@kunolu/omp-sbtd 0.2.0-rc.2

Release identity / 发布身份

• Annotated tag / 标注标签: omp-sbtd-v0.2.0-rc.2 (tag object d22a877b449cfde587f2f0041ab27256176df765)
• Commit / 提交: 2393d10c3fb1a1f3cb756a351297a430fd2afc81 (#124 squash merge)
• PR-tip CI / PR tip CI: omp-runtime-linux-probe (Frozen-tarball Host Event live cell on ubuntu-latest) green on tip 7432be486b42c3b7326ed1b0574d0bab38b30739 (squash source of this merge) — https://github.com/KunoLu/sbtd-plugins/actions/runs/39954216679
• Packed tarball check / 打包核验: rebuilt from a clean worktree at the merge commit; check-package --packed exit 0, no SBOM_MISMATCH; 472 files (includes README.zh.md, byte-identical to source); tarball SHA-256 3b6c696e15798146251712498672f92bc01a089d3e536273d00ec3d23f49604b; sourceTreeSha256 d45faca21edbe2f5d580942a6739499c343a5811697cdb889d7c8788a5634870, sbomSha256 06eac22d3d5a7170e2b21002cf5d954692aefaa3d9e89fb51b93e4b1d71f14e1
• npm: @kunolu/omp-sbtd@0.2.0-rc.2, to be published to npm dist-tags next and latest / 将发布到 npm dist-tag next 与 latest

English

Breaking

• Host event evidence v2. The current contract and evidence profile are omp-extension-v2 / omp-host-events-v2. Evidence consumers must use v2; historical v1 ledger records remain read-only and are not relabeled as v2.
• Required handoff proof. session_compact is now a required Host Event: 13 required events plus 1 optional event make 14 subscriptions. A successful handoff must be proven by a correlated session_compact with compactionEntry.method === "handoff". A missing method or a competing compact in the window fails; HANDOFF_EVENT_UNOBSERVABLE is a hard failure again.

Changed

• Renamed the Chinese README from README_zh.md to README.zh.md and included it in the npm package, with both language links pinned to this release tag.

Sources: #123 (implementation) and #122 (contract decisions).

简体中文

Breaking（破坏性变更）

• Host Event 证据 v2。 当前契约与证据 profile 为 omp-extension-v2 / omp-host-events-v2。证据消费者须使用 v2；历史 v1 ledger 记录保持只读，不重标为 v2。
• 必需的 handoff 证明。 session_compact 现为必需 Host Event：13 个必需事件加 1 个可选事件，共 14 个订阅。成功 handoff 必须由关联的 session_compact 证明，且 compactionEntry.method === "handoff"。缺少 method 或窗口内存在竞争 compact 均失败；HANDOFF_EVENT_UNOBSERVABLE 恢复为硬失败。

变更

• 中文 README 从 README_zh.md 改名为 README.zh.md，随 npm 包发布；两个语言链接均钉本 release tag。

来源：#123（实现）与 #122（契约决定）。

Deployment boundary / 部署边界

This release does not change the omp peer range (>=18 <19, tested on 18.11.1), does not touch @kunolu/dsh-sbtd, and does not modify any existing host installation; hosts pick it up only on their next omp plugin install/update. Because latest will also point to 0.2.0-rc.2, unversioned installs resolve to this RC.

本次发布不改变 omp peer 范围（>=18 <19，实测 18.11.1），不涉及 @kunolu/dsh-sbtd，也不改动任何已有宿主安装；宿主只在下次 omp plugin install 或更新时取得。由于 latest 也将指向 0.2.0-rc.2，不带版本的安装会取得此 RC。

Full comparison / 完整对比: omp-sbtd-v0.2.0-rc.1...omp-sbtd-v0.2.0-rc.2

@kunolu/dsh-sbtd 0.2.0-rc.2

Release identity / 发布身份

• Annotated tag / 标注标签: dsh-sbtd-v0.2.0-rc.2
• Commit / 提交: 548a0bf125e3b3fe1407de11094409e55c2e779e (squash merge of #118)
• Exact-commit CI / 精确提交 CI: Frozen-tarball Host Event live cell green on tip 40dc46d (squash source of this merge) — https://github.com/KunoLu/sbtd-plugins/actions/runs/39928174466
• Native scope verified / 原生范围核验: @kunolu/dsh-sbtd@0.2.0-rc.2 on npm, dist-tags next and latest both 0.2.0-rc.2 (shasum 3e414ff4440cee1e7a1bb59fb58cc1e548912239); unit tests 342/342; tarball 103 files incl. README.md, README.zh.md, CHANGELOG.md, CHANGELOG.zh.md

English

Changed

• Documentation-only RC: English default README.md and Chinese mirror README.zh.md, with release-tag-pinned language switchers.
• No runtime or contract changes. Host range remains >=0.2.0-rc.2 <0.3.0-0; development host stays pinned to @deepseek-ai/dsh@0.2.0-rc.2.

简体中文

变更

• 仅文档 RC：英文默认 README.md 与中文镜像 README.zh.md，顶部语言切换链接钉到 release tag。
• 无运行时或契约变化。宿主范围保持 >=0.2.0-rc.2 <0.3.0-0；开发宿主仍钉为 @deepseek-ai/dsh@0.2.0-rc.2。

Deployment boundary / 部署边界

English: This tag and prerelease were created after the npm publish (backfilled) so the README language links resolve; the package was not republished. The manual dsh-host-compat run on this commit (https://github.com/KunoLu/sbtd-plugins/actions/runs/39933109206) is red on both REQUIRED rows because the smoke script still hardcodes plugin version 0.1.0-rc.3 (stale since #99); a chore PR will fix it and rerun. Until then 0.2.x has no green REQUIRED host smoke. This release does not change existing hosts.

简体中文：本 tag 与 prerelease 在 npm 发布之后补建，用于让 README 语言链接可访问；包未重新发布。本提交上手动触发的 dsh-host-compat（https://github.com/KunoLu/sbtd-plugins/actions/runs/39933109206）两个 REQUIRED 格均为红，原因是 smoke 脚本仍写死插件版本 0.1.0-rc.3（自 #99 起过期）；将由 chore PR 修复后重跑。在此之前 0.2.x 没有绿色的 REQUIRED 宿主冒烟结果。本次发布不改动已有宿主。

Full comparison / 完整对比: dsh-sbtd-v0.2.0-rc.1...dsh-sbtd-v0.2.0-rc.2

@kunolu/omp-sbtd 0.2.0-rc.1

Release identity / 发布身份

• Annotated tag / 标注标签: omp-sbtd-v0.2.0-rc.1 (tag object 942fca1322fe6b3fc8441fe3a83d0e0198b850ab)
• Commit / 提交: f4ea2ac729a6fda86cd41425563d65c68afb3aa3 (#114 squash merge)
• PR-tip CI / PR tip CI: omp-runtime-linux-probe green on tip fa669e64d83bfa06602669ef89c02bb70f84d085 (squash source of this merge) — https://github.com/KunoLu/sbtd-plugins/actions/runs/39773197353
• Packed tarball check / 打包核验: check-package --packed exit 0, no SBOM_MISMATCH; 471 files; sourceTreeSha256 06b01ba05f97e91ff979f11ae76664ab5375e80f84bfa33ab92d4c40f1014a06, sbomSha256 b654e0be249c9200d94a6d0d9497d90a5dc4520fdc8de8740a38ae5f154f7b14
• npm: @kunolu/omp-sbtd@0.2.0-rc.1, to be published to npm dist-tags next and latest / 将发布到 npm dist-tag next 与 latest

English

Breaking

• No longer supports omp 17.x; tested only on 18.11.1; as of the D11 lock on 2026-10-19, upstream latest was 18.12.2.
• Unversioned installs (omp plugin install @kunolu/omp-sbtd) now resolve to 0.2.0-rc.1, because npm dist-tags latest and next both point to it; it requires omp >=18 <19. omp 17.x users must explicitly pin an older 0.1.x version.

Added

• Expanded onboard runtime bundle. Includes all 33 upstream Python scripts, nine runtime assets, onboard-contracts.schema.json, upgrade.schema.json, and the sbtd-task template tree (eight template files, plus LICENSE and NOTICE).
• Python dependency preflight. Ships kit/onboard/runtime/requirements.txt with five pinned dependencies: jsonschema, PyYAML, markdown-it-py, tomlkit, and cryptography. Recognized dependency-requiring SBTD Python commands, including upgrade and migration, are checked in isolation before execution and fail closed if any dependency is missing; signature verification refuses to run without cryptography. No automatic installation or skipped fallback. Standard-library-only onboard commands remain usable; this host guard is not a general shell sandbox.
• Install-path host smoke. Verified the packed plugin on omp 18.11.1 through installation and discovery via omp.extensions, real command, tool and hook registration, and project onboard. This is smoke evidence, not model end-to-end testing or full host-event certification.

Changed

• Kit ownership. Moved sync, projection and generation into packages/omp-sbtd/scripts/ and packages/omp-sbtd/upstream/, then deleted the private packages/sbtd-workflow-kit workspace package. Supply-chain sourceId remains sbtd-workflow-kit-upstream.
• Upstream sync. Updated to 640-skills v2.0.2 (1d82494d74f6df9bca7dccef2da409f87091883e) with transformVersion: p0-v4. Both embedded AGENTS templates now use that revision; third-party notices were regenerated.
• Canonical runtime projection. Expanded the PROJECTION_FORBIDDEN_TOKEN exemption from onboard.py to the canonical onboard runtime Python scripts, assets and two schemas. Content remains digest-bound to the canonical manifest; overlays cannot use the exemption for non-canonical content.
• Portable Skill candidates. Removed the deleted upstream trellis-workflow candidate; missing candidates still fail closed.
• Onboard Skill catalog. Replaced skill:trellis-workflow and skill:trellis-channel with skill:sbtd-task.
• omp 18 host contract. The peer range is >=18 <19, with the development dependency pinned to 18.11.1. Event schemas accept session_branch reasons branch, fork, btw and session_switch reasons new, resume, fork.
• v2.0.2 task routing. The optional trellis capability now maps to sbtd-task, without requiring .trellis/workflow.md for Skill readiness. Read-only task observation recognizes in-progress and checking records under ai/tasks/** and .sbtd/tasks/**; legacy .trellis observation remains read-only. Task state writing stays with sbtd-task.

Known limitations

• Handoff evidence on omp 18.x. Handoff is not observable as session_switch. The p0 host-event live cell temporarily records HANDOFF_EVENT_UNOBSERVABLE as a diagnostic rather than a hard failure. A registered follow-up will first update the PRD, then implement session_compact observation in a separate code PR and restore the hard failure for missing handoff evidence after that code PR merges.

Known issue

• Exact-local-OMP 18.11.1 smoke test not passed on the release host. In the full test suite (884 passed / 1 failed / 3 skipped), test/p0-authorized-omp-rpc-harness.test.ts › "smoke-only: exact local OMP 18.11.1 …" fails because the release host's Bun offline cache lacks the zod and @oh-my-pi/pi-coding-agent manifests. This is an environment cause and is recorded as not passed (not PASS); the release proceeds by user decision on 2026-10-22 20:27 (UTC+8). The D11 hard gate — the omp 18.11.1 real-host install-path smoke (row C, #107) — passed. A separate fix task will follow.

简体中文

Breaking（破坏性变更）

• 不再支持 omp 17.x；只在 18.11.1 上实测过；截至 2026-10-19 D11 锁定时，上游最新是 18.12.2。
• 不带版本的安装（omp plugin install @kunolu/omp-sbtd）现在会取得 0.2.0-rc.1，因为 npm dist-tag latest 与 next 均指向该版本；它要求 omp >=18 <19。omp 17.x 用户须显式钉旧的 0.1.x 版本。

新增

• 扩展 onboard runtime 随包内容。 收录全部 33 个上游 Python 脚本、9 个 runtime assets、onboard-contracts.schema.json、upgrade.schema.json，以及 sbtd-task 模板树（八个模板文件，另含 LICENSE、NOTICE）。
• Python 依赖预检。 随包提供 kit/onboard/runtime/requirements.txt，含 5 个钉版依赖：jsonschema、PyYAML、markdown-it-py、tomlkit 和 cryptography。对可识别且需要依赖的 SBTD Python 命令（含 upgrade 与 migration），执行前进行隔离检查；缺任一依赖即 fail-closed 拒跑，验签缺 cryptography 也拒跑。不自动安装，不降级为 skipped。仅用标准库的 onboard 命令仍可用；此宿主 guard 不是通用 shell sandbox。
• 安装路径宿主 smoke。 已在 omp 18.11.1 上验证打包插件的安装、经 omp.extensions 发现、真实命令/工具/hook 注册及项目 onboard。这是 smoke 证据，不是模型端到端测试或完整宿主事件认证。

变更

• Kit 归属。 同步、投影与生成迁入 packages/omp-sbtd/scripts/ 和 packages/omp-sbtd/upstream/，随后删除私有 workspace 包 packages/sbtd-workflow-kit。供应链 sourceId 保持 sbtd-workflow-kit-upstream。
• 上游同步。 升至 640-skills v2.0.2（1d82494d74f6df9bca7dccef2da409f87091883e），transformVersion 为 p0-v4。两个嵌入 AGENTS 模板统一到该 revision，third-party notices 已重新生成。
• Canonical runtime 投影。 PROJECTION_FORBIDDEN_TOKEN 豁免从 onboard.py 扩展到 canonical onboard runtime 的 Python 脚本、assets 与两个 schema。内容仍以 digest 绑定 canonical manifest；overlay 不能借该豁免引入非 canonical 内容。
• Portable Skill 候选。 移除上游已删除的 trellis-workflow 候选；缺失候选仍 fail-closed。
• Onboard Skill catalog。 用 skill:sbtd-task 替换 skill:trellis-workflow 与 skill:trellis-channel。
• omp 18 宿主契约。 peer 范围为 >=18 <19，开发依赖精确钉 18.11.1。事件 schema 接受 session_branch 的 branch、fork、btw reason，以及 session_switch 的 new、resume、fork reason。
• v2.0.2 任务路由。 optional trellis capability 现映射到 sbtd-task，Skill readiness 不再要求 .trellis/workflow.md。只读任务观测识别 ai/tasks/** 与 .sbtd/tasks/** 下状态为 in-progress 或 checking 的记录；旧 .trellis 观测保持只读。任务状态仍由 sbtd-task 写入。

已知限制

• omp 18.x 的 handoff 证据。 handoff 无法作为 session_switch 观测；p0 host-event live cell 暂将 HANDOFF_EVENT_UNOBSERVABLE 记为 diagnostic，而非硬失败。已登记后续：先更新 PRD，再以独立代码 PR 实现 session_compact 观测；该代码 PR 合并后，恢复对缺失 handoff 证据的硬失败。

已知问题

• 发布机上 exact-local-OMP 18.11.1 smoke 测试未通过。 全量测试（884 通过 / 1 失败 / 3 跳过）中，test/p0-authorized-omp-rpc-harness.test.ts › "smoke-only: exact local OMP 18.11.1 …" 失败，原因是发布机 Bun 离线缓存缺少 zod 与 @oh-my-pi/pi-coding-agent 的 manifest。属环境原因，记为未通过（不记为 PASS）；按用户 2026-10-22 20:27（UTC+8）决定保留并继续发版。D11 硬门——omp 18.11.1 真实宿主安装路径 smoke（行 C，#107）——已通过。后续将另开修复任务。

Install / 安装

English: Prefer the exact RC over a moving dist-tag such as @latest for a reproducible installation. Requires omp >=18 <19; check with omp --version first.

简体中文：为保证可复现安装，优先使用精确 RC 版本，而非 @latest 这类会移动的 dist-tag。要求 omp >=18 <19，安装前先用 omp --version 确认。

omp plugin install @kunolu/omp-sbtd@0.2.0-rc.1
# project scope only / 仅当前项目:
omp plugin install --scope project @kunolu/omp-sbtd@0.2.0-rc.1

Deployment boundary / 部署边界

English: 0.2.0-rc.1 is to be published to npm dist-tag next, then dist-tag latest will also be moved to 0.2.0-rc.1 (D4), so latest = next = 0.2.0-rc.1. Unversioned installs will then get 0.2.0-rc.1, which needs omp >=18 <19; omp 17.x users must pin an older 0.1.x version (for example @kunolu/omp-sbtd@0.1.0-rc.14).

简体中文：0.2.0-rc.1 将发布到 npm dist-tag next，随后 dist-tag latest 也将指向 0.2.0-rc.1（D4），即 latest = next = 0.2.0-rc.1。届时不带版本的安装会取得 0.2.0-rc.1，要求 omp >=18 <19；omp 17.x 用户须钉旧的 0.1.x 版本（例如 @kunolu/omp-sbtd@0.1.0-rc.14）。

Docs / 文档: README (English) · README（简体中文） · CHANGELOG · CHANGELOG（中文）

Full comparison / 完整对比: f11abd2...omp-sbtd-v0.2.0-rc.1

@kunolu/dsh-sbtd 0.2.0-rc.1

Release identity / 发布身份

• Annotated tag / 标注标签: dsh-sbtd-v0.2.0-rc.1
• Commit / 提交: 1fdf9e8701afbb7d199c3f3ca5d10ac4a6a0a831
• Exact-commit CI / 精确提交 CI: Frozen-tarball Host Event live cell green on tip 1798018ad41c235ff4b1862d2186cf811e997440 (squash source of this merge) — https://github.com/KunoLu/sbtd-plugins/actions/runs/39162856179
• Native scope verified / 原生范围核验: @kunolu/dsh-sbtd@0.2.0-rc.1 on npm dist-tag next (shasum 0b4f3ef93703963757cd8cb991a65bb1d0cd35e6); latest remains 0.1.0-rc.1

English

Added

• Graft analysis backend for sbtd_validate pre/post (read-only via managed launcher; six skip reasons; never blocks load; strict → graftEvidence: "未证明").
• sbtd-task read layer and layered workflow_mode resolution (tool/host → task file → default); plan/review/validate return mode + source.
• Lessons v2 (.sbtd/developer identity; layered docs/lessons/ store; legacy .trellis lessons read-only; graft-mismatch rename).
• V4 host adaptation: notice kind 'dsh-sbtd' (legacy 'plugin:dsh-sbtd' still recognized); runPreStep preserves startsRequestSeries.
• sbtd-task manual synced from 640-skills v2.0.2 (1d82494d…) including references/ + task-data.schema.json.
• Two-row REQUIRED host-compat CI for @deepseek-ai/dsh 0.2.0-rc.2 and 0.2.1-rc.2.

Changed

• Host range: peerDependencies["@deepseek-ai/dsh"] and engines.dsh both >=0.2.0-rc.2 <0.3.0-0; devDep pin 0.2.0-rc.2.
• sbtd_validate analysis field gitnexus → graft (no dual field).
• Mode-gated enforcement (strict deny vs default/lite notice on failed required book gates).
• Draft-only planning tools (sbtd_spec / sbtd_tickets / task-artifact); TaskStore remains the only task writer.
• Manuals supply chain pinned to 640-skills v2.0.2 with per-file sha256 MANIFEST.

Removed

• Trellis backend and GitNexus backend (including trellis-workflow manual). Plugin no longer writes .trellis/**; legacy lessons trees stay readable.

简体中文

新增

• Graft 分析后端（sbtd_validate pre/post；只读走 managed launcher；六种 skip reason；不拒载；strict 下记 graftEvidence: "未证明"）。
• sbtd-task 只读层与 workflow_mode 分层解析（工具/宿主 → task.md → default）；plan/review/validate 返回模式与来源。
• lessons v2（.sbtd/developer 身份；docs/lessons/ layered 库；旧 .trellis lessons 只读；graft-mismatch 改名）。
• V4 宿主适配：notice kind 'dsh-sbtd'（仍识别 'plugin:dsh-sbtd'）；runPreStep 保留 startsRequestSeries。
• sbtd-task 手册同步自 640-skills v2.0.2（1d82494d…），含 references/ 与 task-data.schema.json。
• 两行 REQUIRED 宿主兼容 CI：0.2.0-rc.2 与 0.2.1-rc.2。

变更

• 宿主范围：peerDependencies["@deepseek-ai/dsh"] 与 engines.dsh 均为 >=0.2.0-rc.2 <0.3.0-0；devDep 钉 0.2.0-rc.2。
• sbtd_validate 分析字段 gitnexus → graft（不留双字段）。
• 按模式分级强制（strict deny；default/lite 降级 notice）。
• 规划类工具只回草稿；任务记录唯一 writer 仍是 TaskStore。
• 手册供应链钉 640-skills v2.0.2，MANIFEST 逐文件 sha256。

移除

• Trellis 后端与 GitNexus 后端（含 trellis-workflow 手册）。不再写 .trellis/**；旧 lessons 树仍可读。

Deployment boundary / 部署边界

English: npm install with @deepseek-ai/dsh@0.2.1-rc.2 can ERESOLVE (npm peer default lacks includePrerelease across patch-rc). pnpm host-compat REQUIRED rows for 0.2.0-rc.2 and 0.2.1-rc.2 pass. Range stays >=0.2.0-rc.2 <0.3.0-0 (no retreat). Prefer pnpm / dsh plugin manager; npm users on 0.2.1-rc.2 may need overrides. This publish updates dist-tag next only — latest remains 0.1.0-rc.1.

简体中文：搭配 @deepseek-ai/dsh@0.2.1-rc.2 用 npm install 可能 ERESOLVE（npm peer 默认无 includePrerelease，跨 patch rc）。pnpm 宿主兼容两行 REQUIRED 均通过。范围保持 >=0.2.0-rc.2 <0.3.0-0，不退回。推荐 pnpm / dsh 插件管理器；npm 0.2.1-rc.2 用户可能需 overrides。本次只更新 dist-tag next，latest 仍为 0.1.0-rc.1。

Full comparison / 完整对比: bbe1178...dsh-sbtd-v0.2.0-rc.1