Move the interactive pi-tui front door into @deepseek-ai/dsh-tui while keeping @deepseek-ai/dsh-stdio line-oriented for pipes. Select the terminal package in the demo app, preserve logger ownership, and cover the production Loader composition with a PTY smoke test.
A source-of-truth link did not make the review obligation explicit, so reviewers could treat green documentation checks as sufficient. Make dsh-prose-standard a blocking requirement for every added or changed prose form and require semantic comparison with the owning code or behavior.
The original PR branch merged the same current master while the inline-feedback work was in progress. Preserve that remote ancestry and combine it with the local review-fix commit instead of overwriting or rewriting either history.
The public kill result used the awkward phrase already-terminal. Rename it to already-finished and keep the model-facing response aligned; not-alive would be inaccurate because a force-failed registry record can still correspond to orphaned producer work.
Task kinds were open strings even though producer namespaces are an extension point. Add the merge-extensible TaskKindMap and derived TaskKind, cover consumer declarations in task and bundle tests, and retain the runtime non-empty check for untyped callers.
With exactOptionalPropertyTypes, owner?: Agent | undefined allowed an explicit undefined value that no caller needs. Tighten the property to owner?: Agent so unowned work is expressed by omitting it.
Record the requested task-service/backend split as a follow-up, using a systemd-backed runtime as a concrete candidate without guessing its durability and ownership contract in this PR. Regenerate the type and Cordis catalogs so public docs match the declarations.
Comparing a feedback-time PR commit directly with the landing merge lets unrelated target-branch changes satisfy a review comment and creates false adoption evidence.
Define feedback-time and final PR-specific patch snapshots, fail closed when the landing shape cannot be reconstructed, and require a target-only negative control before implementation.
A saved complete-file candidate could overwrite newer skill guidance, while a provider-wide outage was indistinguishable from a healthy no-op run. Record the source blob and provenance, reject drift during promotion, and make total adapter failure visible.
Align cadence and feedback acquisition with the evidence contract, and narrow the borrowed-state and negative-control checks so they do not contradict the package and testing standards.
Refresh the background-task branch onto the latest repository baseline before applying review feedback. This preserves merge ancestry, incorporates the current CI and package-structure changes, and ensures the review fixes are validated against the code that will actually receive the PR.
The background-task change repeated its lifecycle design across implemented RFCs, package READMEs, JSDoc, test commentary, and model-visible schemas. That repetition obscured the contracts that maintainers must preserve and added avoidable prompt tokens.
Rewrite the implemented RFCs around the current design, keep authorization, exact-owner cleanup, wait/abort ordering, producer quiescence, and teardown-failure guarantees at their owning surfaces, and remove peer surveys, review history, control-flow narration, and emphatic restatement.
Shorten the task and subagent schema wording, synchronize the bilingual tool cookbook, and regenerate the config, service, RFC, tool, and replay snapshot derivatives. Runtime behavior is unchanged; test edits update prose-only assertions and descriptions.
Entry point for the skill's operator and for any future handoff: what the
private periodic tool produces, where the saved candidate diff and SKILL.md
land on the operator's machine, and how the promote helper turns the
operator's decision into a draft PR from a clean master checkout. Companion
to the maintenance RFC.
A private out-of-repo maintainer tool turns adopted human review feedback
into candidate skill updates. Only the resulting SKILL.md diff enters this
repository through normal PR review; the tool source, adapter binaries,
provider credentials, and scheduler stay on the maintainer's machine to
keep this repository focused on shipped product code. Kept in proposed/
until end-to-end verification against master lands a candidate PR; the
acceptance criteria list the exact observations that unlock promotion.
The acp built-bin smoke killed its child and immediately rm'd the temp
consumer dir; POSIX tolerates unlinking a live process's cwd, Windows fails
EBUSY while the child still holds its cwd and session-log handles (the CI
windows job's only red step). Await the child's exit after SIGKILL and give
both smokes' rm a brief retry for the OS handle-release lag.
glob/globSync returns host-separator paths on Windows. Nine scripts that consume these paths for split('/'), manifest-key comparison, startsWith/includes exclusion checks, or committed-output rendering now normalize with .map(s => s.split(sep).join('/')) at ingestion. This replaces the previous replaceAll('\\\\', '/') with an explicit, self-documenting OS-separator-to-POSIX conversion.
The ::warning:: wrapper kept the lane job green on failure — honest
about not gating merges, but a Windows regression was visible only as
an annotation buried in the run summary. GitHub has no yellow job
state, so the choice is green+annotation (too hidden) or a red X on a
non-required job (visible, still non-blocking). Take the red X:
job-level continue-on-error, plain 'Run gates' step, one less wrapper.
The step stays on the runner's native pwsh — never shell: bash — per
the MSYS-parent leak recorded in the windows-support RFC.
Also remove the temporary Windows-only failing demo test that
exercised the wrapper's annotation path (REVERT ME commit a496b9ae).
The lane-split merge moved the Run gates step to `shell: bash`, which
broke it twice over. First, GHA's bash shell runs with -e, so a failing
gate aborted the step before the ::warning::/exit 0 lines — the lane
went red X instead of the intended yellow warning. Second, and worse,
Git Bash as the PARENT of the gate run leaks MSYS environment into the
suite itself, producing 8 real test failures the pwsh-launched runs
(and the DSec VM runs) never saw:
- bash exports PWD; the MSYS runtime rewrites it to Windows form for
native children, dsh-bash-local's adaptEnv passes it through, and the
executor's MSYS bash adopts it — `pwd` prints `D:/a/...` where the
tests (and the executor's MSYS dialect) expect `/d/a/...` (7 tests).
- cygwin enables SeBackupPrivilege on the runner's admin token; children
inherit the enabled state, and libuv's FILE_FLAG_BACKUP_SEMANTICS read
opens then pierce the dwShareMode=0 lock the jsonl EBUSY test holds —
loadLive resolves instead of rejecting (1 test).
Evidence: run 28918325498 (pwsh step, pre-merge) failed only the two
hooks dispose tests since fixed by f8fd8c00; run 28921741006 (bash
step) fixed those and failed exactly the 8 above, with zero relevant
source diff between them.
Fix: run the wrapper in pwsh — a native command's failure doesn't abort
pwsh, so $LASTEXITCODE capture + ::warning:: + exit 0 works without an
errexit dance, and the gates start from a native Windows shell as they
do everywhere else Windows CI has been validated.
Docs: the windows-support RFC drops the stale continue-on-error wording
(replaced by the warning wrapper) and records the launch-environment
limitation — native shell required today; making an MSYS parent a
supported launch environment (PWD scrub in adaptEnv, privilege-explicit
tests) is a future improvement direction.
The Windows CI was a single job running the full ci-windows inventory
(check:ci:windows), while Linux splits into 5 lanes (static/lint/coverage/
snapshot/artifacts) per the parallel-gates RFC. The single-job shape was a
transitional artifact from when Windows CI was added as a non-required
observation lane; its rationale ('keep gate parallelism modest so coverage
is not starved') conflated run-gates intra-job concurrency
(DSH_GATE_CONCURRENCY) with GitHub job fan-out — orthogonal concerns.
Split Windows into 4 lanes mirroring Linux (snapshot absent: its goldens
are Linux-recorded and self-skip on Windows). Each lane is a separate
GitHub job so a Windows regression is attributable to one lane, not
buried in one job's log. Concurrency is NOT throttled versus Linux: the
lane is non-blocking (continue-on-error), and the observational stance
is to actively expose Windows-arm issues rather than hide them behind
reduced parallelism.
- scripts/run-gates.ts: add ci-windows:static/lint/coverage/artifacts
modes; ci-windows (full inventory) is retained as the local one-process
entry, symmetric with Linux's ci-primary.
- .github/workflows/ci.yml: windows job becomes a matrix over the 4 lanes.
- package.json: check:ci:windows:{static,lint,coverage,artifacts} scripts.
- AGENTS.md + windows-support RFC: document the per-lane, non-blocking,
unthrottled stance.
Verified: scripts/caohuanqi-private/run-ci.py --windows (full
check:ci:windows) — all gates green except the known hooks-claude
bridge.spec waitFor timeout (pre-existing Windows subprocess-timing
flake, unrelated).
Add a Windows CI job alongside the existing Linux checks. Runs the full
test suite (without the Linux-only coverage gate) plus typecheck, lint,
doc-sync, build, hygiene, and demo smoke under PowerShell. Developer
Mode is enabled via registry for symlink support (fs-local tests,
verify-node-next-types).
Per the windows-support RFC transition plan: step (2) — non-required
Windows CI job to observe stability.
