@xdxer/dingtalk-agent 0.1.5-beta.2 → 0.1.5-beta.3

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to `@xdxer/dingtalk-agent` are documented here. The project follows semantic versioning; prerelease entries describe release candidates and do not imply that Live canaries or registry publication have completed.
 
+## 0.1.5-beta.3 - 2026-07-22
+
+Agent delivery-package single-source layout and Multica Issue-Adapter receipt compatibility (PR #11). Ships on the `beta` dist-tag; `latest` stays at 0.1.4.
+
+### Changed
+
+- Agent delivery packages now have a single source of truth: new projects generate `agent/AGENTS.md` and `agent/skills/`, and Host exposure is materialized only into temporary isolated workspaces instead of being committed alongside the source. The project manifest gains `skillsRoot`; explicit paths and the legacy root layout keep working.
+- Basic Behavior 0.11.11 makes IM history file-identifier recovery mandatory: rich-message recovery follows a fixed readback-before-gap-judgment order, and a fileId present in a history file card must go through `drive info`/read-only download instead of the Agent claiming it cannot read the file. A deterministic history-file-card fixture locks the behavior.
+- Golden Path and load-evidence fixtures moved to the `agent/AGENTS.md` + `agent/skills` single-source layout; load evidence now verifies resolved instructions against the trusted `definitionInstruction` exactly, while the legacy implicit root-`AGENTS.md` rule remains accepted.
+
+### Fixed
+
+- The Multica deployment load-smoke gate no longer misjudges the platform's constrained Issue-Adapter receipts as arbitrary Shell. It accepts the combined here-doc write/comment/cleanup control-plane command only when content, filename and target Issue all match exactly, extracts the response evidence from that command, adds `result.md` to the approved result filenames (alongside `reply.md`/`result.json`), and allows `rm`/`rm -f` cleanup only for those three whitelisted files. DWS, network and any other Shell use still fail closed.
+- Contract scenario 54's injected-timeout legs used a 1-second per-call provider budget, which a loaded machine could exhaust on an innocent preflight read (each fake-provider call spawns a Node process) before ever reaching the write the timeout was injected on — the pre-release `--full` run failed exactly this way while the isolated rerun passed. The runtime behaved correctly (read timeout → fail closed before any remote write); the eval budgets were raised to 4 seconds with the simulated hang raised to 8, and scenario 54's expectation texts in `evals.json` were reordered to match the runner's check order, which had drifted and mislabeled the failing assertion.
+
 ## 0.1.5-beta.2 - 2026-07-21
 
 Multica native-Skill refactor and DingTalk IM context recovery (PR #9, #10). Ships on the `beta` dist-tag; `latest` stays at 0.1.4.

package/README.en.md

@@ -53,7 +53,9 @@ A model that talks is not a digital employee that works reliably. `dta` turns th
 
 ## What an Agent is made of
 
-Four things: the **Definition** (`AGENTS.md` — who I am, where my duties stop), **shared behavior** (the `dingtalk-basic-behavior` Skill — when to respond, ask, stay silent, close out), **role capability** (`skills/<role>/SKILL.md`), and **storage routing** (`agent.bindings.json` — optional; the same configuration can come from host context, environment variables, or a Workspace manifest). The Agent Host, DWS, managed platform, and event source it depends on are all outside this project.
+Four things: the **Definition** (`agent/AGENTS.md` — who I am, where my duties stop), **shared behavior** (`agent/skills/dingtalk-basic-behavior`), **role capability** (`agent/skills/<role>/SKILL.md`), and **storage routing** (`agent.bindings.json` — optional; the same configuration can come from host context, environment variables, or a Workspace manifest). The repository-root `AGENTS.md` only governs coding agents and is never the remote System Prompt.
+
+For a new project, `agent/` is the only managed-platform delivery boundary; do not commit duplicate Skills under root `skills/` or `.agents/skills/`. Existing code repositories can retain custom layouts by explicitly declaring `agent.definition` and `agent.skillsRoot` in `dingtalk-agent.json`.
 
 Full composition, dependencies, and boundaries: [Architecture](docs/ARCHITECTURE.md#2-一个-agent-由什么构成模型-a).
 
@@ -104,7 +106,7 @@ The placeholders above are not yours to invent — each has a definite source:
 | `<plan-id>` | Top-level `.planId` in the preceding `--dry-run --json` output. Any source or config change invalidates it, so re-run the dry run |
 | `local-dev` / `multica-dev` | Workspace names **you** declare in `dingtalk-agent.json#workspaces` — not built-in values. Sample: [`lab/project-workspace/project.fixture.json`](lab/project-workspace/project.fixture.json) |
 | `<promotion-id>` | `.promotionId` on the `promotion-receipt@1` produced by `dta promote --yes` |
-| `<role-skill-name>` | The `name` in your `skills/<role>/SKILL.md` frontmatter |
+| `<role-skill-name>` | The `name` in your `agent/skills/<role>/SKILL.md` frontmatter |
 
 ### Minimal runnable path (local only, three commands)
 
@@ -116,9 +118,9 @@ dta bootstrap --json      # Was the body recognized? Check definition.status and
 dta agent audit --json    # Expect partial — the role semantics are still template text, which is correct
 ```
 
-None of this needs a DingTalk account or a managed platform, and none of it has side effects. Fill in the real role semantics in `AGENTS.md`, run `agent audit` again, and the only remaining gap is `host.load-probe` — which needs an Agent Host, see the [Compose Skill](skills/core/dingtalk-agent-compose/SKILL.md). The third command group above only applies once you have a Multica binding and declared Workspaces.
+None of this needs a DingTalk account or a managed platform, and none of it has side effects. Fill in the real role semantics in `agent/AGENTS.md`, run `agent audit` again, and the only remaining gap is `host.load-probe` — which needs an Agent Host, see the [Compose Skill](skills/core/dingtalk-agent-compose/SKILL.md). The third command group above only applies once you have a Multica binding and declared Workspaces.
 
-When deploying to Multica, the remote System Prompt must equal the versioned `AGENTS.md` source. Deployment hashes, the Skill manifest, and assignment evidence stay in the plan/operation/Receipt control plane. Basic and Role Skills use the platform's native assignment instead of an extra startup prompt or startup Skill.
+When deploying to Multica, the remote System Prompt must equal the manifest-selected `agent/AGENTS.md` source. Deployment hashes, the Skill manifest, and assignment evidence stay in the plan/operation/Receipt control plane. Basic and Role Skills use the platform's native assignment instead of an extra startup prompt or startup Skill.
 
 ## Support
 

package/README.md

@@ -52,7 +52,9 @@ npm install --global --prefix "$HOME/.local" \
 
 ## 一个 Agent 由什么构成
 
-四件东西：**本体**（`AGENTS.md`，我是谁、职责边界）、**公共行为**（`dingtalk-basic-behavior` Skill，何时响应/追问/沉默/收口）、**岗位能力**（`skills/<role>/SKILL.md`）、**存储路由**（`agent.bindings.json`，可选——等价配置也可来自宿主 context、环境变量或 Workspace manifest）。它依赖的 Agent Host、DWS、托管平台和事件源都不属于本项目。
+四件东西：**本体**（`agent/AGENTS.md`，我是谁、职责边界）、**公共行为**（`agent/skills/dingtalk-basic-behavior`，何时响应/追问/沉默/收口）、**岗位能力**（`agent/skills/<role>/SKILL.md`）、**存储路由**（`agent.bindings.json`，可选——等价配置也可来自宿主 context、环境变量或 Workspace manifest）。仓库根 `AGENTS.md` 只约束 Coding Agent 开发，不属于远端本体。Agent Host、DWS、托管平台和事件源也不属于 Agent 交付包。
+
+从零创建时，`agent/` 是 managed agent platform 的唯一同步边界，Skill 不能再复制到根 `skills/` 或 `.agents/skills/`。已有代码仓库不强制迁目录：在 `dingtalk-agent.json#agent` 显式声明 `definition` 与 `skillsRoot` 即可继续按原布局同步。
 
 完整的构成、依赖与边界见 [Architecture](docs/ARCHITECTURE.md#2-一个-agent-由什么构成模型-a)。
 
@@ -103,7 +105,7 @@ dta observe --promotion-id <promotion-id> --input <observation.json> --dry-run -
 | `<plan-id>` | 上一条 `--dry-run --json` 输出的顶层 `.planId`。源码或配置一变它就失效，必须重新 dry-run |
 | `local-dev` / `multica-dev` | **你自己**在 `dingtalk-agent.json#workspaces` 里声明的 Workspace 名，不是内置值。样例见 [`lab/project-workspace/project.fixture.json`](lab/project-workspace/project.fixture.json) |
 | `<promotion-id>` | `dta promote --yes` 产出的 `promotion-receipt@1` 的 `.promotionId` |
-| `<role-skill-name>` | 你 `skills/<role>/SKILL.md` 里 frontmatter 的 `name` |
+| `<role-skill-name>` | 你 `agent/skills/<role>/SKILL.md` 里 frontmatter 的 `name` |
 
 ### 最小可运行路径（纯本地，三条命令）
 
@@ -115,9 +117,9 @@ dta bootstrap --json      # 本体被识别了吗：看 definition.status 与 st
 dta agent audit --json    # 预期 partial —— 岗位语义还是模板，这是正确结果
 ```
 
-到这一步不需要钉钉账号、不需要托管平台、不产生任何副作用。把 `AGENTS.md` 里的岗位语义填成真的，再跑一次 `agent audit`，缺口就只剩 `host.load-probe`——那需要一个 Agent Host，见 [Compose Skill](skills/core/dingtalk-agent-compose/SKILL.md)。上面第 3 组云端命令要等你有了 Multica 归属和已声明的 Workspace 才用得上。
+到这一步不需要钉钉账号、不需要托管平台、不产生任何副作用。把 `agent/AGENTS.md` 里的岗位语义填成真的，再跑一次 `agent audit`，缺口就只剩 `host.load-probe`——那需要一个 Agent Host，见 [Compose Skill](skills/core/dingtalk-agent-compose/SKILL.md)。上面第 3 组云端命令要等你有了 Multica 归属和已声明的 Workspace 才用得上。
 
-发布到 Multica 时，远端 System Prompt 必须与版本化的 `AGENTS.md` 原文一致；部署哈希、Skill 清单和 assignment 证据只存在于 plan/operation/Receipt 控制面。Basic 与 Role Skills 通过平台原生 assignment 挂载，不再用额外启动 Prompt 或启动 Skill 承载机器协议。
+发布到 Multica 时，远端 System Prompt 必须与 manifest 指定的 `agent/AGENTS.md` 原文一致；部署哈希、Skill 清单和 assignment 证据只存在于 plan/operation/Receipt 控制面。Basic 与 Role Skills 通过平台原生 assignment 挂载，不再用额外启动 Prompt 或启动 Skill 承载机器协议。
 
 ## 支持范围
 

package/dist/src/agent-audit.js

@@ -12,6 +12,7 @@ import { resolvePackageRoot } from './package-root.js';
 import { bundledSkillPath } from './skill-manager.js';
 import { createIsolatedOpenCodeHost } from './opencode-isolation.js';
 const COMPOSE_TEMPLATE_MARKER = /<(?:Agent 名称|岗位\/角色|人群、团队或工作场域|长期目标|主动负责的事项|可观察的交付物|明确不做或必须升级确认的事项|岗位稳定的输入、判断、交付与验收范式|何时自行推进、何时交给谁|本体级常见错误 [12]|纠偏动作 [12]|Role Skill names|role-skill-name|Role Skill 名称|岗位职责或工作流|领域判断、输入与交付物|相邻职责或明确交接边界|岗位特有的禁区或必须升级条件|领域输入|领域方法\/SOP|领域常见错误|领域纠偏动作|可观察结果 [12]|route)>/u;
+const BASIC = 'dingtalk-basic-behavior';
 const BASIC_INSTRUCTION = '.agents/skills/dingtalk-basic-behavior/SKILL.md';
 const DEFINITION_PROBE_PROMPT = '这是 Agent Definition 继承探针。只依据已强制加载的角色宪法末尾注释回答；' +
     '严格输出纯文本 dta-definition-probe=<值>，若看不到则输出纯文本 ' +
@@ -77,28 +78,33 @@ export function auditAgent(root, options = {}) {
         }
     }
     const basic = readCanonicalBasicSkill();
-    const basicExposurePath = join(rootReal, '.agents', 'skills', 'dingtalk-basic-behavior', 'SKILL.md');
+    const packagedBasic = definition.skills.find((item) => item.name === BASIC);
+    const basicExposurePath = packagedBasic?.path || join(rootReal, '.agents', 'skills', BASIC, 'SKILL.md');
     const basicExposure = inspectSkill(basicExposurePath);
     const basicExposureTree = inspectSkillTree(basicExposurePath);
     add('host.basic-exposure', 'host', basicExposure.exists && basicExposure.name === basic.name &&
         basicExposure.version === basic.version && basicExposure.hash === basic.hash &&
         basicExposureTree.hash === basic.treeHash ? 'pass' : 'fail', true, basicExposure.exists && basicExposure.hash === basic.hash &&
         basicExposureTree.hash === basic.treeHash
-        ? 'OpenCode Basic Skill 全树 exposure 与 canonical source 一致'
-        : 'OpenCode Basic Skill 入口、references 或 assets 缺失或发生漂移', { expected: basic, actual: { ...basicExposure, treeHash: basicExposureTree.hash,
+        ? 'Agent package 的 Basic Skill 全树与 canonical source 一致'
+        : 'Agent package 的 Basic Skill 入口、references 或 assets 缺失或发生漂移', { expected: basic, actual: { ...basicExposure, treeHash: basicExposureTree.hash,
             files: basicExposureTree.files, error: basicExposureTree.error } });
     const config = inspectOpenCodeConfig(rootReal);
     const definitionInstruction = definition.body?.path
         ? relative(rootReal, definition.body.path).split('\\').join('/') : '';
     const definitionInstructionCount = countInstructionsForPath(rootReal, config.instructions, definitionInstruction);
-    const definitionRuleReady = !config.error && definitionInstruction === 'AGENTS.md' &&
-        definitionInstructionCount === 0;
+    const definitionInstructionExpected = definitionInstruction === 'AGENTS.md' ? 0 : 1;
+    const definitionRuleReady = !config.error && Boolean(definitionInstruction) &&
+        definitionInstructionCount === definitionInstructionExpected;
     add('host.definition-rule', 'host', definitionRuleReady
         ? 'pass' : 'fail', true, definitionRuleReady
-        ? 'OpenCode 使用项目根 AGENTS.md 原生 rule，且未重复声明 custom instruction'
-        : 'Agent Definition 必须是项目根 AGENTS.md，且不能重复加入 opencode instructions', { path: config.path, error: config.error, instruction: definitionInstruction,
+        ? definitionInstruction === 'AGENTS.md'
+            ? 'OpenCode 使用项目根开发兼容模式的原生 Agent Definition'
+            : 'OpenCode 以唯一 custom instruction 加载独立 Agent Definition'
+        : 'Agent Definition 未形成唯一加载路径', { path: config.path, error: config.error, instruction: definitionInstruction,
         instructionCount: definitionInstructionCount });
-    const instructionCount = countInstructionsForPath(rootReal, config.instructions, '.agents/skills/dingtalk-basic-behavior/SKILL.md');
+    const basicInstruction = relative(rootReal, basicExposurePath).split('\\').join('/');
+    const instructionCount = countInstructionsForPath(rootReal, config.instructions, basicInstruction);
     add('host.basic-instruction', 'host', !config.error && instructionCount === 1 &&
         config.permissions['dingtalk-basic-behavior'] === 'allow' ? 'pass' : 'fail', true, !config.error && instructionCount === 1 &&
         config.permissions['dingtalk-basic-behavior'] === 'allow'
@@ -107,12 +113,10 @@ export function auditAgent(root, options = {}) {
         permission: config.permissions['dingtalk-basic-behavior'] || '' });
     for (const name of requiredSkills) {
         const source = roleSkills.get(name);
-        const exposure = inspectSkill(join(rootReal, '.agents', 'skills', name, 'SKILL.md'));
         const permission = config.permissions[name] || '';
-        const matched = Boolean(source?.hash && exposure.exists && exposure.name === name &&
-            exposure.hash === source.hash && permission === 'allow');
-        add(`host.role-exposure.${name}`, 'host', matched ? 'pass' : 'fail', true, matched ? `Role Skill ${name} exposure 与 Definition 一致`
-            : `Role Skill ${name} exposure、hash 或 permission 不一致`, { sourceHash: source?.hash || '', exposure, permission });
+        const matched = Boolean(source?.hash && source.path && permission === 'allow');
+        add(`host.role-exposure.${name}`, 'host', matched ? 'pass' : 'fail', true, matched ? `Role Skill ${name} 单一发布源与 Host permission 一致`
+            : `Role Skill ${name} 发布源或 permission 不一致`, { sourceHash: source?.hash || '', sourcePath: source?.path || '', permission });
     }
     const staticPrerequisitesReady = checks
         .filter((item) => item.blocking)
@@ -129,7 +133,7 @@ export function auditAgent(root, options = {}) {
         if (!options.yes)
             throw new Error('agent audit --verify-load 会调用 OpenCode；必须同时传 --yes');
         if (staticPrerequisitesReady) {
-            const execution = executeLoadAudit(rootReal, options, loadTargetHash, definitionInstruction, effectiveModel, () => currentLoadTargetHash(rootReal, options, requiredSkills, effectiveModel));
+            const execution = executeLoadAudit(rootReal, options, loadTargetHash, definitionInstruction, basicInstruction, effectiveModel, () => currentLoadTargetHash(rootReal, options, requiredSkills, effectiveModel));
             loadReport = execution.report;
             loadReportPath = execution.evidencePath;
             verifiedReportPath = execution.reportPath;
@@ -374,17 +378,14 @@ function currentLoadTargetHash(root, options, requiredSkills, model) {
     const hydrated = bootstrap(root, { ...(options.bootstrap || {}), deferRemote: true });
     const definition = hydrated.definition;
     const basic = readCanonicalBasicSkill();
-    const exposedPath = join(root, '.agents', 'skills', 'dingtalk-basic-behavior', 'SKILL.md');
+    const packagedBasic = definition.skills.find((item) => item.name === BASIC);
+    const exposedPath = packagedBasic?.path || join(root, '.agents', 'skills', BASIC, 'SKILL.md');
     const exposed = inspectSkill(exposedPath);
     const exposedTree = inspectSkillTree(exposedPath);
     const config = inspectOpenCodeConfig(root);
     const roleSkills = new Map(definition.skills
         .filter((item) => item.name !== 'dingtalk-basic-behavior')
         .map((item) => [item.name, item]));
-    const roleExposureHashes = Object.fromEntries(requiredSkills.map((name) => [
-        name,
-        inspectSkill(join(root, '.agents', 'skills', name, 'SKILL.md')).hash || '',
-    ]));
     const roleSourceHashes = Object.fromEntries(requiredSkills.map((name) => [
         name, roleSkills.get(name)?.hash || '',
     ]));
@@ -402,11 +403,10 @@ function currentLoadTargetHash(root, options, requiredSkills, model) {
         opencodeConfigHash: config.hash,
         requiredSkills,
         roleSourceHashes,
-        roleExposureHashes,
         model,
     }));
 }
-function executeLoadAudit(root, options, targetHash, definitionInstruction, model, revalidate) {
+function executeLoadAudit(root, options, targetHash, definitionInstruction, basicInstruction, model, revalidate) {
     const runId = `agent_audit_${Date.now()}_${randomUUID().slice(0, 8)}`;
     const outputInspection = inspectContainedPath(root, options.out || join('.dingtalk-agent', 'agent-audit', 'results', runId));
     const outputRoot = outputInspection.path;
@@ -424,8 +424,8 @@ function executeLoadAudit(root, options, targetHash, definitionInstruction, mode
     const host = createIsolatedOpenCodeHost(model.split('/')[0]);
     try {
         const command = process.env.DTA_OPENCODE_BIN || 'opencode';
-        const sourcePreflight = inspectSourceOpenCodeRuntime(command, root, host.environment, definitionInstruction);
-        materializeAuditProbeWorkspace(root, auditWorkspace, definitionInstruction);
+        const sourcePreflight = inspectSourceOpenCodeRuntime(command, root, host.environment, definitionInstruction, basicInstruction);
+        materializeAuditProbeWorkspace(root, auditWorkspace, definitionInstruction, basicInstruction);
         const suitePath = join(auditWorkspace, 'suite.json');
         writeAtomic(suitePath, JSON.stringify({
             $schema: 'dingtalk-agent/robot-eval-suite@1',
@@ -494,19 +494,19 @@ function executeLoadAudit(root, options, targetHash, definitionInstruction, mode
         rmSync(auditWorkspace, { recursive: true, force: true });
     }
 }
-function materializeAuditProbeWorkspace(sourceRoot, targetRoot, definitionInstruction) {
-    if (definitionInstruction !== 'AGENTS.md') {
-        throw new Error('OpenCode 原生 Definition 探针只接受项目根 AGENTS.md');
-    }
+function materializeAuditProbeWorkspace(sourceRoot, targetRoot, definitionInstruction, basicInstruction) {
     mkdirSync(targetRoot, { recursive: true });
-    writeAtomic(join(targetRoot, 'AGENTS.md'), readFileSync(join(sourceRoot, 'AGENTS.md'), 'utf8'));
-    const sourceBasic = join(sourceRoot, '.agents', 'skills', 'dingtalk-basic-behavior');
+    writeAtomic(join(targetRoot, definitionInstruction), readFileSync(join(sourceRoot, definitionInstruction), 'utf8'));
+    const sourceBasic = dirname(join(sourceRoot, basicInstruction));
     const targetBasic = join(targetRoot, '.agents', 'skills', 'dingtalk-basic-behavior');
     mkdirSync(dirname(targetBasic), { recursive: true });
     cpSync(sourceBasic, targetBasic, { recursive: true });
     const config = {
         $schema: 'https://opencode.ai/config.json',
-        instructions: [BASIC_INSTRUCTION],
+        instructions: [
+            ...(definitionInstruction === 'AGENTS.md' ? [] : [definitionInstruction]),
+            BASIC_INSTRUCTION,
+        ],
         permission: { skill: { 'dingtalk-basic-behavior': 'allow' } },
         plugin: [],
         mcp: {},
@@ -515,19 +515,21 @@ function materializeAuditProbeWorkspace(sourceRoot, targetRoot, definitionInstru
     };
     writeAtomic(join(targetRoot, 'opencode.json'), JSON.stringify(config, null, 2) + '\n');
 }
-function inspectSourceOpenCodeRuntime(command, root, environment, definitionInstruction) {
+function inspectSourceOpenCodeRuntime(command, root, environment, definitionInstruction, basicInstruction) {
     const parent = mkdtempSync(join(tmpdir(), 'dta-source-config-preflight-'));
     const workspace = join(parent, 'workspace');
     let stdout = '';
     try {
         mkdirSync(workspace, { recursive: true });
         cpSync(join(root, 'opencode.json'), join(workspace, 'opencode.json'));
-        if (existsSync(join(root, 'AGENTS.md'))) {
-            cpSync(join(root, 'AGENTS.md'), join(workspace, 'AGENTS.md'));
+        if (existsSync(join(root, definitionInstruction))) {
+            const target = join(workspace, definitionInstruction);
+            mkdirSync(dirname(target), { recursive: true });
+            cpSync(join(root, definitionInstruction), target);
         }
-        const basic = join(root, '.agents', 'skills', 'dingtalk-basic-behavior');
+        const basic = dirname(join(root, basicInstruction));
         if (existsSync(basic)) {
-            const target = join(workspace, '.agents', 'skills', 'dingtalk-basic-behavior');
+            const target = dirname(join(workspace, basicInstruction));
             mkdirSync(dirname(target), { recursive: true });
             cpSync(basic, target, {
                 recursive: true,
@@ -564,9 +566,10 @@ function inspectSourceOpenCodeRuntime(command, root, environment, definitionInst
         throw new Error('OpenCode 原项目 resolved instructions 不是 string array');
     }
     const definitionCount = countInstructionsForPath(root, instructions, definitionInstruction);
-    const basicCount = countInstructionsForPath(root, instructions, BASIC_INSTRUCTION);
-    if (definitionInstruction !== 'AGENTS.md' || definitionCount !== 0 || basicCount !== 1) {
-        throw new Error(`OpenCode 原项目 resolved config 未形成原生 AGENTS.md + 唯一 Basic: ` +
+    const basicCount = countInstructionsForPath(root, instructions, basicInstruction);
+    const expectedDefinitionCount = definitionInstruction === 'AGENTS.md' ? 0 : 1;
+    if (definitionCount !== expectedDefinitionCount || basicCount !== 1) {
+        throw new Error(`OpenCode 原项目 resolved config 未形成唯一 Agent Definition + Basic: ` +
             `definition=${definitionCount} basic=${basicCount}`);
     }
     if (value.agent?.['dta-eval'] !== undefined) {
@@ -625,7 +628,10 @@ function executeInheritanceProbe(sourceRoot, model, command, timeoutMs, reportEv
             !Array.isArray(sourceConfig.permission) ? sourceConfig.permission : {};
         const skill = permission.skill && typeof permission.skill === 'object' &&
             !Array.isArray(permission.skill) ? permission.skill : {};
-        sourceConfig.instructions = [BASIC_INSTRUCTION];
+        sourceConfig.instructions = [
+            ...(definitionInstruction === 'AGENTS.md' ? [] : [definitionInstruction]),
+            BASIC_INSTRUCTION,
+        ];
         delete sourceConfig.provider;
         sourceConfig.plugin = [];
         sourceConfig.mcp = {};
@@ -665,7 +671,7 @@ function executeInheritanceProbe(sourceRoot, model, command, timeoutMs, reportEv
         const definitionRaw = persistProbeExecution(reportEvidenceRoot, 'definition', definitionExecution);
         const referenceRaw = persistProbeExecution(reportEvidenceRoot, 'reference', referenceExecution);
         const result = {
-            passed: definitionInstruction === 'AGENTS.md' && basicResolvedCount === 1 &&
+            passed: Boolean(definitionInstruction) && basicResolvedCount === 1 &&
                 definitionPermissionPassed && referencePermissionPassed &&
                 definitionExecution.exitCode === 0 && definitionExecution.directoryMatched &&
                 definitionExecution.toolCalls === 0 &&
@@ -830,7 +836,7 @@ function validRandomProbe(value, name) {
     const count = name === 'dta-reference-probe' ? 2 : 1;
     return new RegExp(`^${name}=${uuid}${count === 2 ? `:${uuid}` : ''}$`).test(value);
 }
-function verifyLoadProbeSet(root, reportPath, report, primaryName, comparisonName, basic, expectedRuns) {
+function verifyLoadProbeSet(root, reportPath, report, primaryName, comparisonName, basic, definitionInstruction, expectedRuns) {
     const all = Array.isArray(report.loadProbes) ? report.loadProbes : [];
     const declaredRuns = Number(report.summary?.runsPerConfiguration);
     const primary = all.filter((item) => item.configuration === primaryName);
@@ -841,7 +847,12 @@ function verifyLoadProbeSet(root, reportPath, report, primaryName, comparisonNam
         items.every((item) => Number.isInteger(item.runNumber) &&
             item.runNumber >= 1 && item.runNumber <= expectedRuns);
     const common = (item) => {
-        const expectedInstructions = item.expectsLoad === true ? [BASIC_INSTRUCTION] : [];
+        const expectedInstructions = item.expectsLoad === true
+            ? [
+                BASIC_INSTRUCTION,
+                ...(definitionInstruction === 'AGENTS.md' ? [] : [definitionInstruction]),
+            ].sort()
+            : [];
         return loadProbeCorePassed(item, version) &&
             stableStringify(item.resolvedInstructions) === stableStringify(expectedInstructions) &&
             verifyLoadProbeRaw(root, reportPath, item, String(report.engine?.model || ''));
@@ -954,7 +965,7 @@ function readLoadEvidence(root, input, expectedTargetHash) {
 function verifyLoadReport(root, reportPath, report, basic, definitionInstruction, model, currentHostVersion) {
     const configuration = 'with_skill';
     const comparison = 'without_skill';
-    const probeSet = verifyLoadProbeSet(root, reportPath, report, configuration, comparison, basic, 1);
+    const probeSet = verifyLoadProbeSet(root, reportPath, report, configuration, comparison, basic, definitionInstruction, 1);
     const probes = probeSet.primary;
     const source = report.skills?.[configuration];
     const gate = report.summary?.configurationLoadGates?.[configuration];
@@ -966,7 +977,7 @@ function verifyLoadReport(root, reportPath, report, basic, definitionInstruction
         Array.isArray(definition.toolNames) && definition.toolNames.length === 0 &&
         Array.isArray(definition.toolPaths) && definition.toolPaths.length === 0 &&
         Array.isArray(definition.toolTrace) && definition.toolTrace.length === 0 &&
-        definition.nativeRule === 'AGENTS.md' && definitionInstruction === 'AGENTS.md' &&
+        definition.nativeRule === definitionInstruction && Boolean(definitionInstruction) &&
         definition.permissionPassed === true &&
         zeroToolPermission(definition.evalAgent || {});
     const referenceTrace = Array.isArray(reference.toolTrace) ? reference.toolTrace : [];
@@ -1017,7 +1028,7 @@ function verifyLoadReport(root, reportPath, report, basic, definitionInstruction
             baselineAntiGuessProbes: probeSet.passedComparison,
             expectedRunsPerConfiguration: probeSet.expectedRuns,
             definitionInstruction,
-            definitionNativeRule: definition.nativeRule === 'AGENTS.md',
+            definitionNativeRule: definition.nativeRule === definitionInstruction,
             totalProbes: probes.length,
             definitionProbePassed: definitionPassed,
             referenceProbePassed: referencePassed,
@@ -1037,8 +1048,11 @@ function verifySourceConfigEvidence(root, reportPath, summary, evidence) {
         return false;
     const value = summary;
     const manifest = evidence;
-    if (value.passed !== true || value.definitionInstruction !== 'AGENTS.md' ||
-        value.definitionInstructionCount !== 0 || value.basicInstructionCount !== 1 ||
+    const expectedDefinitionCount = value.definitionInstruction === 'AGENTS.md' ? 0 : 1;
+    if (value.passed !== true || typeof value.definitionInstruction !== 'string' ||
+        !value.definitionInstruction ||
+        value.definitionInstructionCount !== expectedDefinitionCount ||
+        value.basicInstructionCount !== 1 ||
         typeof value.rawHash !== 'string' || !value.rawHash ||
         manifest.rawHash !== value.rawHash)
         return false;
@@ -1227,12 +1241,12 @@ function repairFor(id) {
     if (id === 'definition.semantic-contract')
         return {
             id, why: '结构化模板不能替代真实的本体定义、岗位底线、做事范式和常犯错误。',
-            actions: ['评审并替换 AGENTS.md 中所有 <...> 占位符，再复跑 audit。'],
+            actions: ['评审并替换 manifest 中 agent.definition 指向文件的所有 <...> 占位符，再复跑 audit。'],
         };
     if (id === 'definition.body')
         return {
             id, why: 'Agent 必须有长期定义、岗位底线、做事范式和常犯错误。',
-            actions: ['从 compose Skill 的 AGENTS.template.md 创建 AGENTS.md，再复跑 audit。'],
+            actions: ['从 compose Skill 的 AGENTS.template.md 创建 agent/AGENTS.md，并由 manifest 的 agent.definition 指向它，再复跑 audit。'],
         };
     if (id === 'storage.memory')
         return {
@@ -1257,22 +1271,22 @@ function repairFor(id) {
     if (id.startsWith('skill.role.') && id.endsWith('.semantic'))
         return {
             id, why: 'Role Skill 必须包含真实的领域输入、方法、产物和验收，而不是模板提示。',
-            actions: [`评审并替换 skills/${id.slice('skill.role.'.length, -'.semantic'.length)}/SKILL.md 中所有 <...> 占位符。`],
+            actions: [`评审并替换 agent.skillsRoot 下 ${id.slice('skill.role.'.length, -'.semantic'.length)}/SKILL.md 中所有 <...> 占位符。`],
         };
     if (id.startsWith('skill.role.'))
         return {
             id, why: '领域职责需要独立 Role Skill，不能写回 Basic Behavior。',
-            actions: [`创建 skills/${id.slice('skill.role.'.length)}/SKILL.md，并确保目录名等于 frontmatter name。`],
+            actions: [`在 manifest 声明的 agent.skillsRoot 下创建 ${id.slice('skill.role.'.length)}/SKILL.md，并确保目录名等于 frontmatter name。`],
         };
     if (id === 'host.basic-exposure')
         return {
             id, why: 'OpenCode 只能从项目 exposure 完整继承本次装配的 Basic Skill 入口、references 与 assets。',
-            actions: ['把 canonical dingtalk-basic-behavior 全树物化到 .agents/skills/dingtalk-basic-behavior。'],
+            actions: ['把 canonical dingtalk-basic-behavior 全树放入 agent.skillsRoot；由 dta 在隔离 Host 工作区临时物化 exposure。'],
         };
     if (id === 'host.definition-rule')
         return {
-            id, why: 'OpenCode 只会把项目根 AGENTS.md 作为本地原生 rule；重复 custom instruction 会形成冗余通道。',
-            actions: ['把项目本体统一为根目录 AGENTS.md，并从 opencode.json#instructions 删除其等价路径。'],
+            id, why: 'Agent Definition 与仓库开发约束必须分离，重复 custom instruction 会形成冗余通道。',
+            actions: ['让 managed Host 只加载一次 manifest 的 agent.definition；仓库根 AGENTS.md 仅保留 Coding Agent 开发约束。'],
         };
     if (id === 'host.basic-instruction')
         return {
@@ -1282,7 +1296,7 @@ function repairFor(id) {
     if (id.startsWith('host.role-exposure.'))
         return {
             id, why: 'Role Skill 的发布源、Host exposure 与权限必须指向同一版本。',
-            actions: [`物化 .agents/skills/${id.slice('host.role-exposure.'.length)}，校验 hash 并设置 permission=allow。`],
+            actions: [`修复 agent.skillsRoot 下 ${id.slice('host.role-exposure.'.length)} 的唯一发布源；由 dta 临时物化 Host exposure、校验 hash 并设置 permission=allow。`],
         };
     if (id === 'host.load-probe')
         return {