[haofeng0705]

This PR migrates the reviewed business scope onto the public CLI while retaining its newer digital employee reply/card runtime. It depends on the Schema enum governance in #1560.

Dependency landed: prerequisite #1560 merged into main as 49a591be1c605c19b339482a0ef7892b28c9b498. This PR now targets and includes that main revision, so the diff contains only business changes and consumes the base-owned declarations. The maintainer subsequently authorized sequential integration and administrator bypass, with real CI failures to be fixed before merge. Package/tag/OSS publication remains outside this task.

Risk tier: High-risk (new write operations, shared command/runtime paths and breaking enum inputs).

This AI-generated business patch exceeds the ordinary 30-file limit and consumes a protected approval ledger. It does not qualify for the existing exact-patch exceptions. The maintainer explicitly authorized administrator bypass for these governance restrictions and peer approval. The agent did not remove the AI label. The remote timeline records its removal by haofeng0705 at 2026-10-27 06:37:47 UTC; later AI Behavior success therefore reflects the unlabeled path, not acceptance of this AI-generated patch. Administrator bypass remains recorded separately from the eight substantive quality contexts. Permanent protection and AI policy rules remain intact.

Scope	Resulting behavior
Mind documents	Create mind documents; list/create/update/delete nodes; route mind documents separately from wiki spaces and meeting mind maps
Developer applications	Structured success/pending/failure/unknown results, diagnostics and visible-scope get/set; credential reset is excluded
Rate limits	Explain the retry delay for RATE_LIMIT_ERROR; no automatic retry
Confirmation contracts	Require user confirmation for six existing destructive/sensitive operations; supersedes #1539, which is already closed
npm installation	Support binary-only installation via DWS_NO_SKILLS=1; recover with a warning when the skill cache cannot refresh
Conversation pagination	Opt-in page aggregation, limits, deduplication and exact int64 cursors for object/tuple responses
MCP marketplace	Search with a bounded field set and validated pagination
Form sharing	Read/update sharing, share URLs, notifications, local QR rendering, cover uploads and partial-failure readback
Group joining	Join by group ID or invitation URL, resolve invitation metadata, redact invitations; submission does not claim membership
Digital employee enums	Replace open_code with qwenwork while keeping local_agent; constrain visibility to ALL/PARTIAL
AI tables: plans and layout	Build plans, batch reads/creates, chart/layout operations, AI task waiting/recovery/reporting and required invocation-scoped runtime support
AI tables: permissions	Advanced-permission role member append/replace/copy and user-role operations
AI tables: fields and AI	Built-in AI plugins, AI fields and field groups, write prechecks and error contracts

The four prerequisite ledger records keep their exact identifiers, contracts and reasons; only their state changes from pending to consumed. Existing open_code callers must migrate their input to qwenwork. Maintainers must confirm public service support for the new enum and visibility values before distribution. Server availability for the new operations is not verified by this PR.

Public-only products and newer digital employee A2UI/card ledger behavior are retained. The existing reply mode, card and feedback implementation files have no changes. Source-side CI/workflow migrations, source-only products, keychain renaming, credential reset and source evidence/history documents are excluded. The QR dependency is included because it is absent from the current public base.

Validation	Evidence and acceptance
Source-to-public scope comparison and independent static review	Completed; public-specific fixes retained and cursor precision findings resolved
Formatting and git diff --check	Applied / passed
Public aliases, path fallbacks, shortcut catalog and Skill sections	Regenerated: 921 commands, 34 fallbacks, 497 public shortcuts and 435 visible Skill shortcuts
GitHub CI	Integration requires all eight substantive quality contexts to succeed for the final head against main. Exact results are recorded in Checks and the merge receipt. Earlier partial or cancelled runs are not acceptance evidence.
Native changed-code coverage	The 100% requirement remains intact. Relevant regression tests participate in native selection, including scope publish flags and fail-closed Windows quoting.
Local tests and compatibility policy	NOT RUN locally; the maintainer explicitly requested actual GitHub CI
Live public services and breaking enum compatibility	NOT VERIFIED; maintainers must confirm service support before distribution

CI-driven fixes preserve the intended migration boundary: the public dev Schema contains 69 tools (scope get/set included; credential reset excluded), and the non-authoritative smoke fixture gains only the mind root entry. Historical flag/required records and authoritative compatibility baselines are retained. The fixture preservation generator rejected pre-existing historical flag migrations; a separate external-output attempt exited 137, so no reset was used.

Windows tests retain checkpoint/resume and no-replay assertions while limiting POSIX mode-bit checks to Unix. File logger cleanup precedes temporary-directory removal. The confirmation-table test normalizes checkout CRLF before checking the same canonical command paths. Windows ACL isolation is not established by mode-bit tests. Developer-app next-step tests verify both publish values, safe quoting and explicit fail-closed behavior; coverage thresholds and assertions are not relaxed.

The supporting-coverage job previously exceeded its ten-minute budget. Its timeout is now twenty minutes, retaining both complete coverage commands, required contexts and failure handling. This is a public CI reliability fix under the integration authorization; source-side CI migrations remain excluded. Native generator linking initially failed against local SDK metadata; CGO-disabled generation succeeded. Live service availability is outside these checks.

Release fragments accompany the capability groups, including .changes/public-business-capabilities.md and .changes/dingtalk-tag-qwenwork-type.md. Roll back business changes together with their consumed ledger state; retain prerequisite governance and historical compatibility receipts. No package, tag or OSS publication is performed here.