feat: prepare KsADK 0.8.3 public candidate

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     env:
-      KSADK_WEB_VERSION: "0.3.2"
+      KSADK_WEB_VERSION: "0.3.3"
     steps:
       - uses: actions/checkout@v4
 
@@ -98,7 +98,7 @@ jobs:
     name: full pytest (google-adk ${{ matrix.google-adk }})
     runs-on: ubuntu-latest
     env:
-      KSADK_WEB_VERSION: "0.3.2"
+      KSADK_WEB_VERSION: "0.3.3"
     strategy:
       fail-fast: false
       matrix:

.github/workflows/publish-pypi.yml

@@ -9,7 +9,7 @@ on:
       ksadk_web_version:
         description: KsADK Web npm version to bundle
         required: false
-        default: "0.3.2"
+        default: "0.3.3"
       approved_source_commit:
         description: Reviewed source commit SHA recorded in docs/maintainer-approval-record.md
         required: false
@@ -37,7 +37,7 @@ jobs:
     environment:
       name: pypi
     env:
-      KSADK_WEB_VERSION: ${{ github.event.inputs.ksadk_web_version || '0.3.2' }}
+      KSADK_WEB_VERSION: ${{ github.event.inputs.ksadk_web_version || '0.3.3' }}
       KSADK_APPROVED_SOURCE_COMMIT: ${{ github.event.inputs.approved_source_commit || vars.KSADK_APPROVED_SOURCE_COMMIT }}
       PUBLISH_TARGET: ${{ github.event.inputs.publish_target || 'full' }}
     permissions:

.github/workflows/release-check.yml

@@ -9,8 +9,20 @@ on:
       - "Makefile"
       - "ksadk/**"
       - "ksadk_runtime_common/**"
+      - "tests/compat/**"
+      - "tests/e2e/test_codex_plugin_bridge_e2e.py"
+      - "tests/e2e/test_codex_provider_app_server_e2e.py"
+      - "tests/e2e/test_dsh_managed_toolchain_e2e.py"
+      - "tests/plugins/test_dsh_node_provider_e2e.py"
+      - "tests/fixtures/dsh-node-agent-provider/**"
+      - "tests/packaging/test_phase2_release_preflight.py"
+      - "tests/studio/e2e/**"
       - "scripts/open_source_audit.py"
+      - "scripts/audit_release_artifacts.py"
+      - "scripts/phase2_release_preflight.py"
       - "scripts/verify_ksadk_web_static.py"
+      - "scripts/write_build_provenance.py"
+      - "docs/phase2-plugin-compatibility.md"
       - ".github/workflows/release-check.yml"
 
 jobs:
@@ -33,18 +45,25 @@ jobs:
           node-version: "22"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra all
+
+      - name: Install Chromium for Phase 2 browser gates
+        run: uv run playwright install --with-deps chromium
 
       - name: Build pinned frontend static assets
         env:
-          KSADK_WEB_VERSION: "0.3.2"
+          KSADK_WEB_VERSION: "0.3.3"
         run: make build-frontend
 
-      - name: Build artifacts
-        run: uv build
+      - name: Verify clean release source
+        run: |
+          test -z "$(git status --porcelain --untracked-files=all)"
 
-      - name: Check package metadata
-        run: uv run --extra dev python -m twine check dist/*
+      - name: Build one provenance-bound artifact pair
+        run: |
+          rm -rf dist
+          uv run python scripts/write_build_provenance.py
+          uv build --out-dir dist
 
-      - name: Audit wheel and sdist file lists
-        run: make open-source-audit-dist
+      - name: Run Phase 2 release preflight
+        run: uv run --extra all python scripts/phase2_release_preflight.py --dist-dir dist

.gitignore

@@ -91,6 +91,9 @@ webui
 ksadk/server/static/**
 # Generated from the tracked React Studio source during release/build.
 ksadk/studio/static/**
+# Generated immediately before packaging and embedded in wheel/sdist.  Release
+# gates verify it against the checked-out source commit; it is never source.
+ksadk/_build_provenance.json
 ksadk/studio/web/node_modules/
 ksadk/studio/web/dist/
 site/
@@ -100,3 +103,4 @@ ksadk/server/web-ui/
 e2e-codex-agent/
 ksadk/studio/react-ui/node_modules/
 .agentkit/secrets.env
+agentkit.yaml

CHANGELOG.md

@@ -5,7 +5,33 @@
 格式参考 [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)，
 版本遵循 [Semantic Versioning](https://semver.org/spec/v2.0.0.html)。
 
-## [Unreleased]
+## [0.8.3] - Unreleased
+
+> 本节是 Agent Runtime V2 Phase 2 的开发中草案，不代表已经发布或通过稳定版门禁。
+
+### 插件化基础
+
+- 新增统一的 `agentengine plugin` 产品入口，但不定义第三种 KsADK 私有插件格式。DSH Bundle/Profile 是唯一默认生态；受管理的固定版本 DSH/pnpm 工具链覆盖 `create`、`validate`、`test`、`pack`，开发者无需检出或编译 DeepSeek Harness 源码。
+- 新增事务化 PluginHost、能力注册与组合合同。一个真实仓外 DSH AgentProvider 已在同一受管 Profile 中通过安装、连续两轮状态延续、停用阻断、损坏升级失败回滚、重新启用旧版本继续执行以及卸载的完整 E2E。SQLite Store 与 Renderer 保持 host-owned，MCP、Skill 和 Context 只投影经过边界校验的安全数据；数据库路径和已解析 Secret 不越界。
+- DSH 本地目录和 `.tgz` 安装源按 SHA-256 固化到受管不可变存储；目录使用固定 pnpm 按 npm `files` 语义打包。启用、更新和投影前发现来源或制品摘要漂移会 fail closed；升级失败恢复旧 manifest、lock、状态和可执行旧包。
+- 新增 Codex App Server 插件桥接。Codex 插件的发现、详情、安装和卸载均交给 Codex 宿主，KsADK 不复制插件实现，也不接管其认证或宿主权限。
+- 新增 DeepSeek Harness Profile 管理桥接。DSH Bundle 的发现、安装、启停、升级、卸载和配置预检均委托给受管理的原生 `dsh plugin`，KsADK 只保存无 Secret 的 inventory、来源摘要与配置摘要。
+
+### Studio 自动化与会话表面
+
+- 新增本地 Scheduler Lite：支持 once、interval、cron、IANA 时区、启停、编辑、删除、立即运行、misfire 策略、并发保护和 occurrence 历史。Studio 提供全局自动化页和 Agent 详情页自动化 Tab；浏览器纵切已通过真实本地 Kernel、Codex RuntimeAdapter + App Server 以及 KsADK Harness 生产模型客户端验证 new/follow-up、accepted、run identity、terminal 状态和刷新后历史对账；测试仅以本地确定性 HTTP 模型端替代外部模型服务。
+- 冻结 `ConversationSurface`、`ConversationInput` 和 `ConversationItem` 合同，统一文本、reasoning、工具、审批、A2UI 与未知 item 的 identity-aware 归并和回放边界。
+- 新增核心 Conversation Renderer 与受控 A2UI action bridge。自定义前端可以消费同一会话表面；未知类型保持安全的通用降级，不要求客户端理解某个 Provider 的私有事件。
+- Hosted UI 与 Studio 固定到 `@kingsoftcloud/ksadk-web@0.3.3`。该版本新增可在 Node/SSR 环境安全导入的 headless conversation 入口、严格的 Conversation v1 解码、SSE 有界重连、按 item/event identity 归并、思考/工具/审批/产物/A2UI 的统一时间线，以及附件、模型、推理、审批、Goal/Plan 的统一输入合同；只有明确的 404 才回退旧 Responses/AG-UI，畸形响应与 5xx 继续 fail closed。
+- 修复基础安装把 `agentengine studio` 整体误降级为不可用的问题：Studio 所需的 `google-adk` 现在随基础包安装；LiteLLM 与 JSON 修复等仅在 `[adk]` 扩展中保留。
+
+### 兼容与尚未关闭的门禁
+
+- Phase 2 只增加本地能力，不要求已发布 Agent、历史 Bundle、无来源三元组 Runtime、未启用 Kernel 或无 PostgreSQL 的单机模式升级。历史 Harness 只有命中显式登记的精确来源摘要才进入 legacy adapter；未知 v1 fail closed，新 v2 缺少就绪 DSH registration 时也不会回退旧路径。
+- Codex 已覆盖真实 App Server 插件生命周期、DSH Codex Provider 的 MCP 两轮/同一 Thread、插件 inventory 与失败回滚、以及隔离 one-shot child 的取消和清理；DSH 也覆盖受管 Profile 和一个真实外部 AgentProvider 的连续多轮与完整失败回滚。上述证据不等于任意第三方 Provider 自动受支持，也不把云端持续后台任务纳入本地稳定声明。
+- Claude Code、游戏插件和任意第三方插件格式尚未作为已支持生态发布。后续可以通过 Provider 或 ecosystem bridge 接入，但必须先通过权限、生命周期、ConversationSurface 和兼容性 conformance。
+- `ksadk-web@0.3.3` 的源码门禁、独立浏览器 E2E 和显式 tarball 消费已通过；绑定该制品的真实部署 Hosted UI 已完成 Studio 创建 Codex Agent 与 0.8.2 历史 Agent 的两轮会话，验证了正文、思考、工具卡片和上下文续接。正式发布仍要求先完成 npm Trusted Publishing，再从公开 registry 重建 Studio/Hosted UI，并以最终 clean commit 通过 wheel/sdist provenance、公开内容审计和维护者审批；在这些外部写入完成前本节保持 `Unreleased`。
+- 新增 Phase 2 最终候选聚合门禁：只有最终源码提交、wheel/sdist、npm integrity、Hosted UI 镜像 digest、Helm revision，以及 Studio 新 Agent/历史 0.8.2 Agent 在 Studio 与 Hosted UI 的多轮流式证据全部一致时才输出 `passed`；本地 preflight 不再能被误当成完整发布结论。
 
 ## [0.8.2] - 2026-08-26
 

MANIFEST.in

@@ -3,3 +3,4 @@ recursive-exclude ksadk/server/web-ui *
 prune ksadk/studio/react-ui
 recursive-exclude ksadk/studio/react-ui *
 recursive-include ksadk_runtime_common/schemas *.json
+include ksadk/_build_provenance.json

Makefile

@@ -1,7 +1,7 @@
 # AgentEngine Makefile
 # 用于同步 KsADK Web static 和管理项目
 
-.PHONY: help install clean clean-cache clean-dist clean-static clean-offline dev test publish publish-test public-status public-init-worktree public-worktree-status public-sync-check public-secret-audit public-audit public-version-gate docs-site-build docs-site-dev public-test public-build-check public-build-alias-check public-preflight public-publish-check public-release-approval-check public-publish-gate public-release-tag public-review public-sync-ksadk-web-static open-source-audit-dist open-source-audit-alias-dist openclaw-build openclaw-push openclaw-size hermes-build hermes-push hermes-size sync-ksadk-web-static verify-ksadk-web-static verify-ksadk-web-wheel-static build-studio-static sync-hosted-ui build-frontend build-webui sync-static webui build-wheel build-all clean-frontend print-build-provenance phase1-canary-build phase1-canary-push phase1-canary-deploy phase1-canary-matrix phase1-canary-status phase1-canary-delete
+.PHONY: help install clean clean-cache clean-dist clean-static clean-offline dev test publish publish-test public-status public-init-worktree public-worktree-status public-sync-check public-secret-audit public-audit public-version-gate docs-site-build docs-site-dev public-test public-build-check public-build-alias-check phase2-release-preflight phase2-release-candidate-gate public-preflight public-publish-check public-release-approval-check public-publish-gate public-release-tag public-review public-sync-ksadk-web-static open-source-audit-dist open-source-audit-alias-dist openclaw-build openclaw-push openclaw-size hermes-build hermes-push hermes-size sync-ksadk-web-static verify-ksadk-web-static verify-ksadk-web-wheel-static build-studio-static sync-hosted-ui build-frontend build-webui sync-static webui build-wheel build-all clean-frontend print-build-provenance phase1-canary-build phase1-canary-push phase1-canary-deploy phase1-canary-matrix phase1-canary-status phase1-canary-delete
 
 PHASE1_CANARY_NAMESPACE ?= agent-kernel-phase1
 # Phase 1 runtime drills must run beside real Agent workloads in the preprod
@@ -27,7 +27,7 @@ help:
 	@echo "    make test           运行测试"
 	@echo ""
 	@echo "  \033[1;32mWeb UI 构建:\033[0m"
-	@echo "    make sync-ksadk-web-static KSADK_WEB_VERSION=0.3.2"
+	@echo "    make sync-ksadk-web-static KSADK_WEB_VERSION=0.3.3"
 	@echo "                         从 @kingsoftcloud/ksadk-web npm 包同步 static"
 	@echo "    make build-frontend 准备 ksadk-web 与 React Studio static"
 	@echo "    make build-studio-static 编译 React Studio static"
@@ -53,6 +53,8 @@ help:
 	@echo "    make public-version-gate  版本号门禁(防降版/重复发版,对比 PyPI 已发版本)"
 	@echo "    make public-init-worktree 初始化/校验 .worktrees/public-main"
 	@echo "    make public-preflight     GitHub/PyPI/Release 前必须通过的本地门禁"
+	@echo "    make phase2-release-preflight  Phase 2 兼容/原生宿主/浏览器/制品门禁"
+	@echo "    make phase2-release-candidate-gate  绑定 npm/镜像/预发 E2E 的最终门禁"
 	@echo "    make public-publish-gate  PyPI/GitHub Release 写操作前的审批门禁"
 	@echo "    make public-release-tag V=x.y.z  创建公开 release 留痕 tag"
 	@echo "    make public-review        公开候选审核入口"
@@ -184,7 +186,7 @@ studio-react-install-browser:
 
 studio-react-test:
 	@if [ -f "ksadk/studio/react-ui/package.json" ]; then \
-		npm --prefix ksadk/studio/react-ui ci; \
+		$(KSADK_WEB_NPM) --prefix ksadk/studio/react-ui ci; \
 		npm --prefix ksadk/studio/react-ui test; \
 		npm --prefix ksadk/studio/react-ui run test:ui; \
 		(cd ksadk/studio/react-ui && npx tsc --noEmit); \
@@ -269,6 +271,7 @@ check-build-deps:
 
 build: check-build-deps sync-ksadk-web-static build-studio-static
 	@echo "📦 构建 Python 包 v$(VERSION)..."
+	@python scripts/write_build_provenance.py
 	python -m build
 	@# 删除 tar.gz 和临时目录，只保留 whl
 	@rm -f dist/*.tar.gz
@@ -284,6 +287,7 @@ build-only: check-build-deps build-studio-static
 		echo "❌ 错误: ksadk/server/static/ 目录为空，请先运行 make sync-ksadk-web-static"; \
 		exit 1; \
 	fi
+	@python scripts/write_build_provenance.py
 	python -m build
 	@rm -f dist/*.tar.gz
 	@rm -rf build/ *.egg-info/
@@ -431,6 +435,10 @@ public-sync-check:
 
 public-secret-audit:
 	@echo "==> secret and sensitive-file audit"
+	@# Docs static output is generated, untracked release byproduct.  Remove it
+	@# before scanning so a second public-preflight checks the same source tree
+	@# as the first one instead of scanning bundled third-party source maps.
+	@rm -rf docs-site/.next docs-site/out
 	@if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then \
 		if git ls-files | grep -E '(^|/)(\.pypirc|kubeconfig|.*\.kubeconfig|id_rsa|id_ed25519)$$'; then \
 			echo "❌ 发现禁止跟踪的敏感文件"; \
@@ -478,6 +486,7 @@ public-sync-ksadk-web-static: sync-ksadk-web-static
 
 public-build-check: clean-dist sync-ksadk-web-static build-studio-static
 	@echo "==> build and twine check"
+	@uv run python scripts/write_build_provenance.py
 	@uv build
 	@$(MAKE) verify-ksadk-web-wheel-static
 	@uv run pytest tests/test_runtime_common_packaging.py -q
@@ -513,7 +522,27 @@ public-version-gate:
 	@echo "==> release version gate (prevent downgrade/re-publish)"
 	uv run python scripts/check_release_version.py
 
-public-preflight: public-version-gate public-audit sync-ksadk-web-static public-test docs-site-build public-build-check
+phase2-release-preflight: public-build-check
+	@echo "==> Phase 2 compatibility, native host, browser, and artifact preflight"
+	@uv run --extra all python scripts/phase2_release_preflight.py --dist-dir dist
+
+PHASE2_FINAL_COMMIT ?= $(shell git rev-parse HEAD)
+PHASE2_LOCAL_EVIDENCE ?= dist/phase2-evidence.json
+PHASE2_WEB_REGISTRY_EVIDENCE ?= dist/evidence/ksadk-web-registry.json
+PHASE2_DEPLOYMENT_EVIDENCE ?= dist/evidence/hosted-ui-deployment.json
+PHASE2_PREPROD_EVIDENCE ?= dist/evidence/preprod-e2e.json
+PHASE2_FINAL_EVIDENCE ?= dist/phase2-release-candidate.json
+
+phase2-release-candidate-gate:
+	@uv run python scripts/phase2_release_candidate_gate.py \
+		--expected-commit "$(PHASE2_FINAL_COMMIT)" \
+		--local "$(PHASE2_LOCAL_EVIDENCE)" \
+		--web-registry "$(PHASE2_WEB_REGISTRY_EVIDENCE)" \
+		--deployment "$(PHASE2_DEPLOYMENT_EVIDENCE)" \
+		--preprod "$(PHASE2_PREPROD_EVIDENCE)" \
+		--output "$(PHASE2_FINAL_EVIDENCE)"
+
+public-preflight: public-version-gate public-audit sync-ksadk-web-static public-test docs-site-build phase2-release-preflight
 	@echo "✅ public preflight passed"
 
 public-publish-check:
@@ -668,17 +697,18 @@ STATIC_DIR := ksadk/server/static
 STUDIO_REACT_DIR := ksadk/studio/react-ui
 STUDIO_STATIC_DIR := ksadk/studio/static
 # The wheel must embed a reproducible Web bundle. 0.8.x is coupled to the
-# Interaction/v1 Web 0.3.2 release; a normal release build must fail rather
-# than silently substituting an older npm package when that release is not
+# The shared Conversation v1 Web 0.3.3 release; a normal release build must
+# fail rather than silently substituting an older npm package when that release is not
 # visible.  A reviewed local tarball is permitted for a pre-release image
 # build, but remains explicit in the command and provenance output.
-KSADK_WEB_VERSION ?= 0.3.2
+KSADK_WEB_VERSION ?= 0.3.3
 KSADK_WEB_PACKAGE ?= @kingsoftcloud/ksadk-web
 KSADK_WEB_TARBALL_NAME := kingsoftcloud-ksadk-web-$(patsubst v%,%,$(KSADK_WEB_VERSION)).tgz
 KSADK_WEB_TARBALL ?=
 KSADK_WEB_RELEASE_URL ?=
 KSADK_WEB_CACHE_DIR ?= .cache/ksadk-web
 KSADK_WEB_REGISTRY ?= https://registry.npmjs.org
+KSADK_WEB_NPM := npm --registry="$(KSADK_WEB_REGISTRY)"
 
 sync-ksadk-web-static:
 	@echo "Sync KsADK Web static assets from $(KSADK_WEB_PACKAGE)@$(KSADK_WEB_VERSION)"
@@ -698,7 +728,7 @@ sync-ksadk-web-static:
 		echo "$(KSADK_WEB_TARBALL_NAME)" > "$(KSADK_WEB_CACHE_DIR)/.tarball-name"; \
 	elif command -v npm >/dev/null 2>&1; then \
 		echo "Using npm pack (npm found in PATH)"; \
-		npm pack "$(KSADK_WEB_PACKAGE)@$(patsubst v%,%,$(KSADK_WEB_VERSION))" --pack-destination "$(KSADK_WEB_CACHE_DIR)" > "$(KSADK_WEB_CACHE_DIR)/.tarball-name"; \
+		$(KSADK_WEB_NPM) pack "$(KSADK_WEB_PACKAGE)@$(patsubst v%,%,$(KSADK_WEB_VERSION))" --pack-destination "$(KSADK_WEB_CACHE_DIR)" > "$(KSADK_WEB_CACHE_DIR)/.tarball-name"; \
 	else \
 		echo "npm not found; resolving tarball from registry $(KSADK_WEB_REGISTRY)"; \
 		REGISTRY_JSON=$$(curl -fsSL "$(KSADK_WEB_REGISTRY)/$(KSADK_WEB_PACKAGE)/$(KSADK_WEB_VERSION)"); \
@@ -735,8 +765,17 @@ verify-ksadk-web-wheel-static:
 
 build-studio-static:
 	@if [ -f "$(STUDIO_REACT_DIR)/package.json" ]; then \
+		set -eu; \
 		echo "Build React Studio static assets from $(STUDIO_REACT_DIR)"; \
-		npm --prefix "$(STUDIO_REACT_DIR)" ci; \
+		if [ -n "$(KSADK_WEB_TARBALL)" ]; then \
+			WEB_TARBALL_PATH="$(KSADK_WEB_TARBALL)"; \
+			case "$$WEB_TARBALL_PATH" in /*) ;; *) WEB_TARBALL_PATH="$(CURDIR)/$$WEB_TARBALL_PATH" ;; esac; \
+			test -f "$$WEB_TARBALL_PATH" || { echo "ERROR: KSADK_WEB_TARBALL does not exist: $$WEB_TARBALL_PATH" >&2; exit 1; }; \
+			echo "Install Studio dependencies with the reviewed KsADK Web tarball: $$WEB_TARBALL_PATH"; \
+			$(KSADK_WEB_NPM) --prefix "$(STUDIO_REACT_DIR)" install --no-save --package-lock=false "$$WEB_TARBALL_PATH"; \
+		else \
+			$(KSADK_WEB_NPM) --prefix "$(STUDIO_REACT_DIR)" ci; \
+		fi; \
 		npm --prefix "$(STUDIO_REACT_DIR)" run build; \
 	else \
 		echo "React Studio source is intentionally absent; using reviewed compiled assets from $(STUDIO_STATIC_DIR)"; \
@@ -751,6 +790,7 @@ build-frontend: sync-ksadk-web-static build-studio-static
 	@echo "Frontend static assets prepared for packaging"
 
 build-wheel: build-frontend
+	@uv run python scripts/write_build_provenance.py
 	uv build
 	@$(MAKE) --no-print-directory print-build-provenance