fix(chat): prevent message search from resolving groups

docs(skill): streamline chat progressive routing
fix(chat): reconcile remote guidance contracts
2026-08-03 17:44:19 +08:00 · 2026-08-03 17:37:34 +08:00 · 2026-08-03 12:03:27 +08:00 · 2026-08-03 11:53:45 +08:00 · 2026-08-03 11:53:45 +08:00 · 2026-08-03 11:53:45 +08:00
1831 changed files with 986366 additions and 342997 deletions
@@ -1,36 +0,0 @@
-# Release fragments
-
-普通功能、修复和面向用户的行为变更不要再修改根目录 `CHANGELOG.md` 的
-`Unreleased` 区域。每个 PR 在本目录新增一个独立的 Markdown fragment，避免
-并行 PR 争用同一文件。
-
-文件名使用能唯一定位变更的短名，通常是 PR 号，例如
-`1234-chat-reply-mentions.md`。文件名必须匹配
-`^[a-z0-9][a-z0-9._-]*\.md$`，且必须是普通文件，不能是符号链接。本目录顶层
-只接受 `README.md`、`released/` 和符合该规则的 fragment：fragment 一律平铺在
-顶层，不接受任何其它子目录，本目录自身也不能被替换成文件或符号链接。其余条目
-会被 CI 直接拒绝而不是忽略，以免非法条目跳过校验后拖垮下一个 PR。文件格式
-严格如下：
-
-```markdown
---
-category: Added
---
-
- **Chat reply mentions** (#1234) — supports mentioning selected members.
-```
-
-`category` 只能是 `Added`、`Changed`、`Deprecated`、`Removed`、`Fixed` 或
-`Security`。正文至少包含一个 Markdown 列表项，且不得包含 `TODO` 或 `TBD`。
-
-发布 beta 时，`scripts/release/prepare-changelog.sh` 会按分类和文件名稳定排序，
-将未归档 fragments 汇总为唯一的版本章节，并移动到
-`.changes/released/<version>/`。beta 发布后若有新 fragments 合入并直接准备 stable，
-stable 封板会把它们追加到明确的 post-beta 小节，并归档到正式版本目录；没有新
-fragments 时仍只生成原有 beta 晋级模板。因此 release-seal PR 是唯一会修改
-`CHANGELOG.md` 的 PR；它同时归档已消费的 fragments，供审计追溯。
-归档只能在同一个 release-seal PR 中以原样移动完成；CI 会拒绝直接修改、
-删除或重写已归档文件。
-
-无需面向用户发布说明的改动不添加 fragment。评审者根据改动是否可见来判断该
-例外是否成立。
@@ -1,8 +0,0 @@
---
-category: Added
---
-
- **Agent version and extended context passthrough** (Aone 85384225) — adds
-  validated `DWS_AGENT_VER` and sensitive JSON `DWS_AGENT_EXT` metadata to
-  ordinary non-plugin MCP requests without forwarding it to A2A, OAuth,
-  Discovery, or third-party plugins.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **Chat message send help** - Clarifies Markdown image syntax for inline mixed text and images.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Drive file comments** (#961) — adds `dws drive comment list` and `dws drive comment create` for comments on ordinary preview files.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Chat automatic pagination controls** (#970) — adds bounded `--max-items` and cancellable `--page-delay` support to the core IM list shortcuts, with safe continuation metadata and truncation reporting.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **Doc/drive/wiki routing descriptions** — clarifies the document-space container-vs-content boundary across the doc, drive, and wiki skill descriptions for more predictable first-round Agent selection, without changing CLI behavior.
@@ -1,20 +0,0 @@
---
-category: Fixed
---
-
- **Drive `--latest` refuses incomplete Top-N** (#899) — `dws drive list --latest` used to
-  exit 0 with a "Top-N" computed over a partially scanned tree whenever a directory read
-  failed mid-recursion (permission denied, API error), letting an incomplete set pose as the
-  globally newest files. Truncation at the 2000-item scan cap and mid-recursion directory
-  failures now both fail closed (`LATEST_SCAN_TRUNCATED` / `LATEST_SCAN_INCOMPLETE`), report
-  the first failing folder with its depth and reason, and emit a recovery command that
-  reproduces the original candidate set — query domain, `--folder`, `--pattern`, `--type`,
-  `--start` and `--end` are all carried over. On POSIX shells each user-supplied value is
-  quoted so a URL query string or a shell metacharacter cannot change how the copied command
-  parses. On Windows no quoting form is safe for both `cmd.exe` and PowerShell, so values
-  containing metacharacters are not inlined at all: the command carries a placeholder and the
-  original value is shown on a separate line marked as data rather than an executable command.
-  Unrecoverable errors under `--latest` return the root cause instead of a partial result.
-  Remote-controlled folder names and server error text are stripped of ANSI escapes and
-  control characters before they reach the plain-text stderr message. The internal `sortTime`
-  sort key no longer leaks into `drive list --depth` output on any path.
@@ -1,12 +0,0 @@
---
-category: Added
---
-
- **Drive list type/time filtering** (#942) — `dws drive list` gains `--type
-  file|folder`, `--start`, and `--end` for client-side filtering by node type
-  and modification time on both the pan and workspace routes. Filtering runs
-  a bounded full scan of the target directory (2000-entry cap, reported via
-  `truncated=true`), composes with `--latest`/`--pattern`/`--depth`, and is
-  mutually exclusive with `--versions`/`--cursor`/`--order-by`/`--order`/
-  `--limit`. Time values accept relative forms (`24h`/`7d`/`2w`), RFC 3339,
-  zone-less ISO 8601 (Asia/Shanghai), or a plain date.
@@ -1,12 +0,0 @@
---
-category: Fixed
---
-
- **Drive list pattern filtering** (#942) — `dws drive list --pattern` on the
-  single-layer pan route now filters the returned page by name pattern; the
-  flag was previously accepted but silently ignored.
-
- **Drive list `--type folder --latest` composition** (#942) — `--latest` now
-  ranks the filtered entries (folders included when `--type folder` is set)
-  instead of unconditionally dropping folders, so the documented combination
-  returns the most recently modified folders rather than an empty list.
@@ -1,5 +0,0 @@
---
-category: Fixed
---
-
- **Chat message time defaults** (#973) — default omitted `chat message list-all` time bounds in `Asia/Shanghai` when emitting timezone-less `yyyy-MM-dd HH:mm:ss` values, matching parsing semantics and rejecting reversed windows.
@@ -1,5 +0,0 @@
---
-category: Fixed
---
-
- **Doc and Drive parameter aliases** — normalizes reviewed identifier, pagination, path, version, and role synonyms while blocking ambiguous values before dispatch.
@@ -1,15 +0,0 @@
---
-category: Added
---
-
- **Drive folder synchronization** — adds `dws drive status`, `dws drive pull`,
-  `dws drive push`, and `dws drive sync` for file-level comparison and transfer
-  between a local folder and a Drive folder. Differences come from exact MD5 by
-  default or from modification time with `--quick`; `status` is read-only, `pull`
-  and `push` are one-directional with `--if-exists skip|smart|overwrite`, and
-  `sync` is bidirectional with `--on-conflict remote-wins|local-wins|keep-both|ask`.
-  Only regular files are transferred — online documents and shortcuts are skipped,
-  neither side deletes extra files, downloads are staged through a temporary file
-  and committed with an atomic rename, and remote names that would escape
-  `--local-folder` are reported as failures instead of being written. Every command
-  prints a structured summary on stdout and exits non-zero when any item fails.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **International DingTalk region support** — adds `.io` login and MCP routing, pre-release endpoint overrides, and profile-aware gateway selection while preserving the existing `.com` flow.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **Chat identity routing** — validates explicit `openDingTalkId` inputs and improves name, `userId`, and `openDingTalkId` routing for message shortcuts.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Privacy-safe CLI telemetry** (#1009) — reports reviewed command outcomes and profile identity dimensions while excluding command arguments, output, paths, device fingerprints, and automatic system dimensions; `DO_NOT_TRACK=1` disables reporting.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Feedback survey entry in root help** (#1019) — `dws --help` now closes with a Feedback section linking the user-experience survey form.
@@ -1,7 +0,0 @@
---
-category: Changed
---
-
- **Chat IM ID flags** (#954) — standardizes chat command entry points on `--conversation-id` for conversation IDs and `--message-id` for message IDs, so help, Schema, and Agent recommendations use the same canonical flags.
- **Legacy chat flag compatibility** (#954) — keeps older chat IM ID flags such as `--group`, `--id`, `--chat`, `--open-conversation-id`, `--msg-id`, and `--open-message-id` working as compatibility aliases where applicable, while hiding migrated aliases from recommended help and Schema surfaces.
- **Chat group bots target flag** (#954) — keeps `dws chat group bots` on the visible `--group` flag; this command does not register `--group-name`, and `--group` accepts either an openConversationId or a uniquely resolved group name.
@@ -1,6 +0,0 @@
---
-category: Fixed
---
-
- **Chat card update evidence** — distinguishes an accepted update request from an independently verified visible update, preserving the real `bizId` and warning callers not to repeat an unverified write.
- **Chat command guidance** — splits message and group references by task and explains that `--from` is ambiguous between sender and time-range intent.
@@ -1,8 +0,0 @@
---
-category: Changed
---
-
- **Faster Schema Catalog assembly** — projects typed values into payload JSON
-  without re-running a validation scan over documents `json.Marshal` has just
-  produced, cutting roughly a third of the projection work across the full tool
-  set. Untrusted JSON input keeps its existing validation.
@@ -1,9 +0,0 @@
---
-category: Added
---
-
- **Wiki Shortcut workflows** — publishes 20 reviewed space, member, node, and
-  activity shortcuts with strict collection validation, cursor handling,
-  write-terminal evidence, safe read-backs where the backend supports them,
-  task-oriented routing, and documented backend
-  boundaries.
@@ -1,11 +0,0 @@
---
-category: Fixed
---
-
- **Aitable pagination and Minutes unshare verification** (#1006) — keeps
-  record queries on the service's 20-record page boundary so multi-page reads
-  and mutation readbacks no longer report false retryable failures, preserves
-  `totalCount` when supplied, validates `--dry-run` plans before transport,
-  follows active deletion readback continuations before proving absence, and
-  rejects Minutes unshare success until the listening note exists and the
-  service acknowledges the exact task and member targets.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Robot group reference replies** (#928) — `chat message send-by-bot` supports paired `--reply` and `--ref-sender` flags for Markdown replies that quote an existing group message.
@@ -1,5 +0,0 @@
---
-category: Fixed
---
-
- **Document write verification** (#960) — avoids false partial-success results when normalized Markdown, paginated blocks, inline images, or version reverts are confirmed by server readback. Document reverts and media inserts now require explicit readback evidence and report partial success when the server cannot prove the requested result.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **AI Table parameter aliases** — accepts reviewed equivalent spellings for Base, table, workflow, search, pagination, and description parameters while keeping role-changing or semantically ambiguous inputs blocked.
@@ -1,9 +0,0 @@
---
-category: Added
---
-
- **AI Table server-side statistics** — adds `dws aitable record stats` for
-  ungrouped record-set metrics through `query_records_stats`, plus `dws aitable
-  record group-stats` for grouped, distinct, and advanced aggregation through
-  `query_stats`; both commands validate their JSON aggregation contracts before
-  dispatch.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Calendar event share-info** (#980) — adds `dws calendar event share-info` to fetch a calendar event's share info (title, organizer, location, join info) for sharing with others; supports `--calendar-id` and `--language`.
@@ -1,11 +0,0 @@
---
-category: Added
---
-
- **Calendar and To-do Shortcut workflows** — aligns 47 public task-oriented
-  entries with lark-cli where the DingTalk backend supports equivalent
-  semantics, rejects malformed or missing collections instead of returning
-  false empty success, preserves truthful pagination, and requires stable
-  identifiers plus read-back or explicit terminal receipts for writes. Adds
-  deterministic contract coverage, a PII-safe live E2E runner, and a sanitized
-  capability review with documented platform boundaries.
@@ -1,5 +0,0 @@
---
-category: Fixed
---
-
- **Chat sender identity guards** — preserves unverified mixed sender inputs after exact message `senderId` matches and aligns `--sender-query` Skill guidance with fail-closed Runtime behavior.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **Doc/drive description scope** — restates the `dingtalk-doc` description as document-entity-and-content operations with an explicit exclusion list, and narrows `dingtalk-drive` to file-level management of DingTalk documents, so first-round Agent selection separates content work from file management without changing CLI behavior.
@@ -1,10 +0,0 @@
---
-category: Added
---
-
- **Doc and Sheet comment lifecycle commands** — adds `comment batch-query`,
-  `comment resolve`, `comment restore`, and the lightweight
-  `comment react-reply` to both `dws doc` and `dws sheet`. The two domains share
-  the same `doc-comment` MCP capabilities; batch queries preserve input order
-  for repeated `topicId:commentKey` references, while reaction replies require
-  DingTalk reaction names such as `憨笑` or `鼓掌` rather than raw Unicode emoji.
@@ -1,6 +0,0 @@
---
-category: Added
---
-
- **Sheet SourceRange dropdowns** — supports range-backed dropdowns across direct, cell, and batch write paths, with structured readback for valid and invalid references. Batch `set-dropdown` now rejects unsupported top-level `colors` / `source-colors`; Inline colors belong in `options[].color`, while SourceRange color writes remain unsupported.
- **Sheet read completion metadata** — documents and preserves returned ranges, truncation reasons, and partial-read status for large range and CSV reads.
@@ -1,5 +0,0 @@
---
-category: Fixed
---
-
- **Windows event bus lifecycle** — start event consumers without unsupported inherited file descriptors, stop buses through local IPC with a termination fallback, and preserve subscription cleanup when startup fails.
@@ -1,14 +0,0 @@
---
-category: Changed
---
-
- **Attendance and Mail Shortcuts** (#1045) — publishes only capabilities with
-  strict response, identity, pagination, and real-data verification while
-  retaining historical CLI discovery and argument compatibility for commands
-  that remain unavailable to agents. Mailbox auto-resolution now accepts both
-  reviewed string and object response shapes, and Attendance date ranges cover
-  the complete requested end date without dropping cross-midnight punches whose
-  actual check time is inside the requested range. The schedule query remains
-  CLI-compatible but is withheld from the Agent catalog because its downstream
-  service returns a successful process exit with a null body for both populated
-  and empty ranges.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **Chat group roles** (#1058) — exposes the single-value `--role-id` flag for assigning one custom group role while preserving hidden `--role-ids` compatibility.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **招聘职位管理** (#976) — 新增招聘职位列表、详情查询和职位创建命令。
@@ -1,6 +0,0 @@
---
-category: Fixed
---
-
- **Chat user mentions** — preserves literal `<@openDingTalkId>` tokens in current-user Markdown messages and rejects mismatches between message-body mentions and mention flags before sending.
- **Chat direct media** — uses the IM upload target field for current-user direct file, audio, and video uploads, then uses the Chat receiver field for final message delivery.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **CLI compatibility governance** — adds a reviewed two-stage path for hiding retained legacy commands or optional `NoOpt=true` boolean flags from Help and Schema when their activated capability moves to a dedicated command, with legacy-leaf, complete parameter/constant mapping, durable runtime constant evidence, protected framework bridges, dry-run preservation, parameter-collision, and fail-closed required-parameter checks.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **OA admin approval query** — `oa approval list-by-admin` queries approval instances of a template with admin scope, with simple flags and an advanced `--request` mode; `startTime`/`endTime` use `yyyy-MM-dd HH:mm:ss` strings per the 2026-08 MCP contract update (ISO-8601 flag inputs auto-convert), and pageSize/time format are validated client-side with localized errors.
@@ -1,5 +0,0 @@
---
-category: Fixed
---
-
- **Shortcut functional workflows** (#1050) — fixes truthful Drive push/sync previews, strict AITable write verification and deletion accounting, lossless Wiki feeds, and false-success handling across task, Contact, Minutes, and Wiki operations.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Chat personal emotions** — adds `chat emotion list`, `chat emotion send`, and `chat emotion favorite` for current-user personal favorite emotion listing, sending, and favoriting.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Minutes, DingTalk tasks, and Wiki parameter aliases** — adds reviewed parameter-name normalization, ambiguity guards, and end-to-end payload coverage for the three products.
@@ -1,7 +0,0 @@
---
-category: Fixed
---
-
- **Calendar empty windows** (#1074) — returns a legitimate empty result when the service emits its exact exhausted empty-event sentinel.
- **Task update verification** (#1074) — compares due-time readback as exact milliseconds so committed updates are no longer reported as failures.
- **Comment reaction validation** (#1074) — narrows accepted reaction input to reviewed DingTalk emoji names and rejects Unicode emoji and unsupported names such as `like` and `heart` before the RPC.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **OA, DING, and Report shortcuts** — hardens response, identity, pagination, and confirmation contracts; publishes verified form search, receiver status, and report read workflows while withholding shortcuts that lack trustworthy downstream evidence.
@@ -1,11 +0,0 @@
---
-category: Fixed
---
-
- **OAuth refresh falls back to the organization mirror** — when the server rejects the
-  current identity's `refresh_token` with the reviewed `invalidParameter.authCode.notFound`
-  business code, `dws` now retries once with the still-valid token mirrored in the same
-  organization's slot (same corp, matching or backfilled user identity) before giving up,
-  and writes the rotated credential back to both the identity and the organization slots so
-  the fallback stays usable on later refreshes. Transient failures and direct-mode HTTP
-  rejections without a reviewed business code do not trigger the fallback.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **Stable release sealing** — directly preparing a stable release now renders and archives release fragments merged after its beta baseline, avoiding a forced extra beta solely to consume pending notes.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Drive permission get-setting** (#1056) — adds `dws drive permission get-setting --node <ID>` to inspect a document-space node's permission settings (permission mode, share scope, and permission policies) in one call.
@@ -1,6 +0,0 @@
---
-category: Added
---
-
- **Whiteboard shortcuts** (#1082) — adds strict query and confirmed update workflows with stable-target receipts and exact readback verification.
- **Sheet shortcut hardening** (#1082) — makes worksheet listing and cell-range reads fail closed on malformed, ambiguous, or truncated responses, publishes a closed reviewed output shape, and preserves non-executing `--dry-run` previews for range reads.
@@ -1,5 +0,0 @@
---
-category: Changed
---
-
- **AiSearch and Contact shortcuts** (#1083) — adds strict people search and reviewed unified results; people results must use the live-reviewed `person` source, and exact mobile lookups normalize accepted formatting before calling the dedicated mobile interface. Agent/public discovery keeps `contact +list-roles`, `contact +list-roster-fields`, `contact +get-roster`, and incomplete Live routes unavailable rather than publishing ambiguous results, while the historical Contact CLI commands retain legacy MCP execution and real error propagation. The legacy role-list projection preserves the service's reviewed null placeholder without exposing that ambiguous row through Agent Result contracts.
@@ -1,24 +0,0 @@
---
-category: Changed
---
-
- **Permission error guidance and error rendering** (#1085) —
-  permission-denied responses now exit with the `AUTH_PERMISSION_DENIED` code
-  instead of a generic business-error rendering; document/wiki-specific errors
-  (the drive-specific codes `forbidden.accessDenied` / `forbidden.no.auth`,
-  or the role-threshold wording like
-  “需要您具备 MANAGER 及以上角色”) carry apply-permission guidance
-  (`dws drive permission apply-info` / `dws drive permission apply`), while
-  permission failures carrying only generic code names (`FORBIDDEN`,
-  `NO_PERMISSION` — also returned by attendance and event-subscription tools)
-  or other products' wording keep their product-specific or
-  product-neutral suggestion instead of a misleading document-permission hint;
-  member-validation failures such as
-  “用户不存在/不属于当前组织” are classified as tool errors with a
-  `--members`-with-`corpId` suggestion instead of a misleading
-  resource-not-found error; business error output now surfaces the backend
-  message with `code`/`logId` appended for traceability; and the
-  `update_permission` / `remove_permission` / `update_member` /
-  `remove_member` tools — whose servers return a literal `null` on successful
-  no-payload writes — now render `{}` so downstream JSON consumers do not fail
-  parsing `null`; other tools keep raw `null` output unchanged.
@@ -1,22 +0,0 @@
---
-category: Added
---
-
- **Permission and member list pagination** (#1085) — `drive/doc permission
-  list` and `wiki member list` now accept `--next-token` to follow the
-  server-side cursor (output carries `totalCount`/`hasMore`/`nextToken`) and
-  map `--limit` to `pageSize` capped at 50 instead of the rejected `maxResults
-  200` path; `permission add/update/remove` and `wiki member add/update/remove`
-  additionally accept a `--members` JSON array covering USER/DEPT/CONVERSATION/TAG
-  grantee types. The optional `--notify` defaults to `false` and is omitted from
-  the server request unless passed explicitly, so member grants no longer notify
-  recipients by default. These commands also declare cursor pagination
-  (`next-token`) in the Agent schema contract, mirroring the internal CLI parity
-  change. Because a single batch remove can revoke access for up to 30
-  USER/DEPT/CONVERSATION/TAG members — where departments, chats, and role
-  groups can indirectly affect many more users — `drive/doc permission
-  remove` and `wiki member remove` now declare
-  `confirmation=user_required` and gate the actual tool call behind user
-  confirmation (`--yes`, an interactive yes, or `--dry-run` preview); their
-  confirmation-gate failure now also passes through verbatim instead of being
-  reclassified as a permission-denied or unclassified error.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Agoal scorecard search-entities** — `dws agoal scorecard search-entities` searches scorecard metrics and key items by keyword, returning matching entity info (scorecard ID, entity ID, entity type, title, owning team) with optional `--page`/`--page-size` pagination.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **AITable datasource shortcuts** — adds 7 shortcuts for datasource sync management (`+datasource-create`, `+datasource-update`, `+datasource-sync`, `+datasource-sync-status`, `+datasource-get-config`, `+datasource-list-sources`, `+datasource-get-fields`) and updates the `dingtalk-aitable` skill with routing rules and a new `aitable-datasource.md` reference guide.
@@ -1,13 +0,0 @@
---
-category: Added
---
-
- **Doc public-link and historical-version reads** — `dws doc read` forwards
-  the reviewed `password` (internet-public documents with password protection)
-  and `historyVersion` (read content as of a listed historical version; `0`
-  denotes the document's initial version) parameters on the markdown, JSONML,
-  and scope read paths via `--password` / `--version`; `dws doc +fetch` gains
-  `--password` and `--version` with the same `historyVersion` forwarding, while
-  `--revision` stays rejected with explicit guidance: revision is the document
-  edit revision returned by JSONML reads for `+update --expected-revision`
-  conditional writes, not a historical version number.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Edu & College vendor extensions** — adds five hidden vendor extension commands for education scenarios: `dws edu-contact` (school/class/family/teacher contact management), `dws edu-group` (student/class group lifecycle), `dws edu-app` (homework, notices, report cards, diplomas, class circles), `dws edu-familygroup` (family group management, child binding, app permissions), and `dws college-contact` (university dept/employee/alumni/graduate management). All route to dedicated MCP servers via `callMCPToolOnServer`.
@@ -1,5 +0,0 @@
---
-category: Fixed
---
-
- **Legacy global slot recovery** — recovers a rejected identity refresh from the legacy global keychain slot when the organization mirror is absent, with strict corp/user matching so blank-user legacy tokens only recover for single-account organizations.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **OA approval attachment upload** — `dws oa approval attachment upload --file <path>` uploads a local file as an approval attachment in one command: it initializes the upload credential (MCP `oa/init_attachment_upload_info`), HTTP PUTs the file to OSS, then commits it (MCP `oa/commit_attachment_upload_info`). `--file-name` defaults to the file's base name and `--md5` is auto-computed when omitted.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Sheet floating images** — supports creating or replacing a floating image directly from a local file with `create-float-image --file` and `update-float-image --file`, while retaining the existing `--src` workflow.
@@ -1,5 +0,0 @@
---
-category: Added
---
-
- **Sheet revision changesets** — adds read-only commands for querying the current workbook revision and reviewing Agent-readable changes between revisions, with guidance for distinguishing revisions from saved history versions and safely selecting rollback targets.
@@ -19,12 +19,3 @@

 # Cache directory (optional, defaults to ~/.dws/cache)
 # DWS_CACHE_DIR=
-
-# Agent integration metadata (optional; ordinary non-plugin MCP requests only)
-# DWS_AGENT_PRODUCT=example-agent
-# DWS_AGENT_HOST=cloud
-# DWS_AGENT_VER=0.1.5
-# DWS_AGENT_EXT='{"umt":"example-redacted","miniwua":"example-redacted","ua":"ExampleAgent/0.1.5"}'
-# The outer single quotes above are shell syntax and are not part of the value.
-# DWS_AGENT_EXT is sensitive caller-declared JSON (max 8 KiB); never put real
-# tokens in committed files or use this metadata alone for authentication.
@@ -19,10 +19,8 @@ repeat the entire CI suite locally only to fill this checklist: CI expands the
 selected tier from documentation checks, through affected-package tests, to
 the complete high-risk suite.

- [ ] Release fragment added for a user-visible behavior/interface change (otherwise `N/A`):
-  `.changes/<unique-name>.md`; ordinary PRs must not edit `CHANGELOG.md`.
- [ ] Release-seal validation (otherwise `N/A`):
-  `./scripts/policy/check-changelog-pr.sh --content-only "$(git merge-base HEAD origin/main)" HEAD`
+- [ ] Exact in-place `CHANGELOG.md`-only check (otherwise `N/A`):
+  `./scripts/policy/check-changelog-pr.sh --fast-path "$(git merge-base HEAD origin/main)" HEAD`
 - [ ] Targeted test/check commands and results:
 - [ ] Behavior evidence (test name, CLI output shape, or before/after result):
 - [ ] Documentation links/content/rendering checked (documentation-only, otherwise
@@ -1,61 +0,0 @@
-# /eval 自助触发允许名单
-#
-# 名单内的 GitHub 登录名可对【自己创建的 PR】触发 /eval 评测；
-# 对任意 PR 触发仍需仓库 write/maintain/admin 权限（维护者背书）。
-# 授权读取的始终是默认分支上的本文件，PR 无法修改自身授权。
-#
-# 变更本文件必须走 PR 评审。每行一个 GitHub login，# 开头为注释。
-
-aftersss
-notable-open
-EdgarWang0925
-ayunya
-yutongshe
-qingyang1014
-caiTriumph
-xlb1130
-Anonymity-0
-FuShu-Yang
-guimingyue
-AlwaysLee
-TaoJikun
-zengyoulingzyl-stack
-liyuan333
-huangyoo
-lifeihong
-nitonitori
-cywan1998
-gangwn
-junlonghuo2
-aqruan
-Freda0909
-ShawnWhite777
-PeterGuy326
-abucraft
-pengzhihan47-star
-rainyak8
-gongrongyun
-huangyuanzhuo-coder
-ybcstudy
-bigqy
-liwang-ai
-meng93
-wxianfeng
-Patrick-Star-CN
-rossluo28-hz
-dxy704330469
-gtezg30062
-Neige-Premaire
-zhuoyu20
-avicii-chen
-typefield
-Haofeng0705
-Huwenjiao
-liuzeyang
-maoqxxmm
-FloralTide
-lingyun9833
-dxb121
-C0922
-xiaoji121
-H3java
@@ -1,285 +0,0 @@
-'use strict';
-
-// 评审归属是受保护分支上的声明式规则；未知路径不猜测，交给工作流负载均衡兜底。
-const REVIEWER_POOL = ['wxianfeng', 'typefield', 'haofeng0705', 'hlzjsong'];
-
-const PRODUCT_GROUPS = [
-  {
-    primary: 'wxianfeng',
-    backup: 'typefield',
-    products: ['chat', 'contact', 'ding', 'event', 'mail', 'live', 'conference', 'dev', 'devapp', 'mcp', 'aiapp'],
-  },
-  {
-    primary: 'typefield',
-    backup: 'wxianfeng',
-    products: ['doc', 'drive', 'wiki', 'markdown', 'docparse', 'aidesign', 'devdoc', 'blackboard', 'finance', 'law', 'credit'],
-  },
-  {
-    primary: 'haofeng0705',
-    backup: 'typefield',
-    products: ['minutes', 'sheet', 'aitable', 'calendar', 'todo', 'oa', 'attendance', 'report', 'agoal', 'aisearch', 'yida', 'hrbrain'],
-  },
-];
-
-const pathStartsWith = (prefixes) => (path) => prefixes.some((prefix) => path.startsWith(prefix));
-
-const MODULES = [
-  {
-    id: 'security',
-    label: '登录、认证、权限、安全',
-    primary: 'hlzjsong',
-    backup: 'typefield',
-    requiresSecondary: true,
-    matches: pathStartsWith([
-      'internal/auth/',
-      'internal/keychain/',
-      'internal/audit/',
-      'internal/pat/',
-      'internal/security/',
-      'internal/safety/',
-      'pkg/edition/',
-    ]),
-  },
-  {
-    id: 'delivery',
-    label: 'CI、测试、发布、安装',
-    primary: 'haofeng0705',
-    backup: 'wxianfeng',
-    requiresSecondary: true,
-    matches: (path) =>
-      path.startsWith('.github/') ||
-      path.startsWith('scripts/release/') ||
-      path.startsWith('scripts/policy/') ||
-      path.startsWith('scripts/dev/') ||
-      path.startsWith('scripts/install') ||
-      path.startsWith('Formula/') ||
-      path.startsWith('build/') ||
-      path.startsWith('internal/upgrade/') ||
-      path.startsWith('internal/app/upgrade') ||
-      path.startsWith('test/') ||
-      path.startsWith('verify/') ||
-      path.startsWith('.workflow/') ||
-      path === 'coverage.txt' ||
-      path === 'coverage-base.txt' ||
-      path === '.goreleaser.yaml' ||
-      path === 'package.json' ||
-      path === 'package-lock.json' ||
-      path === 'docs/releasing.md',
-  },
-  {
-    id: 'architecture',
-    label: 'DWS 架构、公共内核',
-    primary: 'wxianfeng',
-    backup: 'typefield',
-    requiresSecondary: true,
-    matches: pathStartsWith([
-      'cmd/',
-      'internal/apiclient/',
-      'internal/app/',
-      'internal/cli/',
-      'internal/cobracmd/',
-      'internal/corecmd/',
-      'internal/errors/',
-      'internal/executor/',
-      'internal/generator/',
-      'internal/i18n/',
-      'internal/interfacesnapshot/',
-      'internal/jsonutil/',
-      'internal/localio/',
-      'internal/logging/',
-      'internal/output/',
-      'internal/pipeline/',
-      'internal/plugin/',
-      'internal/profilectx/',
-      'internal/registry/',
-      'internal/syncdata/',
-      'internal/testseam/',
-      'internal/transport/',
-      'pkg/',
-    ]),
-  },
-  {
-    id: 'compatibility',
-    label: '兼容性',
-    primary: 'wxianfeng',
-    backup: 'typefield',
-    requiresSecondary: true,
-    matches: (path) =>
-      /(?:^|[/_.-])compat(?:ibility)?(?=$|[/_.-])/.test(path) ||
-      path.includes('schema_compat'),
-  },
-];
-
-function productMatches(path, product) {
-  const aliases = product === 'blackboard' ? ['blackboard', 'whiteboard'] : [product];
-  return aliases.some((alias) => new RegExp(`(?:^|[/_.-])${alias}(?=$|[/_.-])`).test(path));
-}
-
-const PRODUCT_MODULES = PRODUCT_GROUPS.flatMap((group) =>
-  group.products.map((product) => ({
-    id: `product:${product}`,
-    label: `产品：${product}`,
-    primary: group.primary,
-    backup: group.backup,
-    requiresSecondary: false,
-    matches: (path) => productMatches(path, product),
-  })),
-);
-
-const ALL_MODULES = [MODULES[0], MODULES[1], ...PRODUCT_MODULES, MODULES[2], MODULES[3]];
-
-function normalizedPaths(file) {
-  return [file?.filename, file?.previous_filename]
-    .filter((path) => typeof path === 'string' && path !== '')
-    .map((path) => path.toLowerCase());
-}
-
-function compareStats(left, right) {
-  return right.files - left.files || left.module.order - right.module.order || left.module.id.localeCompare(right.module.id);
-}
-
-function classifyFiles(files) {
-  const counts = new Map();
-  for (const file of files || []) {
-    const matchingModules = new Set();
-    for (const path of normalizedPaths(file)) {
-      const matches = ALL_MODULES.filter((module) => module.matches(path));
-      const securityOrDelivery = matches.filter(
-        (module) => module.id === 'security' || module.id === 'delivery',
-      );
-      const effectiveMatches = securityOrDelivery.length > 0
-        ? [...securityOrDelivery, ...matches.filter((module) => module.id === 'compatibility')]
-        : matches;
-      for (const match of effectiveMatches) {
-        matchingModules.add(match.id);
-      }
-      if (
-        effectiveMatches.length === 0 &&
-        (path.startsWith('internal/helpers/') || path.startsWith('internal/shortcut/'))
-      ) {
-        matchingModules.add('architecture');
-      }
-    }
-    for (const moduleID of matchingModules) {
-      counts.set(moduleID, (counts.get(moduleID) || 0) + 1);
-    }
-  }
-
-  return [...counts.entries()]
-    .map(([id, files]) => {
-      const index = ALL_MODULES.findIndex((module) => module.id === id);
-      return {module: {...ALL_MODULES[index], order: index}, files};
-    })
-    .sort(compareStats);
-}
-
-function chooseModuleReviewer(module, unavailable) {
-  return [module.primary, module.backup].find(
-    (reviewer) => REVIEWER_POOL.includes(reviewer) && !unavailable.has(reviewer),
-  );
-}
-
-function addReviewer(reviewers, reviewer) {
-  if (reviewer && !reviewers.includes(reviewer)) {
-    reviewers.push(reviewer);
-  }
-}
-
-function reviewerCandidates({preferredReviewers, fallbackReviewers, eligibleReviewers}) {
-  const eligible = new Set(eligibleReviewers.map((reviewer) => reviewer.toLowerCase()));
-  const candidates = [];
-  for (const reviewer of [...preferredReviewers, ...fallbackReviewers]) {
-    if (
-      eligible.has(reviewer.toLowerCase()) &&
-      !candidates.some((candidate) => candidate.toLowerCase() === reviewer.toLowerCase())
-    ) {
-      candidates.push(reviewer);
-    }
-  }
-  return candidates;
-}
-
-async function requestReviewersWithFallback({
-  candidates,
-  requiredReviewers,
-  satisfiedReviewers = [],
-  requestReviewer,
-  onFailure = () => {},
-}) {
-  const alreadySatisfied = new Set(
-    satisfiedReviewers.map((reviewer) => reviewer.toLowerCase()),
-  );
-  const satisfied = new Set();
-  const requested = [];
-
-  for (const reviewer of candidates) {
-    if (satisfied.size >= requiredReviewers) {
-      break;
-    }
-    const normalizedReviewer = reviewer.toLowerCase();
-    if (alreadySatisfied.has(normalizedReviewer)) {
-      satisfied.add(normalizedReviewer);
-      continue;
-    }
-
-    try {
-      const shouldContinue = await requestReviewer(reviewer);
-      if (shouldContinue === false) {
-        return {requested, satisfiedReviewers: [...satisfied], aborted: true};
-      }
-      requested.push(reviewer);
-      satisfied.add(normalizedReviewer);
-    } catch (error) {
-      onFailure(reviewer, error);
-    }
-  }
-
-  return {requested, satisfiedReviewers: [...satisfied], aborted: false};
-}
-
-function resolveReviewRouting({files, author, latestPusher, fallbackReviewers = REVIEWER_POOL}) {
-  const modules = classifyFiles(files);
-  const unavailable = new Set([author, latestPusher].filter(Boolean).map((login) => login.toLowerCase()));
-  const reviewers = [];
-  const primaryModule = modules[0];
-
-  if (!primaryModule) {
-    return {modules: [], reviewers, requiredReviewers: 1, reason: 'unknown_paths'};
-  }
-
-  addReviewer(reviewers, chooseModuleReviewer(primaryModule.module, unavailable));
-
-  const requiresSecondary =
-    modules.length > 1 || modules.some(({module}) => module.requiresSecondary);
-  const secondaryModule = modules.find(({module}) => module.id !== primaryModule.module.id) || primaryModule;
-  if (requiresSecondary) {
-    addReviewer(
-      reviewers,
-      chooseModuleReviewer(secondaryModule.module, new Set([...unavailable, ...reviewers])),
-    );
-  }
-
-  for (const reviewer of fallbackReviewers) {
-    if (reviewers.length >= (requiresSecondary ? 2 : 1)) {
-      break;
-    }
-    if (REVIEWER_POOL.includes(reviewer) && !unavailable.has(reviewer)) {
-      addReviewer(reviewers, reviewer);
-    }
-  }
-
-  return {
-    modules: modules.map(({module, files}) => ({id: module.id, label: module.label, files})),
-    reviewers,
-    requiredReviewers: requiresSecondary ? 2 : 1,
-    reason: requiresSecondary ? 'cross_or_sensitive' : 'single_module',
-  };
-}
-
-module.exports = {
-  REVIEWER_POOL,
-  classifyFiles,
-  requestReviewersWithFallback,
-  resolveReviewRouting,
-  reviewerCandidates,
-};
@@ -1,148 +0,0 @@
-'use strict';
-
-const assert = require('node:assert/strict');
-const {
-  requestReviewersWithFallback,
-  resolveReviewRouting,
-  reviewerCandidates,
-} = require('./reviewer-routing');
-
-function route(files, author = 'author', latestPusher = author) {
-  return resolveReviewRouting({files: files.map((filename) => ({filename})), author, latestPusher});
-}
-
-{
-  const result = route(['internal/helpers/chat_toolbar.go']);
-  assert.deepEqual(result.reviewers, ['wxianfeng']);
-  assert.equal(result.requiredReviewers, 1);
-  assert.deepEqual(result.modules.map((module) => module.id), ['product:chat']);
-}
-
-{
-  const result = route(['internal/helpers/chat_toolbar.go', 'internal/helpers/doc_style.go']);
-  assert.deepEqual(result.reviewers, ['wxianfeng', 'typefield']);
-  assert.equal(result.requiredReviewers, 2);
-}
-
-{
-  const result = route(['.github/workflows/ci.yml']);
-  assert.deepEqual(result.reviewers, ['haofeng0705', 'wxianfeng']);
-  assert.equal(result.requiredReviewers, 2);
-  assert.equal(result.reason, 'cross_or_sensitive');
-}
-
-{
-  const result = route(['internal/auth/login.go'], 'hlzjsong');
-  assert.deepEqual(result.reviewers, ['typefield', 'wxianfeng']);
-  assert.equal(result.requiredReviewers, 2);
-}
-
-{
-  const result = route(['internal/upgrade/downloader.go']);
-  assert.deepEqual(result.reviewers, ['haofeng0705', 'wxianfeng']);
-  assert.equal(result.requiredReviewers, 2);
-}
-
-{
-  const result = route(['internal/app/upgrade.go', 'scripts/dev/test-release.sh']);
-  assert.deepEqual(result.reviewers, ['haofeng0705', 'wxianfeng']);
-  assert.equal(result.requiredReviewers, 2);
-}
-
-{
-  const result = route(['pkg/edition/edition.go']);
-  assert.deepEqual(result.reviewers, ['hlzjsong', 'typefield']);
-  assert.equal(result.requiredReviewers, 2);
-}
-
-{
-  const result = route(['internal/shortcut/chat/compatibility_coverage_test.go']);
-  assert.deepEqual(result.reviewers, ['wxianfeng', 'typefield']);
-  assert.equal(result.requiredReviewers, 2);
-  assert.deepEqual(result.modules.map((module) => module.id), ['product:chat', 'compatibility']);
-}
-
-{
-  const result = route(['internal/helpers/leaf_dispatch.go']);
-  assert.deepEqual(result.reviewers, ['wxianfeng', 'typefield']);
-  assert.equal(result.requiredReviewers, 2);
-}
-
-{
-  const result = route(['docs/unknown-area.md']);
-  assert.deepEqual(result.reviewers, []);
-  assert.equal(result.reason, 'unknown_paths');
-}
-
-async function testSingleReviewerFallback() {
-  const candidates = reviewerCandidates({
-    preferredReviewers: ['wxianfeng'],
-    fallbackReviewers: ['wxianfeng', 'typefield', 'haofeng0705'],
-    eligibleReviewers: ['wxianfeng', 'typefield', 'haofeng0705'],
-  });
-  const attempts = [];
-  const result = await requestReviewersWithFallback({
-    candidates,
-    requiredReviewers: 1,
-    requestReviewer: async (reviewer) => {
-      attempts.push(reviewer);
-      if (reviewer === 'wxianfeng') {
-        throw Object.assign(new Error('cannot request primary'), {status: 422});
-      }
-      return true;
-    },
-  });
-  assert.deepEqual(attempts, ['wxianfeng', 'typefield']);
-  assert.deepEqual(result.requested, ['typefield']);
-  assert.equal(result.satisfiedReviewers.length, 1);
-}
-
-async function testTwoReviewerFallback() {
-  const candidates = reviewerCandidates({
-    preferredReviewers: ['haofeng0705', 'wxianfeng'],
-    fallbackReviewers: ['haofeng0705', 'wxianfeng', 'typefield', 'hlzjsong'],
-    eligibleReviewers: ['haofeng0705', 'wxianfeng', 'typefield', 'hlzjsong'],
-  });
-  const attempts = [];
-  const result = await requestReviewersWithFallback({
-    candidates,
-    requiredReviewers: 2,
-    requestReviewer: async (reviewer) => {
-      attempts.push(reviewer);
-      if (reviewer === 'wxianfeng') {
-        throw Object.assign(new Error('temporary failure'), {status: 503});
-      }
-      return true;
-    },
-  });
-  assert.deepEqual(attempts, ['haofeng0705', 'wxianfeng', 'typefield']);
-  assert.deepEqual(result.requested, ['haofeng0705', 'typefield']);
-  assert.equal(result.satisfiedReviewers.length, 2);
-}
-
-async function testLowerPriorityExistingRequestDoesNotReplaceOwner() {
-  const attempts = [];
-  const result = await requestReviewersWithFallback({
-    candidates: ['wxianfeng', 'typefield'],
-    requiredReviewers: 1,
-    satisfiedReviewers: ['typefield'],
-    requestReviewer: async (reviewer) => {
-      attempts.push(reviewer);
-      return true;
-    },
-  });
-  assert.deepEqual(attempts, ['wxianfeng']);
-  assert.deepEqual(result.requested, ['wxianfeng']);
-  assert.deepEqual(result.satisfiedReviewers, ['wxianfeng']);
-}
-
-Promise.all([
-  testSingleReviewerFallback(),
-  testTwoReviewerFallback(),
-  testLowerPriorityExistingRequestDoesNotReplaceOwner(),
-])
-  .then(() => console.log('reviewer routing policy tests passed'))
-  .catch((error) => {
-    console.error(error);
-    process.exitCode = 1;
-  });
@@ -24,7 +24,6 @@ jobs:
      pull-requests: read
    outputs:
      changelog_only: ${{ steps.classify.outputs.changelog_only }}
-      release_seal_only: ${{ steps.classify.outputs.release_seal_only }}
      changelog_changed: ${{ steps.classify.outputs.changelog_changed }}
      docs_only: ${{ steps.classify.outputs.docs_only }}
      full_suite: ${{ steps.classify.outputs.full_suite }}
@@ -40,7 +39,6 @@ jobs:
        with:
          script: |
            let changelogOnly = false;
-            let releaseSealOnly = false;
            let changelogChanged = false;
            let docsOnly = false;
            let fullSuite = context.eventName === 'push';
@@ -113,7 +111,6 @@ jobs:
                filename.startsWith('internal/app/') ||
                filename.startsWith('internal/cli/') ||
                filename.startsWith('internal/cobracmd/') ||
-                filename.startsWith('internal/corecmd/') ||
                filename.startsWith('internal/helpers/') ||
                filename.startsWith('internal/i18n/') ||
                filename.startsWith('internal/interfacesnapshot/') ||
@@ -150,22 +147,12 @@ jobs:
                filename === '.github/actionlint.yaml' ||
                filename.startsWith('scripts/') ||
                filename.startsWith('verify/') ||
-                filename.startsWith('internal/helpers/') ||
-                // Shortcut declarations feed the live command tree and Schema
-                // assembly. Their reverse dependencies include the expensive
-                // app and generator packages, which must run in separate shards.
-                filename.startsWith('internal/shortcut/') ||
                filename.startsWith('internal/generator/') ||
                filename.startsWith('internal/cli/schema') ||
-                // Parameter aliases are reduced against the live command tree.
-                // Their reverse-dependency set is too large for one focused
-                // race job, so use the existing full-suite shards.
-                filename === 'internal/cli/param_concepts.json' ||
-                filename === 'internal/cli/param_concepts.schema.json' ||
-                filename === 'internal/cli/param_aliases_generated.go' ||
                filename.startsWith('internal/interfacesnapshot/') ||
                filename.startsWith('internal/app/upgrade') ||
                filename.startsWith('internal/transport/') ||
+                filename.startsWith('internal/recovery/') ||
                filename.startsWith('internal/syncdata/') ||
                filename.includes('/testdata/') ||
                filename.startsWith('testdata/') ||
@@ -174,43 +161,6 @@ jobs:
                filename === 'go.mod' ||
                filename === 'go.sum'
              );
-            const isExactReleaseSeal = (candidates) => {
-              const changelog = candidates.filter(
-                ({ filename, status, previous_filename }) =>
-                  filename === 'CHANGELOG.md' &&
-                  status === 'modified' &&
-                  !previous_filename
-              );
-              if (changelog.length !== 1 || candidates.length < 2) {
-                return false;
-              }
-              let version = '';
-              return candidates.every((file) => {
-                if (file.filename === 'CHANGELOG.md') {
-                  return file.status === 'modified' && !file.previous_filename;
-                }
-                if (
-                  file.status !== 'renamed' ||
-                  typeof file.filename !== 'string' ||
-                  typeof file.previous_filename !== 'string' ||
-                  file.additions !== 0 ||
-                  file.deletions !== 0
-                ) {
-                  return false;
-                }
-                const target = file.filename.match(
-                  /^\.changes\/released\/([0-9]+\.[0-9]+\.[0-9]+(?:-beta\.[1-9][0-9]*)?)\/([a-z0-9][a-z0-9._-]*\.md)$/
-                );
-                if (!target || file.previous_filename !== `.changes/${target[2]}`) {
-                  return false;
-                }
-                if (version && version !== target[1]) {
-                  return false;
-                }
-                version = target[1];
-                return true;
-              });
-            };
            const classifyFiles = (complete) => {
              const paths = files.flatMap(({ filename, previous_filename }) =>
                [filename, previous_filename].filter(
@@ -297,26 +247,19 @@ jobs:
                );
              }

-              const exactChangelogDiff =
+              changelogOnly =
                files.length === 1 &&
                files[0].filename === 'CHANGELOG.md' &&
                files[0].status === 'modified' &&
                !files[0].previous_filename;
-              releaseSealOnly = isExactReleaseSeal(files);
-              changelogOnly = exactChangelogDiff || releaseSealOnly;
              changelogChanged = files.some(
                ({ filename, previous_filename }) =>
                  filename === 'CHANGELOG.md' ||
                  previous_filename === 'CHANGELOG.md'
              );
              classifyFiles(true);
-              if (releaseSealOnly) {
-                fullSuite = false;
-              }
              fastPathTrust = changelogOnly
-                ? releaseSealOnly
-                  ? 'exact release-seal fragment archival and synthetic merge policy'
-                  : 'exact CHANGELOG-only revision and synthetic merge policy'
+                ? 'exact pull-request revision and synthetic merge policy'
                : docsOnly
                  ? 'documentation-only focused admission'
                  : fullSuite
@@ -351,8 +294,7 @@ jobs:
                    per_page: 100,
                  });
                files = Array.isArray(comparison.files) ? comparison.files : [];
-                const pushFilesComplete = files.length < 300;
-                classifyFiles(pushFilesComplete);
+                classifyFiles(files.length < 300);
                const linearFromValidatedTip =
                  comparison.status === 'ahead' &&
                  comparison.merge_base_commit?.sha === expectedBefore &&
@@ -364,10 +306,8 @@ jobs:
                  files[0].filename === 'CHANGELOG.md' &&
                  files[0].status === 'modified' &&
                  !files[0].previous_filename;
-                const exactReleaseSealDiff =
-                  pushFilesComplete && isExactReleaseSeal(files);

-                if (linearFromValidatedTip && (exactChangelogDiff || exactReleaseSealDiff)) {
+                if (linearFromValidatedTip && exactChangelogDiff) {
                  const requiredContexts = [
                    'Lint',
                    'Test',
@@ -418,15 +358,9 @@ jobs:

                  if (missing.length === 0 && nonSuccess.length === 0) {
                    changelogOnly = true;
-                    releaseSealOnly = exactReleaseSealDiff;
                    changelogChanged = true;
-                    if (releaseSealOnly) {
-                      fullSuite = false;
-                    }
                    fastPathTrust =
-                      releaseSealOnly
-                        ? `exact release-seal successor of validated ${expectedBefore}`
-                        : `exact CHANGELOG-only successor of validated ${expectedBefore}`;
+                      `exact CHANGELOG-only successor of validated ${expectedBefore}`;
                  } else {
                    fastPathTrust =
                      'predecessor Code Admission is not fully successful; ' +
@@ -441,7 +375,6 @@ jobs:
            }

            core.setOutput('changelog_only', String(changelogOnly));
-            core.setOutput('release_seal_only', String(releaseSealOnly));
            core.setOutput('changelog_changed', String(changelogChanged));
            core.setOutput('docs_only', String(docsOnly));
            core.setOutput('full_suite', String(fullSuite));
@@ -453,8 +386,7 @@ jobs:
            await core.summary
              .addHeading('Code Admission scope')
              .addRaw(`- Event: \`${context.eventName}\`\n`)
-              .addRaw(`- Metadata-only fast path: \`${changelogOnly}\`\n`)
-              .addRaw(`- Release-seal fragments only: \`${releaseSealOnly}\`\n`)
+              .addRaw(`- Exact modified CHANGELOG only: \`${changelogOnly}\`\n`)
              .addRaw(`- CHANGELOG touched: \`${changelogChanged}\`\n`)
              .addRaw(`- Documentation-only: \`${docsOnly}\`\n`)
              .addRaw(`- Full suite: \`${fullSuite}\`\n`)
@@ -469,14 +401,7 @@ jobs:

      - name: Record CHANGELOG-only fast path
        if: steps.classify.outputs.changelog_only == 'true'
-        env:
-          RELEASE_SEAL_ONLY: ${{ steps.classify.outputs.release_seal_only }}
-        run: |
-          if [ "$RELEASE_SEAL_ONLY" = true ]; then
-            echo "Lint is satisfied by the trusted release-seal fragment Policy path." >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "Lint is satisfied by the trusted CHANGELOG-only Policy path." >> "$GITHUB_STEP_SUMMARY"
-          fi
+        run: echo "Lint is satisfied by the trusted CHANGELOG-only Policy path." >> "$GITHUB_STEP_SUMMARY"

      - name: Record documentation-only fast path
        if: steps.classify.outputs.changelog_only != 'true' && steps.classify.outputs.docs_only == 'true'
@@ -508,54 +433,12 @@ jobs:
        if: steps.classify.outputs.changelog_only != 'true' && steps.classify.outputs.docs_only != 'true'
        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12

-      - name: Test reviewer routing policy
-        if: steps.classify.outputs.changelog_only != 'true' && steps.classify.outputs.docs_only != 'true'
-        run: node .github/reviewer-routing.test.js
-
-      - name: Test npm installer smoke (prune, backup, publish)
-        if: steps.classify.outputs.changelog_only != 'true' && steps.classify.outputs.docs_only != 'true'
-        env:
-          XDG_CONFIG_HOME: ""
-        run: node test/scripts/install_js_smoke.mjs
-
  test-focused:
-    name: "Test (focused: ${{ matrix.shard }})"
+    name: Test (changed packages)
    needs: lint
    if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite != 'true' }}
    runs-on: ubuntu-latest
-    # Each shard owns one bounded slice of the impacted set, so no single job
-    # carries internal/app together with every reverse dependency. The shard
-    # list and per-shard execution below mirror test-race, which runs the same
-    # shards at full-suite scope; release-scripts is included because its
-    # dedicated job only runs at full-suite or release-sensitive scope, and
-    # dropping it here would stop testing test/scripts changes entirely.
-    # internal/app is carried by one shard per bounded partition rather than a
-    # single app shard: the partitions used to run end to end inside one job,
-    # where the Schema partition alone owned most of the wall clock. The
-    # app-<partition> names are pinned to the helper's partition set by
-    # TestCIAppRacePartitionMatrixMatchesHelper, so a partition can never lose
-    # its job silently. The CrossPlatformCoverage-heavy C range is split again
-    # to retain headroom on runners reclaimed near the five-minute mark.
    timeout-minutes: 20
-    strategy:
-      fail-fast: false
-      matrix:
-        shard:
-          - app-schema
-          - app-a-b
-          - app-c-a-l
-          - app-c-m-o
-          - app-c-p-r
-          - app-c-s-z
-          - app-c-other
-          - app-d-r
-          - app-s-z-example-fuzz
-          - generators
-          - helpers
-          - cli
-          - smoke
-          - remaining
-          - release-scripts
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
@@ -584,125 +467,37 @@ jobs:
        with:
          go-version-file: go.mod

-      - name: Select impacted packages for shard
-        id: select
-        shell: bash
-        env:
-          TEST_SHARD: ${{ matrix.shard }}
-        run: |
-          set -euo pipefail
-          # Every app partition shard tests the same single internal/app
-          # package, so the impacted-package query uses the base shard name and
-          # the partition only selects which tests run.
-          package_shard="$TEST_SHARD"
-          case "$TEST_SHARD" in
-            app-*) package_shard=app ;;
-          esac
-          package_output="$(
-            ./scripts/ci/changed-test-packages.sh \
-              list-shard "$package_shard" "$TEST_BASE_REF" "$TEST_HEAD_REF"
-          )"
-          if [ -z "$package_output" ]; then
-            echo "No buildable Go package in shard $TEST_SHARD is affected by this revision." \
-              >> "$GITHUB_STEP_SUMMARY"
-            echo "affected=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          # The package list travels through a file rather than a step output:
-          # reading it with `mapfile < file` has unambiguous line semantics,
-          # whereas a here-string over a multi-line output would append an extra
-          # empty element if the value ever carried a trailing newline, and an
-          # empty element would reach go test as an empty package argument.
-          printf '%s\n' "$package_output" > "$RUNNER_TEMP/focused-shard-packages.txt"
-          echo "affected=true" >> "$GITHUB_OUTPUT"
-
-      - name: Build
-        if: ${{ matrix.shard == 'remaining' && steps.select.outputs.affected == 'true' }}
-        run: make build
-
-      - name: Install archive tooling
-        if: ${{ matrix.shard == 'release-scripts' && steps.select.outputs.affected == 'true' }}
-        run: |
-          if command -v zip >/dev/null && command -v unzip >/dev/null; then
-            echo "zip and unzip are already available"
-          else
-            sudo apt-get update
-            sudo apt-get install -y zip unzip
-          fi
-
-      - name: Test shard with Race Detection
-        if: ${{ steps.select.outputs.affected == 'true' }}
+      - name: Test changed packages and reverse dependencies
        shell: bash
        env:
          DWS_PACKAGE_VERSION: 0.0.0-test
-          TEST_SHARD: ${{ matrix.shard }}
        run: |
          set -euo pipefail
-          mapfile -t packages < "$RUNNER_TEMP/focused-shard-packages.txt"
-          test "${#packages[@]}" -gt 0
-          for package in "${packages[@]}"; do
-            test -n "$package" || {
-              echo "shard package list contains an empty entry" >&2
-              exit 1
-            }
-          done
-          case "$TEST_SHARD" in
-            app-*)
-              # A single long-lived app test process retains every constructed
-              # command tree in framework registries. Each partition is its own
-              # job, so that state is released when the process exits and the
-              # partitions run concurrently instead of end to end. The helper
-              # still verifies that the partition patterns cover every top-level
-              # test exactly once before running the one it was asked for.
-              test "${#packages[@]}" -eq 1
-              ./scripts/ci/run-app-race-tests.sh run "${packages[0]}" "${TEST_SHARD#app-}"
-              exit 0
-              ;;
-          esac
-          if [ "$TEST_SHARD" = "release-scripts" ]; then
-            # Mirror the dedicated release-contract job: these suites shell out
-            # to archive tooling and are not race-instrumented there.
-            go test -v -count=1 -timeout=10m "${packages[@]}"
+          package_output="$(
+            ./scripts/ci/changed-test-packages.sh \
+              list "$TEST_BASE_REF" "$TEST_HEAD_REF"
+          )"
+          if [ -z "$package_output" ]; then
+            echo "No buildable Go package is affected by this revision." \
+              >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
-          # cli/smoke own heavy NewRootCommand / Schema assembly under -race;
-          # give them a dedicated package timeout on slower hosted runners.
-          timeout_budget=12m
-          if [ "$TEST_SHARD" = "cli" ] ||
-             [ "$TEST_SHARD" = "smoke" ]; then
-            timeout_budget=15m
-          fi
-          go test -v -race -count=1 -timeout="$timeout_budget" "${packages[@]}"
+          mapfile -t packages <<< "$package_output"
+          go test -v -race -count=1 -timeout=15m "${packages[@]}"

  test-race:
    name: "Test (race: ${{ matrix.shard }})"
    needs: lint
    if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite == 'true' }}
    runs-on: ubuntu-latest
-    # internal/app is split across one shard per bounded partition so the
-    # partitions run concurrently and each releases its framework registries
-    # when the process exits; cli/smoke need headroom beyond go test -timeout for
-    # setup + assembly. The app-<partition> names are pinned to the helper's
-    # partition set by TestCIAppRacePartitionMatrixMatchesHelper. The
-    # CrossPlatformCoverage-heavy C range is split again for runner headroom.
-    timeout-minutes: 20
+    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        shard:
-          - app-schema
-          - app-a-b
-          - app-c-a-l
-          - app-c-m-o
-          - app-c-p-r
-          - app-c-s-z
-          - app-c-other
-          - app-d-r
-          - app-s-z-example-fuzz
+          - app
          - generators
          - helpers
-          - cli
-          - smoke
          - remaining
    steps:
      - name: Check out repository
@@ -724,38 +519,11 @@ jobs:
          TEST_SHARD: ${{ matrix.shard }}
        run: |
          set -euo pipefail
-          # Every app partition shard tests the same single internal/app
-          # package, so the package query uses the base shard name and the
-          # partition only selects which tests run.
-          package_shard="$TEST_SHARD"
-          case "$TEST_SHARD" in
-            app-*) package_shard=app ;;
-          esac
-          package_output="$(./scripts/ci/test-packages.sh list "$package_shard")"
+          package_output="$(./scripts/ci/test-packages.sh list "$TEST_SHARD")"
          test -n "$package_output"
          mapfile -t packages <<< "$package_output"
          test "${#packages[@]}" -gt 0
-          case "$TEST_SHARD" in
-            app-*)
-              # A single long-lived app test process retains every constructed
-              # command tree in framework registries. Each partition is its own
-              # job, so that state is released when the process exits and the
-              # partitions run concurrently instead of end to end. The helper
-              # still verifies that the partition patterns cover every top-level
-              # test exactly once before running the one it was asked for.
-              test "${#packages[@]}" -eq 1
-              ./scripts/ci/run-app-race-tests.sh run "${packages[0]}" "${TEST_SHARD#app-}"
-              exit 0
-              ;;
-          esac
-          # cli/smoke own heavy NewRootCommand / Schema assembly under -race;
-          # give them a dedicated package timeout on slower hosted runners.
-          timeout_budget=12m
-          if [ "$TEST_SHARD" = "cli" ] ||
-             [ "$TEST_SHARD" = "smoke" ]; then
-            timeout_budget=15m
-          fi
-          go test -v -race -count=1 -timeout="$timeout_budget" "${packages[@]}"
+          go test -v -race -count=1 -timeout=12m "${packages[@]}"

  test-release-scripts:
    name: Test (workflow and release contracts)
@@ -773,13 +541,7 @@ jobs:
          go-version-file: go.mod

      - name: Install archive tooling
-        run: |
-          if command -v zip >/dev/null && command -v unzip >/dev/null; then
-            echo "zip and unzip are already available"
-          else
-            sudo apt-get update
-            sudo apt-get install -y zip unzip
-          fi
+        run: sudo apt-get update && sudo apt-get install -y zip unzip

      - name: Test release scripts
        shell: bash
@@ -855,7 +617,7 @@ jobs:
          failed=0
          if [ "$CHANGELOG_ONLY" = true ] || [ "$DOCS_ONLY" = true ]; then
            for shard in \
-              "focused shards:$FOCUSED_RESULT" \
+              "changed packages:$FOCUSED_RESULT" \
              "race shards:$RACE_RESULT" \
              "release scripts:$RELEASE_SCRIPTS_RESULT" \
              "cross-platform compile:$CROSS_PLATFORM_RESULT" \
@@ -884,7 +646,7 @@ jobs:
            release_expected=success
          fi
          for shard in \
-            "focused shards:$FOCUSED_RESULT:$focused_expected" \
+            "changed packages:$FOCUSED_RESULT:$focused_expected" \
            "race shards:$RACE_RESULT:$race_expected" \
            "release scripts:$RELEASE_SCRIPTS_RESULT:$release_expected" \
            "cross-platform compile:$CROSS_PLATFORM_RESULT:success"
@@ -931,11 +693,8 @@ jobs:
        with:
          go-version-file: go.mod

-      - name: Test macOS auth and Keychain packages with Race Detection
-        run: go test -v -race -count=1 -timeout=6m ./internal/keychain ./internal/auth
-
-      - name: Test macOS auth migration, Keychain diagnostics, and upgrade self-heal with Race Detection
-        run: go test -v -race -count=1 -timeout=5m ./internal/app -run '^(TestValidateNewBinary_RecoversFromUnsignedDarwin|Test(CrossPlatformCoverage)?Auth(MigrateKeychain|StatusDiagnosticReportsCiphertextKeyMismatch))'
+      - name: Test macOS auth and Keychain paths with Race Detection
+        run: go test -v -race -count=1 -timeout=10m ./internal/keychain ./internal/auth ./internal/app

  test-windows:
    name: Test (Windows)
@@ -1046,7 +805,6 @@ jobs:
        run: ./scripts/policy/run-platform-coverage-gate.sh --base-ref "$COVERAGE_BASE_REF" --profile coverage-windows.txt

      - name: Upload Windows coverage artifact
-        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-windows
@@ -1055,7 +813,7 @@ jobs:
  coverage-current:
    name: Coverage (current)
    needs: lint
-    if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite != 'true' }}
+    if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
@@ -1070,6 +828,10 @@ jobs:
        with:
          go-version-file: go.mod

+      - name: Install archive tooling
+        if: needs.lint.outputs.full_suite == 'true'
+        run: sudo apt-get update && sudo apt-get install -y zip unzip
+
      - name: Resolve authoritative coverage base
        env:
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -1091,33 +853,41 @@ jobs:
      - name: Build
        run: make build

-      - name: Run scoped unit tests with coverage
+      - name: Run current unit tests with coverage
        shell: bash
        env:
          DWS_PACKAGE_VERSION: 0.0.0-test
+          FULL_SUITE: ${{ needs.lint.outputs.full_suite }}
        run: |
          set -euo pipefail
-          changed_output="$(
-            ./scripts/ci/changed-test-packages.sh \
-              changed "$COVERAGE_BASE_REF" "$COVERAGE_HEAD_REF"
-          )"
-          impacted_output="$(
-            ./scripts/ci/changed-test-packages.sh \
-              list "$COVERAGE_BASE_REF" "$COVERAGE_HEAD_REF"
-          )"
-          if [ -z "$changed_output" ] || [ -z "$impacted_output" ]; then
-            printf 'mode: atomic\n' > coverage.txt
-            echo "No buildable Go package needs scoped coverage." \
-              >> "$GITHUB_STEP_SUMMARY"
-          else
-            mapfile -t changed_packages <<< "$changed_output"
-            mapfile -t impacted_packages <<< "$impacted_output"
-            coverpkg="$(IFS=,; echo "${changed_packages[*]}")"
+          if [ "$FULL_SUITE" = true ]; then
            go test -count=1 -p 1 \
-              -coverpkg="$coverpkg" \
              -coverprofile=coverage.txt \
              -covermode=atomic \
-              "${impacted_packages[@]}"
+              ./ ./cmd/... ./internal/... ./skills/...
+          else
+            changed_output="$(
+              ./scripts/ci/changed-test-packages.sh \
+                changed "$COVERAGE_BASE_REF" "$COVERAGE_HEAD_REF"
+            )"
+            impacted_output="$(
+              ./scripts/ci/changed-test-packages.sh \
+                list "$COVERAGE_BASE_REF" "$COVERAGE_HEAD_REF"
+            )"
+            if [ -z "$changed_output" ] || [ -z "$impacted_output" ]; then
+              printf 'mode: atomic\n' > coverage.txt
+              echo "No buildable Go package needs scoped coverage." \
+                >> "$GITHUB_STEP_SUMMARY"
+            else
+              mapfile -t changed_packages <<< "$changed_output"
+              mapfile -t impacted_packages <<< "$impacted_output"
+              coverpkg="$(IFS=,; echo "${changed_packages[*]}")"
+              go test -count=1 -p 1 \
+                -coverpkg="$coverpkg" \
+                -coverprofile=coverage.txt \
+                -covermode=atomic \
+                "${impacted_packages[@]}"
+            fi
          fi
          if [ "$(wc -l < coverage.txt)" -gt 1 ]; then
            go tool cover -func=coverage.txt
@@ -1130,72 +900,6 @@ jobs:
          path: coverage.txt
          retention-days: 1

-  coverage-current-full:
-    name: "Coverage (current: ${{ matrix.shard }})"
-    needs: lint
-    if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      fail-fast: false
-      matrix:
-        shard:
-          - app
-          - cli
-          - generators
-          - helpers
-          - remaining
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Install archive tooling
-        run: |
-          if command -v zip >/dev/null && command -v unzip >/dev/null; then
-            echo "zip and unzip are already available"
-          else
-            sudo apt-get update
-            sudo apt-get install -y zip unzip
-          fi
-
-      - name: Build
-        run: make build
-
-      # Each shard keeps -p 1 so the authoritative measurement stays serial
-      # inside one instrumented process group; shards run on isolated runners,
-      # and scripts/ci/test-packages.sh verify proves the shard union equals
-      # the previous single full-suite package set exactly once.
-      - name: Run current shard tests with coverage
-        shell: bash
-        env:
-          DWS_PACKAGE_VERSION: 0.0.0-test
-          COVERAGE_SHARD: ${{ matrix.shard }}
-        run: |
-          set -euo pipefail
-          package_output="$(./scripts/ci/test-packages.sh list-coverage "$COVERAGE_SHARD")"
-          test -n "$package_output"
-          mapfile -t packages <<< "$package_output"
-          test "${#packages[@]}" -gt 0
-          go test -count=1 -p 1 \
-            -coverprofile="coverage-shard-$COVERAGE_SHARD.txt" \
-            -covermode=atomic \
-            "${packages[@]}"
-          go tool cover -func="coverage-shard-$COVERAGE_SHARD.txt" | tail -n 1
-
-      - name: Upload current shard coverage profile
-        uses: actions/upload-artifact@v4
-        with:
-          name: coverage-current-shard-${{ matrix.shard }}
-          path: coverage-shard-${{ matrix.shard }}.txt
-          retention-days: 1
-
  coverage-supporting:
    name: Coverage (supporting)
    needs: lint
@@ -1214,13 +918,7 @@ jobs:
          go-version-file: go.mod

      - name: Install archive tooling
-        run: |
-          if command -v zip >/dev/null && command -v unzip >/dev/null; then
-            echo "zip and unzip are already available"
-          else
-            sudo apt-get update
-            sudo apt-get install -y zip unzip
-          fi
+        run: sudo apt-get update && sudo apt-get install -y zip unzip

      - name: Run policy and shortcut coverage
        run: |
@@ -1255,11 +953,14 @@ jobs:
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}

      - name: Set up Go
-        id: setup-go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

+      - name: Install archive tooling
+        if: needs.lint.outputs.full_suite == 'true'
+        run: sudo apt-get update && sudo apt-get install -y zip unzip
+
      - name: Resolve authoritative coverage base
        env:
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -1277,40 +978,7 @@ jobs:
          git rev-parse --verify "${base_ref}^{commit}" >/dev/null
          echo "COVERAGE_BASE_REF=$base_ref" >> "$GITHUB_ENV"

-      # The merge-base full-suite profile is a pure function of the base
-      # commit. Reuse the profile published by the last green push run of
-      # exactly that commit instead of re-running the whole suite; any key
-      # mismatch falls back to authoritative recomputation. Exact key only,
-      # never prefix fallback: a near-miss profile would compare the
-      # candidate against the wrong commit.
-      - name: Restore cached merge-base coverage profile
-        id: baseline-cache
-        if: needs.lint.outputs.full_suite == 'true'
-        uses: actions/cache/restore@v4
-        with:
-          path: coverage-cache.txt
-          key: dws-coverage-full-v2-${{ env.COVERAGE_BASE_REF }}-go${{ steps.setup-go.outputs.go-version }}
-
-      - name: Materialize cached merge-base coverage profile
-        if: needs.lint.outputs.full_suite == 'true' && steps.baseline-cache.outputs.cache-hit == 'true'
-        run: |
-          set -eu
-          test -s coverage-cache.txt
-          test "$(head -n 1 coverage-cache.txt)" = "mode: atomic"
-          cp coverage-cache.txt coverage-base.txt
-
-      - name: Install archive tooling
-        if: needs.lint.outputs.full_suite == 'true' && steps.baseline-cache.outputs.cache-hit != 'true'
-        run: |
-          if command -v zip >/dev/null && command -v unzip >/dev/null; then
-            echo "zip and unzip are already available"
-          else
-            sudo apt-get update
-            sudo apt-get install -y zip unzip
-          fi
-
      - name: Run baseline unit tests with coverage
-        if: steps.baseline-cache.outputs.cache-hit != 'true'
        shell: bash
        env:
          DWS_PACKAGE_VERSION: 0.0.0-test
@@ -1359,21 +1027,6 @@ jobs:
            fi
          )

-      - name: Prepare merge-base coverage profile cache
-        if: needs.lint.outputs.full_suite == 'true' && steps.baseline-cache.outputs.cache-hit != 'true'
-        run: |
-          set -eu
-          test -s coverage-base.txt
-          test "$(head -n 1 coverage-base.txt)" = "mode: atomic"
-          cp coverage-base.txt coverage-cache.txt
-
-      - name: Save merge-base coverage profile cache
-        if: needs.lint.outputs.full_suite == 'true' && steps.baseline-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
-        with:
-          path: coverage-cache.txt
-          key: dws-coverage-full-v2-${{ env.COVERAGE_BASE_REF }}-go${{ steps.setup-go.outputs.go-version }}
-
      - name: Upload baseline coverage profile
        uses: actions/upload-artifact@v4
        with:
@@ -1386,7 +1039,6 @@ jobs:
    needs:
      - lint
      - coverage-current
-      - coverage-current-full
      - coverage-supporting
      - coverage-baseline
      - coverage-darwin
@@ -1402,7 +1054,6 @@ jobs:
          FULL_SUITE: ${{ needs.lint.outputs.full_suite }}
          PLATFORM_SENSITIVE: ${{ needs.lint.outputs.platform_sensitive }}
          CURRENT_RESULT: ${{ needs.coverage-current.result }}
-          CURRENT_FULL_RESULT: ${{ needs.coverage-current-full.result }}
          SUPPORTING_RESULT: ${{ needs.coverage-supporting.result }}
          BASELINE_RESULT: ${{ needs.coverage-baseline.result }}
          DARWIN_RESULT: ${{ needs.coverage-darwin.result }}
@@ -1410,7 +1061,6 @@ jobs:
        run: |
          failed=0
          current_expected=success
-          current_full_expected=skipped
          supporting_expected=skipped
          baseline_expected=success
          native_expected=skipped
@@ -1418,8 +1068,6 @@ jobs:
            current_expected=skipped
            baseline_expected=skipped
          elif [ "$FULL_SUITE" = true ]; then
-            current_expected=skipped
-            current_full_expected=success
            supporting_expected=success
          fi
          if [ "$CHANGELOG_ONLY" != true ] &&
@@ -1430,7 +1078,6 @@ jobs:

          for profile in \
            "current:$CURRENT_RESULT:$current_expected" \
-            "current shards:$CURRENT_FULL_RESULT:$current_full_expected" \
            "supporting:$SUPPORTING_RESULT:$supporting_expected" \
            "baseline:$BASELINE_RESULT:$baseline_expected"
          do
@@ -1466,7 +1113,6 @@ jobs:
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}

      - name: Set up Go
-        id: setup-go
        if: needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true'
        uses: actions/setup-go@v5
        with:
@@ -1490,12 +1136,11 @@ jobs:
          git rev-parse --verify "${base_ref}^{commit}" >/dev/null
          echo "COVERAGE_BASE_REF=$base_ref" >> "$GITHUB_ENV"

-      - name: Download current coverage profiles
+      - name: Download current coverage profile
        if: needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true'
        uses: actions/download-artifact@v4
        with:
-          pattern: coverage-current-*
-          merge-multiple: true
+          name: coverage-current-profile
          path: .

      - name: Download supporting coverage profiles
@@ -1512,33 +1157,13 @@ jobs:
          name: coverage-baseline-profile
          path: .

-      # Shard profiles cover disjoint package sets, so their block-level
-      # concatenation is the same candidate profile one serial run produced.
-      # Every expected shard must be present; a missing shard would silently
-      # shrink the scope-matched overall comparison.
-      - name: Assemble full-suite coverage profile
-        if: needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite == 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          test ! -f coverage.txt
-          for shard in app cli generators helpers remaining; do
-            profile="coverage-shard-$shard.txt"
-            test -f "$profile"
-            test "$(head -n 1 "$profile")" = "mode: atomic"
-          done
-          printf 'mode: atomic\n' > coverage.txt
-          for shard in app cli generators helpers remaining; do
-            tail -n +2 "coverage-shard-$shard.txt" >> coverage.txt
-          done
-
      - name: Enforce coverage gate
        if: needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true'
        env:
          FULL_SUITE: ${{ needs.lint.outputs.full_suite }}
          COVERAGE_TARGET: "100"
          COVERAGE_ENFORCE_OVERALL: "false"
-          COVERAGE_OVERALL_TOLERANCE: "0.1"
+          COVERAGE_OVERALL_TOLERANCE: "0"
        run: |
          policy_profile=coverage-policy.txt
          if [ "$FULL_SUITE" != true ]; then
@@ -1552,26 +1177,6 @@ jobs:
          COVERAGE_ADDITIONAL_DIFF_PROFILE="$additional_profile" \
            make coverage-gate BASE_REF="$COVERAGE_BASE_REF"

-      # Publish this push's full-suite profile as the merge-base cache for
-      # future PRs whose merge-base is exactly this commit. Saved only after
-      # the gate passed so a broken run never becomes a baseline. Both producer
-      # and consumer use coverage-cache.txt because the cache version includes
-      # the configured path as well as the compression tool.
-      - name: Prepare push coverage profile as merge-base cache
-        if: github.event_name == 'push' && needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite == 'true'
-        run: |
-          set -eu
-          test -s coverage.txt
-          test "$(head -n 1 coverage.txt)" = "mode: atomic"
-          cp coverage.txt coverage-cache.txt
-
-      - name: Save push coverage profile as merge-base cache
-        if: github.event_name == 'push' && needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite == 'true'
-        uses: actions/cache/save@v4
-        with:
-          path: coverage-cache.txt
-          key: dws-coverage-full-v2-${{ github.sha }}-go${{ steps.setup-go.outputs.go-version }}
-
      - name: Generate coverage report
        if: needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true'
        run: |
@@ -1599,10 +1204,7 @@ jobs:
    name: Policy
    needs: lint
    runs-on: ubuntu-latest
-    # Full policy regenerates and validates the runtime Schema several times.
-    # Keep job-level headroom for large reviewed command-surface additions;
-    # individual policy gates retain their own fail-closed checks.
-    timeout-minutes: 15
+    timeout-minutes: 10
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
@@ -1636,7 +1238,6 @@ jobs:
        env:
          CLASSIFIED_CHANGELOG_CHANGED: ${{ needs.lint.outputs.changelog_changed }}
          CHANGELOG_ONLY: ${{ needs.lint.outputs.changelog_only }}
-          RELEASE_SEAL_ONLY: ${{ needs.lint.outputs.release_seal_only }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          set -eu
@@ -1663,53 +1264,31 @@ jobs:
          fi

          mode=--content-only
-          if [ "$CHANGELOG_ONLY" = true ] && [ "$RELEASE_SEAL_ONLY" != true ]; then
+          if [ "$CHANGELOG_ONLY" = true ]; then
            mode=--fast-path
          fi
          ./scripts/policy/check-changelog-pr.sh \
            "$mode" "$PR_BASE_SHA" HEAD

-      - name: Validate release fragment lifecycle
-        if: github.event_name == 'pull_request'
-        env:
-          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: ./scripts/policy/check-release-fragments.sh "$PR_BASE_SHA" HEAD
-
-      - name: Validate trusted main metadata-only push
+      - name: Validate trusted main CHANGELOG-only push
        if: github.event_name == 'push' && needs.lint.outputs.changelog_only == 'true'
        env:
          PUSH_BEFORE_SHA: ${{ github.event.before }}
          PUSH_AFTER_SHA: ${{ github.event.after }}
-          RELEASE_SEAL_ONLY: ${{ needs.lint.outputs.release_seal_only }}
        run: |
          set -eu
          test "$(git rev-parse HEAD)" = "$PUSH_AFTER_SHA" || {
            echo "checked-out push revision does not match event after SHA" >&2
            exit 1
          }
-          mode=--fast-path
-          if [ "$RELEASE_SEAL_ONLY" = true ]; then
-            mode=--content-only
-          fi
          ./scripts/policy/check-changelog-pr.sh \
-            "$mode" "$PUSH_BEFORE_SHA" "$PUSH_AFTER_SHA"
-          if [ "$RELEASE_SEAL_ONLY" = true ]; then
-            ./scripts/policy/check-release-fragments.sh \
-              "$PUSH_BEFORE_SHA" "$PUSH_AFTER_SHA"
-          fi
+            --fast-path "$PUSH_BEFORE_SHA" "$PUSH_AFTER_SHA"

      - name: Record CHANGELOG-only fast path
        if: needs.lint.outputs.changelog_only == 'true'
-        env:
-          RELEASE_SEAL_ONLY: ${{ needs.lint.outputs.release_seal_only }}
        run: |
-          if [ "$RELEASE_SEAL_ONLY" = true ]; then
-            echo "Only the trusted release-seal and fragment validators ran; executable sources are unchanged." \
-              >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "Only the trusted base-equivalent CHANGELOG validator ran; executable sources are unchanged." \
-              >> "$GITHUB_STEP_SUMMARY"
-          fi
+          echo "Only the trusted base-equivalent CHANGELOG validator ran; executable sources are unchanged." \
+            >> "$GITHUB_STEP_SUMMARY"

      - name: Validate scoped policy
        if: ${{ needs.lint.outputs.changelog_only != 'true' && (needs.lint.outputs.docs_only == 'true' || (needs.lint.outputs.full_suite != 'true' && needs.lint.outputs.interface_sensitive != 'true')) }}
@@ -1774,47 +1353,29 @@ jobs:
          if [ -z "$base_ref" ] || [ "$base_ref" = "0000000000000000000000000000000000000000" ]; then
            base_ref="$(git rev-parse HEAD^)"
          fi
-          candidate_ref="$(git rev-parse 'HEAD^{commit}')"
-          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "$candidate_ref" != "$PR_HEAD_SHA" ]; then
-            echo "Compatibility checkout $candidate_ref does not match PR head $PR_HEAD_SHA" >&2
-            exit 1
-          fi
          git rev-parse --verify "${base_ref}^{commit}" >/dev/null
-          . ./scripts/release/release-lib.sh
-          stable_ref=""
-          for tag in $(git tag --merged "$base_ref" --list 'v*' --sort=-version:refname); do
-            release_is_stable_version "$tag" || continue
-            if git rev-parse --verify --quiet "refs/tags/withdrawn/$tag" >/dev/null; then
-              continue
-            fi
-            stable_ref="$tag"
-            break
-          done
+          stable_ref="$(git tag --merged "$base_ref" --list 'v[0-9]*' --sort=-version:refname | awk 'index($0, "-") == 0 { print; exit }')"
          if [ -z "$stable_ref" ]; then
            echo "No stable release tag is reachable from compatibility base $base_ref" >&2
            exit 1
          fi
          git rev-parse --verify "${stable_ref}^{commit}" >/dev/null
-          printf '%s\n' \
-            "COMPATIBILITY_BASE_REF=$base_ref" \
-            "COMPATIBILITY_STABLE_REF=$stable_ref" \
-            "COMPATIBILITY_CANDIDATE_REF=$candidate_ref" >> "$GITHUB_ENV"
+          echo "COMPATIBILITY_BASE_REF=$base_ref" >> "$GITHUB_ENV"
+          echo "COMPATIBILITY_STABLE_REF=$stable_ref" >> "$GITHUB_ENV"

-      - name: Check historical commands, help, and complete CLI compatibility
+      - name: Check historical commands and help compatibility
        if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && (needs.lint.outputs.full_suite == 'true' || needs.lint.outputs.interface_sensitive == 'true') }}
        run: |
          make authoritative-interface-integrity \
-            BASE_REF="$COMPATIBILITY_BASE_REF" \
-            STABLE_REF="$COMPATIBILITY_STABLE_REF" \
-            CANDIDATE_REF="$COMPATIBILITY_CANDIDATE_REF"
+            BASE_REF="$COMPATIBILITY_BASE_REF"
+          if [ "$(git rev-parse "${COMPATIBILITY_BASE_REF}^{commit}")" != "$(git rev-parse "${COMPATIBILITY_STABLE_REF}^{commit}")" ]; then
+            make authoritative-interface-integrity \
+              BASE_REF="$COMPATIBILITY_STABLE_REF"
+          fi

      - name: Check complete Schema compatibility
        if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && (needs.lint.outputs.full_suite == 'true' || needs.lint.outputs.interface_sensitive == 'true') }}
-        run: |
-          make schema-compatibility \
-            BASE_REF="$COMPATIBILITY_BASE_REF" \
-            STABLE_REF="$COMPATIBILITY_STABLE_REF" \
-            CANDIDATE_REF="$COMPATIBILITY_CANDIDATE_REF"
+        run: make schema-compatibility BASE_REF="$COMPATIBILITY_BASE_REF"

      - name: Check skill command references
        if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && (needs.lint.outputs.full_suite == 'true' || needs.lint.outputs.interface_sensitive == 'true') }}
@@ -1,296 +0,0 @@
-name: PR Eval Dispatch
-
-# `/eval <products> [sha=<full-head-sha>] [cases=<ref>]` PR 评论 → 生成可验证的评测请求，报告由 bot 回贴。
-# 本 workflow 只在默认分支上下文运行，不 checkout、不执行 PR 代码。
-# 审核 SHA 规则：评测他人 PR 必须显式携带 sha=（审阅背书凭据，验证
-# 其恰为当前 open head）；评测自己创建的 PR 可省略，自动钉住派发时刻
-# 的当前 head（作者自背书，无第三方偷换窗口）；受控评测执行端另以
-# FETCH_HEAD 校验兜底派发后的变更。
-# 授权两级：仓库 write/maintain/admin 可派发任意 PR；默认分支
-# .github/eval-allowlist.txt 名单内的用户仅可派发自己创建的 PR。
-# 触发通道：workflow 先创建占位评论，再上传与本次 run/comment 绑定的
-# 不可变 manifest artifact，最后把 artifact 指针写回同一评论。评论仅是
-# 不可信通知；受控评测服务必须验证成功 run、artifact 与 manifest，并在
-# 触发评测前原子占用 manifest.idempotency_key，重复占用只能 no-op。
-
-on:
-  issue_comment:
-    types:
-      - created
-
-permissions: {}
-
-concurrency:
-  group: eval-dispatch-${{ github.event.issue.number }}
-  cancel-in-progress: false
-
-jobs:
-  dispatch:
-    name: Dispatch internal evaluation
-    if: >-
-      github.event.issue.pull_request &&
-      startsWith(github.event.comment.body, '/eval')
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      # 该 job 仅处理 PR；评论写入也限定在 PR Conversation 这一权限域。
-      pull-requests: write
-    steps:
-      - name: Check out default branch tooling
-        uses: actions/checkout@v4
-
-      - name: Verify commenter dispatch authorization
-        env:
-          GH_TOKEN: ${{ github.token }}
-          COMMENTER: ${{ github.event.comment.user.login }}
-          PR_AUTHOR: ${{ github.event.issue.user.login }}
-          EVAL_ALLOWLIST_PATH: .github/eval-allowlist.txt
-        run: |
-          # 不用 --fail：非协作者查权限返回 404 错误体，交由 guard 走名单分支；硬网络错误降级为空对象同样 fail-closed
-          permission_json="$(curl --silent --show-error \
-            -H "Authorization: Bearer ${GH_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            "https://api.github.com/repos/${GITHUB_REPOSITORY}/collaborators/${COMMENTER}/permission")" || permission_json='{}'
-          printf '%s' "$permission_json" | python3 scripts/ci/eval_dispatch_guard.py permission
-
-      - name: Parse /eval command
-        id: parse
-        continue-on-error: true
-        env:
-          COMMENT_BODY: ${{ github.event.comment.body }}
-        run: python3 scripts/ci/eval_comment_parse.py
-
-      - name: Reply usage on parse failure
-        if: steps.parse.outcome == 'failure'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.issue.number }}
-          PARSE_ERROR: ${{ steps.parse.outputs.error }}
-        run: |
-          body="❌ /eval 命令解析失败：${PARSE_ERROR}"
-          gh api --method POST \
-            "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
-            --raw-field body="$body" \
-            > /dev/null
-          exit 1
-
-      - name: Verify reviewed PR head
-        id: pr
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.issue.number }}
-          EXPECTED_PR_NUMBER: ${{ github.event.issue.number }}
-          REVIEWED_SHA: ${{ steps.parse.outputs.reviewed_sha }}
-          COMMENTER: ${{ github.event.comment.user.login }}
-        run: |
-          pr_json="$(curl --fail --silent --show-error \
-            -H "Authorization: Bearer ${GH_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            "https://api.github.com/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}")"
-          printf '%s' "$pr_json" \
-            | python3 scripts/ci/eval_dispatch_guard.py head \
-            >> "$GITHUB_OUTPUT"
-
-      - name: Create dispatch placeholder
-        id: placeholder
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.issue.number }}
-        run: |
-          set -euo pipefail
-          placeholder_body="🛰️ /eval 请求已通过权限与版本校验，正在生成可验证的评测请求。"
-          response="$(
-            gh api --method POST \
-              "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
-              --raw-field body="$placeholder_body"
-          )"
-          comment_id="$(
-            printf '%s' "$response" \
-              | jq -er \
-                --arg issue_url "https://api.github.com/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}" \
-                'select(.issue_url == $issue_url) | .id | tostring | select(test("^[1-9][0-9]*$"))'
-          )"
-          printf 'comment_id=%s\n' "$comment_id" >> "$GITHUB_OUTPUT"
-
-      - name: Build dispatch request manifest
-        env:
-          REPOSITORY_ID: '1187709537'
-          REPOSITORY: ${{ github.repository }}
-          WORKFLOW_ID: '331725458'
-          WORKFLOW_PATH: .github/workflows/eval-dispatch.yml
-          RUN_ID: ${{ github.run_id }}
-          RUN_ATTEMPT: ${{ github.run_attempt }}
-          SOURCE_COMMENT_ID: ${{ github.event.comment.id }}
-          DISPATCH_COMMENT_ID: ${{ steps.placeholder.outputs.comment_id }}
-          ACTOR_ID: ${{ github.event.comment.user.id }}
-          ACTOR_LOGIN: ${{ github.event.comment.user.login }}
-          PR_NUMBER: ${{ github.event.issue.number }}
-          PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
-          PRODUCTS: ${{ steps.parse.outputs.products }}
-          CASES_REF: ${{ steps.parse.outputs.cases_ref }}
-          SOURCE_BODY: ${{ github.event.comment.body }}
-          MANIFEST_PATH: ${{ runner.temp }}/eval-dispatch-request.json
-        run: |
-          set -euo pipefail
-          if [ "$REPOSITORY" != "DingTalk-Real-AI/dingtalk-workspace-cli" ]; then
-            echo "unexpected repository: ${REPOSITORY}" >&2
-            exit 1
-          fi
-          for value in \
-            "$REPOSITORY_ID" \
-            "$WORKFLOW_ID" \
-            "$RUN_ID" \
-            "$RUN_ATTEMPT" \
-            "$SOURCE_COMMENT_ID" \
-            "$DISPATCH_COMMENT_ID" \
-            "$ACTOR_ID" \
-            "$PR_NUMBER"; do
-            if [[ ! "$value" =~ ^[1-9][0-9]*$ ]]; then
-              echo "dispatch manifest contains a non-canonical identifier" >&2
-              exit 1
-            fi
-          done
-          if [[ ! "$PR_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "dispatch manifest contains an invalid PR head SHA" >&2
-            exit 1
-          fi
-
-          hash_output="$(printf '%s' "$SOURCE_BODY" | sha256sum)"
-          source_body_sha256="${hash_output%% *}"
-          if [[ ! "$source_body_sha256" =~ ^[0-9a-f]{64}$ ]]; then
-            echo "failed to hash source comment" >&2
-            exit 1
-          fi
-          idempotency_key="${REPOSITORY_ID}:${SOURCE_COMMENT_ID}"
-
-          umask 077
-          jq -n \
-            --arg repository_id "$REPOSITORY_ID" \
-            --arg repository "$REPOSITORY" \
-            --arg workflow_id "$WORKFLOW_ID" \
-            --arg workflow_path "$WORKFLOW_PATH" \
-            --arg run_id "$RUN_ID" \
-            --arg run_attempt "$RUN_ATTEMPT" \
-            --arg source_comment_id "$SOURCE_COMMENT_ID" \
-            --arg dispatch_comment_id "$DISPATCH_COMMENT_ID" \
-            --arg actor_id "$ACTOR_ID" \
-            --arg actor_login "$ACTOR_LOGIN" \
-            --arg pr_number "$PR_NUMBER" \
-            --arg pr_head_sha "$PR_HEAD_SHA" \
-            --arg products "$PRODUCTS" \
-            --arg cases_ref "$CASES_REF" \
-            --arg source_body_sha256 "$source_body_sha256" \
-            --arg idempotency_key "$idempotency_key" \
-            '{
-              schema_version: 1,
-              repository_id: $repository_id,
-              repository: $repository,
-              workflow_id: $workflow_id,
-              workflow_path: $workflow_path,
-              run_id: $run_id,
-              run_attempt: $run_attempt,
-              source_comment_id: $source_comment_id,
-              dispatch_comment_id: $dispatch_comment_id,
-              actor_id: $actor_id,
-              actor_login: $actor_login,
-              pr_number: $pr_number,
-              pr_head_sha: $pr_head_sha,
-              products: $products,
-              cases_ref: $cases_ref,
-              source_body_sha256: $source_body_sha256,
-              idempotency_key: $idempotency_key
-            }' > "$MANIFEST_PATH"
-
-      - name: Upload dispatch request manifest
-        id: artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: eval-dispatch-request-${{ github.run_id }}-${{ github.run_attempt }}-${{ steps.placeholder.outputs.comment_id }}
-          path: ${{ runner.temp }}/eval-dispatch-request.json
-          if-no-files-found: error
-          retention-days: 1
-          overwrite: false
-
-      - name: Finalize dispatch marker
-        env:
-          GH_TOKEN: ${{ github.token }}
-          DISPATCH_COMMENT_ID: ${{ steps.placeholder.outputs.comment_id }}
-          REPOSITORY_ID: '1187709537'
-          WORKFLOW_ID: '331725458'
-          WORKFLOW_PATH: .github/workflows/eval-dispatch.yml
-          RUN_ID: ${{ github.run_id }}
-          RUN_ATTEMPT: ${{ github.run_attempt }}
-          ARTIFACT_ID: ${{ steps.artifact.outputs.artifact-id }}
-          ARTIFACT_DIGEST: ${{ steps.artifact.outputs.artifact-digest }}
-          PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
-          PRODUCTS: ${{ steps.parse.outputs.products }}
-          CASES_REF: ${{ steps.parse.outputs.cases_ref }}
-        run: |
-          set -euo pipefail
-          if [[ ! "$DISPATCH_COMMENT_ID" =~ ^[1-9][0-9]*$ ]] || \
-             [[ ! "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]; then
-            echo "artifact marker contains a non-canonical identifier" >&2
-            exit 1
-          fi
-
-          artifact_digest="${ARTIFACT_DIGEST,,}"
-          if [[ "$artifact_digest" != sha256:* ]]; then
-            artifact_digest="sha256:${artifact_digest}"
-          fi
-          if [[ ! "$artifact_digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
-            echo "artifact marker contains an invalid digest" >&2
-            exit 1
-          fi
-
-          marker_json="$(
-            jq -nc \
-              --arg repository_id "$REPOSITORY_ID" \
-              --arg workflow_id "$WORKFLOW_ID" \
-              --arg workflow_path "$WORKFLOW_PATH" \
-              --arg run_id "$RUN_ID" \
-              --arg run_attempt "$RUN_ATTEMPT" \
-              --arg dispatch_comment_id "$DISPATCH_COMMENT_ID" \
-              --arg artifact_id "$ARTIFACT_ID" \
-              --arg artifact_digest "$artifact_digest" \
-              '{
-                schema_version: 1,
-                repository_id: $repository_id,
-                workflow_id: $workflow_id,
-                workflow_path: $workflow_path,
-                run_id: $run_id,
-                run_attempt: $run_attempt,
-                dispatch_comment_id: $dispatch_comment_id,
-                artifact_id: $artifact_id,
-                artifact_digest: $artifact_digest
-              }'
-          )"
-          cases_note=""
-          if [ -n "$CASES_REF" ]; then
-            cases_note="，用例版本 \`${CASES_REF}\`"
-          fi
-          body="<!-- eval-dispatch: ${marker_json} -->"$'\n'"🛰️ /eval 已受理：产品集 \`${PRODUCTS}\`${cases_note}，评测对象 \`${PR_HEAD_SHA}\`。"$'\n'"受控评测服务将在数分钟内处理，完成后由 bot 回贴报告。"
-          response="$(
-            gh api --method PATCH \
-              "repos/${GITHUB_REPOSITORY}/issues/comments/${DISPATCH_COMMENT_ID}" \
-              --raw-field body="$body"
-          )"
-          printf '%s' "$response" \
-            | jq -e \
-              --arg comment_id "$DISPATCH_COMMENT_ID" \
-              --arg body "$body" \
-              '((.id | tostring) == $comment_id) and (.body == $body)' \
-              > /dev/null
-
-      - name: Mark dispatch preparation failure
-        if: ${{ failure() && steps.placeholder.outputs.comment_id != '' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          DISPATCH_COMMENT_ID: ${{ steps.placeholder.outputs.comment_id }}
-        run: |
-          failure_body="❌ /eval 请求准备失败，未生成可消费的评测请求。请稍后重试。"
-          gh api --method PATCH \
-            "repos/${GITHUB_REPOSITORY}/issues/comments/${DISPATCH_COMMENT_ID}" \
-            --raw-field body="$failure_body" \
-            > /dev/null \
-            || true
@@ -14,12 +14,9 @@ jobs:
        uses: actions/github-script@v7
        with:
          script: |
-            const webhooks = [
-              process.env.DINGTALK_WEBHOOK,
-              process.env.DINGTALK_WEBHOOK_SECONDARY
-            ].filter(Boolean);
-            if (webhooks.length === 0) {
-              console.log('⚠️ No DingTalk webhook configured, skipping notification');
+            const webhook = process.env.DINGTALK_WEBHOOK;
+            if (!webhook) {
+              console.log('⚠️ DINGTALK_WEBHOOK not set, skipping notification');
              return;
            }
            
@@ -42,15 +39,12 @@ jobs:
              }
            };
            
-            await Promise.all(webhooks.map(webhook =>
-              fetch(webhook, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify(message)
-              })
-            ));
+            await fetch(webhook, {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify(message)
+            });
            
-            console.log(`✅ DingTalk notification sent to ${webhooks.length} webhook(s)`);
+            console.log('✅ DingTalk notification sent');
        env:
          DINGTALK_WEBHOOK: ${{ secrets.DINGTALK_WEBHOOK }}
-          DINGTALK_WEBHOOK_SECONDARY: ${{ secrets.DINGTALK_WEBHOOK_SECONDARY }}
@@ -2645,40 +2645,6 @@ jobs:
          "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh" \
            "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"

-      # The sealed candidate tag is intentionally visible while its GitHub
-      # authority is checked above. Compatibility must instead discover the
-      # previous delivered stable tag, so hide only this verified candidate
-      # from this isolated runner's local tag namespace.
-      - name: Prepare delivered-stable compatibility ref view
-        if: ${{ matrix.check == 'compatibility' }}
-        env:
-          RELEASE_VERSION: ${{ needs.release-contract.outputs.release_version }}
-          RELEASE_COMMIT: ${{ needs.release-contract.outputs.release_commit }}
-          RELEASE_TAG_OBJECT: ${{ needs.release-contract.outputs.release_tag_object }}
-          PREVIOUS_STABLE: ${{ needs.release-contract.outputs.previous_stable }}
-          PREVIOUS_STABLE_COMMIT: ${{ needs.release-contract.outputs.previous_stable_commit }}
-        run: |
-          set -eu
-          test -n "$RELEASE_VERSION"
-          test -n "$RELEASE_COMMIT"
-          test -n "$RELEASE_TAG_OBJECT"
-          test -n "$PREVIOUS_STABLE"
-          test -n "$PREVIOUS_STABLE_COMMIT"
-          test "$RELEASE_VERSION" != "$PREVIOUS_STABLE"
-          test "$(git rev-parse HEAD)" = "$RELEASE_COMMIT"
-          test "$(git rev-parse --verify "refs/tags/${RELEASE_VERSION}")" = "$RELEASE_TAG_OBJECT"
-          test "$(git rev-parse --verify "refs/tags/${RELEASE_VERSION}^{commit}")" = "$RELEASE_COMMIT"
-          test "$(git rev-parse --verify "${PREVIOUS_STABLE}^{commit}")" = "$PREVIOUS_STABLE_COMMIT"
-
-          git update-ref -d "refs/tags/${RELEASE_VERSION}" "$RELEASE_TAG_OBJECT"
-
-          if git show-ref --verify --quiet "refs/tags/${RELEASE_VERSION}"; then
-            echo "sealed candidate tag is still visible to compatibility baseline discovery" >&2
-            exit 2
-          fi
-          test "$(git rev-parse HEAD)" = "$RELEASE_COMMIT"
-          test "$(git rev-parse --verify "${PREVIOUS_STABLE}^{commit}")" = "$PREVIOUS_STABLE_COMMIT"
-
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
@@ -2698,11 +2664,9 @@ jobs:
              ;;
            compatibility)
              test -n "$PREVIOUS_STABLE"
-              "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/check-release-compatibility.sh" \
-                --repo-root "$GITHUB_WORKSPACE" \
+              ./scripts/policy/check-command-compatibility.sh \
                --base-ref HEAD \
-                --stable-ref "$PREVIOUS_STABLE" \
-                --candidate-ref HEAD
+                --stable-ref "$PREVIOUS_STABLE"
              ;;
            e2e)
              bash scripts/dev/test-multi-profile-e2e.sh
@@ -2829,7 +2793,7 @@ jobs:
            fi
            if test "${{ needs.dispatch-contract.outputs.mode }}" = plan_release; then
              echo
-              echo "Plan only: no tag or package was created. Render pending \`.changes/*.md\` fragments into the exact \`CHANGELOG.md\` section, merge the release-seal PR to main, then run publish."
+              echo "Plan only: no tag or package was created. Add the exact \`CHANGELOG.md\` section, merge it to main, then run publish."
            fi
          } >> "$GITHUB_STEP_SUMMARY"

@@ -21,11 +21,6 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
-      - name: Check out trusted routing policy
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          persist-credentials: false
      - name: Route review and enable auto-merge
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        with:
@@ -34,13 +29,12 @@ jobs:
            const repo = context.repo.repo;
            const pullNumber = context.payload.pull_request.number;
            const eventHeadSha = context.payload.pull_request.head.sha;
-            const {
-              REVIEWER_POOL,
-              requestReviewersWithFallback,
-              resolveReviewRouting,
-              reviewerCandidates,
-            } = require('./.github/reviewer-routing.js');
-            const reviewerPool = REVIEWER_POOL;
+            const reviewerPool = [
+              'sczheng189',
+              'shangguanxuan633-lab',
+              'audanye-sudo',
+              'wxianfeng',
+            ];

            async function getReadyEventPull(phase) {
              const {data: currentPull} = await github.rest.pulls.get({
@@ -73,21 +67,6 @@ jobs:
                : author;

            async function routeReview() {
-              let changedFiles;
-              try {
-                changedFiles = await github.paginate(github.rest.pulls.listFiles, {
-                  owner,
-                  repo,
-                  pull_number: pullNumber,
-                  per_page: 100,
-                });
-              } catch (error) {
-                core.warning(
-                  `Could not inspect changed files for PR #${pullNumber}; using load-balanced fallback (${error.status || 'unknown status'}).`,
-                );
-                changedFiles = [];
-              }
-
              const eligible = reviewerPool.filter(
                reviewer =>
                  reviewer.toLowerCase() !== author &&
@@ -98,9 +77,13 @@ jobs:
                return;
              }

-              const existingRequestedReviewers = new Set(
-                (pullRequest.requested_reviewers || []).map(({login}) => login.toLowerCase()),
-              );
+              const alreadyRequested =
+                (pullRequest.requested_reviewers || []).length > 0 ||
+                (pullRequest.requested_teams || []).length > 0;
+              if (alreadyRequested) {
+                core.info(`PR #${pullNumber} already has a requested reviewer; leaving it unchanged.`);
+                return;
+              }

              let reviews;
              try {
@@ -133,18 +116,22 @@ jobs:
                  latestDecisionByLogin.set(login, review);
                }
              }
-              const currentHeadReviewers = new Set(
-                [...latestDecisionByLogin.values()]
-                  .filter(
-                    review =>
-                      review.commit_id === headSha &&
-                      eligible.some(
-                        reviewer => reviewer.toLowerCase() === review.user.login.toLowerCase(),
-                      ) &&
-                      ['APPROVED', 'CHANGES_REQUESTED'].includes(review.state),
-                  )
-                  .map(review => review.user.login.toLowerCase()),
+              const currentHeadDecision = [...latestDecisionByLogin.values()].find(
+                review =>
+                  review.commit_id === headSha &&
+                  eligible.some(
+                    reviewer =>
+                      reviewer.toLowerCase() ===
+                      review.user.login.toLowerCase(),
+                  ) &&
+                  ['APPROVED', 'CHANGES_REQUESTED'].includes(review.state),
              );
+              if (currentHeadDecision) {
+                core.info(
+                  `PR #${pullNumber} already has a ${currentHeadDecision.state} review on its current head; leaving review ownership unchanged.`,
+                );
+                return;
+              }

              const loads = new Map(eligible.map(reviewer => [reviewer, 0]));
              try {
@@ -191,42 +178,20 @@ jobs:
                  tieOrder.get(left) - tieOrder.get(right),
              );

-              const routing = resolveReviewRouting({
-                files: changedFiles,
-                author,
-                latestPusher,
-                fallbackReviewers: ranked,
-              });
-              const candidates = reviewerCandidates({
-                preferredReviewers: routing.reviewers,
-                fallbackReviewers: ranked,
-                eligibleReviewers: eligible,
-              });
-              const desiredReviewers = candidates.slice(0, routing.requiredReviewers);
-              if (routing.reason === 'unknown_paths' && currentHeadReviewers.size > 0) {
-                core.info(
-                  `PR #${pullNumber} has a current-head review for unknown paths; leaving manual ownership unchanged.`,
-                );
-                return;
-              }
-              core.info(
-                `PR #${pullNumber} routing: ${routing.reason}; modules=${routing.modules.map(module => module.id).join(',') || 'unknown'}; reviewers=${desiredReviewers.join(',') || 'load-balanced fallback'}.`,
-              );
-
-              const satisfiedReviewers = new Set([
-                ...currentHeadReviewers,
-                ...[...existingRequestedReviewers].filter((reviewer) =>
-                  candidates.some((candidate) => candidate.toLowerCase() === reviewer),
-                ),
-              ]);
-              const requestResult = await requestReviewersWithFallback({
-                candidates,
-                requiredReviewers: routing.requiredReviewers,
-                satisfiedReviewers: [...satisfiedReviewers],
-                requestReviewer: async (reviewer) => {
+              for (const reviewer of ranked) {
+                try {
                  const currentPull = await getReadyEventPull('review request');
                  if (!currentPull) {
-                    return false;
+                    return;
+                  }
+                  if (
+                    (currentPull.requested_reviewers || []).length > 0 ||
+                    (currentPull.requested_teams || []).length > 0
+                  ) {
+                    core.info(
+                      `PR #${pullNumber} received a reviewer while routing; leaving it unchanged.`,
+                    );
+                    return;
                  }
                  await github.rest.pulls.requestReviewers({
                    owner,
@@ -237,23 +202,15 @@ jobs:
                  core.info(
                    `Requested @${reviewer} for PR #${pullNumber} (open request load: ${loads.get(reviewer)}).`,
                  );
-                  return true;
-                },
-                onFailure: (reviewer, error) => {
+                  return;
+                } catch (error) {
                  core.warning(
                    `Could not request @${reviewer} for PR #${pullNumber}; trying the next candidate (${error.status || 'unknown status'}).`,
                  );
-                },
-              });
-              if (requestResult.aborted) {
-                return;
+                }
              }

-              if (requestResult.satisfiedReviewers.length < routing.requiredReviewers) {
-                core.warning(
-                  `Only ${requestResult.satisfiedReviewers.length} of ${routing.requiredReviewers} required reviewers could be satisfied for PR #${pullNumber}.`,
-                );
-              }
+              core.warning(`No reviewer request could be created for PR #${pullNumber}.`);
            }

            async function enableAutoMerge() {
@@ -20,10 +20,6 @@ test/cli_compat/testdata/
 .gitignore
 .worktrees/
 .qoder/
-_logs/
-_docs/
-_output/
-vendor/

 # Secrets & credentials
 .env
@@ -5,75 +5,21 @@ unrelated work, and use `gofmt` for every modified Go file.

 ## Build and test

- Build: `make build` (wraps `scripts/dev/build.sh` → `go build -o dws ./cmd`; bare `go build ./cmd` fails because output name `cmd` collides with the directory)
+- Build: `go build ./cmd`
 - Full test suite: `DWS_PACKAGE_VERSION=0.0.0-test go test ./...`
- Param aliases generate: `go generate ./internal/cli` (entry point: `internal/cli/gen.go`; Catalog is not generated)
- Optional diagnostic MCP dump (not a Schema pin): `make fetch-mcp-metadata` (requires `dws auth login`; writes under `artifacts/`)
- Check generated drift + assembly determinism: `./scripts/policy/check-generated-drift.sh`
+- Generate Schema assets: `go generate ./internal/cli` (entry point: `internal/cli/gen.go`)
+- Refresh pinned MCP metadata: `make fetch-mcp-metadata` (requires `dws auth login`)
+- Check generated drift: `./scripts/policy/check-generated-drift.sh`
 - Check the Schema contract: `./scripts/policy/check-schema-catalog.sh`
- Coverage-gate test naming: tests that carry coverage for the macOS platform
-  gate must be named `TestCrossPlatformCoverage*` (or `TestAllShortcuts*`);
-  `scripts/policy/run-platform-coverage-gate.sh` only selects those prefixes,
-  so a covering test with any other name silently leaves its target uncovered.
- Package-var injection seams (e.g. `pipelineBuildEffectiveRegistry`): swap
-  them in tests only via `testseam.Swap(t, &seam, stub)` from
-  `internal/testseam` — it restores the previous value through `t.Cleanup`
-  structurally. Like the manual pattern it replaces, Swap mutates global state
-  and is **not** safe for `t.Parallel` tests.
- Cross-package test helpers (e.g. `StoreProductDeclRawForTest`) live in
-  per-package `fortest.go` files, never scattered through production files;
-  the `ForTest` suffix is the boundary and production code must not call them.

-Schema Catalog delivery is **声明即 Catalog**: production assembles via
-`RegisterSchemaSourceRoot` → `ResolveSchemaBuild` (factory registered in
-`internal/app`). There is no
-`cmd_schema_catalog` `//go:generate` delivery step. `dws schema -f json` remains
-the wire projection. `cmd_schema_catalog` produces CI/local dumps only;
-`internal/cli/schema_catalog/`, `internal/cli/schema_meta_index.gob`, and
-`internal/cli/schema_meta_index.json` must not be committed. `schema_agent_metadata/` is retired: if that directory
-(or `schema_agent_metadata_audit.json`) is present, policy fails.
-Command identity is no longer a file input: it is collected from
-`ContractFinal.Identity` on the live Cobra leaves
-(`internal/cli/schema_identity_collect.go` → `BuildEffectiveCommandRegistry`).
-The reviewed `schema_command_registry/` was retired together with that
-switchover and must not reappear; identity changes happen by editing the leaf
-declaration. The remaining **reviewed inputs** under `internal/cli` (see Agent
-Schema contract) keep separate authorities — do not merge them with
-`param_concepts.json` or promote any of them into Catalog declaration.
-
-## Command framework declaration
-
- Framework definition: `docs/rfc-command-framework-convergence.md` **§5.0**
- Today: `helpers.LeafSpec` / `shortcut.Shortcut` → `corecmd.Spec` (+ optional `Contract`) → `corecmd.New`
- **Declare = final Schema source**: `Flags` / `Constraints` / `Safety` / `ConstParams` / `Contract` (`corecmd.ContractDecl`; nested fields are `contract.*`)
- Naming: `ContractDecl` is the authoring leaf declaration. "Schema" means Catalog / `ToolSpec` delivery — do not reintroduce `SchemaDecl`.
- `Safety` uses `contract.SafetySpec` (`internal/corecmd/contract` only — no `cli.*` type alias). Its `confirmation` drives the runtime gate; `effect` / `risk` / `idempotency` are published unchanged. When `Contract` is set, convert once via `contractfinal.RegisterRuntimeContractFinal` (all callers — `corecmd.New` registers internally); assembly **pass-throughs** Final.
- Package seam:
-  - types / ProductDecl → `corecmd/contract` (DTO only; **no** Cobra-keyed ContractFinal store)
-  - AnnotateRuntime* writers → `internal/corecmd/runtimeannotate` (framework-owned)
-  - ContractFinal cobra store + Register → `internal/corecmd/contractfinal` (framework-owned)
-  - homology gates → `internal/cli/homology`
-  - Catalog assembly / `ResolveMeta` (`RegisterSchemaSourceRoot` → `ResolveSchemaBuild`); go:embed only for reviewed inputs → `internal/cli` root (package-local aliases for annotate/store APIs live in `runtime_schema_seam.go`; the former `cli/runtimeannotate` / `cli/contractfinal` shim packages are removed — import `corecmd/*` directly)
-  - **Hard rule**: `internal/corecmd` (and its subpackages) must **not** import any `internal/cli` package
- Authoring tiers (current, not aspirational):
-  - **Tier1** — `corecmd.New` / `helpers.NewLeafCommand` (fully managed declare + execute)
-  - **Tier2** — `DeclareLeafMetadata` (helpers migration; **Shortcut may also use this path — acceptable**)
-  - **Tier3** — bare Cobra (should shrink over time; reviewed exclusions where needed)
-  - Long-term outlook only: broader mcpbind / fewer hand-written `Execute` bodies. **Not** a current hard requirement to delete `Shortcut.Execute` or force mcpbind.
- Description declare vs delivery: construction requires `ContractDecl.Description` (evidence). Catalog delivery prefers Cobra Long → provenance `cobra_help`; without Long, declared text → `contract_final`. Title: declared first, then Short, then MCP. Do **not** read this as "declare = wire final" or dual authority.
- **Execute** = hooks (`Validate` / `Call` / `RunE` / `PostMount`) — not a second surface authority
- Declaration path has **no reviewed parallel fields**; migration-only `runtime_gate` annotate until `Safety` is declared
- **Do not add** new production `AnnotateRuntimeRisk` / `AnnotateRuntimeGate`
-  (`runtime_gate`) call sites; migrate leaves to declared `Safety` /
-  `ContractDecl` instead. Existing annotate sites may remain until migrated.
-
-## flag / help / schema homology
-
- Decision (path A — Contract/LeafSpec is CLI-surface authority **and must embed into Schema**): `docs/flag-help-schema-homology.md`
- Hard rule: every help/Schema fact is **declared** **or** **annotated**; never inference-only (§1.1–§1.3; framework §5.0).
- Embed path: `corecmd.New` → `dws.schema.*` annotations → Schema catalog assembly
- MCP metadata must not create CLI flags; optional 1:1 passthrough is a gated subset only.
- Gate IDs: `HOM-P*`, `HOM-S*`, `HOM-I1`, `HOM-D1` (see that doc §3–§4). `HOM-P1`/`HOM-D1`/`HOM-S1`/`HOM-S2` are on the `check-schema-catalog.sh` policy whitelist; remaining IDs land incrementally.
+Generated Schema JSON is committed. Change its source inputs and generators,
+then regenerate; do not hand-edit generated Catalog or Agent metadata files.
+`internal/cli/schema_command_registry.json` is different: it is a reviewed
+`CommandRegistry` source, not a generated snapshot. It is the single reviewed
+source of stable canonical identity,
+primary paths, aliases, and navigation. Edit it only when reviewed exposure,
+identity, primary path, or aliases change; parameter, Skill, and metadata-only
+changes must not rewrite it mechanically.

 ## Agent Schema contract

@@ -82,115 +28,90 @@ The Schema data flow is one way:
 ```text
 1. app.NewRootCommand()
   └─ builds the real Cobra command tree and flags
-   └─ leaf Safety / Contract / contract.ParamDecl declare ContractFinal (declare-or-annotate)

-2. CollectIdentitySpecs (ContractFinal.Identity on live Cobra leaves)
+2. schema_command_registry.json
+   + schema_hints/metadata/<product>.json tool parameters (+ cli_path)
   └─ forms EffectiveCommandRegistry
      └─ binds exactly to real Cobra leaves and aliases

 3. Parameter resolution
   Cobra flags
-   + contract.ParamDecl.Property / native annotations (primary property authority)
-   + schema_parameter_mapping_ledger.go (mapping_exclusions / removals only;
-     active bindings JSON retired after Track 1 Phase 2)
+   + schema_parameter_bindings.json
+   + metadata tool parameters
   └─ produces ParameterSpec and constraints

 4. Agent and interface semantics
-   ProductDecl + leaf ContractFinal Selection / Safety / Interface
-   + contract.ParamDecl (interface_type / property)
+   schema_hints/selection/<product>.json   (selection prose)
+   + schema_hints/metadata/<product>.json  (safety/interface/runtime_gate)
+   + pinned MCP metadata
   └─ resolves Agent metadata by source precedence
      Markdown is evidence only; it is not concatenated into final prose
-   └─ schema_hints/ and schema_mcp_metadata.json are fully retired

-  5. One typed hub
+5. One typed hub
   BoundCommandRegistry
   + ParameterSpec
   + Agent metadata
   + Interface metadata
   └─ resolves every command exactly once into ToolSpec
-   └─ aggregates SchemaRegistry + SchemaIndex
-   └─ ResolveSchemaBuild assembles at runtime; deliverySchemaCatalog wraps it (lazy, sync.Once)
+      └─ aggregates SchemaRegistry + SchemaIndex

-  6. Runtime delivery (no generate-written Catalog authority)
+6. One-way publication
   SchemaRegistry
-   └─ dws schema list/product/group/leaf/--all (-f json wire)
-   └─ ResolveMeta projects Identity/Safety/Selection from the same registry
-   └─ CI may dump Catalog via cmd_schema_catalog for jq gates / determinism
+   └─ internal/cli/schema_catalog/
+      (catalog.json + tools/<product>.json; split per product so
+       concurrent feature PRs only rewrite their own shard)
+      └─ dws schema list/product/group/leaf/--all
+
+7. Runtime consumption (unified API)
+   ResolveMeta(cliPath) → CommandMeta{Identity, Safety, Selection}
+   └─ internal/cli/command_meta.go
+   └─ all consumers (help, schema, agent, skill-gen) call this one function
+   └─ backed by embedded catalog (sync.Once lazy map, O(1) lookup)
 ```

-**Reviewed inputs / 评审输入** (organizational family under `internal/cli`;
-parallel peers, not one merged authority). These are assembly inputs only —
-never Catalog declaration authority, never leaf `Contract` / `ProductDecl`
-substitutes. Keep them side-by-side; do **not** fold one into another:
-
-| Input | Path | Owns |
-|---|---|---|
-| Command identity | collected from `ContractFinal.Identity` on live Cobra leaves (`schema_identity_collect.go`; not a file input) | stable identity, primary CLI path, aliases, navigation |
-| Param concepts | `param_concepts.json` (+ `.schema.json`) | argv synonym / concept dictionary (reduced to `param_aliases_generated.go`) |
-| Exclusions | `schema_command_exclusions.go` | exact reviewed CLI paths excluded from Schema (non-empty reason) |
-| Mapping ledger | `schema_parameter_mapping_ledger.go` | `mapping_exclusions` / removals (CLI flags with no direct RPC property); active bindings JSON retired |
-
-`schema_mcp_metadata.json` is retired and must not reappear. Interface facts
-(`interface_ref`, `interface_type`, …) declare on leaf `Contract` /
-`contract.ParamDecl`. Retiring the pin cleared MCP-sourced `interface_type`
-values from the wire; schema-compat deliberately accepts clearing (missing =
-unknown for consumers) while still rejecting any change to a different
-non-empty value. Re-populating a value requires an explicit `ParamDecl`
-declaration, not a new pin.
-
-**Aliases are three distinct layers** (do not conflate):
-
-| Layer | Owns |
-|---|---|
-| `FlagSpec.Aliases` / Cobra flag aliases | executable flag synonyms on a leaf |
-| `ContractFinal.Identity` `aliases` | reviewed CLI-path aliases for the same command identity |
-| `param_concepts.json` | argv synonym / concept dictionary (central preparse normalization) |
-
-**Visibility vs exclusions:** collected identity `visibility` is dormant (all
-entries default `public`); “runnable but not Agent-visible” belongs in
-`schema_command_exclusions.go`, not new `visibility` values. Native identity
-annotations are consistency assertions only — they must agree with the
-collected identity and never materialize or override it.
-
-Leaf declare (`Contract` / `ParamDecl` / `Safety` / `ProductDecl`) and the live
-Cobra tree remain separate from this table: declare owns semantics; Cobra owns
-executability and flags.
-
-After binding there is no second identity source and no identity precedence
-winner. The binder must reject a missing/non-runnable Cobra path, an alias
-collision, and any native identity annotation that disagrees with the effective
-registry. A missing native identity annotation is allowed because annotations
-are implementation-side assertions, not identity fallbacks.
+Parameter overlays from metadata are merged into `EffectiveCommandRegistry`
+*before* Cobra binding; after that point there is no second identity source and
+no identity precedence winner. The binder must reject a missing/non-runnable
+Cobra path, an alias collision, and any native identity annotation that
+disagrees with the effective registry. A missing native identity annotation is
+allowed because annotations are implementation-side assertions, not identity
+fallbacks.

 The assembler resolves every bound command exactly once into one `ToolSpec`.
-CI determinism (`check-schema-assembly.sh`) and policy jq gates consume a
-fresh assembly dump; runtime consumes the same `ResolveSchemaBuild` path via
-`RegisterSchemaSourceRoot`. Neither path may reopen annotations, merge source
-records, or use a previous Catalog JSON as a source.
+Build-time gates and the snapshot serializer consume that source-resolved typed
+registry/index. Runtime projections and delivery gates consume the typed
+registry/index returned by the production snapshot loader. Neither path may
+reopen annotations, merge source records, or use a previous Catalog or other
+generated JSON as a source. `schema_catalog/` (catalog.json + per-product
+tools/<product>.json shards) is output-only in the
+generation graph. The production loader decoding the embedded published
+snapshot is a delivery boundary, not source resolution; it must never create or
+repair a Cobra command, flag, registry entry, or later Catalog generation.

-### Assembly vs consumption
+### Generation vs consumption separation

-**Assembly** (declare → typed registry; CI + runtime):
- Runtime entry: `RegisterSchemaSourceRoot` (`internal/app`) →
-  `ResolveSchemaBuild` / `deliverySchemaCatalog` (lazy, sync.Once).
- CI tool: `cmd_schema_catalog` dumps an assembled Catalog for jq/determinism;
-  it is **not** a `//go:generate` or committed delivery step.
- `gen.go` only generates `param_aliases_generated.go`.
- Inputs: **reviewed inputs** (param_concepts / exclusions / mapping ledger —
-  see table above) + ProductDecl/ContractFinal (identity is collected from
-  `ContractFinal.Identity`) + live Cobra tree.
-  `schema_hints/`, `schema_agent_metadata/`, `schema_command_registry/`, and
-  `schema_mcp_metadata.json` must not reappear.
- Gates: `make generate-schema` (param aliases + assembly determinism),
-  `check-generated-drift.sh`, `check-schema-catalog.sh`.
+The Schema system has two physically separated processes:

-**Consumption** (runtime, unified API):
+**Generation** (build-time, slow, reviewed, one-way):
+- Entry point: `internal/cli/gen.go` (all `//go:generate` pragmas isolated here,
+  not in business code).
+- Tools: `internal/generator/cmd_schema_agent_metadata` + `cmd_schema_catalog` +
+  `cmd_param_aliases` (standalone Go mains).
+- Inputs: 7 authored source groups (registry + hints metadata + hints selection +
+  MCP metadata + parameter bindings + reviewed parameter concepts + cobra tree).
+- Output: `schema_catalog/` (per-product shards) + `schema_agent_metadata/` +
+  `param_aliases_generated.go`.
+- Refresh MCP metadata: `make fetch-mcp-metadata` (iterates 26 MCP server
+  endpoints, merges with previous data for cross-server interface_ref).
+- Gates: `make generate-schema` (byte guards on inputs), `check-generated-drift.sh`,
+  `check-command-surface.sh` (catalog structure).
+
+**Consumption** (runtime, fast, read-only, unified API):
 - Entry point: `ResolveMeta(cliPath) → CommandMeta{Identity, Safety, Selection}`
-  in `internal/cli/command_meta.go` — projected from the assembled registry
-  when the app factory is registered.
+  in `internal/cli/command_meta.go`.
+- Backed by embedded catalog (`embeddedSchemaCatalog()`, sync.Once, O(1) map).
 - Consumers: `--help` (Safety annotation via `RenderSafetyAnnotation`),
-  agent selection, future skill generation; `dws schema` uses the same
-  assembled Catalog (`-f json` wire unchanged).
+  `dws schema`, agent selection, future skill generation.
 - `SafetyForCLIPath` delegates to `ResolveMeta` (backward compatible).

 This split is architecturally isomorphic to Lark's typed metadata registry,
@@ -198,17 +119,16 @@ navigation catalog, and schema renderer. DWS intentionally preserves its
 existing flat JSON wire contract for compatibility; do not treat architectural
 alignment as permission to make an unversioned wire-format change.

-The identity collected from `ContractFinal.Identity` (via
-`CollectIdentitySpecs`) is the sole source of stable command identity and
-navigation. The executable Cobra tree remains the source of truth for whether
-a CLI path exists, is runnable, and which flags it accepts. Schema coverage is
-bidirectional:
+The reviewed `CommandRegistry` is the sole source of stable command identity
+and navigation. The executable Cobra tree remains the source of truth for
+whether a CLI path exists, is runnable, and which flags it accepts. Schema
+coverage is bidirectional:

 1. Every final `SchemaRegistry` tool, including its serialized Catalog
   projection, must resolve to an executable Cobra command.
 2. Every public runnable Cobra leaf must either resolve to Schema or appear as
   an exact, reviewed exclusion with a non-empty reason in
-   `internal/cli/schema_command_exclusions.go` (central Go groups; not JSON).
+   `internal/cli/schema_command_exclusions.json`.

 Do not use prefix or wildcard exclusions: they can silently hide future
 commands. Remove an exclusion when its command enters Schema; stale, invalid,
@@ -216,117 +136,115 @@ or duplicate exclusions must fail generation and CI.

 When adding or changing an Agent-visible command, review all relevant inputs:

- Leaf `ContractFinal.Identity` for canonical identity, primary CLI path,
-  aliases, and stable navigation. Identity is collected from the live Cobra
-  leaves (`CollectIdentitySpecs`); there is no separate identity file. Invalid
-  canonical paths, alias collisions, stale paths, and drift fail collection,
-  binding, and policy.
- Leaf `Safety` / `Contract` (`corecmd.ContractDecl`) / `contract.ParamDecl`
-  (helpers `LeafSpec` or shortcut `Contract`) for parameter facts, interface
-  disposition, safety, and Agent selection prose. Delivered provenance is
-  `contract_final` from `corecmd.contract` (description may stamp `cobra_help`
-  when Cobra Long wins). Product routing uses `ProductDecl`
-  (`internal/corecmd/contract`; provenance label remains `cli.product_decl`).
- `internal/cli/schema_hints/` is fully retired. Do not reintroduce HintFiles,
-  audit JSON, or `imported/` baselines; declare on ProductDecl / the owning
-  leaf instead.
+- `internal/cli/schema_command_registry.json` for the reviewed
+  `CommandRegistry`: canonical identity, primary CLI path, aliases, and stable
+  navigation. It is the identity source and is not a generated artifact.
+- `internal/cli/schema_command_registry.schema.json` is its closed,
+  machine-readable editing contract. Preserve the local `$schema` reference;
+  unknown fields, invalid visibility values, stale paths, and collisions fail
+  Go validation and policy.
+- `internal/cli/schema_hints/metadata/<product>.json` for safety, interface,
+  `runtime_gate`, and optional parameter overlays (`parameters` / `cli_path`).
+- `internal/cli/schema_hints/selection/<product>.json` for reviewed Agent
+  selection prose (`agent_summary`, `use_when`, `avoid_when`, `examples`).
+- `internal/cli/schema_hints/index.json` only maps product IDs to those files.
 - Native Runtime Schema identity annotations, when present, as consistency
  assertions against `EffectiveCommandRegistry`. They must agree exactly and
  must never materialize, infer, or override registry identity.
 - Flag-to-interface property mappings and required/default semantics.
- Do not expect generate-written Catalog delivery. Run
-  `make generate-schema` only to refresh param aliases and prove assembly
-  determinism. Do not expect or commit `schema_agent_metadata/`.
+- Generated files under `internal/cli/schema_agent_metadata/` and
+  `internal/cli/schema_catalog/` (catalog.json + tools/<product>.json) after
+  running generation.

 Run the reverse-completeness tests whenever the Cobra tree changes. A command
 that works through `dws <path>` but cannot be found through the matching
 `dws schema` lookup is a contract failure unless it has a reviewed exact
 exclusion.

-`RegisterSchemaHints` / `ToolSchemaHint` overlays are fully removed. Parameter
-and selection facts must be declared on the owning leaf (`contract.ParamDecl` /
-`Contract`) or via `ProductDecl`; do not reintroduce overlay registries.
+Metadata parameter overlays must reference an exact public runnable Cobra leaf
+and real flags. They may override Schema description, interface-property/type
+mapping, `required`, and `required_when`; they must not create commands or
+flags, define an interface, or advertise an unknown RPC. Every authored entry
+requires `reviewed: true` and a non-empty review reason.

-For Agent-authored selection edits:
+For Agent-authored metadata or selection edits:

 1. Confirm the exact command and flag names in the current Cobra tree.
-2. Declare selection prose on the owning leaf (`Contract.Selection` /
-   `DeclareLeafMetadata`) and product routing via `ProductDecl`; declare
-   safety / parameters / interface on the same leaf.
-3. Do not copy generated Catalog fields into source inputs.
-4. Run generation, drift, Schema policy, and the focused CLI tests before
+2. Edit only the owning block (`metadata/` or `selection/`); do not mix fields.
+3. Add the smallest possible entry; do not copy generated Catalog fields into
+   the input.
+4. Describe user-visible semantics in `review_reason` and parameter
+   descriptions.
+5. Run generation, drift, Schema policy, and the focused CLI tests before
   proposing the change.

-## Agent curation workflow
+## Agent curation workflow (Schema hints)

 Use this workflow when refreshing Agent selection prose and confirmation
 alignment. Prefer **agent-authored review** over bulk merge scripts that dump
-Skill Markdown into Catalog fields.
+`selection-review.json` or Skill Markdown into Catalog fields.

-Human-authored inputs:
+Human-authored inputs are split into two blocks:

 | Block | Path | Owns |
 |---|---|---|
-| **declaration** | helpers / shortcut `Safety` + `Contract` / `contract.ParamDecl` + `ProductDecl` | `effect` / `risk` / `confirmation` / `idempotency` / `interface_*` / parameter facts / selection prose (`contract_final`) |
+| **metadata** | `internal/cli/schema_hints/metadata/<product>.json` | `effect` / `risk` / `confirmation` / `idempotency` / `interface_*` / `runtime_gate` / optional `parameters` |
+| **selection** | `internal/cli/schema_hints/selection/<product>.json` | `agent_summary` / `use_when` / `avoid_when` / `examples` (+ product routing) |

-`schema_hints/` is fully retired. Do not reintroduce HintFiles or audit JSON.
+`index.json` only maps product IDs to those files. Do not mix selection fields
+into metadata files or metadata fields into selection files.

 ### Goals

 1. **Selection prose** is decision-oriented (Feishu/Lark style): trigger intent,
   sibling-command routing, and outcome shape — not a restatement of the
-   summary. Delivered Catalog provenance is `contract_final` from leaf
-   `Contract.Selection` / `ProductDecl`.
-2. **Safety** follows Runtime: `confirmation=user_required` when the leaf
-   Contract/Safety (or remaining `runtime_gate` annotate) requires a user gate
-   (for example `confirm_delete`, `typed_yes`, `confirm_dangerous`).
-3. **Parameter facts** are declared on the leaf (`contract.ParamDecl` /
-   `Contract.Parameters` / FlagSpec). Do not reintroduce HintFile or
-   `RegisterSchemaHints` overlays.
+   summary. Delivered Catalog provenance is `reviewed_explicit` from
+   `selection/`.
+2. **Safety** follows Runtime: `confirmation=user_required` iff the tool's
+   metadata `runtime_gate != none` (for example `confirm_delete`, `typed_yes`,
+   `confirm_dangerous`).
+3. **Parameter overrides** (former Manual `commands`) live on metadata tools as
+   `parameters` (+ `cli_path`) and are applied into EffectiveCommandRegistry.

 ### Authoring

 For every curated tool:

-1. Declare safety/interface/parameters/selection on the owning leaf
-   (`DeclareLeafMetadata` / `Shortcut.Contract` / `contract.ParamDecl`) and product routing
-   via `ProductDecl` when needed.
-2. Run `make generate-schema` (param aliases + assembly determinism). Do not
-   create or commit `schema_catalog/` or Schema meta-index fixtures.
+1. Edit `metadata/<product>.json` for safety/interface/gates/parameters.
+2. Edit `selection/<product>.json` for selection prose (`reviewed: true`,
+   `review_reason`, `source_refs`).
+3. Run `make generate-schema`. Do not hand-edit generated
+   `schema_agent_metadata/` or `schema_catalog/`.

 ### Pull live MCP descriptions (personal token)

-Schema delivery no longer embeds a pinned MCP JSON. Prefer live Schema from a
-logged-in personal session when reviewing interface facts before declaring them
-on the leaf:
+Pinned `internal/cli/schema_mcp_metadata.json` is a sanitized baseline. Prefer
+live Schema from a logged-in personal session:

 ```bash
 dws auth status                 # token_valid should be true
-dws schema <mcp-canonical> --jq '{canonical_path,interface_ref,parameters}' -f json
-# or CLI path: dws schema --cli-path "drive copy" --jq '{canonical_path,interface_ref,parameters}' -f json
+dws cache refresh               # refresh discovery / tools cache
+dws schema <mcp-canonical> -f json
+# or CLI path: dws schema --cli-path "drive copy" -f json
 ```

-Resolve MCP identity via declared `interface_ref` when CLI canonical ≠ MCP path
+Resolve MCP identity via `interface_ref` when CLI canonical ≠ MCP path
 (example: CLI `drive.copy_document` → live `doc.copy_document`). On pull
-failure, fall back to Skill + Cobra Help, and record evidence
+failure, fall back to Skill + Cobra Help + pinned MCP, and record evidence
 (for example `live-dws-schema:<path>#FAILED`). Never print or commit tokens.
-`make fetch-mcp-metadata` writes an optional diagnostic dump under `artifacts/`
-only — do not commit it as a Schema pin.

-Precedence when sources disagree: **Runtime/Cobra / leaf Contract > live MCP >
+Precedence when sources disagree: **Runtime/Cobra > live MCP > pinned MCP >
 Skill (evidence only)**.

 ### Parallel product agents

 Split work by product groups. Each agent must:

- Read Skill, Cobra/`--help`, Runtime confirmation sites, and live
-  `dws schema <leaf> --compact` for its tools. Mapping/interface/provenance
-  audits may query the full leaf only through a narrow `--jq` / `--fields`
-  projection; do not load an entire full leaf into Agent context.
- Hand-write selection prose and leaf Contract / ProductDecl declarations;
-  forbid wholesale JSON merges from review dumps.
- Edit only its product’s leaf declarations (and `ProductDecl` when needed).
+- Read Skill, Cobra/`--help`, Runtime confirmation sites, and live `dws schema`
+  for its tools.
+- Hand-write selection + metadata; forbid wholesale JSON merges from review
+  dumps.
+- Edit only its `metadata/<product>.json` and `selection/<product>.json`.
 - **Never** `git checkout` unrelated product files to “clean scope”.

 ### Regenerate and gates
@@ -337,24 +255,23 @@ make generate-schema
 go test ./internal/app -run '^TestSheetFinalSchemaConfirmationMatchesRuntimeGuards$' -count=1
 ```

-`check-runtime-confirmation-truth.sh` compares live ContractFinal.Safety with the assembled ToolSpec `confirmation=user_required` and probes the runtime gate.
-`schema_hints/` must stay absent.
-
 Example rules (fail generation otherwise):

 - At most two examples per tool; no `--yes` in stored examples.
 - Examples must match live Cobra argv (path, flags, required groups).
 - No shell comments in examples.

-After generation, spot-check Catalog: selection and safety/interface
-provenance are `contract_final` from ProductDecl / leaf declarations
-(`user_required` must match Runtime confirmation gates).
+After generation, spot-check Catalog: selection provenance is
+`reviewed_explicit` from `selection/`, and `user_required` count equals
+metadata `runtime_gate != none`.

-`make generate-schema` refreshes `param_aliases_generated.go` and runs
-assembly determinism (`check-schema-assembly.sh`). It does not rewrite a
-committed Catalog as delivery authority — runtime reassembles from
-declarations. Byte guards fail if generation mutates parameter-concept
-inputs; policy fails if the retired `schema_command_registry/` reappears.
+`make generate-schema` is a full deterministic snapshot rebuild, not an
+incremental patch over the previous Catalog. It rereads every reviewed input,
+removes stale generated product metadata, and rewrites the exact metadata and
+Catalog projections. Incremental work happens only when an Agent or human
+edits selected `metadata/` or `selection/` entries; the next publication still
+recomputes all outputs. Generated files must never be read back as merge input,
+and byte guards fail generation if it changes the hint inputs or CommandRegistry.

 Selection prose may choose a more or less restrictive recommendation. It cannot
 create a Cobra command or flag, change parameter facts, invent an
@@ -400,7 +317,7 @@ proves natural-language understanding.

 Semantic selection is an explicit opt-in live-model check. Run the smoke set
 (one positive and one negative scenario per product) with
-`DWS_AGENT_SELECTION_LIVE=1 ARK_API_KEY=... ARK_BASE_URL=... ARK_MODEL=... go test ./internal/app -run TestAgentSelectionArkLive -count=1`.
+`DWS_AGENT_SELECTION_LIVE=1 ARK_API_KEY=... ARK_BASE_URL=... ARK_MODEL=... go test ./internal/app -run TestManualAgentSelectionArkLive -count=1`.
 Add `DWS_AGENT_SELECTION_FULL=1` to evaluate every committed tool scenario, or
 set `DWS_AGENT_SELECTION_CASES` to comma-separated fixture case IDs. Normal CI
 never calls a model; its blockers remain the reproducible fixture, binding,
@@ -424,21 +341,14 @@ Preserve all candidates and the selected source in provenance, and fail
 same-precedence conflicts rather than silently merging them.

 `required` is the exception. Cobra `MarkFlagRequired` is a hard floor: the
-final Agent projection must keep `required=true` and cannot be lowered by a
-lower-precedence source. A higher-precedence declaration may still raise an
-optional flag to required. `cli_required` continues to mirror the executable
-Cobra marker.
+final Agent projection must keep `required=true` and cannot be lowered by
+manual/hint overlays. Overlays may still raise an optional flag to required.
+`cli_required` continues to mirror the executable Cobra marker.

-For command-level description: **declare required, delivery Long may win**.
-`ContractDecl.Description` is mandatory at construction (declaration evidence).
-Catalog delivery prefers Cobra Long when present (provenance `cobra_help`,
-resolution `cobra_help_preferred`); without Long, the declared Description is
-delivered as `contract_final`. Title keeps declared ContractDecl /
-ContractFinal first, then Cobra Short, then MCP metadata. This is one authority
-chain with an explicit delivery preference — not two competing sources.
-Generic RPC prose may remain an unselected provenance candidate (and
-parameter-level `interface_description`); it must not overwrite a specialized
-leaf's title or description.
+For command text, reviewed `ToolSchemaHint` wins first, then command-specific
+Cobra Help, then MCP metadata. Generic RPC prose may remain an unselected
+provenance candidate (and parameter-level `interface_description`); it must not
+overwrite a specialized leaf's title or description.

 For every delivered `ToolSpec` and `ParameterSpec` field, the provenance
 winner value must exactly equal the delivered value. Checking only source,
@@ -464,134 +374,6 @@ Keep CLI confirmation behavior and Schema metadata consistent, and add a
 semantic regression test through the final embedded loader/query delivery
 path; a generator unit test or JSON count alone is insufficient.

-## Unified result Schema and performance
-
-The unified runtime envelope and the per-command Schema result declaration are
-related but distinct contracts:
-
- Runtime owns the outer machine envelope (`ok`, `outcome`, `data`, `error`,
-  `meta`) and derives it through `internal/output`. Business commands return a
-  `CommandResult`; they must not hand-author the outer JSON shape.
- A leaf `Contract.Result` / `contract.ResultSpec` describes the reviewed
-  business value inside `data`. It may declare `outcomes`, `data_schema`, and
-  `sensitive_paths`. `Contract.Pagination` is a separate command capability
-  because pagination is emitted under envelope `meta`, not inside `data`.
- `outcomes` is the set of results a command may produce; it is not the outcome
-  of the current invocation. `data_schema` is a JSON Schema object for business
-  data and must not duplicate the framework envelope.
- Result declarations are delivered in the full leaf and in the reviewed
-  `--compact` Agent projection. Compact retains the normalized `result` object
-  verbatim but still omits provenance, interface bindings, and other audit-only
-  fields. Product/group summaries remain navigation views and need not repeat
-  every leaf Result. When an Agent needs return-shape facts, query the compact
-  leaf directly; do not load the whole full Catalog.
- A missing `result` means “no reviewed return-value declaration is published
-  for this leaf.” It does **not** prove that the runtime is legacy, and it must
-  not be filled by inference from examples, MCP samples, or previous command
-  output. Runtime rollout remains an internal per-command fact.
- The public contract has no `contract_version`, no `--output-contract`, and no
-  Agent-selectable protocol alias. Agents continue to request machine output
-  with `--format json`; migrated commands use the unified result directly and
-  unmigrated commands retain their current legacy output.
- Existing `dev` / `devapp` pilot coverage is gradual. Active reviewed
-  `devapp` shortcuts are gated on a non-empty Result declaration, while `dev`
-  currently has representative Result coverage. Do not describe that as
-  repository-wide coverage. Any newly activated Agent-visible command should
-  add and test its Result declaration; the remaining pilot gaps should shrink,
-  not expand.
-
-The compact/full leaf `result` object has one stable shape:
-
-```json
-{
-  "result": {
-    "outcomes": ["success", "pending", "partial_failure", "failure"],
-    "data_schema": {
-      "type": "object",
-      "properties": {
-        "items": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "id": {"type": "string", "description": "Stable resource ID"},
-              "name": {"type": "string", "description": "Display name"}
-            }
-          }
-        }
-      }
-    },
-    "sensitive_paths": ["credential.secret"]
-  },
-  "pagination": {
-    "kind": "cursor",
-    "cursor_parameter": "cursor",
-    "meta_path": "meta.pagination",
-    "endpoint_exhausted_path": "meta.pagination.endpoint_exhausted",
-    "next_token_path": "meta.pagination.next_token"
-  }
-}
-```
-
-Field rules:
-
-| Field | Required | Contract |
-|---|---|---|
-| `outcomes` | yes | Non-empty unique subset of `success`, `pending`, `partial_failure`, `failure`; normalization publishes canonical order. |
-| `data_schema` | yes | One recursive JSON Schema **object** describing only the runtime envelope's `data` value. Every named `properties` child must have a non-empty `description`. It must not duplicate `ok`, `outcome`, `error`, or `meta`. |
-| `sensitive_paths` | no | Unique safe dot paths relative to `data`; renderers/redaction consumers must not treat them as shell/JQ expressions. |
-
-Optional members are omitted, never emitted as `null`. A leaf without a
-reviewed Result omits the entire `result` key. Compact must preserve the same
-normalized Result value as the full leaf; it must not summarize, infer, rename,
-or independently rebuild any Result field. Product/group summaries do not
-aggregate child Result objects.
-
-`pagination` is a sibling of `result`, not a child. It declares the canonical
-CLI cursor parameter and the fixed framework paths under `meta.pagination`.
-Product response fields used to derive that metadata remain mapper internals;
-they are not part of `result.data_schema`. Do not execute a second request to
-derive pagination metadata.
-
-Invalid result declarations fail closed during normalization: unknown or
-duplicate outcomes, a non-object/multiple `data_schema`, unsafe or duplicate
-sensitive paths, unsupported pagination kinds, attempts to override framework
-meta paths, and an invalid cursor parameter must be rejected rather than
-silently removed.
-Full-leaf wire round trips must
-preserve the normalized Result exactly. Do not commit generated Schema JSON as
-evidence; tests construct contracts in Go and runtime/CI assemble the Catalog
-from declarations.
-
-### Performance model and rules
-
- Catalog construction is declaration-driven and cached through the existing
-  lazy `sync.Once` delivery path. Do not reassemble or reopen annotations per
-  command invocation, per leaf lookup, or per renderer.
- Normalizing one Result declaration is linear in the size of that declaration.
-  Full `schema --all` is linear in tools + parameters + Result schema bytes and
-  is an audit/compatibility export, not the normal Agent discovery path.
-  Overview → compact product/group → compact leaf remains the normal route;
-  only the final leaf carries its Result declaration.
- Constructing a `CommandResult` defensively clones result data and validates
-  invariants; rendering is buffer-first and then writes once. Both CPU cost and
-  transient memory are O(payload size), with roughly one additional in-memory
-  rendered copy. This buys immutability and prevents partial JSON leakage, but
-  it is not free.
- Large list/search commands must use bounded pages and publish continuation
-  facts. The current emitter buffers one command result/page before publishing;
-  pagination is the memory bound. Continuous event streams are a separate,
-  command-specific protocol and are not described by `ResultSpec`.
- A `dual_validate` command must execute the business request exactly once,
-  validate a shadow unified result, and preserve legacy bytes. Never obtain
-  validation by issuing a second network or write request.
- Filters and alternate formats are render-time work over the same in-memory
-  result. They must not rerun the business operation or rebuild Schema.
- Performance changes must preserve the one-result, buffer-first, fail-closed,
-  and atomic `--output` guarantees. Do not trade correctness for a microbenchmark
-  improvement. For a material hot-path change, benchmark representative small
-  and page-sized payloads and report allocations/bytes as well as latency.
-
 ## Current Schema boundaries

 - `schema list` remains a progressive overview. `schema --all` is the stable
@@ -600,16 +382,13 @@ from declarations.
  `parameters` object for commands without flags. Keep it suitable for the #602
  compatibility baseline and fail rather than silently emitting a partial
  export.
- `schema --all` is not normal command discovery. Use overview -> compact
-  product/group -> compact leaf for routine Agent work. `--compact` is the
-  reviewed positive-field allowlist for Agent context: new full/audit fields
-  must not appear there until explicitly reviewed. A compact full export is not
-  a complete compatibility baseline.
+- `schema --all` is not normal command discovery. Use overview -> product/group
+  -> leaf for routine Agent work. `--compact` is supported for context-saving
+  projections, but a compact full export is not a complete compatibility
+  baseline.
 - `dws <path> --help` defines whether Cobra exposes a path and which flags the
-  executable accepts. A compact leaf defines Agent selection, CLI parameters,
-  constraints, safety/confirmation semantics, and any reviewed `result`
-  contract. Full leaf fields such as `property`, `interface_ref`, and
-  provenance are audit facts. A conflict is contract drift, not permission to
-  guess.
+  executable accepts. A leaf Schema defines Agent selection, parameter mapping
+  and constraints, and safety/confirmation semantics. A conflict is contract
+  drift, not permission to guess.
 - Schema and Help describe commands; neither returns DingTalk business data.
  After discovery, execute the real read/search/list command to obtain data.
@@ -68,25 +68,14 @@ coverage is additionally selected for platform-sensitive code.
 3. Include both the commands/results and user-visible or contract-level
   behavior evidence in the PR description.
 4. Run `./scripts/policy/check-command-surface.sh --strict` when command
-   paths/flags change. CI resolves the exact merge-base, latest reachable
-   non-withdrawn stable GA tag, and committed candidate SHA, then enters the single compatibility
-   decision seam through
-   `make authoritative-interface-integrity BASE_REF=<merge-base> STABLE_REF=<latest-GA-tag> CANDIDATE_REF=<candidate-sha>`.
-   The Make target delegates to the authoritative wrapper; CI does not invoke a
-   second comparator or the legacy fixture checker. See
-   [CLI Help / Schema compatibility migration governance](docs/cli-interface-flag-migrations.md)
-   for the reviewed two-stage `pending` → `consumed` lifecycle.
-   Agent-visible flag or command-path migrations must also run
-   `make schema-compatibility BASE_REF=<merge-base> STABLE_REF=<latest-GA-tag> CANDIDATE_REF=<candidate-sha>`;
-   it consumes the same base-owned ledger rather than a second exception list.
+   paths/flags change. CI also runs
+   `./scripts/policy/check-command-compatibility.sh --base-ref <main-ref> --stable-ref <latest-GA-tag>`
+   against both the target branch and latest stable release.
 5. Run `./scripts/policy/check-generated-drift.sh` when generated artifacts may
   change.
 6. Run `./scripts/release/verify-package-managers.sh` when packaging or
   installer surfaces change (run `make package` first).
-7. Update docs and add one `.changes/<unique-name>.md` release fragment for
-   behavior/interface changes. Do not edit `CHANGELOG.md` in an ordinary PR;
-   the release-seal workflow renders and archives fragments into the versioned
-   changelog section.
+7. Update docs and `CHANGELOG.md` for behavior/interface changes.

 ## Submission Flow

@@ -1,33 +1,33 @@
 class DingtalkWorkspaceCliBeta < Formula
  desc "Automate DingTalk workspace tasks from the terminal (beta channel)"
  homepage "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli"
-  version "1.0.60-beta.2"
+  version "1.0.56-beta.2"
  license "Apache-2.0"
  keg_only "it is the beta channel and conflicts with dingtalk-workspace-cli"

  on_macos do
    if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.60-beta.2/dws-darwin-arm64.tar.gz"
-      sha256 "e7776807f0664cbf0d0728cc236f2415c0981eb8d6557a897d2eeee708641b1d"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.56-beta.2/dws-darwin-arm64.tar.gz"
+      sha256 "19b52b5427dbf24acfeb1da16a93e6edfd0443389a778abbbfd381ff8f656139"
    else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.60-beta.2/dws-darwin-amd64.tar.gz"
-      sha256 "3004474df3cfb529719348f02c9f2f39afa88f0fca469fe8303a9ebe0f3a0034"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.56-beta.2/dws-darwin-amd64.tar.gz"
+      sha256 "621da52d04f391234d160a0522d70c1fb2e36da59102ef201a9a3a11b706b3e8"
    end
  end

  on_linux do
    if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.60-beta.2/dws-linux-arm64.tar.gz"
-      sha256 "6386885d10f149c8c555031dda4cf07bf34e1e9daad61d4cd948b92d3c7b7bad"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.56-beta.2/dws-linux-arm64.tar.gz"
+      sha256 "4ba956463f4b583c1727f58026a6bc1fb23d27537083e3bafd541a05ab15b48b"
    else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.60-beta.2/dws-linux-amd64.tar.gz"
-      sha256 "5c94c2af269d2fe5a79a400d4fa3af267a86d6ab21b01a24ede1d29514a6eaef"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.56-beta.2/dws-linux-amd64.tar.gz"
+      sha256 "a8156ec5b89355faf8c08a65d9c088f89a7b411a418fb4b488f3d472efc79670"
    end
  end

  resource "skills" do
-    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.60-beta.2/dws-skills.zip"
-    sha256 "c3bd917f1b44a978ba2a9fbe95c5d0910ccf75f870f1c9b0dc356262ab1080c5"
+    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.56-beta.2/dws-skills.zip"
+    sha256 "92c71fdeade88b3b76a00cb74ebd3223cc4110c7ee151d36d782537613129967"
  end

  def install
@@ -1,33 +1,33 @@
 class DingtalkWorkspaceCli < Formula
  desc "Automate DingTalk workspace tasks from the terminal"
  homepage "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli"
-  version "1.0.59"
+  version "1.0.55"
  license "Apache-2.0"


  on_macos do
    if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59/dws-darwin-arm64.tar.gz"
-      sha256 "61135a2a9286204ce060847e653c63c1e9784a0fa631bb7e0563b90628762a35"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.55/dws-darwin-arm64.tar.gz"
+      sha256 "dd753bbd051e5dd007cf433b8aa211c4a221dd73dfcb0b3783fa924d09f12351"
    else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59/dws-darwin-amd64.tar.gz"
-      sha256 "fd14b0b1a1475891fb243bf6453857a1044ab5a40bcf7dc1c7c795f57e5b03ba"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.55/dws-darwin-amd64.tar.gz"
+      sha256 "f465eb7ac38a8a84eac4eb821fd15424bfc6f6245a60fa695ba97a639970dd77"
    end
  end

  on_linux do
    if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59/dws-linux-arm64.tar.gz"
-      sha256 "5bfe9ac7d1798b028f0fad579bbdffec5898e2fb16ee36f5766ab58e208abd50"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.55/dws-linux-arm64.tar.gz"
+      sha256 "5961be0fd551ec8e69b6fff2b1609f73486f7e6c3ffe8eb4bb99fa1ed691b401"
    else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59/dws-linux-amd64.tar.gz"
-      sha256 "be1eb9a1f8fc5048e578b5b0bde212fc90baca0f289236c7c333d824bd869cf3"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.55/dws-linux-amd64.tar.gz"
+      sha256 "051ba404a5f6a8fb15def0e0f5d9d273cf9d63f881df2fffe159f2c4ea3366e7"
    end
  end

  resource "skills" do
-    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59/dws-skills.zip"
-    sha256 "7ce5c3ab6f6a367407f64971bc5ff96cfcdfade2c1a10d326144b17c7b25a57e"
+    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.55/dws-skills.zip"
+    sha256 "bd35f674f184001f5a03c7b5fa6029ebcda54f0054e15cd608b5b5e213ce2d05"
  end

  def install
@@ -5,12 +5,10 @@ PUBLISH ?= 0
 YES ?= 0
 DWS_POLICY_TMPDIR ?= $(CURDIR)/.worktrees/policy-tmp
 POLICY_GOTMPDIR ?= $(DWS_POLICY_TMPDIR)/go
-SCHEMA_CATALOG_OUTPUT ?= artifacts/schema_catalog
-SCHEMA_META_INDEX_OUTPUT ?= artifacts/schema_meta_index.gob
 POLICY_ENV = DWS_POLICY_TMPDIR="$(DWS_POLICY_TMPDIR)" GOTMPDIR="$(POLICY_GOTMPDIR)"
 GO_SOURCE_LIST = git ls-files -z --cached --others --exclude-standard -- '*.go'

-.PHONY: all help build rebuild test test-plan test-auth-legacy-compat shortcut-public-e2e-proof lint format-check fmt policy edition-test interface-integrity authoritative-interface-integrity coverage-gate coverage-gate-platform update-interface-baseline reset-interface-baseline schema-compatibility skill-command-integrity skill-context-budget multi-im-skill-chain-integrity cli-smoke mock-mcp-smoke test-schema-agent-examples generate-schema fetch-mcp-metadata generate-schema-catalog package release release-pre release-stable changelog-pre changelog-stable publish-homebrew-formula setup-hooks
+.PHONY: all help build rebuild test test-plan test-auth-legacy-compat lint format-check fmt policy edition-test interface-integrity authoritative-interface-integrity coverage-gate coverage-gate-platform update-interface-baseline reset-interface-baseline schema-compatibility skill-command-integrity skill-context-budget cli-smoke mock-mcp-smoke test-schema-agent-examples generate-schema generate-schema-agent-metadata fetch-mcp-metadata generate-schema-catalog package release release-pre release-stable changelog-pre changelog-stable publish-homebrew-formula setup-hooks

 all: setup-hooks fmt lint build test rebuild

@@ -18,28 +16,27 @@ help:
 	@printf "Available targets:\n"
 	@printf "  make build         - Build the dws CLI binary\n"
 	@printf "  make test          - Run the Go test suite\n"
-	@printf "  make test-plan     - Verify CI test and full-suite coverage package plans cover their scopes exactly once\n"
+	@printf "  make test-plan     - Verify every default Go package belongs to one CI test shard\n"
 	@printf "  make test-auth-legacy-compat - Run stable legacy authentication compatibility regressions\n"
-	@printf "  make shortcut-public-e2e-proof - Prove every reviewed Devdoc/HRbrain/PAT public Shortcut through exact and owning raw execution\n"
 	@printf "  make lint          - Run formatting checks, go vet, and staticcheck\n"
 	@printf "  make format-check  - Check all repository Go source files with gofmt\n"
 	@printf "  make fmt           - Format all repository Go source files\n"
 	@printf "  make policy        - Check the built dws plus open-source and Schema policies\n"
-	@printf "  make interface-integrity [BASE_REF=<ref>] [STABLE_REF=<tag>] [CANDIDATE_REF=<ref>] - Check authoritative CLI history\n"
-	@printf "  make authoritative-interface-integrity BASE_REF=<ref> [STABLE_REF=<tag>] [CANDIDATE_REF=<ref>] - Check Git-owned CLI history\n"
+	@printf "  make interface-integrity - Check historical commands and help contracts still work\n"
+	@printf "  make authoritative-interface-integrity BASE_REF=<ref> - Check the Git-owned PR merge-base\n"
 	@printf "  make coverage-gate BASE_REF=<ref> - Enforce overall non-regression and 100%% changed-code coverage\n"
 	@printf "  make coverage-gate-platform BASE_REF=<ref> PROFILE=<file> - Enforce 100%% native changed-code coverage\n"
-	@printf "  make update-interface-baseline - Update the non-authoritative CLI smoke fixture\n"
-	@printf "  make reset-interface-baseline - DANGEROUS: replace the non-authoritative CLI smoke fixture\n"
-	@printf "  make schema-compatibility BASE_REF=<ref> [STABLE_REF=<tag>] [CANDIDATE_REF=<ref>] - Check the authoritative Schema history\n"
+	@printf "  make update-interface-baseline - Add new CLI contracts without removing history\n"
+	@printf "  make reset-interface-baseline - DANGEROUS: replace all CLI compatibility history\n"
+	@printf "  make schema-compatibility BASE_REF=<ref> - Check the complete Schema contract against the PR merge-base\n"
 	@printf "  make skill-command-integrity - Check dws commands referenced by skills exist\n"
 	@printf "  make skill-context-budget - Check generated Skill drift and common-path context budgets\n"
-	@printf "  make multi-im-skill-chain-integrity - Check reviewed IM intents keep one default Skill route\n"
 	@printf "  make cli-smoke     - Verify help for every public top-level command\n"
 	@printf "  make mock-mcp-smoke - Verify HTTP and stdio MCP request/response transport\n"
 	@printf "  make test-schema-agent-examples - Contract-check all Agent examples and dry-run the eligible subset\n"
-	@printf "  make generate-schema - Refresh param_aliases + verify Schema assembly determinism\n"
-	@printf "  make generate-schema-catalog - Optional assembled Catalog dump under artifacts/ (not a delivery step)\n"
+	@printf "  make generate-schema - Regenerate embedded Agent metadata and the release Catalog\n"
+	@printf "  make generate-schema-agent-metadata - Regenerate versioned Agent metadata\n"
+	@printf "  make generate-schema-catalog - Regenerate the embedded release Catalog\n"
 	@printf "  make package       - Build all release artifacts locally\n"
 	@printf "  make changelog-pre VERSION=vX.Y.Z-beta.N - Prepare prerelease notes\n"
 	@printf "  make changelog-stable VERSION=vX.Y.Z FROM_BETA=vX.Y.Z-beta.N - Prepare stable notes\n"
@@ -63,9 +60,6 @@ test-auth-legacy-compat:
 	@mkdir -p "$(POLICY_GOTMPDIR)"
 	@GO="$(GO)" $(POLICY_ENV) ./scripts/policy/check-auth-legacy-compat.sh

-shortcut-public-e2e-proof: build
-	@GO="$(GO)" DWS_PACKAGE_VERSION="$(DWS_PACKAGE_VERSION)" ./scripts/policy/check-shortcut-public-e2e-proof.sh
-
 lint:
 	@./scripts/dev/lint.sh

@@ -88,12 +82,11 @@ fmt:
 	$(GO_SOURCE_LIST) > "$$go_files"; \
 	xargs -0 sh -c 'if [ "$$#" -gt 0 ]; then exec gofmt -w -- "$$@"; fi' sh < "$$go_files"

-policy: test-auth-legacy-compat shortcut-public-e2e-proof
+policy: test-auth-legacy-compat
 	@mkdir -p "$(POLICY_GOTMPDIR)"
 	@$(POLICY_ENV) ./scripts/policy/check-open-source-assets.sh
 	@$(POLICY_ENV) ./scripts/policy/check-skill-context-budget.sh
-	@$(POLICY_ENV) ./scripts/policy/check-multi-im-skill-chain.sh
-	@python3 scripts/run_chat_shortcut_live_audit_test.py
+	@$(POLICY_ENV) ./scripts/policy/check-schema-command-registry.sh
 	@$(POLICY_ENV) ./scripts/policy/check-command-surface.sh --strict
 	@$(POLICY_ENV) ./scripts/policy/check-generated-drift.sh
 	@$(POLICY_ENV) ./scripts/policy/check-param-concepts.sh
@@ -107,22 +100,10 @@ edition-test:
 	$(GO) test -v -count=1 ./pkg/editiontest/...

 interface-integrity:
-	@base_ref="$(BASE_REF)"; \
-	candidate_ref="$(CANDIDATE_REF)"; \
-	if [ -z "$$base_ref" ]; then base_ref="origin/main"; fi; \
-	if [ -z "$$candidate_ref" ]; then candidate_ref="HEAD"; fi; \
-	./scripts/policy/check-authoritative-interface-baselines.sh \
-		--base-ref "$$base_ref" \
-		--stable-ref "$(STABLE_REF)" \
-		--candidate-ref "$$candidate_ref"
+	@./scripts/policy/check-interface-baseline.sh

 authoritative-interface-integrity:
-	@candidate_ref="$(CANDIDATE_REF)"; \
-	if [ -z "$$candidate_ref" ]; then candidate_ref="HEAD"; fi; \
-	./scripts/policy/check-authoritative-interface-baselines.sh \
-		--base-ref "$(BASE_REF)" \
-		--stable-ref "$(STABLE_REF)" \
-		--candidate-ref "$$candidate_ref"
+	@./scripts/policy/check-authoritative-interface-baselines.sh --base-ref "$(BASE_REF)"

 coverage-gate:
 	@./scripts/policy/check-coverage-gate.sh --base-ref "$(BASE_REF)" --scope-buildable
@@ -137,12 +118,7 @@ reset-interface-baseline:
 	@./scripts/policy/check-interface-baseline.sh --reset

 schema-compatibility:
-	@candidate_ref="$(CANDIDATE_REF)"; \
-	if [ -z "$$candidate_ref" ]; then candidate_ref="HEAD"; fi; \
-	./scripts/policy/check-authoritative-schema-compatibility.sh \
-		--base-ref "$(BASE_REF)" \
-		--stable-ref "$(STABLE_REF)" \
-		--candidate-ref "$$candidate_ref"
+	@./scripts/policy/check-authoritative-schema-compatibility.sh --base-ref "$(BASE_REF)"

 skill-command-integrity:
 	@./scripts/policy/check-skill-commands.sh
@@ -150,12 +126,6 @@ skill-command-integrity:
 skill-context-budget:
 	@./scripts/policy/check-skill-context-budget.sh

-multi-im-skill-chain-integrity:
-	@./scripts/policy/check-multi-im-skill-chain.sh
-
-skill-mono-multi-content:
-	@./scripts/policy/check-mono-multi-skill-content.sh
-
 cli-smoke:
 	@./scripts/policy/check-cli-smoke.sh

@@ -163,30 +133,26 @@ mock-mcp-smoke:
 	$(GO) test -v -count=1 -run '^(TestHTTPClientEndToEnd|TestStdioClientEndToEnd)$$' ./internal/transport

 test-schema-agent-examples:
-	DWS_AGENT_EXAMPLES_DRY_RUN=1 $(GO) test -v -count=1 ./internal/app -run '^TestAgentExamplesDryRun$$'
+	DWS_AGENT_EXAMPLES_DRY_RUN=1 $(GO) test -v -count=1 ./internal/app -run '^TestManualAgentExamplesDryRun$$'

-# generate-schema refreshes param_aliases_generated.go and verifies that
-# ResolveSchemaBuild assembly is deterministic. Catalog is runtime-assembled
-# (声明即 Catalog); cmd_schema_catalog is not a committed delivery step.
-# schema_agent_metadata/ and schema_hints/ must stay absent.
 generate-schema:
 	@set -e; \
+	registry_guard=$$(mktemp -d); \
 	concepts_guard=$$(mktemp); \
 	concepts_schema_guard=$$(mktemp); \
-	command_fallbacks_guard=$$(mktemp); \
-	command_fallbacks_schema_guard=$$(mktemp); \
-	trap 'rm -f "$$concepts_guard" "$$concepts_schema_guard" "$$command_fallbacks_guard" "$$command_fallbacks_schema_guard"' EXIT HUP INT TERM; \
+	metadata_guard=$$(mktemp -d); \
+	selection_guard=$$(mktemp -d); \
+	trap 'rm -rf "$$registry_guard" "$$concepts_guard" "$$concepts_schema_guard" "$$metadata_guard" "$$selection_guard"' EXIT HUP INT TERM; \
+	cp -R internal/cli/schema_command_registry/ "$$registry_guard/"; \
 	cp internal/cli/param_concepts.json "$$concepts_guard"; \
 	cp internal/cli/param_concepts.schema.json "$$concepts_schema_guard"; \
-	cp internal/cli/command_path_fallbacks.json "$$command_fallbacks_guard"; \
-	cp internal/cli/command_path_fallbacks.schema.json "$$command_fallbacks_schema_guard"; \
+	cp -R internal/cli/schema_hints/metadata/. "$$metadata_guard/"; \
+	cp -R internal/cli/schema_hints/selection/. "$$selection_guard/"; \
 	$(GO) generate ./internal/cli; \
-	rm -rf internal/cli/schema_agent_metadata internal/cli/schema_agent_metadata_audit.json; \
-	rm -f internal/cli/schema_meta_index.json; \
-	if [ -e internal/cli/schema_command_registry ]; then \
-		printf '%s\n' 'retired schema_command_registry/ must not reappear after generation' >&2; \
+	diff -qr internal/cli/schema_command_registry "$$registry_guard" >/dev/null || { \
+		printf '%s\n' 'generation modified reviewed input internal/cli/schema_command_registry/' >&2; \
 		exit 1; \
-	fi; \
+	}; \
 	cmp -s internal/cli/param_concepts.json "$$concepts_guard" || { \
 		printf '%s\n' 'generation modified reviewed input internal/cli/param_concepts.json' >&2; \
 		exit 1; \
@@ -195,35 +161,37 @@ generate-schema:
 		printf '%s\n' 'generation modified reviewed input internal/cli/param_concepts.schema.json' >&2; \
 		exit 1; \
 	}; \
-	cmp -s internal/cli/command_path_fallbacks.json "$$command_fallbacks_guard" || { \
-		printf '%s\n' 'generation modified reviewed input internal/cli/command_path_fallbacks.json' >&2; \
+	cmp -s internal/cli/param_concepts.json "$$concepts_guard" || { \
+		printf '%s\n' 'generation modified reviewed input internal/cli/param_concepts.json' >&2; \
 		exit 1; \
 	}; \
-	cmp -s internal/cli/command_path_fallbacks.schema.json "$$command_fallbacks_schema_guard" || { \
-		printf '%s\n' 'generation modified reviewed input internal/cli/command_path_fallbacks.schema.json' >&2; \
+	cmp -s internal/cli/param_concepts.schema.json "$$concepts_schema_guard" || { \
+		printf '%s\n' 'generation modified reviewed input internal/cli/param_concepts.schema.json' >&2; \
 		exit 1; \
 	}; \
-	if [ -e internal/cli/schema_hints ]; then \
-		printf '%s\n' 'retired schema_hints/ must not reappear after generation' >&2; \
+	diff -qr internal/cli/schema_hints/metadata "$$metadata_guard" >/dev/null || { \
+		printf '%s\n' 'generation modified reviewed input internal/cli/schema_hints/metadata' >&2; \
 		exit 1; \
-	fi; \
-	if [ -e internal/cli/schema_meta_index.json ]; then \
-		printf '%s\n' 'retired schema_meta_index.json must not remain after generation' >&2; \
+	}; \
+	diff -qr internal/cli/schema_hints/selection "$$selection_guard" >/dev/null || { \
+		printf '%s\n' 'generation modified reviewed input internal/cli/schema_hints/selection' >&2; \
 		exit 1; \
-	fi; \
-	./scripts/policy/check-schema-assembly.sh
+	}
+
+generate-schema-agent-metadata:
+	$(GO) run ./internal/generator/cmd_schema_agent_metadata \
+		-root . \
+		-registry internal/cli/schema_command_registry \
+		-output-dir internal/cli/schema_agent_metadata \
+		-audit-output internal/cli/schema_agent_metadata_audit.json

-# Optional local/CI dump of an assembled Catalog under artifacts/ by default.
-# Override SCHEMA_CATALOG_OUTPUT and SCHEMA_META_INDEX_OUTPUT as needed. This
-# is not a go:generate or production delivery step.
 generate-schema-catalog:
 	$(GO) run -a ./internal/generator/cmd_schema_catalog \
 		-root . \
-		-output "$(SCHEMA_CATALOG_OUTPUT)" \
-		-meta-index "$(SCHEMA_META_INDEX_OUTPUT)"
+		-output internal/cli/schema_catalog

 fetch-mcp-metadata:
-	@printf '  %sFetching diagnostic MCP dump (not a Schema pin)%s\n' "$(COLOR_RUN)" "$(COLOR_RESET)"
+	@printf '  %sRefreshing MCP metadata from live server%s\n' "$(COLOR_RUN)" "$(COLOR_RESET)"
 	@./scripts/dev/fetch_mcp_metadata.sh

 package:
@@ -70,17 +70,17 @@ The installer ships skills in one of two layouts. CLI commands (`dws aitable ...

 | Mode | What gets installed | Best for |
 |------|----------------------|----------|
-| **multi** (default) | Per-product skills (`dingtalk-aitable`, `dingtalk-calendar`, `dingtalk-chat`, ...) | Single-product tasks; smaller context per call |
-| **mono** (legacy) | One `dws` skill covering all products | Cross-product workflows; single entry point |
+| **mono** (stable, default) | One `dws` skill covering all products | Cross-product workflows; single entry point |
+| **multi** 🧪 **EXPERIMENTAL** | Per-product skills (`dingtalk-aitable`, `dingtalk-calendar`, `dingtalk-chat`, ...) | Single-product tasks; smaller context per call |

-> Installs and upgrades default to `multi`. `mono` remains available via `DWS_SKILL_MODE=mono` or `dws skill setup --mode mono`. File issues if you hit problems.
+> 🧪 **`multi` is currently EXPERIMENTAL / preview.** All product-scoped skills pass the dispatch verifier, but interface, naming and cross-skill references may change in future releases. For production / shared environments, prefer `mono`. File issues if you hit problems.

 How to pick:

- **Quick install** (one-liner above): non-interactive, installs `multi`.
- **TTY install** (download then run): `curl -O .../install.sh && bash install.sh` — prompts `1) multi  2) mono` (default 1).
- **Override via env**: `DWS_SKILL_MODE=mono curl -fsSL ... | sh`.
- **Switch later**: `dws skill setup --mode mono` (or `--mode multi`) — review the listed paths and confirm interactively.
+- **Quick install** (one-liner above): non-interactive, installs `mono`.
+- **TTY install** (download then run): `curl -O .../install.sh && bash install.sh` — prompts `1) mono  2) multi` (default 1).
+- **Override via env**: `DWS_SKILL_MODE=multi curl -fsSL ... | sh`.
+- **Switch later**: `dws skill setup --mode multi` (or `--mode mono`) — re-run any time.

 </details>

@@ -210,7 +210,7 @@ The verifier uses isolated directories and does not replace the `dws` on the cur
 The upgrade process follows a two-phase atomic flow to ensure consistency:

 1. **Prepare** — downloads the platform-specific binary and skill packages to a temporary directory, verifies SHA256 checksums, and extracts/validates all files. If any step fails, the upgrade aborts without modifying the existing installation.
-2. **Apply** — only after all preparations succeed, the binary is replaced and skills are flattened into the canonical `~/.agents/skills` root. Agents classified by the pinned compatibility registry as supporting the universal root read it directly; other detected Agents receive links to the canonical copy, with a direct-copy fallback when links are unavailable. Older DWS-managed agent-specific copies are backed up and retired so the same Skill is not discovered twice.
+2. **Apply** — only after all preparations succeed, the binary is replaced and skill packages are installed to all detected agent directories (`~/.agents/skills/dws`, `~/.claude/skills/dws`, `~/.cursor/skills/dws`, etc.).

 A backup of the current version is automatically created before each upgrade. Use `dws upgrade --rollback` to restore the previous version if needed.

@@ -371,7 +371,7 @@ dws contact user get-self --jq '.result[0].orgEmployeeModel | {name: .orgUserNam
 Use Cobra help and Schema for different parts of the command contract:

 - `dws <path> --help` is the source of truth for whether a command exists and which flags the binary accepts.
- `dws schema "<path>" --compact` is the normative Agent view for command selection, CLI parameters and constraints, risk, and confirmation; use a full leaf with a narrow `--jq` projection for mapping or provenance audits.
+- `dws schema "<path>"` is the Agent contract for command selection, parameter mappings and constraints, risk, and confirmation semantics.
 - If Help and Schema disagree, treat it as contract drift: pass only flags accepted by Cobra and use the more conservative safety semantics.
 - Schema describes commands; it does not read or search DingTalk business data. Execute the real product command after discovery.

@@ -380,32 +380,32 @@ Use Cobra help and Schema for different parts of the command contract:
 dws aitable record query --help

 # Discover within a product, then inspect the selected leaf contract
-dws schema aitable --compact
-dws schema "aitable record query" --compact
+dws schema aitable
+dws schema "aitable record query"

 # Execute the real business query
 dws aitable record query --base-id BASE_ID --table-id TABLE_ID --limit 10
 ```

-`dws schema --all` exports the complete contract for tooling, CI, audits, and compatibility baselines. Agents should query progressively with `--compact`; its positive field allowlist prevents new full/audit fields from silently expanding Agent context.
+`dws schema --all` exports the complete contract for tooling, CI, audits, and compatibility baselines. Agents should prefer product/group discovery followed by a leaf query to avoid loading the full Catalog into context.

 ### Agent Skills

 The repo ships a complete Agent Skill system under `skills/`, organized into two layouts:

- `skills/mono/` — single-skill layout (one `SKILL.md` + `references/products/`), legacy.
- `skills/multi/` — per-product skills (`dingtalk-aitable/`, `dingtalk-calendar/`, `dingtalk-chat/`, ...), each with its own `SKILL.md`. Default layout.
+- `skills/mono/` — single-skill layout (one `SKILL.md` + `references/products/`), recommended default.
+- `skills/multi/` — per-product skills (`dingtalk-aitable/`, `dingtalk-calendar/`, `dingtalk-chat/`, ...), each with its own `SKILL.md`. 🧪 **EXPERIMENTAL / preview — see banner in each multi `SKILL.md` for caveats.**

-Leaf safety/parameters/selection prose for Schema generation come from ProductDecl / ContractFinal declarations in Go. The former `internal/cli/schema_hints/` HintFile tree is fully retired and must not reappear.
+Shared reviewed inputs for Schema generation live separately under `internal/cli/schema_hints/`. They are not Agent Skills and are excluded from binaries and release skill bundles.

 After installing, AI tools like Claude Code / Cursor can operate DingTalk directly through natural language:

 ```bash
-# Install skills into current project (defaults to multi; DWS_SKILL_MODE=mono switches back)
+# Install skills into current project (defaults to mono)
 curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install-skills.sh | sh
 ```

-> Installers use `$HOME/.agents/skills/` as the canonical global store, following the universal `.agents/skills` convention. Agents classified by the pinned compatibility registry as universal read that root directly; detected non-universal Agents receive links to it (or copies when links are unavailable). Multi layout is per-product siblings, while mono uses the `dws/` subdirectory.
+> `install.sh` installs to `$HOME/.agents/skills/dws` (global); `install-skills.sh` installs to `./.agents/skills/dws` (current project).
 >
 > China users: prefix `DWS_GITEE_REPO` to use the Gitee mirror — see [China mirror](#china-mirror).

@@ -415,31 +415,22 @@ curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace
 # Interactive: prompts for mode + target agents
 dws skill setup

-# Preview the exact directories that mono setup would back up and replace
-dws skill setup --mode mono --target all --dry-run
+# Install mono skill to every detected agent home (claude / cursor / codex / opencode / qoder)
+dws skill setup --mode mono --target all --yes

-# Run interactively and confirm the listed directories
-dws skill setup --mode mono --target all
+# Install multi skills to a single agent home
+dws skill setup --mode multi --target cursor --yes

-# Preview, then install multi skills to a single agent home with interactive confirmation
-dws skill setup --mode multi --target cursor --dry-run
-dws skill setup --mode multi --target cursor
-
-# Point at a local source tree (e.g. a fork or work-in-progress), preview first
-DWS_SKILL_SOURCE=/path/to/skills dws skill setup --mode multi --dry-run
+# Point at a local source tree (e.g. a fork or work-in-progress)
 DWS_SKILL_SOURCE=/path/to/skills dws skill setup --mode multi
 ```

 | Flag | Values | Description |
 |------|--------|-------------|
 | `--mode` | `mono` \| `multi` | Skill layout; defaults to interactive prompt |
-| `--target` | `all` \| `claude` \| `cursor` \| `codex` \| `zcode` \| `opencode` \| `qoder` | Where to install; `all` covers every detected agent home, including ZCode at `~/.zcode/skills` |
+| `--target` | `all` \| `claude` \| `cursor` \| `codex` \| `opencode` \| `qoder` | Where to install; `all` covers every detected agent home |
 | `--source` | path | Local source directory (overrides bundled skills) |
-| `--yes` | — | Scripting-only: skip the confirmation prompt. Removals are still backed up to `~/.dws/skill-backups/` first |
-
-> The setup command can remove the opposite-mode layout (`dws/` for multi, DWS-managed multi Skills for mono) and stale managed Skills not in the bundle. DWS records ownership, installer version, source, and content digest centrally in `~/.dws/skills-state.json` (or `$DWS_CONFIG_DIR/skills-state.json`). Exact official names shipped before the centralized state remain a frozen migration list. A `dingtalk-*` prefix alone never authorizes cleanup, so other same-prefix market/user Skills are preserved. Every removal is previewed before confirmation and preserved under `~/.dws/skill-backups/<timestamp>/`; a directory that cannot be backed up is never removed. In a non-interactive shell, first run `--dry-run` and inspect its output; only then may the caller explicitly choose the scripting-only confirmation bypass.
-
-After a multi setup or upgrade, DWS stores the official bundle snapshot and centralized ownership metadata in `~/.dws/skills-state.json` (or `$DWS_CONFIG_DIR/skills-state.json`). Every upgrade installs and overwrites the complete bundled Skill set from that release. Deleting or excluding a bundled Skill is not sticky: the next upgrade restores it. `dws upgrade --force` additionally allows reinstalling the current CLI version when no newer version is available.
+| `--yes` | — | Skip confirmation prompts |

 Env vars: `DWS_SKILL_MODE=mono|multi` (also honored by `install.sh` / `install.ps1`), `DWS_SKILL_SOURCE=<path>`.

@@ -452,6 +443,7 @@ Env vars: `DWS_SKILL_MODE=mono|multi` (also honored by `install.sh` / `install.p
 | Intent guide | `skills/mono/references/intent-guide.md` | Disambiguation for confusing scenarios (e.g. report vs todo) |
 | Global reference | `skills/mono/references/global-reference.md` | Auth, output formats, global flags |
 | Error codes | `skills/mono/references/error-codes.md` | Error codes + debugging workflows |
+| Recovery guide | `skills/mono/references/recovery-guide.md` | `RECOVERY_EVENT_ID` handling |
 | Ready-made scripts | `skills/mono/scripts/*.py` | 13 batch operation scripts (see below) |

 <details>
@@ -482,7 +474,7 @@ Env vars: `DWS_SKILL_MODE=mono|multi` (also honored by `install.sh` / `install.p
 <details>
 <summary><strong>Personal Event Subscription</strong> — real-time DingTalk messages for event-driven agents</summary>

-`dws event consume` subscribes as the currently logged-in user over a managed Stream WebSocket and emits each event as one NDJSON line on stdout. The public catalog covers scoped and all one-to-one/group messages, specified senders, read/recall/reaction events, group lifecycle events, and seven OA approval task/instance events.
+`dws event consume` subscribes as the currently logged-in user over a managed Stream WebSocket and emits each event as one NDJSON line on stdout. The public catalog covers scoped and all one-to-one/group messages, specified senders, read/recall/reaction events, and group title/disband lifecycle events.

 The default `ndjson`, `json`, and `pretty` output preserves the transport envelope (`type`, `event_type`, string `data`, and `headers`) for existing scripts; `compact` retains its existing processor. Add `--flatten` to emit the stable top-level business fields used by Agent workflows. `--format` controls JSON serialization; `--flatten` controls the data structure and cannot be combined with `-f raw` or `--debug-raw-events`.

@@ -492,33 +484,28 @@ For an event-focused installation, use the official convenience installer:

 ```bash
 curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install-event.sh | sh
-
-# Or install the standalone multi skill from an existing dws installation
-dws skill setup --mode multi -s event
 ```

 ```bash
 # Inspect the public personal event catalog and schema
 dws event list
 dws event schema user_im_message_receive_o2o --flatten
-dws event list --category oa
-dws event schema user_oa_approval_task_created --flatten

 # Listen for messages that mention the current user
-dws event +listen-im --kind at-me -f ndjson
+dws event consume user_im_message_receive_at --flatten -f ndjson

-# Listen for messages from a specified sender
-dws event +listen-im --kind sender --user <userId> -f ndjson
+# Listen for one-to-one messages with a specified user
+dws event consume user_im_message_receive_o2o --user <userId> --flatten -f ndjson

 # Listen by openDingtalkId (external contact, bot, or cross-organization identity)
-dws event +listen-im --kind sender --open-dingtalk-id <openDingtalkId> -f ndjson
+dws event consume user_im_message_receive_o2o --open-dingtalk-id <openDingtalkId> --flatten -f ndjson

 # Listen for messages in a specified group
-dws event +listen-im --kind group --chat-id <openConversationId> -f ndjson
+dws event consume user_im_message_receive_group --group <openConversationId> --flatten -f ndjson

 # Listen for all one-to-one or all group messages
-dws event +listen-im --kind all-direct -f ndjson
-dws event +listen-im --kind all-group -f ndjson
+dws event consume user_im_message_receive_o2o_all --flatten -f ndjson
+dws event consume user_im_message_receive_group_all --flatten -f ndjson

 # Listen for a specified group's title changes, member changes, or disband event
 dws event consume user_im_group_updated --group <openConversationId> --flatten -f ndjson
@@ -526,20 +513,14 @@ dws event consume user_im_group_member_added --group <openConversationId> --flat
 dws event consume user_im_group_member_exited --group <openConversationId> --flatten -f ndjson
 dws event consume user_im_group_disbanded --group <openConversationId> --flatten -f ndjson

-# Listen for messages, reads, and recalls from the same sender in one process
-dws event +listen-im --kind sender --user <userId> \
-  --events message,read,recall -f ndjson
-
-# Listen for all seven public OA approval events in one process
+# Listen for multiple events for the same user in one process
 dws event consume \
-  user_oa_approval_task_created \
-  user_oa_approval_task_finished \
-  user_oa_approval_task_redirected \
-  user_oa_approval_instance_started \
-  user_oa_approval_instance_cc \
-  user_oa_approval_instance_terminated \
-  user_oa_approval_instance_finished \
-  --flatten -f ndjson
+  user_im_message_receive_o2o \
+  user_im_message_read_o2o \
+  user_im_message_recall_o2o \
+  --user <userId> \
+  --flatten \
+  -f ndjson

 # Inspect local consumers and cancel a subscription
 dws event status
@@ -643,7 +624,7 @@ dws aitable record query --base-id BASE_ID --tabel-id TABLE_ID       # --tabel-i
 ```bash
 # Built-in jq expressions
 dws aitable record query --base-id BASE_ID --table-id TABLE_ID --jq '.invocation.params'
-dws schema "dev app create" --jq '.parameters'
+dws schema "dev app create" --jq '.tool.required'

 # Return only specific fields
 dws aitable record query --base-id BASE_ID --table-id TABLE_ID --fields invocation,response
@@ -655,9 +636,9 @@ dws aitable record query --base-id BASE_ID --table-id TABLE_ID --fields invocati
 <summary><strong>Schema Introspection</strong> — Agent command discovery and execution contracts</summary>

 ```bash
-dws schema aitable --compact                            # discover product commands
-dws schema "aitable record query" --compact             # view the selected Agent leaf contract
-dws schema "aitable record query" --jq '[.parameters | to_entries[] | select(.value.required)]' # view required fields
+dws schema aitable                                      # discover product commands
+dws schema "aitable record query"                       # view the selected leaf contract
+dws schema "aitable record query" --jq '.tool.required' # view required fields
 dws schema --all                                        # full export for CI/audit/baselines
 ```

@@ -738,7 +719,7 @@ See [`docs/robot-quickstart.md`](./docs/robot-quickstart.md) for the full 4-step
 <summary>Coming soon</summary>

 - `conference` (video meetings)
- Multi-skill mode (default) — per-product skills under `skills/multi/`; installs and upgrades default to it, `dws skill setup --mode mono` switches back after interactive confirmation
+- Multi-skill mode (experimental) — per-product skills under `skills/multi/`; opt in via `dws skill setup --mode multi`

 </details>

@@ -787,7 +768,6 @@ See [`docs/robot-quickstart.md`](./docs/robot-quickstart.md) for the full 4-step

 ## Reference & Docs

- [International DingTalk (`.io`) guide](./docs/international-region-guide.md) — international login, domestic/international profile switching, isolated testing, and troubleshooting
 - [Command Index](./docs/command-index.md) — every runtime command with description and when-to-use guidance
 - [Reference](./docs/reference.md) — environment variables, exit codes, output formats, shell completion
 - [Architecture](./docs/architecture.md) — static endpoint pipeline, command surface, transport layer
@@ -19,7 +19,7 @@
 </p>

 > [!IMPORTANT]
-> **钉钉 DWS CLI 已全面开放，欢迎使用**：本项目涉及钉钉企业数据访问，需企业管理员授权后方可使用。欢迎加入钉钉 DWS 共创群获取支持与最新动态。详见下方 [开始使用](#开始使用)。
+> **共创阶段**：本项目涉及钉钉企业数据访问，需企业管理员授权后方可使用。欢迎加入钉钉 DWS 共创群获取支持与最新动态。详见下方 [开始使用](#开始使用)。
 >
 > <img src="https://img.alicdn.com/imgextra/i1/O1CN01WJyAsJ1prD2ovQACM_!!6000000005413-2-tps-718-720.png" alt="dws 开源沟通群二维码" width="150">

@@ -70,17 +70,17 @@ irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/ma

 | 模式 | 安装内容 | 适合场景 |
 |------|----------|----------|
-| **multi**（默认） | 按产品拆分的独立 skill（`dingtalk-aitable` / `dingtalk-calendar` / `dingtalk-chat` ...） | 单产品任务；每次召唤上下文更小 |
-| **mono**（legacy） | 一个 `dws` skill，覆盖全部产品 | 跨产品组合操作；单一入口召唤 |
+| **mono**（稳定，默认） | 一个 `dws` skill，覆盖全部产品 | 跨产品组合操作；单一入口召唤 |
+| **multi** 🧪 **试验版 / Preview** | 按产品拆分的独立 skill（`dingtalk-aitable` / `dingtalk-calendar` / `dingtalk-chat` ...） | 单产品任务；每次召唤上下文更小 |

-> 安装与升级默认均为 multi。mono 仍可通过 `DWS_SKILL_MODE=mono` 或 `dws skill setup --mode mono` 使用。问题请提 issue 反馈。
+> 🧪 **multi 模式当前为 EXPERIMENTAL（试验版 / Preview）**。全部独立 skill 均通过 dispatch verifier，但接口、命名、跨 skill 引用后续可能调整。生产 / 共享环境建议优先用 `mono`。问题请提 issue 反馈。

 怎么选：

- **快速安装**（上方一行 curl）：非交互，默认装 `multi`。
- **TTY 安装**（先下载再执行）：`curl -O .../install.sh && bash install.sh`，会弹出 `1) multi  2) mono` 选项（默认 1）。
- **环境变量覆盖**：`DWS_SKILL_MODE=mono curl -fsSL ... | sh`。
- **装完之后再切换**：`dws skill setup --mode mono`（或 `--mode multi`），核对列出的路径后交互确认。
+- **快速安装**（上方一行 curl）：非交互，默认装 `mono`。
+- **TTY 安装**（先下载再执行）：`curl -O .../install.sh && bash install.sh`，会弹出 `1) mono  2) multi` 选项（默认 1）。
+- **环境变量覆盖**：`DWS_SKILL_MODE=multi curl -fsSL ... | sh`。
+- **装完之后再切换**：`dws skill setup --mode multi`（或 `--mode mono`），随时重跑都行。

 </details>

@@ -207,7 +207,7 @@ bash verify-all-channels.sh
 升级过程采用两阶段原子流程，确保一致性：

 1. **准备阶段** — 将平台对应的二进制文件和技能包下载到临时目录，校验 SHA256 校验和，解压并验证所有文件。任何步骤失败则立即中止，不会修改现有安装。
-2. **执行阶段** — 仅在所有准备工作成功后，替换二进制文件并将技能包平铺到已检测到的具体 Agent 目录（例如 `~/.codex/skills/dingtalk-chat`、`~/.claude/skills/dingtalk-chat`）。只有未检测到具体 Agent 时才使用 `~/.agents/skills`；检测到具体 Agent 后会备份迁走旧的 DWS 通用副本，避免同一 Skill 被重复发现。
+2. **执行阶段** — 仅在所有准备工作成功后，替换二进制文件并将技能包安装到所有已检测到的 Agent 目录（`~/.agents/skills/dws`、`~/.claude/skills/dws`、`~/.cursor/skills/dws` 等）。

 每次升级前自动备份当前版本，可通过 `dws upgrade --rollback` 随时回滚。

@@ -365,7 +365,7 @@ dws contact user get-self --jq '.result[0].orgEmployeeModel | {name: .orgUserNam
 命令帮助和 Schema 分别负责命令契约的不同部分：

 - `dws <path> --help` 是命令是否存在、当前二进制接受哪些 flags 的事实源。
- `dws schema "<path>" --compact` 是 Agent 选命令、CLI 参数与约束、风险和确认语义的规范视图；映射或 provenance 审计使用 full leaf 配合 `--jq` 精确投影。
+- `dws schema "<path>"` 是 Agent 选命令、参数映射与约束、风险和确认语义的契约。
 - Help 与 Schema 冲突时视为契约漂移：执行只传 Cobra 接受的参数，安全语义取更保守值。
 - Schema 只描述命令，不读取或搜索钉钉业务数据；发现命令后仍需执行真实产品命令。

@@ -374,32 +374,32 @@ dws contact user get-self --jq '.result[0].orgEmployeeModel | {name: .orgUserNam
 dws aitable record query --help

 # 先在产品内发现命令，再查看选中 leaf 的契约
-dws schema aitable --compact
-dws schema "aitable record query" --compact
+dws schema aitable
+dws schema "aitable record query"

 # 执行真实业务查询
 dws aitable record query --base-id BASE_ID --table-id TABLE_ID --limit 10
 ```

-`dws schema --all` 会完整导出命令契约，供工具、CI、审计和兼容性基线使用。Agent 应使用 `--compact` 渐进查询；该视图采用正向字段白名单，full 新增的审计字段不会自动进入 Agent 上下文。
+`dws schema --all` 会完整导出命令契约，供工具、CI、审计和兼容性基线使用。Agent 应优先按产品/分组发现后查询 leaf，避免把整个 Catalog 加载进上下文。

 ### Agent Skills

 仓库内置完整的 Agent Skill 体系（`skills/` 目录），分为两套布局：

- `skills/mono/` — 单 skill 布局（一个 `SKILL.md` + `references/products/`），legacy。
- `skills/multi/` — 每个产品一个独立 skill（`dingtalk-aitable/` / `dingtalk-calendar/` / `dingtalk-chat/` ...），每个 skill 自带 `SKILL.md`。默认布局。
+- `skills/mono/` — 单 skill 布局（一个 `SKILL.md` + `references/products/`），默认推荐。
+- `skills/multi/` — 每个产品一个独立 skill（`dingtalk-aitable/` / `dingtalk-calendar/` / `dingtalk-chat/` ...），每个 skill 自带 `SKILL.md`。🧪 **试验版 / Preview — 各 multi `SKILL.md` 头部有详细注意事项。**

-Schema 生成的叶子 safety/参数/选型文案由 Go 中的 ProductDecl / ContractFinal 声明驱动。原 `internal/cli/schema_hints/` HintFile 目录已完全退役，不得重新引入。
+Schema 生成共享的 reviewed 输入单独位于 `internal/cli/schema_hints/`。它们不是 Agent Skill，也不会进入二进制或发布 skill 包。

 安装之后，Claude Code / Cursor 等 AI 工具就能通过自然语言直接操作钉钉：

 ```bash
-# 安装 skills 到当前项目（默认 multi；DWS_SKILL_MODE=mono 可切回）
+# 安装 skills 到当前项目（默认 mono）
 curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install-skills.sh | sh
 ```

-> 安装器优先使用检测到的具体 Agent 根目录（如 `$HOME/.codex/skills/`）；仅在未检测到具体 Agent 时回退到 `.agents/skills/`。multi 为按产品平铺，mono 为 `dws/` 子目录。
+> `install.sh` 安装到 `$HOME/.agents/skills/dws`（全局）；`install-skills.sh` 安装到 `./.agents/skills/dws`（当前项目）。
 >
 > 国内用户加 `DWS_GITEE_REPO` 走 Gitee 镜像，见 [国内加速安装](#国内加速安装)。

@@ -409,31 +409,22 @@ curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace
 # 交互式：提示选模式 + 目标 Agent
 dws skill setup

-# 先预览 mono setup 将备份和替换的精确目录
-dws skill setup --mode mono --target all --dry-run
+# 把 mono skill 铺到所有检测到的 Agent home（claude / cursor / codex / opencode / qoder）
+dws skill setup --mode mono --target all --yes

-# 交互执行并确认列出的目录
-dws skill setup --mode mono --target all
+# 只装到某一个 Agent home
+dws skill setup --mode multi --target cursor --yes

-# 先预览，再交互确认装到某一个 Agent home
-dws skill setup --mode multi --target cursor --dry-run
-dws skill setup --mode multi --target cursor
-
-# 指定本地源目录（比如 fork 或正在改的版本），先预览
-DWS_SKILL_SOURCE=/path/to/skills dws skill setup --mode multi --dry-run
+# 指定本地源目录（比如 fork 或正在改的版本）
 DWS_SKILL_SOURCE=/path/to/skills dws skill setup --mode multi
 ```

 | 参数 | 取值 | 说明 |
 |------|------|------|
 | `--mode` | `mono` \| `multi` | skill 布局，不指定则交互式询问 |
-| `--target` | `all` \| `claude` \| `cursor` \| `codex` \| `zcode` \| `opencode` \| `qoder` | 安装目标；`all` 表示铺到检测到的具体 Agent home（ZCode 为 `~/.zcode/skills`），仅在未检测到具体 Agent 时回退到 `~/.agents/skills` |
+| `--target` | `all` \| `claude` \| `cursor` \| `codex` \| `opencode` \| `qoder` | 安装目标，`all` 表示铺到所有检测到的 Agent home |
 | `--source` | 路径 | 本地源目录（覆盖内置 skills） |
-| `--yes` | — | 仅供脚本使用：跳过确认提示。删除操作仍会先备份到 `~/.dws/skill-backups/` |
-
-> setup 命令可能移除对面模式残留（装 multi 删 `dws/`，装 mono 清理统一状态中登记或属于状态上线前精确官方名称集合的 multi Skill）以及不在 bundle 内的过期受管 Skill。DWS 在 `~/.dws/skills-state.json`（或 `$DWS_CONFIG_DIR/skills-state.json`）集中记录所有权、安装版本、来源和内容摘要。仅有 `dingtalk-*` 前缀不能触发清理，因此其他同前缀市场/用户 Skill 会保留。所有删除都会先列入确认预览，并备份到 `~/.dws/skill-backups/<时间戳>/`；备份失败的目录会保留原样、绝不删除。非交互环境应先用 `--dry-run` 核对输出，再由调用方显式决定是否使用仅供脚本的确认跳过参数。
-
-multi setup 或 upgrade 后，DWS 会把官方 bundle 快照和统一所有权元数据写入 `~/.dws/skills-state.json`（或 `$DWS_CONFIG_DIR/skills-state.json`）。每次 upgrade 都会安装并覆盖该版本的全部预制 Skill；手工删除或通过 setup 排除预制 Skill 不会永久保留，下次 upgrade 会恢复。`dws upgrade --force` 还允许在没有新版本时重装当前 CLI 版本。
+| `--yes` | — | 跳过确认提示 |

 环境变量：`DWS_SKILL_MODE=mono|multi`（`install.sh` / `install.ps1` 也认）、`DWS_SKILL_SOURCE=<路径>`。

@@ -446,6 +437,7 @@ multi setup 或 upgrade 后，DWS 会把官方 bundle 快照和统一所有权
 | 意图指南 | `skills/mono/references/intent-guide.md` | 易混淆场景消歧（如 report vs todo） |
 | 全局参考 | `skills/mono/references/global-reference.md` | 认证、输出格式、全局 flag |
 | 错误码 | `skills/mono/references/error-codes.md` | 错误码 + 调试流程 |
+| Recovery 指南 | `skills/mono/references/recovery-guide.md` | `RECOVERY_EVENT_ID` 处理 |
 | 现成脚本 | `skills/mono/scripts/*.py` | 13 个批量操作脚本（见下方） |

 <details>
@@ -476,7 +468,7 @@ multi setup 或 upgrade 后，DWS 会把官方 bundle 快照和统一所有权
 <details>
 <summary><strong>个人事件订阅</strong> — 实时接收钉钉消息，驱动事件触发的 Agent</summary>

-`dws event consume` 使用当前 OAuth 登录用户建立托管的 Stream WebSocket 长连接，并把每条事件以 NDJSON 一行输出到 stdout。当前公开目录覆盖指定范围和全量单聊/群消息、指定发送人、已读/撤回/表情回应、群生命周期，以及七个 OA 审批任务/实例事件。
+`dws event consume` 使用当前 OAuth 登录用户建立托管的 Stream WebSocket 长连接，并把每条事件以 NDJSON 一行输出到 stdout。当前公开目录覆盖指定范围和全量单聊/群消息、指定发送人、已读/撤回/表情回应，以及群标题变更和群解散事件。

 默认 `ndjson`、`json`、`pretty` 输出保留兼容 transport envelope（`type`、`event_type`、字符串 `data`、`headers`），`compact` 继续沿用原 processor。Agent 或新脚本显式加 `--flatten` 后，输出稳定的顶层业务字段。`--format` 控制 JSON 序列化，`--flatten` 控制数据结构，且不能与 `-f raw` 或 `--debug-raw-events` 同时使用。

@@ -486,33 +478,28 @@ multi setup 或 upgrade 后，DWS 会把官方 bundle 快照和统一所有权

 ```bash
 curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install-event.sh | sh
-
-# 或在已有 dws 环境中安装独立的 multi skill
-dws skill setup --mode multi -s event
 ```

 ```bash
 # 查看公开个人事件目录和 schema
 dws event list
 dws event schema user_im_message_receive_o2o --flatten
-dws event list --category oa
-dws event schema user_oa_approval_task_created --flatten

 # 监听当前用户被 @ 的消息
-dws event +listen-im --kind at-me -f ndjson
+dws event consume user_im_message_receive_at --flatten -f ndjson

-# 监听指定发送人的消息
-dws event +listen-im --kind sender --user <userId> -f ndjson
+# 监听与指定用户的单聊消息
+dws event consume user_im_message_receive_o2o --user <userId> --flatten -f ndjson

 # 使用 openDingtalkId 监听外部联系人、机器人或跨组织身份
-dws event +listen-im --kind sender --open-dingtalk-id <openDingtalkId> -f ndjson
+dws event consume user_im_message_receive_o2o --open-dingtalk-id <openDingtalkId> --flatten -f ndjson

 # 监听指定群的消息
-dws event +listen-im --kind group --chat-id <openConversationId> -f ndjson
+dws event consume user_im_message_receive_group --group <openConversationId> --flatten -f ndjson

 # 监听所有单聊或所有群消息
-dws event +listen-im --kind all-direct -f ndjson
-dws event +listen-im --kind all-group -f ndjson
+dws event consume user_im_message_receive_o2o_all --flatten -f ndjson
+dws event consume user_im_message_receive_group_all --flatten -f ndjson

 # 监听指定群标题变更、成员进退群或群解散
 dws event consume user_im_group_updated --group <openConversationId> --flatten -f ndjson
@@ -520,20 +507,14 @@ dws event consume user_im_group_member_added --group <openConversationId> --flat
 dws event consume user_im_group_member_exited --group <openConversationId> --flatten -f ndjson
 dws event consume user_im_group_disbanded --group <openConversationId> --flatten -f ndjson

-# 一个进程监听同一发送人的消息、已读和撤回
-dws event +listen-im --kind sender --user <userId> \
-  --events message,read,recall -f ndjson
-
-# 一个进程监听全部七个公开 OA 审批事件
+# 一个进程监听同一用户的多个事件
 dws event consume \
-  user_oa_approval_task_created \
-  user_oa_approval_task_finished \
-  user_oa_approval_task_redirected \
-  user_oa_approval_instance_started \
-  user_oa_approval_instance_cc \
-  user_oa_approval_instance_terminated \
-  user_oa_approval_instance_finished \
-  --flatten -f ndjson
+  user_im_message_receive_o2o \
+  user_im_message_read_o2o \
+  user_im_message_recall_o2o \
+  --user <userId> \
+  --flatten \
+  -f ndjson

 # 查看本地 consume，并取消指定订阅
 dws event status
@@ -637,7 +618,7 @@ dws aitable record query --base-id BASE_ID --tabel-id TABLE_ID       # --tabel-i
 ```bash
 # 内置 jq 表达式
 dws aitable record query --base-id BASE_ID --table-id TABLE_ID --jq '.invocation.params'
-dws schema "dev app create" --jq '.parameters'
+dws schema "dev app create" --jq '.tool.required'

 # 只返回指定字段
 dws aitable record query --base-id BASE_ID --table-id TABLE_ID --fields invocation,response
@@ -649,9 +630,9 @@ dws aitable record query --base-id BASE_ID --table-id TABLE_ID --fields invocati
 <summary><strong>Schema 自省</strong> — Agent 命令发现与执行契约</summary>

 ```bash
-dws schema aitable --compact                            # 发现产品命令
-dws schema "aitable record query" --compact             # 查看 Agent leaf 契约
-dws schema "aitable record query" --jq '[.parameters | to_entries[] | select(.value.required)]' # 定向查看必填字段
+dws schema aitable                                      # 发现产品命令
+dws schema "aitable record query"                       # 查看选中 leaf 契约
+dws schema "aitable record query" --jq '.tool.required' # 查看必填字段
 dws schema --all                                        # CI/审计/基线的全量导出
 ```

@@ -727,7 +708,7 @@ dws dev connect --channel auto --robot-client-id <id> --robot-client-secret <sec
 <summary>即将推出</summary>

 - `conference`（视频会议）
- 多 skill 模式（默认）— 每产品一个独立 skill，位于 `skills/multi/`，安装与升级默认启用；`dws skill setup --mode mono` 交互确认后可切回单 skill
+- 多 skill 模式（实验中）— 每产品一个独立 skill，位于 `skills/multi/`，通过 `dws skill setup --mode multi` 启用

 </details>

@@ -778,7 +759,6 @@ dws dev connect --channel auto --robot-client-id <id> --robot-client-secret <sec

 ## 参考与文档

- [国际版（`.io`）使用手册](./docs/international-region-guide.zh-CN.md) — 国际版登录、国内/国际 profile 切换、隔离验证与排障
 - [命令索引](./docs/command-index.md) — 全部运行时命令，带描述与使用场景
 - [参考手册](./docs/reference.md) — 环境变量、退出码、输出格式、Shell 补全
 - [架构设计](./docs/architecture.md) — 静态端点管道、命令面、Transport 层
@@ -13,71 +13,13 @@ if (!fs.existsSync(binaryPath)) {
  process.exit(1);
 }

-// Interactive commands must remain in the terminal's foreground session so
-// prompts can use /dev/tty. Non-interactive launches use a separate process
-// group, allowing a signal sent only to this wrapper to reach the full vendor
-// process tree exactly once.
-const isolateVendorProcessGroup = process.platform !== "win32" && !process.stdin.isTTY;
-
-const child = childProcess.spawn(binaryPath, process.argv.slice(2), {
+const result = childProcess.spawnSync(binaryPath, process.argv.slice(2), {
  stdio: "inherit",
-  detached: isolateVendorProcessGroup,
 });

-let spawnFailed = false;
-let forwardedSignal = null;
-const forwardedSignals = ["SIGINT", "SIGTERM"];
-
-function forwardSignal(signal) {
-  forwardedSignal = signal;
-  if (child.exitCode === null && child.signalCode === null) {
-    if (process.platform === "win32") {
-      child.kill(signal);
-      return;
-    }
-    if (!isolateVendorProcessGroup) {
-      // Ctrl-C is generated for the whole foreground process group, including
-      // the vendor. SIGTERM is not terminal-generated and still needs an
-      // explicit handoff when a process manager targets only this wrapper.
-      if (signal === "SIGTERM") {
-        child.kill(signal);
-      }
-      return;
-    }
-    try {
-      // detached makes the vendor PID the leader of its POSIX process group.
-      // Signal the whole group so any subprocesses inherit the same shutdown.
-      process.kill(-child.pid, signal);
-    } catch (error) {
-      // The group may have completed between the state check and kill.
-      if (error.code !== "ESRCH") {
-        throw error;
-      }
-    }
-  }
+if (result.error) {
+  console.error(result.error.message);
+  process.exit(1);
 }

-const signalHandlers = new Map(
-  forwardedSignals.map((signal) => [signal, () => forwardSignal(signal)]),
-);
-for (const signal of forwardedSignals) {
-  process.on(signal, signalHandlers.get(signal));
-}
-
-child.on("error", (error) => {
-  spawnFailed = true;
-  console.error(error.message);
-});
-
-child.on("close", (code, signal) => {
-  for (const forwarded of forwardedSignals) {
-    process.removeListener(forwarded, signalHandlers.get(forwarded));
-  }
-
-  const exitSignal = forwardedSignal || signal;
-  if (exitSignal && process.platform !== "win32") {
-    process.kill(process.pid, exitSignal);
-    return;
-  }
-  process.exitCode = spawnFailed || code === null ? 1 : code;
-});
+process.exit(result.status === null ? 1 : result.status);
@@ -32,6 +32,6 @@
    "README.md"
  ],
  "engines": {
-    "node": ">=16.7.0"
+    "node": ">=16"
  }
 }
@@ -1,16 +1,15 @@
 // Command fetch_mcp_metadata pulls tools/list from ALL live MCP server endpoints
-// and writes a local diagnostic dump. It is NOT a Schema delivery refresh:
-// schema_mcp_metadata.json is retired; production Catalog assembles from
-// Contract/ParamDecl/Interface + Cobra only.
+// and writes a refreshed schema_mcp_metadata.json. This is DWS's equivalent of
+// lark-cli's scripts/fetch_meta.py.
 //
 // Usage:
 //
 //	dws auth login                     # ensure valid auth
-//	make fetch-mcp-metadata             # writes artifacts/mcp_metadata_diagnostic.json
+//	make fetch-mcp-metadata             # runs this tool
 //
-// The tool loads auth from the DWS keychain, iterates static server endpoints
-// (internal/syncdata.StaticServers), calls tools/list on each, merges results,
-// and writes the requested -output path (refuses the retired pin path).
+// The tool loads auth from the DWS keychain, iterates all 26 static server
+// endpoints (internal/syncdata.StaticServers), calls tools/list on each,
+// merges results, and writes schema_mcp_metadata.json.
 package main

 import (
@@ -25,7 +24,6 @@ import (
 	"strings"
 	"time"

-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/app"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/syncdata"
@@ -40,15 +38,14 @@ type toolLister interface {

 // Injection points so run() is fully testable without network/keychain/exit.
 var (
-	osExit               = os.Exit
-	getenv               = os.Getenv
-	loadTokenData        = auth.LoadTokenDataKeychain
-	staticServers        = syncdata.StaticServers
-	registrySource       = collectedIdentityInterfaceRefs
-	collectIdentitySpecs = cli.CollectIdentitySpecs
-	listToolsTimeout     = 30 * time.Second
-	gitHeadPath          = ".git/HEAD"
-	newToolLister        = func(token string) toolLister {
+	osExit           = os.Exit
+	getenv           = os.Getenv
+	loadTokenData    = auth.LoadTokenDataKeychain
+	staticServers    = syncdata.StaticServers
+	registrySource   = cli.EmbeddedCommandRegistryMergedJSON
+	listToolsTimeout = 30 * time.Second
+	gitHeadPath      = ".git/HEAD"
+	newToolLister    = func(token string) toolLister {
 		return transport.NewClient(&http.Client{Timeout: 60 * time.Second}).WithAuth(token, nil)
 	}
 )
@@ -60,14 +57,10 @@ func main() {
 func run(args []string, stderr io.Writer) int {
 	flags := flag.NewFlagSet("fetch_mcp_metadata", flag.ContinueOnError)
 	flags.SetOutput(stderr)
-	output := flags.String("output", "artifacts/mcp_metadata_diagnostic.json", "diagnostic dump path (not a Schema pin)")
+	output := flags.String("output", "internal/cli/schema_mcp_metadata.json", "output file path")
 	if err := flags.Parse(args); err != nil {
 		return 2
 	}
-	if retiredPinnedMCPMetadataPath(*output) {
-		fmt.Fprintln(stderr, "fetch_mcp_metadata: refusing to write retired Schema pin internal/cli/schema_mcp_metadata.json")
-		return 2
-	}

 	token := resolveToken(stderr)
 	if token == "" {
@@ -81,11 +74,11 @@ func run(args []string, stderr io.Writer) int {
 	servers := staticServers()
 	fmt.Fprintf(stderr, "fetch_mcp_metadata: querying %d server endpoints\n", len(servers))

-	// Collect command identity to build tool_name → interface_ref mapping.
+	// Load CLI registry to build tool_name → interface_ref mapping.
 	registryMap := loadRegistryInterfaceRefs(stderr)
 	fmt.Fprintf(stderr, "fetch_mcp_metadata: registry mapping: %d entries\n", len(registryMap))

-	// Load a previous diagnostic dump (if any) to preserve hand-curated
+	// Load the previous schema_mcp_metadata.json to preserve hand-curated
 	// cross-server interface_ref mappings that automated matching can't derive.
 	prevData, prevErr := os.ReadFile(*output)
 	prevTools := map[string]map[string]any{}
@@ -317,51 +310,48 @@ func buildCrossServerRefs(prevTools map[string]map[string]any, registryMap map[s
 	return index
 }

-// collectedIdentityInterfaceRefs collects command identity from the live
-// command tree — the replacement for the retired reviewed CommandRegistry —
-// and derives the canonical_path → {product_id, rpc_name} mapping used for
-// interface_ref injection.
-func collectedIdentityInterfaceRefs() (map[string]map[string]string, error) {
-	root := app.NewSchemaSourceRootCommand()
-	specs, _, err := collectIdentitySpecs(root)
-	if err != nil {
-		return nil, fmt.Errorf("collect command identity: %w", err)
-	}
-	out := make(map[string]map[string]string, len(specs))
-	for _, spec := range specs {
-		cp := strings.TrimSpace(spec.CanonicalPath)
-		if cp == "" || !strings.Contains(cp, ".") {
-			continue
-		}
-		parts := strings.SplitN(cp, ".", 2)
-		out[cp] = map[string]string{
-			"product_id": parts[0],
-			"rpc_name":   parts[1],
-		}
-	}
-	return out, nil
-}
-
-// loadRegistryInterfaceRefs builds the canonical_path → interface_ref mapping
-// from the collected command identity. 与旧实现同等告警：静默返回空映射会让
-// 所有 live tool 被丢弃、产出 stub-only 快照且零提示（P1#1 的故障模式）。
+// loadRegistryInterfaceRefs loads the reviewed split CommandRegistry through
+// the cli package's reassembly API and builds a canonical_path →
+// {product_id, rpc_name} mapping for interface_ref injection.
 func loadRegistryInterfaceRefs(stderr io.Writer) map[string]map[string]string {
-	refs, err := registrySource()
+	data, err := registrySource()
 	if err != nil {
-		fmt.Fprintf(stderr, "fetch_mcp_metadata: warning: cannot collect command identity: %v\n", err)
+		fmt.Fprintf(stderr, "fetch_mcp_metadata: warning: cannot load registry: %v\n", err)
 		return map[string]map[string]string{}
 	}
-	return refs
-}
-
-func retiredPinnedMCPMetadataPath(path string) bool {
-	cleaned := strings.ReplaceAll(strings.TrimSpace(path), "\\", "/")
-	return cleaned == "internal/cli/schema_mcp_metadata.json" ||
-		strings.HasSuffix(cleaned, "/internal/cli/schema_mcp_metadata.json")
+	var reg struct {
+		Products []struct {
+			ID    string `json:"id"`
+			Tools []struct {
+				CanonicalPath string `json:"canonical_path"`
+			} `json:"tools"`
+		} `json:"products"`
+	}
+	if err := json.Unmarshal(data, &reg); err != nil {
+		// 与读文件失败同等告警：静默返回空映射会让所有 live tool 被丢弃、
+		// 产出 stub-only 快照且零提示（P1#1 的故障模式）。
+		fmt.Fprintf(stderr, "fetch_mcp_metadata: warning: cannot parse registry: %v\n", err)
+		return map[string]map[string]string{}
+	}
+	out := make(map[string]map[string]string)
+	for _, prod := range reg.Products {
+		for _, tool := range prod.Tools {
+			cp := strings.TrimSpace(tool.CanonicalPath)
+			if cp == "" || !strings.Contains(cp, ".") {
+				continue
+			}
+			parts := strings.SplitN(cp, ".", 2)
+			out[cp] = map[string]string{
+				"product_id": parts[0],
+				"rpc_name":   parts[1],
+			}
+		}
+	}
+	return out
 }

 // extractParams converts a JSON Schema inputSchema (from MCP tools/list) into
-// the flat param-name → metadata map used by diagnostic dumps.
+// the flat param-name → metadata map used by schema_mcp_metadata.json.
 func extractParams(inputSchema map[string]any) map[string]map[string]any {
 	if inputSchema == nil {
 		return nil
@@ -16,66 +16,24 @@ import (
 	"testing"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/syncdata"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
-	"github.com/spf13/cobra"
 )

-func TestCrossPlatformCoverageLoadRegistryInterfaceRefsCollectsIdentity(t *testing.T) {
+func TestLoadRegistryInterfaceRefsUsesSplitRegistry(t *testing.T) {
 	var stderr bytes.Buffer
 	refs := loadRegistryInterfaceRefs(&stderr)
 	if len(refs) == 0 {
-		t.Fatal("loadRegistryInterfaceRefs() returned no collected commands")
+		t.Fatal("loadRegistryInterfaceRefs() returned no reviewed commands")
 	}

 	got, ok := refs["calendar.list_calendars"]
 	if !ok {
-		t.Fatal("calendar.list_calendars missing from collected command identity")
+		t.Fatal("calendar.list_calendars missing from reassembled split registry")
 	}
 	if got["product_id"] != "calendar" || got["rpc_name"] != "list_calendars" {
 		t.Fatalf("calendar.list_calendars ref = %#v", got)
 	}
-
-	direct, err := collectedIdentityInterfaceRefs()
-	if err != nil {
-		t.Fatalf("collectedIdentityInterfaceRefs() error = %v", err)
-	}
-	if len(direct) == 0 || direct["calendar.list_calendars"]["rpc_name"] != "list_calendars" {
-		t.Fatalf("collectedIdentityInterfaceRefs() = %#v", direct["calendar.list_calendars"])
-	}
-
-	prevRegistry := registrySource
-	prevCollect := collectIdentitySpecs
-	t.Cleanup(func() {
-		registrySource = prevRegistry
-		collectIdentitySpecs = prevCollect
-	})
-	registrySource = func() (map[string]map[string]string, error) {
-		return nil, errors.New("collect boom")
-	}
-	stderr.Reset()
-	if got := loadRegistryInterfaceRefs(&stderr); len(got) != 0 || !strings.Contains(stderr.String(), "cannot collect command identity") {
-		t.Fatalf("loadRegistryInterfaceRefs error path = %#v stderr=%q", got, stderr.String())
-	}
-
-	collectIdentitySpecs = func(*cobra.Command) ([]cli.CommandSpec, cli.IdentityCollectionReport, error) {
-		return nil, cli.IdentityCollectionReport{}, errors.New("walk boom")
-	}
-	if _, err := collectedIdentityInterfaceRefs(); err == nil || !strings.Contains(err.Error(), "collect command identity") {
-		t.Fatalf("collectedIdentityInterfaceRefs wrap error = %v", err)
-	}
-	collectIdentitySpecs = func(*cobra.Command) ([]cli.CommandSpec, cli.IdentityCollectionReport, error) {
-		return []cli.CommandSpec{
-			{CanonicalPath: ""},
-			{CanonicalPath: "nodot"},
-			{CanonicalPath: "doc.create"},
-		}, cli.IdentityCollectionReport{}, nil
-	}
-	gotRefs, err := collectedIdentityInterfaceRefs()
-	if err != nil || len(gotRefs) != 1 || gotRefs["doc.create"]["rpc_name"] != "create" {
-		t.Fatalf("collectedIdentityInterfaceRefs skip = %#v err=%v", gotRefs, err)
-	}
 }

 func TestBuildCrossServerRefs(t *testing.T) {
@@ -133,11 +91,8 @@ func TestBuildCrossServerRefsSkipsMalformedRefs(t *testing.T) {
 }

 func TestRunRefreshesCrossServerTools(t *testing.T) {
-	registry := func() (map[string]map[string]string, error) {
-		return map[string]map[string]string{
-			"aitable.advperm_enable":  {"product_id": "aitable", "rpc_name": "advperm_enable"},
-			"aitable.advperm_disable": {"product_id": "aitable", "rpc_name": "advperm_disable"},
-		}, nil
+	registry := func() ([]byte, error) {
+		return []byte(`{"version":1,"products":[{"id":"aitable","tools":[{"canonical_path":"aitable.advperm_enable"},{"canonical_path":"aitable.advperm_disable"}]}]}`), nil
 	}
 	servers := []syncdata.ServerInfo{{ID: "aitable-helper", Endpoint: "https://helper.example"}}
 	lister := &fakeLister{
@@ -192,10 +147,8 @@ func TestRunRefreshesCrossServerTools(t *testing.T) {
 // 跨 server 身份时，另一 server 上恰好同名的工具不得直连覆盖其元数据——
 // 数据源只能是评审身份指向的 live 工具。
 func TestRunCrossOwnedCanonicalIgnoresNameCoincidence(t *testing.T) {
-	registry := func() (map[string]map[string]string, error) {
-		return map[string]map[string]string{
-			"aitable.advperm_enable": {"product_id": "aitable", "rpc_name": "advperm_enable"},
-		}, nil
+	registry := func() ([]byte, error) {
+		return []byte(`{"version":1,"products":[{"id":"aitable","tools":[{"canonical_path":"aitable.advperm_enable"}]}]}`), nil
 	}
 	servers := []syncdata.ServerInfo{
 		{ID: "aitable", Endpoint: "https://aitable.example"},
@@ -345,7 +298,7 @@ func (f *fakeLister) ListTools(_ context.Context, endpoint string) (transport.To
 }

 // stubDeps swaps every injection point for the duration of one test.
-func stubDeps(t *testing.T, token string, keychain func() (*auth.TokenData, error), servers []syncdata.ServerInfo, lister toolLister, registry func() (map[string]map[string]string, error)) {
+func stubDeps(t *testing.T, token string, keychain func() (*auth.TokenData, error), servers []syncdata.ServerInfo, lister toolLister, registry func() ([]byte, error)) {
 	t.Helper()
 	origGetenv, origLoad, origServers, origNew, origRegistry := getenv, loadTokenData, staticServers, newToolLister, registrySource
 	t.Cleanup(func() {
@@ -363,32 +316,12 @@ func stubDeps(t *testing.T, token string, keychain func() (*auth.TokenData, erro
 	registrySource = registry
 }

-func testRegistryRefs() (map[string]map[string]string, error) {
-	return map[string]map[string]string{
-		"doc.copy_document": {"product_id": "doc", "rpc_name": "copy_document"},
-		"doc.get_document":  {"product_id": "doc", "rpc_name": "get_document"},
-	}, nil
-}
-
-func TestCrossPlatformCoverageRunRefusesRetiredPinnedMCPMetadataPath(t *testing.T) {
-	stubDeps(t, "env-token", nil, nil, &fakeLister{}, testRegistryRefs)
-	var stderr bytes.Buffer
-	code := run([]string{"--output", "internal/cli/schema_mcp_metadata.json"}, &stderr)
-	if code != 2 {
-		t.Fatalf("run(retired pin) = %d, want 2", code)
-	}
-	if !strings.Contains(stderr.String(), "refusing to write retired Schema pin") {
-		t.Fatalf("stderr = %q, want retired-pin refusal", stderr.String())
-	}
-	if !retiredPinnedMCPMetadataPath("internal/cli/schema_mcp_metadata.json") ||
-		!retiredPinnedMCPMetadataPath("/tmp/repo/internal/cli/schema_mcp_metadata.json") ||
-		retiredPinnedMCPMetadataPath("artifacts/mcp_metadata_diagnostic.json") {
-		t.Fatal("retiredPinnedMCPMetadataPath classification is incorrect")
-	}
+func testRegistryJSON() ([]byte, error) {
+	return []byte(`{"version":1,"products":[{"id":"doc","tools":[{"canonical_path":"doc.copy_document"},{"canonical_path":"doc.get_document"},{"canonical_path":"bad-entry"}]}]}`), nil
 }

 func TestRunNoTokenFails(t *testing.T) {
-	stubDeps(t, "", func() (*auth.TokenData, error) { return nil, errors.New("no keychain") }, nil, &fakeLister{}, testRegistryRefs)
+	stubDeps(t, "", func() (*auth.TokenData, error) { return nil, errors.New("no keychain") }, nil, &fakeLister{}, testRegistryJSON)
 	var stderr bytes.Buffer
 	if code := run(nil, &stderr); code != 1 {
 		t.Fatalf("run() = %d, want 1", code)
@@ -399,7 +332,7 @@ func TestRunNoTokenFails(t *testing.T) {
 }

 func TestRunInvalidFlagFails(t *testing.T) {
-	stubDeps(t, "tok", nil, nil, &fakeLister{}, testRegistryRefs)
+	stubDeps(t, "tok", nil, nil, &fakeLister{}, testRegistryJSON)
 	var stderr bytes.Buffer
 	if code := run([]string{"--nonexistent"}, &stderr); code != 2 {
 		t.Fatalf("run() = %d, want 2", code)
@@ -409,7 +342,7 @@ func TestRunInvalidFlagFails(t *testing.T) {
 func TestResolveTokenKeychainFallback(t *testing.T) {
 	stubDeps(t, "", func() (*auth.TokenData, error) {
 		return &auth.TokenData{AccessToken: "kc-token"}, nil
-	}, nil, &fakeLister{}, testRegistryRefs)
+	}, nil, &fakeLister{}, testRegistryJSON)
 	var stderr bytes.Buffer
 	if got := resolveToken(&stderr); got != "kc-token" {
 		t.Fatalf("resolveToken() = %q, want kc-token", got)
@@ -420,14 +353,14 @@ func TestResolveTokenKeychainFallback(t *testing.T) {
 }

 func TestResolveTokenEmptyKeychainToken(t *testing.T) {
-	stubDeps(t, "", func() (*auth.TokenData, error) { return &auth.TokenData{}, nil }, nil, &fakeLister{}, testRegistryRefs)
+	stubDeps(t, "", func() (*auth.TokenData, error) { return &auth.TokenData{}, nil }, nil, &fakeLister{}, testRegistryJSON)
 	var stderr bytes.Buffer
 	if got := resolveToken(&stderr); got != "" {
 		t.Fatalf("resolveToken() = %q, want empty", got)
 	}
 }

-func TestCrossPlatformCoverageRunWritesSnapshotWithHonestCoverage(t *testing.T) {
+func TestRunWritesSnapshotWithHonestCoverage(t *testing.T) {
 	servers := []syncdata.ServerInfo{
 		{ID: "doc", Endpoint: "https://doc.example"},
 		{ID: "sheet", Endpoint: "https://sheet.example"},
@@ -450,7 +383,7 @@ func TestCrossPlatformCoverageRunWritesSnapshotWithHonestCoverage(t *testing.T)
 		},
 		errs: map[string]error{"https://sheet.example": errors.New("boom")},
 	}
-	stubDeps(t, "env-token", nil, servers, lister, testRegistryRefs)
+	stubDeps(t, "env-token", nil, servers, lister, testRegistryJSON)

 	dir := t.TempDir()
 	output := filepath.Join(dir, "snapshot.json")
@@ -513,7 +446,7 @@ func TestCrossPlatformCoverageRunWritesSnapshotWithHonestCoverage(t *testing.T)
 }

 func TestRunIgnoresCorruptPreviousSnapshot(t *testing.T) {
-	stubDeps(t, "env-token", nil, nil, &fakeLister{}, testRegistryRefs)
+	stubDeps(t, "env-token", nil, nil, &fakeLister{}, testRegistryJSON)
 	output := filepath.Join(t.TempDir(), "snapshot.json")
 	if err := os.WriteFile(output, []byte("{corrupt"), 0o600); err != nil {
 		t.Fatal(err)
@@ -524,20 +457,32 @@ func TestRunIgnoresCorruptPreviousSnapshot(t *testing.T) {
 	}
 }

-func TestCrossPlatformCoverageRunRegistryLoadFailureStillWritesStublessSnapshot(t *testing.T) {
-	stubDeps(t, "env-token", nil, nil, &fakeLister{}, func() (map[string]map[string]string, error) { return nil, errors.New("no identity") })
+func TestRunRegistryLoadFailureStillWritesStublessSnapshot(t *testing.T) {
+	stubDeps(t, "env-token", nil, nil, &fakeLister{}, func() ([]byte, error) { return nil, errors.New("no registry") })
 	output := filepath.Join(t.TempDir(), "snapshot.json")
 	var stderr bytes.Buffer
 	if code := run([]string{"--output", output}, &stderr); code != 0 {
 		t.Fatalf("run() = %d, stderr=%s", code, stderr.String())
 	}
-	if !strings.Contains(stderr.String(), "cannot collect command identity") {
-		t.Fatalf("stderr = %q, want identity collection warning", stderr.String())
+	if !strings.Contains(stderr.String(), "cannot load registry") {
+		t.Fatalf("stderr = %q, want registry warning", stderr.String())
+	}
+}
+
+func TestRunUnparsableRegistryYieldsNoRefs(t *testing.T) {
+	var stderr bytes.Buffer
+	stubDeps(t, "env-token", nil, nil, &fakeLister{}, func() ([]byte, error) { return []byte("{bad"), nil })
+	if refs := loadRegistryInterfaceRefs(&stderr); len(refs) != 0 {
+		t.Fatalf("refs = %v, want empty for unparsable registry", refs)
+	}
+	// 解析失败必须有告警，不得静默产出空映射。
+	if !strings.Contains(stderr.String(), "cannot parse registry") {
+		t.Fatalf("stderr = %q, want parse warning", stderr.String())
 	}
 }

 func TestRunWriteFailure(t *testing.T) {
-	stubDeps(t, "env-token", nil, nil, &fakeLister{}, testRegistryRefs)
+	stubDeps(t, "env-token", nil, nil, &fakeLister{}, testRegistryJSON)
 	var stderr bytes.Buffer
 	badPath := filepath.Join(t.TempDir(), "missing-dir", "snapshot.json")
 	if code := run([]string{"--output", badPath}, &stderr); code != 1 {
@@ -553,7 +498,7 @@ func TestWriteMetadataMarshalFailure(t *testing.T) {
 }

 func TestMainDelegatesToRun(t *testing.T) {
-	stubDeps(t, "env-token", nil, nil, &fakeLister{}, testRegistryRefs)
+	stubDeps(t, "env-token", nil, nil, &fakeLister{}, testRegistryJSON)
 	origExit, origArgs := osExit, os.Args
 	t.Cleanup(func() { osExit, os.Args = origExit, origArgs })
 	exitCode := -1
@@ -574,14 +519,14 @@ func TestExtractParamsNilAndNonObjectSchemas(t *testing.T) {
 	}
 }

-func TestCrossPlatformCoverageNewToolListerBuildsAuthedClient(t *testing.T) {
+func TestNewToolListerBuildsAuthedClient(t *testing.T) {
 	if lister := newToolLister("tok"); lister == nil {
 		t.Fatal("newToolLister returned nil")
 	}
 }

 func TestRunRecordsSourceRevision(t *testing.T) {
-	stubDeps(t, "env-token", nil, nil, &fakeLister{}, testRegistryRefs)
+	stubDeps(t, "env-token", nil, nil, &fakeLister{}, testRegistryJSON)
 	dir := t.TempDir()
 	head := filepath.Join(dir, "HEAD")
 	if err := os.WriteFile(head, []byte("ref: refs/heads/feature\n"), 0o600); err != nil {
@@ -17,23 +17,18 @@
 package main

 import (
-	"bytes"
 	"encoding/json"
 	"flag"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
-	"strings"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/app"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/interfacesnapshot"
-	"github.com/spf13/cobra"
 )

-var newRootCommand = func() *cobra.Command { return app.NewRootCommand() }
-
 func main() {
 	os.Exit(run(os.Args[1:], os.Stdout, os.Stderr))
 }
@@ -117,11 +112,7 @@ func runGenerate(args []string, stdout, stderr io.Writer) error {
 	defer i18n.SetLang(previousLang)
 	i18n.SetLang("en")

-	root := newRootCommand()
-	snapshot := interfacesnapshot.Capture(root)
-	if err := validateHelpRendering(root, snapshot); err != nil {
-		return err
-	}
+	snapshot := interfacesnapshot.Capture(app.NewRootCommand())
 	if *output == "-" {
 		return interfacesnapshot.Write(stdout, snapshot)
 	}
@@ -147,26 +138,6 @@ func runCompare(args []string, stdout, stderr io.Writer) (bool, error) {
 	currentPath := flags.String("current", "", "candidate snapshot path")
 	basePath := flags.String("base", "", "target main/development baseline snapshot path")
 	stablePath := flags.String("stable", "", "latest stable GA snapshot path")
-	approvedMigrationsPath := flags.String(
-		"approved-flag-migrations",
-		"",
-		"merge-base-owned approved flag migration manifest",
-	)
-	candidateMigrationsPath := flags.String(
-		"candidate-flag-migrations",
-		"",
-		"candidate flag migration manifest",
-	)
-	approvedCommandMigrationsPath := flags.String(
-		"approved-command-migrations",
-		"",
-		"merge-base-owned approved command migration manifest",
-	)
-	candidateCommandMigrationsPath := flags.String(
-		"candidate-command-migrations",
-		"",
-		"candidate command migration manifest",
-	)
 	if err := flags.Parse(args); err != nil {
 		return false, err
 	}
@@ -179,19 +150,6 @@ func runCompare(args []string, stdout, stderr io.Writer) (bool, error) {
 	if *basePath == "" && *stablePath == "" {
 		return false, fmt.Errorf("compare requires --base, --stable, or both")
 	}
-	if (*approvedMigrationsPath == "") != (*candidateMigrationsPath == "") {
-		return false, fmt.Errorf(
-			"--approved-flag-migrations and --candidate-flag-migrations must be provided together",
-		)
-	}
-	if (*approvedCommandMigrationsPath == "") != (*candidateCommandMigrationsPath == "") {
-		return false, fmt.Errorf(
-			"--approved-command-migrations and --candidate-command-migrations must be provided together",
-		)
-	}
-	if (*approvedMigrationsPath != "" || *approvedCommandMigrationsPath != "") && (*basePath == "" || *stablePath == "") {
-		return false, fmt.Errorf("migration compare requires both --base and --stable")
-	}

 	current, err := readSnapshot(*currentPath)
 	if err != nil {
@@ -212,57 +170,6 @@ func runCompare(args []string, stdout, stderr io.Writer) (bool, error) {
 	}

 	report := interfacesnapshot.CompareAll(current, references)
-	if *approvedCommandMigrationsPath != "" {
-		flagApproved := interfacesnapshot.FlagMigrationManifest{Version: interfacesnapshot.FlagMigrationManifestVersion, Migrations: []interfacesnapshot.FlagMigration{}}
-		flagCandidate := flagApproved
-		if *approvedMigrationsPath != "" {
-			flagApproved, err = readFlagMigrationManifest(*approvedMigrationsPath)
-			if err != nil {
-				return false, fmt.Errorf("read approved flag migrations: %w", err)
-			}
-			flagCandidate, err = readFlagMigrationManifest(*candidateMigrationsPath)
-			if err != nil {
-				return false, fmt.Errorf("read candidate flag migrations: %w", err)
-			}
-		}
-		commandApproved, readErr := readCommandMigrationManifest(*approvedCommandMigrationsPath)
-		if readErr != nil {
-			return false, fmt.Errorf("read approved command migrations: %w", readErr)
-		}
-		commandCandidate, readErr := readCommandMigrationManifest(*candidateCommandMigrationsPath)
-		if readErr != nil {
-			return false, fmt.Errorf("read candidate command migrations: %w", readErr)
-		}
-		report, err = interfacesnapshot.CompareAllWithInterfaceMigrations(
-			current,
-			references,
-			flagApproved,
-			flagCandidate,
-			commandApproved,
-			commandCandidate,
-		)
-		if err != nil {
-			return false, fmt.Errorf("validate interface migration lifecycle: %w", err)
-		}
-	} else if *approvedMigrationsPath != "" {
-		approved, readErr := readFlagMigrationManifest(*approvedMigrationsPath)
-		if readErr != nil {
-			return false, fmt.Errorf("read approved flag migrations: %w", readErr)
-		}
-		candidate, readErr := readFlagMigrationManifest(*candidateMigrationsPath)
-		if readErr != nil {
-			return false, fmt.Errorf("read candidate flag migrations: %w", readErr)
-		}
-		report, err = interfacesnapshot.CompareAllWithFlagMigrations(
-			current,
-			references,
-			approved,
-			candidate,
-		)
-		if err != nil {
-			return false, fmt.Errorf("validate flag migration lifecycle: %w", err)
-		}
-	}
 	encoder := json.NewEncoder(stdout)
 	encoder.SetEscapeHTML(false)
 	encoder.SetIndent("", "  ")
@@ -272,58 +179,6 @@ func runCompare(args []string, stdout, stderr io.Writer) (bool, error) {
 	return report.Compatible, nil
 }

-func readFlagMigrationManifest(path string) (interfacesnapshot.FlagMigrationManifest, error) {
-	file, err := os.Open(filepath.Clean(path))
-	if err != nil {
-		return interfacesnapshot.FlagMigrationManifest{}, err
-	}
-	defer file.Close()
-	return interfacesnapshot.ReadFlagMigrationManifest(file)
-}
-
-func readCommandMigrationManifest(path string) (interfacesnapshot.CommandMigrationManifest, error) {
-	file, err := os.Open(filepath.Clean(path))
-	if err != nil {
-		return interfacesnapshot.CommandMigrationManifest{}, err
-	}
-	defer file.Close()
-	return interfacesnapshot.ReadCommandMigrationManifest(file)
-}
-
-func validateHelpRendering(root *cobra.Command, snapshot interfacesnapshot.Snapshot) error {
-	for _, command := range snapshot.Commands {
-		path := strings.TrimPrefix(command.Path, "dws")
-		resolved, remaining, err := root.Find(strings.Fields(path))
-		if err != nil || len(remaining) != 0 || resolved == nil {
-			return fmt.Errorf("resolve %q before help rendering: remaining=%v error=%v", command.Path, remaining, err)
-		}
-		if err := renderCommandHelp(resolved); err != nil {
-			return fmt.Errorf("render %q help: %w", command.Path, err)
-		}
-	}
-	return nil
-}
-
-func renderCommandHelp(command *cobra.Command) (err error) {
-	var stdout, stderr bytes.Buffer
-	command.InitDefaultHelpFlag()
-	command.SetOut(&stdout)
-	command.SetErr(&stderr)
-	defer func() {
-		if recovered := recover(); recovered != nil {
-			err = fmt.Errorf("help renderer panicked: %v", recovered)
-		}
-	}()
-	command.HelpFunc()(command, []string{})
-	if stderr.Len() > 0 {
-		return fmt.Errorf("help renderer wrote an error: %s", strings.TrimSpace(stderr.String()))
-	}
-	if stdout.Len() == 0 {
-		return fmt.Errorf("help renderer produced empty output")
-	}
-	return nil
-}
-
 func readSnapshot(path string) (interfacesnapshot.Snapshot, error) {
 	file, err := os.Open(filepath.Clean(path))
 	if err != nil {
@@ -336,5 +191,5 @@ func readSnapshot(path string) (interfacesnapshot.Snapshot, error) {
 func printUsage(w io.Writer) {
 	fmt.Fprintln(w, "usage:")
 	fmt.Fprintln(w, "  interface-snapshot generate [--output FILE]")
-	fmt.Fprintln(w, "  interface-snapshot compare --current FILE [--base FILE] [--stable FILE] [--approved-flag-migrations FILE --candidate-flag-migrations FILE] [--approved-command-migrations FILE --candidate-command-migrations FILE]")
+	fmt.Fprintln(w, "  interface-snapshot compare --current FILE [--base FILE] [--stable FILE]")
 }
@@ -15,16 +15,11 @@ package main

 import (
 	"bytes"
-	"errors"
-	"io"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/interfacesnapshot"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
-	"github.com/spf13/cobra"
 )

 func TestCrossPlatformCoverageRunGenerateCapturesActualRootOffline(t *testing.T) {
@@ -61,24 +56,6 @@ func TestCrossPlatformCoverageRunGenerateCapturesActualRootOffline(t *testing.T)
 	}
 }

-func TestCrossPlatformCoverageRunGenerateRejectsHelpRenderingFailure(t *testing.T) {
-	testseam.Swap(t, &newRootCommand, func() *cobra.Command {
-		root := &cobra.Command{Use: "dws"}
-		root.SetHelpFunc(func(command *cobra.Command, _ []string) {
-			_, _ = io.WriteString(command.ErrOrStderr(), "injected help failure")
-		})
-		return root
-	})
-
-	var stdout, stderr bytes.Buffer
-	if exitCode := run([]string{"generate"}, &stdout, &stderr); exitCode != 2 {
-		t.Fatalf("run(generate) exit=%d stderr=%s", exitCode, stderr.String())
-	}
-	if !strings.Contains(stderr.String(), "injected help failure") {
-		t.Fatalf("run(generate) stderr=%q", stderr.String())
-	}
-}
-
 func TestCrossPlatformCoverageRunCompareUsesBothSnapshotInputsAndExitCode(t *testing.T) {
 	current := commandSnapshot("dws")
 	mergeBase := commandSnapshot("dws")
@@ -106,464 +83,6 @@ func TestCrossPlatformCoverageRunCompareUsesBothSnapshotInputsAndExitCode(t *tes
 	}
 }

-func TestCrossPlatformCoverageRunCompareEnforcesBaseOwnedFlagMigrationLifecycle(t *testing.T) {
-	dir := t.TempDir()
-	before := flagMigrationSnapshot(false)
-	after := flagMigrationSnapshot(true)
-	currentPath := writeSnapshot(t, dir, "current.json", after)
-	basePath := writeSnapshot(t, dir, "base.json", before)
-	stablePath := writeSnapshot(t, dir, "stable.json", before)
-	approvedPath := writeManifest(t, dir, "approved.json", flagMigrationManifestJSON("pending"))
-	candidatePath := writeManifest(t, dir, "candidate.json", flagMigrationManifestJSON("consumed"))
-
-	var stdout, stderr bytes.Buffer
-	exitCode := run([]string{
-		"compare",
-		"--current", currentPath,
-		"--base", basePath,
-		"--stable", stablePath,
-		"--approved-flag-migrations", approvedPath,
-		"--candidate-flag-migrations", candidatePath,
-	}, &stdout, &stderr)
-	if exitCode != 0 {
-		t.Fatalf("exact base-owned migration exit=%d stderr=%s", exitCode, stderr.String())
-	}
-	if !bytes.Contains(stdout.Bytes(), []byte(`"compatible": true`)) {
-		t.Fatalf("exact migration report is not compatible:\n%s", stdout.String())
-	}
-
-	stdout.Reset()
-	stderr.Reset()
-	emptyApproved := writeManifest(t, dir, "empty-approved.json", `{"version":1,"migrations":[]}`)
-	exitCode = run([]string{
-		"compare",
-		"--current", currentPath,
-		"--base", basePath,
-		"--stable", stablePath,
-		"--approved-flag-migrations", emptyApproved,
-		"--candidate-flag-migrations", candidatePath,
-	}, &stdout, &stderr)
-	if exitCode != 2 || !strings.Contains(stderr.String(), "must start pending") {
-		t.Fatalf("candidate self-approval exit=%d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageRunCompareRequiresBothFlagMigrationInputs(t *testing.T) {
-	dir := t.TempDir()
-	currentPath := writeSnapshot(t, dir, "current.json", commandSnapshot("dws"))
-	basePath := writeSnapshot(t, dir, "base.json", commandSnapshot("dws"))
-	approvedPath := writeManifest(t, dir, "approved.json", `{"version":1,"migrations":[]}`)
-
-	var stdout, stderr bytes.Buffer
-	exitCode := run([]string{
-		"compare",
-		"--current", currentPath,
-		"--base", basePath,
-		"--approved-flag-migrations", approvedPath,
-	}, &stdout, &stderr)
-	if exitCode != 2 || !strings.Contains(stderr.String(), "must be provided together") {
-		t.Fatalf("one-sided migration input exit=%d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageRunCompareCommandMigrationInputs(t *testing.T) {
-	dir := t.TempDir()
-	snapshotPath := writeSnapshot(t, dir, "snapshot.json", commandSnapshot("dws"))
-	emptyFlag := writeManifest(t, dir, "empty-flags.json", `{"version":1,"migrations":[]}`)
-	emptyCommand := writeManifest(t, dir, "empty-commands.json", `{"version":1,"migrations":[]}`)
-	invalid := writeManifest(t, dir, "invalid-commands.json", `{`)
-
-	var stdout, stderr bytes.Buffer
-	args := []string{
-		"compare",
-		"--current", snapshotPath,
-		"--base", snapshotPath,
-		"--stable", snapshotPath,
-		"--approved-flag-migrations", emptyFlag,
-		"--candidate-flag-migrations", emptyFlag,
-		"--approved-command-migrations", emptyCommand,
-		"--candidate-command-migrations", emptyCommand,
-	}
-	if exitCode := run(args, &stdout, &stderr); exitCode != 0 {
-		t.Fatalf("combined migration compare exit=%d stderr=%s", exitCode, stderr.String())
-	}
-	for _, test := range []struct {
-		name      string
-		approved  string
-		candidate string
-		want      string
-	}{
-		{"approved flag", invalid, emptyFlag, "read approved flag migrations"},
-		{"candidate flag", emptyFlag, invalid, "read candidate flag migrations"},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			stdout.Reset()
-			stderr.Reset()
-			testArgs := []string{
-				"compare", "--current", snapshotPath, "--base", snapshotPath, "--stable", snapshotPath,
-				"--approved-flag-migrations", test.approved,
-				"--candidate-flag-migrations", test.candidate,
-				"--approved-command-migrations", emptyCommand,
-				"--candidate-command-migrations", emptyCommand,
-			}
-			if exitCode := run(testArgs, &stdout, &stderr); exitCode != 2 || !strings.Contains(stderr.String(), test.want) {
-				t.Fatalf("combined flag error exit=%d stderr=%s", exitCode, stderr.String())
-			}
-		})
-	}
-
-	for _, test := range []struct {
-		name      string
-		approved  string
-		candidate string
-		want      string
-	}{
-		{"approved", invalid, emptyCommand, "read approved command migrations"},
-		{"candidate", emptyCommand, invalid, "read candidate command migrations"},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			stdout.Reset()
-			stderr.Reset()
-			testArgs := []string{
-				"compare", "--current", snapshotPath, "--base", snapshotPath, "--stable", snapshotPath,
-				"--approved-command-migrations", test.approved,
-				"--candidate-command-migrations", test.candidate,
-			}
-			if exitCode := run(testArgs, &stdout, &stderr); exitCode != 2 || !strings.Contains(stderr.String(), test.want) {
-				t.Fatalf("command manifest error exit=%d stderr=%s", exitCode, stderr.String())
-			}
-		})
-	}
-
-	stderr.Reset()
-	if exitCode := run([]string{
-		"compare", "--current", snapshotPath, "--base", snapshotPath,
-		"--approved-command-migrations", emptyCommand,
-	}, &stdout, &stderr); exitCode != 2 || !strings.Contains(stderr.String(), "provided together") {
-		t.Fatalf("one-sided command manifest exit=%d stderr=%s", exitCode, stderr.String())
-	}
-
-	if _, err := readCommandMigrationManifest(filepath.Join(dir, "missing.json")); err == nil {
-		t.Fatal("missing command migration manifest unexpectedly read")
-	}
-	if _, err := readCommandMigrationManifest(invalid); err == nil {
-		t.Fatal("invalid command migration manifest unexpectedly read")
-	}
-
-	pending := writeManifest(t, dir, "pending-command.json", commandMigrationManifestJSON("pending"))
-	consumed := writeManifest(t, dir, "consumed-command.json", commandMigrationManifestJSON("consumed"))
-	stderr.Reset()
-	if exitCode := run([]string{
-		"compare", "--current", snapshotPath, "--base", snapshotPath, "--stable", snapshotPath,
-		"--approved-command-migrations", pending,
-		"--candidate-command-migrations", consumed,
-	}, &stdout, &stderr); exitCode != 2 || !strings.Contains(stderr.String(), "validate interface migration lifecycle") {
-		t.Fatalf("command lifecycle error exit=%d stderr=%s", exitCode, stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageRunCompareRequiresBothReferencesForFlagMigrations(t *testing.T) {
-	dir := t.TempDir()
-	currentPath := writeSnapshot(t, dir, "current.json", commandSnapshot("dws"))
-	basePath := writeSnapshot(t, dir, "base.json", commandSnapshot("dws"))
-	stablePath := writeSnapshot(t, dir, "stable.json", commandSnapshot("dws"))
-	approvedPath := writeManifest(t, dir, "approved.json", `{"version":1,"migrations":[]}`)
-	candidatePath := writeManifest(t, dir, "candidate.json", `{"version":1,"migrations":[]}`)
-
-	tests := []struct {
-		name string
-		args []string
-	}{
-		{
-			name: "missing stable",
-			args: []string{"--base", basePath},
-		},
-		{
-			name: "missing base",
-			args: []string{"--stable", stablePath},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			args := []string{"compare", "--current", currentPath}
-			args = append(args, test.args...)
-			args = append(args,
-				"--approved-flag-migrations", approvedPath,
-				"--candidate-flag-migrations", candidatePath,
-			)
-			var stdout, stderr bytes.Buffer
-			exitCode := run(args, &stdout, &stderr)
-			if exitCode != 2 || !strings.Contains(stderr.String(), "requires both --base and --stable") {
-				t.Fatalf("one-reference migration compare exit=%d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageRunPrintsUsageForMissingAndUnknownCommands(t *testing.T) {
-	tests := []struct {
-		name       string
-		args       []string
-		wantStderr []string
-	}{
-		{
-			name:       "missing command",
-			args:       nil,
-			wantStderr: []string{"usage:", "interface-snapshot generate", "--approved-flag-migrations"},
-		},
-		{
-			name:       "unknown command",
-			args:       []string{"unknown"},
-			wantStderr: []string{`unknown command "unknown"`, "usage:", "interface-snapshot compare"},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			var stdout, stderr bytes.Buffer
-			if exitCode := run(test.args, &stdout, &stderr); exitCode != 2 {
-				t.Fatalf("run(%v) exit=%d, want 2", test.args, exitCode)
-			}
-			if stdout.Len() != 0 {
-				t.Fatalf("run(%v) unexpectedly wrote stdout: %s", test.args, stdout.String())
-			}
-			for _, want := range test.wantStderr {
-				if !strings.Contains(stderr.String(), want) {
-					t.Errorf("run(%v) stderr missing %q:\n%s", test.args, want, stderr.String())
-				}
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageRunRejectsInvalidSubcommandArguments(t *testing.T) {
-	tests := []struct {
-		name string
-		args []string
-		want string
-	}{
-		{name: "generate unknown flag", args: []string{"generate", "--unknown"}, want: "flag provided but not defined"},
-		{name: "generate positional", args: []string{"generate", "unexpected"}, want: "generate accepts no positional arguments"},
-		{name: "compare unknown flag", args: []string{"compare", "--unknown"}, want: "flag provided but not defined"},
-		{name: "compare positional", args: []string{"compare", "unexpected"}, want: "compare accepts no positional arguments"},
-		{name: "compare missing current", args: []string{"compare", "--base", "base.json"}, want: "compare requires --current"},
-		{name: "compare missing reference", args: []string{"compare", "--current", "current.json"}, want: "compare requires --base, --stable, or both"},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			var stdout, stderr bytes.Buffer
-			if exitCode := run(test.args, &stdout, &stderr); exitCode != 2 {
-				t.Fatalf("run(%v) exit=%d, want 2", test.args, exitCode)
-			}
-			if !strings.Contains(stderr.String(), test.want) {
-				t.Fatalf("run(%v) stderr missing %q:\n%s", test.args, test.want, stderr.String())
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageRunGenerateRejectsUnsafeOutputPath(t *testing.T) {
-	outputDirectory := t.TempDir()
-	var stdout, stderr bytes.Buffer
-	exitCode := run([]string{"generate", "--output", outputDirectory}, &stdout, &stderr)
-	if exitCode != 2 || !strings.Contains(stderr.String(), "create snapshot") {
-		t.Fatalf("directory output exit=%d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageRunGenerateReportsTemporaryDirectoryFailure(t *testing.T) {
-	missingTempRoot := filepath.Join(t.TempDir(), "missing")
-	for _, name := range []string{"TMPDIR", "TMP", "TEMP"} {
-		t.Setenv(name, missingTempRoot)
-	}
-
-	var stdout, stderr bytes.Buffer
-	exitCode := run([]string{"generate"}, &stdout, &stderr)
-	if exitCode != 2 || !strings.Contains(stderr.String(), "create isolated home") {
-		t.Fatalf("invalid temporary root exit=%d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageRunCompareReportsSnapshotReadFailures(t *testing.T) {
-	dir := t.TempDir()
-	validPath := writeSnapshot(t, dir, "valid.json", commandSnapshot("dws"))
-	missingPath := filepath.Join(dir, "missing.json")
-	tests := []struct {
-		name string
-		args []string
-		want string
-	}{
-		{
-			name: "current",
-			args: []string{"compare", "--current", missingPath, "--base", validPath},
-			want: "read current snapshot",
-		},
-		{
-			name: "main",
-			args: []string{"compare", "--current", validPath, "--base", missingPath},
-			want: "read main/development baseline snapshot",
-		},
-		{
-			name: "stable",
-			args: []string{"compare", "--current", validPath, "--stable", missingPath},
-			want: "read stable snapshot",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			var stdout, stderr bytes.Buffer
-			if exitCode := run(test.args, &stdout, &stderr); exitCode != 2 {
-				t.Fatalf("run(compare) exit=%d, want 2", exitCode)
-			}
-			if !strings.Contains(stderr.String(), test.want) {
-				t.Fatalf("stderr missing %q:\n%s", test.want, stderr.String())
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageRunCompareReportsEachManifestReadFailure(t *testing.T) {
-	dir := t.TempDir()
-	snapshotPath := writeSnapshot(t, dir, "snapshot.json", commandSnapshot("dws"))
-	validManifest := writeManifest(t, dir, "valid-manifest.json", `{"version":1,"migrations":[]}`)
-	invalidManifest := writeManifest(t, dir, "invalid-manifest.json", `{`)
-	tests := []struct {
-		name      string
-		approved  string
-		candidate string
-		want      string
-	}{
-		{
-			name:      "approved manifest",
-			approved:  invalidManifest,
-			candidate: validManifest,
-			want:      "read approved flag migrations",
-		},
-		{
-			name:      "candidate manifest",
-			approved:  validManifest,
-			candidate: invalidManifest,
-			want:      "read candidate flag migrations",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			var stdout, stderr bytes.Buffer
-			exitCode := run([]string{
-				"compare",
-				"--current", snapshotPath,
-				"--base", snapshotPath,
-				"--stable", snapshotPath,
-				"--approved-flag-migrations", test.approved,
-				"--candidate-flag-migrations", test.candidate,
-			}, &stdout, &stderr)
-			if exitCode != 2 || !strings.Contains(stderr.String(), test.want) {
-				t.Fatalf("%s exit=%d stdout=%s stderr=%s", test.name, exitCode, stdout.String(), stderr.String())
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageRunCompareReportsOutputFailure(t *testing.T) {
-	dir := t.TempDir()
-	snapshotPath := writeSnapshot(t, dir, "snapshot.json", commandSnapshot("dws"))
-	var stderr bytes.Buffer
-	exitCode := run([]string{
-		"compare",
-		"--current", snapshotPath,
-		"--base", snapshotPath,
-	}, failingWriter{}, &stderr)
-	if exitCode != 2 || !strings.Contains(stderr.String(), "write comparison report") {
-		t.Fatalf("comparison output failure exit=%d stderr=%s", exitCode, stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageReadHelpersRejectMissingAndInvalidInputs(t *testing.T) {
-	dir := t.TempDir()
-	missingPath := filepath.Join(dir, "missing.json")
-	invalidPath := filepath.Join(dir, "invalid.json")
-	if err := os.WriteFile(invalidPath, []byte(`{`), 0o600); err != nil {
-		t.Fatalf("write invalid fixture: %v", err)
-	}
-
-	if _, err := readSnapshot(missingPath); err == nil {
-		t.Fatal("readSnapshot(missing) unexpectedly succeeded")
-	}
-	if _, err := readSnapshot(invalidPath); err == nil {
-		t.Fatal("readSnapshot(invalid) unexpectedly succeeded")
-	}
-	if _, err := readFlagMigrationManifest(missingPath); err == nil {
-		t.Fatal("readFlagMigrationManifest(missing) unexpectedly succeeded")
-	}
-	if _, err := readFlagMigrationManifest(invalidPath); err == nil {
-		t.Fatal("readFlagMigrationManifest(invalid) unexpectedly succeeded")
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingReportsResolveError(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	err := validateHelpRendering(root, commandSnapshot("dws missing"))
-	if err == nil || !strings.Contains(err.Error(), `resolve "dws missing" before help rendering`) {
-		t.Fatalf("validateHelpRendering resolve error = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingReportsTemplateError(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	root.SetHelpTemplate(`{{index .Commands 99}}`)
-	err := validateHelpRendering(root, commandSnapshot("dws"))
-	if err == nil || !strings.Contains(err.Error(), `render "dws" help`) {
-		t.Fatalf("validateHelpRendering template error = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingRecoversTemplatePanic(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	root.SetHelpTemplate("{{")
-	err := validateHelpRendering(root, commandSnapshot("dws"))
-	if err == nil || !strings.Contains(err.Error(), `render "dws" help`) {
-		t.Fatalf("validateHelpRendering template panic = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingRejectsCustomHelpStderr(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	root.SetHelpFunc(func(command *cobra.Command, _ []string) {
-		_, _ = io.WriteString(command.ErrOrStderr(), "injected help failure")
-	})
-	err := validateHelpRendering(root, commandSnapshot("dws"))
-	if err == nil || !strings.Contains(err.Error(), "injected help failure") {
-		t.Fatalf("validateHelpRendering custom stderr = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingRejectsEmptyOutput(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	root.SetHelpFunc(func(*cobra.Command, []string) {})
-	err := validateHelpRendering(root, commandSnapshot("dws"))
-	if err == nil || !strings.Contains(err.Error(), "empty") {
-		t.Fatalf("validateHelpRendering empty output = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingAcceptsNormalOutput(t *testing.T) {
-	root := &cobra.Command{Use: "dws", Short: "root command"}
-	if err := validateHelpRendering(root, commandSnapshot("dws")); err != nil {
-		t.Fatalf("validateHelpRendering normal output: %v", err)
-	}
-}
-
-type failingWriter struct{}
-
-func (failingWriter) Write([]byte) (int, error) {
-	return 0, errors.New("injected write failure")
-}
-
-var _ io.Writer = failingWriter{}
-
 func commandSnapshot(paths ...string) interfacesnapshot.Snapshot {
 	commands := make([]interfacesnapshot.Command, 0, len(paths))
 	for _, path := range paths {
@@ -601,95 +120,6 @@ func writeSnapshot(t *testing.T, dir, name string, snapshot interfacesnapshot.Sn
 	return path
 }

-func writeManifest(t *testing.T, dir, name, contents string) string {
-	t.Helper()
-	path := filepath.Join(dir, name)
-	if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
-		t.Fatalf("write %s: %v", path, err)
-	}
-	return path
-}
-
-func flagMigrationSnapshot(after bool) interfacesnapshot.Snapshot {
-	legacy := interfacesnapshot.Flag{
-		Name:      "legacy-id",
-		Shorthand: "l",
-		Type:      "string",
-		Default:   "",
-		NoOpt:     "auto",
-		Required:  true,
-	}
-	flags := []interfacesnapshot.Flag{legacy}
-	if after {
-		legacy.Required = false
-		legacy.Hidden = true
-		legacy.AliasOf = "message-id"
-		flags = []interfacesnapshot.Flag{
-			legacy,
-			{Name: "message-id", Type: "string", Default: "", Required: true},
-		}
-	}
-	return interfacesnapshot.Snapshot{
-		SchemaVersion: interfacesnapshot.SchemaVersion,
-		Rules: interfacesnapshot.Rules{
-			ExcludedCommandSubtrees: []string{},
-			ExcludedFlags:           []string{},
-		},
-		Commands: []interfacesnapshot.Command{
-			{Path: "dws", Runnable: true, Aliases: []string{}, LocalFlags: []interfacesnapshot.Flag{}, InheritedFlags: []interfacesnapshot.Flag{}},
-			{Path: "dws chat send", Runnable: true, Aliases: []string{}, LocalFlags: flags, InheritedFlags: []interfacesnapshot.Flag{}},
-		},
-	}
-}
-
-func flagMigrationManifestJSON(state string) string {
-	return strings.Replace(`{
-  "version": 1,
-  "migrations": [{
-    "command": "dws chat send",
-    "legacy": {
-      "name": "legacy-id",
-      "before": {"present": true, "type": "string", "required": true, "shorthand": "l", "no_opt": "auto", "scope": "local"},
-      "after": {"present": true, "type": "string", "hidden": true, "shorthand": "l", "no_opt": "auto", "scope": "local", "alias_of": "message-id"}
-    },
-    "canonical": {
-      "name": "message-id",
-      "before": {"present": false},
-      "after": {"present": true, "type": "string", "required": true, "scope": "local"}
-    },
-    "state": "STATE",
-    "reason": "reviewed exact migration"
-  }]
-}`, "STATE", state, 1)
-}
-
-func commandMigrationManifestJSON(state string) string {
-	return strings.Replace(`{
-  "version": 1,
-  "migrations": [{
-    "kind": "command_move",
-    "legacy": {
-      "command": "dws chat message old",
-      "before": {"present": true, "runnable": true},
-      "after": {"present": true, "runnable": true, "hidden": true}
-    },
-    "replacement": {
-      "command": "dws chat topic new",
-      "before": {"present": false},
-      "after": {"present": true, "runnable": true}
-    },
-    "schema": {
-      "product_id": "chat",
-      "source_tool_id": "chat.move",
-      "replacement_tool_id": "chat.move",
-      "parameters": []
-    },
-    "state": "STATE",
-    "reason": "reviewed command migration"
-  }]
-}`, "STATE", state, 1)
-}
-
 func hasFlag(flags []interfacesnapshot.Flag, name, flagType string) bool {
 	for _, flag := range flags {
 		if flag.Name == name && flag.Type == flagType {
@@ -15,76 +15,12 @@ package main

 import (
 	"os"
-	"strings"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/app"
-	"gitlab.alibaba-inc.com/aes/aem-go-sdk/clitrack"
 )

-var (
-	appExecute               = app.ExecuteWithTelemetry
-	resolveTelemetryIdentity = app.ResolveTelemetryIdentity
-	trackRun                 = func(cfg clitrack.Config, execute func() error, exitCode func(error) int) {
-		clitrack.New(cfg).Run(execute, exitCode)
-	}
-)
-
-// trackedExitError tells clitrack that the command failed without asking it to
-// print the error a second time. The already-rendered message is published via
-// ExtraFields c5, while app.Execute remains the sole owner of presentation.
-type trackedExitError struct{}
-
-func (trackedExitError) Error() string { return "" }
-
-func trackerConfig(identity app.TelemetryIdentity, commandPath, errorMessage *string) clitrack.Config {
-	return clitrack.Config{
-		PID:                   "wcCRwZ",
-		App:                   "dws",
-		Version:               app.RawVersion(),
-		UID:                   identity.UserID,
-		Username:              identity.UserName,
-		NoCommandLine:         true,
-		NoCwd:                 true,
-		NoAutomaticDimensions: true,
-		ExtraFields: func() map[string]string {
-			fields := map[string]string{"c9": *commandPath}
-			if identity.CorpID != "" {
-				fields["c10"] = identity.CorpID
-			}
-			if *errorMessage != "" {
-				fields["c5"] = *errorMessage
-			}
-			return fields
-		},
-	}
-}
-
-func telemetryOptedOut() bool {
-	return strings.TrimSpace(os.Getenv("DO_NOT_TRACK")) != ""
-}
+var exit = os.Exit

 func main() {
-	optedOut := telemetryOptedOut()
-	identity := app.TelemetryIdentity{}
-	if !optedOut {
-		identity = resolveTelemetryIdentity(os.Args[1:])
-	}
-	exitCode := 0
-	commandPath := "dws"
-	errorMessage := ""
-	cfg := trackerConfig(identity, &commandPath, &errorMessage)
-	if optedOut {
-		cfg.PID = ""
-	}
-	trackRun(
-		cfg,
-		func() error {
-			exitCode, commandPath, errorMessage = appExecute()
-			if exitCode != 0 {
-				return trackedExitError{}
-			}
-			return nil
-		},
-		func(error) int { return exitCode },
-	)
+	exit(app.Execute())
 }
@@ -1,220 +1,27 @@
 package main

 import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
 	"os"
-	"slices"
-	"sort"
-	"strings"
 	"testing"
-	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/app"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
-	"gitlab.alibaba-inc.com/aes/aem-go-sdk/clitrack"
 )

-func TestCrossPlatformCoverageMainRunsThroughCLITracker(t *testing.T) {
-	for _, wantCode := range []int{0, 1, 3, 5} {
-		t.Run(fmt.Sprintf("exit_%d", wantCode), func(t *testing.T) {
-			t.Setenv("DO_NOT_TRACK", "")
-			wantError := ""
-			if wantCode != 0 {
-				wantError = "synthetic failure"
-			}
-			testseam.Swap(t, &os.Args, []string{"dws", "sheet", "read", "--profile", "corp-a"})
-			testseam.Swap(t, &resolveTelemetryIdentity, func(args []string) app.TelemetryIdentity {
-				if strings.Join(args, " ") != "sheet read --profile corp-a" {
-					t.Fatalf("telemetry identity args = %#v", args)
-				}
-				return app.TelemetryIdentity{UserID: "user-1", UserName: "Alice", CorpID: "corp-1"}
-			})
-			testseam.Swap(t, &appExecute, func() (int, string, string) { return wantCode, "sheet read", wantError })
-			called := false
-			testseam.Swap(t, &trackRun, func(cfg clitrack.Config, execute func() error, exitCode func(error) int) {
-				called = true
-				if cfg.PID != "wcCRwZ" || cfg.App != "dws" {
-					t.Fatalf("tracker identity = PID %q App %q", cfg.PID, cfg.App)
-				}
-				if cfg.Version != app.RawVersion() {
-					t.Fatalf("tracker Version = %q, want %q", cfg.Version, app.RawVersion())
-				}
-				if !cfg.NoCommandLine || !cfg.NoCwd || !cfg.NoAutomaticDimensions || cfg.CaptureOutput {
-					t.Fatalf("tracker privacy config = NoCommandLine %v NoCwd %v NoAutomaticDimensions %v CaptureOutput %v", cfg.NoCommandLine, cfg.NoCwd, cfg.NoAutomaticDimensions, cfg.CaptureOutput)
-				}
-				if cfg.Env != "" || cfg.EventID != "" || cfg.Endpoint != "" || cfg.FlushTimeout != 0 || cfg.OutputMaxLen != 0 {
-					t.Fatalf("tracker SDK defaults were overridden: %#v", cfg)
-				}
-				if cfg.UID != "user-1" || cfg.Username != "Alice" || cfg.UserType != "" {
-					t.Fatalf("tracker user identity = UID %q Username %q UserType %q", cfg.UID, cfg.Username, cfg.UserType)
-				}
+func TestCrossPlatformCoverageMainExitsWithSuccessfulVersionCommand(t *testing.T) {
+	previousExit := exit
+	previousArgs := os.Args
+	t.Cleanup(func() {
+		exit = previousExit
+		os.Args = previousArgs
+	})

-				err := execute()
-				if wantCode == 0 && err != nil {
-					t.Fatalf("successful tracked execute error = %v", err)
-				}
-				if wantCode != 0 && (err == nil || err.Error() != "") {
-					t.Fatalf("failed tracked execute error = %#v, want empty sentinel", err)
-				}
-				if gotCode := exitCode(err); gotCode != wantCode {
-					t.Fatalf("tracked exit code = %d, want %d", gotCode, wantCode)
-				}
-				fields := cfg.ExtraFields()
-				if fields["c9"] != "sheet read" || fields["c10"] != "corp-1" || fields["c5"] != wantError {
-					t.Fatalf("tracker extra fields = %#v, want command path, corp ID, and error %q", fields, wantError)
-				}
-				if (wantError == "" && len(fields) != 2) || (wantError != "" && len(fields) != 3) {
-					t.Fatalf("tracker extra field count = %d for error %q", len(fields), wantError)
-				}
-			})
-
-			main()
-			if !called {
-				t.Fatalf("trackRun was not called for exit code %d", wantCode)
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageTrackerConfigOmitsEmptyOrganization(t *testing.T) {
-	commandPath := "version"
-	errorMessage := ""
-	cfg := trackerConfig(app.TelemetryIdentity{}, &commandPath, &errorMessage)
-	if cfg.UID != "" {
-		t.Fatalf("empty identity UID = %q", cfg.UID)
-	}
-	if cfg.Username != "" {
-		t.Fatalf("empty identity Username = %q", cfg.Username)
-	}
-	if fields := cfg.ExtraFields(); len(fields) != 1 || fields["c9"] != "version" {
-		t.Fatalf("empty organization fields = %#v", fields)
-	}
-}
-
-func TestCrossPlatformCoverageDefaultTrackRunNoopTracker(t *testing.T) {
 	called := false
-	trackRun(clitrack.Config{}, func() error {
+	code := -1
+	exit = func(value int) {
 		called = true
-		return nil
-	}, nil)
-	if !called {
-		t.Fatal("default tracker did not execute callback")
+		code = value
 	}
-}
-
-func TestCrossPlatformCoverageMainRespectsDoNotTrack(t *testing.T) {
-	t.Setenv("DO_NOT_TRACK", "1")
-	testseam.Swap(t, &os.Args, []string{"dws", "version"})
-	testseam.Swap(t, &resolveTelemetryIdentity, func([]string) app.TelemetryIdentity {
-		t.Fatal("DO_NOT_TRACK must skip telemetry identity reads")
-		return app.TelemetryIdentity{}
-	})
-	testseam.Swap(t, &appExecute, func() (int, string, string) { return 0, "version", "" })
-	testseam.Swap(t, &trackRun, func(cfg clitrack.Config, execute func() error, exitCode func(error) int) {
-		if cfg.PID != "" || cfg.UID != "" || cfg.Username != "" {
-			t.Fatalf("opted-out tracker config = %#v", cfg)
-		}
-		if err := execute(); err != nil {
-			t.Fatalf("opted-out execution failed: %v", err)
-		}
-		if code := exitCode(nil); code != 0 {
-			t.Fatalf("opted-out exit code = %d, want 0", code)
-		}
-	})
-
+	os.Args = []string{"dws", "version"}
 	main()
-}
-
-func TestCrossPlatformCoverageTrackerPayloadUsesReviewedFieldWhitelist(t *testing.T) {
-	testseam.Protect(t, &os.Args)
-	os.Args = []string{"dws", "sheet", "read", "--access-token", "must-not-leak"}
-	t.Setenv("SHELL", "/bin/zsh")
-	t.Setenv("TERM_SESSION_ID", "stable-session")
-	t.Setenv("TMUX_PANE", "%42")
-	t.Setenv("LANG", "zh_CN.UTF-8")
-	t.Setenv("LC_ALL", "zh_CN.UTF-8")
-	t.Chdir(t.TempDir())
-
-	requestBody := make(chan []byte, 1)
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		body, _ := io.ReadAll(req.Body)
-		requestBody <- body
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
-
-	commandPath := "sheet read"
-	errorMessage := ""
-	cfg := trackerConfig(app.TelemetryIdentity{UserID: "user-1", UserName: "Alice", CorpID: "corp-1"}, &commandPath, &errorMessage)
-	cfg.Endpoint = server.URL
-	cfg.FlushTimeout = time.Second
-	clitrack.New(cfg).Run(func() error { return nil }, nil)
-
-	var body []byte
-	select {
-	case body = <-requestBody:
-	case <-time.After(time.Second):
-		t.Fatal("timed out waiting for telemetry request")
-	}
-	var envelope map[string]string
-	if err := json.Unmarshal(body, &envelope); err != nil {
-		t.Fatalf("decode telemetry request %q: %v", body, err)
-	}
-	decoded, err := url.QueryUnescape(envelope["gokey"])
-	if err != nil {
-		t.Fatalf("decode gokey: %v", err)
-	}
-	globalFields, err := url.ParseQuery(decoded)
-	if err != nil {
-		t.Fatalf("parse global telemetry fields: %v", err)
-	}
-	eventFields, err := url.ParseQuery(globalFields.Get("msg"))
-	if err != nil {
-		t.Fatalf("parse event telemetry fields: %v", err)
-	}
-
-	assertTelemetryKeys(t, globalFields, []string{"app_name", "app_version", "env", "msg", "pid", "platform", "uid", "username", "version"})
-	assertTelemetryKeys(t, eventFields, []string{"c1", "c10", "c3", "c4", "c9", "p1", "p4", "ts", "type"})
-	for key, want := range map[string]string{
-		"app_name": "dws", "app_version": app.RawVersion(), "env": "prod", "pid": "wcCRwZ",
-		"platform": "cli", "uid": "user-1", "username": "Alice", "version": app.RawVersion(),
-	} {
-		if got := globalFields.Get(key); got != want {
-			t.Fatalf("global telemetry field %s = %q, want %q", key, got, want)
-		}
-	}
-	for key, want := range map[string]string{
-		"type": "event", "p1": "cli.exec", "p4": "SYS", "c1": "dws", "c3": "0", "c9": "sheet read", "c10": "corp-1",
-	} {
-		if got := eventFields.Get(key); got != want {
-			t.Fatalf("event telemetry field %s = %q, want %q", key, got, want)
-		}
-	}
-	for _, key := range []string{"device_id", "ext", "os", "os_version", "pv_id", "sdk_version", "sid", "timezone_offset"} {
-		if globalFields.Has(key) {
-			t.Fatalf("global telemetry leaked %s: %q", key, decoded)
-		}
-	}
-	for _, key := range []string{"c2", "c5", "c6", "c7", "c8"} {
-		if eventFields.Has(key) {
-			t.Fatalf("event telemetry leaked %s: %q", key, globalFields.Get("msg"))
-		}
-	}
-}
-
-func assertTelemetryKeys(t *testing.T, fields url.Values, want []string) {
-	t.Helper()
-	got := make([]string, 0, len(fields))
-	for key := range fields {
-		got = append(got, key)
-	}
-	sort.Strings(got)
-	if !slices.Equal(got, want) {
-		t.Fatalf("telemetry keys = %v, want %v", got, want)
+	if !called || code != 0 {
+		t.Fatalf("main exit = called %v, code %d", called, code)
 	}
 }
@@ -1,6 +1,6 @@
 # Architecture

-`dws` is a Go CLI with a versioned, static command surface for DingTalk MCP capabilities. Cobra help serves humans; runtime-assembled Schema (`ResolveSchemaBuild`) serves AI agents.
+`dws` is a Go CLI with a versioned, static command surface for DingTalk MCP capabilities. Cobra help serves humans; the embedded Command Catalog serves AI agents.

 ## High-Level Flow

@@ -9,8 +9,8 @@
 3. `internal/helpers` contains the main command handlers for all product surfaces (`dev`, `chat`, `calendar`, `contact`, `aitable`, etc.).
 4. `internal/executor` and `internal/transport` execute MCP JSON-RPC calls; `internal/output` formats responses.
 5. `internal/auth` manages login state, PAT tokens, and agent-code detection.
-6. Schema assembly (`ResolveSchemaBuild`) starts from the reviewed `CommandRegistry`, binds each identity to the exact current Cobra leaf, and then resolves typed constraints, sanitized MCP snapshots, and leaf ContractFinal / ProductDecl into one `SchemaRegistry`. Startup and Schema queries do not call MCP `tools/list`. There is no generate-written Catalog delivery step.
-7. Production Catalog / `ResolveMeta` consume the lazily assembled registry via `RegisterSchemaSourceRoot` → `ResolveSchemaBuild` / `deliverySchemaCatalog` (声明即 Catalog; lazy `sync.Once`). `ResolveMeta` projects Identity/Safety/Selection from that assembly into an in-process map cache — not a committed `schema_catalog/` or `schema_meta_index.*` fixture. Flag-to-interface property delivery is owned by leaf `ParamDecl.Property` (native annotations). `schema_parameter_mapping_ledger.go` holds reviewed `mapping_exclusions` / `removals` (the empty `schema_parameter_bindings.json` audit table is retired). CLI `required` and constraints come from the resolved typed contract, while MCP `required` remains interface-only metadata.
+6. Schema generation starts from the reviewed `CommandRegistry`, binds each identity to the exact current Cobra leaf, and then resolves typed constraints, sanitized MCP snapshots, Agent hints, and Skills into one `SchemaRegistry`. Startup and Schema queries do not call MCP `tools/list`.
+7. The embedded Catalog is a downstream release artifact and never backfills identity or participates in regeneration. Stable flag-to-interface property bindings come from the reviewed, content-addressed v3 manifest in `schema_parameter_bindings.json`; its exact active tuples, corrections, removals, and mapping exclusions are validated against the final bound `SchemaRegistry`. CLI `required` and constraints come from the resolved typed contract, while MCP `required` remains interface-only metadata.
 8. Agent selection results are fixed in versioned review inputs. Every public tool has explicit use/avoid/example and interface disposition metadata; Skill references that are not current leaves require an explicit alias/group/stale/out-of-surface review instead of fuzzy runtime matching.

 ## Repository Structure
@@ -19,8 +19,8 @@
 - `internal/app`: root command wiring, static utility commands, and plugin loading
 - `internal/helpers`: product command handlers (dev, chat, calendar, contact, etc.)
 - `internal/plugin`: versioned plugin manifest, hook, skill, and transport descriptor loading
- `internal/cli`: Schema assembly, `dws schema` query, and catalog contracts
- `internal/generator`: CI/determinism tools (`cmd_schema_catalog` dump) and param-alias generate
+- `internal/cli`: embedded Agent Command Catalog, static schema query, and catalog contracts
+- `internal/generator`: deterministic Agent metadata and Command Catalog generators
 - `internal/executor`: invocation dispatch and result handling
 - `internal/transport`: MCP HTTP client and request signing
 - `internal/auth`: login, token management, agent-code detection, identity
@@ -30,16 +30,11 @@
 - `internal/security`: endpoint allowlist and domain trust
 - `internal/safety`: runtime safety checks (confirm prompts, dry-run guards)
 - `internal/cobracmd`: shared Cobra command builders
- `internal/corecmd`: dispatch-agnostic leaf-command base — flag registration,
-  alias/env/default value resolution, required and cross-flag constraint
-  validation, Risk write confirmation, toolArgs assembly, Runtime Schema
-  projection. Distinct from `internal/cobracmd` (generic tree helpers): it owns
-  the declarative leaf contract (`corecmd.Spec`) that the LeafSpec framework is
-  built on and that the Shortcut adapter projects into.
 - `internal/pat`: PAT (Personal Access Token) authorization flow
 - `internal/output`: response formatting (json, table, raw, pretty)
 - `internal/logging`: structured logging and argument sanitization
 - `internal/tui`: terminal UI helpers
+- `internal/recovery`: panic recovery and graceful degradation
 - `pkg/configmeta`: environment variable registry and documentation
 - `pkg/config`: configuration constants and paths
 - `pkg/edition`: edition detection (oss vs enterprise)
@@ -43,7 +43,7 @@ repository root while preserving repo-local guidance for automation.
 - Error message or category issues: inspect `internal/errors`
 - Audit log issues: inspect `internal/audit`
 - Plugin loading or command surface: inspect `internal/plugin`
- Failure or degraded mode: inspect `internal/errors`
+- Failure or degraded mode: inspect `internal/errors`, `internal/recovery`

 ## Policy Checks

@@ -48,12 +48,8 @@ It then runs:
  --fast-path "$PR_BASE_SHA" HEAD
 ```

-The exact fast path remains limited to historic one-file maintenance. A
-release-seal PR uses `--content-only`, which permits the generated
-`CHANGELOG.md` change together with archival moves from `.changes/` to
-`.changes/released/`; it receives the normal scoped admission instead of this
-fast path. Ordinary PRs must not modify `CHANGELOG.md`; they add a standalone
-release fragment instead. The validator and its policy dependencies in that merge tree are byte-for-byte the current base
+Because the verified PR diff contains only `CHANGELOG.md`, the validator and
+its policy dependencies in that merge tree are byte-for-byte the current base
 versions. Validation targets the synthetic merge tree, not the feature-branch
 tree, so a stale branch cannot supply an older validator or combine with newer
 base notes into an invalid final CHANGELOG.
@@ -83,12 +79,10 @@ to the complete main admission suite. A source change can therefore never
 inherit the CHANGELOG-only result.

 Any PR that touches `CHANGELOG.md` but also changes another file runs the same
-content contract in `Policy` with `--content-only`. That mode accepts only
-fragment archival moves (`.changes/<name>.md` to
-`.changes/released/<version>/<name>.md`) alongside the changelog; source and
-documentation changes are rejected. It still rejects invalid dates or
-versions, missing bullets, placeholder `TODO`/`TBD`, unmanaged-section
-changes, and unsafe tree modes.
+content contract in `Policy` with `--content-only`. That mode permits the
+second file but still rejects invalid dates or versions, missing bullets,
+placeholder `TODO`/`TBD`, unmanaged-section changes, and unsafe tree modes.
+Adding a second file therefore cannot bypass CHANGELOG validation.

 ## Risk tiers and downstream boundaries

@@ -163,59 +157,28 @@ expected to repeat every CI job locally:
 ```sh
 make build
 make policy
-make interface-integrity BASE_REF=<merge-base> STABLE_REF=<stable-tag> CANDIDATE_REF=<candidate-sha>
-make schema-compatibility BASE_REF=<merge-base> STABLE_REF=<stable-tag> CANDIDATE_REF=<candidate-sha>
+make interface-integrity
+make authoritative-interface-integrity BASE_REF=<merge-base>
+make schema-compatibility BASE_REF=<merge-base>
 make skill-command-integrity
 make cli-smoke
 make mock-mcp-smoke
 go test -v -count=1 ./pkg/editiontest/...
 ```

-CI 先解析并核对精确的 merge-base、最近可达且未撤回的 stable GA tag 和已提交的 candidate
-SHA，再调用 `make authoritative-interface-integrity`。本地 `make interface-integrity`
-与该 CI target 都只委托给同一个 modern authoritative wrapper，不存在第二个比较
-入口。省略 `BASE_REF` 时本地 target 默认比较 `origin/main`，省略 `STABLE_REF` 时自动
-选择该 base 可达且未撤回的最近 stable GA tag，省略 `CANDIDATE_REF` 时比较已提交的 `HEAD`。
-需要逐字复现某次 CI 时，应显式传入该次运行记录的 merge-base、stable tag 和
-candidate SHA。
-
-`make update-interface-baseline` / `make reset-interface-baseline` 只维护
-`test/fixtures/cli-interface-baseline.txt` 这一份非权威 CLI Smoke fixture。底层旧
-`check-interface-baseline.sh` 不再作为本地或 CI 的兼容性审批入口，也不能用于批准
-flag 迁移。
-
-Schema compatibility 使用同一组 base、stable、candidate refs，以及 base-owned flag
-与 command migration ledgers。merge-base-owned checker 分别规范化 merge-base 与
-stable 的完整 Schema，并让 candidate 对两份历史 contract 独立执行检查；它只把已通过
-Interface lifecycle 的 exact rename、command move 或 flag extraction 规范化到当前历史
-副本，不会维护第二份 allowlist，也不会放宽其他 Schema 历史字段。
-
-For a release-seal branch that archives rendered fragments:
+For an exact CHANGELOG-only branch:

 ```sh
 base_ref=$(git merge-base HEAD origin/main)
-./scripts/policy/check-changelog-pr.sh --content-only "$base_ref" HEAD
+./scripts/policy/check-changelog-pr.sh --fast-path "$base_ref" HEAD
 ```

 `make coverage-gate` is an enforcement step, not a profile generator. For a
 standard PR, CI derives changed packages and their reverse-dependency test
 closure, then generates candidate and merge-base profiles with the same test
 scope and `coverpkg`. High-risk and protected-main runs use the complete
-profiles. The complete candidate profile is produced by disjoint per-shard
-helper jobs (`scripts/ci/test-packages.sh list-coverage`, kept serial with
-`-p 1` inside each shard; `verify` proves the shard union equals the
-full-suite scope exactly once) and concatenated in the aggregate job before
-enforcement. The complete merge-base profile is restored from an exact-key
-cache written by the last green `main` push of that same commit (key:
-merge-base SHA plus resolved Go version); any miss falls back to recomputing
-it in a merge-base worktree. The trusted `main` producer and PR consumer use
-the same dedicated cache profile path because GitHub includes that path in the
-cache version; the runtime-facing candidate and baseline filenames remain
-separate. Near-miss reuse is forbidden — the caches carry no prefix restore
-keys, because a neighbouring commit's profile would compare the candidate
-against the wrong baseline. Supporting and (when
-platform-selected) native profiles are generated before the aggregate
-`Coverage` context evaluates them. The
+profiles. Supporting and (when platform-selected) native profiles are
+generated before the aggregate `Coverage` context evaluates them. The
 aggregate and native gates require 100% coverage for changed executable Go
 statements. Overall coverage remains an unrounded, zero-tolerance,
 scope-matched merge-base non-regression check. Candidate and baseline profiles
@@ -223,24 +186,11 @@ are evaluated by the same block-deduplicating checker; supporting policy and
 shortcut profiles contribute to changed-code coverage only. The checked-in
 badge is presentation only and is never read as a gate input.

-CLI 兼容检查只使用 modern Interface Snapshot 这一处权威比较 seam，并从 PR
-merge-base 和最近的可达 stable release 生成权威快照。本治理机制合入后，
-merge-base 拥有生成器、比较器和已审批迁移清单，因此 candidate 不能通过修改
-helper、fixture 或在同一 PR 新增 self-approval 记录来放行 breaking change。首次
-bootstrap 仍由 merge-base 已有的 modern helper 做无豁免比较，并只接受 candidate
-提交中的规范空清单；完整边界见下方治理文档。
-
-精确的两阶段 flag 迁移生命周期见
-[CLI flag 兼容迁移治理](cli-interface-flag-migrations.md)。治理 PR 只能在
-surface 未变化时新增 `pending`；后续产品 PR 达到审批的精确 surface 后，才能
-消费 base-owned 记录并改为 `consumed`。在 main 与 stable 都达到 after 状态前
-必须保留该回执，之后再由单独 PR 清理。机制只放行记录中的 legacy
-visible-to-hidden，以及 canonical required 新增或提升；删除、type、scope、
-shorthand、no-opt 和任何无关漂移仍然阻塞。Schema 可以新增；历史 product、
-tool、parameter、mapping、positional execution、constraint 与 safety 语义继续
-受保护。`alias_of` 只是一项由 `FlagSpec.Aliases` 产生的框架关系证据，不是 payload
-等价证明；产品 PR 仍须证明 canonical 与 legacy 的最终运行 payload 等价并在 transport
-前拒绝冲突输入。当前迁移清单为空，不授权 PR #904。
+Compatibility checks derive authoritative Interface snapshots from the PR
+merge-base and the latest reachable stable release. The candidate cannot bless
+a breaking change by editing a fixture. Schema additions are allowed;
+historical products, tools, parameters, mappings, positional execution fields,
+constraints, and safety semantics remain protected.

 ## Required GitHub repository settings

@@ -1,270 +0,0 @@
-# CLI Help / Schema 兼容迁移治理
-
-本文定义两种受控 flag 迁移：
-
-1. `flag_rename`：保留旧 flag 的可执行兼容性，但把它从 Help 与 Agent Schema 中隐藏，并将新的规范 flag 设为唯一可见入口；rename 必须保持原 flag 的 requiredness，optional 只能迁到 optional，required 只能迁到 required。
-2. `requiredness_change`：同一个公开 flag 从 optional 精确提升为 required；flag 的名称、类型、作用域、可见性、shorthand、`no_opt` 与 alias 关系必须保持不变。
-
-两种原语都只放行清单精确登记的变化，不是通用 breaking-change 豁免，也不得在同一 command/flag 上叠加以绕过 rename 的 requiredness 保持规则。
-
-同一套 base-owned lifecycle 也治理两类跨命令迁移：旧命令保留执行能力但从 Help / Schema 导航隐藏，并迁到新的公开命令路径；或把旧命令中的一个可选 flag 拆成新的专用命令。跨命令迁移只允许清单精确声明的 `command_became_hidden` / `flag_became_hidden` 及其 Schema 投影，不是通用 command-path breaking-change 豁免。
-
-同名 flag 的精确类型迁移属于另一类评审机制，只能进入
-`internal/interfacesnapshot/reviewed.go` 与 legacy smoke helper 的镜像表；flag rename
-只能进入本文的 JSON lifecycle ledger。一项迁移不得跨两种机制组合授权。
-
-## 唯一比较入口与信任边界
-
-PR 与本地兼容性审批的唯一权威比较入口是 modern Interface Snapshot：
-
- `cmd/interface-snapshot` 生成和比较快照；
- `internal/interfacesnapshot` 实现兼容规则和迁移生命周期；
- `scripts/policy/check-command-compatibility.sh` 组装 candidate、PR merge-base 和最近可达且未撤回的 stable GA 三份快照；
- `scripts/policy/check-authoritative-interface-baselines.sh` 只保留为 Makefile 的兼容包装，不再维护第二套判断逻辑。
-
-紧随其后的 Schema compatibility 不是第二份审批清单。它从同一 merge-base-owned
-ledger 和同一组三方 Interface Snapshot 取得已经完成 lifecycle 校验的
-authorization。merge-base-owned checker 会分别规范化 merge-base 与 stable 的完整
-Schema，并让 candidate 对两份历史 contract 独立执行检查；授权的 flag rename 只会
-精确投影到当前被检查的历史副本。candidate 不能为 CLI 与 Schema 分别提供两套例外。
-
-`make interface-integrity` 也调用上述 authoritative wrapper；默认 base 为
-`origin/main`，stable 可由包装脚本自动解析，candidate 默认为已提交的 `HEAD`。旧
-`scripts/policy/check-interface-baseline.sh` 只供
-`make update-interface-baseline` / `make reset-interface-baseline` 维护非权威 CLI
-Smoke fixture，不参与迁移审批。
-
-直接调用 `interface-snapshot compare` 时，只要提供 migration manifest 参数，就必须
-同时提供 `--base` 与 `--stable`；核心 lifecycle 也拒绝缺失 stable 的非空清单，避免
-调用方因漏传历史参考而提前清理 consumed receipt。
-
-PR merge-base 同时拥有快照生成器、比较器和已审批清单。门禁用这套 base-owned helper 检查同一个已提交 candidate revision、merge-base 与 stable，candidate 不能通过修改自己的 Go 比较 helper 来放宽规则。candidate 中的清单只参与迁移状态流转，不能批准同一个 PR 引入的接口变化。首次引入 flag 机制时，merge-base 尚无迁移解析器；bootstrap 会用 merge-base 已有的 modern Interface Snapshot 做不带豁免的普通比较，并只接受 candidate 中逐字匹配的空 flag 清单。后续引入 command migration 扩展时，base 已拥有 flag comparator；bootstrap 仍只执行 base-owned 普通比较，不向旧 helper 传入新的 command ledger，因此允许随治理 PR 提交仍处于 before 的 pending 计划，也不会授予任何迁移豁免。bootstrap 无法让旧 helper 证明新治理实现本身正确，因此本治理 PR 的新 parser、lifecycle、launcher 与 hostile tests 仍是必须由真人评审的受保护策略变更；它们合入后才成为后续 PR 的 base-owned authority。
-
-这条边界保护比较规则和审批数据，不是任意代码沙箱。GitHub workflow / launcher 的变更仍由仓库保护规则和真人评审负责；candidate Cobra 构建也会执行 candidate 代码，因此对同一 runner 上的主动恶意代码，需要独立进程或文件系统隔离，不能把本门禁描述成已经解决。
-
-已审批清单固定为：
-
-```text
-scripts/policy/interface-migrations/approved-flag-migrations-v1.json
-scripts/policy/interface-migrations/approved-command-migrations-v1.json
-```
-
-清单使用严格 JSON 解析：版本、字段名大小写、JSON 值类型、命令路径和 flag 名都必须精确；拒绝重复键、未知键、scalar `null` 与尾随 JSON 值，`reason` 不能为空；禁止 `*`、`?`、前缀规则或其他 wildcard。历史未声明 `kind` 的记录按 `flag_rename` 解释；新增同名 requiredness 迁移必须显式写 `kind: requiredness_change` 和单一 `flag` before/after。清单中的 `pending` 记录只记录已评审计划，并授权其精确列出的后续产品迁移；候选与 merge-base 仍必须精确匹配 `before`，不能授权同一个提交中的接口变化，也不能作为其他命令或参数的通配豁免。
-
-首次引入一个旧 merge-base 不认识的新 `kind` 时，机制 PR 不得同时写入该 kind 的 pending 记录，因为旧的 base-owned 严格解析器会拒绝未知字段。必须先合入 parser、lifecycle、CLI/Schema adapter 与 hostile tests；待这些实现成为新的 merge-base authority 后，再用独立治理审批 PR 新增 pending，最后才由产品 PR 消费。
-
-## 跨命令迁移原语
-
-`approved-command-migrations-v1.json` 只接受两种 `kind`：
-
-| kind | CLI after 状态 | Schema 允许的精确投影 |
-|---|---|---|
-| `command_move` | legacy 命令仍 runnable、由 visible 变 hidden；replacement 由 absent 变 visible runnable | 同一 stable tool identity 的 `primary_cli_path` 改到 replacement；只允许清单列出的参数改名，参数类型、property、requiredness、default 等必须等价 |
-| `flag_extraction` | legacy 命令保持 visible runnable；指定 legacy flag 仍可执行但由 visible 变 hidden；replacement 由 absent 变 visible runnable | source tool 只删除指定参数；replacement tool 必须位于精确的新路径，并保持 source 的 interface 与 safety identity；清单必须完整列出每个 source 参数到 replacement 参数或常量 property 的承接关系 |
-
-`command_move` 只能隐藏没有子命令的 legacy leaf，且 legacy 与 replacement
-不得互为祖先路径；整棵命令树的迁移需要单独设计逐叶治理，不能复用这一原语。
-稳定 Schema tool 可以继续接受普通的 optional 参数新增，但不得借路径迁移引入清单未登记的
-`required`、`cli_required` 或 `required_when` 参数；参数改名的目标也不得与历史
-Schema 中已有的其他参数重名，避免把两个历史参数静默合并。`flag_extraction` 只接受
-optional bool legacy flag，不能隐藏仍由 Cobra hard-required 的参数。它必须对 source tool
-的全部历史参数逐项声明：普通参数使用精确 `from` → `to`（同名也必须显式写出），且恰好
-一个与 legacy flag 同名的 `from` 使用 `replacement_constant`，不得同时声明 `to`；所有
-`from` 与 replacement 参数/property 目标必须唯一。legacy bool flag 的 `no_opt` 必须等于
-常量布尔值的字符串形式。v1 只治理 optional bool flag 的 `NoOpt=true` 激活分支，因此
-`replacement_constant.value` 与 legacy `no_opt` 都必须是 `true`；negative flag、默认即
-`true` 或固定 `false` 的语义不在本轮证明范围，必须另行设计，不能借本清单放行。
-
-如果 `command_move` 的参数 `from` 在更早 stable 中仍使用另一历史名称，Schema adapter
-只能把同一 legacy command 上、已经由 base-owned lifecycle 返回且
-`state=consumed` 的 flag rename 回执作为前驱边。例如
-`group → conversation-id` 与 `conversation-id → open-topic-id` 可以组合，但不能把
-candidate 自增的 pending 记录、其他命令的同名参数、参数概念词典或 CLI alias 当作证据。
-首次消费 pending command 回执时，merge-base 的 normalized Schema 必须真实发布中间参数，
-并逐跳验证参数签名和 constraints；command 回执合入为 consumed 后，中间 Schema 已从 main
-消失，此时保留的两份 consumed 回执可继续对 stable 做受限重放，直到 stable 也达到 after
-并让回执转为惰性记录或由独立 PR 清理。两种阶段都拒绝残留 predecessor/intermediate、字段漂移、环、分叉、
-target 碰撞或 primary path/tool identity 不唯一；positionals 不在该组合授权面内。
-
-`replacement_constant` 不是清单自报即可成立的例外。after 阶段的 Interface Snapshot
-必须从 replacement 命令的同一份框架运行时声明中捕获完全一致的 property/value，缺失、
-值不符或额外常量都会使 lifecycle 落入 partial。对于 #1054，`dws chat topic create`
-必须通过 `NewLeafCommand` 的 `ConstParams` 声明并实际注入
-`convThreadEnabled=true`；手写 `RunE` 固定值、Cobra annotation 或只改清单都不能提供这份
-同源证据，Snapshot 只读取 `corecmd` 包内私有注册表公开的只读副本。第一次向旧快照增加
-bool 常量证据属于 bootstrap；一旦任一历史快照已记录该
-证据，普通 Interface Compare 会持续要求 property/value 集合完全一致，因此 ledger 清理后
-删除、翻转或增加常量仍会阻塞。若 candidate 改动 command ledger，则
-`internal/corecmd/corecmd.go`、`internal/corecmd/interface_const_params.go` 与
-`internal/helpers/leaf.go` 三份执行/证据桥必须保持 base Git blob 不变；框架演进必须先用
-独立 PR 合入，不能和产品消费混在一起。
-
-replacement 必须保留 source 已发布的 dry-run 能力：历史 `dry_run` 非空时不得删除或改值；
-历史未声明时允许 replacement 新增 dry-run。这与普通 Schema 兼容规则保持同一单调边界。
-
-两种迁移都要求旧 argv 继续可执行。删除旧命令、删除旧 flag、把 legacy 改成 non-runnable、改变未登记的历史参数、改变 interface / safety，或只完成部分 before → after 转换都会 fail closed。命令别名会先规范到 reference 的 canonical path，但清单本身仍只能记录精确 canonical 命令，不能用 alias 或前缀扩大授权。
-
-跨命令清单复用下文同一套 `pending → consumed → inert/cleanup` 生命周期。治理 PR 只能新增 `pending` 且产品 surface 必须仍是 before；后续产品 PR 才能一次性切到 after 并改为 `consumed`。candidate 新增的 pending 记录不能批准自己的改动。
-
-当前首批 pending 记录覆盖 `chat topic` 收口：`chat group create --thread` 拆到 `chat topic create`，以及 `chat message list-topic-replies` / `forward-topic` 迁到对应的 `chat topic` 命令。前一条完整登记 `name` / `type` / `users` 的同名承接，以及 `thread` → `convThreadEnabled=true` 的常量承接。产品 PR 消费这些记录时只能把三条 `state` 改为 `consumed`，不得改写其 before、after、Schema mapping、constant 或 reason。
-
-## 两阶段迁移与回执清理
-
-rename 以 `(kind, command, legacy flag, canonical flag)` 为唯一精确键；requiredness change 以 `(kind, command, flag)` 为唯一精确键。二者经历同一生命周期：
-
-| 阶段 | PR 可以做什么 | 必须满足的快照状态 |
-|---|---|---|
-| 1. 治理审批 | 新增 `state: pending` 的精确记录；不得在同一个 PR 修改产品 surface | candidate 和 merge-base 都与记录中的 `before` 完全一致；该记录不改变 stable 的判断 |
-| 2. 产品迁移 | merge-base 已拥有 `pending` 后，按记录一次性切到精确 `after`，并把记录改为 `state: consumed` | rename 的 legacy 仍存在但由 visible 变 hidden，且声明 `alias_of`，canonical requiredness 保持不变；requiredness change 只把同名 flag 从 optional 提升为 required |
-| 3. 保留回执 | 产品 PR 合入后，如果 stable 仍是 `before`，继续保留 `consumed` | merge-base 或 stable 仍有任一份尚未达到 `after` |
-| 4. 惰性保留或清理 | 当 merge-base 和 stable 都已经是 `after`，该记录不再提供任何授权；后续 PR 可以原样保留或删除 | 两份参考快照均精确匹配 `after`；保留时仍必须是不可改写的 `consumed`，接口偏离 `after` 继续失败 |
-
-因此，新增 `pending` 和修改产品 surface 不能发生在同一个 PR；candidate 自己新增的记录不能 self-approve。迁移也不能部分执行：legacy、canonical、`alias_of` 或状态只要有一项不匹配，门禁即失败。stable 发布只会让已经追平的 `consumed` 回执变成无授权效果的审计记录，不会在没有代码变更时让后续业务 PR 失去合规性；清理仍可作为独立的账本压缩动作，但不再是下一个 PR 的强制前置条件。
-
-下面只是清单结构示例，不代表已审批命令；实际字段必须从 Interface Snapshot 核对：
-
-```json
-{
-  "version": 1,
-  "migrations": [
-    {
-      "command": "dws chat message recall",
-      "legacy": {
-        "name": "msg-id",
-        "before": {
-          "present": true,
-          "type": "string",
-          "required": true,
-          "scope": "local"
-        },
-        "after": {
-          "present": true,
-          "type": "string",
-          "hidden": true,
-          "scope": "local",
-          "alias_of": "message-id"
-        }
-      },
-      "canonical": {
-        "name": "message-id",
-        "before": { "present": false },
-        "after": {
-          "present": true,
-          "type": "string",
-          "required": true,
-          "scope": "local"
-        }
-      },
-      "state": "pending",
-      "reason": "保留旧 argv 兼容性，并将规范 flag 设为唯一可见入口"
-    }
-  ]
-}
-```
-
-产品迁移 PR 必须保持同一条记录的命令、flag、before/after 和 reason 不变，只把 `pending` 改成 `consumed`。
-
-同名 flag requiredness 迁移的清单结构如下；示例不代表已经审批：
-
-```json
-{
-  "version": 1,
-  "migrations": [
-    {
-      "kind": "requiredness_change",
-      "command": "dws report entry submit",
-      "flag": {
-        "name": "to-user-ids",
-        "before": {"present": true, "type": "string", "scope": "local"},
-        "after": {"present": true, "type": "string", "required": true, "scope": "local"}
-      },
-      "state": "pending",
-      "reason": "Reject report submissions that have no visible recipient."
-    }
-  ]
-}
-```
-
-## `alias_of` 是框架来源的受评审关系证据
-
-`alias_of` 不是 Schema 同义词、参数概念词典或任意文字声明。它只能由 `FlagSpec.Aliases` 写入，并与内部 origin `corecmd.flag_spec_aliases.v1` 成对出现；每次 Interface Integrity 都会在已提交的 detached candidate 上执行源码门禁，禁止其他生产文件写入或复刻这些 evidence token。Interface Snapshot 会验证：
-
- legacy 与 canonical 位于同一个可执行命令；
- canonical flag 确实存在；
- legacy 与 canonical 类型一致；
- legacy 不是指向自身，也不存在 alias chain；
- legacy 的 after 状态精确指向该记录中的 canonical flag。
-
-通过命令框架声明 `FlagSpec.Aliases` 时，框架会自动注册隐藏的兼容 flag，并写入两项 relation annotation；仅手写 `alias_of`、伪造 origin、重复值或不精确值都会让快照生成失败。不要用 Schema overlay、迁移清单或手写 Cobra annotation 伪造关系。
-
-这项关系证据只证明 legacy/canonical 经过受控框架路径建立关系，不证明最终 transport payload 等价，也不会替产品代码实现命令特有的值同步。当前框架还禁止把
-`MarkRequired` 与 `FlagSpec.Aliases` 直接组合，因为 Cobra 的 hard-required
-校验只识别 canonical spelling。若产品迁移同时需要 canonical 的 Cobra required
-标记和 legacy spelling，产品 PR 必须提供明确的运行时方案，并通过 canonical / legacy
-最终 payload 等价、同值输入一致、冲突输入在 transport 前失败、legacy 仍可调用但 Help 隐藏等测试；迁移清单和 relation evidence 都不能替代这些证明。
-
-## 豁免边界
-
-一条 base-owned、状态正确且前后快照精确匹配的记录，只会从普通兼容报告中移除以下三类预期 finding：
-
-1. legacy flag 的 `flag_became_hidden`（visible → hidden）；
-2. required legacy 被新增的 required canonical 替代时产生的 `required_flag_added`；如果 canonical 在 before 阶段只是 hidden 占位符，则允许它在转为公开拼写时继承 legacy 的 requiredness。已有的 visible canonical 不允许借 rename 改变 requiredness。
-3. `requiredness_change` 中同名 flag 从 optional 提升为 required 时产生的 `flag_became_required`。
-
-以下变化仍按普通兼容规则阻塞，不能被迁移记录掩盖：
-
- 删除 legacy、canonical、命令或其他 flag；
- flag 类型或迁移记录中的 scope、shorthand、`no_opt` 漂移；
- `alias_of` 缺失、指向变化或 alias chain；
- 命令路径及任何无关的阻塞性接口变化；
- requiredness change 同时发生的 rename、隐藏、类型、scope、shorthand、`no_opt` 或 alias 漂移；
- 不精确、部分完成、超出记录范围的 surface 变化。
-
-## Schema 投影边界
-
-Agent-visible command 会把 visible Cobra flag 投影为 Schema parameter，因此合法的
-legacy hidden 迁移会同时表现为历史 parameter 消失，constraint member 也可能从
-legacy 名改为 canonical 名。Schema adapter 只接受已经由三方 Interface Snapshot
-判定为 authorized 的迁移，并按 tool 的精确 `primary_cli_path` 绑定：
-
- reference 仍处于 `before` 且该 flag 有 Schema surface 时，baseline legacy parameter
-  必须存在，candidate legacy parameter 必须消失，candidate canonical parameter 必须存在；
-  如果 baseline 只有 canonical、没有 legacy，则 adapter 不得借 CLI ledger 提升
-  `required` / `cli_required` 或重写 constraint；
- rename 前后的 `type`、`property`、`interface_type`、default、format、enum 与
-  `required_when` 必须完全一致；
- `required` / `cli_required` 必须在 rename 前后完全一致，升高或降低都失败；
- constraint 只允许在同一 tool 内按已枚举的 legacy → canonical map 做 member 替换、
-  排序与去重；group kind、非迁移 member 或 group 增删仍然阻塞；
- 多个 legacy 指向同一 canonical 时，所有历史 parameter signature 必须一致，否则
-  fail closed。
-
-adapter 先构造经过上述验证的历史 contract 副本，再调用原 Schema checker；它不会按
-错误字符串删除 finding。这样既能处理纯 rename，也能阻止“旧 required 参数改名后意外
-变为 optional”或 property 漂移等伪兼容。`consumed` 回执在 merge-base Schema 已经处于
-canonical-only `after` 状态时不需要再次投影；adapter 保持 baseline 不变，由原 checker
-验证 candidate 是否仍与该 canonical contract 兼容。
-
-`requiredness_change` 的 Schema adapter 只把历史同名 parameter 的 `required` 与
-`cli_required` 提升到 candidate 的 `true` 值，并要求 candidate 两者都为 `true`。parameter
-不存在、tool/path 不匹配时不制造 Schema surface；type、property、interface type、default、
-format、enum、`required_when`、constraints、positionals 与 safety 等全部字段仍交给原 checker，
-任何不相干漂移继续阻塞。
-
-## 本地验证
-
-先确保 merge-base 和 stable tag 已在本地，然后运行与 CI 相同的权威门禁：
-
-```sh
-make interface-integrity \
-  BASE_REF=<merge-base> \
-  STABLE_REF=<stable-tag> \
-  CANDIDATE_REF=<candidate-sha>
-
-make schema-compatibility \
-  BASE_REF=<merge-base> \
-  STABLE_REF=<stable-tag> \
-  CANDIDATE_REF=<candidate-sha>
-```
-
-`STABLE_REF` 必须解析到从该 merge-base 可达的最高未撤回 stable GA tag；primary checker 会按 release contract 独立核对，不能用任意 after commit 或已撤回版本提前清理回执。包装脚本可以在省略时自动解析。`CANDIDATE_REF` 省略时固定为命令启动时的已提交 `HEAD`；评审和复现 CI 时应显式传入 candidate SHA，避免 surface 与清单来自不同 revision。
@@ -1,209 +0,0 @@
-# command 领域模型
-
-本文档描述 `internal/corecmd` 包的领域模型——类型、概念及其关系。
-
-## 核心模型图
-
-```
-┌─────────────────────────────────────────────────────────────────────┐
-│                         corecmd.Spec                                  │
-│                    (一个叶子命令的完整契约)                             │
-├─────────────────────────────────────────────────────────────────────┤
-│                                                                     │
-│  ┌─── CLI 表面 ───┐   ┌─── 参数声明 ───────────────────────────┐   │
-│  │ Use            │   │ FlagSpec[]                              │   │
-│  │ Short          │   │  ├─ Name / Kind / Default              │   │
-│  │ Long           │   │  ├─ Required / MarkRequired            │   │
-│  │ Example        │   │  ├─ Aliases[] / EnvVar (回退链)         │   │
-│  └────────────────┘   │  ├─ Bind / Transform / OmitEmpty       │   │
-│                       │  └─ Enum / Format / SchemaDescription  │   │
-│                       │                                        │   │
-│                       │ Constraint[]                            │   │
-│                       │  ├─ at_least_one                       │   │
-│                       │  ├─ exactly_one                        │   │
-│                       │  └─ mutually_exclusive                 │   │
-│                       │                                        │   │
-│                       │ ConstParams map[string]any             │   │
-│                       └────────────────────────────────────────┘   │
-│                                                                     │
-│  ┌─── 安全模型 ──────────────────────────────────────────────────┐  │
-│  │  Safety contract.SafetySpec                                       │  │
-│  │  ├─ Effect       (read / write / destructive)                │  │
-│  │  ├─ Risk         (low / medium / high)                       │  │
-│  │  ├─ Confirmation (not_required / user_required) ──▶ 运行时门 │  │
-│  │  └─ Idempotency  (idempotent / retryable / …)                │  │
-│  │                                                               │  │
-│  │  四字段彼此独立；同一值同时供运行时与 Schema 使用              │  │
-│  │  ConfirmFirst: bool (只控制确认门顺序)                         │  │
-│  └───────────────────────────────────────────────────────────────┘  │
-│                                                                     │
-│  ┌─── Contract 声明 (Agent 可见的元数据) ────────────────────────┐  │
-│  │  ContractDecl                                                   │  │
-│  │  ├─ Title / Description                                      │  │
-│  │  ├─ contract.DryRunSpec     {PreviewKind, RemoteReads}       │  │
-│  │  ├─ contract.InterfaceSpec  {Mode, Availability, Reason, Ref}│  │
-│  │  ├─ contract.SelectionSpec  {AgentSummary, UseWhen, AvoidWhen│  │
-│  │  │                          Prerequisites, Tips, Examples}    │  │
-│  │  ├─ contract.ToolIdentitySpec {ProductID, CanonicalPath, …}  │  │
-│  │  └─ Positionals[]  {Name, Type, Required, Variadic}          │  │
-│  └───────────────────────────────────────────────────────────────┘  │
-│                                                                     │
-│  ┌─── 执行体 (恰好一个) ─────────────────────────────────────────┐  │
-│  │  Invoke(Ctx, toolArgs)     ← #830 过渡：单步派发（目标 mcpbind）│  │
-│  │  Orchestrate(Ctx)          ← #830 过渡：多步编排（目标 Handler）│  │
-│  │  RunE(cmd, args)           ← 逃生舱：完全自定义               │  │
-│  └───────────────────────────────────────────────────────────────┘  │
-│                                                                     │
-│  ┌─── 钩子 ─────────────────────────────────────────────────────┐  │
-│  │  Validate(cmd, args)   ← 条件式业务校验（约束表达不了的）      │  │
-│  │  PostMount(cmd)        ← 挂载收尾（设置 Args 等 cobra 属性）   │  │
-│  └───────────────────────────────────────────────────────────────┘  │
-└─────────────────────────────────────────────────────────────────────┘
-```
-
-## 构建与执行流
-
-```
-corecmd.Spec ──── corecmd.New() ────▶ cobra.Command ──── 用户执行 ────▶ Ctx
-                     │                    │                            │
-              构建时检查:              注册产物:                    执行上下文:
-              • validateDispatchDecl   • Flags + Aliases            • Str(name)
-              • validateSafetySpec     • Annotations (Schema)       • Int(name)
-              • validateContractDecl     • Long (约束 help)           • Bool(name)
-              • RegisterFlags          • RunE (管线)                • StrSlice(name)
-              • ValidateConstraintDecls                            • Changed(name)
-              • embedContractIntoSchema                            • DryRun() / Yes()
-              • AnnotateConstraints
-              • PostMount
-```
-
-## 领域概念
-
-| 概念 | 类型 | 职责 |
-|------|------|------|
-| **corecmd.Spec** | struct | 一个命令的完整契约（声明 + 执行） |
-| **FlagSpec** | struct | 一个参数的注册、回退链、绑定规则 |
-| **Constraint** | struct | 参数间的关系约束 |
-| **Safety** | contract.SafetySpec | 运行时与 Schema 共用的安全契约 |
-| **ContractDecl** | struct | Agent 可见的完整工具规格声明 |
-| **contract.SelectionSpec** | struct | Agent 选择该工具的语义指引 |
-| **contract.InterfaceSpec** | struct | 工具的接口模式与可用性 |
-| **contract.DryRunSpec** | struct | dry-run 能力声明 |
-| **contract.ToolIdentitySpec** | struct | 工具在注册表中的身份标识 |
-| **contract.RuntimeSchemaPositional** | struct | 有序位置参数声明 |
-| **Ctx** | struct | 执行上下文（类型安全的 flag 读取） |
-| **New** | func | 统一构建器（`corecmd.Spec` → `*cobra.Command`） |
-
-## SafetySpec
-
-`corecmd.Spec.Safety` 使用 `corecmd/contract.SafetySpec`（无 cli 类型别名），没有 command 自定义 Risk/Safety 枚举，也没有 `SafetyDecl` 覆盖层：
-
-```go
-Safety: contract.SafetySpec{
-    Effect:       "write",
-    Risk:         "high",
-    Confirmation: "user_required",
-    Idempotency:  "unknown",
-}
-```
-
- `Confirmation == "user_required"` 时执行确认；`--yes` 和 `--dry-run` 可跳过交互。
- `Effect`、`Risk`、`Idempotency` 不参与确认决策，也不会改写 `Confirmation`。
- 任意一个字段非空时，四个字段必须全部显式声明；构建时拒绝部分声明。
- 完全空值仅作为历史只读默认，最终发布为 `read/low/not_required/idempotent`。
-
-## FlagSpec 有效值回退链
-
-框架统一的 flag 值解析顺序：
-
-```
-显式主 flag (Changed)
-    │ 空?
-    ▼
-隐藏别名 (Changed, 按声明序)
-    │ 空?
-    ▼
-环境变量 (EnvVar)
-    │ 空?
-    ▼
-注册默认值 (Default)
-    │ 空?
-    ▼
-ArgDefault (兜底)
-```
-
-各 Kind 的特殊行为：
-
-| Kind | 入参条件 | 回退链 |
-|------|----------|--------|
-| KindString | 有效值非空（或 !OmitEmpty） | 完整参与 |
-| KindInt | 值 ≠ 0（putInt 语义） | 完整参与 |
-| KindBool | Changed 时入参（显式 false 也下发） | 不参与别名/env 回退 |
-| KindStringSlice | 存在非空元素 | 仅 Changed 的主 flag/alias |
-
-## Constraint 约束
-
-声明式跨 flag 关系，构建时校验合法性，运行时统一执行：
-
-| Kind | 语义 | 错误文案示例 |
-|------|------|-------------|
-| `at_least_one` | 至少提供一个 | "请至少指定 --a、--b 之一" |
-| `exactly_one` | 恰好提供一个 | "请指定 --a、--b 之一" / "只能指定其一" |
-| `mutually_exclusive` | 最多提供一个 | "参数 --a、--b 互斥，只能指定其一" |
-
-"是否提供"的判定复用有效值回退链（显式主 flag → 别名 → env），注册默认值不算作已提供。
-
-## ContractDecl 子结构
-
-### contract.SelectionSpec（Agent 选择指引）
-
-```go
-contract.SelectionSpec{
-    AgentSummary: "一句话描述工具做什么",
-    UseWhen:      []string{"在什么场景下应该选择这个工具"},
-    AvoidWhen:    []string{"什么场景不应该用，应该用什么替代"},
-    Prerequisites: []string{"使用前提条件"},
-    Tips:          []string{"使用技巧"},
-    Examples:      []string{"dws dev app create --name Bot --dry-run"},
-}
-```
-
-### contract.InterfaceSpec（接口模式）
-
-```go
-contract.InterfaceSpec{
-    Mode:         "composite",  // local / mcp / composite
-    Availability: "available",  // available / unavailable
-    Reason:       "...",        // composite/unavailable 时的原因
-    Ref: &contract.InterfaceRefSpec{ // mcp 时的 ref
-        ProductID: "...",
-        RPCName:   "...",
-    },
-}
-```
-
-### contract.DryRunSpec（dry-run 能力）
-
-```go
-contract.DryRunSpec{
-    PreviewKind: "invocation",  // invocation / request / plan
-    RemoteReads: false,         // dry-run 时是否发起远端读
-}
-```
-
-## 执行体三选一
-
-| 执行体 | 适用场景 | 框架做了什么 |
-|--------|----------|-------------|
-| **Invoke** | #830 过渡单步派发（生产仍用；目标 mcpbind） | 框架完成 required→constraint→validate→buildArgs→confirm，传入装配好的 toolArgs |
-| **Orchestrate** | #830 过渡多步编排（生产仍用；目标 Handler） | 框架完成 required→constraint→validate→confirm，传入 Ctx 自行组装调用 |
-| **RunE** | 逃生舱 | 框架仍执行 Safety 确认，具体业务执行完全自定义 |
-
-## 设计不变量
-
-1. **一个 corecmd.Spec = 一个叶子命令的全部事实**
-2. **声明面绝不调用后端**——command 是 dispatch-agnostic
-3. **执行面绝不发明 CLI 表面**——业务 flag 必须在 Flags 声明
-4. **构建时拦截 > 运行时报错**——声明错误 panic 在注册阶段
-5. **SafetySpec 是单一事实源**——Confirmation 驱动运行时，其余字段原样进入 Schema
-6. **声明即 review**——代码中的 Schema 经 code review 后直接投影，不依赖外部 hint 文件
@@ -1,286 +0,0 @@
-# 命令框架架构
-
-本文档描述 `internal/corecmd` 统一命令框架的当前架构，面向框架使用者和维护者。
-
-## 概览
-
-```
-用户输入 → cobra 命令树 → corecmd.New() → 运行时管线 → 后端派发
-```
-
-命令框架将 CLI 命令的**声明**与**执行**分离：
-
- **声明面** — 数据字段描述命令是什么（flag、约束、SafetySpec、Contract 元数据）
- **执行面** — 钩子函数描述命令做什么（校验、派发、编排）
-
-框架负责：flag 注册、有效值回退链、required/约束校验、SafetySpec 确认、toolArgs 装配、Agent Runtime Schema 投影。
-
-## 核心类型
-
-### corecmd.Spec
-
-统一的类型化命令规格，是框架的核心数据结构：
-
-```go
-type Spec struct {
-    // 声明面
-    Use         string
-    Short       string
-    Long        string
-    Example     string
-    Flags       []FlagSpec
-    Constraints []Constraint
-    Safety      contract.SafetySpec // 运行时与 Schema 的单一安全来源
-    ConfirmFirst bool         // 确认门先于参数校验
-    ConstParams map[string]any
-    Contract   ContractDecl    // 叶子 Contract 声明（非 Catalog Schema）
-
-    // 执行面（恰好一个；Invoke/Orchestrate 为 #830 过渡派发 API，目标 mcpbind+Handler）
-    Invoke      func(c *Ctx, toolArgs map[string]any) error  // 过渡：单步
-    Orchestrate func(c *Ctx) error                           // 过渡：多步
-    RunE        func(cmd *cobra.Command, args []string) error // 逃生舱
-
-    // 钩子
-    Validate    func(cmd *cobra.Command, args []string) error
-    PostMount   func(cmd *cobra.Command)
-}
-```
-
-### SafetySpec（单一安全来源）
-
-`Spec.Safety` 使用 `corecmd/contract.SafetySpec`：
-
-| 字段 | 职责 |
-|------|------|
-| `Effect` | 操作影响：read / write / destructive |
-| `Risk` | 风险等级：low / medium / high |
-| `Confirmation` | 是否需要用户确认：not_required / user_required |
-| `Idempotency` | 幂等性：idempotent / retryable / non_idempotent / unknown |
-
-四个字段彼此独立。框架只读取 `Confirmation` 决定运行时确认，其余字段原样发布到 Schema，不从一个字段机械推导另一个。非空 SafetySpec 必须一次声明完整：
-
-```go
-Safety: contract.SafetySpec{
-    Effect:       "write",
-    Risk:         "high",
-    Confirmation: "user_required",
-    Idempotency:  "unknown",
-},
-```
-
-完全空值保留历史只读默认 `read/low/not_required/idempotent`；不存在 Risk/Safety 枚举或覆盖优先级链。
-
-### FlagSpec
-
-声明一个 flag 的注册方式、有效值回退链、到 toolArgs 的绑定：
-
-```go
-type FlagSpec struct {
-    Name     string       // flag 名（kebab-case）
-    Usage    string       // --help 文案
-    Kind     FlagKind     // String / Int / Bool / StringSlice
-    Default  string       // 注册默认值
-    Required bool         // 框架校验非空
-    Aliases  []string     // 隐藏别名
-    EnvVar   string       // 环境变量回退
-    Bind     string       // toolArgs 键名（空则用 Name）
-    Transform func(string) (any, error)  // 值转换
-    // ...更多字段见源码
-}
-```
-
-### Constraint
-
-跨 flag 关系约束：
-
-```go
-type Constraint struct {
-    Kind  ConstraintKind  // at_least_one / exactly_one / mutually_exclusive
-    Flags []string
-}
-```
-
-## 有效值回退链
-
-flag 解析按以下顺序取值（先命中先生效）：
-
-```
-显式主 flag (Changed) → 隐藏别名 (Changed) → 环境变量 → 注册默认值
-                                                            │
-                                              ArgDefault ←──┘ (兜底)
-```
-
- KindBool：仅 Changed 时生效，不参与回退链
- KindStringSlice：仅主 flag / alias Changed 时生效，元素恒 TrimSpace
- KindInt：非零才入 toolArgs（putInt 语义）
-
-## 构建时流程
-
-`corecmd.New(spec)` 执行以下构建时检查（失败则 panic）：
-
-1. **validateDispatchDecl** — 恰好一个执行体（Invoke/Orchestrate/RunE）
-2. **validateSafetySpec** — 非空 SafetySpec 的四个独立字段必须完整
-3. **validateContractDecl** — Contract 声明完整性（Description、AgentSummary、UseWhen、AvoidWhen、Examples、Interface）
-4. **RegisterFlags** — flag + alias 注册到 cobra
-5. **ValidateConstraintDecls** — 约束引用的 flag 必须存在
-6. **embedContractIntoSchema** — 投影到 dws.schema.* annotations
-7. **AnnotateConstraints** — 约束渲染到 --help
-8. **PostMount** — 调用方的挂载收尾钩子
-
-## 运行时流程
-
-生成的 `RunE` 按以下顺序执行：
-
-```
-[ConfirmFirst? → ConfirmSafety]      ← 可选：先确认后校验
-  │
-  ▼
-ValidateRequired                     ← 有效值回退链校验
-  │
-  ▼
-ValidateConstraints                  ← 互斥/至少一个/恰好一个
-  │
-  ▼
-Validate hook                        ← 条件式业务校验（可选）
-  │
-  ▼
-BuildArgs                            ← flag → toolArgs 装配
-  │
-  ▼
-ConstParams 合并
-  │
-  ▼
-[!ConfirmFirst? → ConfirmSafety]     ← 默认顺序：校验后确认
-  │
-  ▼
-Invoke(ctx, toolArgs)                ← #830 过渡：单步派发
-  或 Orchestrate(ctx)                ← #830 过渡：多步编排
-```
-
-## 消费方式
-
-### LeafSpec（MCP 直连叶子命令）
-
-```go
-func newDevAppCreateCommand(runner executor.Runner) *cobra.Command {
-    return NewLeafCommand(LeafSpec{
-        Use:     "create",
-        Short:   "创建开放平台企业内部应用",
-        Tool:    devAppCreateTool,
-        Safety: contract.SafetySpec{
-            Effect: "write", Risk: "high",
-            Confirmation: "user_required", Idempotency: "unknown",
-        },
-        ConfirmFirst: true,
-        Flags: []LeafFlag{
-            {Name: "name", Usage: "应用名称 (必填)", Bind: "name",
-             Trim: true, Required: true, RequiredHint: "--name 为必填"},
-        },
-        Contract: ContractDecl{
-            Description: "创建开放平台企业内部应用",
-            DryRun:      &contract.DryRunSpec{PreviewKind: "invocation"},
-            Interface:   &contract.InterfaceSpec{Mode: "composite", Availability: "available", Reason: "create then configure"},
-            Selection: contract.SelectionSpec{
-                AgentSummary: "创建钉钉开放平台应用",
-                UseWhen:      []string{"需要新建企业内部应用"},
-                AvoidWhen:    []string{"应用已存在时用 update"},
-                Examples:     []string{`dws dev app create --name "Bot" --dry-run`},
-            },
-        },
-        Call: devAppCall(runner),
-    })
-}
-```
-
-`NewLeafCommand` 经 `FromLeafSpec()` 归一为 `corecmd.Spec`，再交 `corecmd.New()` 构建。这是**完全托管模式**：声明 + 执行都归 command。
-
-### 声明元数据模式（既有命令补 Contract）
-
-执行体必须冻结时，用同一套 `LeafSpec` 词汇只声明元数据，写在命令字面量旁：
-
-```go
-baseListCmd := &cobra.Command{
-    Use: "list", Short: "获取 AI 表格列表",
-    RunE: func(cmd *cobra.Command, args []string) error { /* 原执行体不动 */ },
-}
-DeclareLeafMetadata(baseListCmd, LeafSpec{
-    Safety: aitableSafetyRead(),
-    Contract: ContractDecl{
-        Description: "列出最近访问的 AI 表格 Base。",
-        Interface:   aitableMCPInterface("list_bases"),
-        Selection: contract.SelectionSpec{
-            AgentSummary: "列出最近访问的 AI 表格 Base。",
-            UseWhen:      []string{"只需浏览最近打开过的 Base 时"},
-            AvoidWhen:    []string{"按名称查找优先 base search"},
-            Examples:     []string{"dws aitable base list"},
-        },
-    },
-})
-```
-
-`DeclareLeafMetadata` 调用 `corecmd.AttachContract` 挂 Safety+Contract；不注册 flag、不接管参数投影。可选 `Validate` 与 `ConfirmSafety` 同挂在 **RunE 包装器**内（不是 PreRunE）。当 `Safety.Confirmation=user_required` 时，用**同一份** SafetySpec 包一层 `ConfirmSafety`，保证执行门禁与 Catalog 同源；无 Validate 时确认推迟到 gated `CallTool`，成功返回却未确认则 fail-closed。迁移态入口；新命令仍应走 `NewLeafCommand`。
-
-### 三档路径（当前可接受）
-
-| 档 | 入口 | 说明 |
-|---|---|---|
-| **Tier1** | `corecmd.New` / `NewLeafCommand` | 完全托管：声明 + 执行都归框架 |
-| **Tier2** | `DeclareLeafMetadata` | helpers 迁移态；**Shortcut 也可采用，可接受** |
-| **Tier3** | 裸 Cobra | 应逐步收；新增裸叶需补声明或精确排除 |
-
-长期展望（非当前硬要求）：更多 Shortcut 可收敛到 mcpbind / 减少仅为参数装配的 `Execute`。**不要**把「Shortcut 必须去掉 Execute / 必须 mcpbind」当作当前门禁；也不要否定 Shortcut + `DeclareLeafMetadata`。
-
-### Shortcut（智能快捷方式，已接入 live mount）
-
-```go
-func mount(s Shortcut) *cobra.Command {
-    return corecmd.New(FromShortcut(s))
-}
-
-spec := FromShortcut(Shortcut{
-    Service: "chat",
-    Command: "+demo",
-    Risk:    RiskHighWrite,
-    Flags:   []Flag{...},
-    Execute: func(rt *RuntimeContext) error { ... },
-})
-```
-
-Shortcut 当前仍保留自身的 `Risk`，adapter 只在边界将它展开成完整
-`contract.SafetySpec`；command/Leaf 不再保留该枚举。Shortcut 的 Cobra
-type/default/usage provenance 保持不变，command 统一补充 Required、Enum 和关系约束投影。
-需要补 Agent Schema 且执行体暂不迁入时，Shortcut 也可走 Tier2
-`DeclareLeafMetadata`（与 helpers 同一路径）。
-
-## 文件结构
-
-| 文件 / 包 | 职责 |
-|------|------|
-| `internal/corecmd/corecmd.go` | 核心类型 + `New` 构建器 + 运行时管线 |
-| `internal/corecmd/contract_decl.go` | ContractDecl 载荷类型 + 声明完整性守卫 |
-| `internal/corecmd/contract/` | 契约 DTO（`SafetySpec` / `ParamDecl` / `ProductDecl` / `ContractFinalPayload`）；**无** Cobra-keyed Final store |
-| `internal/corecmd/runtimeannotate/` | `AnnotateRuntime*` 写注解（框架侧；`cli` 薄 re-export） |
-| `internal/corecmd/contractfinal/` | ContractFinal Cobra store + `RegisterRuntimeContractFinal`（框架侧；`cli` 薄 re-export） |
-| `internal/cli/homology/` | flag/help/schema 同源门禁（`HOM-*`） |
-| `internal/helpers/leaf.go` | LeafSpec 门面：`NewLeafCommand`（完全托管）+ `DeclareLeafMetadata`（声明元数据） |
-| `internal/shortcut/adapter.go` | FromShortcut 完整映射与 Risk 兼容边界 |
-| `internal/shortcut/runner.go` | RuntimeContext；live mount 委托 `corecmd.New(FromShortcut(s))` |
-
-## Schema 投影
-
-声明即 review：代码中的 Contract 声明经过 code review 后直接投影为：
-
- **Agent Runtime Schema**（`dws.schema.*` Cobra annotations；经 `runtimeannotate` / ContractFinal 嵌入）
- **运行时组装的 SchemaRegistry / Catalog ToolSpec wire**（`RegisterSchemaSourceRoot` → `ResolveSchemaBuild`；`dws schema` / `--all` / 完整 leaf 载荷）
- **CommandMeta 投影**（装配 Once 同步缓存 `map[cli_path]CommandMeta`；`ResolveMeta` / `SafetyForCLIPath` / leaf `--help` Safety 稳态 O(1) 读缓存，与 SchemaRegistry 同源）
- **Dry-run Capabilities**（声明自动索引为 reviewed 能力）
-
-生产权威是 leaf `ContractFinal` / `ProductDecl`（经 `RegisterSchemaSourceRoot` → `ResolveSchemaBuild` 装配进 Catalog）；`InstallBuildTimeAgentMetadataJSON` 仅用于 `cmd_schema_catalog` 的 CI/local dump inject，不是生产交付路径。`schema_agent_metadata/` 与 `schema_hints/` 已退役。不再需要外部 hint 文件维护 selection/metadata/dry-run 信息。Catalog/meta-index 路径不得提交。
-
-## 设计原则
-
-1. **声明 vs 执行分离** — Flags/Constraints/Safety/Contract 是声明；Invoke/Validate/PostMount 是执行
-2. **单一数据源** — 一份声明驱动 --help、Schema、catalog、runtime 校验
-3. **安全字段不互推** — Confirmation 单独驱动确认，Effect/Risk/Idempotency 原样发布
-4. **构建时拦截 > 运行时报错** — 声明不完整在命令注册时 panic，不等到用户触发
-5. **边界兼容** — Shortcut 暂由 adapter 转换，Leaf 直接声明 SafetySpec
@@ -1,236 +0,0 @@
-# 命令框架对比：DWS command vs lark-cli vs GWS
-
-本文档对比 DWS（钉钉工作区 CLI）、lark-cli（飞书 CLI）和 GWS（Google Workspace CLI / gcloud）三套命令框架的设计差异。
-
-## 总览对比
-
-| 维度 | DWS (command) | lark-cli | GWS (gcloud) |
-|------|---------------|----------|--------------|
-| 语言 | Go | Go | Python (gcloud) / Go (部分) |
-| CLI 框架 | cobra | cobra | argparse + calliope |
-| 调用底座 | MCP JSON-RPC | Lark REST SDK (`CallAPITyped`) | Google API Client |
-| 命令层次 | 2 层：LeafSpec + Shortcut | 3 层：Shortcuts + API Commands + Raw API | 2 层：surface commands + raw |
-| Schema 来源 | 代码声明投影 | 代码声明 + 运行时 introspection | API Discovery 文档自动生成 |
-| Agent 适配 | 内建 (dws.schema.*) | 内建 (--print-schema) | 外挂 (MCP adapter) |
-
-## 架构对比
-
-### DWS command
-
-```
-corecmd.Spec (声明) → corecmd.New() → cobra.Command
-     │
-     ├── contract.SafetySpec (运行时 + Schema 单一安全来源)
-     ├── FlagSpec[] (参数 + 回退链 + 绑定)
-     ├── Constraint[] (互斥/至少一个)
-     ├── ContractDecl (Agent Selection/DryRun/Interface)
-     │
-     └── Invoke / Orchestrate / RunE (执行)
-```
-
-**核心特点**：
- 声明与执行严格分离
- SafetySpec 四个独立字段直接对齐 Agent Runtime Schema
- 有效值回退链：flag → alias → env → default
- 框架统一校验、装配、确认、投影
- Schema 从代码声明直接投影，无外部 hint 文件
-
-### lark-cli
-
-```
-Shortcut (声明) → runner.Mount() → cobra.Command
-     │
-     ├── Risk string (确认行为)
-     ├── Scopes / ConditionalScopes (OAuth 权限)
-     ├── Flag[] (参数 + Enum + Input sources)
-     ├── AuthTypes (user/bot)
-     │
-     ├── DryRun hook → DryRunAPI
-     ├── Validate hook
-     └── Execute hook → RuntimeContext → CallAPITyped
-```
-
-**核心特点**：
- Execute 内直接调 REST API (`CallAPITyped`)
- DryRun 是独立 hook（返回结构化 API 计划）
- 内建 OAuth scope 声明与预检
- `--print-schema --flag-name` 运行时 introspection
- 无 Schema 投影层，Agent 通过 introspection 动态发现
-
-### GWS (gcloud 风格)
-
-```
-API Discovery → 代码生成 → surface command
-     │
-     ├── arguments (从 JSON Schema 自动生成)
-     ├── request/response 映射
-     └── 自定义 action hook (少量)
-```
-
-**核心特点**：
- Schema-first：从 API Discovery 文档自动生成命令
- 参数直接映射 API 字段（flat schema）
- 人工 surface command 是 thin wrapper
- Agent 适配通过 MCP 外部 adapter
-
-## 核心设计差异
-
-### 1. 声明粒度
-
-| 能力 | DWS command | lark-cli | GWS |
-|------|-------------|----------|-----|
-| 参数别名 + 环境变量回退 | ✅ FlagSpec.Aliases + EnvVar | ❌ 无 | ❌ 无 |
-| 声明式约束 (互斥/至少一个) | ✅ Constraint[] | ❌ 只有 Validate hook | ✅ argparse group |
-| 安全契约 | ✅ SafetySpec（effect/risk/confirmation/idempotency） | Risk | 无 |
-| Schema 投影 (Agent metadata) | ✅ ContractDecl 内建 | ⚠️ 运行时 introspection | ❌ 外挂 |
-| 参数绑定 (flag name → API key) | ✅ FlagSpec.Bind | ❌ 手写 | ✅ 自动映射 |
-| ConstParams (固定载荷) | ✅ | ❌ 手写在 Execute | ✅ 隐式 |
-| 确认门顺序可配 (ConfirmFirst) | ✅ | ❌ 固定顺序 | ❌ 无确认机制 |
-
-### 2. 执行模型
-
-| 维度 | DWS command | lark-cli | GWS |
-|------|-------------|----------|-----|
-| 参数装配 | 框架自动 (BuildArgs) | 手写 (`runtime.Str()/Bool()`) | 自动映射 |
-| 派发方式 | Invoke(ctx, toolArgs) | Execute(ctx, runtime) | 自动调用 |
-| 多步编排 | Orchestrate(ctx) | Execute 内链式 CallAPITyped | 不支持 |
-| DryRun | 框架统一 (--dry-run flag) | 独立 DryRun hook 返回 API 计划 | 部分命令支持 |
-| 错误分类 | apperrors 类型化 | errs.Problem 类型化 | HTTP status 映射 |
-
-### 3. Agent 适配
-
-| 维度 | DWS command | lark-cli | GWS |
-|------|-------------|----------|-----|
-| 工具发现 | `dws schema --all` (静态 catalog) | `--print-schema` (运行时) | API Discovery |
-| 选择指引 | contract.SelectionSpec (UseWhen/AvoidWhen) | Description + Tips | 无 |
-| 安全声明 | contract.SafetySpec 直接声明 | Risk string | 无 |
-| dry-run 能力声明 | contract.DryRunSpec (reviewed) | DryRun hook 存在性 | 无 |
-| 接口模式 | contract.InterfaceSpec (local/mcp/composite) | 隐式 (全部 REST) | 隐式 (全部 REST) |
-
-### 4. Schema 生命周期
-
-```
-DWS:      代码声明 → code review → cobra annotation → catalog/metadata JSON
-          (单一数据源，构建时验证完整性)
-
-lark-cli: 代码声明 → 运行时 introspection → Agent 动态发现
-          (无离线 catalog，Agent 必须执行命令才能发现)
-
-GWS:      API Discovery JSON → 代码生成 → surface command
-          (Schema-first，但命令行体验受限于 API 形状)
-```
-
-## 设计哲学对比
-
-### DWS command 的选择
-
-| 选择 | 理由 | 对比 |
-|------|------|------|
-| 框架装配参数 | 消除 N 个命令各写一份 toolArgs 装配 | lark-cli 每个 Execute 手动取 flag 值 |
-| SafetySpec 单一来源 | confirmation 驱动运行时，其余字段原样发布且互不推导 | lark-cli 只有 Risk 一个维度 |
-| 声明式约束 | 构建时校验合法性 + 投影到 Schema + 渲染帮助 | lark-cli 约束隐藏在 Validate 逻辑里 |
-| Schema 构建时投影 | 离线 catalog 支持 Agent 批量发现 | lark-cli 需要逐个命令 introspection |
-| 有效值回退链 | flag → alias → env 统一语义 | lark-cli 别名是独立 Flag 手动关联 |
-| ConfirmFirst | 精确建模遗留语义 | lark-cli 确认始终在 Execute 内 |
-
-### lark-cli 的选择
-
-| 选择 | 理由 | 对比 |
-|------|------|------|
-| 直连 REST API | 精确控制请求/响应，可处理分页/重试 | DWS 通过 MCP 间接调用 |
-| DryRun 返回 API 计划 | Agent 可预览将要发出的真实 HTTP 请求 | DWS dry-run 只展示参数 |
-| OAuth scope 声明 | 框架预检权限，失败提前 | DWS 依赖 MCP 层鉴权 |
-| `--print-schema` introspection | 运行时发现，无需维护离线 catalog | DWS 需要 re-generate |
-| Input sources (file/@path/stdin) | 丰富的输入方式声明 | DWS 无此抽象 |
-| PrintFlagSchema | 单 flag 级别的 JSON Schema 暴露 | DWS 只在 catalog 级别 |
-
-### GWS (gcloud) 的选择
-
-| 选择 | 理由 | 对比 |
-|------|------|------|
-| API Discovery 驱动 | 一份 Schema 生成所有：SDK/CLI/文档 | DWS/lark 手写 |
-| Flat parameter 映射 | API 字段 = CLI flag，零转换 | DWS 需要 Bind 映射 |
-| 无 shortcut 层 | API 粒度即用户粒度 | DWS/lark 有精选层 |
-
-## 代码量对比
-
-| 框架 | 核心框架代码 | 单命令声明开销 | 备注 |
-|------|-------------|---------------|------|
-| DWS command | ~1400 行 (command.go + contract_decl.go) | ~20-30 行 (纯声明) | 框架重、单命令轻 |
-| lark-cli | ~800 行 (runner.go + types.go + common.go) | ~50-150 行 (声明 + Execute 逻辑) | 框架轻、单命令重 |
-| GWS gcloud | ~5000+ 行 (calliope 框架) | ~10 行 (多数自动生成) | 框架最重、单命令最轻 |
-
-## DWS 命令声明示例 vs lark-cli
-
-### DWS (command / LeafSpec)
-
-```go
-NewLeafCommand(LeafSpec{
-    Use:    "create",
-    Short:  "创建应用",
-    Tool:   "create_dev_app",
-    Safety: contract.SafetySpec{
-        Effect: "write", Risk: "high",
-        Confirmation: "user_required", Idempotency: "unknown",
-    },
-    ConfirmFirst: true,
-    Flags: []LeafFlag{
-        {Name: "name", Usage: "应用名称", Bind: "name",
-         Trim: true, Required: true, RequiredHint: "--name 为必填"},
-    },
-    Contract: ContractDecl{
-        Description: "创建开放平台企业内部应用",
-        DryRun:    &contract.DryRunSpec{PreviewKind: "invocation"},
-        Interface: &contract.InterfaceSpec{Mode: "composite", Availability: "available", Reason: "create then configure"},
-        Selection: contract.SelectionSpec{
-            AgentSummary: "创建钉钉开放平台应用",
-            UseWhen:      []string{"需要新建企业内部应用"},
-            AvoidWhen:    []string{"应用已存在时用 update"},
-            Examples:     []string{`dws dev app create --name "Bot" --dry-run`},
-        },
-    },
-    Call: devAppCall(runner),
-})
-```
-
-### lark-cli (Shortcut)
-
-```go
-var CalendarCreate = common.Shortcut{
-    Service:     "calendar",
-    Command:     "+create",
-    Description: "Create a new calendar event",
-    Risk:        "write",
-    Scopes:      []string{"calendar:calendar"},
-    Flags: []common.Flag{
-        {Name: "summary", Desc: "Event title", Required: true},
-        {Name: "start", Desc: "Start time (RFC3339)", Required: true},
-        {Name: "end", Desc: "End time (RFC3339)", Required: true},
-        {Name: "attendees", Type: "string_slice", Desc: "Attendee emails"},
-    },
-    DryRun: func(ctx context.Context, rt *common.RuntimeContext) *common.DryRunAPI {
-        return &common.DryRunAPI{
-            Method: "POST",
-            Path:   "/open-apis/calendar/v4/calendars/{id}/events",
-            Body:   buildEventBody(rt),
-        }
-    },
-    Execute: func(ctx context.Context, rt *common.RuntimeContext) error {
-        body := buildEventBody(rt)
-        data, err := rt.CallAPITyped("POST",
-            "/open-apis/calendar/v4/calendars/{id}/events", nil, body)
-        if err != nil { return err }
-        return rt.Output(data)
-    },
-}
-```
-
-## 适用场景总结
-
-| 场景 | 最适合 | 原因 |
-|------|--------|------|
-| MCP 后端 + Agent Schema 投影 | **DWS command** | 内建 Schema 声明、SafetySpec 契约、离线 catalog |
-| REST API 直连 + OAuth scope 管理 | **lark-cli** | CallAPITyped + scope 预检 + DryRun API 计划 |
-| API-first 大规模 surface 生成 | **GWS gcloud** | Discovery 驱动，一份 Schema 生成一切 |
-| 多步编排 (跨服务链式调用) | **lark-cli** / DWS Orchestrate | lark 的 CallAPITyped 链式 + DWS 的 Orchestrate |
-| 遗留系统迁移 (保持行为等价) | **DWS command** | ConfirmFirst + 回退链 + catalog 漂移门禁 |
@@ -3,7 +3,7 @@
 Every runtime command the `dws` CLI exposes when loaded with the **pre** environment configuration.

 - **Products**: 13
- **Total commands**: 163
+- **Total commands**: 160
 - **Generated from**: `internal/plugin` command descriptors — the same code path the CLI uses at runtime.

 > Auto-generated. Update plugin descriptors in `internal/plugin/`, not this file.
@@ -33,14 +33,14 @@ Every command inherits these flags (documented here once, not repeated per comma
 - [`dws aitable` — AI Tables](#dws-aitable) · 41 commands
 - [`dws attendance` — Attendance](#dws-attendance) · 4 commands
 - [`dws calendar` — Calendar](#dws-calendar) · 14 commands
- [`dws chat` — Group Chat / IM](#dws-chat) · 26 commands
+- [`dws chat` — Group Chat / IM](#dws-chat) · 23 commands
 - [`dws contact` — Contact Directory](#dws-contact) · 6 commands
 - [`dws devdoc` — Open Platform Docs](#dws-devdoc) · 2 commands
 - [`dws ding` — DING Messages](#dws-ding) · 2 commands
 - [`dws doc` — DingTalk Doc](#dws-doc) · 21 commands
 - [`dws drive` — DingTalk Drive](#dws-drive) · 6 commands
 - [`dws minutes` — AI Minutes](#dws-minutes) · 19 commands
- [`dws oa` — OA Approval](#dws-oa) · 12 commands
+- [`dws oa` — OA Approval](#dws-oa) · 9 commands
 - [`dws report` — Reports](#dws-report) · 7 commands
 - [`dws todo` — Todo Tasks](#dws-todo) · 6 commands

@@ -134,15 +134,12 @@ _Calendar events, participants, meeting rooms, and busy-status queries._

 _Group chats, conversations, messages, and robot/webhook integrations._

-**26 commands**
+**23 commands**

 | Command | Description | When to use |
 |---|---|---|
 | `dws chat bot search` | Search robots (bots) created by the current user by keyword. | When the agent needs to resolve one of its own bots by name to a robot code before sending bot messages. |
 | `dws chat conversation-info` | Retrieve basic metadata for a conversation (single chat or group chat) by conversation ID. | When the agent needs context about a conversation (name, type, member count) before operating on it. |
-| `dws chat emotion favorite` | Add a media ID to the current user's personal favorite emotions. | When the agent needs to save an available mediaId as a reusable personal emotion, optionally preserving source message context. |
-| `dws chat emotion list` | List the current user's personal favorite emotions. | When the agent needs to inspect available personal emotions or resolve an emotionId/mediaId before sending. |
-| `dws chat emotion send` | Send a personal favorite emotion to a group or direct chat as the authenticated user. | When the agent needs to send a known personal emotion mediaId to exactly one group, userId, or openDingTalkId target. |
 | `dws chat group create` | Create a new internal group chat with a set of initial members. | When the agent needs to spin up a dedicated group for a new project, incident, or discussion thread. |
 | `dws chat group members` | List members of a group chat; can also be used against the current user to enumerate their groups' members. | When the agent needs the roster of a group before mentioning, removing, or auditing members. |
 | `dws chat group members add` | Add one or more users to an existing group chat. | When the agent expands a group to include additional participants. |
@@ -280,17 +277,14 @@ _AI meeting notes: listing, summary, todos, transcription, recording control, mi

 ## `dws oa` — OA Approval

-_OA approval workflows: inspect forms, forecast routes, create instances, approve, reject, revoke, and audit records._
+_OA approval workflows: list, approve, reject, revoke, records._

-**12 commands**
+**9 commands**

 | Command | Description | When to use |
 |---|---|---|
 | `dws oa approval approve` | Approve a pending approval process instance (task) as the current user. | When the agent acts on a pending approval the user has delegated it to handle. |
-| `dws oa approval create-instance` | Create a real approval process instance from validated form values or a complete request payload. | After the agent has inspected the form Schema, forecast the route, resolved any selectable approvers, and obtained explicit user confirmation. |
 | `dws oa approval detail` | Retrieve full details of an approval process instance, including form fields, attachments, and state. | When the agent needs to read the content of an approval ticket before deciding on it or summarizing it. |
-| `dws oa approval form-schema` | Retrieve the form Schema for an approval template by processCode. | Before collecting or validating values for a new approval instance. |
-| `dws oa approval forecast-process` | Forecast the approval route for a template and its proposed form values. | Before creating an instance, especially when the route contains user-selectable approver or notifier nodes. |
 | `dws oa approval list-forms` | List approval process templates (forms) the current user is allowed to initiate. | When the agent needs to pick the right approval form before submitting a new request. |
 | `dws oa approval list-initiated` | List approval process instances the current user has initiated. | When the agent reviews the status of approvals the user submitted. |
 | `dws oa approval list-pending` | List approval process instances currently awaiting action from the current user. | When the agent surfaces "needs your approval" items in the user's inbox. |
@@ -1,454 +0,0 @@
-# AI 表格数据源指令使用指南
-
-## 概述
-
-dws 新增了 7 个 AI 表格数据源同步管理指令，用于将外部数据源（一期支持审批数据）接入 AI 表格，实现数据的自动同步。
-
-所有指令均通过 `dws aitable +datasource-*` 前缀调用，操作对象是 AI 表格中的"数据源表"——一种由数据源同步创建的特殊数据表。
-
-## 指令速览
-
-| 指令 | 用途 | 读写 | 风险 |
-|------|------|------|------|
-| `+datasource-list-sources` | 列出数据源类型可用的来源信息（OA 返回 result/processCode、sourceType、sourceUrl） | 读 | low |
-| `+datasource-get-fields` | 获取数据源来源的可同步字段结构 | 读 | low |
-| `+datasource-create` | 创建数据源表并触发首次同步 | 写 | medium |
-| `+datasource-update` | 更新已有数据源表的同步配置 | 写 | medium |
-| `+datasource-sync` | 手动触发一次同步 | 写 | medium |
-| `+datasource-sync-status` | 查询同步任务状态 | 读 | low |
-| `+datasource-get-config` | 查看数据源表配置 | 读 | low |
-
-## 前置条件
-
-1. **登录认证**：执行 `dws auth login` 确保已登录
-2. **获取 Base ID**：通过 `dws aitable +base-list` 或 `dws aitable +base-search --query "关键词"` 获取目标 AI 表格的 Base ID
-
---
-
-## 1. 列出数据源可用来源
-
-```
-dws aitable +datasource-list-sources [flags]
-```
-
-列出指定数据源类型可用的来源信息。OA 审批类型返回当前 Base 可用的审批数据源条目（`sources` 数组，当前通常为单条），用于构造 `+datasource-create` / `+datasource-update` / `+datasource-get-fields` 的 `--source-config`。OA 场景下每条 source 的 `result` 字段是 JSON 字符串，需解析后得到 `approvals` 数组，再从中提取目标模板的 `processCode`、`name`、`iconUrl`、`url`。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--datasource-type` | string | 是 | 数据源类型，目前支持审批（OA） |
-
-### 示例
-
-```bash
-# 列出审批数据源来源，获取 result（JSON，解析后得到 approvals[].processCode）
-dws aitable +datasource-list-sources \
-  --base-id BASE123 \
-  --datasource-type OA
-```
-
-### 返回值
-
-返回 `sources` 数组，每个条目包含：
-
-| 字段 | 说明 |
-|------|------|
-| `result` | OA 审批场景为 JSON 字符串，解析后得到 `approvals` 数组；每个 approval 含 `processCode`、`name`、`iconUrl`、`url` |
-| `sourceType` | 数据源类型编号（OA 对应内部枚举值 2） |
-| `sourceUrl` | 数据源访问链接，可选 |
-
-`result` 本身不是 `processCode`，需要解析出 `approvals` 数组，再取目标模板的 `processCode`、`name`、`iconUrl`、`url` 原样填入 `--source-config`。
-
---
-
-## 2. 获取数据源可同步字段
-
-```
-dws aitable +datasource-get-fields [flags]
-```
-
-获取指定数据源来源（如某个审批模板）的可同步字段列表，包括字段 ID、字段名称、字段类型和是否主键等信息。用于创建数据源前选择需要同步的字段。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--datasource-type` | string | 是 | 数据源类型，目前支持审批（OA） |
-| `--source-config` | string | 是 | 源配置 JSON 字符串，结构同 `+datasource-create` 的 `--source-config` |
-
-### 示例
-
-```bash
-# 获取某审批模板的可同步字段
-dws aitable +datasource-get-fields \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-```
-
-### 返回值
-
-返回可同步字段列表，每个字段包含字段 ID、名称、类型和是否主键。字段 ID 可用于 `+datasource-create` / `+datasource-update` 的 `--field-ids` 参数。
-
---
-
-## 3. 创建数据源表
-
-```
-dws aitable +datasource-create [flags]
-```
-
-为指定 AI 表格创建数据源同步配置，自动创建一张数据源表并触发首次全量同步。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID（通过 `+base-list` / `+base-search` 获取） |
-| `--datasource-type` | string | 是 | 数据源类型，目前支持审批（OA） |
-| `--source-config` | string | 是 | 源配置 JSON 字符串（格式见下方） |
-| `--auto` | bool | 否 | 是否开启自动同步，默认 false；无论是否传入，CLI 都会把该字段下发给下游 |
-| `--auto-sync-setting` | string | 否 | 自动同步频率配置 JSON 字符串，仅在 `--auto=true` 时生效，格式见下方 |
-| `--field-ids` | stringSlice | 否 | 需要同步的字段 ID 列表，不传时同步全部字段 |
-
-### source-config 格式（审批类）
-
-审批数据源的 `--source-config` 是一个 JSON 对象字符串，包含以下字段：
-
-| 字段 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `processCode` | string | 是 | 审批模板编码，对应 `+datasource-list-sources` 返回的 `result` |
-| `name` | string | 是 | 数据源展示名称，须从 `+datasource-list-sources` 结果原样透传 |
-| `iconUrl` | string | 是 | OA 审批图标 URL，须从 `+datasource-list-sources` 结果原样透传 |
-| `url` | string | 是 | OA 审批跳转链接，须从 `+datasource-list-sources` 结果原样透传 |
-| `dataType` | string | 是 | 数据时间范围类型：`time_range` / `start_time` / `recent_time` |
-| `recentDays` | string | 当 dataType=recent_time 时必填 | 近 N 天：`7d` / `30d` / `1y` |
-| `startDate` | string | 当 dataType=time_range 或 start_time 时必填 | 起始日期，格式 `yyyy-MM-dd` |
-| `endDate` | string | 当 dataType=time_range 时必填 | 结束日期，格式 `yyyy-MM-dd` |
-| `keepRemovedFields` | bool | 否 | 是否保留已删除字段，默认 false |
-
-> 注：`splitParentTableField`、`enableDataSyncOaDetailList` 等字段为下游内部字段，无需传入，下游自动处理。
-
-按 `dataType` 选择对应的时间参数组合：
-
-| dataType | 需要的时间字段 | 说明 |
-|----------|----------------|------|
-| `recent_time` | `recentDays` | 同步近 N 天数据（7d/30d/1y） |
-| `start_time` | `startDate` | 同步从某日期至今的数据 |
-| `time_range` | `startDate` + `endDate` | 同步指定日期范围内的数据 |
-
-### auto-sync-setting 格式
-
-`--auto-sync-setting` 仅在 `--auto=true` 时生效，用于指定自动同步频率。不传时使用下游默认策略。
-
-| 字段 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `syncType` | string | 是 | `hourly`（按小时间隔）/ `scheduled`（定时触发） |
-| `hourlyInterval` | int | hourly 时必填 | 正整数，小时间隔 |
-| `scheduleType` | string | scheduled 时必填 | `daily` / `weekly` / `monthly` |
-| `timeValue` | string | scheduled 时必填 | 触发时间，格式 `HH:mm` |
-| `selectedMonthDays` | int[] | monthly 时必填 | 每月几号触发，1-31 |
-| `selectedWeekdays` | int[] | weekly 时必填 | 每周哪几天触发，1=周一…7=周日 |
-| `skipNonWorkingDay` | bool | 否 | 是否跳过非工作日，默认 false |
-
-示例：`{"syncType":"scheduled","scheduleType":"daily","timeValue":"09:00"}`
-
-### 示例
-
-```bash
-# 基本创建——同步近 30 天审批数据
-dws aitable +datasource-create \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-
-# 指定日期范围创建并开启自动同步
-dws aitable +datasource-create \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"time_range","startDate":"2025-01-01","endDate":"2025-12-31","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}' \
-  --auto
-
-# 指定同步字段（仅同步部分字段，field-ids 可通过 +datasource-get-fields 获取）
-dws aitable +datasource-create \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}' \
-  --field-ids fldAAA,fldBBB,fldCCC
-```
-
-### 返回值
-
-创建成功后返回新建数据源表 ID 和同步任务 ID，后续操作需要用到这两个 ID。
-
---
-
-## 4. 更新数据源配置
-
-```
-dws aitable +datasource-update [flags]
-```
-
-更新已有数据源表的同步配置，支持更新源配置、自动同步开关和同步字段选择。更新后会自动触发一次同步。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--table-id` | string | 是 | 已存在的数据源表 ID（由 `+datasource-create` 返回） |
-| `--source-config` | string | 否 | 新的源配置 JSON 字符串，不传时保持原有配置。结构同 `+datasource-create` |
-| `--auto` | bool | 否 | 是否开启自动同步；仅显式设置时下发给下游，省略时保持原有自动同步开关不变 |
-| `--auto-sync-setting` | string | 否 | 自动同步频率配置 JSON 字符串，仅在显式设置 `--auto=true` 时生效；省略时保持原频率配置 |
-| `--field-ids` | stringSlice | 否 | 需要同步的字段 ID 列表，不传时保持现有字段配置 |
-
-### 示例
-
-```bash
-# 更换审批模板并调整时间范围
-dws aitable +datasource-update \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --source-config '{"processCode":"PROC-YYYY","name":"出差申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-
-# 开启自动同步
-dws aitable +datasource-update \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --auto
-
-# 更新同步字段范围
-dws aitable +datasource-update \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --field-ids fldAAA,fldDDD
-```
-
-> 注意：`--table-id` 指向的是数据源表（由 `+datasource-create` 创建），不是普通数据表。
-
---
-
-## 5. 触发手动同步
-
-```
-dws aitable +datasource-sync [flags]
-```
-
-对已有数据源表触发一次手动同步。单次最多 5 张表，每张表独立提交，部分失败不影响其他表。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--table-ids` | stringSlice | 是 | 待触发同步的数据源表 ID 列表（1-5 个） |
-
-### 示例
-
-```bash
-# 同步单张表
-dws aitable +datasource-sync \
-  --base-id BASE123 \
-  --table-ids TBL1
-
-# 批量同步多张表（逗号分隔，最多 5 个）
-dws aitable +datasource-sync \
-  --base-id BASE123 \
-  --table-ids TBL1,TBL2,TBL3
-```
-
-### 返回值
-
-返回每个表的同步任务 ID，可通过 `+datasource-sync-status` 查询最终结果。
-
---
-
-## 6. 查询同步状态
-
-```
-dws aitable +datasource-sync-status [flags]
-```
-
-按任务 ID 查询数据源表的同步任务状态。与 `+datasource-sync` / `+datasource-create` / `+datasource-update` 配对使用——这些指令触发同步后返回任务 ID，本指令通过任务 ID 查询最终结果。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--table-id` | string | 是 | 数据源表 ID |
-| `--task-ids` | stringSlice | 是 | 待查询的同步任务 ID 列表（1-5 个） |
-
-### 示例
-
-```bash
-# 按任务 ID 查询（批量，最多 5 个）
-dws aitable +datasource-sync-status \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --task-ids TASK1,TASK2
-```
-
---
-
-## 7. 获取数据源配置
-
-```
-dws aitable +datasource-get-config [flags]
-```
-
-获取指定数据源表的同步配置信息，包括源配置、同步模式、自动同步开关和同步状态。
-
-### 参数
-
-| 参数 | 类型 | 必填 | 说明 |
-|------|------|------|------|
-| `--base-id` | string | 是 | 目标 Base ID |
-| `--table-id` | string | 是 | 数据源表 ID |
-
-### 示例
-
-```bash
-dws aitable +datasource-get-config \
-  --base-id BASE123 \
-  --table-id TBL456
-```
-
---
-
-## 典型工作流
-
-### 场景一：从零接入审批数据
-
-```bash
-# 0. 获取 Base ID
-dws aitable +base-search --query "我的项目表"
-
-# 1. 列出可用审批数据源来源，解析 result JSON 获取 approvals[].processCode
-dws aitable +datasource-list-sources \
-  --base-id BASE123 \
-  --datasource-type OA
-# → 返回 sources[0].result 为 JSON 字符串，解析后取 approvals[0].processCode=PROC-XXXX
-
-# 2. 查看可同步字段（可选，用于指定 field-ids）
-dws aitable +datasource-get-fields \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-
-# 3. 创建数据源表（创建后自动触发首次同步）
-dws aitable +datasource-create \
-  --base-id BASE123 \
-  --datasource-type OA \
-  --source-config '{"processCode":"PROC-XXXX","name":"采购申请","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-# → 返回 tableId=TBL456, taskId=TASK001
-
-# 4. 查询首次同步是否完成
-dws aitable +datasource-sync-status \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --task-ids TASK001
-
-# 5. 确认配置
-dws aitable +datasource-get-config \
-  --base-id BASE123 \
-  --table-id TBL456
-```
-
-### 场景二：更换审批模板后重新同步
-
-```bash
-# 1. 更新源配置（更新后自动触发一次同步）
-dws aitable +datasource-update \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --source-config '{"processCode":"PROC-NEW","name":"新审批模板","dataType":"recent_time","recentDays":"30d","iconUrl":"https://example.com/icon.png","url":"https://example.com/oa"}'
-
-# 2. 查询同步状态（更新后会返回新的 taskId）
-dws aitable +datasource-sync-status \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --task-ids TASK002
-```
-
-### 场景三：手动触发日常同步
-
-```bash
-# 仅触发同步，不修改配置
-dws aitable +datasource-sync \
-  --base-id BASE123 \
-  --table-ids TBL456
-
-# 查询结果（sync 会返回 taskId）
-dws aitable +datasource-sync-status \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --task-ids TASK001
-```
-
-### 场景四：开启自动同步后确认
-
-```bash
-# 1. 更新配置，开启自动同步
-dws aitable +datasource-update \
-  --base-id BASE123 \
-  --table-id TBL456 \
-  --auto
-
-# 2. 确认配置已更新
-dws aitable +datasource-get-config \
-  --base-id BASE123 \
-  --table-id TBL456
-# → 返回中应显示 auto=true
-```
-
---
-
-## 通用选项
-
-以下全局选项可在所有指令中使用：
-
-| 选项 | 说明 |
-|------|------|
-| `-f, --format` | 输出格式：json（默认）/ table / raw / pretty / ndjson / csv |
-| `--jq` | jq 表达式过滤输出（如 `.tableId` 或 `.status`） |
-| `--fields` | 筛选输出字段（逗号分隔） |
-| `--dry-run` | 预览操作内容，不实际执行 |
-| `--profile` | 指定组织或账号 |
-| `--timeout` | HTTP 请求超时时间（秒，默认 30） |
-| `--debug` | 显示调试日志 |
-| `-v, --verbose` | 显示详细日志 |
-
-### 输出过滤示例
-
-```bash
-# 只取 tableId
-dws aitable +datasource-create ... --jq '.tableId'
-
-# 只取同步状态
-dws aitable +datasource-sync-status ... --jq '.status'
-
-# table 格式查看
-dws aitable +datasource-get-config ... -f table
-```
-
---
-
-## 注意事项
-
-1. **推荐流程**：先 `+datasource-list-sources` 解析 `result` JSON 获取 `approvals[].processCode`，再 `+datasource-get-fields` 查看可同步字段，最后 `+datasource-create` 创建数据源表。
-
-2. **数据源表 vs 普通数据表**：`+datasource-create` 创建的是"数据源表"，它由数据源同步驱动数据写入。`+datasource-update` 和 `+datasource-sync` 仅适用于数据源表，不可对普通数据表使用。
-
-3. **datasource-type 透传**：CLI 层不对 `--datasource-type` 做枚举校验，目前一期仅支持 `OA`（审批）。后续支持其他类型时由服务端控制，CLI 无需修改。
-
-4. **source-config 格式**：`--source-config` 必须是合法 JSON 字符串。审批数据源需要原样透传 `processCode`（从 `+datasource-list-sources` 返回的 `result` JSON 中解析 `approvals[]` 提取）、`name`、`iconUrl`、`url`，设置 `dataType`（时间范围类型），并按 `dataType` 提供对应的时间参数（`recentDays` / `startDate` / `endDate`）。
-
-5. **同步限制**：`+datasource-sync` 单次最多 5 张表；`+datasource-sync-status` 单次最多查询 5 个任务 ID。
-
-6. **创建即同步**：`+datasource-create` 和 `+datasource-update` 在操作完成后会自动触发一次同步，无需额外调用 `+datasource-sync`。
-
-7. **自动同步**：`--auto` 开启后，数据源表会按 `--auto-sync-setting` 指定的频率自动定期同步；未指定频率时使用服务端默认策略。关闭 `--auto` 后仅能通过 `+datasource-sync` 手动触发。
@@ -1,7 +1,7 @@
 # dws dev 命令集 · Agent 人肉手工评测集（10 条复合用例）

 > 性质：**人肉手工评测集**——由测评人逐条手工跑、肉眼核对、人工判分，不是自动化脚本。
-> 用途：评测 agent（加载 `dingtalk-misc` 的 `references/devapp.md` 后）能否正确处理开放平台 dev 任务。
+> 用途：评测 agent（加载 `dingtalk-dev` 技能后）能否正确处理开放平台 dev 任务。
 > 特点：10 条**复合用例**，每条串多个子任务，一条覆盖一类完整场景；10 条合起来覆盖全部 34 个子命令 + 8 类横切行为。
 > 约定：所有命令应带 `--format json`；写操作应先 `--dry-run` 预览、用户确认后再 `--yes`；应用定位只用 `--unified-app-id`。

@@ -6,7 +6,7 @@

 ## 一键安装

-`dws dev` 能力已经合入主干并随正式版发布。专用安装脚本会下载预编译二进制 + `dingtalk-misc` skill（开放平台应用文档落在 misc），**只需要 curl + tar，不需要 git / go / make**。
+`dws dev` 能力已经合入主干并随正式版发布。专用安装脚本会下载预编译二进制 + `dingtalk-dev` skill，**只需要 curl + tar，不需要 git / go / make**。

 ### macOS / Linux

@@ -24,7 +24,7 @@ irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/ma

 1. 从 `DingTalk-Real-AI/dingtalk-workspace-cli` 的最新 Release 下载对应平台的预编译二进制。
 2. 安装 `dws` 到默认目录 `~/.local/bin`。
-3. 从 Release 的 skills 包里安装 `dingtalk-misc` skill 到本机已检测到的 Agent 目录。
+3. 从 Release 的 skills 包里安装 `dingtalk-dev` skill 到本机已检测到的 Agent 目录。

 支持这些环境变量（全部可选）：

@@ -33,7 +33,7 @@ irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/ma
 | `DEVAPP_REPO` | 覆盖发布仓库，默认 `DingTalk-Real-AI/dingtalk-workspace-cli` |
 | `DEVAPP_VERSION` | 钉某个 release tag，默认取最新 release |
 | `DWS_INSTALL_DIR` | 二进制安装目录，默认 `~/.local/bin` |
-| `DWS_NO_SKILLS` | 设为 `1` 跳过 `dingtalk-misc` skill 安装 |
+| `DWS_NO_SKILLS` | 设为 `1` 跳过 `dingtalk-dev` skill 安装 |

 > `dws dev` 已在正式版里，所以你也可以直接用标准安装脚本 `install.sh`，二者都会带上 `dws dev`。

@@ -0,0 +1,301 @@
+# IM Chat Skill 精简与渐进加载优化方案
+
+## 1. 背景
+
+当前 `im-chat-skill-hint-align` 分支已经增强了 Chat Skill 的 Shortcut 路由、执行骨架、身份边界、查询与资源处理、低频原子回退和错误导航。与 Lark IM Skill 对比后，DWS 在 Agent 路由和执行约束上更直接，但根 Skill 仍存在以下问题：
+
+- 高频执行骨架与核心意图表重复。
+- Runtime Shortcut Catalog、leaf Schema 和 leaf Help 的读取规则在多处重复。
+- Shortcut 错误处理与 Workflow 错误导航重复。
+- 身份、ID 和三种置顶对象的边界分散在不同章节。
+- 缺少简短、集中且可复用的核心对象与查询结果语义。
+- Frontmatter 能力召回仍可扩展，但不能削弱 DING、邮件和班级群等产品边界。
+
+本方案只调整根文件 `skills/multi/dingtalk-chat/SKILL.md` 的组织和必要语义，不把 API 手册、完整 Shortcut 清单或权限表重新放回根 Skill。
+
+## 2. 修改目标
+
+1. 提高高频 Chat 意图的直接命中率，减少不必要的 Catalog、Schema 和 `--help` 调用。
+2. 提前建立渐进加载顺序，避免模型在高频任务中优先进入原子命令树。
+3. 补齐身份、核心对象、ID 和查询结果的必要语义，降低错误重试和 ID 混用。
+4. 合并重复 SOP，确保新增内容不会增加根 Skill 的总体 token。
+5. 保持参数、安全和完整 API 事实由 leaf Schema、Help 和 references 按需提供。
+
+## 3. 设计原则
+
+### 3.1 根 Skill 只保留决策必需信息
+
+根 Skill 应负责：
+
+- Skill 触发范围和跨产品排除边界。
+- 渐进加载与能力选择顺序。
+- 高频意图到精确 Shortcut 的映射。
+- 身份、ID、幂等、分页、部分失败等跨命令不变量。
+- 低频能力的导航入口。
+- 错误恢复和停止条件。
+
+以下内容继续留在 Schema 或 references：
+
+- 完整 Shortcut Catalog。
+- API Resources 全量列表。
+- 权限 scope 表。
+- 叶级参数全集和接口字段格式。
+- 只服务单个命令的实现细节。
+
+### 3.2 渐进加载规则必须早于命令骨架
+
+模型应在看到具体命令前，先知道何时直接执行、何时才加载额外上下文。但完整一级命令树不应提前，以免低频原子命令干扰高频 Shortcut 选择。
+
+### 3.3 同一事实只保留一个权威位置
+
+- 高频 Shortcut 只出现在一张核心意图表中。
+- Catalog、Schema 和 Help 的读取顺序只定义一次。
+- 错误恢复与 reference 导航只定义一次。
+- 身份、对象和 ID 的公共边界集中定义，后续章节只引用，不重复解释。
+
+## 4. 目标章节结构
+
+```text
+1. Frontmatter
+2. Preconditions
+3. 加载与路由顺序
+4. 核心对象与 ID
+5. 核心意图与执行骨架
+6. 统一发送
+7. 查询、资源与卡片
+8. 低频原子路由
+   ├── 一级命令树
+   ├── branch references
+   └── 低频操作回退表
+9. 错误恢复与按需 Reference
+10. 跨产品协作
+```
+
+## 5. 具体修改
+
+### 5.1 扩展 Frontmatter 产品能力
+
+扩展 `description` 的正向能力召回，覆盖：
+
+- 单聊、群聊、建群、群搜索和群成员管理。
+- 消息发送、回复、转发、撤回、查询和聊天记录搜索。
+- 图片、文件和消息资源下载。
+- 表情回应、收藏、Pin、消息置顶和会话置顶。
+- 应用机器人、Webhook 和互动卡片。
+- 未读、红点、消息已读状态和会话分类。
+
+同时保留明确排除：
+
+- DING、短信和电话转到 `dingtalk-ding`。
+- 邮件转到 `dingtalk-mail`。
+- 班级群转到对应的低频产品 Skill。
+- 找人本身由 `dingtalk-contact` 或 `dingtalk-aisearch` 负责，Chat 只消费真实人员 ID。
+
+Frontmatter 只描述真实能力和路由边界，不加入参数、SOP 或 token 实现细节。
+
+### 5.2 前移并合并渐进加载规则
+
+将现有“Shortcut 发现”“Shortcut 执行契约”和“渐进加载与一级路由”的加载决策部分合并为紧随 Preconditions 的唯一章节：
+
+```markdown
+## 加载与路由顺序
+
+1. 已知高频意图：直接使用“核心意图与执行骨架”，不查 Help。
+2. 已有匹配 Shortcut：直接执行；参数、约束或安全不确定时才查 leaf Schema。
+3. 仅 Cobra flags 不确定时查 leaf `--help`。
+4. 现有路由无法定位低频能力时，才查 Runtime Shortcut Catalog。
+5. 没有 Shortcut 时，按需读取对应 branch reference，进入原子命令。
+```
+
+同一章节保留以下公共规则：
+
+- 路由优先级为 `exact recipe/runnable script > public Shortcut > atomic command`。
+- 不猜测 `cli_path` 或参数名称。
+- `confirmation=user_required` 时先确认，再添加 `--yes`。
+- 来源冲突时采用更安全的解释并报告契约漂移。
+- 命令已确定且参数清楚时直接执行，不为验证已知路径重复发现。
+
+删除其他章节重复出现的 Catalog、Schema、Help 选择说明。
+
+### 5.3 新增“核心对象与 ID”小表
+
+增加不超过 8 行的表格，集中表达：
+
+| 对象 | 核心标识与边界 |
+|---|---|
+| 人员 | 姓名必须先解析成唯一真实的 `userId` 或 `openDingTalkId`，名称不能作为 ID 传递 |
+| 会话 | 使用真实 `openConversationId` / cid；群名只能用于 Shortcut 的目标解析 |
+| 消息 | 使用真实 `openMessageId` / msgId，并保持与身份及会话一致 |
+| 发送任务 | `openTaskId` 只用于查询发送状态，不能替代消息 ID |
+| Thread | thread/topic ID 必须绑定真实会话，不跨会话复用 |
+| 身份 | current-user、app-bot 和 Webhook 是不同操作者，不能自动互换 |
+| 状态 | 收藏、消息置顶、消息 Pin 和会话置顶作用于不同对象 |
+
+新增后删除后文对这些边界的重复说明。
+
+### 5.4 合并高频骨架与核心意图表
+
+删除独立的“高频直接执行骨架”，将其全部合入唯一的“核心意图与执行骨架”表。表格固定为三列：
+
+| 用户意图 | 精确 Shortcut 骨架 | 必须保留的执行边界 |
+|---|---|---|
+
+至少覆盖以下高频场景：
+
+- 姓名发单聊、群名发群消息。
+- user、bot、webhook 三种身份发送。
+- 建群、改群名、拉人和成员查询。
+- 拉取会话消息、查询详情、撤回和发送状态。
+- 关键词搜索、组合搜索和查询 @ 我的消息。
+- 群邀请链接和群机器人。
+- 会话置顶和收藏列表。
+- 查和某人的聊天记录。
+- 群消息翻页导出。
+- 机器人多群广播。
+
+表中直接给出正确参数骨架；命中后照抄参数名，不先调用 `--help`。同一个 Shortcut 不再在其他表中重复列出。
+
+### 5.5 补充统一身份规则
+
+在“统一发送”开头加入统一规则：
+
+> 身份决定真实操作者、可见范围和可用能力；同一目标使用 user、bot 或 webhook 时，结果和权限可能不同，禁止自动切换身份重试。
+
+继续保留：
+
+- 发送前检查身份、目标、正文、标题、@、消息类型和附件路径。
+- 重试复用相同 `--idempotency-key`。
+- user、bot、webhook 的精确发送模板。
+- @ 占位符、新行和文件能力边界。
+
+不加入 Lark 的 access token 类型说明。
+
+### 5.6 补充查询结果与增强失败语义
+
+在“查询、资源与卡片”中增加：
+
+- 发送者名称缺失时保留真实 ID，不猜姓名，也不自动扩大通讯录查询。
+- 可选增强字段缺失不代表主查询失败；增强请求失败时保留主结果并写入 per-item ledger。
+
+继续保留：
+
+- `--page-all` 只在确需完整分页时使用。
+- 部分失败保留已有结果，禁止把不完整结果声明为完整。
+- 资源下载默认关闭，显式请求后才增加请求和本地输出。
+- 子消息资源优先使用子 `messageId`。
+- 输出路径、覆盖、HTTPS 和重定向安全限制。
+
+### 5.7 拆分“渐进加载”与“一级命令树”
+
+前移的只有加载决策。完整一级命令树及 branch references 改名为“低频原子路由”，保留在高频意图、统一发送和查询规则之后。
+
+这样可以：
+
+- 防止高频任务优先进入 atomic branch。
+- 降低不必要的 Schema 和 Help 查询。
+- 继续为没有 Shortcut 的能力提供确定导航。
+
+低频原子回退表继续保留收藏、编辑、外部群升级、群昵称、分类、共同群、群公告、群身份、置顶、未读、已读、授权、退群和解散群等差异化入口。
+
+### 5.8 合并错误恢复与 Workflow 导航
+
+将现有“Shortcut 错误处理”和“Workflow 与错误导航”合并为：
+
+```markdown
+## 错误恢复与按需 Reference
+```
+
+只保留以下规则：
+
+- 路径或参数错误时，按 Catalog、Schema、Help 的既定顺序校正一次。
+- 始终从实际输出重新提取下游 ID。
+- 复杂消息任务按需读取 `01-messaging.md`。
+- Onboarding 按需读取对应 workflow。
+- 命令错误按需读取 `chat-error-recovery.md`。
+- 权限不足、歧义未消除、无结果或契约冲突时停止并报告。
+
+删除其他位置重复的 `01-messaging.md` 和错误恢复入口。
+
+### 5.9 保留跨产品协作边界
+
+继续保留根 Skill 中不可由 Chat 自己完成的路由：
+
+- 人名解析到 Contact / AISearch。
+- DING、短信和电话到 Ding Skill。
+- 邮件到 Mail Skill。
+- 本地文件与已有 mediaId 的发送差异。
+
+如果某项边界已经在 Frontmatter 或核心对象表中完整表达，正文只保留执行阶段真正需要的补充，不重复整段说明。
+
+## 6. 删除与合并清单
+
+| 当前内容 | 处理方式 |
+|---|---|
+| “Shortcut 发现（按需）” | 合入前置“加载与路由顺序” |
+| “Shortcut 执行契约” | 公共规则合入前置章节 |
+| “高频直接执行骨架” | 删除，内容合入核心意图表 |
+| “渐进加载与一级路由”中的加载说明 | 前移并去重 |
+| 完整一级命令树 | 保留，改放“低频原子路由” |
+| “Shortcut 错误处理” | 合入统一错误章节 |
+| “Workflow 与错误导航” | 合入统一错误章节 |
+| 分散的身份、ID、置顶说明 | 合入核心对象表或统一身份规则 |
+| 重复的 `01-messaging.md` 入口 | 只保留一处 |
+
+## 7. 不纳入本次修改
+
+- 不展开 97 个公开 Shortcut。
+- 不复制 Lark 的完整 API Resources 和权限 scope 表。
+- 不在根 Skill 中维护 leaf 参数全集。
+- 不引入与当前 CLI 不一致的新命令或参数。
+- 不改变 Schema、Help、Runtime Catalog 和 reference 的事实优先级。
+- 不通过增加默认查询、自动通讯录查询或默认资源增强来换取结果丰富度。
+
+## 8. 实施顺序
+
+1. 更新 Frontmatter description，确认能力召回和排除边界。
+2. 合并并前移“加载与路由顺序”。
+3. 新增“核心对象与 ID”表，删除相应重复边界。
+4. 合并高频骨架和核心意图表。
+5. 补充统一身份规则。
+6. 补充查询结果和增强失败语义。
+7. 将一级命令树调整为后置的“低频原子路由”。
+8. 合并错误恢复与 reference 导航。
+9. 全文检查重复命令、重复 reference 和冲突参数。
+10. 运行 Skill 格式及相关策略测试，并用高频场景做静态路由验证。
+
+## 9. 验收标准
+
+### 9.1 内容与结构
+
+- 根 Skill 中只有一份 Catalog、Schema、Help 读取顺序。
+- 根 Skill 中只有一张高频意图与 Shortcut 骨架表。
+- 根 Skill 中只有一个错误恢复章节。
+- `01-messaging.md` 的同类导航不重复。
+- 核心对象与 ID 表不超过 8 行数据。
+- 一级原子命令树位于高频路由之后。
+- Frontmatter 同时覆盖主要产品能力和明确排除边界。
+
+### 9.2 执行行为
+
+- “发给某人”“发到某群”“查 @ 我”“改群名”等高频意图可直接选中已评审 Shortcut，不先查 Help。
+- 低频未知意图才触发 Runtime Shortcut Catalog。
+- 参数或安全不确定时读取 leaf Schema；只有 Cobra flags 不确定时读取 leaf Help。
+- user、bot、webhook 不被自动互换。
+- `openTaskId`、消息 ID、会话 ID 不混用。
+- 发送者名称或 reaction 等增强缺失时，不把主查询误判为失败。
+- 部分失败保留已有结果并明确报告 ledger/completeness。
+
+### 9.3 Token 与维护成本
+
+- 修改后的根 Skill 不超过当前 211 行，并以不丢失必要路由和边界为前提尽量低于 195 行。
+- 文件单词数和字符数不高于修改前基线。
+- 新增内容通过删除重复 SOP 抵消。
+- 不新增完整 Shortcut、API 或权限清单。
+
+## 10. 预期收益
+
+- 减少高频任务中的 `--help` 和重复 Schema 查询。
+- 降低因身份切换、ID 混用和发送者名称缺失导致的错误重试。
+- 让 Shortcut、Schema、Help、Catalog 和 references 各自保持单一职责。
+- 在不增加默认 token 和耗时的前提下，提高 Chat Skill 的选择准确率和执行成功率。
+- 降低后续新增 Shortcut 时同时维护多张表和多处规则的漂移风险。
@@ -1,312 +0,0 @@
-<!doctype html>
-<html lang="zh-CN">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <meta name="description" content="DWS Drive Shortcut 与 lark-cli 的业务能力、真实数据 E2E 证据和平台边界分析。">
-  <title>Drive Shortcut 能力全景｜业务评审版</title>
-  <style>
-    :root {
-      color-scheme: light;
-      --paper: #f4f6f2; --surface: #fffefa; --ink: #17251f; --muted: #66746d;
-      --line: #dce2dc; --forest: #154f3d; --green: #17765a; --mint: #dff4e8;
-      --blue: #265f86; --blue-soft: #e7f1f7; --amber: #8c5a09; --amber-soft: #fff2cf;
-      --red: #a43b32; --red-soft: #fde9e5; --shadow: 0 14px 40px rgba(28, 48, 38, .08);
-    }
-    * { box-sizing: border-box; }
-    html { scroll-behavior: smooth; }
-    body { margin: 0; color: var(--ink); background: var(--paper); font: 15px/1.65 -apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC", "Microsoft YaHei", sans-serif; }
-    a { color: inherit; text-decoration: none; }
-    code { padding: .12rem .38rem; border: 1px solid #d6e0da; border-radius: 6px; color: #174f3e; background: #f1f7f3; font: 600 .88em/1.4 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; white-space: nowrap; }
-    .wrap { width: min(1180px, calc(100% - 40px)); margin: auto; }
-    .hero { position: relative; overflow: hidden; padding: 64px 0 52px; color: #f7fff9; background: linear-gradient(125deg, #102b22 0%, #154c3c 57%, #1c6b54 100%); }
-    .hero::after { position: absolute; inset: -180px -100px auto auto; width: 540px; height: 540px; border: 1px solid rgba(255,255,255,.14); border-radius: 50%; box-shadow: 0 0 0 76px rgba(255,255,255,.035), 0 0 0 152px rgba(255,255,255,.025); content: ""; }
-    .hero-grid { position: relative; z-index: 1; display: grid; grid-template-columns: minmax(0, 1.35fr) minmax(300px, .65fr); gap: 32px; align-items: end; }
-    .eyebrow, .section-kicker { margin: 0 0 9px; color: #9fd6bd; font-size: 11px; font-weight: 900; letter-spacing: .16em; text-transform: uppercase; }
-    h1 { margin: 0; font-size: clamp(40px, 6vw, 68px); line-height: 1.03; letter-spacing: -.045em; }
-    .subtitle { max-width: 760px; margin: 19px 0 0; color: #d3e9de; font-size: 17px; }
-    .meta-row { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 21px; }
-    .meta-pill { padding: 6px 10px; border: 1px solid rgba(255,255,255,.18); border-radius: 999px; color: #d5e9df; background: rgba(255,255,255,.07); font-size: 11px; font-weight: 750; }
-    .meta-pill.good { color: #bff2d5; border-color: rgba(139,232,179,.38); }
-    .hero-stats { display: grid; grid-template-columns: repeat(2, 1fr); gap: 10px; }
-    .hero-stat { padding: 17px 16px; border: 1px solid rgba(255,255,255,.17); border-radius: 15px; background: rgba(255,255,255,.075); backdrop-filter: blur(8px); }
-    .hero-stat strong { display: block; font-size: 30px; line-height: 1; }
-    .hero-stat span { display: block; margin-top: 7px; color: #cce2d7; font-size: 11px; }
-    .nav { position: sticky; top: 0; z-index: 20; border-bottom: 1px solid var(--line); background: rgba(255,254,250,.94); backdrop-filter: blur(12px); }
-    .nav .wrap { display: flex; overflow-x: auto; }
-    .nav a { flex: 0 0 auto; padding: 14px 15px; color: #5b6c64; font-size: 12px; font-weight: 800; }
-    .nav a:hover { color: var(--forest); background: #eaf3ee; }
-    main { padding: 38px 0 74px; }
-    section { margin-top: 50px; scroll-margin-top: 72px; }
-    section:first-child { margin-top: 0; }
-    .section-head { display: flex; justify-content: space-between; gap: 28px; align-items: end; margin-bottom: 19px; }
-    h2 { margin: 0; font-size: clamp(25px, 3.2vw, 36px); line-height: 1.16; letter-spacing: -.025em; }
-    h3 { margin: 0 0 7px; font-size: 18px; }
-    .section-desc { max-width: 660px; margin: 0; color: var(--muted); font-size: 13px; }
-    .callout { padding: 19px 21px; border: 1px solid #bdd8cb; border-left: 4px solid var(--green); border-radius: 13px; background: #ecf7f1; box-shadow: 0 6px 20px rgba(28,48,38,.04); }
-    .callout strong { color: #13513d; }
-    .callout.warn { border-color: #ead29a; border-left-color: #b67508; background: #fff8e7; }
-    .callout.warn strong { color: #784b00; }
-    .callout.danger { border-color: #e9b7b1; border-left-color: var(--red); background: var(--red-soft); }
-    .score-grid, .domain-grid, .evidence-grid, .review-grid { display: grid; gap: 13px; }
-    .score-grid { grid-template-columns: repeat(4, 1fr); margin-top: 16px; }
-    .score, .domain-card, .evidence-card, .review-card { border: 1px solid var(--line); border-radius: 15px; background: var(--surface); box-shadow: var(--shadow); }
-    .score { padding: 19px; }
-    .score strong { display: block; color: var(--forest); font-size: 29px; line-height: 1; }
-    .score span { display: block; margin-top: 8px; color: var(--muted); font-size: 12px; }
-    .domain-grid { grid-template-columns: repeat(4, 1fr); }
-    .domain-card { position: relative; padding: 21px; overflow: hidden; }
-    .domain-card .number { position: absolute; top: 12px; right: 17px; color: #d5e8de; font: 800 42px/1 ui-monospace, monospace; }
-    .domain-card p { min-height: 64px; margin: 8px 0 12px; color: var(--muted); font-size: 13px; }
-    .domain-card small { color: var(--green); font-weight: 800; }
-    .compare { overflow: hidden; border: 1px solid var(--line); border-radius: 16px; background: var(--surface); box-shadow: var(--shadow); }
-    .compare-top { display: grid; grid-template-columns: repeat(3, 1fr); }
-    .compare-column { padding: 21px; border-right: 1px solid var(--line); }
-    .compare-column:last-child { border-right: 0; }
-    .compare-column p, .compare-column li { color: var(--muted); font-size: 13px; }
-    .compare-column ul { margin: 9px 0 0; padding-left: 18px; }
-    .compare-column.covered { border-top: 5px solid var(--green); }
-    .compare-column.partial { border-top: 5px solid #c78b22; }
-    .compare-column.gap { border-top: 5px solid var(--red); }
-    .table-wrap { overflow-x: auto; }
-    table { width: 100%; border-collapse: collapse; }
-    th, td { padding: 12px 14px; border-bottom: 1px solid var(--line); text-align: left; vertical-align: top; }
-    th { color: #617069; background: #f7f8f5; font-size: 11px; font-weight: 900; letter-spacing: .03em; }
-    tr:last-child td { border-bottom: 0; }
-    tbody tr:hover { background: #f8fbf8; }
-    .verdict, .badge { display: inline-flex; align-items: center; padding: 3px 8px; border-radius: 999px; font-size: 10px; font-weight: 900; white-space: nowrap; }
-    .v-covered, .badge.read { color: #116045; background: var(--mint); }
-    .v-ahead, .badge.smart { color: #20577c; background: var(--blue-soft); }
-    .v-partial, .badge.write { color: #7b510a; background: var(--amber-soft); }
-    .v-gap, .badge.high { color: #8f3028; background: var(--red-soft); }
-    .truth-grid { display: grid; grid-template-columns: 1.1fr .9fr; gap: 14px; }
-    .truth-card { padding: 22px; border: 1px solid var(--line); border-radius: 15px; background: var(--surface); box-shadow: var(--shadow); }
-    .truth-step { display: grid; grid-template-columns: 30px 1fr; gap: 11px; margin-top: 13px; }
-    .truth-step b { display: grid; width: 28px; height: 28px; place-items: center; border-radius: 50%; color: #fff; background: var(--forest); font-size: 12px; }
-    .truth-step strong, .truth-step span { display: block; }
-    .truth-step span { color: var(--muted); font-size: 12px; }
-    .toolbar { display: grid; grid-template-columns: minmax(260px, 1fr) 180px 180px auto; gap: 10px; align-items: center; margin: 18px 0; padding: 13px; border: 1px solid var(--line); border-radius: 14px; background: var(--surface); }
-    input, select { width: 100%; min-height: 42px; padding: 9px 11px; border: 1px solid #ccd7d0; border-radius: 9px; color: var(--ink); background: #fff; font: inherit; }
-    input:focus, select:focus { outline: 3px solid rgba(23,118,90,.13); border-color: var(--green); }
-    .result-count { color: var(--muted); font-size: 12px; text-align: right; white-space: nowrap; }
-    .catalog { overflow: hidden; border: 1px solid var(--line); border-radius: 16px; background: var(--surface); box-shadow: var(--shadow); }
-    .shortcut-row { display: grid; grid-template-columns: 215px minmax(0, 1fr) 200px; gap: 16px; align-items: center; padding: 14px 17px; border-bottom: 1px solid var(--line); }
-    .shortcut-row:last-child { border-bottom: 0; }
-    .shortcut-row:hover { background: #f8fbf8; }
-    .command code { font-size: 12px; }
-    .row-main p { margin: 0; font-size: 13px; }
-    .row-main small { color: var(--muted); }
-    .badges { display: flex; justify-content: flex-end; flex-wrap: wrap; gap: 5px; }
-    .hidden-row { display: none; }
-    .evidence-grid { grid-template-columns: repeat(4, 1fr); }
-    .evidence-card { padding: 19px; }
-    .evidence-card strong { display: block; color: var(--forest); font-size: 23px; }
-    .evidence-card p { margin: 7px 0 0; color: var(--muted); font-size: 12px; }
-    .timeline { margin-top: 15px; border-left: 2px solid #bdd7ca; }
-    .event { position: relative; padding: 0 0 17px 22px; }
-    .event::before { position: absolute; left: -7px; top: 5px; width: 12px; height: 12px; border: 3px solid var(--paper); border-radius: 50%; background: var(--green); content: ""; }
-    .event b { display: block; }
-    .event span { color: var(--muted); font-size: 12px; }
-    .review-grid { grid-template-columns: repeat(3, 1fr); }
-    .review-card { position: relative; padding: 20px; }
-    .review-card .review-num { color: #b8d1c4; font: 800 12px/1 ui-monospace, monospace; letter-spacing: .1em; }
-    .review-card p { margin: 7px 0 0; color: var(--muted); font-size: 13px; }
-    footer { margin-top: 52px; padding: 23px 0; border-top: 1px solid var(--line); color: var(--muted); font-size: 11px; }
-    @media (max-width: 900px) { .hero-grid, .truth-grid { grid-template-columns: 1fr; } .score-grid, .domain-grid, .evidence-grid { grid-template-columns: repeat(2, 1fr); } .review-grid { grid-template-columns: 1fr 1fr; } .shortcut-row { grid-template-columns: 180px 1fr; } .badges { grid-column: 1 / -1; justify-content: flex-start; } }
-    @media (max-width: 620px) { .wrap { width: min(100% - 24px, 1180px); } .hero { padding: 44px 0 38px; } .hero-stats, .score-grid, .domain-grid, .evidence-grid, .review-grid, .compare-top { grid-template-columns: 1fr; } .compare-column { border-right: 0; border-bottom: 1px solid var(--line); } .toolbar { grid-template-columns: 1fr; } .result-count { text-align: left; } .shortcut-row { grid-template-columns: 1fr; } }
-    @media print { body { background: #fff; } .hero { color: var(--ink); background: #fff; border-bottom: 2px solid var(--ink); } .subtitle, .meta-pill, .hero-stat span { color: #425249; } .hero-stat { border-color: #aebbb3; } .nav, .toolbar { display: none; } .score, .domain-card, .compare, .truth-card, .catalog, .evidence-card, .review-card { box-shadow: none; break-inside: avoid; } }
-  </style>
-</head>
-<body>
-  <header class="hero">
-    <div class="wrap hero-grid">
-      <div>
-        <p class="eyebrow">Business Review · Drive</p>
-        <h1>Drive Shortcut<br>能力全景</h1>
-        <p class="subtitle">从 lark-cli 对齐出发，但不止于命令名：逐项审查输入、校验、多步编排、失败语义、真实字节和平台边界。</p>
-        <div class="meta-row">
-          <span class="meta-pill good">真实账号 E2E 已执行</span>
-          <span class="meta-pill">28 个公开入口</span>
-          <span class="meta-pill">统一 Result / Pagination</span>
-          <span class="meta-pill">报告已移除 PII / 凭证 / 业务正文</span>
-        </div>
-      </div>
-      <div class="hero-stats" aria-label="关键统计">
-        <div class="hero-stat"><strong>38</strong><span>lark-cli Drive 逐项审查</span></div>
-        <div class="hero-stat"><strong>26</strong><span>已覆盖或跨产品路由</span></div>
-        <div class="hero-stat"><strong>7</strong><span>部分对齐，边界已公开</span></div>
-        <div class="hero-stat"><strong>5</strong><span>客观不可对齐能力</span></div>
-      </div>
-    </div>
-  </header>
-
-  <nav class="nav"><div class="wrap"><a href="#overview">全景</a><a href="#compare">Lark 对齐</a><a href="#ahead">超越项</a><a href="#truth">真实语义</a><a href="#catalog">完整目录</a><a href="#e2e">E2E</a><a href="#review">评审</a></div></nav>
-
-  <main class="wrap">
-    <section id="overview">
-      <div class="section-head"><div><p class="section-kicker">Executive summary</p><h2>28 个公开入口，覆盖文件完整生命周期</h2></div><p class="section-desc">另有 <code>+publish-set</code> 已实现契约和读回逻辑，但真实普通文件与在线文档均被服务端拒绝，因此保持 unavailable，不进入 Agent 公开目录。</p></div>
-      <div class="callout"><strong>结论：</strong>Drive 已从 9 个偏原子入口扩展为 28 个可发现 Shortcut。它不仅补齐 Lark 的核心文件、版本和状态任务，还通过严格响应合同、真实落盘、写后读回、回收恢复和个人收藏形成更可审计的钉盘工作流。</div>
-      <div class="score-grid">
-        <article class="score"><strong>29</strong><span>已审查注册项（含 1 unavailable）</span></article>
-        <article class="score"><strong>25</strong><span>公开主能力 / 语义适配</span></article>
-        <article class="score"><strong>3</strong><span>公开兼容入口</span></article>
-        <article class="score"><strong>3</strong><span>高风险写入口，均需确认</span></article>
-      </div>
-    </section>
-
-    <section>
-      <div class="section-head"><div><p class="section-kicker">Capability map</p><h2>四个业务域</h2></div><p class="section-desc">目录按用户任务组织；兼容命令不重复计为新增能力。</p></div>
-      <div class="domain-grid">
-        <article class="domain-card"><span class="number">09</span><h3>发现与检查</h3><p>严格目录分页、搜索、最近访问，以及元数据、统计和封面聚合检查。</p><small>+list · +search · +recent · +inspect</small></article>
-        <article class="domain-card"><span class="number">09</span><h3>文件生命周期</h3><p>创建目录、上传下载、快捷方式、在线对象复制、移动重命名、删除与恢复。</p><small>+upload · +download · +rename · +recycle-restore</small></article>
-        <article class="domain-card"><span class="number">06</span><h3>个人与公开状态</h3><p>回收站清单、收藏闭环和互联网公开状态的独立安全域。</p><small>+star-list · +star-add · +publish-get</small></article>
-        <article class="domain-card"><span class="number">04</span><h3>历史版本</h3><p>版本列表、精确定位、真实字节下载与高风险回滚读回。</p><small>+version-history · +version-download · +version-revert</small></article>
-      </div>
-    </section>
-
-    <section id="compare">
-      <div class="section-head"><div><p class="section-kicker">Lark alignment</p><h2>对齐业务语义，不追求同名率</h2></div><p class="section-desc">38 项逐项核对。评论、导入导出和成员权限在 DWS 由更成熟的 Doc 或原子权限入口承接，不在 Drive 再复制一套。</p></div>
-      <div class="compare">
-        <div class="compare-top">
-          <article class="compare-column covered"><h3>26 · 已覆盖 / 路由</h3><p>上传下载、目录与快捷方式、版本、移动删除、状态、搜索、评论、导入导出和成员任务均有真实入口。</p></article>
-          <article class="compare-column partial"><h3>7 · 部分对齐</h3><p>预览、resolve/reaction、push/pull、权限申请与 setting 受对象模型或接口粒度约束，明确保留有限语义。</p></article>
-          <article class="compare-column gap"><h3>5 · 客观缺口</h3><p>删除评论恢复、普通文件版本删除、安全标签读写、可靠双向目录同步缺少必要下层接口。</p></article>
-        </div>
-        <div class="table-wrap"><table><thead><tr><th>Lark 任务组</th><th>DWS 主路径</th><th>结论</th><th>关键差异与交付决定</th></tr></thead><tbody>
-          <tr><td>upload / folder / shortcut / download</td><td><code>drive +upload</code> 等</td><td><span class="verdict v-ahead">增强</span></td><td>工作目录边界、OSS PUT、严格 commit、no-clobber、原子落盘、非零字节和读回验证。</td></tr>
-          <tr><td>preview / cover</td><td><code>drive +cover</code></td><td><span class="verdict v-partial">部分</span></td><td>封面/缩略图可读；没有等价的服务端多格式预览转换，不扩大宣称。</td></tr>
-          <tr><td>comments / replies</td><td><code>doc +comment-*</code> / <code>doc +review</code></td><td><span class="verdict v-covered">路由</span></td><td>评论归在线文档协作域；独立 resolve、reaction identity 与删除后恢复仍受接口限制。</td></tr>
-          <tr><td>export / import / task result</td><td><code>doc +export</code> / <code>doc +import</code></td><td><span class="verdict v-ahead">增强</span></td><td>提交、轮询、恢复、安全下载形成类型化闭环，不保留泛化下划线命令。</td></tr>
-          <tr><td>version history / get / revert</td><td><code>drive +version-*</code></td><td><span class="verdict v-ahead">增强</span></td><td>严格分页、精确版本、历史字节落盘、回滚前预检与终态读回；历史版本删除无接口。</td></tr>
-          <tr><td>status / inspect</td><td><code>drive +inspect</code></td><td><span class="verdict v-ahead">超越</span></td><td>元数据为必达结果，统计、公开状态和封面按需 fan-out；可选失败为 partial_success。</td></tr>
-          <tr><td>push / pull / sync</td><td><code>+upload</code> / <code>+download</code> 单文件</td><td><span class="verdict v-partial">部分</span></td><td>不在缺少稳定 hash、rename/delete journal 和冲突向量时制造危险目录同步。</td></tr>
-          <tr><td>member / permission</td><td><code>doc +access-*</code> / <code>drive permission</code></td><td><span class="verdict v-covered">路由</span></td><td>协作者权限与互联网公开是两个安全域；申请权限需真实上下文，未伪装为通用 Shortcut。</td></tr>
-          <tr><td>secure labels</td><td>无等价</td><td><span class="verdict v-gap">缺口</span></td><td>当前 DWS/钉钉下层没有 Drive 安全标签目录和写入接口，不能用普通权限代替。</td></tr>
-          <tr><td>search</td><td><code>drive +search</code> / <code>doc +search</code></td><td><span class="verdict v-ahead">增强</span></td><td>文件与在线文档按域路由；文件搜索严格验证数组、过滤和分页。</td></tr>
-        </tbody></table></div>
-      </div>
-      <div class="callout warn" style="margin-top:14px"><strong>普通文件 copy 边界：</strong>钉钉现有复制接口对普通文件产生 <code>.dlink</code>，不是字节独立副本。因此 <code>+copy</code> 只接受在线对象；普通文件快捷入口用 <code>+create-shortcut</code>，独立副本使用 <code>+download</code> 后 <code>+upload</code>。</div>
-    </section>
-
-    <section id="ahead">
-      <div class="section-head"><div><p class="section-kicker">Beyond parity</p><h2>DWS 可主推的八个差异化点</h2></div><p class="section-desc">价值来自正确性与完整闭环，而不是额外注册同义命令。</p></div>
-      <div class="domain-grid">
-        <article class="domain-card"><h3>严格目录语义</h3><p><code>+list</code> / <code>+recent</code> 只有服务端明确返回数组时才接受空集合。</p><small>缺字段 ≠ 空目录</small></article>
-        <article class="domain-card"><h3>聚合检查</h3><p><code>+inspect</code> 一次汇总身份、统计、公开状态和封面，并保留局部失败。</p><small>partial_success 可审计</small></article>
-        <article class="domain-card"><h3>真实文件传输</h3><p>上传执行完整事务；下载验证受控路径、覆盖策略、原子发布和字节。</p><small>不是只返回临时 URL</small></article>
-        <article class="domain-card"><h3>回收恢复闭环</h3><p>从 <code>recycleItemId</code> 恢复后读取真实节点，证明资源确实回到可访问状态。</p><small>恢复后读回</small></article>
-        <article class="domain-card"><h3>个人收藏闭环</h3><p>收藏、列表、取消收藏覆盖完整用户偏好过程，并保留分页。</p><small>add → list → remove</small></article>
-        <article class="domain-card"><h3>版本真实字节</h3><p>除元数据外可下载任意已知历史版本，并用本地字节核验回滚结果。</p><small>version-download</small></article>
-        <article class="domain-card"><h3>重命名终态</h3><p>处理服务端扩展名规则，再读取节点确认最终名称，避免重复扩展名。</p><small>write → read-back</small></article>
-        <article class="domain-card"><h3>公开域诚实降级</h3><p>查询和关闭可验证；开启在 eligible 节点闭环完成前保持 unavailable。</p><small>不把 notSupported 当成功</small></article>
-      </div>
-    </section>
-
-    <section id="truth">
-      <div class="section-head"><div><p class="section-kicker">Truthful execution</p><h2>空数组不再是“看起来成功”</h2></div><p class="section-desc">合法业务空集合可以成功，但必须先证明响应结构、元素类型和分页语义成立。内部错误、缺字段与坏投影必须失败。</p></div>
-      <div class="truth-grid">
-        <article class="truth-card"><h3>四层成功证据</h3>
-          <div class="truth-step"><b>1</b><div><strong>传输成功</strong><span>进程成功，MCP / HTTP 没有显式错误。</span></div></div>
-          <div class="truth-step"><b>2</b><div><strong>响应合同</strong><span>对象、数组、success 标志和元素类型与命令声明一致。</span></div></div>
-          <div class="truth-step"><b>3</b><div><strong>业务终态</strong><span>写命令必须获得新 ID、终态证据或后续元数据读回。</span></div></div>
-          <div class="truth-step"><b>4</b><div><strong>产物校验</strong><span>下载必须落盘、非零字节；关键链路比较大小和 SHA-256。</span></div></div>
-        </article>
-        <article class="truth-card"><h3>明确失败的情况</h3>
-          <ul><li>空响应、缺少预期集合字段或集合类型错误。</li><li>集合存在坏元素，不能投影时静默丢弃。</li><li><code>success=false</code>、写响应没有 ID 或读回不一致。</li><li>inspect 的可选分支失败却返回整体 success。</li><li>下载得到空文件、越界路径或覆盖既有文件。</li><li>普通文件 copy 返回快捷链接却声称独立副本。</li></ul>
-        </article>
-      </div>
-    </section>
-
-    <section id="catalog">
-      <div class="section-head"><div><p class="section-kicker">Full catalog</p><h2>28 个公开 Shortcut 完整目录</h2></div><p class="section-desc">16 个只读、9 个普通写、3 个高风险写；3 个历史入口保留兼容但不作为新 Agent 主路径。</p></div>
-      <div class="toolbar"><input id="q" type="search" placeholder="搜索命令或用途，例如 版本、回收、+inspect…" aria-label="搜索 Shortcut"><select id="domain"><option value="all">全部业务域</option><option value="discover">发现与检查</option><option value="lifecycle">文件生命周期</option><option value="personal">个人与公开</option><option value="version">历史版本</option></select><select id="risk"><option value="all">全部风险</option><option value="read">只读</option><option value="write">普通写</option><option value="high">高风险写</option></select><span id="result-count" class="result-count">显示 28 / 28</span></div>
-      <div class="catalog">
-        <article class="shortcut-row" data-tool data-domain="discover" data-risk="read"><div class="command"><code>dws drive +list</code></div><div class="row-main"><p>严格分页列出目录，保留游标，区分显式空目录和畸形响应。</p><small>发现与检查</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="discover" data-risk="read"><div class="command"><code>dws drive +inspect</code></div><div class="row-main"><p>聚合元数据与可选统计、公开状态、封面；局部失败如实报告。</p><small>发现与检查</small></div><div class="badges"><span class="badge read">READ</span><span class="badge smart">SMART</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="discover" data-risk="read"><div class="command"><code>dws drive +info</code></div><div class="row-main"><p>历史元数据兼容入口；新场景优先使用 +inspect。</p><small>兼容入口</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="discover" data-risk="read"><div class="command"><code>dws drive +search</code></div><div class="row-main"><p>按关键词、类型、扩展名、创建人、时间和分页搜索钉盘文件。</p><small>发现与检查</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="discover" data-risk="read"><div class="command"><code>dws drive +find-file</code></div><div class="row-main"><p>历史文件搜索兼容入口；新场景优先使用 +search。</p><small>兼容入口</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="discover" data-risk="read"><div class="command"><code>dws drive +search-docs</code></div><div class="row-main"><p>历史跨域搜索入口；新的在线文档搜索路由 doc +search。</p><small>兼容入口</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="discover" data-risk="read"><div class="command"><code>dws drive +recent</code></div><div class="row-main"><p>读取最近访问或编辑列表，支持创建人筛选并保留分页。</p><small>发现与检查</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="discover" data-risk="read"><div class="command"><code>dws drive +stats</code></div><div class="row-main"><p>读取访问、编辑、评论、点赞、预览和下载统计。</p><small>发现与检查</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="discover" data-risk="read"><div class="command"><code>dws drive +cover</code></div><div class="row-main"><p>读取封面或缩略图；不宣称服务端多格式预览。</p><small>发现与检查</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-
-        <article class="shortcut-row" data-tool data-domain="lifecycle" data-risk="write"><div class="command"><code>dws drive +upload</code></div><div class="row-main"><p>上传凭证、OSS PUT、严格提交和远端元数据读回的一体化事务。</p><small>文件生命周期</small></div><div class="badges"><span class="badge write">WRITE · CONFIRM</span><span class="badge smart">SMART</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="lifecycle" data-risk="read"><div class="command"><code>dws drive +download</code></div><div class="row-main"><p>安全落盘、no-clobber、原子发布并验证非零字节。</p><small>文件生命周期</small></div><div class="badges"><span class="badge read">READ</span><span class="badge smart">SMART</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="lifecycle" data-risk="write"><div class="command"><code>dws drive +create-folder</code></div><div class="row-main"><p>创建文件夹后要求新 ID，并读回名称验证。</p><small>文件生命周期</small></div><div class="badges"><span class="badge write">WRITE · CONFIRM</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="lifecycle" data-risk="write"><div class="command"><code>dws drive +create-shortcut</code></div><div class="row-main"><p>创建快捷方式并读回，明确区别于独立副本。</p><small>文件生命周期</small></div><div class="badges"><span class="badge write">WRITE · CONFIRM</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="lifecycle" data-risk="write"><div class="command"><code>dws drive +copy</code></div><div class="row-main"><p>复制在线对象；普通文件预检拒绝，避免把 .dlink 当副本。</p><small>文件生命周期</small></div><div class="badges"><span class="badge write">WRITE · CONFIRM</span><span class="badge smart">SMART</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="lifecycle" data-risk="write"><div class="command"><code>dws drive +move</code></div><div class="row-main"><p>移动到指定文件夹或知识库位置，语义与 copy/shortcut 消歧。</p><small>文件生命周期</small></div><div class="badges"><span class="badge write">WRITE · CONFIRM</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="lifecycle" data-risk="write"><div class="command"><code>dws drive +rename</code></div><div class="row-main"><p>重命名后读取真实节点，验证最终名称和扩展名。</p><small>文件生命周期</small></div><div class="badges"><span class="badge write">WRITE · CONFIRM</span><span class="badge smart">SMART</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="lifecycle" data-risk="high"><div class="command"><code>dws drive +delete</code></div><div class="row-main"><p>将确认过的节点移入回收站，要求 success=true 终态证据。</p><small>文件生命周期</small></div><div class="badges"><span class="badge high">HIGH · CONFIRM</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="lifecycle" data-risk="write"><div class="command"><code>dws drive +recycle-restore</code></div><div class="row-main"><p>按回收项 ID 恢复，并读回恢复后的节点。</p><small>文件生命周期</small></div><div class="badges"><span class="badge write">WRITE · CONFIRM</span><span class="badge smart">SMART</span></div></article>
-
-        <article class="shortcut-row" data-tool data-domain="personal" data-risk="read"><div class="command"><code>dws drive +recycle-list</code></div><div class="row-main"><p>严格分页列出回收项并稳定投影 recycleItemId。</p><small>个人与公开</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="personal" data-risk="read"><div class="command"><code>dws drive +star-list</code></div><div class="row-main"><p>严格分页列出当前用户收藏并保留游标。</p><small>个人与公开</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="personal" data-risk="write"><div class="command"><code>dws drive +star-add</code></div><div class="row-main"><p>以幂等用户偏好语义收藏指定节点。</p><small>个人与公开</small></div><div class="badges"><span class="badge write">WRITE</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="personal" data-risk="write"><div class="command"><code>dws drive +star-remove</code></div><div class="row-main"><p>以幂等用户偏好语义取消收藏指定节点。</p><small>个人与公开</small></div><div class="badges"><span class="badge write">WRITE</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="personal" data-risk="read"><div class="command"><code>dws drive +publish-get</code></div><div class="row-main"><p>只读查询互联网公开状态，不沿用错误的写风险标签。</p><small>个人与公开</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="personal" data-risk="high"><div class="command"><code>dws drive +publish-unset</code></div><div class="row-main"><p>关闭互联网公开并读回验证外链状态。</p><small>个人与公开</small></div><div class="badges"><span class="badge high">HIGH · CONFIRM</span><span class="badge smart">SMART</span></div></article>
-
-        <article class="shortcut-row" data-tool data-domain="version" data-risk="read"><div class="command"><code>dws drive +version-history</code></div><div class="row-main"><p>严格分页列出普通文件历史版本。</p><small>历史版本</small></div><div class="badges"><span class="badge read">READ</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="version" data-risk="read"><div class="command"><code>dws drive +version-get</code></div><div class="row-main"><p>按正整数版本号精确匹配，零命中显式失败。</p><small>历史版本</small></div><div class="badges"><span class="badge read">READ</span><span class="badge smart">SMART</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="version" data-risk="read"><div class="command"><code>dws drive +version-download</code></div><div class="row-main"><p>预检版本后安全下载历史字节，要求非零产物。</p><small>历史版本</small></div><div class="badges"><span class="badge read">READ</span><span class="badge smart">SMART</span></div></article>
-        <article class="shortcut-row" data-tool data-domain="version" data-risk="high"><div class="command"><code>dws drive +version-revert</code></div><div class="row-main"><p>验证版本存在后回滚，并读取当前节点终态。</p><small>历史版本</small></div><div class="badges"><span class="badge high">HIGH · CONFIRM</span><span class="badge smart">SMART</span></div></article>
-      </div>
-      <div class="callout warn" style="margin-top:14px"><strong>未公开入口：</strong><code>+publish-set</code> 的安全契约和 set→get 读回代码已存在，但真实后端返回 <code>operation.notSupported</code>。在找到 eligible 节点并完成 set→get→unset 闭环前，不进入公开 Agent catalog。</div>
-    </section>
-
-    <section id="e2e">
-      <div class="section-head"><div><p class="section-kicker">Real-data E2E</p><h2>真实数据验证，不用空结果证明成功</h2></div><p class="section-desc">测试在隔离目录创建临时资源，覆盖读取、写入、下载、版本、收藏、回收和清理。资源 ID、账号、URL、上传凭证、绝对路径和业务正文均未进入报告。</p></div>
-      <div class="evidence-grid">
-        <article class="evidence-card"><strong>39,838 B</strong><p>真实文件上传后下载字节数；与源文件 SHA-256 完全一致。</p></article>
-        <article class="evidence-card"><strong>2 versions</strong><p>覆盖写入生成两个版本；精确查询、历史下载和回滚全部读回。</p></article>
-        <article class="evidence-card"><strong>4 / 5</strong><p>隔离夹具中搜索命中 4 项、最近列表命中 5 项，证明非空投影链路。</p></article>
-        <article class="evidence-card"><strong>0 remain</strong><p>测试结束后隔离根目录无残留；临时资源进入回收站并完成本地清理。</p></article>
-      </div>
-      <div class="timeline">
-        <div class="event"><b>创建与发现</b><span>创建两个隔离目录并读回；+list 命中真实节点，由此发现并修复 dentryId 与 32 字符 fileId 混用。</span></div>
-        <div class="event"><b>上传与下载</b><span>真实 OSS 上传、远端元数据读回、下载、no-clobber 二次路径、大小与 SHA-256 一致性全部通过。</span></div>
-        <div class="event"><b>检查与个人状态</b><span>+inspect（含 stats / publish / cover）、+stats、+cover、收藏 add→list→remove 通过。</span></div>
-        <div class="event"><b>版本闭环</b><span>覆盖文件产生两个版本；history/get/download/revert 通过，回滚后最新字节与原始内容一致。</span></div>
-        <div class="event"><b>复制、移动与命名</b><span>在线文档 copy 通过；普通文件 .dlink 被修正为预检拒绝；move 往返、rename 扩展名规范化通过。</span></div>
-        <div class="event"><b>删除与恢复</b><span>delete→recycle-list→recycle-restore 通过，真实回收响应字段已按后端形态修正。</span></div>
-        <div class="event"><b>平台负向证据</b><span>publish-set 对普通文件和在线文档均明确返回不支持，因此保持 unavailable；没有把失败改写成空对象成功。</span></div>
-        <div class="event"><b>清理</b><span>隔离目录进入回收站，根目录残留计数为零；本地下载产物删除。</span></div>
-      </div>
-    </section>
-
-    <section id="review">
-      <div class="section-head"><div><p class="section-kicker">Review prompts</p><h2>建议业务评审重点确认</h2></div><p class="section-desc">这些是需要接受的产品边界，不是被空结果遮蔽的实现问题。</p></div>
-      <div class="review-grid">
-        <article class="review-card"><span class="review-num">01</span><h3>是否接受 26 / 7 / 5 结论？</h3><p>按用户任务计覆盖、部分与缺口，不用同名命令数量代替语义保真。</p></article>
-        <article class="review-card"><span class="review-num">02</span><h3>普通文件 copy 是否足够清晰？</h3><p>服务端无法提供原子独立副本；快捷方式与下载后上传两条替代路径已明确。</p></article>
-        <article class="review-card"><span class="review-num">03</span><h3>是否拒绝不可靠目录 sync？</h3><p>缺稳定 hash、删除/重命名日志和冲突向量时，不发布可能覆盖数据的双向同步。</p></article>
-        <article class="review-card"><span class="review-num">04</span><h3>跨产品路由是否合理？</h3><p>评论、导入导出和协作者权限优先复用 Doc 成熟入口，不在 Drive 制造同义表面。</p></article>
-        <article class="review-card"><span class="review-num">05</span><h3>publish-set 是否继续 unavailable？</h3><p>建议维持，直到真实 eligible 节点完成开启、查询、关闭的可恢复闭环。</p></article>
-        <article class="review-card"><span class="review-num">06</span><h3>下一批后端解锁优先级？</h3><p>建议依次评估普通文件原子 copy、同步所需版本信号、安全标签和评论恢复接口。</p></article>
-      </div>
-    </section>
-  </main>
-
-  <footer><div class="wrap">依据：DWS 最终 Shortcut catalog / Schema、Drive 实现与测试、真实账号 E2E、lark-cli Drive registrations 与实现。范围仅含 Drive Shortcut 及必要跨产品路由；不包含原子命令总表。所有业务标识、凭证、签名 URL、用户信息和正文均已脱敏。</div></footer>
-  <script>
-    const q = document.querySelector('#q');
-    const domain = document.querySelector('#domain');
-    const risk = document.querySelector('#risk');
-    const rows = [...document.querySelectorAll('[data-tool]')];
-    const count = document.querySelector('#result-count');
-    function filterTools() {
-      const needle = q.value.trim().toLocaleLowerCase('zh-CN');
-      let visible = 0;
-      rows.forEach((row) => {
-        const show = (!needle || row.textContent.toLocaleLowerCase('zh-CN').includes(needle)) && (domain.value === 'all' || row.dataset.domain === domain.value) && (risk.value === 'all' || row.dataset.risk === risk.value);
-        row.classList.toggle('hidden-row', !show);
-        if (show) visible += 1;
-      });
-      count.textContent = `显示 ${visible} / ${rows.length}`;
-    }
-    [q, domain, risk].forEach((control) => control.addEventListener('input', filterTools));
-  </script>
-</body>
-</html>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
瑞达	7ef88d696b	fix(chat): prevent message search from resolving groups	2026-08-03 17:44:19 +08:00
瑞达	891cf87c7f	docs(skill): streamline chat progressive routing	2026-08-03 17:37:34 +08:00
瑞达	6182169b3e	fix(chat): reconcile remote guidance contracts	2026-08-03 12:03:27 +08:00
瑞达	ab2fba868b	fix(chat): improve aligned shortcut reliability Add hidden compatibility flags and exact high-frequency routes to avoid help-driven recovery loops. Restore granular PAT tests and correct the Runtime Catalog versus curated Schema contract.	2026-08-03 11:53:45 +08:00
瑞达	796cee3d95	fix(skills): gate script priority on runtime availability	2026-08-03 11:53:45 +08:00
瑞达	32c82e1246	fix(chat): keep help guidance on stdout	2026-08-03 11:53:45 +08:00
瑞达	fe2f64dc43	chore(schema): refresh skill source hashes	2026-08-03 11:53:16 +08:00
瑞达	32c9109c71	fix(skills): avoid requiring python for chat workflows	2026-08-03 11:53:16 +08:00
瑞达	7a42c83d3a	perf(skills): restore progressive chat shortcut discovery	2026-08-03 11:53:16 +08:00
瑞达	8b1564eff4	test: restore shortcut and confirmation contracts	2026-08-03 11:53:16 +08:00
南润	b8b5583440	PR修复	2026-07-31 17:59:09 +08:00
南润	8f8ba3f290	init	2026-07-31 14:36:19 +08:00
瑞达	fe856a8f38	Merge origin/main into codex/im-chat-skill-hint-align	2026-07-31 13:57:15 +08:00
瑞达	583b453abf	feat(skill): embed chat shortcuts in multi skill	2026-07-31 13:42:41 +08:00
瑞达	eef94425e2	test(pat): restore coverage baseline	2026-07-30 16:42:07 +08:00
瑞达	e17ffe5bff	test(chat): fix CI script runner and coverage	2026-07-30 16:29:46 +08:00
瑞达	e83e3a3e2c	feat(chat): align skill with shortcut runtime	2026-07-30 15:56:16 +08:00
南润	5323129e5e	Merge branch 'main' into codex/im-chat-skill-hint-align # Conflicts: # internal/app/schema_shortcut_contract_test.go # internal/cli/schema_agent_metadata/index.json # internal/cli/schema_agent_metadata_audit.json # internal/cli/schema_catalog/catalog.json # internal/cli/schema_command_registry/products/chat.json # internal/cli/schema_hints/runtime-surface-completeness.json # skills/multi/dingtalk-chat/SKILL.md	2026-07-30 13:41:02 +08:00
南润	014dea52f0	refactor(chat): remove media selection guard and related tests	2026-07-30 12:41:21 +08:00
南润	20c2ff98c2	Merge branch 'main' into codex/im-chat-skill-hint-align	2026-07-30 10:53:44 +08:00
南润	c7ea642aef	fix(chat): enforce destructive guards and media validation	2026-07-30 10:34:42 +08:00
瑞达	b5af90c089	test: satisfy coverage for chat hints	2026-07-29 20:04:05 +08:00
瑞达	a5ee9dffe2	Merge remote-tracking branch 'origin/main' into codex/im-chat-skill-hint-align	2026-07-29 19:43:59 +08:00
瑞达	7179928c75	Merge remote-tracking branch 'origin/main' into codex/im-chat-skill-hint-align # Conflicts: # internal/app/schema_shortcut_contract_test.go # internal/cli/schema_agent_metadata/index.json # internal/cli/schema_agent_metadata_audit.json # internal/cli/schema_catalog/catalog.json # internal/cli/schema_catalog/tools/chat.json # internal/cli/schema_command_registry/products/chat.json # internal/cli/schema_hints/runtime-surface-completeness.json # skills/multi/dingtalk-chat/SKILL.md # skills/multi/dingtalk-chat/references/chat.md	2026-07-29 19:20:08 +08:00
瑞达	8e48ede81a	feat(chat): align skill hints and schema	2026-07-29 15:45:32 +08:00