Update the published team pointer to the reviewed team revision that
locks Lead and Evidence 0.1.1. Preview wording remains until
clean-install end-to-end acceptance is complete.
---------
Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
## 变更 / Changes
新增 Control 1.4.0 中英文市场安装指南及 README 应用入口，指向真正的应用数据源
desirecore/registry；同步 registering-services / using-services 到 1.0.4，明确
native-app 的对外 MCP 不可注册为内部服务。
Add bilingual marketplace documentation and update both service skills
without duplicating an App as an MCP service. Fixed native application
listing and lifecycle live in Registry; open-source implementation lives
in desirecore-agent/desirecore-cdp-mcp.
## 兼容 / Compatibility
Requires native-app-aware desktop (catalog minimum 10.0.169) and
app-install-manager >=1.4.0. Catalog publication does not upgrade the
desktop or Agent.
## 验证 / Verification
- i18n/catalog validation: 0 errors, 129 existing governance/freshness
warnings retained.
- scoped translation hash check: both skills up to date; no model API
invoked by checks.
- git diff --check passed; unrelated market entries preserved.
## Why\nPublish the intake-gate scope fix through the official market
pointer.\n\n## Changes\n- point team entry and catalog metadata to team
release 0.1.36\n- update contract-intake member to 1.0.6\n- preserve
tracked DOCX, parallel risk/jurisdiction, and human-review
disclosures\n\n## Validation\n- validate_catalog_metadata.py
--require-complete (0 errors, pre-existing warnings only)\n- python -m
unittest scripts.catalog.test_validate_catalog_metadata (47 passed)\n-
git diff --check
## Why
The published contract review team must reconcile redline delivery state
after `ExportRedlineDocument` succeeds.
## What changed
- publish team 0.1.34 at upstream ref 92cb41f
- update Lead pointer to 1.0.20 at cf11ca6
- keep source-pointer-only distribution and existing governance metadata
## Validation
- uv run scripts/i18n/validate-i18n.py
- uv run scripts/catalog/test_validate_catalog_metadata.py (47 passed)
- uv run scripts/catalog/validate_catalog_metadata.py (0 errors;
existing warnings)
- uv run scripts/i18n/translate.py --check
## Why
Publish the lead tool-permission fix so newly installed contract-review
teams can pass `ExportRedlineDocument` through the orchestrator to the
independent reviewer.
## What changed
- Point the official team entry at team commit
`948f61c6c2d9ea101023e66c6a8261288d2cfab7`.
- Publish version 0.1.33 and lead member version 1.0.19.
## Validation
- Team source `npm run check:gates` passed before this market update.
- Entry diff reviewed and source ref is a 40-character commit SHA.
## Why
Publish the corrected contract review team release after the newcomer
run found stale coverage matrix state.
## Change
- Team 0.1.32 points to team merge
`821f999b087c9a740b3b209963f5f123a3cc694d`.
- Lead member 1.0.18 is listed in the catalog.
## Validation
- `git diff --check`
This release publishes contract-review-team 0.1.28 from immutable team
commit f088da9eb61d084470e8ede578e73c8cd65b57cb.
Changes:
- Lock Lead 1.0.16 with bounded O0→O4 orchestration and receipt/matrix
synchronization.
- Lock jurisdiction-auditor 1.3.0 and risk-scanner 1.1.0 with one-turn
bounded evidence loops.
- Preserve existing intake, clause-extractor 1.1.0, and reporter
members.
- Update both entry and catalog metadata to the same full team commit
SHA.
Validation: contract-review-team npm run check:gates passes; market
validate and translate checks pass on this PR.
## Why
The contract review team now uses the merged `clause-extractor` 1.1.0
bounded checkpoint workflow. The official market entry still pointed at
team release 0.1.26 and clause-extractor 1.0.6.
## Change
- Publish team version 0.1.27.
- Point the source ref to merged team commit
`cb25d73a0dfbfc319df6eac2d254b3dbcc790e6e`.
- Update the member projection to clause-extractor 1.1.0.
## 变更说明 / What this changes
新增官方 Agent 条目「MiMo 模型余量检测」，以不可变 source pointer 形态收录，内容仓库为
`desirecore-agent/mimo-model-quota-monitor`。
- `agents/mimo-model-quota-monitor/entry.json` 指向已发布提交
`911c0a226346a8157f07d5218207f16e32ea82e0`。
-
`agents/mimo-model-quota-monitor/catalog-metadata.v1.json`：provenance、MIT
许可证证据、合规审查（`reviewedRef` 与内容 ref 一致），`availability: installable`。
- `requiredClientVersion: 10.0.156`：依赖该版本起的调度完成判据、调度权限上限与内嵌浏览器操作记录修复。
- `manifest.json`：Agent 计数与更新日期。
Agent 做什么：按计划（默认每小时）读取小米 MiMo 开放平台 Token Plan 余量，结构化写入 `latest.json`
与每轮一份历史文件，在余量偏低、消耗过快、即将重置或登录失效时提醒。只读、不执行命令；遇到验证码或短信验证时停下请人处理；登录凭据只经
DesireCore 加密凭据存储的占位符注入。
Adds the official "MiMo model quota monitor" Agent as an immutable
source pointer to `desirecore-agent/mimo-model-quota-monitor` at commit
`911c0a226346a8157f07d5218207f16e32ea82e0`, with a bilingual catalog
sidecar (provenance, MIT license evidence, compliance review with
`reviewedRef` equal to the content ref, `availability: installable`) and
`requiredClientVersion: 10.0.156`. The Agent reads the Xiaomi MiMo Token
Plan quota on a schedule, writes structured results, and alerts on low
quota, fast burn, upcoming reset or an expired login. It is read-only,
runs no shell commands, stops for CAPTCHA or SMS verification, and
receives credentials only through DesireCore's encrypted credential
placeholders.
## 校验 / Validation
- `uv run --quiet scripts/catalog/validate_catalog_metadata.py
--require-complete`：0 error（既有条目的 warning 未变）。
- 条目目录内所有 40
位十六进制值只有一个，即上面的提交号（`source.ref`、`provenance.content.ref`、`governance.compliance.reviewedRef`
三处一致）。
- 内容仓库：`agent.json` 通过 agentConfigSchema；`SKILL.md` frontmatter 通过技能
Schema；`HEARTBEAT.md` 被判为实质为空（心跳不会白调模型）；结果与账号 Schema 用样例和反例校验，共 19 项通过。
- 内容仓库共两个提交（首版 + SOP 失败分支表更新），不含账号标识、手机号或凭据。Git 提交元数据中的维护者邮箱是 DesireCore
组织所有公开提交一致使用的公开身份邮箱。
`validate_catalog_metadata.py --require-complete` reports 0 errors; the
entry directory contains exactly one 40-hex value, the pinned commit, in
all three places; the content repository passes agent config, skill
frontmatter, heartbeat and result/account schema checks (19 checks) and
has two commits (initial release plus the SOP failure-branch update)
without account identifiers or credentials.
## 真机验证 / Real-device verification
在 DesireCore dev 构建（10.0.156 之后的 dev，含
#2863/#2865/#2869）上安装本提交的内容，智能路由旗舰档，两个账号各一个每小时定时巡检，连续观察四轮：
| 轮次 | 结果 | 说明 |
|---|---|---|
| 账号 2 · 20:30 | ok | 经接口取到数据，`latest.json` 与本轮 history 文件通过
`result.schema.json`，history 先写、关闭会话、`latest.json` 最后写 |
| 账号 1 · 21:00 | blocked（`platform_unavailable`） |
本机网络间歇断连期间内置浏览器开不了会话；如实落盘，未新建浏览器环境、未反复填表，首轮不提醒 |
| 账号 2 · 21:30 | 失败 | 同一次断网里浏览器开不了会话，且 AI 审批上游持续 502，写 `latest.json`
被拒；平台按完成判据续跑一次后记为失败（已写入使用说明「已知限制」） |
| 账号 1 · 22:00 | blocked，已提醒 | 连续第二轮 `platform_unavailable`，按告警规则
`notify=true`、告警项 `blocked:platform_unavailable` |
四轮都没有执行任何命令，没有非预期工具调用，没有写出 `mimo-quota/` 与平台 Plan 目录以外的文件；每轮的结果文件都通过
Schema 校验。浏览器宿主把导航失败统一报成 `BROWSER_HOST_EXECUTION_FAILED` 的问题已在主仓 #2871
修复（10.0.157 起提供 `BROWSER_NAVIGATION_*` 闭集错误码），本提交的 SOP
失败分支表已随之更新：网络类失败按码重试一次、页面跳转顶替（ABORTED）先看停留页再分流、越出授权范围（ORIGIN_NOT_GRANTED
/ SCHEME_DENIED）不新建 space。旧客户端上这些码不会出现，条目行为退回原有兜底，不受影响。
Installed this commit's content on a DesireCore dev build (dev after
10.0.156, including #2863/#2865/#2869) with smart routing at the
flagship tier and one hourly schedule per account, and observed four
runs. Account 2 at 20:30 read the data through the API; `latest.json`
and the per-run history file passed `result.schema.json`, with history
written first, the session closed, and `latest.json` written last.
During a local network outage, account 1 at 21:00 could not open a
browser session and recorded `blocked` / `platform_unavailable` without
creating environments or retrying the login, and without notifying on
the first round; account 2 at 21:30 hit the same outage plus sustained
502s from the AI approval upstream, so its `latest.json` write was
denied and the run was recorded as failed after one platform
continuation (now listed under known limitations); account 1 at 22:00
was the second consecutive `platform_unavailable` and notified with
`blocked:platform_unavailable`. No run executed a command, called an
unexpected tool, or wrote outside `mimo-quota/` and the platform Plan
directory, and every result file passed schema validation. The browser
host reporting all navigation failures as
`BROWSER_HOST_EXECUTION_FAILED` was fixed in the main repository in
#2871 (closed-set `BROWSER_NAVIGATION_*` codes from 10.0.157), and the
SOP in this commit was updated accordingly: network-class failures retry
once by code, a navigation replaced by a page jump (ABORTED) inspects
the landed page before branching, and out-of-grant targets
(ORIGIN_NOT_GRANTED / SCHEME_DENIED) never create a new space. On older
clients these codes simply do not appear and the entry falls back to the
previous behavior.
Pin the reviewed Entry patch prompted by a real Qwen consultation:
distinguish full tender documents from a notice/invitation and describe
useful outcomes without defect-free assurance. Catalog validation
passed; team member pins are unchanged.
Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
Ordinary tender review was blocked by mandatory TaskSpec preparation,
metadata preflight, fixed report packages and runtime receipts, while
the business quality of delivered opinions remained insufficiently
explicit.
This release accepts clear natural-language assignments and defines
concrete goals, good and bad outcomes, evidence expectations and focused
corrections for each role. Chat, tables and files are valid
deliverables. Specialist calculations and legacy structured-export
validators remain available for their specific purposes. It removes
obsolete business input contracts and updates the corresponding
bilingual guides.
Validation was performed after the full multi-repository modification:
JSON/configuration and document-link checks, targeted calculation
regressions, independent content review, and eight synthetic
paper-evaluation scenarios (8/8 after fixing informational-only entry
handling and residual visual preflight/human gates). Paper evaluation is
not a live DesireCore/Qwen or real-tender accuracy result. No real bid
package was tested.
---------
Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
Advance the team source pointer and matching catalog provenance/review
reference to the merged bilingual project-guide commit.
Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
Update the published team pointer to the reviewed team revision that
locks Lead and Evidence 0.1.1. Preview wording remains until
clean-install end-to-end acceptance is complete.
Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
## What this changes
Adds the tender-review team and its onboarding entry to the official
Market catalog as an immutable source pointer, plus bilingual catalog
sidecars.
- `teams/biao-shu-lian-he-shen-cha/entry.json` points to the published
team commit `7ee5650b066cdee385288a722b8cbd8e1947d0fe`.
- `agents/tender-review-assistant/entry.json` points to assistant commit
`4b6855d2edb535f81c29847e06145c0da87942d0`.
- Both entries include bilingual descriptions, privacy boundaries and
`requiredClientVersion: 10.0.155`.
- The listing is deliberately `pointer` / preview. It does not claim the
v10.0.155 release is fully green or production-certified; newcomer
qualification remains pending.
## Validation
- `python3 scripts/catalog/validate_catalog_metadata.py --json` — 0
errors (existing catalog warnings unchanged).
- Market entry and both `catalog-metadata.v1.json` sidecars validate
against the current client/catalog schemas.
- Published source repositories and full commit pins were checked before
creating this branch.
---------
Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
## Why
The C02 newcomer test exposed a missing-material preflight defect in the
contract-review lead. The corrected team release is already merged as
0.1.24; this PR publishes the exact team ref to the market.
## What changed
- Update the market pointer and catalog sidecar to contract-review-team
0.1.24.
- Pin both metadata surfaces to
`e096a74a482b55266753b3b93e179f9cac2f0ecd`.
- Publish contract-review-lead 1.0.12 in the team roster.
## Validation
- Parsed both market JSON files.
- Verified pointer, provenance, and reviewed refs are identical.
- Verified the remote team `main` ref matches the published pointer.
- Ran the catalog and i18n validators successfully; they reported only
pre-existing catalog warnings outside this team.
- Ran `git diff --check`.
## 中文说明
将市场中的合同审查团队发布指针升级到 0.1.24，并锁定已合并的团队提交。该版本包含统筹官 1.0.12
的无材料零工具咨询修复；entry、sidecar 的来源与审阅提交已一致，市场校验通过。
## Why
Publish the reviewed contract review team fix that was validated by a
fresh final18 real run. The prior run correctly fail-closed when
reporter artifacts escaped the lead case root and clauses.yaml was not
parseable.
## Changes
- bump marketplace entry/catalog to team 0.1.18
- point source/provenance/governance refs to merged team commit
6aa93bf11a6e37cc9d0444e3335ba953bee0a61f
- expose lead 1.0.10, clause 1.0.5, reporter 1.0.4 member versions
- retain legal disclaimer and source-pointer-only distribution
## Validation
- catalog validator exit 0
- i18n validator exit 0
- targeted JSON/ref assertions
- git diff --check
Publish Contract Review Team 0.1.12. Update entry/catalog to the merged
team ref d85b9244244c3b69718b2525b8ef4b8b7296f144, lead 1.0.8, and
current timestamps. Focused validators: metadata 47 passed, i18n 19
passed, collection 4 passed, JSON parse and diff-check pass; existing
catalog warnings unchanged.
## 中文
上一个 PR（#136）把两条能力边界写进了 `USAGE.md`。但 `USAGE.md` **刻意不进模型上下文**（ADR-143，与
`fullDesc` 分开正是为了不占每轮 token）——也就是说运行时模型并不知道这些边界，遇到 `851003` 仍会当故障重试。本 PR
把它们落到技能侧。
重新 pin 到内容仓库
[`ebb1903`](ebb19035bb)。
### 三条改动
**1. `wecom-shared` 新增「零之四：企业人数改变机器人的身份」**
| 企业规模 | 模式 | 以谁的身份调用 | 能否读到真人的东西 |
| --- | --- | --- | --- |
| ≤ 10 人 | 小团队模式 | 授权真人 | 能，继承其文档权限 |
| > 10 人 | 企业模式 | 机器人独立身份 | **不能** |
写明了它与既有「零之一」的分工——零之一管**写**（任何规模下只能写机器人自己建的），本条管**读**（>10
人连读都不继承）。给出正确动作：说明边界 + 建议把文档显式分享给机器人，而不是重试。并标注**这条不可自查**：CLI
没有查企业人数的接口，`identity whoami` 也不返回规模，只能从实际返回反推。来源为上游 issue #64 维护者确认。
此前这个概念只藏在 `wecomcli-smartsheet/references/smart-sheet-webhook.md`
里，是局部知识，而且表述成「写入接口被限制」——真实机制是身份不继承，本 PR 一并修正。
**2. `wecom-shared` 易错点补「方法描述里也有不存在的参数」**
比既有的「服务描述里有不存在的能力」更隐蔽：方法真的存在，只是做不到描述承诺的事。实测三处，`--schema` 请求体里根本没有对应字段：
| 方法 | 描述承诺 | 请求体实际只有 |
| --- | --- | --- |
| `calendar schedules cancel` | 周期日程需指定编辑规则 | `schedule_id` |
| `calendar schedules update` | 同上 | 11 个字段，无一是周期规则 |
| `meeting cancel` | 周期会议取消单次需指定子会议 ID | `meeting_id` |
这解释了 `wecomcli-calendar` / `wecomcli-meeting` 为何禁止操作周期日程——**不是技能保守，是 CLI
没暴露参数**。顺带把 `calendar` 的「日历本列表查询」补进既有的服务描述清单。
**3. `smartsheet get` 是 `sheets list` 的别名**
两者官方描述逐字相同、返回同一份子表列表。此前 `smartsheet get` 在整个仓库零字面出现，模型只能靠 `--help`
自己摸到，然后在两者之间犹豫。
### vendor 纪律
第 3 条与 webhook 归因修正都落在 **vendor 自上游的 `wecomcli-smartsheet`**
上。脚本头注释明确「不要手工编辑 `skills/wecomcli-*`，改动会在下次重跑时被无声抹掉」，所以走
`patches/snippets/` + `injections.tsv` 注入，不手工改文件。
`bash scripts/vendor-official-skills.sh` **连跑两次 diff 不变**，幂等成立；注入计数 6 →
8，脚本摘要与 tsv 注释同步更新。
### 条目改动
三处 ref 一起改（这次用全文扫 40 位 hex 复核，只剩一个值），`releasePublishedAt` 不动——版本仍 1.0.0：
- `entry.source.ref`
- `provenance.content.ref`
- `governance.compliance.reviewedRef`
推之前本地跑过 `uv run scripts/catalog/validate_catalog_metadata.py
--require-complete`：**0 error**（129 warning 为全仓存量）。
---
## English
#136 put two capability limits into `USAGE.md`, which is **deliberately
kept out of model context** (ADR-143). At runtime the model therefore
still doesn't know them and retries `851003` as a failure. This PR lands
them in the skills.
1. **`wecom-shared` gains "rule zero-four": corporation size changes the
bot's identity.** ≤10 people — the bot calls *as the authorizing user*
and inherits their document permissions; >10 — it calls under its own
identity and inherits nothing. Spelled out against the existing "rule
zero-one" (that one governs *writes*; this one governs *reads*). Marked
as non-self-checkable: no API returns the corporation size, so it can
only be inferred from responses. Source: upstream issue #64.
2. **A new pitfall: method descriptions also promise parameters that
don't exist** — subtler than the existing service-level note, since the
method does exist. Three verified cases where `--schema` has no such
field, which is precisely why the calendar/meeting skills forbid
recurring-event operations.
3. **`smartsheet get` is an alias of `sheets list`** — identical
official descriptions, same payload.
Items 2–3 touch vendored upstream skills, so they go through
`patches/snippets/` + `injections.tsv` rather than hand edits; the
vendor script is idempotent across two consecutive runs. Catalog
validator reports 0 errors locally before pushing.
## 中文
企业微信助手的市场详情页「使用说明」区此前为空。内容仓库
[`desirecore-agent/wecom-assistant@047928a`](047928afe1)
新增 `USAGE.md`，本 PR 把条目重新 pin 过去。
### 为什么要写这两条
它们都是**装之前**该知道、且**装完也改不了**的边界，正是 `USAGE.md` 的定位（ADR-143：与 `fullDesc`
分开，不进模型上下文）。
**1. 群聊历史目前仅对 ≤10 人企业开放。** 官方错误码 `853001` 的释义原文如此。实际触发返回相邻的 `853006`：
```
errcode: 853006
errmsg: this tool is not available for your corporation
```
措辞是 **for your
corporation**，不是「机器人未开通某品类」——所以让用户去找管理员开通品类是无效动作。本机实测复现，同一凭证下其余 12
个服务域全部正常，`chat` 是唯一被拒的域。上游 `WecomTeam/wecom-cli` #106 / #107 / #132 三个
issue 都在追这件事，截至提交时全部 OPEN、官方未回复。
**2. 同一条命令在不同规模的企业行为不同，而且不报错。** 上游维护者在 issue #64 确认：≤10
人「小团队模式」机器人以**授权用户身份**调用、继承其文档权限；>10
人「企业模式」机器人以**独立身份**调用、不继承。后果是同事分享给你的文档，小公司读得到、大公司读同一份返回
`851003`。这不是故障，但不写出来必然被当成故障反复重试。
顺带记入第三条与规模无关的边界：`wecom-cli identity whoami`
返回原文「只能写入或修改机器人创建或拥有的数据」——这是邮件署名固定为「XXX的机器人」、用户对助手所建文档反而没有管理权的根因。
### 条目改动
pointer 条目的 `USAGE.md` 由客户端从内容仓库**按 pinned ref** 抓取（`sync/market.ts` 的
`pointerUsage` ← `code-repo/file-fetcher.ts`），所以只推内容仓库不改 ref
的话客户端看不到。四处一起改，保持 ADR-137 证据链自洽：
| 字段 | 旧 | 新 |
| --- | --- | --- |
| `entry.source.ref` | `665ab1d2` | `047928a` |
| `compliance.reviewedRef` | `665ab1d2` | `047928a` |
| `compliance.reviewedAt` | 2026-09-04 | 2026-09-06 |
| `timestamps.reviewedAt.value` | 2026-09-04 | 2026-09-06 |
| `timestamps.catalogUpdatedAt.value` | 2026-09-04 | 2026-09-06 |
`releasePublishedAt` **不动**——版本仍是 1.0.0，本次只增文档。
已核对：`reviewedRef === source.ref`、`timestamps.reviewedAt ===
compliance.reviewedAt`、`availability: installable`、`license.state:
known`、compliance 五项必填齐全、ref 为 40 位 SHA、`repoUrl` 在官方前缀内。
### 证据等级
| 结论 | 来源 |
| --- | --- |
| `853006` 错误原文与触发条件 | 本机实测复现 |
| 「仅对 ≤10 人企业开放」 | 官方错误码 `853001` 释义 |
| 小团队 / 企业模式身份差异 | 上游 issue #64 维护者确认 |
| 「只能写入机器人拥有的数据」 | `identity whoami` 返回原文 |
| 群聊 7 天限制 | `chat messages list` 的 `begin_time` 字段 schema |
**未核实**：`853006` 的具体判定标准（是否严格按人数、有无灰度名单）与开通路径，官方未公开、上游 issue
未获回复。`USAGE.md` 里已如实标注。
### 追加：一并修正 docs 的 853006 归因
同一 ref 里还带了内容仓库
[`047928a`](047928afe1)
的一处事实修正。原 docs 把 `853006` 写成「机器人未开通『群聊会话』品类」，并给出
「要让它可用：为机器人开通群聊会话品类」——**这是让用户去做一件做不成的事**。
改了 6 处（`04-群聊历史` 四处、`README` / `01-快速开始` / `99-风险与确认` 各处），
只纠正群聊这一处的归因，**不动「能力按品类逐项开通」这条通则**——那条对 `850002`
依然成立。技能侧（`wecom-shared` / `wecom-workflows` / `wecomcli-message`）本就写的是
「企业级不可用」，本次是让 docs 与技能口径一致。
---
## English
The agent detail page's "Usage" section was empty for the WeCom
assistant. The content repo now carries a `USAGE.md`; this PR repins the
listing to it.
It documents two limits that a reader needs **before** installing and
cannot change afterwards:
1. **Chat history is currently limited to corporations of 10 people or
fewer.** Official error `853001` states this; the actual response is
`853006 this tool is not available for your corporation` — the wording
is *corporation*, not *bot*, so asking an admin to enable a bot
capability is a dead end. Reproduced locally; all 12 other service
domains work under the same credential. Upstream issues #106 / #107 /
#132 all remain OPEN with no official response.
2. **The same command behaves differently by corporation size, without
erroring.** Per the upstream maintainer in issue #64, bots in ≤10-person
"small team mode" call **as the authorizing user** and inherit their
document permissions; in ">10 person" enterprise mode they call **under
their own identity** and do not. A doc shared with you is readable in a
small company and returns `851003` in a large one.
A pointer listing's `USAGE.md` is fetched from the content repo **at the
pinned ref**, so `source.ref` and the ref-bound compliance evidence are
updated together to keep the ADR-137 chain self-consistent.
`releasePublishedAt` is unchanged — still 1.0.0, docs only.
## Why / 背景
The market entry still pointed at team v0.1.5. Its pinned member lock
used stale agent manifests whose `command_authority.allowed_targets` did
not match the installed runtime IDs, so a fresh newcomer install could
pass catalog discovery but block the first delegation. The upstream team
main is now v0.1.6 with the corrected lock and member versions.
市场条目仍指向 v0.1.5。其成员锁引用了旧 Agent
manifest，`command_authority.allowed_targets` 与安装后的 runtime ID
不一致，导致新人实例虽然能发现团队，却会在首次委派时被阻断。上游团队 main 已更新到 v0.1.6，成员锁和版本已修正。
## What changed / 变更
- bump `latestVersion` and `release.version` to `0.1.6`;
- point entry source, catalog provenance, and compliance `reviewedRef`
to upstream team commit `3a4736e31ff5bf4299fde17fdde682a179d898b2`;
- align all six listed member versions with the upstream
`members.lock.json` (lead 1.0.4, intake 1.0.1, clause 1.0.2, risk 1.0.2,
jurisdiction 1.2.1, reporter 1.0.1);
- update release and upstream observation timestamps.
- 将 `latestVersion` 与 `release.version` 更新为 `0.1.6`；
- 将 entry source、catalog provenance 和 compliance `reviewedRef` 对齐上游团队
commit `3a4736e31ff5bf4299fde17fdde682a179d898b2`；
- 六名成员版本与上游 `members.lock.json` 对齐（统筹 1.0.4、输入 1.0.1、条款 1.0.2、风险
1.0.2、法域 1.2.1、报告 1.0.1）；
- 更新发布时间与上游观察时间。
## Validation / 验证
- `uv run scripts/catalog/validate_catalog_metadata.py --json` — exit 0,
0 errors, 129 existing warnings;
- `uv run scripts/i18n/validate-i18n.py` — exit 0;
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47
passed;
- `uv run scripts/i18n/test_validate_i18n.py` — 19 passed;
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed;
- independent GPT-Reserve reviews — PASS, P0/P1/P2/P3=0;
- `git diff --check` — passed.
- `uv run scripts/catalog/validate_catalog_metadata.py --json`：exit 0，0
errors，129 个既有 warnings；
- `uv run scripts/i18n/validate-i18n.py`：exit 0；
- `uv run scripts/catalog/test_validate_catalog_metadata.py`：47 passed；
- `uv run scripts/i18n/test_validate_i18n.py`：19 passed；
- `uv run scripts/catalog/test_collection_generator.py`：4 passed；
- 两次独立 GPT-Reserve 复审：PASS，P0/P1/P2/P3=0；
- `git diff --check`：通过。
## Changes\n- publish contract-review-team v0.1.5\n- point entry and
catalog metadata at merged team main commit
2a45d9fc031ba7d63d3ec15552ef0bc4c3a2b46e\n- align clause-extractor
roster version to 1.0.2\n- advance release timestamps to
2026-09-06T10:02:16Z, after team lock resolvedAt
2026-09-06T09:56:11.162Z\n- preserve Work Context description and all
unrelated metadata\n\n## Validation\n- team entry schema: PASS\n-
catalog metadata validator: PASS (existing repository warnings only)\n-
i18n validator: PASS (0 errors, 129 existing warnings)\n- collection
generator tests: 4 passed\n- git diff --check: PASS\n\nPlease review
independently; do not merge automatically.
Publish team 0.1.4 with the merged lead manifest version/hash lock. Independent GPT-Reserve review PASS; Copilot approval recommended; market validators/tests PASS.
Publish contract review team 0.1.3 with Work Context orchestration compatibility and aligned publication provenance timestamps. Independent GPT-Reserve review PASS; market validators and tests PASS; Copilot concern resolved with timestamp fix.
Align the market roster jurisdiction-auditor version with the published
team lock. Independent GPT-Reserve review passed; canonical market
validators and tests pass.
