weichen
77da63edac
ci / vet-and-test (pull_request) Successful in 41s
Why: User rulings 1 and 3. The direct conversation path exposed only run_shell/run_python, so any file edit meant rewriting and re-running whole generation scripts (diagnosis: 24 calls with 9 failures in one turn, 6KB scripts regenerated 8 times). The kernel already ships line-numbered reads, exact edit/multi_edit with read-before-write, grep and glob; they were wired only into the squad path. Deliverables had no editable source: docx output came from one-shot python scripts, so "make section 3 more detailed" rebuilt everything. Now: WorkspaceToolsCheckpointed (sandbox = conversation workspace, checkpoint hooks wired) is registered into the direct run and its decls join the tool surface (plan mode keeps the read-only subset). Word deliverables get a markdown-source pipeline - python3 -m housestyle.build renders .md deterministically via docx_kit and runs lint + outline on every build (write-time diagnostics, exit 1 on error so the model fixes the source and rebuilds). run_python kits remain for xlsx/pptx/images (ruling 3). base-tools/base-deliverables prompts and the house-style SKILL document the new loop. Evidence: SELF - TestDirectRunExposesKernelWorkspaceTools (read->edit->grep against the real sandbox FS), TestDirectRunWithoutSandboxHidesKernelTools, three new BuildTests in recipes (renders+lint passes, heading-skip errors exit 1, CLI entry); go vet + go test ./... pass; live before/after on the golden task set recorded on the phase03 task card per the policy clause. Impact: Direct conversations can now read and edit workspace files surgically; docx deliverables become edit-source + rebuild instead of regenerate. No contract or storage changes.