test(zcode): automate CLI acceptance and skill behavior evaluation

.github/workflows/zcode-acceptance.yml

@@ -0,0 +1,141 @@
+name: ZCode acceptance
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [master]
+  workflow_dispatch:
+  schedule:
+    - cron: '23 3 * * 0'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: zcode-acceptance-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  # ZCode 3.14.3 contains CLI 0.16.9. Update this pin only with a new acceptance run.
+  ZCODE_REF: 29628c9acdb81b703bbd4080c207a0e7ce5e276e
+  ZCODE_CLI_BIN: ${{ github.workspace }}/.powercontext/zcode-ci-source/apps/zcode-cli/packages/cli/dist/zcode.cjs
+  CI: 'true'
+  HUSKY: '0'
+
+jobs:
+  controlled-cli:
+    runs-on: windows-latest
+    timeout-minutes: 30
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - name: Check out PowerContext
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Check out the supported ZCode host
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: zai-org/ZCode
+          ref: ${{ env.ZCODE_REF }}
+          path: .powercontext/zcode-ci-source
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: ./.github/actions/setup-python-env
+        with:
+          python-version: '3.12'
+
+      - name: Set up Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: '24.15.0'
+
+      - name: Install the host package manager
+        run: npm install --global pnpm@10.33.2
+
+      - name: Validate the ZCode Skill pin and behavior evaluation harness
+        run: |
+          uv run --locked --no-sync python -m evaluation.zcode_guidance.pin --check
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          uv run --locked --no-sync python -m evaluation.zcode_guidance.run --help
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          uv run --locked --no-sync python -m pytest evaluation/zcode_guidance/tests tests/test_zcode_acceptance_protocol.py tests/test_zcode_acceptance_host.py -q
+
+      - name: Record build provenance
+        run: |
+          $hostCommit = git -C .powercontext/zcode-ci-source rev-parse HEAD
+          if ($LASTEXITCODE -ne 0 -or $hostCommit -ne $env:ZCODE_REF) { throw 'Unexpected ZCode commit' }
+          $reportDir = Join-Path $env:RUNNER_TEMP 'zcode-ci-evidence'
+          New-Item -ItemType Directory -Path $reportDir | Out-Null
+          [ordered]@{
+            repository_commit = (git rev-parse HEAD)
+            host_repository = 'zai-org/ZCode'
+            host_commit = $hostCommit
+            node_version = (node --version)
+            pnpm_version = (pnpm --version)
+            model_mode = 'fixture'
+            server_mode = 'real-sqlite'
+          } | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $reportDir 'provenance.json') -Encoding utf8
+
+      - name: Install frozen host build dependencies
+        run: >-
+          pnpm --dir .powercontext/zcode-ci-source
+          --filter zcode --filter zcode-cli --filter '@zcode/cli...'
+          install --frozen-lockfile --ignore-scripts
+
+      - name: Build the actual CLI
+        run: |
+          pnpm --dir .powercontext/zcode-ci-source exec turbo --skip-infer --cwd apps/zcode-cli run build --filter=@zcode/cli
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          if (-not (Test-Path -LiteralPath $env:ZCODE_CLI_BIN -PathType Leaf)) { throw 'CLI bundle not built' }
+          node $env:ZCODE_CLI_BIN --version
+
+      - name: Run all plugin Node tests including native host discovery
+        run: node --test integrations/zcode/plugins/powercontext/tests/*.test.mjs
+
+      - name: Run two independent controlled CLI acceptances
+        run: >-
+          uv run --locked --no-sync pytest tests/e2e/test_zcode_host_acceptance.py
+          -m 'zcode_host_acceptance and not zcode_live_model'
+          --zcode-acceptance-output "$env:RUNNER_TEMP/zcode-acceptance" -q
+
+      - name: Retain only summaries and selected evidence
+        if: always()
+        run: |
+          $reportDir = Join-Path $env:RUNNER_TEMP 'zcode-ci-evidence'
+          $output = Join-Path $env:RUNNER_TEMP 'zcode-acceptance'
+          if (Test-Path -LiteralPath $output) {
+            foreach ($run in Get-ChildItem -LiteralPath $output -Directory) {
+              if ($run.Name -notmatch '^[0-9a-f]{32}$') { continue }
+              $summary = Join-Path $run.FullName 'summary.json'
+              if (-not (Test-Path -LiteralPath $summary -PathType Leaf)) { continue }
+              $target = Join-Path $reportDir $run.Name
+              New-Item -ItemType Directory -Force -Path $target | Out-Null
+              Copy-Item -LiteralPath $summary -Destination $target
+              $evidence = Join-Path $run.FullName 'evidence'
+              if (Test-Path -LiteralPath $evidence -PathType Container) {
+                $evidenceTarget = Join-Path $target 'evidence'
+                New-Item -ItemType Directory -Path $evidenceTarget | Out-Null
+                Get-ChildItem -LiteralPath $evidence -File -Filter '*.json' |
+                  Copy-Item -Destination $evidenceTarget
+              }
+              $result = Get-Content -LiteralPath $summary -Raw | ConvertFrom-Json
+              "### Run $($run.Name): $($result.overall_status)" | Add-Content -LiteralPath $env:GITHUB_STEP_SUMMARY
+              foreach ($scenario in $result.scenarios) {
+                "- $($scenario.id): $($scenario.status)" | Add-Content -LiteralPath $env:GITHUB_STEP_SUMMARY
+              }
+            }
+          }
+
+      - name: Upload controlled acceptance evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: zcode-controlled-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/zcode-ci-evidence/
+          if-no-files-found: warn
+          retention-days: 14

docs/en/docs/integrations/zcode.md

@@ -343,7 +343,13 @@ node --test integrations/zcode/plugins/powercontext/tests/host.test.mjs
 ```
 
 The second command needs `ZCODE_CLI_BIN` pointing to a built CLI. It uses a fake model and Server and does not replace
-a live-host acceptance run. Official Windows desktop 3.14.3 connected to local unauthenticated and Bearer-authenticated
+a live-host acceptance run. The ZCode acceptance CI builds a pinned open-source CLI on Windows, runs all Node tests
+and two actual CLI + PowerContext Server core acceptances with controlled inference on PRs, master updates and weekly
+checks. Build provenance, scenario summaries and selected evidence are retained as Actions artifacts for 14 days.
+See [repeatable CLI acceptance](https://github.com/oceanbase/powercontext/blob/master/integrations/zcode/acceptance/README.md#continuous-integration) for scope
+and host upgrade instructions.
+
+Official Windows desktop 3.14.3 connected to local unauthenticated and Bearer-authenticated
 Servers: MCP `list_scopes` succeeded, and ordinary prompts became readable Sources through the Hook. An ordinary
 conversation continued during a Server outage. In the current isolated acceptance, a native MCP call in the same task
 after Server restart failed with `Session not found`. Creating a new task restored native MCP without restarting

docs/zh/docs/integrations/zcode.md

@@ -300,6 +300,10 @@ node --test integrations/zcode/plugins/powercontext/tests/host.test.mjs
 ```
 
 第二条需要将 `ZCODE_CLI_BIN` 指向已构建的开源 CLI；它使用模拟模型和 Server，不能代替真实宿主验收。
+仓库的 ZCode acceptance CI 在 Windows 上构建固定提交的开源 CLI，运行完整 Node 测试和两轮
+真实 CLI + PowerContext Server 的可控模型核心验收；PR、master 更新和每周检查都会触发。
+构建版本、逐场景摘要和选定证据随 Actions artifact 保留 14 天；详细范围与升级步骤见
+[可重复 CLI 验收](https://github.com/oceanbase/powercontext/blob/master/integrations/zcode/acceptance/README.md#continuous-integration)。
 官方 Windows 桌面版 3.14.3 已分别连接本地无鉴权与 Bearer 鉴权 Server：MCP `list_scopes` 成功，
 普通提示词经 Hook 形成可读回的 Source。断服期间普通对话仍能回答；本轮隔离验收中，Server 重启后
 同一任务的原生 MCP 调用返回 `Session not found`；新建任务后原生 MCP 恢复，无需重启程序。

evaluation/README.md

@@ -9,7 +9,7 @@ Python environment and build configuration.
 | [`coding/`](coding/README.md) | Coding-task completion and continuation quality | [SWE-bench Pro](coding/swebench_pro/README.md), [Work continuity](coding/work_continuity/README.md) |
 | [`memory/`](memory/README.md) | Memory retrieval and answer quality | [LoCoMo](memory/locomo/README.md), [LoCoMo-Plus](memory/locomo_plus/README.md), [LongMemEval-V2](memory/longmemeval_v2/README.md) |
 | [`performance/`](performance/README.md) | Capacity, storage growth, latency, and compaction cost | [Memory capacity](performance/memory_capacity/README.md) |
-| [`skills/`](skills/README.md) | Agent instruction routing and authorization regressions | [Claude Code skill-up](skills/skill-up/README.md) |
+| [`skills/`](skills/README.md) | Agent instruction routing and authorization regressions | [Claude Code skill-up](skills/skill-up/README.md), [ZCode native CLI](zcode_guidance/README.md) |
 
 ```text
 evaluation/
@@ -39,6 +39,7 @@ evaluation/
 │       └── tests/
 ├── performance/
 │   └── memory_capacity/
+├── zcode_guidance/                 # Native ZCode Skill routing and authorization
 └── skills/
     └── skill-up/
 ```
@@ -48,7 +49,7 @@ evaluation/
 Run these commands from the repository root. LoCoMo, LoCoMo-Plus, and performance modules use the root project's
 Python dependencies. SWE-bench Pro, Work continuity, and LongMemEval-V2 share this directory's locked environment and
 expose independent `swebench-pro`, `work-continuity`, and `longmemeval-v2` commands. Skill-up has its own validation
-dependencies and pinned CLI.
+dependencies and pinned CLI. ZCode guidance uses the root project's dependencies and its pinned native CLI.
 
 ```bash
 # Install the shared environment, then choose a suite command.
@@ -69,6 +70,10 @@ uv run python -m evaluation.performance.memory_capacity --help
 # Skill regression: validate the pinned Skill and controlled fixtures locally.
 uv run python evaluation/skills/skill-up/sync_skill.py --check
 uv run python evaluation/skills/skill-up/validate_suite.py
+
+# Native ZCode Skill regression: validate the pin and runner without calling a model.
+uv run --locked python -m evaluation.zcode_guidance.pin --check
+uv run --locked python -m evaluation.zcode_guidance.run --help
 ```
 
 The [SWE-bench Pro console guide](coding/swebench_pro/docs/console.md) covers its Web and worker deployment.
@@ -92,7 +97,7 @@ The `powercontext-eval` distribution contains three packages: `powercontext_eval
 `powercontext_eval_work_continuity`, and `powercontext_eval_longmemeval_v2`. Editable installs and wheels expose the
 independent `swebench-pro`, `work-continuity`, and `longmemeval-v2` commands and their suite modules.
 LoCoMo behavior tests remain under [`tests/`](../tests/), including [`tests/evaluation/`](../tests/evaluation/).
-Skill-up keeps its own validation tests. The [Bub replay harness](../e2e/bub/README.md) and
+Skill-up and ZCode guidance keep their own validation tests. The [Bub replay harness](../e2e/bub/README.md) and
 [product E2E tests](../tests/e2e/) cover cross-component acceptance.
 
 Keep fixed datasets, locks, configuration examples, and scoring rules with their owning suite. Store local outputs in

evaluation/skills/README.md

@@ -6,6 +6,7 @@ suite's host setup, fixtures, and evidence requirements in its own directory.
 | Suite | Measures | Entry point |
 | --- | --- | --- |
 | [skill-up](skill-up/README.md) | Claude Code routing and tool selection with and without the packaged PowerContext Skill, using mocked MCP replies. | `cd evaluation/skills/skill-up` then follow its README. |
+| [ZCode native CLI](../zcode_guidance/README.md) | Native ZCode tool routing and authorization with a live model, controlled MCP replies, and a no-Skill baseline. | From the repository root, follow the ZCode guidance README. |
 
 These results describe Skill guidance behavior. They do not establish live backend
 acceptance or contribute to coding-task and memory-quality benchmark scores.