fix: add missing Provides: anolisa-component(<name>) to os-skills, tokenless, ws-ckpt, agent-sec-core spec files

[zhangtaibo]

Problem

Fixes #2559 (same root cause, covers the remaining 4 components). Complements PR #2560 (agent-memory spec).

Five RPM spec files were missing the Provides: anolisa-component(<name>) virtual provide line that agentsight, copilot-shell, cosh-ng, and skillfs already declare. When the repo-side components-v2.toml is unavailable (HTTP 404 from http://mirrors.cloud.aliyuncs.com/anolisa/generic/anolisa/v1/components-v2.toml) and no package_map entry exists in repo.toml, the ANOLISA RPM resolver falls through all three resolution paths (package_map → component_index → rpm_package_provides_component) and returns empty candidates, causing INVALID_ARGUMENT: not an ANOLISA RPM component.

This causes anolisa install <component> --backend rpm to fail, and for adapter-dependent tests, anolisa adapter scan returns empty because the RPM (and its adapter resources under /usr/share/anolisa/adapters/) was removed by dnf remove and the reinstall failed.

Fix

Add Provides: anolisa-component(<name>) to 4 spec files:

Component	Spec File	Provides Value
os-skills	src/os-skills/os-skills.spec.in	anolisa-component(os-skills)
tokenless	src/tokenless/tokenless.spec.in	anolisa-component(tokenless)
ws-ckpt	src/ws-ckpt/ws-ckpt.spec.in	anolisa-component(ws-ckpt)
agent-sec-core	src/agent-sec-core/agent-sec-core.spec.in	anolisa-component(sec-core)

Each addition includes a 4-line explanatory comment matching the style already used in agent-memory.spec.in (PR #2560).

+# Declare ANOLISA component identity so that `anolisa install <name> --backend rpm`
+# can resolve this package via RPM Provides when the repo-side components-v2.toml
+# is unavailable (404) and no package_map entry exists — the resolver falls through to
+# RPM Provides but finds no anolisa-component(<name>) capability.
+Provides:       anolisa-component(<name>)

Verification

Tested on ECS (8.217.123.80) for os-skills:

git clone https://github.com/alibaba/anolisa.git && cd anolisa
git apply <patch>
bash scripts/rpm-build.sh os-skills
# → BUILD_EXIT=0, output: os-skills-0.0.1-1.alnx4.noarch.rpm (308K)
rpm -qp --provides scripts/rpmbuild/RPMS/noarch/os-skills-*.rpm
# → anolisa-component(os-skills)  ← new provides present
anolisa --json adopt os-skills --package os-skills
# → ok: true, adopted
anolisa --json adapter scan | jq '.data.adapters[] | select(.component=="os-skills")'
# → os-skills/openclaw with resource_present=true, driver_available=true, framework_detected=true

Co-Authored-By: Hermes Agent noreply@nousresearch.com

[qoderai]

本次变更集中为四个组件 RPM spec 增加 ANOLISA 组件级 Provides 能力及解释性注释，逻辑上对齐 issue 2559 所述缺失问题，未见功能性错误。

建议将注释从具体 resolver 回退实现抽象为稳定的协议约定，避免后续安装流程演进时文档失真，同时保留 Provides: anolisa-component(<name>) 作为关键能力声明。

---

🤖 Generated by Qoder • View workflow run

[qoderai]

[P2] tokenless RPM 组件 Provides 说明与 resolver 行为耦合较紧

当前注释直接绑定 components-v2.toml 404 + package_map 缺失这一特定回退路径，若将来 resolver 策略或索引文件名调整，注释易失真但 Provides: anolisa-component(tokenless) 仍然是必需的协议字段。建议在 src/tokenless/tokenless.spec.in:29-33 将说明收敛为：该 Provides 行是 ANOLISA 约定的组件标识能力，用于 rpm backend 解析与适配器发现，避免过度依赖具体实现细节。

---

🤖 Generated by Qoder • Fix in Qoder

[qoderai]

[P2] ws-ckpt RPM 提供能力说明过于实现细节化

ws-ckpt.spec.in:26-30 的注释同样写死了当前 resolver 的三段式回退逻辑（components-v2.toml / package_map / RPM Provides）。一旦 ANOLISA 安装流程演进，这段注释可能误导维护者。建议改为更抽象的协议描述：此 Provides 声明 ws-ckpt 作为 ANOLISA 组件，保证 anolisa install ws-ckpt --backend rpm 与适配器资源扫描能够通过 RPM 提供能力识别该包。

---

🤖 Generated by Qoder • Fix in Qoder

[qoderai]

[P2] sec-core RPM 提供能力注释建议抽象为协议层含义

agent-sec-core.spec.in:64-68 的注释延续 agent-memory 的模式，细致描述 resolver 在 components-v2.toml 404 且无 package_map 时的内部回退行为。作为规范性 RPM spec，更稳妥的做法是强调 Provides: anolisa-component(sec-core) 是 ANOLISA 定义的虚拟能力，用于组件身份解析与适配器发现，而不是紧耦合当前实现细节，以降低后续安装流程重构时的文档维护成本。

---

🤖 Generated by Qoder • Fix in Qoder

[Forrest-ly]

Code review @ d8cbf69 — code changes verified correct; one blocking CI failure (commit message)

What I verified (code is correct ✅)

1. Provides values match canonical component names. All four values match src/anolisa/manifests/components-v2.toml exactly: os-skills, tokenless, ws-ckpt, sec-core.
2. agent-sec-core → anolisa-component(sec-core) is correct despite the name mismatch. src/agent-sec-core/.anolisa/component.toml declares name = "sec-core" with package = "agent-sec-core"; this follows the existing convention where copilot-shell.spec.in provides anolisa-component(cosh).
3. Resolver semantics confirmed. rpm_component_provide() in src/anolisa/crates/anolisa-cli/src/resolution.rs builds exactly anolisa-component(<component>), and the final fallthrough in resolve_rpm() queries what_provides_installed/available() with that capability. So the Provides line alone is sufficient for anolisa install <component> --backend rpm to resolve when both package_map and the component index are unavailable — no other change needed.
4. Placement correct. Each line sits in the main-package preamble; the agent-sec-* subpackages correctly do not declare the component capability.
5. Comment style is consistent with agent-memory.spec.in from the complementary PR #2560.

Blocking — Commit Message Lint is red on this head

📝 Commit Message Lint fails (failOnErrors=true): header is 121 characters, limit is 120 (.github/commitlint.config.json → header-max-length). Please amend the commit header, e.g.:

fix(anolisa): add missing Provides: anolisa-component to os-skills, tokenless, ws-ckpt, agent-sec-core specs

(108 chars; scope anolisa is valid per scope-enum, body can stay as-is.)

Non-blocking

• I agree in principle with qoderai's 3 P2 comments (the new comments couple spec text to current resolver internals — 404/package_map fallthrough). If simplified, please do it consistently across all specs including agent-memory in #2560, possibly as a follow-up; keeping the pair consistent matters more than the abstraction level.
• Remaining CI on this head was still pending at review time (Test tokenless, Test agent-sec-core, Build agent-sec-core RPM, Source Builds); Test ws-ckpt already passes. Please confirm green after the amend.

[Forrest-ly]

Code Review — head 587da977 — REQUEST_CHANGES

严重问题：当前 head 的实际改动与 PR 目的完全不符，疑似 force-push 推错了分支内容。

本 PR 的标题、描述与 commit message 均声明：为 os-skills / tokenless / ws-ckpt / agent-sec-core 四个 spec 文件补充 Provides: anolisa-component(<name>)，修复 #2559。但 head 587da977 的实际 diff 没有触及任何 spec 文件，而是包含一组与本 PR 完全无关的 cosh-shell runtime 重构（5 个文件，+180/-31）：

• src/cosh-ng/crates/cosh-shell/src/runtime/controller.rs
• src/cosh-ng/crates/cosh-shell/src/runtime/dispatcher.rs
• src/cosh-ng/crates/cosh-shell/src/runtime/dispatcher_tests.rs
• src/cosh-ng/crates/cosh-shell/src/runtime/events.rs
• src/cosh-ng/crates/cosh-shell/src/runtime/state.rs

验证证据

1. 在 587da977 上，src/os-skills/os-skills.spec.in、src/tokenless/tokenless.spec.in、src/ws-ckpt/ws-ckpt.spec.in、src/agent-sec-core/agent-sec-core.spec.in 均 grep 不到 anolisa-component。对照参考：src/cosh-ng/cosh-ng.spec.in:21 已正确声明 Provides: anolisa-component(cosh-ng)。
2. force-push 之前的旧 head d8cbf695（GitHub API 仍可访问）commit message 与本 head 完全相同，但其改动文件列表恰好是上述 4 个 spec 文件——说明正确的修复在 force-push 之前是存在的，本次 force-push 用无关改动覆盖了它。
3. 因此若按现状合并，"Fixes #2559" 会关闭 issue，但 #2559 的实际问题（anolisa install <component> --backend rpm 报 INVALID_ARGUMENT）并未被修复。

CI 覆盖不匹配

本 head 的 CI 中 15 项组件测试全部为 skipping。既然实际 diff 改动了 cosh-ng 的 Rust 源码，cosh-ng 组件测试本应被触发。当前 CI 并未真正校验实际改动。作为补充验证，本地 cargo test -p cosh-shell --lib 通过（1314 passed, 0 failed），但这不能替代 CI 覆盖。

对 cosh-shell 改动本身的技术评估（次要）

该重构（ShellEventBatch/ShellEventSnapshot 由持有 Vec 改为借用 &[ShellEvent]；ControlState 新增 active_shell_command_ids 增量跟踪 shell busy 状态；空 batch 走 poll_inline_runtime_without_shell_events 快路径）经评估语义与旧实现等价：

• 事件流 append-only，cursor batch 对事件流形成划分，增量 busy 集合与旧的 shell_has_active_foreground_command(events) 全流重算等价（dispatcher.rs:85 处 batch_since(event_cursor)，AdvanceEventCursor 保证 cursor 单调推进）。
• controller.rs 中 cursor 归零重放路径 render_inline_guidance 为 #[cfg(test)] 专用，且全量重放对该集合状态机收敛，无泄漏风险。
• shell_exited 的 finalize 逻辑只在置位该标志的同一事件路径执行，idle 路径仅复用已置位状态，行为不变。

但这是一个独立的性能优化重构，应当单独提 PR，配独立的描述与 CI 范围，而不是混在一个标题为 spec 修复的 PR 里。

请求

1. 请将正确的 spec 修复重新推送到本分支（可直接恢复 d8cbf695 的内容），使分支内容与 PR 标题/描述一致。
2. 请将 cosh-shell runtime 重构拆分到另一个 PR 单独提交与评审。
3. 在分支内容修正之前，本 PR 不应合并。

[kongche-jbw]

Closing as superseded by the component-specific PRs. The os-skills and tokenless changes landed in #2576, while agent-sec-core and ws-ckpt remain tracked by #2563 and #2568. The current head branch no longer contains the original RPM metadata changes.