dsh-tower 2.0.4 → 2.1.0-beta.1

package/CHANGELOG.md

@@ -2,6 +2,107 @@
 
 > 自 2.0.0 起，每个版本按 **新增 / 变更 / 修复** 三类组织；更早的版本保留原始流水式记录。
 
+## 未发布（Unreleased）
+
+## 2.1.0-beta.1（2026-10-22）
+
+**预发布**：本版本发布到 npm 的 `next` dist-tag，`latest` 继续保持 `2.0.4`，直到出现稳定版本。
+从 2.0.4 直接跳到 2.1.0-beta.1，是为了让 #94 的交付闸门（mount smoke、发布闸门、证据约定）有一个
+可验证的预发布载体；从 2.0.4 升级不需要改动配置。
+
+### 新增
+
+- **#95 mount smoke**：新增 `npm run smoke:mount`——打包本包、把 `scripts/mount-smoke/host.json` 中
+  唯一 pin 的 host 装进一次性目录、创建一次性 `DSH_HOME` 与 profile、用真实 loader 启动，并断言
+  **加载后的真实 surface**（29 个 `tower_*` 工具 id、3 个 skill、2 个 preset、`/tower` 命令，以及恰好
+  一个顶层 `tower-bundle` 行，#66 不变量）；CI 增加 `mount` job（Node 22，5 分钟预算），
+  `tests/mount-smoke.test.mjs` 锁定 oracle，并保持 host pin 等于 `COMPATIBILITY.md` 最新行。
+- **#95 覆盖率可见化**：CI 每次 push 运行 `npm run test:coverage` 并输出覆盖率表（只接线：无阈值、
+  无 baseline、无徽章）；`CONTRIBUTING.md` 写明 CI 能证明什么、不能证明什么。
+- **#97 发布闸门**：新增 `npm run release:check`（`scripts/release-check.mjs`）。每次运行都打印上一个
+  tag、`git describe`、自该 tag 起的提交数与 Unreleased 是否有内容；PR/分支 push 只警告（exit 0），
+  tag push 在版本没有前进、tag 不是 `v<version>`、或 CHANGELOG 没有该版本内容时失败（exit 1）。
+  CI 在每次 push 与 tag push 上运行它。
+- **#97 发布清单**：`docs/guide/release.md` 把发布收敛为六步（版本 → CHANGELOG → COMPATIBILITY →
+  `npm publish --tag next` → 注释 tag → `gh release create`），含里程碑 P0/P1 规则、CHANGELOG 段落的
+  bash/PowerShell 提取命令，以及 `--verify-tag`、`--prerelease --latest=false` 与“先发布后打 tag”的
+  原因。
+- **#96 离线 issue 审计**：新增 `npm run audit:issues`（`scripts/issue-audit.mjs`），读取本地
+  `tracker/issues.json` 导出，检查已关闭 P0/P1 的 `verified-by:`/`commit:` 两行契约，全程不访问
+  GitHub；`--since` 只看约定日期之后的关闭，`tracker/` 是 gitignored 的本地快照。
+- **#97 追踪看板**：新增 `docs/board.md`，把 owner 每周要问的三个问题写成可执行的 `gh` 命令，并记录
+  标签/搜索语义（`--label P0,P1` 匹配单个字面标签，`--search 'label:P0,P1'` 才是 OR）。
+
+### 变更
+
+- **#96 受保护 `main` 与证据约定**：`main` 只能经 PR 合入（管理员同样受限），必需检查与“two-key
+  路径 + 四行 PR body”写进 `CONTRIBUTING.md`；P0/P1 关闭必须带 `verified-by:` 与 `commit:` 两行。
+  “某些路径允许直推”的例外被删除，因为 GitHub 的分支保护无法表达它——留一条服务器不会执行的规则
+  比没有规则更糟。
+- **#94/#97 追踪策略**：优先级只存在于 `P0`–`P3` 标签、领域在 `area/*`，issue 标题不再带 `[P*]`
+  前缀；milestone 仍然只表示发布范围（一个 release 一个 milestone）。
+- **README 徽章**：中英文 README 增加 “Listed on dsh-plugin.org” 徽章，链接到插件市场条目。
+- **#66 all-or-nothing bundle**：`cordis.patch.yml` 改为单个 `tower-bundle` `cordis:group`，Host、
+  skills 与 worker/reviewer preset 成为内部 section；子行不再可独立启停，避免 host 关闭后的 orphan。
+- **#64 preset 前置校验**：模式进入与 `tower_plan` 前解析 worker/reviewer preset；缺失时以稳定
+  `preset-missing` 拒绝并点名 `preset-tower-worker` / `preset-tower-reviewer`，不再先规划后死锁。
+- **#65 可选能力开关**：`tools.exposeBatch/exposeImport/exposeLeases/exposeTests/exposeRecovery/exposeDoctor`
+  可独立关闭；`gates.requireTests:true` 与 tests/tools 关闭的组合在配置解析时直接拒绝。
+- **#67 组件文案**：host locale 增加 `components.{tower-bundle,tower-skills,preset-*}` 的
+  title/summary/disables 中英文案；预设仍为内部 section，不再作为独立开关暴露。
+- **#52 继续拆分 tools**：review/preflight/merge-rebase-teardown 拆为 per-tool 模块；
+  `lib/tools.js` 降至约 503 行。
+- **#51 two-phase 试点**：`tower_complete` 改为锁外 prepare + 锁内 revision 复核；`submitReview`
+  同样拆为锁外准备（actor/worktree/tip/round）与锁内 revision 复核；新增
+  `lock-holds.jsonl` 遥测与 doctor p50/p95 检查（>1s warn）。
+- **#51 git 互斥基础**：新增 `withGitLock` / `git.lock`，用与 state lock 相同的 token/PID-dead
+  回收协议串行化 git 操作，为把 git 移出 state lock 做准备。
+- **#51 merge/rebase/teardown**：三者改为 prepare/act/commit；长 git 操作在 `git.lock` 下进行，
+  state lock 只做 revision 复核与写回；rebase 增加可对账的 `rebaseIntent`。
+- **#51 init/provision/merge reconcile**：init/provision 同样锁外 prepare + `git.lock` act +
+  短 state lock 复核；merge 的 intent/landed 对账改为锁外 git 观察 + revision CAS，任何
+  state lock 内不再启动 git。
+- **#51 init/provision**：`tower_init` 与 worktree provision 同样改为锁外 prepare + `git.lock`
+  下 act + 短 state lock 复核；provision 失败/并发变更时回滚 worktree 与 branch。
+- **#68 owner 恢复提示**：`towerAgentId` 缺失时写工具现在返回可操作错误
+  “run tower_init to re-claim”，`tower_status` 暴露 `towerAgentId/ownerMissing`，doctor 增加
+  `tower-owner` 检查；`tower_init` 重新绑定后恢复写权限。
+- **#52 Tower 拆分**：`lib/tower.js` 从约 2.9k 行降到 **535** 行；plan/mission/checkCompletion/
+  missionContext/enrichedMissions/board/spawn/recording 拆为 `lib/tower/*.js` use-case 模块，
+  `Tower` 方法仅作委托，行为、错误码与锁顺序不变。
+- **#50 I/O 边界**：`node:fs` 仅保留在 `lib/adapters/store-fs.js`，`node:child_process` 仅保留在
+  `lib/adapters/vcs-git.js`；其余 lib 模块经 adapter 导入，`package.json files` 补齐 adapters；
+  新增架构回归锁定该不变量。
+- **#50 依赖注入**：新增 `lib/adapters/default.js` 组合根；`Tower` 构造器接受
+  `deps.store/vcs/clock/ids`，类内不再直接调用 git/store 模块；回归证明注入 adapter 生效。
+- **#56 前置工作**：架构 fitness 规则按实际 `lib/adapters` 边界修正并全部升级为 error
+  （domain-pure / child-process / fs / ambient-state / aggregate-size / tools-thin / tools-vocabulary），
+  baseline 零违规；`docs/architecture/overview.md` 更新为实际分层、state/modes 契约和剩余差距。
+- **#45 路线 A：TypeBox 单一 schema 源**：经调研 Schemastery 的 `toJSON()` 只序列化自身结构、不输出 JSON Schema，因此选用 TypeBox。29 个工具输入 schema 改为 `Type.Object(...)`；`define` 泛型从 schema 推导 `execute(args)` 类型；`tsc` 覆盖全部 tool 模块并加入 required/enum 负向 fixture。运行时注册前 JSON 化，wire schema 与迁移前逐项一致。
+- **#50 test doubles**：`tests/support/memory-store.js` 与 `scripted-vcs.js` 提供无磁盘/无 git 的
+  Store/Vcs 契约；新增完整 scripted lifecycle 与 10 项 adapter contract 测试。
+- **#45 domain 类型**：`lib/domain/*.js` 纳入 checkJs，新增 `tests/type-contracts.ts` 正/负类型
+  fixture；types 契约与 domain 签名对齐。
+- **packaging**：`package.json files` 补齐 `lib/tower/*.js`，避免发布包遗漏 use-case 模块。
+- **#45 错误结构化继续**：纯 domain、review/findings/read/batch/rebase、`lib/tower.js` 与 infra
+  （store/config/git/tests）均改为抛出带 code 的 `TowerToolError`；`classifyError` 的 26 条
+  prose `RULES` 表已删除，纯文本错误统一落到 `tool-internal`。
+- **#54 mode 锁等待**：`mode.lockTimeoutMs`（默认 5000ms）统一 modes.lock 的有界等待与死锁回收语义。
+- **#59 兼容性记录**：新增随包发布 `COMPATIBILITY.md`，doctor 增加 `host-version` 检查（verified /
+  untested-newer / untested-older / unknown，仅警告）。
+- **#61 共存冲突**：README 增加 “Known conflicts”，doctor 增加 `loader-conflicts` 检查。
+- **#58 仓库产物排除**：`docs.boardLocation:"repo"` 与仓库内 `worktrees.root` 自动写入
+  `.git/info/exclude`（幂等，绝不改 `.gitignore`）；新增 `init.autoExclude`。
+- **#44 模式进入审计**：`tower_status` 增加 `mode.lastChange`/`mode.history`；新增
+  `mode.requireHumanAckOnFirstEntry` 与 `/tower ack`；安全文档补充模型主动进入的威胁模型。
+- **#43 默认值提醒**：doctor 的 `default-reversals` 检查提示仍依赖旧默认值的 profile。
+- **#60 提供商冷却**：spawn 在连续可重试失败后进入进程内冷却并收缩预算；
+  `tower_status.spawn` 暴露 `{inflight, budget, blockedUntil}`。
+- **#48 发布文件守卫**：新增 `scripts/pack-manifest.txt`、`npm run pack:check` 与 CI 步骤。
+- **#62 工具面预算**：`tools.exposeOperational:false` 可跳过 batch/resource/import/legacy/recover/test/doctor 工具。
+- **#47 live 守卫**：`tests/live` 需要显式 `DSH_LIVE=1` 与隔离的 `DSH_HOME`，不再可能误跑真实 profile。
+- **#63**：doctor 不再把正常 live worker 视为 warn。
+
 ## 2.0.4（2026-10-21）
 
 ### 变更

package/COMPATIBILITY.md

@@ -0,0 +1,38 @@
+# Compatibility
+
+Tower records the DeepSeek Harness host build each release was actually verified against. This file
+is shipped in the npm package; doctor reads it locally and never contacts a registry.
+
+| dsh version | tag / commit | verified on | what was run |
+|---|---|---|---|
+| 0.2.1-rc.2 | v2.1.0-beta.1 | 2026-10-22 | mount smoke (29 tower tools, `/tower`, 3 skills, 2 presets, single bundle row), `npm test` (413), `npm run docs:check`, generated docs checks |
+| 0.2.1-rc.2 | 6ee19de | 2026-10-21 | `npm test` (229), `npm run docs:check`, offline `ui-bundle` tests |
+| 0.2.1-rc.2 | 5b0accd | 2026-10-18 | `npm test` (219), `npm run docs:check` |
+
+## How to read this
+
+- **verified**: exact host version match; the row names the date and what ran.
+- **untested-newer**: newer than every row. Normally safe to try; include the host version and the
+  latest row in a bug report.
+- **untested-older**: older than every row; upgrade the host or expect missing APIs.
+- **unknown**: the host did not expose a parseable version.
+
+`tower_doctor` reports this as a warning only: a newer host is the normal case and must not block
+Tower work. This is provenance, not a feature-detection mechanism.
+
+## Release process
+
+Add a row in the release PR, before tagging, after running the offline suite and docs check on the
+host build being shipped. Name the release tag in cell 1 and the host build in cell 0; the other
+columns are read positionally by `lib/compatibility.js`, so do not insert or reorder them. Do not
+claim a live run that was not performed. The 2.1.0-beta.1 row is a pre-release: it becomes
+installable on the `next` dist-tag only after the checklist's publish step, and `latest` stays on
+2.0.4 until a stable release. The full six-step procedure is the
+[release checklist](docs/guide/release.md).
+
+## Pack provenance
+
+Releases are currently published locally with npm 2FA. `publishConfig.provenance` is intentionally
+not enabled because provenance requires a CI OIDC publisher; enabling it locally would fail the
+release. The reviewed `scripts/pack-manifest.txt` and CI `pack:check` guard the published file list.
+Move publishing to GitHub Actions before enabling provenance.

package/CONTRIBUTING.md

@@ -2,6 +2,59 @@
 
 Thanks for your interest in `dsh-tower`. This is a DeepSeek Harness plugin; the repository root is the bundle itself (`package.json` + `cordis.patch.yml`).
 
+## Landing changes
+
+`main` is protected. Every change lands through a pull request; direct pushes to `main` are rejected,
+including the maintainer's, because protection is enforced for admins. To merge, a PR must pass these
+required checks:
+
+| Required context | What it proves |
+|---|---|
+| `test (22)` | offline suite, docs/pack/architecture/types/domain checks on Node 22 |
+| `test (24)` | the same jobs on Node 24 |
+| `mount` | the packed tarball mounts in a throwaway profile and registers its surface (`npm run smoke:mount`) |
+
+The context names come from the workflow job id and matrix values. Renaming a job or a matrix value
+changes the required context; update the protection setting in the same PR, or the check never reports
+and every PR stays unmergeable. The setting and its verification command are in
+[SECURITY.md](SECURITY.md#repository-protection-on-main). The `mount-fixtures` job runs the seeded
+smoke failures for evidence but is deliberately **not** a required context.
+
+There are no mandatory approvals, no CODEOWNERS gate, and **merging your own PR is allowed**: there is
+one maintainer, and a mandatory self-approval would be theatre. What replaces the second reviewer is a
+written contract.
+
+### Two-key paths and the four-line PR body
+
+"Two-key" here means two independent keys of evidence — the written failure mode and the named test,
+on top of the green required checks — not two approvals. A change touching any of these paths carries a
+four-line body, in this order:
+
+- `domain/**`
+- `app/**`
+- `lib/store.js`, `lib/persistence.js`, `lib/*lock*.js`
+- `scripts/architecture.mjs`
+- `cordis.patch.yml`
+
+```markdown
+Failure mode: <what breaks for a user if this is wrong>
+Change: <what changed, one sentence>
+Test: <test file and case that fails without this change>
+Blast radius: <repositories, state files or tools that can be affected>
+```
+
+Those paths decide whether a user's repository is modified or a gate can be bypassed. Every other path
+still lands as a PR, but a one-line description is enough. The four lines are evidence, not ceremony:
+if the "Test" line cannot name a file, the change needs one first.
+
+### Direct push
+
+There is none. Before the delivery gate (#94 / #96), `main` accepted direct pushes, and #77 proposed
+the two-key rule as a path-scoped exception. GitHub branch protection cannot express "direct push
+allowed for these paths only", so the exception was dropped instead of documented as a rule the server
+would not enforce. An emergency bypass is not a workflow: repairing `main` means changing the setting
+deliberately and recording why, not silently pushing.
+
 ## Development setup
 
 ```bash
@@ -21,15 +74,110 @@ Requirements: Node.js 22+, Git. No package installation is needed for the offlin
 
 ## Pull request checklist
 
-1. `npm test` passes locally (206 tests today, including protocol end-to-end against a real temporary Git repository and mock spawn coverage) and `npm run docs:check` passes.
+1. `npm test` passes locally (416 tests today, including protocol end-to-end against a real temporary Git repository and mock spawn coverage) and `npm run docs:check` passes.
 2. New behavior has a test. Bug fixes should add a test that fails before the fix.
 3. No secrets, tokens, personal paths, session logs, or generated artifacts are added. `.gitignore` covers local acceptance output; do not force-add it.
 4. Keep the public API and state-file formats compatible; if a change is breaking, call it out in `CHANGELOG.md` and bump the version.
 5. Update `README.md` / `README.en.md` when the user-visible behavior changes.
+6. If you touched `cordis.patch.yml`, `index.js`, `skills.js`, or `tools/`, run `npm run smoke:mount` (see below).
+7. A commit carries `Refs #n` or `Fixes #n`; a P0/P1 closure carries `verified-by:` and `commit:`, and `npm run audit:issues` reports no new failures.
+
+## Mount smoke
+
+The offline suite never loads a host, so it cannot see a bundle that fails to mount. The smoke
+packs this package, installs the pinned host into a temp directory, adds the tarball through
+`dsh plugin`, and boots the throwaway profile through the real loader:
+
+```bash
+npm run smoke:mount      # asserts the loaded surface; under two minutes
+npm run smoke:fixtures   # proves the smoke still fails for the right seeded reasons
+```
+
+It needs network access the first time (the host install) and `pnpm` on `PATH` (the plugin CLI's
+package manager). `scripts/mount-smoke/host.json` is the single host build pin: bump it and the
+newest `COMPATIBILITY.md` row together — a unit test fails when the two disagree. The fixtures
+rename one tool id and remove the `tower-skills` row to prove the red run names the cause rather
+than only counting rows; CI runs them in the `mount-fixtures` job, sharing one cached host install
+through `--host-dir`.
+
+Coverage is reported by `npm run test:coverage` in CI. It is a signal, not a gate: no threshold,
+no baseline, no badge.
+
+## Releasing
+
+A release is six steps: bump → changelog → COMPATIBILITY row → publish → annotated tag → GitHub
+Release. The one-page procedure with exact commands is [docs/guide/release.md](docs/guide/release.md).
+It carries the two rules that are easy to get wrong: **publish before tagging** (or delete the tag if
+publish fails), and a release **may not be tagged while its milestone holds an open P0/P1** unless the
+release notes say why. `npm publish` is the only human-only step (2FA).
+
+`npm run release:check` prints `git describe`, the previous tag, the commits since it and whether
+Unreleased is non-empty on every run. It warns on a PR and fails on a tag push whose
+`package.json` version did not move past the last tag or whose tag is not `v<version>`.
+
+## Tracker board
+
+Priority lives in the `P0`–`P3` labels; open titles carry no `[P*]` prefix. The saved queries — open
+P1, unmilestoned P0/P1, closed this week by area, and the milestone check that blocks a release — are
+in [docs/board.md](docs/board.md).
+
+## Commits, closures and evidence
+
+### Trailers
+
+Put the issue trailer on its own line at the end of the commit message:
+
+- `Refs #n` — the commit touches issue n but does not complete it.
+- `Fixes #n` — the commit completes the issue; GitHub closes it when the change reaches `main`.
+
+One trailer per issue, and exactly one of the two per commit. `Fixes` is not decoration for work that a
+later commit still has to finish.
+
+### The two-line closure contract
+
+A closure on a P0/P1 is a pointer, not prose. The closing comment starts with these two lines:
+
+```text
+verified-by: tests/<file>.test.mjs
+commit: <sha>
+```
+
+- `verified-by:` names a test file that exists in the repository (under `tests/`, or named `*.test.*` /
+  `*.spec.*`). A script or a doc is not a test.
+- `commit:` names the commit that landed the change.
+
+Prose may follow. A closure without the two lines is treated as unverified, and the audit below fails
+on it.
+
+### Checking closures offline
+
+The audit reads a local export; it never calls GitHub, so it cannot pass because of a network outage or
+a token. Produce the export once (network), then audit it offline:
+
+```powershell
+# 1) Export (PowerShell; no jq needed)
+New-Item -ItemType Directory -Force tracker | Out-Null
+$all = foreach ($n in (gh issue list --repo louifinn/dsh-tower --state all --limit 500 --json number --jq '.[].number')) {
+  gh issue view $n --repo louifinn/dsh-tower --json number,title,state,labels,closedAt,body,comments | ConvertFrom-Json
+}
+@{ issues = @($all) } | ConvertTo-Json -Depth 8 | Set-Content tracker/issues.json -Encoding utf8
+
+# 2) Audit (offline)
+npm run audit:issues                          # every closed P0/P1 in tracker/issues.json
+npm run audit:issues -- --since 2026-10-22    # only closures on/after the convention date
+npm run audit:issues -- --tracker path/to/export.json --json
+```
+
+The bash equivalent of step 1 is the same `gh` calls piped through `jq -s '{issues: .}'`.
+
+Exit codes: `0` — every checked closure names an existing test file (a missing `commit:` is a warning);
+`1` — at least one pointer is missing, nonexistent, not a test, or outside the repository; `2` — the
+export is missing or malformed. `--strict` promotes the missing-`commit:` warning to an error.
+`tracker/` is a local snapshot and is gitignored; regenerate it instead of committing it.
 
 ## Commit style
 
-Conventional-commit prefixes are preferred: `feat:`, `fix:`, `docs:`, `test:`, `refactor:`, `chore:`. Keep the subject line in the imperative mood.
+Conventional-commit prefixes are preferred: `feat:`, `fix:`, `docs:`, `test:`, `refactor:`, `chore:`. Keep the subject line in the imperative mood. Add the issue trailer (`Refs #n` / `Fixes #n`) described above.
 
 ## Reporting issues
 

package/README.en.md

@@ -2,6 +2,7 @@
 
 [![CI](https://github.com/louifinn/dsh-tower/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/louifinn/dsh-tower/actions/workflows/test.yml)
 [![npm](https://img.shields.io/npm/v/dsh-tower.svg)](https://www.npmjs.com/package/dsh-tower)
+[![Listed on dsh-plugin.org](https://dsh-plugin.org/badges/listed.svg)](https://dsh-plugin.org/plugins/louifinn/dsh-tower)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [中文说明](README.md)
 
@@ -51,7 +52,7 @@ Tower mode refuses Team/Workflow/Ralph/ordinary subagent tools and clears plan m
 
 ## Requirements
 
-- DeepSeek Harness `0.2.1-rc.2` (or a compatible newer build)
+- DeepSeek Harness `0.2.1-rc.2` (see [COMPATIBILITY.md](COMPATIBILITY.md) for the verified host builds)
 - Node.js 22 or newer
 - Git (worktrees are created locally; no network access is required)
 
@@ -82,6 +83,13 @@ The optional Web UI ships inside the npm package at `ui-bundle/`: for an npm ins
 `<profile>/node_modules/dsh-tower/ui-bundle`, or `ui-bundle/` in a source checkout. Install it with
 `plugin_manager({action:"install_bundle", target:"<that directory>"})`, restart DSH, then refresh the page.
 
+### Known conflicts
+
+Do not install `dsh-plugins-tower` (third-party) alongside this package. Its loader row also uses
+`name: dsh-tower`, so it resolves to this package: this package may load twice or the other package
+never runs. `tower_doctor` reports this as `loader-conflicts`; uninstall the conflicting package and
+restart DSH.
+
 ## Quick start
 
 ```text
@@ -112,10 +120,23 @@ A small change usually takes one worker mission; add one reviewer round when ind
 | `/tower on <instruction>` | Enter/stay **and** forward `<instruction>` as the next user message |
 | `/tower off` | Leave Tower mode |
 | `/tower off <instruction>` | Leave **and** forward `<instruction>` |
+| `/tower ack` | Record human acknowledgement for `mode.requireHumanAckOnFirstEntry` |
 | `/tower <instruction>` | Ensure on, then forward `<instruction>` |
 
 Image and file attachments are forwarded together with the instruction as one complete `UserMessage`.
 
+## Component model
+
+This bundle is **all-or-nothing**: `cordis.patch.yml` inserts one `tower-bundle`
+`cordis:group` row, and the Host plugin, skills, and worker/reviewer presets are internal sections
+of it. The plugin page should treat that group as one component; disabling it disables all sections
+together, so no orphan preset or skill points at missing `tower_*` tools. Do not enable/disable the
+child rows independently.
+
+Mode entry and `tower_plan` validate both presets before work starts. A missing preset is refused
+with `preset-missing` and names `preset-tower-worker` / `preset-tower-reviewer`, instead of planning
+or spawning first and dead-ending at review/merge.
+
 ## Configuration
 
 ```yaml
@@ -179,14 +200,14 @@ Workers use the bundled `tower-worker` preset (writable worktree surface); revie
 
 | Path | Contents |
 |---|---|
-| `package.json`, `cordis.patch.yml` | bundle manifest and loader patch (inserts the Host plugin and the `tower-worker` preset) |
+| `package.json`, `cordis.patch.yml` | bundle manifest and loader patch (one `tower-bundle` group containing the Host, skills, and both presets) |
 | `index.js`, `lib/`, `worker.js`, `reviewer.js` | Host entry, protocol/config implementation, worker and reviewer preset policies |
 | `skills.js`, `skills/` | bundled agent skills (worker protocol, review checklist, recovery playbook) |
 | `docs/` | guides, reference, architecture, operations, FAQ and examples |
 | `locale/`, `icon.svg` | localization and icon |
 | `tests/` | pure-function, protocol end-to-end, and plugin-level tests; optional isolated Web-runtime scripts |
 | `ui-bundle/` | optional Client widget (Tower tool cards, persistent Tower-mode chip, mode-aware denied rows, dock summary, transient overlay strip), not installed by default |
-| `.github/workflows/test.yml` | CI running the offline suite on Node 22/24 |
+| `.github/workflows/test.yml` | CI running the offline suite on Node 22/24, the release and coverage checks, and the Node 22 mount smoke and seeded fixtures |
 
 ## Development and testing
 
@@ -200,6 +221,22 @@ Hot-reload development: `npm run dev:hmr` adds this checkout to the current prof
 
 The offline suite needs no DSH process and creates throwaway Git repositories in the OS temp directory. `tests/README.md` documents the isolated Web-runtime checks, model-driven acceptance, and the session-diagnostic scripts used while hardening the plugin.
 
+## What CI proves
+
+Every push and PR runs the same set of jobs; each job backs one checkable claim instead of a README promise.
+
+| Job | Claim | Evidence |
+|---|---|---|
+| `test` (Node 22/24) | the offline suite, documentation consistency, generated references, the published file list, architecture, types, and domain purity all hold | `npm test`, `npm run docs:check`, the three `docs:check:generated*` checks, `pack:check`, `architecture:check`, `types:check`, `domain:check` |
+| `test`'s `Coverage (Node 22)` step | coverage is actually measured in CI (reported only: no threshold, no badge) | `npm run test:coverage` |
+| `test`'s `Release check` step (Node 22) | a tag is a claim: the version moved past the previous version tag, a pushed tag is `v<version>`, and the changelog carries release content | `npm run release:check` |
+| `mount` (Node 22) | the packed tarball, added through the plugin CLI to a throwaway profile, mounts in the real loader and registers the surface the bundle claims | `npm run smoke:mount` |
+| `mount-fixtures` (Node 22, not required) | the mount smoke still goes red for the right seeded reasons (a renamed tool id, a removed skills section), with one cached host install shared by all runs | `npm run smoke:fixtures -- --host-dir <cached host>` |
+
+`mount` asserts the throwaway profile's **loaded surface**, never the text of `cordis.patch.yml`: 29 `tower_*` tools (27 `tools/*.js` modules plus `tower_mode` / `tower_control`), the 3 bundled skills, both the `tower-worker` and `tower-reviewer` presets, the `/tower` command, and exactly one top-level `tower-bundle` group row (the #66 invariant). It calls no model and opens no browser. Measured on the maintainer's Windows machine: about 100 seconds on a cold host (install included) and about 85 seconds with a cached host; the CI step allows 3 minutes (`timeout-minutes: 3`) inside the 5-minute `mount` job. A red run prints the resolved profile path, the host build, the loaded counts, and every unmet claim.
+
+The host build is pinned in exactly one place, `scripts/mount-smoke/host.json`; a unit test keeps the newest `COMPATIBILITY.md` row equal to it, so a release never retypes it. `npm run smoke:fixtures` proves the smoke still fails for the right seeded reasons (a renamed tool id, a removed skills section). CI runs it as the non-required `mount-fixtures` job, where the control and both seeds share one cached host install through `--host-dir` (about 2 minutes warm here).
+
 ## Documentation
 
 - [docs/README.md](docs/README.md) — documentation index (new user / operator / maintainer paths)

package/README.md

@@ -2,6 +2,7 @@
 
 [![CI](https://github.com/louifinn/dsh-tower/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/louifinn/dsh-tower/actions/workflows/test.yml)
 [![npm](https://img.shields.io/npm/v/dsh-tower.svg)](https://www.npmjs.com/package/dsh-tower)
+[![Listed on dsh-plugin.org](https://dsh-plugin.org/badges/listed.svg)](https://dsh-plugin.org/plugins/louifinn/dsh-tower)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [English](README.en.md)
 
@@ -51,7 +52,7 @@ Tower 模式会拒绝 Team/Workflow/Ralph/普通 subagent 工具并清除 plan m
 
 ## 环境要求
 
-- DeepSeek Harness `0.2.1-rc.2`（或兼容的新版本）
+- DeepSeek Harness `0.2.1-rc.2`（已验证的 host 构建见 [COMPATIBILITY.md](COMPATIBILITY.md)）
 - Node.js 22+
 - Git（worktree 在本地创建，不需要联网）
 
@@ -82,6 +83,12 @@ Host 插件在 DSH 进程启动时加载，**安装或更新后需重启 DSH**
 `<profile>/node_modules/dsh-tower/ui-bundle`，源码安装时为目标仓库的 `ui-bundle/` 目录。用
 `plugin_manager({action:"install_bundle", target:"<该目录>"})` 安装并重启 DSH，然后刷新页面。
 
+### 已知冲突
+
+不要同时安装 `dsh-plugins-tower`（第三方包）。它的 loader row 也使用 `name: dsh-tower`，会解析到
+本包，导致本包被加载两次或对方代码不生效。`tower_doctor` 的 `loader-conflicts` 检查会报告该情况；
+卸载冲突包并重启 DSH。
+
 ## 快速开始
 
 ```text
@@ -112,10 +119,22 @@ tower_teardown  repoRoot=D:\work\repo
 | `/tower on <指令>` | 开启/保持，并把 `<指令>` 作为下一条用户消息转发 |
 | `/tower off` | 退出 Tower 模式 |
 | `/tower off <指令>` | 退出并转发 `<指令>` |
+| `/tower ack` | 记录人类确认，供 `mode.requireHumanAckOnFirstEntry` 使用 |
 | `/tower <指令>` | 确保开启，然后转发 `<指令>` |
 
 图片与文件附件会随指令一起作为一条完整的 `UserMessage` 转发。
 
+## 组件模型
+
+本 bundle 采用 **all-or-nothing**：`cordis.patch.yml` 只插入一个 `tower-bundle`
+`cordis:group` 行，Host 插件、skills、worker/reviewer preset 都是它的内部 section。插件页只应把
+这个 group 当作一个组件；关闭它时四个 section 一起关闭，不会留下指向已消失 `tower_*` 工具的
+orphan preset/skill。不要再把子行单独启停。
+
+进入 Tower 模式与 `tower_plan` 前会校验两个 preset 是否已注册；缺失时直接以 `preset-missing`
+拒绝（并在消息中点名 `preset-tower-worker` / `preset-tower-reviewer`），不会先完成规划/派发再在
+review/merge 阶段死锁。
+
 ## 配置
 
 ```yaml
@@ -179,12 +198,12 @@ worker 与 reviewer 是使用内置 `tower-worker` preset 的普通 DSH 子代
 
 | 路径 | 内容 |
 |---|---|
-| `package.json`、`cordis.patch.yml` | bundle 清单与 loader patch（插入 Host 插件和 `tower-worker` preset） |
+| `package.json`、`cordis.patch.yml` | bundle 清单与 loader patch（单个 `tower-bundle` group，内含 Host、skills 与两个 preset） |
 | `index.js`、`lib/`、`worker.js` | Host 入口、协议实现、worker preset 策略 |
 | `locale/`、`icon.svg` | 本地化与图标 |
 | `tests/` | 纯函数、协议 e2e、插件级测试；可选的真实 Web 运行时脚本 |
 | `ui-bundle/` | 可选 Client 小挂件（Tower 工具卡片、Tower·on 状态 chip、模式感知的 disabled 行、dock 摘要、临时 overlay 状态条），默认不安装 |
-| `.github/workflows/test.yml` | CI：Node 22/24 上跑离线套件 |
+| `.github/workflows/test.yml` | CI：Node 22/24 离线套件、release 与覆盖率检查、Node 22 挂载 smoke 与种子失败 fixtures |
 
 ## 开发与测试
 
@@ -196,6 +215,22 @@ npm test        # node --test tests/*.test.mjs
 
 离线套件不需要 DSH 进程，只在系统临时目录创建一次性 Git 仓库。隔离 Web 运行时检查、模型驱动验收和会话诊断脚本见 `tests/README.md`。
 
+## CI 证明了什么
+
+每次 push 与 PR 都运行同一组 job；每个 job 对应一条可检查的声明，而不是一句 README 承诺。
+
+| Job | 声明 | 证据 |
+|---|---|---|
+| `test`（Node 22/24） | 离线套件、文档一致性、生成文档、发布文件清单、架构、类型与 domain 纯度全部成立 | `npm test`、`npm run docs:check`、三个 `docs:check:generated*`、`pack:check`、`architecture:check`、`types:check`、`domain:check` |
+| `test` 的 `Coverage (Node 22)` 步骤 | 覆盖率在 CI 中真实测量（只报告，不设阈值、不加徽章） | `npm run test:coverage` |
+| `test` 的 `Release check`（Node 22）步骤 | tag 是一种声明：版本已越过上一个版本 tag、推送的 tag 是 `v<version>`、CHANGELOG 带有发布内容 | `npm run release:check` |
+| `mount`（Node 22） | 打出的 tarball 经 plugin CLI 装进一次性 profile 后，真实 loader 挂载并注册了 bundle 声称的表面 | `npm run smoke:mount` |
+| `mount-fixtures`（Node 22，非必需检查） | mount smoke 仍会因正确的种子失败而变红（改名一个工具 id、删除 skills 段），三次运行共用一次缓存的 host 安装 | `npm run smoke:fixtures -- --host-dir <缓存的 host>` |
+
+`mount` 断言一次性 profile 的**已加载表面**，而不是 `cordis.patch.yml` 的文本：29 个 `tower_*` 工具（27 个 `tools/*.js` 模块 + `tower_mode` / `tower_control`）、3 个内置 skill、`tower-worker` / `tower-reviewer` 两个 preset、`/tower` 命令，以及唯一一个顶层 `tower-bundle` group 行（#66）。它不调用模型、不打开浏览器。在维护者的 Windows 机器上实测：host 冷装（含安装）约 100 秒，host 已缓存约 85 秒；CI 中该步骤上限为 3 分钟（`timeout-minutes: 3`），`mount` job 上限 5 分钟。红叉会打印解析后的 profile 路径、host build、已加载计数与每一条未满足的声明。
+
+host build 只固定在一个地方：`scripts/mount-smoke/host.json`，`COMPATIBILITY.md` 最新一行由单元测试强制与它一致，发布时不再各写一遍。`npm run smoke:fixtures` 用两种种子失败（改名一个工具 id、删除 skills 段）证明 smoke 会以正确原因变红；CI 中它作为非必需的 `mount-fixtures` job 运行，control 与两个种子通过 `--host-dir` 共用一次缓存的 host 安装（本机热跑约 2 分钟）。
+
 ## 文档
 
 - [docs/README.md](docs/README.md) — 文档索引（新用户 / 运维 / 维护者三条阅读路径）

package/SECURITY.md

@@ -11,6 +11,33 @@ Areas that matter for security reports:
 - Command forwarding: injecting content into the model history that the user did not send.
 - Writes outside the declared scope, the mission worktree, or the DSH home directory.
 
+## Repository protection on `main`
+
+The repository's own landing path is part of the security surface, not separate from it: the merge
+gate, state lock, persistence and scope code decide whether a user's repository is modified, so a bad
+change there is exploitable for every repository that installs the plugin. `main` is therefore
+protected with:
+
+- a pull request required for every change, with **admins enforced** — a direct push is rejected even
+  for the maintainer;
+- required checks `test (22)`, `test (24)` and `mount` — the packed bundle must mount and register its
+  surface before a change can merge, and a red or missing check blocks the merge;
+- force-pushes and branch deletion blocked, so a released tag's history cannot be rewritten;
+- no mandatory approvals and no CODEOWNERS gate. With one maintainer, self-merge is the workflow;
+  what replaces the second approval is the four-line PR body for the two-key paths in
+  [CONTRIBUTING.md](CONTRIBUTING.md#landing-changes).
+
+Rationale, the enforcement boundary (server-side protection is not a plugin feature) and the list of
+what the setting does **not** buy are in
+[docs/operations/security.md](docs/operations/security.md#repository-protection). Verify the setting:
+
+```bash
+gh api repos/louifinn/dsh-tower/branches/main/protection \
+  --jq '{checks: .required_status_checks.contexts, strict: .required_status_checks.strict,
+         admins: .enforce_admins.enabled, force_push: .allow_force_pushes.enabled,
+         deletions: .allow_deletions.enabled, reviews: .required_pull_request_reviews}'
+```
+
 ## Reporting
 
 Please do **not** publish exploit details in a public issue. Open a minimal issue titled `security: request private contact` describing only the impact category (for example “merge gate bypass”), and a maintainer will arrange a private channel. Include the affected version and, if possible, a minimal reproduction in the private follow-up.

package/adapters/default.js

@@ -0,0 +1,10 @@
+// Default composition root for Tower dependencies (#50).
+import * as store from '../lib/store.js'
+import * as vcs from '../lib/git.js'
+
+export const defaultDeps = {
+  store,
+  vcs,
+  clock: { now: () => Date.now() },
+  ids: { uuid: () => crypto.randomUUID() },
+}

package/adapters/store-fs.js

@@ -0,0 +1,6 @@
+// The only lib/ module that imports node:fs (#50).
+import fs from 'node:fs'
+import fsp from 'node:fs/promises'
+
+const { createWriteStream } = fs
+export { fs, fsp, createWriteStream }

package/adapters/vcs-git.js

@@ -0,0 +1,4 @@
+// The only lib/ module that imports node:child_process (#50).
+import { execFile, spawn } from 'node:child_process'
+
+export { execFile, spawn }

package/app/batch.js

@@ -0,0 +1,79 @@
+// Batch use cases.
+import { TowerToolError } from '../domain/errors.js'
+import { withLock, writeJsonAtomic, appendJsonl } from '../lib/store.js'
+import { validateState } from '../domain/state.js'
+import { validateCreate as validateBatchCreate, validateClose as validateBatchClose } from '../domain/batch.js'
+import {
+  nextBatchId,
+  createBatchRecord,
+  closeBatchRecord,
+  abandonBatchCheck,
+  applyBatchAbandon,
+  batchStatusPayload,
+} from '../domain/collab/batch.js'
+
+function fail(message, code = 'batch-invalid') {
+  throw new TowerToolError(code, message)
+}
+
+export async function createBatch(tower, input = {}, actor = 'tower') {
+    return withLock(tower.paths, async () => {
+      const state = await tower.load()
+      const normalized = validateBatchCreate(state, input)
+      if (!Array.isArray(state.batches)) state.batches = []
+      const batch = createBatchRecord(nextBatchId(state.batches), normalized, actor, Date.now())
+      state.batches.push(batch)
+      state.revision += 1
+      state.updatedAt = batch.createdAt
+      validateState(state, tower.paths.state)
+      await writeJsonAtomic(tower.paths.state, state)
+      await appendJsonl(tower.paths.activity, {
+        at: batch.createdAt,
+        type: 'batch',
+        text: `created ${batch.id}: ${batch.missionIds.join(', ')}`,
+      })
+      return batch
+    })
+  }
+
+  export async function closeBatch(tower, batchId, options = {}, actor = 'tower') {
+    return withLock(tower.paths, async () => {
+      const state = await tower.load()
+      const batch = (state.batches ?? []).find((entry) => entry.id === batchId)
+      if (!batch) fail(`unknown batch "${batchId}"`)
+      const result = validateBatchClose(state, batch, { ...options, state })
+      const blockers = Array.isArray(result.blockers) ? result.blockers : []
+      if (blockers.length > 0) return { ok: false, batch, blockers, checks: result.checks ?? [] }
+      closeBatchRecord(batch, options, actor, Date.now())
+      state.revision += 1
+      state.updatedAt = batch.closedAt
+      validateState(state, tower.paths.state)
+      await writeJsonAtomic(tower.paths.state, state)
+      await appendJsonl(tower.paths.activity, { at: batch.closedAt, type: 'batch', text: `closed ${batch.id}` })
+      return { ok: true, batch, blockers: [], checks: result.checks ?? [] }
+    })
+  }
+
+  /** @param {string} batchId @param {string} [actor] @param {string | null} [reason] */
+  export async function abandonBatch(tower, batchId, actor = 'tower', reason = null) {
+    return withLock(tower.paths, async () => {
+      const state = await tower.load()
+      const batch = (state.batches ?? []).find((entry) => entry.id === batchId)
+      if (!batch) fail(`unknown batch "${batchId}"`)
+      const { alreadyAbandoned } = abandonBatchCheck(batch, batchId)
+      if (alreadyAbandoned) return { ok: true, batch, alreadyAbandoned: true }
+      const now = Date.now()
+      applyBatchAbandon({ batch, actor, reason, now })
+      state.revision += 1
+      state.updatedAt = batch.abandonedAt
+      validateState(state, tower.paths.state)
+      await writeJsonAtomic(tower.paths.state, state)
+      await appendJsonl(tower.paths.activity, { at: batch.abandonedAt, type: 'batch', text: `abandoned ${batch.id}` })
+      return { ok: true, batch, alreadyAbandoned: false }
+    })
+  }
+
+  export async function batchStatus(tower, batchId) {
+    const state = await tower.load()
+    return batchStatusPayload(state, batchId)
+  }