tech-lead-skill 5.4.1 → 5.4.3

package/README.md

@@ -46,6 +46,8 @@ npx github:240xu/tech-lead-skill
 
 The installer is idempotent: repeated runs back up existing files as `*.bak-<timestamp>` first. Use `--target <dir>` to choose another destination, `--check` to verify an installed copy against the package (hash + version drift), `--dry-run` to preview without writing, and `--uninstall` to remove. Uninstall removes only manifest-managed files — user files and `*.bak-*` backups are kept.
 
+`--check` exit codes: `0` clean, `1` drift detected, `2` usage/refusal error.
+
 ### DeepSeek Harness plugin (read-only tools)
 
 This source repository includes an opt-in DSH bundle exposing 21 read-only lifecycle tools. The original nine audit tools remain compatible, and the strengthened surface adds context validation, evidence graph/freshness analysis, progress decisions, critical-path and impact analysis, resume reconciliation, gate planning/aggregation/reopen checks, and mutation preview. The tools compute over caller-supplied JSON only — no filesystem writes, no subprocesses, no network access. The root npm package distributes the skill and installer only; clone this repository before installing the private workspace bundle.
@@ -112,8 +114,8 @@ This is an engineering planning skill. It focuses on correctness of planning, sa
 
 ## Limitations
 
-- The judgment layer remains prose by design; the optional DSH bundle provides a machine-checkable, composable read-only runtime for context, evidence, progress, gates, release/install audits, recovery, and mutation preview.
-- Evidence freshness and state reconciliation are operator/agent responsibilities until dedicated tooling exists.
+- The prose judgment layer stays non-mechanical by design; only the source-checkout DSH bundle adds a machine-checkable read-only runtime for context, evidence, progress, gates, release/install audits, recovery, and mutation preview.
+- Inside the prose skill itself (without the bundle), evidence freshness and state reconciliation remain operator/agent responsibilities.
 - The skill does not provide a sandbox; untrusted code must not be executed unless an actual isolated execution environment is already available.
 - MCP candidates should be selected only after observing repeated real-project violations.
 
@@ -123,6 +125,6 @@ The executable skill body (`SKILL.md`) is authored in Simplified Chinese; coding
 
 ## Version
 
-Current version: `v5.4.1`.
+Current version: `v5.4.3`.
 
 See [`docs/TECHNICAL_GUIDE.md`](docs/TECHNICAL_GUIDE.md) for the full operating model and [`docs/AUDIT_REPORT.md`](docs/AUDIT_REPORT.md) for the publication audit.

package/README.zh-CN.md

@@ -114,8 +114,8 @@ dsh --profile headless --dump-config   # 确认 tech-lead-tools 行已注入
 
 ## 局限
 
-- 目前规则是文本形式，不是机器强制的状态机。
-- 在专用工具出现之前，证据时效与状态对账依赖执行环境与操作者。
+- 文本判断层有意保持非机械化；只有源码安装的 DSH bundle 才提供上下文、证据、推进、Gate、发布/安装审计、恢复与变更预览的可机检只读运行时。
+- 在纯文本技能形态下（无 bundle），证据时效与状态对账仍依赖执行环境与操作者。
 - 本技能不提供沙箱；除非已有真实隔离执行环境，否则不得运行不可信代码。
 - MCP 工具化候选应在观察到真实项目中反复违例之后再筛选。
 
@@ -125,6 +125,6 @@ dsh --profile headless --dump-config   # 确认 tech-lead-tools 行已注入
 
 ## 版本
 
-当前版本：`v5.4.1`。
+当前版本：`v5.4.3`。
 
-完整运行模型见[技术指南](https://github.com/240xu/tech-lead-skill/blob/main/docs/TECHNICAL_GUIDE.zh-CN.md)，发布审计见 [docs/AUDIT_REPORT.md](docs/AUDIT_REPORT.md)。
+完整运行模型见[技术指南](./docs/TECHNICAL_GUIDE.zh-CN.md)，发布审计见 [docs/AUDIT_REPORT.md](docs/AUDIT_REPORT.md)。

package/docs/AUDIT_REPORT.md

@@ -1,7 +1,7 @@
 # Publication Audit Report
 
 Date: 2026-08-25
-Scope: public release of the `tech-lead` planning skill and its nine templates.
+Scope: public release of the `tech-lead` planning skill and its eight templates.
 
 ## Result
 
@@ -35,8 +35,8 @@ The source set was scanned for local absolute paths, passwords, API-key prefixes
 ### Structural scan
 
 - YAML frontmatter has `name: tech-lead` and a trigger description.
-- The skill version is `v5.4.1`.
-- The nine templates referenced by the skill exist.
+- The skill version is `v5.4.3`.
+- The eight templates referenced by the skill exist.
 - The installer validates options, requires a marker before removing any target, and records the managed package/version after installation.
 - The release-check template covers allowlist inventory, sensitive-content scanning, reference checks, scope checks, publication results, and remote verification.
 - The plan includes PLAN/EXECUTE, L0/L1/L2, protected assets, mutation protocol, E0-E4 evidence, completion levels, stagnation control, state recovery, and real-state reconciliation.
@@ -48,7 +48,7 @@ The skill defaults user data to read-only, requires a recovery path before write
 
 ## Known Limitations
 
-- Core judgment stays prose-first; the source-checkout-only DSH workspace provides 21 machine-checkable read-only tools for context, evidence, progress, gates, release/install audits, recovery, and mutation preview. The root npm tarball intentionally excludes the private workspace packages.
+- Core judgment stays prose-first; the source-checkout-only DSH workspace provides 21 machine-checkable read-only tools for context, evidence, progress, gates, release/install audits, recovery, and mutation preview. The root npm tarball intentionally excludes the private workspace packages. The original nine tools keep their pre-envelope response shapes for backward compatibility; the twelve strengthened tools return ResultEnvelope v1 (documented in docs/superpowers/specs/2026-08-25-dsh-tech-lead-system.md §4.2).
 - Freshness, reconciliation, and rollback verification depend on the executing environment.
 - No claim is made that the skill has completed a multi-project effectiveness trial; that is the next validation phase.
 - The audit validates publication content, not the security of the hosting platform or every consumer's local OpenCode installation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tech-lead-skill",
-  "version": "5.4.1",
+  "version": "5.4.3",
   "description": "Evidence-driven planning and safe change-control skill for OpenCode-compatible agents",
   "license": "MIT",
   "repository": {
@@ -13,7 +13,8 @@
     "tech-lead-skill": "bin/install.js"
   },
   "scripts": {
-    "test": "node tests/run-tests.js"
+    "test": "node tests/run-tests.js",
+    "test:composition": "node packages/dsh-tech-lead-plugin/test/composition/run.mjs"
   },
   "files": [
     "skill/",
@@ -34,11 +35,9 @@
     "agent",
     "tech-lead"
   ],
-  "workspaces": [
-    "packages/*"
-  ],
   "devDependencies": {
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.7"
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.7"
   }
 }

package/skill/SKILL.md

@@ -3,7 +3,7 @@ name: tech-lead
 description: 用于软件、基础设施、研究和运维中的多步、跨边界或有状态工程交付：项目规划、架构选择、跨模块实现、部署、迁移、发布、恢复、重构、长期运行与跨会话续跑。涉及不可逆/生产变更、回滚验证、真实环境对账、发布安全或项目级交付治理时优先加载，即使用户没有说“项目”或“Tech Lead”。不要仅因一次性小修复、单文件编辑、普通解释、单次测试或只读代码审查而自动加载，除非用户明确要求项目级计划或本规范。
 ---
 
-# Tech Lead · 自主演进规划与交付规范 v5.4.0
+# Tech Lead · 自主演进规划与交付规范 v5.4.3
 
 > 双层架构声明：本文件是**判断层**（自由裁量域）。其中可机械判定的不变量（Gate 前置校验、
 > 证据锚点存在性、分级判定器、状态机转换有效性）为未来 **MCP 工具化候选**——