iterate-plugin 2.12.2 → 3.2.1

package/README.md

@@ -1,7 +1,7 @@
 # iterate-plugin for DeepSeek Harness (dsh)
 
-> dsh 桌面端的 iterate 收敛面板、UI 分诊与审查闭环插件。把 iterate 生态的同一套 review/fix loop 直接搬进 dsh 界面。
-> The iterate ecosystem's convergence dashboard, triage UI, and review/fix loop, natively embedded inside the DeepSeek Harness (dsh) desktop client.
+> dsh 桌面端的 iterate 质量指挥中心 + 经验银行插件（v3.1）。把 iterate 生态的同一套 review/fix loop 直接搬进 dsh 界面，新增质量门禁、经验银行、防御事件流与原生指挥操作。
+> The iterate ecosystem's quality command center + experience bank plugin for dsh (v3.1). Natively embedded inside the DeepSeek Harness (dsh) desktop client with quality gates, experience bank, defense events stream, and native command buttons.
 
 <p align="center">
   <a href="README.md"><strong>English</strong></a> ·
@@ -61,7 +61,9 @@ dsh plugin --profile web add iterate-plugin
 
 `iterate-plugin` is the [iterate](https://github.com/jingzhao-l/iterate-skill) integration for the [DeepSeek Harness (dsh)](https://github.com/deepseek-ai/deepseek-harness) desktop client. It brings iterate's review loop (review → triage → fix → validate → converge) directly into the dsh UI, offering **autonomous closed-loop code iteration** (normal mode) and **dry-run read-only multi-round review**.
 
-Besides 13 pure-function tools, it ships a **build-free Web UI layer** (triage panel, convergence dashboard, stats card, theme skin, etc.) that plugs straight into dsh's existing UI slots. Configuration (`iterate.config.yaml` and the review dimensions) is identical across the other two components of the iterate ecosystem ([skill](https://github.com/jingzhao-l/iterate-skill) / [headless engine](https://github.com/jingzhao-l/iterate-harness)) — zero migration cost.
+**v3.1 Quality Command Center**: The plugin has been upgraded from a "passive observation panel" to an "active command center + knowledge base". New features include quality gate view, experience bank, defense events stream, native command buttons, and task_mode indicator.
+
+Besides 17 pure-function tools, it ships a **build-free Web UI layer** (convergence dashboard, triage panel, stats card, observatory panel with 10 tabs, theme skin, etc.) that plugs straight into dsh's existing UI slots. Configuration (`iterate.config.yaml` and the review dimensions) is identical across the other two components of the iterate ecosystem ([skill](https://github.com/jingzhao-l/iterate-skill) / [headless engine](https://github.com/jingzhao-l/iterate-harness)) — zero migration cost.
 
 ## Features
 
@@ -81,22 +83,28 @@ Besides 13 pure-function tools, it ships a **build-free Web UI layer** (triage p
 | Fix atomic findings only, keep architectural for later | ❌ | ✅ |
 | Breakpoint save / resume (long iterations) | ✅ | ✅ |
 
-### Tool layer
+### Tool layer (v3.1: 17 tools)
 
-- **13 registered tools**: `iterate_config` / `iterate_validate` / `iterate_decision_log` / `iterate_context` / `iterate_review` / `iterate_triage` / `iterate_fix` / `iterate_diff` / `iterate_rollback` / `iterate_checkpoint` / `iterate_status` / `iterate_history` / `iterate_prune`
+- **17 registered tools** (14 original + 3 v3.1 quality command center tools):
+  - Original: `iterate_config` / `iterate_validate` / `iterate_decision_log` / `iterate_context` / `iterate_review` / `iterate_triage` / `iterate_fix` / `iterate_diff` / `iterate_rollback` / `iterate_checkpoint` / `iterate_status` / `iterate_history` / `iterate_prune` / `iterate_transcript`
+  - v3.1/v3.2: `iterate_experience` (list/search/get/**add**) / `iterate_quality_gate` (read/**compute**) / `iterate_defense_events` (list/counts/**record**)
 - **Findings triage loop**: review → UI triage (y/n/a) → `iterate_triage` writes back `known_intentional` → auto-filtered next round
 - **Structured fix system**: each fix backs up first, writes a registry entry, records the diff; a failed validation can be reverted with `iterate_rollback`
 - **Breakpoint resume**: checkpoints saved at the start of each round; interrupted long iterations can resume
 - **History audit**: `iterate_history` reads the decision log (filtered by type / time / count) and the fix registry summary to audit run process and fix details
 - **Runtime cleanup**: `iterate_prune` removes stale decision-log entries, stale checkpoints, orphaned fix backups and empty rounds; dry-run by default (report-only), real cleanup requires `dryRun:false`, and every cleanup is logged
 - **Config read / write**: `iterate_config` supports validated, backed-up, rollback-capable partial writes
+- **v3.1/v3.2 Experience Bank**: `iterate_experience` queries historical fixes and patterns with search/filter/adopt, and can persist new verified fixes (`add`) — re-adding the same pattern+dimension bumps its hit count instead of duplicating it
+- **v3.1/v3.2 Quality Gate**: `iterate_quality_gate` reads quality gate status with dimension convergence rates and PASS/FAIL, and can recompute + persist a fresh certificate (`compute`) from this round's findings/validation results (real convergence from `findingsByRound`)
+- **v3.1/v3.2 Defense Events**: `iterate_defense_events` queries defense events (precondition failures, rollbacks, invariant violations, assumption falsifications) and can `record` new ones; readable labels follow the project language (en/zh)
 
-### UI layer (build-free client slots)
+### UI layer (build-free client slots, v3.1: 10 tabs)
 
 | UI component | Mounted slot | Function |
 | --- | --- | --- |
-| ConvergenceDashboard | `conversation.input.dock` | Live round progress bar, severity stats, dimension badges, trend mini-chart above the input; normal mode also shows fix-count badges |
-| TriagePanel | `conversation.chat.turnTail` | Per-finding y/n/a triage, filtering, batch (incl. select-all), keyboard shortcuts, localStorage persistence, copy-YAML / apply-instruction |
+| ConvergenceDashboard | `conversation.input.dock` | Live round progress bar, severity stats, dimension badges, trend mini-chart above the input; normal mode also shows fix-count badges; plus a live workflow-phase chip (current phase + running/stopped); **v3.1: task_mode indicator (code/iterate)** |
+| ObservatoryPanel | `conversation.input.dock` | **Ten-tab** runtime observatory below the input: live activity stream (type filter), review threads (expand/collapse all), convergence trend, finding locations (severity/dimension/search filter), fixes + rollback, checkpoint resume, decision timeline (type/round filter + search); **v3.1: Quality Gate (F8)**, **Experience Bank (F9)**, **Defense Events (F10)**; one-click export of all observatory data to JSON (download, copy fallback) |
+| TriagePanel | `conversation.chat.turnTail` | Per-finding y/n/a triage, filtering, batch (incl. select-all), keyboard shortcuts, localStorage persistence, copy-YAML / apply-instruction; **v3.1: Native command buttons (approve architectural fix, trigger new round, rollback to checkpoint)** |
 | StatsCard | `conversation.chat.turnTail` | When no findings remain: convergence stats, round history table, trend chart, completion summary |
 | iterate theme skin | `theme.overrideTokens` | Warm-amber 13-dsw-token override, light/dark modes, togglable in settings |
 | ProgressCapsule | `shell.overlay` | Popup notification on each round completion / convergence (incl. convergence confirm) |
@@ -211,7 +219,7 @@ validation:
 
 > The config can be read and **validated-partially-written** via `iterate_config` (auto backup, auto rollback on write failure).
 
-## Registered tools (13)
+## Registered tools (v3.1: 17)
 
 | Tool | Function |
 | --- | --- |
@@ -228,6 +236,10 @@ validation:
 | `iterate_status` | Summarize current iteration state: mode, current/last round, fixes applied, remaining architectural, decision-log entry count, whether a checkpoint exists |
 | `iterate_history` | Read iteration history (read-only): decision-log entries (filter by `type` / `since` / `limit`, default latest 50, cap 200) + fix-registry summary (per-round fixed/failed counts). For auditing the run, tracing logs, and inventorying fixes |
 | `iterate_prune` | Clean runtime artifacts: stale decision-log entries (by `retainDays`, default 30), stale checkpoints, orphaned fix backups, empty rounds. Dry-run by default (report-only); real cleanup with `dryRun:false`, each cleanup logged |
+| `iterate_transcript` | Runtime observatory: persist review transcripts, threads, fixes, and nudge directions to `.iterate/transcript.json` for the client observatory |
+| `iterate_experience` | **v3.1/v3.2** Query the experience bank (list/search/get), or `add` a new verified fix: re-adding the same pattern+dimension bumps its hit count instead of duplicating it. Persists to `.iterate/experience.json` |
+| `iterate_quality_gate` | **v3.1/v3.2** Read the quality certificate (`read`), or recompute + persist a fresh one (`compute`) from findings, validation results, `findingsByRound`, and `fixedByDimension`. Real per-dimension convergence rates |
+| `iterate_defense_events` | **v3.1/v3.2** Query defense events (list/counts), or `record` a new one. Human-readable labels follow the project language (en/zh) |
 
 ## Runtime artifact layout
 
@@ -239,6 +251,9 @@ All runtime state lives under `.iterate/` at the project root (can be excluded v
   checkpoint.json         # iteration breakpoint (resume)
   transcript.json         # runtime-observatory manifest (per-reviewer threads, trend, fixes, timeline, nudge)
   transcript-live.ndjson  # append-only near-real-time reviewer-activity feed (read/fix/rollback/validate…), byte-capped
+  experience.json         # v3.1: experience bank (historical fixes and patterns, accumulated across sessions)
+  quality-gate.json       # v3.1: quality gate snapshot (dimension convergence, verification pass rates, PASS/FAIL)
+  defense-events.json     # v3.1: defense events stream (precondition failures, rollbacks, invariant violations, assumption falsifications)
   fixes/
     registry.json         # fix registry (list of FixRecords, grouped by round)
     <fix-id>_<ts>.bak     # original file backup before each fix
@@ -248,11 +263,12 @@ All runtime state lives under `.iterate/` at the project root (can be excluded v
 
 The plugin follows dsh's "everything-is-a-plugin" architecture:
 
-- **Does exactly two things**: injects the system prompt teaching the model the iterate workflow + registers 13 pure-function tools
+- **Does exactly two things**: injects the system prompt teaching the model the iterate workflow + registers 17 pure-function tools
 - **All orchestration runs through dsh native `workflow` + `agent` + `parallel`**
 - **Core logic is entirely pure functions** (dedupe / filter / sort / converge / meta-audit / diff computation / history filtering / cleanup reporting) — unit-testable, no I/O
 - **Security model**: file writes confined to the resolved project root (path-traversal protection); always back up before writing, roll back on failure; config writes also back up + roll back; `iterate_prune` is dry-run by default and only clears artifacts under `.iterate/` with every cleanup logged; `iterate_fix` caps content length and `iterate_triage` caps entry count to fend off abnormal oversized payloads
 - **Build-free UI**: `lib/client.js` uses a `React.createElement` tree + injected `<style>` tags, all colors via `--dsw-*` tokens, degrading gracefully when a service is missing
+- **v3.1 Quality Command Center**: extends the plugin from "passive observation panel" to "active command center + knowledge base" with quality gates, experience bank, defense events, and native command buttons
 - Follows the iterate skill's design principles: deterministic convergence, auditable, least privilege
 
 ## Running the tests
@@ -266,8 +282,8 @@ npm test
 
 All tests pass:
 
-- **212 unit tests green**, type-check clean
-- Coverage: dedupe, filter, sort, multi-round convergence, meta-review audit, path safety, timeout clamping, config read/write + rollback, triage merge, diff computation, checkpoint validation, fix registry, history read + filter, prune cleanup report + dry-run semantics, UI pure functions (select-all key, runtime status guide).
+- **426 unit tests green**, type-check clean
+- Coverage: dedupe, filter, sort, multi-round convergence, meta-review audit, path safety, timeout clamping, config read/write + rollback, triage merge, diff computation, checkpoint validation, fix registry, history read + filter, prune cleanup report + dry-run semantics, UI pure functions (select-all key, runtime status guide), **v3.1: experience bank, quality gate, defense events**.
 
 ## ⚠️ Disclaimer
 

package/README.zh-CN.md

@@ -95,7 +95,8 @@ dsh plugin --profile web add iterate-plugin
 
 | UI 组件 | 挂载槽位 | 功能 |
 |---------|---------|------|
-| 收敛看板 `ConvergenceDashboard` | `conversation.input.dock` | 输入框上方实时显示轮次进度条、严重度统计、维度徽章、趋势迷你图，normal 模式另显示修复计数徽章 |
+| 收敛看板 `ConvergenceDashboard` | `conversation.input.dock` | 输入框上方实时显示轮次进度条、严重度统计、维度徽章、趋势迷你图，normal 模式另显示修复计数徽章；并显示运行阶段芯片（当前工作流阶段 + 运行中/已结束） |
+| 运行时观测台 `ObservatoryPanel` | `conversation.input.dock` | 输入框下方七个标签页：实时活动流（支持按活动类型筛选）、审查线程（支持全部展开/全部收起）、收敛趋势、发现定位（支持按严重度/维度/关键词筛选）、修复与回滚、断点恢复、决策时间线（支持按类型/轮次筛选与关键词搜索）；支持一键导出全部观测数据为 JSON（优先下载，失败回退复制） |
 | Findings 分诊面板 `TriagePanel` | `conversation.chat.turnTail` | 逐条 y/n/a 判定，支持筛选、批量（含一键全选所有 findings）、键盘快捷键、localStorage 持久化、复制 YAML/应用指令 |
 | 收敛统计卡片 `StatsCard` | `conversation.chat.turnTail` | 无 findings 时显示收敛统计、历史轮次表、趋势图、完成摘要 |
 | iterate 主题皮肤 | `theme.overrideTokens` | 暖琥珀配色的 13 个 dsw token 覆盖，明暗双模式，可在设置页开关 |

package/dist/approval-gate.js

@@ -46,12 +46,26 @@ function describe(toolName, arguments0) {
  * deployments, and for any non-iterate tool.
  */
 export function decideApproval(execution, policy) {
-    const name = typeof execution?.name === 'string' ? execution.name : '';
+    // Defensive reads: a hostile/proxied execution object must degrade to "not
+    // our tool" (allow) rather than throw inside the gate.
+    let name = '';
+    try {
+        name = typeof execution?.name === 'string' ? execution.name : '';
+    }
+    catch {
+        name = '';
+    }
     if (!name)
         return { kind: 'allow' };
     if (!DESTRUCTIVE_TOOLS.has(name))
         return { kind: 'allow' };
-    const rawArgs = execution.arguments;
+    let rawArgs;
+    try {
+        rawArgs = execution.arguments;
+    }
+    catch {
+        rawArgs = undefined;
+    }
     const args = rawArgs && typeof rawArgs === 'object' && !Array.isArray(rawArgs)
         ? rawArgs
         : {};

package/dist/config-loader.js

@@ -191,6 +191,11 @@ export function validateConfig(config) {
  */
 export function resolveProjectRoot(input, sessionCwd) {
     const raw = (input ?? '').trim();
+    // A NUL byte can never name a real path and makes `resolve()` (and every
+    // downstream fs call) throw — treat it as unsafe input, not a throw path.
+    if (raw.includes('\0')) {
+        return { ok: false, reason: 'Refusing project root containing NUL bytes.' };
+    }
     const root = raw ? resolve(raw) : resolve(effectiveCwd(sessionCwd));
     if (!root || root === sep) {
         return { ok: false, reason: 'Refusing filesystem root as project root.' };

package/dist/git-scope.js

@@ -29,6 +29,64 @@ import { join } from 'node:path';
  * NUL is present (callers that did not pass -z) fall back to newline-split
  * with C-style quote/escape unescaping for core.quotePath output.
  */
+/**
+ * Decode the quoted body of a git core.quotePath output line into the real
+ * filename bytes, then interpret them as UTF-8.
+ *
+ * Single-pass and escape-atomic: each `\` consumes exactly one escape (\" \\
+ * \t \n or a 3-digit octal for a raw byte), so a literal `\\303` in a filename
+ * (escaped backslash + literal "303") is decoded as the byte `\` followed by
+ * ASCII "303" rather than as the single byte 0xC3. Ordinary characters in the
+ * quoted body are ASCII (git always octal-escapes non-ASCII bytes), so they map
+ * 1:1 to bytes.
+ */
+function decodeQuotedPath(content) {
+    const bytes = [];
+    let i = 0;
+    while (i < content.length) {
+        const ch = content[i];
+        if (ch !== '\\') {
+            bytes.push(ch.charCodeAt(0));
+            i++;
+            continue;
+        }
+        const next = content[i + 1];
+        if (next === '"') {
+            bytes.push(0x22);
+            i += 2;
+        }
+        else if (next === '\\') {
+            bytes.push(0x5c);
+            i += 2;
+        }
+        else if (next === 't') {
+            bytes.push(0x09);
+            i += 2;
+        }
+        else if (next === 'n') {
+            bytes.push(0x0a);
+            i += 2;
+        }
+        else if (next !== undefined && next >= '0' && next <= '7') {
+            const oct = content.slice(i + 1, i + 4);
+            if (oct.length === 3 && /^[0-7]{3}$/.test(oct)) {
+                bytes.push(parseInt(oct, 8));
+                i += 4;
+            }
+            else {
+                // Malformed octal — keep the backslash literally.
+                bytes.push(0x5c);
+                i++;
+            }
+        }
+        else {
+            // Unknown escape — keep the backslash literally.
+            bytes.push(0x5c);
+            i++;
+        }
+    }
+    return Buffer.from(bytes).toString('utf-8');
+}
 export function parseChangedFiles(stdout) {
     if (stdout.includes('\0')) {
         return stdout.split('\0').map((s) => s.trim()).filter((s) => s.length > 0);
@@ -38,16 +96,12 @@ export function parseChangedFiles(stdout) {
         .map((line) => {
         const trimmed = line.trim();
         // git core.quotePath wraps paths with special characters in "..."; the
-        // content uses C-style escapes (\" \\ \t \n and \ooo octal for non-ASCII).
+        // content uses C-style escapes (\" \\ \t \n) and \ooo octal escapes for
+        // non-ASCII bytes (which are raw UTF-8 BYTES, not Latin-1 code points).
         const quoted = trimmed.match(/^"(.*)"$/);
         if (!quoted)
             return trimmed;
-        return quoted[1]
-            .replace(/\\"/g, '"')
-            .replace(/\\\\/g, '\\')
-            .replace(/\\t/g, '\t')
-            .replace(/\\n/g, '\n')
-            .replace(/\\([0-7]{3})/g, (_m, oct) => String.fromCharCode(parseInt(oct, 8)));
+        return decodeQuotedPath(quoted[1]);
     })
         .filter((line) => line.length > 0);
 }

package/dist/index.js

@@ -2,13 +2,16 @@
  * iterate-plugin — dsh plugin for the iterate autonomous closed-loop workflow
  *
  * Architecture:
- * - The plugin registers 14 tools (config, validate, decision-log, context, review,
- *   triage, fix, diff, rollback, checkpoint, status, history, prune, transcript)
+ * - The plugin registers 17 tools (14 original + 3 v3.0 quality command center tools)
+ *   Original: config, validate, decision-log, context, review, triage, fix, diff,
+ *   rollback, checkpoint, status, history, prune, transcript
+ *   v3.0: experience, quality_gate, defense_events
  * - The plugin injects a system prompt section teaching the iterate workflow pattern
  * - The model (prompted by the skill) writes a workflow script using dsh's `workflow` tool
  * - The workflow script uses `agent()` / `parallel()` / `phase()` / `log()` to orchestrate
- * - Subagents use the 14 tools to do real work (read config, run validation, log decisions,
- *   review, triage, apply/rollback/fixing, checkpoint, status, history, prune, transcript)
+ * - Subagents use the 17 tools to do real work (read config, run validation, log decisions,
+ *   review, triage, apply/rollback/fixing, checkpoint, status, history, prune, transcript,
+ *   query experience bank, check quality gates, query defense events)
  * - A `tools/pre-execute` hook gates destructive iterate calls behind human approval
  *   (F8 observatory approval policy: ask / deny / allow).
  *
@@ -20,7 +23,7 @@
  *
  * Key files:
  * - src/index.ts      — Plugin entry: register tools + inject skill prompt
- * - src/tools/        — 13 tool implementations + meta-review/review engines
+ * - src/tools/        — 17 tool implementations (14 original + 3 v3.0)
  * - src/config-loader.ts — YAML config loading
  * - src/types.ts     — Shared types
  */
@@ -35,13 +38,16 @@ import { registerCheckpointTool, registerStatusTool } from "./tools/checkpoint.j
 import { registerHistoryTool } from "./tools/history.js";
 import { registerPruneTool } from "./tools/prune.js";
 import { registerTranscriptTool } from "./tools/transcript.js";
+import { registerExperienceBankTool } from "./tools/experience-bank.js";
+import { registerQualityGateTool } from "./tools/quality-gate.js";
+import { registerDefenseEventsTool } from "./tools/defense-events.js";
 import { registerSessionHooks } from "./session-hooks.js";
 import { registerLiveCapture } from "./live.js";
 import { ITERATE_SKILL_PROMPT } from "./skill-prompt.js";
 export const name = 'iterate-plugin';
 export const inject = ['tools', 'systemPrompt'];
 export function apply(ctx) {
-    // 1. Register the 14 tools
+    // 1. Register the 17 tools (14 original + 3 v3.0)
     registerConfigTool(ctx);
     registerValidateTool(ctx);
     registerDecisionLogTool(ctx);
@@ -56,6 +62,10 @@ export function apply(ctx) {
     registerHistoryTool(ctx);
     registerPruneTool(ctx);
     registerTranscriptTool(ctx);
+    // v3.0: Quality Command Center tools
+    registerExperienceBankTool(ctx);
+    registerQualityGateTool(ctx);
+    registerDefenseEventsTool(ctx);
     // 2. Wire the observatory approval gate onto dsh's tools/pre-execute waterfall,
     //    and the live reviewer-activity feed onto tools/result.
     registerSessionHooks(ctx);

package/dist/session-hooks.js

@@ -32,17 +32,36 @@ import { decideApproval, isDestructiveIterateTool } from "./approval-gate.js";
  * Returns a dsh `PreToolDecision` so the caller can short-circuit the caller.
  */
 export function gateDecision(exec) {
-    // Importing the decision, and only inspecting our own tools, keeps unrelated
-    // tooling untouched. Anything we cannot classify is allowed by default.
-    if (!isDestructiveIterateTool(exec.name))
+    // Defensively read the tool name: an exec handed to the waterfall is an
+    // ordinary object, but a hostile/proxied exec must degrade to "not our tool"
+    // (allow) instead of throwing before classification. The gate only ever
+    // inspects iterate tools, so an unreadable name also must not alter
+    // unrelated tooling.
+    let name = '';
+    try {
+        name = exec?.name ?? '';
+    }
+    catch {
+        name = '';
+    }
+    if (!isDestructiveIterateTool(name))
         return { kind: 'allow' };
     // Resolve the project root (use the call's own `path` arg, else the agent's
     // session cwd) to read the effective observatory policy.
-    const argPath = typeof exec.arguments === 'object' && exec.arguments && !Array.isArray(exec.arguments)
-        && typeof exec.arguments.path === 'string'
-        ? exec.arguments.path
-        : undefined;
-    const sessionCwd = exec.agent?.session?.header?.cwd;
+    let argPath;
+    let sessionCwd;
+    try {
+        const args = exec?.arguments;
+        if (args && typeof args === 'object' && !Array.isArray(args)) {
+            const p = args.path;
+            if (typeof p === 'string')
+                argPath = p;
+        }
+        sessionCwd = exec?.agent?.session?.header?.cwd;
+    }
+    catch {
+        // hostile/proxied exec — fall through with both undefined (defaults to ask)
+    }
     const resolved = resolveProjectRoot(argPath, sessionCwd);
     let policy = 'ask';
     if (resolved.ok) {
@@ -67,13 +86,19 @@ export function gateDecision(exec) {
  */
 export function registerSessionHooks(ctx) {
     ctx.on('tools/pre-execute', (exec, next) => {
-        // Never let a throwing gate break the pipeline — degrade to allow.
+        // Fail-safe: a throwing gate must never fail OPEN. Degrade to `ask` so a
+        // destructive call still routes through human consent instead of running
+        // via `next()`'s allow default (matches the header's documented contract).
         let decision;
         try {
             decision = gateDecision(exec);
         }
-        catch {
-            return next();
+        catch (err) {
+            console.warn('[iterate] approval gate failed; degrading to ask.', err);
+            return Promise.resolve({
+                kind: 'ask',
+                reason: 'iterate approval gate unavailable — require consent',
+            });
         }
         if (decision.kind === 'ask') {
             // Delegate the actual human-consent prompt + audit to dsh's approval

package/dist/skill-prompt.js

@@ -23,6 +23,9 @@ You have the iterate plugin installed, which registers these tools:
 - \`iterate_history\` — inspect the runtime state in detail: decision-log entries and applied fixes (optionally scoped to a round or a fixed file)
 - \`iterate_prune\` — remove stale runtime artifacts (\`.iterate/\` entries). Defaults to a read-only dry-run that reports what WOULD be removed; pass \`dryRun:false\` to actually prune.
 - \`iterate_transcript\` — runtime observatory file (\`.iterate/transcript.json\`). \`read\` fetches the persisted manifest including any steering \`nudge\` for this run's reviewers; \`capture\` (call once after the final report) persists the per-reviewer threads, convergence trend, findings, fixes, checkpoint, and timeline so the client observatory panel reflects the run; \`nudge\` sets/clears steering text the next round's reviewers read. Purely local, never touches source files.
+- \`iterate_experience\` — experience bank (\`.iterate/experience.json\`): \`list\`/\`search\`/\`get\` recall verified fixes and patterns from past sessions (read the bank before fixing so proven fixes are applied first); \`add\` records a new verified fix — re-adding the same pattern+dimension bumps its hit count instead of duplicating it.
+- \`iterate_quality_gate\` — quality certificate: \`read\` loads the persisted dimension convergence rates / verification pass rate / PASS-FAIL status; \`compute\` recomputes a fresh snapshot from this round's findings + validation results (supply \`findingsByRound\` for real convergence) and persists it to \`.iterate/quality-gate.json\`.
+- \`iterate_defense_events\` — defense event stream (\`.iterate/defense-events.json\`): \`list\`/\`counts\` review precondition failures, rollbacks, invariant violations, and falsified assumptions; \`record\` logs a new event when a defense fires. Human-readable labels follow the project \`language\` (en/zh).
 
 ### When to use
 When the user asks to review or iterate on the project (e.g. "review this project", "iterate on error handling", "check the codebase for issues", "dry-run review", "反复审查"), run an iterate **workflow** by calling the \`workflow\` tool.

package/dist/tools/decision-log.js

@@ -57,7 +57,7 @@ export function appendDecisionEntry(projectRoot, entry) {
         appendFileSync(filePath, line, 'utf-8');
     }
     catch (err) {
-        return { count: -1, path: join(projectRoot, LOG_DIR, LOG_FILE), error: `failed to append decision log: ${String(err)}` };
+        return { count: 0, path: join(projectRoot, LOG_DIR, LOG_FILE), error: `failed to append decision log: ${String(err)}` };
     }
     // Count entries
     let count = 0;
@@ -202,6 +202,15 @@ export function registerDecisionLogTool(ctx) {
                     data,
                 };
                 const result = appendDecisionEntry(projectRoot, entry);
+                if (result.error) {
+                    return {
+                        operation: 'append',
+                        success: false,
+                        entryCount: 0,
+                        logPath: result.path,
+                        error: result.error,
+                    };
+                }
                 return {
                     operation: 'append',
                     success: true,