tech-lead-skill 5.5.2 → 5.5.4

package/README.md

@@ -58,6 +58,8 @@ dsh plugin --profile headless add dsh-themis
 
 22 registered entry points in a single artifact: 21 read-only governance tools plus a capability-discovery tool (`tech_lead_capabilities`) that lists only what this bundle actually registers (the original nine audits plus context validation, evidence graph/freshness analysis, progress decisions, critical-path/impact analysis, resume reconciliation, gate planning/aggregation/reopen checks, and mutation preview). Tools compute over caller-supplied JSON only — no filesystem writes, no subprocesses, no network access. The earlier split packages (`dsh-tech-lead-{core,plugin,bundle}`) are deprecated in favor of this one. Source checkouts remain supported: build via `node scripts/build-market-package.mjs` then `dsh plugin add packages/dsh-themis`. The root npm package distributes the skill and installer only.
 
+**Two artifacts, one rulebook:** `tech-lead-skill` is the conservative, broadly-compatible prose spec — install it into any agent environment (opencode, Claude Code, Codex) and nothing else is required. **`dsh-themis` is the DSH-plugin specialized edition**: the same judgment layer plus a machine-checked read-only runtime — schema-declared `protocolJson` negotiation on all 22 tools (bare legacy by default, explicit v1/v2 envelopes, fail-closed on unknown selections), one-way state→context-v2 projection that never invents identity or provenance, strict/compat input handling, and stable v2 envelopes (`findings`, `guidance`, `meta.complete`, `meta.outputProtocol`).
+
 ```bash
 dsh plugin --profile headless add /path/to/tech-lead-skill/packages/dsh-themis
 dsh --profile headless --dump-config   # verify the tech-lead-tools row is present
@@ -148,6 +150,6 @@ The executable skill body (`SKILL.md`) is authored in Simplified Chinese; coding
 
 ## Version
 
-Current version: `v5.5.2`.
+Current version: `v5.5.4`.
 
 See [`docs/TECHNICAL_GUIDE.md`](docs/TECHNICAL_GUIDE.md) for the full operating model and [`docs/AUDIT_REPORT.md`](docs/AUDIT_REPORT.md) for the publication audit.

package/README.zh-CN.md

@@ -58,6 +58,8 @@ dsh plugin --profile headless add dsh-themis
 
 单包注册 22 个入口：21 个只读治理工具（原九项审计＋上下文校验、证据图/新鲜度分析、推进决策、关键路径/影响分析、续跑对账、Gate 计划/聚合/重开、变更预览）＋能力发现工具 `tech_lead_capabilities`（只列出本包实际注册的工具）。仅对调用方传入的 JSON 做计算——无文件写入、无子进程、无网络访问。旧拆分包（`dsh-tech-lead-{core,plugin,bundle}`）已弃用并指向本包。源码安装：`node scripts/build-market-package.mjs` 装配后 `dsh plugin add packages/dsh-themis`。根 npm 包只发布技能与安装器。
 
+**两个产物，同一套规范：** `tech-lead-skill` 是保守、广泛兼容的纯文本规范——装进任何 agent 环境（opencode/Claude Code/Codex）即可，无其他依赖。**`dsh-themis` 是 DSH 插件专项优化版**：同样的判断层外加机器可校验的只读运行时——全部 22 工具在 schema 中声明 `protocolJson`（legacy 默认裸形态、显式请求 v1/v2 信封、未知取值 fail-closed）、state→context-v2 单向投影（身份与来源永不虚构）、strict/compat 输入兼容模式，以及稳定的 v2 信封（`findings`/`guidance`/`meta.complete`/`meta.outputProtocol`）。
+
 ```bash
 dsh plugin --profile headless add /path/to/tech-lead-skill/packages/dsh-themis
 dsh --profile headless --dump-config   # 确认 tech-lead-tools 行已注入
@@ -148,6 +150,6 @@ dsh --profile headless --dump-config   # 确认 tech-lead-tools 行已注入
 
 ## 版本
 
-当前版本：`v5.5.2`.
+当前版本：`v5.5.4`.
 
 完整运行模型见[技术指南](./docs/TECHNICAL_GUIDE.zh-CN.md)，发布审计见 [docs/AUDIT_REPORT.md](docs/AUDIT_REPORT.md)。

package/docs/AUDIT_REPORT.md

@@ -35,7 +35,7 @@ The source set was scanned for local absolute paths, passwords, API-key prefixes
 ### Structural scan
 
 - YAML frontmatter has `name: tech-lead` and a trigger description.
-- The skill version is `v5.5.2`. R8 adds one-way state→context-v2 projection (identity options mandatory), result-protocol negotiation on every tool, and the v2 wire label for strengthened envelopes; reverse projection is deferred as non-lossless (evidence/2026-08-26-r8-projection.md).
+- The skill version is `v5.5.4`. R8.1 (2026-08-26) completes the R8 public contract: protocolJson declared on all 22 tool schemas; all nine legacy bare tools negotiate with bare defaults and fail-closed envelope passthrough; inputCompatibility=compat migrates unknown context keys instead of rejecting; context_validate dispatches canonical v2 documents to validateContextV2; v2 envelopes carry findings/guidance/meta.complete plus meta.outputProtocol stamped by negotiation. one-way state→context-v2 projection (identity options mandatory), result-protocol negotiation on every tool, and the v2 wire label for strengthened envelopes; reverse projection is deferred as non-lossless (evidence/2026-08-26-r8-projection.md).
 - The eight templates referenced by the skill exist.
 - The installer validates options, requires a marker before removing any target, and records the managed package/version after installation.
 - The release-check template covers allowlist inventory, sensitive-content scanning, reference checks, scope checks, publication results, and remote verification.

package/docs/TECHNICAL_GUIDE.md

@@ -138,4 +138,4 @@ PAUSE/PIVOT/SCOPE-DOWN/STOP and gate non-pass states are valid `ok:true` analyse
 
 ## Result protocol negotiation (R8)
 
-Every tool accepts `protocolJson`: `{"outputProtocol":"legacy|tech-lead.result.v1|tech-lead.result.v2","inputCompatibility":"strict|compat"}`. Strengthened tools default to the v2 envelope; the legacy audits stay bare by default and opt into envelopes explicitly. Unsupported selections return `UNSUPPORTED_SCHEMA_VERSION`. Canonical context: `projectStateToContextV2` performs a one-way v1→v2 projection; identity/fingerprint options are mandatory (`NON_CONVERTIBLE_STATE` otherwise); reverse conversion is deferred (see docs/superpowers/evidence/2026-08-26-r8-projection.md).
+Every tool accepts `protocolJson`: `{"outputProtocol":"legacy|tech-lead.result.v1|tech-lead.result.v2","inputCompatibility":"strict|compat"}`. Strengthened tools default to the v2 envelope; all nine legacy bare-shape tools stay bare by default and negotiate on explicit request; fail-closed SCAN_INCOMPLETE envelopes always pass through untouched. `inputCompatibility:"compat"` migrates unknown top-level context keys into namespaced extensions (EXTENSION_MIGRATED warning) instead of rejecting them; strict rejects. Declared on every tool schema. Unsupported selections return `UNSUPPORTED_SCHEMA_VERSION`. Canonical v2 documents are routed through validateContextV2 by tech_lead_context_validate; gate_precheck is envelope-only since R6. Canonical context: `projectStateToContextV2` performs a one-way v1→v2 projection; identity/fingerprint options are mandatory (`NON_CONVERTIBLE_STATE` otherwise); reverse conversion is deferred (see docs/superpowers/evidence/2026-08-26-r8-projection.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tech-lead-skill",
-  "version": "5.5.2",
+  "version": "5.5.4",
   "description": "Evidence-driven planning and safe change-control skill for OpenCode-compatible agents",
   "license": "MIT",
   "repository": {

package/skill/SKILL.md

@@ -3,7 +3,7 @@ name: tech-lead
 description: 用于软件、基础设施、研究和运维中的多步、跨边界或有状态工程交付：项目规划、架构选择、跨模块实现、部署、迁移、发布、恢复、重构、长期运行与跨会话续跑。涉及不可逆/生产变更、回滚验证、真实环境对账、发布安全或项目级交付治理时优先加载，即使用户没有说“项目”或“Tech Lead”。不要仅因一次性小修复、单文件编辑、普通解释、单次测试或只读代码审查而自动加载，除非用户明确要求项目级计划或本规范。
 ---
 
-# Tech Lead · 自主演进规划与交付规范 v5.5.2
+# Tech Lead · 自主演进规划与交付规范 v5.5.4
 
 > 双层架构声明：本文件是**判断层**（自由裁量域）。其中可机械判定的不变量（Gate 前置校验、
 > 证据锚点存在性、分级判定器、状态机转换有效性）为未来 **MCP 工具化候选**——