tech-lead-skill 5.4.0 → 5.4.2

package/README.md

@@ -48,7 +48,7 @@ The installer is idempotent: repeated runs back up existing files as `*.bak-<tim
 
 ### DeepSeek Harness plugin (read-only tools)
 
-The repository also ships an opt-in DSH bundle exposing 21 read-only lifecycle tools. The original nine audit tools remain compatible, and the strengthened surface adds context validation, evidence graph/freshness analysis, progress decisions, critical-path and impact analysis, resume reconciliation, gate planning/aggregation/reopen checks, and mutation preview. The tools compute over caller-supplied JSON only — no filesystem writes, no subprocesses, no network access.
+This source repository includes an opt-in DSH bundle exposing 21 read-only lifecycle tools. The original nine audit tools remain compatible, and the strengthened surface adds context validation, evidence graph/freshness analysis, progress decisions, critical-path and impact analysis, resume reconciliation, gate planning/aggregation/reopen checks, and mutation preview. The tools compute over caller-supplied JSON only — no filesystem writes, no subprocesses, no network access. The root npm package distributes the skill and installer only; clone this repository before installing the private workspace bundle.
 
 ```bash
 dsh plugin --profile headless add /path/to/tech-lead-skill/packages/dsh-tech-lead-bundle
@@ -123,6 +123,6 @@ The executable skill body (`SKILL.md`) is authored in Simplified Chinese; coding
 
 ## Version
 
-Current version: `v5.4.0`.
+Current version: `v5.4.2`.
 
 See [`docs/TECHNICAL_GUIDE.md`](docs/TECHNICAL_GUIDE.md) for the full operating model and [`docs/AUDIT_REPORT.md`](docs/AUDIT_REPORT.md) for the publication audit.

package/README.zh-CN.md

@@ -50,7 +50,7 @@ npx github:240xu/tech-lead-skill
 
 ### DeepSeek Harness 插件（只读工具）
 
-本仓库同时提供可选 DSH bundle，暴露 21 个只读生命周期工具。原有九个审计工具保持兼容，并新增上下文校验、证据图与新鲜度分析、推进决策、关键路径与影响分析、续跑对账、Gate 计划/聚合/重开检查，以及变更预览。工具仅对调用方传入的 JSON 做计算——无文件写入、无子进程、无网络访问。
+本源码仓库提供可选 DSH bundle，暴露 21 个只读生命周期工具。原有九个审计工具保持兼容，并新增上下文校验、证据图与新鲜度分析、推进决策、关键路径与影响分析、续跑对账、Gate 计划/聚合/重开检查，以及变更预览。工具仅对调用方传入的 JSON 做计算——无文件写入、无子进程、无网络访问。根 npm 包只发布技能与安装器；DSH workspace bundle 尚未独立发布，安装前请先 clone 本仓库。
 
 ```bash
 dsh plugin --profile headless add /path/to/tech-lead-skill/packages/dsh-tech-lead-bundle
@@ -125,6 +125,6 @@ dsh --profile headless --dump-config   # 确认 tech-lead-tools 行已注入
 
 ## 版本
 
-当前版本：`v5.4.0`。
+当前版本：`v5.4.2`。
 
 完整运行模型见[技术指南](https://github.com/240xu/tech-lead-skill/blob/main/docs/TECHNICAL_GUIDE.zh-CN.md)，发布审计见 [docs/AUDIT_REPORT.md](docs/AUDIT_REPORT.md)。

package/docs/AUDIT_REPORT.md

@@ -1,7 +1,7 @@
 # Publication Audit Report
 
 Date: 2026-08-25
-Scope: public release of the `tech-lead` planning skill and its eight templates.
+Scope: public release of the `tech-lead` planning skill and its nine templates.
 
 ## Result
 
@@ -18,7 +18,7 @@ The publication set contains only the following intended artifacts:
 - `skill/templates/gate-review.md`
 - `skill/templates/gate-verdict.md`
 - `README.md` (English) / `README.zh-CN.md` (简体中文)
-- `docs/TECHNICAL_GUIDE.md` (English) / `docs/TECHNICAL_GUIDE.md (zh guide ships via GitHub only)
+- `docs/TECHNICAL_GUIDE.md` (English; Chinese README ships separately)
 - `docs/AUDIT_REPORT.md`
 - `LICENSE`
 
@@ -35,8 +35,8 @@ The source set was scanned for local absolute paths, passwords, API-key prefixes
 ### Structural scan
 
 - YAML frontmatter has `name: tech-lead` and a trigger description.
-- The skill version is `v5.4.0`.
-- The seven templates referenced by the skill exist.
+- The skill version is `v5.4.2`.
+- The nine templates referenced by the skill exist.
 - The installer validates options, requires a marker before removing any target, and records the managed package/version after installation.
 - The release-check template covers allowlist inventory, sensitive-content scanning, reference checks, scope checks, publication results, and remote verification.
 - The plan includes PLAN/EXECUTE, L0/L1/L2, protected assets, mutation protocol, E0-E4 evidence, completion levels, stagnation control, state recovery, and real-state reconciliation.
@@ -48,7 +48,7 @@ The skill defaults user data to read-only, requires a recovery path before write
 
 ## Known Limitations
 
-- Core judgment stays prose-first; a mechanical subset (state schema, evidence provenance, gate prechecks, release/install audits) is machine-checkable via @240xu/dsh-tech-lead-core and the optional DSH bundle tools.
+- Core judgment stays prose-first; the source-checkout-only DSH workspace provides 21 machine-checkable read-only tools for context, evidence, progress, gates, release/install audits, recovery, and mutation preview. The root npm tarball intentionally excludes the private workspace packages.
 - Freshness, reconciliation, and rollback verification depend on the executing environment.
 - No claim is made that the skill has completed a multi-project effectiveness trial; that is the next validation phase.
 - The audit validates publication content, not the security of the hosting platform or every consumer's local OpenCode installation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tech-lead-skill",
-  "version": "5.4.0",
+  "version": "5.4.2",
   "description": "Evidence-driven planning and safe change-control skill for OpenCode-compatible agents",
   "license": "MIT",
   "repository": {
@@ -12,6 +12,10 @@
   "bin": {
     "tech-lead-skill": "bin/install.js"
   },
+  "scripts": {
+    "test": "node tests/run-tests.js",
+    "test:composition": "node packages/dsh-tech-lead-plugin/test/composition/run.mjs"
+  },
   "files": [
     "skill/",
     "bin/",