## 中文
sidecar 的 `spec` 未声明 `installPolicy` / `updatePolicy`，而 legacy 侧对双缺省派生为
`market` / `market`，导致 `compareMarketCatalogWithLegacy` 判定
`spec.agent.policy` 不一致，**整个 sidecar 被拒**（`sidecarRejected`）并回退
listing-only。
真机取证——客户端市场索引 `cache/market/index.json` 中该条目：
```json
"sidecarRejected": true,
"catalogDiagnostics": [
{"code": "market.catalog-legacy-mismatch", "field": "governance.availability"},
{"code": "market.catalog-legacy-mismatch", "field": "spec.agent.policy"}
]
```
本 PR 修掉其中的 `spec.agent.policy`。另一条 `governance.availability`
是**客户端侧的结构性缺陷**，不在本仓库范围：`market-agent-entry.client.schema.json` 等 5 个
market schema 均无 `availability` 字段且 `additionalProperties: false`，因此
pointer 条目的 legacy availability 恒为 `listing-only`，sidecar 声明
`installable` 必然 mismatch。主仓库已另开 PR 修复，客户端发版后本条目即可生效；在此之前旧客户端会降级为
listing-only 展示，不影响可用性。
校验：`validate_catalog_metadata.py` 0 error。
---
## English
The sidecar's `spec` omitted `installPolicy` / `updatePolicy`, while the
legacy side derives `market` / `market` from the double default.
`compareMarketCatalogWithLegacy` therefore flagged `spec.agent.policy`
as inconsistent and **rejected the whole sidecar**, falling back to
listing-only.
Verified against a live client's market index, which showed
`sidecarRejected: true` with diagnostics for both `spec.agent.policy`
and `governance.availability`.
This PR fixes the former. The latter is a **structural gap on the client
side**, outside this repository: none of the five market schemas carry
an `availability` field and all set `additionalProperties: false`, so a
pointer entry's legacy availability is always `listing-only` and any
sidecar declaring `installable` must mismatch. A separate PR in the main
repository addresses that; this entry becomes effective once the client
ships it. Older clients degrade to listing-only, which does not affect
usability.
Validation: 0 errors from `validate_catalog_metadata.py`.
## 中文
把「企业微信助手」从 inline 形态改为 pointer 形态，并补齐严格证据门槛，使其成为**首个可一键安装的 Market
Agent**。
### 为什么改
此前该条目在市场详情页显示「仅收录 / 当前不能由 DesireCore 一键获取」。判定源是
`evaluateCatalogAcquisitionEligibility`：Agent 类条目**不享受** builtin Skill 的
`isTrustedBundledBuiltin` 快捷通道（该函数硬编码 `kind === 'skill'`），必须走 content
不可变 + license known + compliance 三重匹配的严格门槛。这与本仓库 README 的「Agent pointers
do not receive the built-in Skill exceptions」及 ADR-137 一致，是有意的设计而非缺陷。
inline 形态还存在自指问题：证据要求 `content` 指向不可变 commit，而 inline
内容就在本仓库里，条目无法预知自己将被合并进哪个 commit。现网 41 个 inline 条目全部没有 `content`，30 个
pointer 条目全部有——数据印证了这一点。
### 改了什么
**形态**：内容迁至 `desirecore-agent/wecom-assistant`，本仓库只保留 `entry.json` 与
sidecar。删除 53 个文件 / 16494 行，条目从 1.0M（全仓最大的 Agent 条目）降到数 KB。符合
ADR-038「market 仓库只放元数据、不放具体内容」。
**证据六项**：
| 项 | 值 |
|---|---|
| `provenance.content` | git + `665ab1d2…`（https + 40 位 SHA） |
| `governance.license` | `unknown` → `known` / MIT，`evidencePath:
LICENSE` |
| `governance.compliance` | 五项齐备，`reviewedRef` 等于 `content.ref` |
| `timestamps.reviewedAt` | 与 `compliance.reviewedAt` 逐字一致 |
| `availability` | `listing-only` → `installable` |
| `redistribution` | 与 `entry.json` 同为 `source-pointer-only` |
**内容侧**（在内容仓库中完成）：13 个业务技能改为 vendor 企业微信官方
`WecomTeam/wecom-cli`（MIT，pinned `78c514b2`），自维护 `wecom-shared` /
`wecom-chat` / `wecom-workflows` 三个治理与增量技能。官方内容量为原自研版的 1.6 倍（21.6k vs
13.7k 行），并已修正官方 `meeting rooms search` 的 3
个失效参数名——`room_keyword`/`min_capacity`/`building_city` 在 CLI 1.2.0 已改名，而
CLI 对未知字段不校验、原样透传，会导致静默订错会议室。MIT 署名义务由内容仓库的 `NOTICE` 与
`third_party/wecom-cli/LICENSE` 履行。
### 校验
`validate_catalog_metadata.py` 0 error、`validate-i18n.py` 0
error、`gen-collection-children.py --check` 通过（wecom-cli 14 children）。129
个 warning 均为其他既有条目所有，本次未新增。
### 已知风险
市场 Agent 的安装链路此前**从未被真实用户走过**（现网 0 个 installable
agent，仅有单测覆盖）。合并后需真机验证安装、并重启客户端后再验一次卸载。
---
## English
Switches the WeCom Assistant entry from inline to pointer form and
supplies the full acquisition evidence, making it the **first
installable Market Agent**.
### Why
The entry previously rendered as listing-only. Agent items do **not**
receive the builtin-Skill fast path in
`evaluateCatalogAcquisitionEligibility` (`isTrustedBundledBuiltin`
hardcodes `kind === 'skill'`), so they must satisfy the strict gate:
immutable content, known license, and ref-bound compliance. That matches
this repo's README ("Agent pointers do not receive the built-in Skill
exceptions") and ADR-137 — it is deliberate, not a defect.
Inline form also has a self-reference problem: the gate requires
`content` to pin an immutable commit, but inline content lives in this
repository and cannot know which commit will carry it. All 41 inline
entries currently lack `content`; all 30 pointer entries have it.
### What changed
**Form**: content moved to `desirecore-agent/wecom-assistant`; only
`entry.json` and the sidecar remain here. 53 files / 16494 lines
removed, shrinking the entry from 1.0M (the largest Agent entry in the
repo) to a few KB, per ADR-038.
**Evidence**: `provenance.content` pins `665ab1d2…`; license becomes
known/MIT with `evidencePath`; compliance carries all five required
fields with `reviewedRef` equal to `content.ref`;
`timestamps.reviewedAt` matches `compliance.reviewedAt`; availability
becomes `installable`; redistribution aligns with `entry.json`.
**Content side**: 13 business skills are now vendored from the official
`WecomTeam/wecom-cli` (MIT, pinned `78c514b2`) — 1.6× the volume of the
previous in-house set — with three self-maintained skills for governance
and coverage gaps. Three stale meeting-room parameter names were
corrected; the CLI passes unknown fields through without validation, so
the stale names would silently book the wrong room. MIT attribution is
carried by `NOTICE` and `third_party/wecom-cli/LICENSE` in the content
repository.
### Validation
0 errors from the catalog and i18n validators; collection children check
passes. The 129 warnings all belong to pre-existing entries.
### Known risk
The Market Agent install path has never been exercised by a real user (0
installable agents in production; unit tests only). Post-merge, install
should be verified on a real client, and uninstall re-verified after a
restart.
