrites = [];
+    const responseShells = [];
+    for (const item of toolUses) {
+        const message = {
+            tool: optionalString(item.tool), input: smokeToolInput(item),
+        };
+        for (const vocabulary of active) {
+            const write = vocabulary.writeEvidence(message);
+            if (write && safeSmokeResponsePath(write.path))
+                responseWrites.push(write.content);
+            const text = vocabulary.commandText(message);
+            if (text && safeCombinedSmokeResponse(text, issueId, marker, requiredSkills)) {
+                responseShells.push(JSON.stringify({
+                    schema: 'dta-multica-load-smoke@1', marker, loaded: requiredSkills,
+                }));
+            }
+        }
+    }
+    const responseEvidence = [...commentContents, ...texts, ...responseWrites, ...responseShells]
+        .find(matchesResponse) || '';
     const responsePassed = Boolean(responseEvidence);
-    const toolTracePassed = toolUses.every((item) => allowedSmokeToolUse(item, issueId, marker, requiredSkills)) && stableStringify(skillNames) === stableStringify(requiredSkills);
+    const toolTracePassed = skillEvidencePassed && !forbiddenTools.length && !forbiddenCommands;
     const failures = [];
+    const failureDetails = [];
     if (taskStatus !== 'completed')
         failures.push(`smoke.task.${taskStatus || 'unknown'}`);
-    if (!toolTracePassed)
-        failures.push('smoke.skill-tool-trace');
-    if (!responsePassed)
+    if (!skillEvidencePassed) {
+        failures.push('smoke.skill-load-evidence');
+        const attemptedMissing = requiredSkills.filter((name) => attempted.has(name) && !evidence.has(name));
+        failureDetails.push({
+            code: 'smoke.skill-load-evidence',
+            expected: requiredSkills,
+            actual: loadedSkills,
+            hint: attemptedMissing.length
+                ? `有装载尝试但无成功证据（tool_result 缺 **Skill loaded**）: ${attemptedMissing.join(', ')}；` +
+                    '尝试不算装载成功'
+                : unrecognizedTools.length
+                    ? `轨迹里有词汇表不认识的工具名: ${unrecognizedTools.join(', ')}；` +
+                        '若属新 runtime 词汇，需要在 multica-runtime-vocabulary 注册'
+                    : '轨迹中没有这些 Skill 的装载证据（tool_result 的 **Skill loaded** 或 Skill 工具调用）',
+        });
+    }
+    for (const tool of forbiddenTools)
+        failures.push(`smoke.forbidden-tool:${tool}`);
+    if (forbiddenCommands)
+        failures.push('smoke.forbidden-command:dws');
+    if (!responsePassed) {
         failures.push('smoke.response');
+        failureDetails.push({
+            code: 'smoke.response',
+            actual: `comments=${commentContents.length} texts=${texts.length} writes=${responseWrites.length}`,
+            hint: '未在 Issue comment、回复文本或落盘文件中找到精确的 dta-multica-load-smoke@1 JSON',
+        });
+    }
+    // 分类冷沙箱竞态：任务终态且缺装载证据，轨迹里出现 skill not found 类措辞 → 可重试，
+    // 与「配置/模板真错了」区分开（B7 的两个误导方向都来自不区分这两态）。
+    let classification = '';
+    if (!skillEvidencePassed) {
+        const searchable = messages.map((item) => optionalString(item.content)).join('\n');
+        if (/skill[^\n]{0,80}?not\s+found|not\s+found[^\n]{0,60}?skill|skill\s+view\s+failed/i.test(searchable)) {
+            classification = 'skills-not-visible';
+            failures.unshift('smoke.skills-not-visible');
+            failureDetails.unshift({
+                code: 'smoke.skills-not-visible',
+                hint: '推送的 Skill 尚未物化进沙箱（冷启动竞态，通常数分钟内自愈）；' +
+                    '用 deploy --status --execute --yes 重试，或部署时用 --wait 放宽预算',
+            });
+        }
+    }
     return {
-        status: failures.length ? 'failed' : 'passed',
-        marker, markerHash: sha256(marker), issueId, taskId, taskStatus, requiredSkills, loadedSkills,
+        status: failures.length ? 'failed' : 'passed', marker, markerHash: sha256(marker),
+        issueId, taskId, taskStatus, taskDiagnostic: remoteTaskDiagnostic(run), requiredSkills, loadedSkills,
         toolTracePassed, responsePassed, responseHash: sha256(responseEvidence || finalText), failures,
+        runtimeProvider: provider, vocabularyIds, toolNames, unrecognizedTools, classification,
+        failureDetails,
     };
 }
 function smokeToolInput(item) {
@@ -641,48 +1143,25 @@ function smokeResponseMatches(value, marker, requiredSkills) {
         return false;
     }
 }
-function allowedSmokeToolUse(item, issueId, marker, requiredSkills) {
-    const tool = optionalString(item.tool);
-    if (tool === 'skill')
-        return true;
-    const input = smokeToolInput(item);
-    if (tool === 'write') {
-        return safeSmokeReplyPath(optionalString(input.filePath)) &&
-            smokeResponseMatches(optionalString(input.content), marker, requiredSkills);
-    }
-    if (tool !== 'bash')
-        return false;
-    const command = optionalString(input.command);
-    if (new Set([
-        `multica issue get ${issueId} --output json`,
-        `multica issue metadata list ${issueId} --output json`,
-        `multica issue comment list ${issueId} --recent 10 --output json`,
-        `multica issue status ${issueId} in_progress`,
-        `multica issue status ${issueId} in_review`,
-    ]).has(command))
-        return true;
-    const commentPrefix = `multica issue comment add ${issueId} --content-file `;
-    if (command.startsWith(commentPrefix)) {
-        return safeSmokeReplyPath(command.slice(commentPrefix.length));
-    }
-    const cleanupFirstPrefix = 'rm ';
-    const cleanupFirstSuffix = ` && multica issue status ${issueId} in_review`;
-    if (command.startsWith(cleanupFirstPrefix) && command.endsWith(cleanupFirstSuffix)) {
-        return safeSmokeReplyPath(command.slice(cleanupFirstPrefix.length, command.length - cleanupFirstSuffix.length));
-    }
-    const statusFirstPrefix = `multica issue status ${issueId} in_review && rm `;
-    if (command.startsWith(statusFirstPrefix)) {
-        return safeSmokeReplyPath(command.slice(statusFirstPrefix.length));
-    }
-    if (command.startsWith(cleanupFirstPrefix)) {
-        return safeSmokeReplyPath(command.slice(cleanupFirstPrefix.length));
-    }
-    return false;
+function safeCombinedSmokeResponse(command, issueId, marker, requiredSkills) {
+    const response = JSON.stringify({ schema: 'dta-multica-load-smoke@1', marker, loaded: requiredSkills });
+    return command === [
+        "cat > ./reply.md << 'REPLY_EOF'",
+        response,
+        'REPLY_EOF',
+        `multica issue comment add ${issueId} --content-file ./reply.md && rm ./reply.md`,
+    ].join('\n');
 }
-function safeSmokeReplyPath(value) {
-    if (value === './reply.md')
-        return true;
-    if (!value.startsWith('/') || !value.endsWith('/reply.md'))
+function safeSmokeResponsePath(value) {
+    const names = new Set(['reply.md', 'result.md', 'result.json']);
+    if (value.startsWith('./'))
+        return names.has(value.slice(2));
+    // 裸文件名与 `./` 前缀等价：Agent 在 workdir 里写绝对路径、随后用裸名引用同一个文件是
+    // 平台的常见写法。只放行精确 basename —— `foo/result.md` 与 `../result.md` 仍然落到
+    // 下面的绝对路径分支并被拒绝，白名单没有变宽。
+    if (!value.startsWith('/'))
+        return names.has(value);
+    if (!names.has(value.split('/').at(-1) || ''))
         return false;
     return value.split('/').every((part) => !part ||
         (part !== '.' && part !== '..' && /^[A-Za-z0-9._-]+$/.test(part)));
@@ -800,7 +1279,7 @@ function verifyRollback(root, plan, command, env, timeoutMs, calls, rollback, re
         });
     }
 }
-function failureReceipt(root, workspace, source, plan, preflight, operation, calls, rollback, status, failure) {
+function failureReceipt(root, workspace, source, plan, preflight, operation, calls, rollback, status, failure, failureDetail) {
     const receiptId = `multica_receipt_${digest(stableStringify({
         operationId: operation.operationId, status, failure,
     })).slice(0, 24)}`;
@@ -838,6 +1317,7 @@ function failureReceipt(root, workspace, source, plan, preflight, operation, cal
         smoke: emptySmoke('not-run', source.skills.map((item) => item.name)),
         rollback,
         failures: [failure, ...rollback.failures],
+        failureDetails: failureDetail ? [failureDetail] : [],
         evidencePath: receiptRelativePath(workspace.name, receiptId),
         remoteRead: true,
         remoteWrite: calls.some((call) => call.kind === 'write' || call.kind === 'rollback'),
@@ -857,6 +1337,7 @@ export function statusMulticaDeployment(start, name, options = {}) {
             workspace: name, provider: 'multica', available: false, operationId: '', receiptId: '',
             status: 'missing', passed: false, providerReady: false,
             operationIntegrity: false, receiptIntegrity: false, reconciled: false,
+            receiptFrozen: false, smokeStale: false, nextAction: '',
             failures: ['deployment.missing'], receipt: null,
             remoteRead: false, remoteWrite: false, triggerWrite: false,
             sideEffect: false, dingtalkSideEffect: false,
@@ -864,6 +1345,7 @@ export function statusMulticaDeployment(start, name, options = {}) {
     let { operation, receipt } = loaded;
     let reconciled = false;
     let remoteRead = false;
+    let remoteWrite = false;
     if (options.execute) {
         if (!options.yes)
             throw new Error('deploy --status 远端 reconcile 必须同时传 --execute --yes');
@@ -872,12 +1354,41 @@ export function statusMulticaDeployment(start, name, options = {}) {
         const timeoutMs = positiveTimeout(options.timeoutMs, 30_000, 300_000);
         if (receipt.status === 'verifying' && receipt.smoke.issueId) {
             remoteRead = true;
-            const smokeReadback = readSmokeFromReceipt(info.root, receipt, command, env, timeoutMs);
-            const smoke = smokeReadback.smoke;
-            receipt = { ...receipt, calls: smokeReadback.calls, smoke, status: smoke.status === 'passed' ? 'ready'
-                    : smoke.status === 'pending' ? 'verifying' : 'failed',
+            let smokeReadback = readSmokeFromReceipt(info.root, receipt, command, env, timeoutMs);
+            let smoke = smokeReadback.smoke;
+            let calls = smokeReadback.calls;
+            // 冷沙箱竞态的收口入口：终态失败但分类为 skills-not-visible 时，补一次 mention
+            // 触发新 task（唯一的写；如实上报 remoteWrite/sideEffect）。新 run 是异步创建的：
+            // 以 taskId 变化为「新 run 出现」的判据再判定，等不到就按旧判定收场（仍 verifying），
+            // 不再重复 mention。
+            if (smoke.status === 'failed' && smoke.classification === 'skills-not-visible' &&
+                receipt.agent.id) {
+                const planLike = {
+                    profile: receipt.profile, expected: { workspaceId: operation.workspaceId },
+                };
+                const staleTaskId = smoke.taskId;
+                runProvider(command, scopedArgs(planLike, [
+                    'issue', 'comment', 'add', receipt.smoke.issueId,
+                    '--content', `[@DTA load smoke](mention://agent/${receipt.agent.id}) Skills were not yet visible in the sandbox; re-run the deployment verification exactly as specified in this Issue description.`,
+                    '--output', 'json',
+                ]), 'smoke.issue.retry', 'write', info.root, env, timeoutMs, calls);
+                remoteWrite = true;
+                const deadline = Date.now() + timeoutMs;
+                do {
+                    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2_000);
+                    smokeReadback = readSmokeFromReceipt(info.root, { ...receipt, calls }, command, env, timeoutMs);
+                    smoke = smokeReadback.smoke;
+                    calls = smokeReadback.calls;
+                } while ((smoke.status === 'pending' ||
+                    (Boolean(staleTaskId) && smoke.taskId === staleTaskId)) && Date.now() < deadline);
+            }
+            const nextStatus = smoke.status === 'passed' ? 'ready'
+                : smoke.status === 'pending' ? 'verifying'
+                    : smoke.classification === 'skills-not-visible' ? 'verifying' : 'failed';
+            receipt = { ...receipt, calls, smoke, status: nextStatus,
                 passed: smoke.status === 'passed', providerReady: smoke.status === 'passed',
-                failures: [...smoke.failures] };
+                failures: [...smoke.failures],
+                failureDetails: [...smoke.failureDetails] };
             reconciled = true;
             persistReceiptAndState(info.root, showDevelopmentWorkspace(info.root, name), operation, receipt);
         }
@@ -911,6 +1422,7 @@ export function statusMulticaDeployment(start, name, options = {}) {
         }
         operation = loadOperationAndReceipt(info.root, name, operation.operationId)?.operation || operation;
     }
+    const receiptFrozen = !options.execute;
     return {
         $schema: 'dingtalk-agent/multica-deployment-status@1',
         workspace: name,
@@ -924,12 +1436,17 @@ export function statusMulticaDeployment(start, name, options = {}) {
         operationIntegrity: true,
         receiptIntegrity: true,
         reconciled,
+        receiptFrozen,
+        smokeStale: receiptFrozen && receipt.status === 'verifying',
+        nextAction: ['verifying', 'reconciling'].includes(receipt.status)
+            ? `dta deploy --workspace ${name} --status --operation-id ${operation.operationId} --execute --yes`
+            : '',
         failures: [...receipt.failures],
         receipt,
         remoteRead,
-        remoteWrite: false,
+        remoteWrite,
         triggerWrite: false,
-        sideEffect: remoteRead ? 'multica-read' : false,
+        sideEffect: remoteWrite ? 'multica-read-write' : remoteRead ? 'multica-read' : false,
         dingtalkSideEffect: false,
     };
 }
@@ -1055,7 +1572,7 @@ function readSmokeFromReceipt(root, receipt, command, env, timeoutMs) {
                 failures: ['smoke.marker-not-recoverable'],
             } };
     }
-    const smoke = readSmoke(root, plan, markerValue, receipt.smoke.issueId, receipt.agent.id, receipt.smoke.requiredSkills, command, env, timeoutMs, calls);
+    const smoke = readSmoke(root, plan, markerValue, receipt.smoke.issueId, receipt.agent.id, receipt.smoke.requiredSkills, receipt.smoke.runtimeProvider || '', command, env, timeoutMs, calls);
     return { smoke, calls };
 }
 function persistReceiptAndState(root, workspace, operation, receipt) {
@@ -1225,7 +1742,7 @@ function runProvider(command, argv, id, kind, cwd, env, timeoutMs, calls) {
         throw new DeploymentFailure('budget.rollback-exhausted');
     }
     const run = spawnSync(command, argv, {
-        cwd, env, encoding: 'utf8', timeout: timeoutMs,
+        cwd, env: sanitizeProviderEnv(env).env, encoding: 'utf8', timeout: timeoutMs,
         maxBuffer: 32 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'],
     });
     const stdout = String(run.stdout || '');
@@ -1237,8 +1754,10 @@ function runProvider(command, argv, id, kind, cwd, env, timeoutMs, calls) {
         id, kind, argv: redactArgv(argv), exitCode,
         stdoutHash: sha256(stdout), stderrHash: sha256(stderr), passed, ambiguous,
     });
-    if (!passed)
+    if (!passed) {
+        emitProviderDiagnostic(id, exitCode, stderr || stdout);
         throw new DeploymentFailure(`command.${id}`, ambiguous);
+    }
     return { stdout, stderr };
 }
 function scopedArgs(plan, args) {
@@ -1356,9 +1875,11 @@ function assertReportRedacted(value) {
 }
 function emptySmoke(status, requiredSkills) {
     return {
-        status, marker: '', markerHash: '', issueId: '', taskId: '', taskStatus: '',
+        status, marker: '', markerHash: '', issueId: '', taskId: '', taskStatus: '', taskDiagnostic: '',
         requiredSkills: [...requiredSkills].sort(), loadedSkills: [],
         toolTracePassed: false, responsePassed: false, responseHash: '', failures: [],
+        runtimeProvider: '', vocabularyIds: [], toolNames: [], unrecognizedTools: [],
+        classification: '', failureDetails: [],
     };
 }
 function emptyRollback(attempted) {
@@ -1432,6 +1953,58 @@ function stringField(value, label) {
 function optionalString(value) {
     return typeof value === 'string' ? value : '';
 }
+function safeRemoteOutput(value, maxBytes) {
+    const redacted = value
+        .replace(/-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g, '[redacted-private-key]')
+        .replace(/\bBearer\s+[A-Za-z0-9._~+\/-]{20,}/gi, 'Bearer [redacted]')
+        .replace(/\b(?:mul_|mcn_|sk-)[A-Za-z0-9._~+\/-]{12,}/gi, '[redacted-token]');
+    const bytes = Buffer.from(redacted, 'utf8');
+    return bytes.length <= maxBytes ? redacted : `${bytes.subarray(0, maxBytes).toString('utf8')}…`;
+}
+function uniqueCalls(calls) {
+    const seen = new Set();
+    return calls.filter((call) => {
+        const key = stableStringify({
+            id: call.id,
+            kind: call.kind,
+            argv: call.argv,
+            exitCode: call.exitCode,
+            stdoutHash: call.stdoutHash,
+            stderrHash: call.stderrHash,
+            passed: call.passed,
+            ambiguous: call.ambiguous,
+        });
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+function remoteTaskDiagnostic(task) {
+    if (!task)
+        return '';
+    const values = [];
+    const add = (label, value) => {
+        if (typeof value === 'string' && value.trim())
+            values.push(`${label}=${value.trim()}`);
+        else if (typeof value === 'number' || typeof value === 'boolean')
+            values.push(`${label}=${value}`);
+        else if (value && typeof value === 'object' && !Array.isArray(value)) {
+            const nested = value;
+            for (const key of ['code', 'category', 'message', 'reason', 'detail']) {
+                if (nested[key] !== undefined)
+                    add(`${label}.${key}`, nested[key]);
+            }
+        }
+    };
+    for (const key of [
+        'error', 'error_message', 'failure_reason', 'status_message', 'reason', 'message', 'detail',
+    ]) {
+        if (task[key] !== undefined)
+            add(key, task[key]);
+    }
+    return safeRemoteOutput(values.join('; '), 2_000);
+}
 function resourceId(value, label) {
     const item = stringField(value, label);
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{1,127}$/.test(item) ||
@@ -1454,12 +2027,6 @@ function requireMulticaWorkspace(start, name, cliVersion = '') {
     }
     return workspace;
 }
-function safeExternalSkillRoot(path) {
-    if (!existsSync(path) || lstatSync(path).isSymbolicLink()) {
-        throw new Error(`Canonical Multica Boot Skill 不存在或是符号链接: ${path}`);
-    }
-    return realpathSync(path);
-}
 function safeProjectPath(root, ref, mustExist) {
     const rootReal = realpathSync(resolve(root));
     const candidate = resolve(rootReal, ref);