fix: ship PDF conversion dependencies

README.md

@@ -65,7 +65,7 @@ Research → Evidence → Knowledge → Learning
 | Phase 5–6 | Knowledge/Learning 与 Enhancement 闭环 | ✅ candidate 治理闭环完成 | 审批、版本、弃用与 provenance 边界已验证 |
 | Phase 7–8 | 受限 Planner tracer、多维 Evaluation、Sleep Loop 构件 | 🟡 首条纵向 tracer 完成 | `read file:`、Permission、Evidence、Evaluation 与 Lesson 已验证；通用 Planner 和统一执行端口未完成 |
 | Phase 9 | Contract & Tracer Alpha | ✅ 历史合同/追踪基线完成 | 不等于完整产品 Alpha，也不证明公开 release |
-| Product Stage A0 | 产品真相、诊断、媒体摄入与发布门禁 | 🟡 收口中 | Job/Outbox/OCR 基线、按需 dispatcher、本地真实 Chromium delivery gate 与 Windows/NSIS 门禁已验证；Tauri WebView 点击级证据、ASR、公开发布资产仍待完成 |
+| Product Stage A0 | 产品真相、诊断、媒体摄入与发布门禁 | 🟡 收口中 | Job/Outbox/OCR 基线、按需 dispatcher、本地真实 Chromium delivery gate、Windows/NSIS 门禁与公开 `v0.5.0` 资产已验证；Tauri WebView 点击级证据、ASR、签名发布与更高阶用户交互仍待完成 |
 
 ### 当前里程碑：Product Stage A0 真相基线
 

app/release-manifest.json

@@ -24,7 +24,7 @@
   "dependency_lock": {
     "path": "uv.lock",
     "algorithm": "sha256",
-    "digest": "e103c5f9a46ca2e11d50460b610de648978b62e60f53bdd7dd97d81fcf121cf8",
+    "digest": "9916e6dba6d152cff045abf188218a0a3a533a786b3c3061738dc3a128aa4268",
     "format_version": 1,
     "revision": 4
   },

docs/PROJECT_STATUS.md

@@ -1,6 +1,6 @@
 # 项目当前状态
 
-> 更新：2026-08-08。本页是能力状态入口；旧审计文件是历史快照。机器无关的恢复检查见 [`HANDOFF_2026-07-21.md`](HANDOFF_2026-07-21.md)，实时分支、SHA、dirty 状态与 CI 必须从 Git/GitHub 读取。
+> 更新：2026-08-09。本页是能力状态入口；旧审计文件是历史快照。机器无关的恢复检查见 [`HANDOFF_2026-07-21.md`](HANDOFF_2026-07-21.md)，实时分支、SHA、dirty 状态与 CI 必须从 Git/GitHub 读取。
 
 ## 发布真相
 

pyproject.toml

@@ -24,7 +24,7 @@ dependencies = [
     "sqlite-vec>=0.1.6",
     "loguru>=0.7",
     "structlog>=24.0",
-    "markitdown>=0.1",
+    "markitdown[pdf]>=0.1",
     "trafilatura>=1.6",
     "networkx>=3.0",
     "litellm==1.91.0",
@@ -61,7 +61,7 @@ ci = [
     "uvicorn[standard]>=0.22",
 ]
 ci-adapters = [
-    "markitdown>=0.1",
+    "markitdown[pdf]>=0.1",
     "newspaper4k>=0.9",
     "readabilipy>=0.3",
     "trafilatura>=1.6",

tests/test_adapter_contract.py

@@ -351,6 +351,34 @@ def test_pdf_uses_markitdown(self, tmp_path):
         assert "Markdown in a" in content
         assert engine == "markitdown"
 
+    def test_real_pdf_uses_markitdown_pdf_extra(self, tmp_path):
+        """A structurally valid PDF reaches the installed PDF extra."""
+        from app.ingestion.multi_format import convert_file
+
+        objects = [
+            b"1 0 obj<< /Type /Catalog /Pages 2 0 R >>endobj",
+            b"2 0 obj<< /Type /Pages /Kids [3 0 R] /Count 1 >>endobj",
+            b"3 0 obj<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R >>endobj",
+            b"4 0 obj<< /Length 0 >>stream\n\nendstream\nendobj",
+        ]
+        body = b"%PDF-1.4\n"
+        offsets = [0]
+        for obj in objects:
+            offsets.append(len(body))
+            body += obj + b"\n"
+        xref = len(body)
+        body += b"xref\n0 5\n0000000000 65535 f \n"
+        body += b"".join(f"{offset:010d} 00000 n \n".encode() for offset in offsets[1:])
+        body += b"trailer<< /Size 5 /Root 1 0 R >>\nstartxref\n"
+        body += str(xref).encode() + b"\n%%EOF\n"
+
+        pdf = tmp_path / "real.pdf"
+        pdf.write_bytes(body)
+        content, engine = convert_file(pdf)
+
+        assert isinstance(content, str)
+        assert engine == "markitdown"
+
     def test_html_uses_trafilatura(self, tmp_path):
         """HTML uses trafilatura when installed."""
         from app.ingestion.multi_format import convert_file

workspace/intake/022_windows_desktop_shell.md

@@ -33,4 +33,4 @@ Tauri
 
 Windows CI 在生成 NSIS 后必须真实执行安装、启动、Workspace HTTP、正常关闭、强制终止进程树、字节码零增长和卸载零残留验证；仅检查 EXE 文件存在不能作为安装闭环证据。
 
-当前 Release Manifest 仍保持 `unreleased`、`public=false`。未签名安装器只用于本地 Alpha 验证，不能作为公开发行或已建立发布身份的证据。
+当前源码 Release Manifest 仍保持 `unreleased`、`public=false`；这不否定已独立验证的公开 `v0.5.0` artifact identity、资产 checksum 与 installer lifecycle。当前没有签名发布声明；后续未签名构建仍不能自动作为新的公开发行证据。