- the unknown runtime schema path error now states that canonical paths
contain dots and must be a single argument while space-separated tokens
resolve as a CLI path; help text and docs only reach agents that consult
them, the error is the one surface guaranteed to be seen at failure time
- the app trust diagnostic comment is shortened to the durable constraint
(do not pin absolute Catalog-size counts) instead of narrating the change
- NewDeliveryToolSearchEngine's doc comment notes the memo serves long-lived
hosts; the shipped schema search command rebuilds per invocation through
NewDeliveryToolSearchEngineWithConfig
The diagnostic test pinned absolute counts from one Catalog generation:
1123 intent cases, Recall@5 == 990/1123, 1098 tools and the 402/721
language slices. Merging main grew the Catalog to 1121 tools, so the
population became 1147/407/740 and the test failed as a size drift
rather than as a trust regression.
- the absolute counts are removed; the observed intent, language-slice
and context values are logged for CI forensics and the headline numbers
stay in the generated comparison JSON
- identity coverage is still enforced exhaustively, but the expected
count is derived from report.Context.ToolCount instead of a literal
- the trust contract that does not move with Catalog size stays a hard
gate: every identity pass rate == 1, alias cases non-zero, all four
integrity counters == 0, zero-result rate == 0, non-empty language
slices and ReductionVsFullSchema >= 0.99
- SearchSubqueries returned a nil candidate slice on the
decomposed_exact_filtered refusal, so that one strategy encoded
"candidates":null while every other path encoded []; the refusal now
carries an empty slice and a marshal assertion pins the wire shape
- the memoized delivery engine was never invalidated: it indexes one
Catalog generation and caches its source/surface hashes, but
RegisterSchemaSourceRoot -> resetDeliverySchemaCatalogState left the
memo installed, so a re-registered root could be served stale hashes.
Catalog delivery reset now clears it, with a ForTest wrapper and a
regression test for the rebuild
- dangerous filter Unicode is rejected before the effect vocabulary and
Catalog product checks, so a control/Bidi character returns
dangerous_filter_unicode instead of being echoed back through
invalid_effect; the filter list is an ordered slice, not a map, so the
reported field name is deterministic
- dws schema help and RFC 5.8 record the path-form boundary: multi-token
args resolve as a CLI path, a canonical path must stay one argument
- --explain and ToolSearchScoreBreakdown declare that the reported score
is the raw value while ordering uses the quantized key
- --limit/--candidate-limit help state that 0 means "use the default",
which was already the behavior but read as an asymmetry against the
rejected negative values
- bootstrap seeds become named constants and are published in both
evaluation reports (bootstrap_samples/bootstrap_seed/
recovery_bootstrap_seed) so an interval is reproducible without
reading the source
- dingtalk-shared documents the cross-product summary --dry-run flag and
that its command list is a plan, not business data
typedJSONValue marshaled a typed value and then routed the result through
rawJSONValue, which runs json.Valid before decoding. On that path the input is
whatever json.Marshal has just produced, so the validation scan can only ever
succeed: it re-read every marshaled document for nothing.
The decode step is now shared by both entry points. rawJSONValue keeps its
json.Valid check, because it still accepts untrusted input, while typedJSONValue
decodes what it marshaled directly. Across the 1121-tool set this removes about a
third of the Schema Catalog projection work: the internal/app schema suite goes
from 26.0s to 17.2s uninstrumented, and from 291.1s to 241.0s under -race.
The delivered Catalog is byte-for-byte unchanged. check-generated-drift,
check-schema-catalog and check-schema-binary each regenerate the same
source_hash sha256:93b8d44eb163bd2898c78397d22af92d378e3dc4e20f56b33277b51e4342e2e6,
and the two error contracts are preserved: typedJSONValue still rejects a value
json.Marshal cannot encode, and rawJSONValue still rejects invalid JSON.
Every neighbouring string in the root help listing — service
descriptions, utility descriptions, global flag usage — is hardcoded
Chinese. Routing only the feedback label through i18n therefore rendered
it in English on any host whose LANG is not zh_*, leaving a lone English
line inside an otherwise Chinese screen.
Hardcode the label and drop the two locale entries it needed. A test
assertion now pins the Chinese label so the indirection cannot return
unnoticed.
`dws --help` now closes with a Feedback section that links the
user-experience survey form, tagged with source=dws-cli so submissions
arriving through the CLI can be told apart from other channels.
The entry is deliberately root-only: this CLI is driven mostly by AI
agents, and repeating a survey link in every subcommand help would be
pure context noise. A guard test pins that boundary.
The URL is printed on its own unwrapped line — it is longer than the
help rule width, and breaking it would stop terminals from recognizing
it as a clickable hyperlink.
Third-review fix for a CI blocker: run-platform-coverage-gate.sh only
executes ^(TestAllShortcuts|TestCrossPlatformCoverage) yet enforces 100%
coverage of changed production lines, so the TestResolveInputFlags names
left every new input.go statement reported as uncovered. Rename them to
the gate prefix, drop three unreachable pflag Set error branches that no
test could ever cover, and add the reachable stdin read-failure case.
Verified: changed code coverage 100.0000% (67 statements).
Second-review fix: explicitInputFlagName judged usability with an
unconditional TrimSpace while rawValue only trims when Trim is set. For
a non-Trim flag a whitespace main value is usable and shadows a changed
alias; the resolver could then rewrite the shadowed alias (and fail on
its @path) while the fallback chain still read the main value. Mirror
rawValue's usable() exactly and pin the shadow case with a regression
test whose alias path does not exist.
Self-review fixes: a Trim flag receiving " @path" judged usability on the
trimmed value (rawValue) while the source prefix check saw the raw value,
so the token would ship as a literal. Trim before the prefix check. Also
build the file-read error once with a conditional hint option, and pin
the default-value/env passthrough plus Trim edge with regression tests.
Port the lark-cli Flag.Input capability: a KindString flag may declare
Input sources ("file" for @path, "stdin" for -) and the framework
rewrites the explicit token into the payload content before
required/enum/constraint/Validate checks. @@value escapes to a literal
@value; a single stdin consumer per invocation is enforced; a leading
UTF-8 BOM is stripped. Shortcut.Flag gains the same declaration and the
adapter maps it through; LeafSpec inherits it via the LeafFlag alias.
Eval-driven optimizations from the 2026-08-14/15 agent evaluations:
- abstained lexical responses now carry a bounded hint naming the one
permitted verification step (dws schema <product> --compact) and
licensing the conclusion 'unsupported', so agents stop enumerating
every product to prove a capability is missing
- responses whose candidates only matched weak fields (parameters/
description, no identity/summary hit) set weak_match=true with a
matching hint; the flag is field-class based, not a score threshold,
preserving the RFC ban on absolute score cutoffs
- exact_filtered keeps its typed refusal without inheriting either hint;
budget-truncation to zero candidates downgrades to the abstain hint
- dingtalk-shared gains the matching convergence rule: one search, at
most one schema <product> verification, then conclude honestly
Evidence: the nonexistent-capability intent scenario took 15 turns/177s
to conclude 'no poll capability' with identical correctness to a 4-turn
run; these signals bound that path. Note: on the real catalog the poll
phrasing still matches summary fields of generic chat tools, so the
behavioral fix for that specific case rides on the shared-skill rule;
the wire flags cover genuinely unmatched and weak-field-only queries.
玉澜