@fitlab-ai/agent-infra 0.11.1 → 0.11.2

package/templates/.agents/rules/local-artifact-repair.en.md

@@ -1,73 +1,27 @@
-# General Rule - Model-Driven Local Artifact Recovery
+# Shared Rule - Current Local Artifact Revalidation
 
-This rule covers the pre-completion gate for `analyze-task`, `plan-task`, and `code-task`, plus the summary finalizers for the three review skills. It handles one canonical artifact in the current task directory only. It does not authorize changes to `task.md`, ledgers, receipts, source code, Git, platform resources, or lifecycle state.
+This rule applies to lifecycle artifact validation. Finalizers read the canonical artifact directly and do not create recovery candidates, generations, baselines, journals, or recovery identities.
 
-## Pre-completion gate
+## Current validation
 
-- Run the applicable finalizer before a completed event; pass only that invocation's `artifactSha256` and `semanticDigest` to the event.
-- When artifact content is invalid, the finalizer returns a controlled `recovery` with a `recoveryId`, `candidatePath`, and baseline digests. The formal artifact remains unchanged until recovery commit.
-- After the mechanical safety gates pass, the model may edit only the returned `candidatePath`. After each byte-changing edit, rerun the complete finalizer with the same task, stage/family, artifact, and `--recovery-id`. Never edit the formal artifact directly and call it a candidate.
-- Preflight stable-reads and validates candidate `S`, then seals immutable digest-addressed generation `R`; candidate SHA is an observation rather than an edit guard.
-- Preflight publishes active `R` through `preflight-ready → preflight-commit-started → preflight-passed`; the business finalizer publishes `F` through `full-finalizer-ready → commit-started → passed` and reuses `R` when `F=R`.
-- Candidate-only is a protocol authorization boundary, not OS isolation: a same-UID process with arbitrary host filesystem write access may tamper with recovery internals. Identity, fingerprint, and state checks detect such anomalies and fail closed, but the protocol does not claim an independent security principal or cross-platform isolation.
+1. Run the applicable finalizer before a completed event and use its returned `artifactSha256` and `semanticDigest`.
+2. On failure, read diagnostics, make one minimal repair to the canonical artifact, and rerun with the same task, family/stage, and artifact.
+3. Every rerun validates structure, qualification, upstream relations, ledger state, and current digests. Stop without publishing completed when there is no progress or repair is unsafe.
 
-## Recovery continuation context
+## Editing boundary
 
-Whenever a preflight or finalizer returns `recovery`, bind the complete continuation context from that response for the current execution: `taskRef`, `stage/family`, `artifact`, `recoveryId`, `candidatePath`, baseline digests, and the original entry point. These fields belong to one controlled transaction; do not regenerate, guess, or mix any of them for a later call.
+Agents may edit only the artifact declared by the current skill.
 
-- For a preflight failure, edit only that `candidatePath`, then rerun the same preflight entry point with the same `--recovery-id`. Only the successful response's recovery context may proceed to ledger writes or summary/finalization.
-- For a finalizer failure, edit only that `candidatePath`, then rerun that same finalizer entry point with the same `--recovery-id`.
-- Stop when the context is lost, the tuple differs, or the formal artifact was edited directly. A fresh invocation without `--recovery-id` cannot replace recovery, and a formal artifact is never a candidate.
+## Completed events
 
-## Authorization boundary
+Completed events still validate current digests, rounds, inputs, and external facts.
 
-- The finalizer and recovery core validate identity, state, permissions, stable reads, complete artifact semantics, and fingerprints. They do not infer repairability or expose a text-operation allow-list.
-- The model may edit only the one ordinary artifact declared by the current skill. It must not edit `task.md`, ledgers, receipts, source code, other reports, or remote resources.
-- `changed=false`, an error code, or a format shape is diagnostic evidence, not edit authorization. Stop on unproven human-decision semantics, concurrency, permission, I/O, identity, provenance, or unknown state.
-
-## Non-bypassable mechanical gates
-
-Before every candidate edit, confirm that:
-
-1. the finalizer failed with the same controlled recovery context and nothing formal was committed;
-2. task, family/stage, round, artifact, request/authority, and baseline fingerprints still match;
-3. `candidatePath` is the ordinary file generated by the recovery core and the formal target has not changed externally;
-4. the edit does not change human-decision semantics, detail or ledger identity, and introduces no other side effect.
-
-If any condition fails, stop without editing or publishing a completed event.
-
-## Durable recovery states
-
-| State | Formal artifact | Allowed action |
-| --- | --- | --- |
-| `awaiting-preflight-recovery` | baseline `B` | Edit `S`; stable-read, validate, and create `R` |
-| `preflight-ready` / `preflight-commit-started` | `B` or `R` | Reconcile/publish only active immutable `R` |
-| `preflight-passed` | `R` | Run the business finalizer for `F` |
-| `full-finalizer-ready` / `commit-started` | `R` or `F` | Reconcile/publish only pending immutable `F` |
-| `passed` | `F` | Completed event validates the final digest and consumes the intent |
-| `consumed` | `F` | Cleanup may reclaim the controlled staging and backup |
-| `aborted` | verified restored `B` | Preserve diagnostics; never fabricate success |
-
-The intent is current-only schema version 4. Legacy schemas fail closed; do not add migration, adapters, or dual writes. Candidate, baseline, generation, and intent files live in controlled repo-local directories and use canonical recovery IDs, regular-file checks, stable reads, the task lock, and expected-value CAS. No cross-file atomicity is claimed; unknown combinations remain indeterminate and retain their evidence.
-
-## Dynamic convergence loop
-
-1. Run the finalizer with the fixed invocation.
-2. On every failure that passes the gates, read the structured diagnostic and `candidatePath`, then make only one minimal, explainable candidate edit.
-3. Confirm byte-level progress and rerun every finalizer check with the same `--recovery-id`; if it still fails with a new diagnostic and fingerprint, return to step 2.
-4. Stop on repeated diagnostics or fingerprints, no byte progress, unknown recovery state, an unsafe repair, or the eight-edit limit for the current invocation. Do not publish a completed event or generate a cross-stage next step.
-
-## Shared entry points
-
-The current entry points are `task-artifact ... inspect|init|finalize-local` and `task-review ... finalize-summary`. Recovery retries use the `recoveryId` returned by the finalizer, for example:
+## Shared entry point
 
 ```text
-agent-infra-internal task-artifact {task-id} finalize-local --family code --artifact {code-artifact} --recovery-id {recovery-id}
-agent-infra-internal task-review {task-id} finalize-summary --stage code --artifact {review-artifact} --recovery-id {recovery-id}
+agent-infra-internal task-artifact {task-id} finalize-local --family code --artifact {code-artifact}
 ```
 
-There is no `task-artifact repair`, `replace-line`, `insert-section`, or `repairable` authorization. The structural engine returns diagnostics and digests only; the current skill's gates and the model decide whether and how to edit the candidate.
-
-## Lifecycle isolation
+## Stop conditions
 
-A completed event may legitimately modify `task.md`, but only after finalizer recovery is `passed` and digest, round, request, and authority all match. If authority consumption fails after the event write, retain the formal artifact and use the existing lifecycle recovery compensation; do not replay the completed write or roll back a passed artifact.
+Stop when repair is unsafe or makes no progress.

package/templates/.agents/rules/local-artifact-repair.zh-CN.md

@@ -1,74 +1,27 @@
-# 通用规则 - 模型驱动的本地产物恢复
+# 通用规则 - 当前本地产物重验
 
-本规则适用于 `analyze-task`、`plan-task`、`code-task` 的本地产物完成前门禁，以及三个 review skill 的 summary finalizer。它只处理当前 task 目录内的一个 canonical artifact；不适用于 `task.md`、账本、receipt、源码、Git、平台资源或生命周期状态。
+本规则适用于生命周期产物的当前校验。finalizer 直接读取正式 artifact，不创建 recovery candidate、generation、baseline、journal 或 recovery identity。
 
-## 完成前门禁
+## 当前校验
 
-- 完成事件前必须运行对应 finalizer；只有同一次返回的 `artifactSha256` 和 `semanticDigest` 才能传给 completed event。
-- preflight 先对当前 stable-read candidate 完整验证，并将验证的 `R` 写入 digest-addressed、只读的 generation；在 journal CAS 前正式 artifact 必须保持 baseline `B`。
-- candidate SHA 是 awaiting 状态的最后一次 stable-read 观测值，不是下一次编辑的 guard。合法 `S` 编辑必须重新验证并在成功后 CAS 为 `R`。
-- 只有在机械安全门通过后，模型才可编辑返回的 `candidatePath`；每次实际字节变化后，用同一 task、stage/family、artifact 和 `--recovery-id` 完整重跑 finalizer。不得直接编辑正式 artifact 后假设它属于候选。
-- preflight 按 `preflight-ready → preflight-commit-started → preflight-passed` 发布 immutable `R`；业务 finalizer 再按 `full-finalizer-ready → commit-started → passed` 将 `F` 发布。`F=R` 复用 active generation。
-- preflight-ready 后 publish 只读取 active/pending generation，绝不再读取可编辑 candidate。
-- candidate-only 是协议授权边界，不是操作系统隔离：拥有同一 UID 且可任意写入宿主文件系统的进程可能篡改 recovery 内部文件；协议会通过身份、指纹和状态校验发现异常并失败关闭，但不承诺独立权限主体或跨平台隔离。
+1. completed event 前运行对应 finalizer，并使用该次返回的 `artifactSha256` 和 `semanticDigest`。
+2. 失败时读取诊断，对正式 artifact 作一次最小修正，再以相同 task、family/stage 和 artifact 重跑。
+3. 每次重跑重新校验结构、资格、上游关系、账本和当前摘要；没有进展或无法安全修正时停止，不发布 completed。
 
-## 恢复续办上下文
+## 编辑边界
 
-任一 preflight 或 finalizer 返回 `recovery` 时，立即在本次执行中绑定该响应的完整续办上下文：`taskRef`、`stage/family`、`artifact`、`recoveryId`、`candidatePath`、baseline digest 和原入口。它们属于同一受控事务，后续调用不得重新生成、猜测或混用其中任一字段。
+模型只能修改当前 skill 声明的 artifact。
 
-- 失败来自 preflight：只编辑该 `candidatePath` 后，以相同入口和同一 `--recovery-id` 重跑 preflight；只有成功响应中的 recovery context 才能进入后续账本写入或 summary/finalizer。
-- 失败来自 finalizer：只编辑该 `candidatePath` 后，以相同入口和同一 `--recovery-id` 重跑该 finalizer。
-- 上下文丢失、tuple 不匹配或正式 artifact 已被直接修改时停止；不得以省略 `--recovery-id` 的新调用替代恢复，也不得把正式 artifact 当作 candidate。
+## 完成事件
 
-## 授权边界
-
-- finalizer 和 recovery core 只校验身份、状态、权限、稳定读取、完整 artifact 语义和指纹；不根据错误码猜测“可修复”，也不提供文本操作白名单。
-- 模型只能修改当前 skill 声明的一个普通 artifact。不得修改 task.md、账本、receipt、源码、其他报告或远端资源。
-- `changed=false`、错误码和格式形状只是诊断事实，不是编辑授权。人工裁决、并发、权限、I/O、身份、provenance 或未知状态无法证明安全时，立即停止。
-
-## 不可绕过的机械安全门
-
-每次编辑候选前确认：
-
-1. finalizer 返回失败并提供同一 recovery context，且没有正式提交；
-2. task、family/stage、round、artifact、request/authority 和 baseline 指纹仍匹配；
-3. `candidatePath` 是 recovery core 生成的受控普通文件，formal target 没有外部变化；
-4. 修改不改变人工裁决语义、详情或账本身份，也不引入其他副作用。
-
-任一条件不满足，停止，不编辑、不发布 completed。
-
-## Durable recovery 状态
-
-| 状态 | formal artifact | 允许动作 |
-| --- | --- | --- |
-| `awaiting-preflight-recovery` | baseline `B` | 只编辑 candidate `S`，稳定读取、验证并生成 `R` |
-| `preflight-ready` / `preflight-commit-started` | `B` 或 `R` | 只可从 active immutable `R` reconcile/publish |
-| `preflight-passed` | `R` | 执行业务 finalizer，生成或复用 `F` |
-| `full-finalizer-ready` / `commit-started` | `R` 或 `F` | 只可从 pending immutable `F` reconcile/publish |
-| `passed` | `F` | completed event 校验 final digest 后消费 |
-| `consumed` | `F` | 可由中间产物清理流程回收受控 staging/backup |
-| `aborted` | 已确认恢复的 `B` | 只保留诊断，不得伪造成功 |
-
-intent 使用 current-only schema version 4。旧 schema 直接失败关闭；不添加迁移、adapter 或双写。candidate、baseline、generation 和 intent 位于 repo-local 受控目录，使用 canonical recovery ID、普通文件检查、stable read、task lock 和 expected-value CAS。跨文件不宣称原子性；未知组合返回 indeterminate 并保留现场。
-
-## 动态收敛循环
-
-1. 用固定 invocation 运行 finalizer。
-2. 每次失败且安全门通过时，读取结构化诊断和 `candidatePath`，仅作一次最小、可解释的候选编辑。
-3. 确认字节变化后，使用同一 `--recovery-id` 完整重跑全部 finalizer 校验；仍失败但诊断和指纹均未重复时，回到第 2 步。
-4. 诊断或指纹重复、无字节进展、恢复状态未知、无法安全修复或达到当前 invocation 的 8 次编辑上限时停止；不发布 completed，不生成跨阶段 next-step。
+completed event 仍校验当前 digest、round、输入和外部事实。
 
 ## 共享入口
 
-`task-artifact ... inspect|init|preflight|finalize-local` 和 `task-review ... finalize-summary` 是当前入口。preflight 不发布 task metadata、ledger、formal provenance、completed event 或平台状态；恢复重试使用 finalizer 返回的 `recoveryId`，例如：
-
 ```text
-agent-infra-internal task-artifact {task-id} finalize-local --family code --artifact {code-artifact} --recovery-id {recovery-id}
-agent-infra-internal task-review {task-id} finalize-summary --stage code --artifact {review-artifact} --recovery-id {recovery-id}
+agent-infra-internal task-artifact {task-id} finalize-local --family code --artifact {code-artifact}
 ```
 
-不再存在 `task-artifact repair`、`replace-line`、`insert-section` 或 `repairable` 授权。结构引擎只返回诊断和 digest；候选是否安全、如何修改以及何时停止由当前 skill 的机械门和模型逐例判断。
-
-## 生命周期隔离
+## 停止条件
 
-completed event 合法地修改 task.md，但必须发生在 finalizer recovery 已 `passed` 且 digest、round、request/authority 全部匹配之后。若 event 写入后 authority 消费失败，保留正式 artifact，使用既有 lifecycle recovery compensation；不得重放 completed 写入或回滚已通过的 artifact。
+无法安全修正或没有进展时停止。

package/templates/.agents/skills/analyze-task/SKILL.en.md

@@ -140,7 +140,7 @@ Before writing this round's `{analysis-artifact}`, create the controlled report
 agent-infra-internal task-artifact {task-id} init --family analysis --artifact {analysis-artifact} --locale en
 ```
 
-The skeleton contains identity metadata, stable section markers, and required headings only; real analysis content is required before the completion gate can pass. If the finalizer returns one provably safe structural error, it returns a controlled recovery candidate; edit only its `candidatePath`, then rerun `task-artifact {task-id} finalize-local --family analysis --artifact {analysis-artifact} --recovery-id {recovery-id}` with the same `recoveryId`. Candidate-only is a protocol authorization boundary, not OS isolation; arbitrary same-UID host writers are outside the protocol's protection claim, and fingerprint/state checks fail closed on anomalies.
+The skeleton contains identity metadata, stable section markers, and required headings only; real analysis content is required before the completion gate can pass. On a structural error, correct the formal artifact directly and rerun `task-artifact {task-id} finalize-local --family analysis --artifact {analysis-artifact}`; current structure, qualification, and summary facts are the only gate.
 
 > Steps 6–9 are the **Scenario A (normal output)** path. **Scenario B (ask and early-exit)** already finished its state update, task-comment sync, and verification inside step 4 and STOPped, so it does not enter these steps.
 
@@ -223,8 +223,8 @@ agent-infra-internal task-artifact {task-id} finalize-local --family analysis --
 ```
 
 - On `status=passed`, save that result's `artifactSha256` and `semanticDigest`; the finalizer has recorded the matching one-shot local provenance intent.
-- On `status=failed` with recovery context, after the completion gates pass, edit the returned `candidatePath` only once for this attempt, then rerun the finalizer completely with the same `recoveryId`; if it still fails with a new diagnostic and fingerprint while the gates continue to pass, continue to the next attempt; the formal artifact must remain unchanged until commit.
-- The recovery candidate must match the recorded task, round, artifact, baseline, and request identity. On baseline conflict, unknown state, an unsafe repair, repeated diagnostics or fingerprints, no progress, or the shared edit limit, stop without publishing a completed event.
+- On `status=failed`, correct the formal artifact directly and rerun the finalizer completely; if the current diagnostic remains unresolved, continue to the next attempt.
+- On an external formal-artifact change, an unsafe repair, repeated diagnostics or fingerprints, no progress, or the shared edit limit, stop without publishing a completed event.
 
 Use the digests from that same `status=passed` result in `agent-infra-internal task-event {task-id} analyze.completed --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code} --artifact {analysis-artifact} --artifact-sha256 {artifact-sha256} --semantic-digest {semantic-digest} {execution-flag}` so the core records the link, stage, agent, metadata, and Activity Log atomically.
   - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Analyze Task (Round {N})** by {agent} — Analysis completed → {analysis-artifact}

package/templates/.agents/skills/analyze-task/SKILL.zh-CN.md

@@ -143,7 +143,7 @@ agent-infra-internal task-event {task-id} analyze.started --agent {standard-agen
 agent-infra-internal task-artifact {task-id} init --family analysis --artifact {analysis-artifact}
 ```
 
-骨架只包含身份元数据、稳定 section marker 和必需标题；必须填入真实分析内容后才能通过完成门禁。finalizer 返回可证明的单个结构错误时，会返回受控 recovery candidate；只能编辑返回的 `candidatePath`，然后使用同一个 `recoveryId` 重跑 `task-artifact {task-id} finalize-local --family analysis --artifact {analysis-artifact} --recovery-id {recovery-id}`。candidate-only 是协议授权边界，不是操作系统隔离；同 UID 的任意宿主写入者不在本协议的防护承诺内，异常由指纹/状态校验失败关闭。
+骨架只包含身份元数据、稳定 section marker 和必需标题；必须填入真实分析内容后才能通过完成门禁。finalizer 返回结构错误时，直接修正正式产物后重跑 `task-artifact {task-id} finalize-local --family analysis --artifact {analysis-artifact}`；当前结构、资格和摘要事实是唯一门禁。
 
 > 步骤 6–9 属**场景 A（正常产出）**路径。**场景 B（提问早退）**已在步骤 4 内完成状态更新、task 评论同步与校验并 STOP，不进入这些步骤。
 
@@ -226,8 +226,8 @@ agent-infra-internal task-artifact {task-id} init --family analysis --artifact {
   agent-infra-internal task-artifact {task-id} finalize-local --family analysis --artifact {analysis-artifact}
   ```
   - `status=passed`：保存本次返回的 `artifactSha256` 和 `semanticDigest`；finalizer 已记录对应的一次性本地 provenance intent。
-  - `status=failed` 且返回 recovery context：完成门禁通过后，本次只编辑返回的 `candidatePath` 一次，然后使用同一个 `recoveryId` 完整重跑 finalizer；若仍失败但诊断和指纹均未重复且安全门继续通过，继续下一轮；formal artifact 在 commit 前必须保持不变。
-  - recovery candidate 必须与记录的任务、轮次、产物、baseline 和 request identity 匹配；基线冲突、未知状态、无法安全修复、诊断或指纹重复、无进展，或达到共享规则的编辑上限时停止，不发布 completed 事件。
+  - `status=failed`：直接修正正式产物并完整重跑 finalizer；若仍失败且诊断未解决，继续下一轮。
+  - 当前正式产物发生外部变化、无法安全修复、诊断或指纹重复、无进展，或达到共享规则的编辑上限时停止，不发布 completed 事件。
 - 使用同一次 `status=passed` 返回的摘要执行 `agent-infra-internal task-event {task-id} analyze.completed --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code} --artifact {analysis-artifact} --artifact-sha256 {artifact-sha256} --semantic-digest {semantic-digest} {execution-flag}`，由核心登记链接、阶段、代理、时间、版本和 Activity Log。
 
 如果 task.md 中存在有效的 `platform_issue_identity`，执行以下同步操作（任一失败则跳过并继续）：

package/templates/.agents/skills/code-task/SKILL.en.md

@@ -122,7 +122,7 @@ Before writing this round's `{code-artifact}`, create the controlled report skel
 agent-infra-internal task-artifact {task-id} init --family code --artifact {code-artifact} --locale en
 ```
 
-The skeleton contains identity metadata, stable section markers, and required headings only; real implementation and verification content is required before the completion gate can pass. When preflight or finalization returns one provably safe structural error, it returns a controlled recovery candidate; edit only its `candidatePath`, then retain the same recovery context and rerun the entry point that returned it, as specified by `.agents/rules/local-artifact-repair.md`. Candidate-only is a protocol authorization boundary, not OS isolation; arbitrary same-UID host writers are outside the protocol's protection claim, and fingerprint/state checks fail closed on anomalies.
+The skeleton contains identity metadata, stable section markers, and required headings only; real implementation and verification content is required before the completion gate can pass. On a preflight or finalization structural error, follow `.agents/rules/local-artifact-repair.md` to correct the formal artifact directly and rerun the same entry point; current structure, qualification, and summary facts are the only gate.
 
 Create `.agents/workspace/active/{task-id}/{code-artifact}`.
 
@@ -139,8 +139,8 @@ echo "$finalizer"
 ```
 
 - `status=0` with `finalizer.status="passed"`: bind `{artifact-sha256}` and `{semantic-digest}` from this result.
-- `status=1` with recovery context: confirm task, round, artifact, baseline, and request identity are unchanged; edit the returned `candidatePath` only once for this attempt, confirm the bytes changed, then rerun the entry point that returned the context completely with the same `recoveryId`; a failed preflight reruns preflight and a failed finalizer reruns that finalizer. If it still fails with a new diagnostic and fingerprint while the gates continue to pass, continue to the next attempt; `baseline`, `final`, `publish`, and `intent` remain framework-internal state and must not be edited.
-- For any other failure, external formal-artifact change, an unsafe repair, repeated diagnostics or fingerprints, lack of progress, the shared edit limit, or recovery identity mismatch, stop without publishing `code.completed`.
+- `status=1`: correct the formal artifact directly and rerun the entry point completely; a failed preflight reruns preflight and a failed finalizer reruns that finalizer. If the current diagnostic remains unresolved, continue to the next attempt.
+- For any other failure, external formal-artifact change, an unsafe repair, repeated diagnostics or fingerprints, lack of progress, or the shared edit limit, stop without publishing `code.completed`.
 
 Do not rescan or manually write digest data; the completion event must include `--artifact-sha256 {artifact-sha256} --semantic-digest {semantic-digest}` from the successful finalizer result.
 

package/templates/.agents/skills/code-task/SKILL.zh-CN.md

@@ -162,7 +162,7 @@ checkpoint 成功后，若任务存在 `platform_issue_identity`，调用 `agent
 agent-infra-internal task-artifact {task-id} init --family code --artifact {code-artifact}
 ```
 
-骨架只包含身份元数据、稳定 section marker 和必需标题；必须填入真实实现与验证内容后才能通过完成门禁。preflight 或 finalizer 返回可证明的单个结构错误时，会返回受控 recovery candidate；只能编辑返回的 `candidatePath`，并按 `.agents/rules/local-artifact-repair.md` 保持同一 recovery context 后重跑返回该 context 的原入口。candidate-only 是协议授权边界，不是操作系统隔离；同 UID 的任意宿主写入者不在本协议的防护承诺内，异常由指纹/状态校验失败关闭。
+骨架只包含身份元数据、稳定 section marker 和必需标题；必须填入真实实现与验证内容后才能通过完成门禁。preflight 或 finalizer 返回结构错误时，按 `.agents/rules/local-artifact-repair.md` 直接修正正式产物并重跑原入口；当前结构、资格和摘要事实是唯一门禁。
 
 创建 `.agents/workspace/active/{task-id}/{code-artifact}`。
 
@@ -179,8 +179,8 @@ echo "$finalizer"
 ```
 
 - `status=0` 且 `finalizer.status="passed"`：绑定这一次返回的 `{artifact-sha256}` 和 `{semantic-digest}`。
-- `status=1` 且返回 recovery context：确认任务、轮次、产物、baseline 和 request identity 未变化后，本次只编辑返回的 `candidatePath` 一次，确认字节确实变化，再使用同一个 `recoveryId` 完整重跑返回该 context 的同一入口；preflight 失败必须重跑 preflight，finalizer 失败必须重跑 finalizer。若仍失败但诊断和指纹均未重复且安全门继续通过，继续下一轮；baseline、final、publish 和 intent 均属于框架内部状态，不得编辑。
-- 其他失败、formal artifact 外部变化、无法安全修复、诊断或指纹重复、无进展、达到共享规则的编辑上限或 recovery identity 不匹配：停止，不发布 `code.completed`。
+- `status=1`：直接修正正式产物后重跑同一入口；preflight 失败必须重跑 preflight，finalizer 失败必须重跑 finalizer。若仍失败且当前诊断未解决，继续下一轮。
+- 其他失败、formal artifact 外部变化、无法安全修复、诊断或指纹重复、无进展或达到共享规则的编辑上限：停止，不发布 `code.completed`。
 
 不得重新扫描或手工补写摘要；完成事件必须携带本次 `passed` 结果的 `--artifact-sha256 {artifact-sha256} --semantic-digest {semantic-digest}`。
 

package/templates/.agents/skills/complete-task/SKILL.en.md

@@ -9,7 +9,7 @@ description: >
 # Complete Task
 > `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
-Host finalization uses receipt v2 with an immutable `receiptId`, monotonic `revision`, and canonical warnings. Lifecycle/identity/required-PR hard failures return `result: failed|blocked`; after lifecycle succeeds, comment, peripheral verification, and other sync failures return `result: completed_with_warnings` and six-field warnings, retrying only receipt-pending steps.
+Host finalization uses receipt v3 with an immutable `receiptId`, monotonic `revision`, staged summary input, and canonical warnings. Lifecycle/identity/required-PR hard failures return `result: failed|blocked`; after lifecycle succeeds, comment, peripheral verification, and other sync failures return `result: completed_with_warnings` and six-field warnings, retrying only receipt-pending steps.
 
 
 ## Boundary / Critical Rules
@@ -143,7 +143,7 @@ When a valid `platform_issue_identity` exists, execute in this exact order:
 
 1. Run `agent-infra-internal platform-comment backfill {task-id} --agent {standard-agent-token}` so core publishes only the completion canonical inventory in fixed order and resolves matching historical warnings only after full success.
 2. Run `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --requirements --fields`.
-3. Write the business summary to a temporary file and run `agent-infra-internal platform-comment sync {task-id} --kind summary --body-file {path} --agent {standard-agent-token}`.
+3. Write the business summary to a temporary file and run `agent-infra-internal platform-comment stage-summary {task-id} --body-file {path}`. This stores the body and SHA-256 in the task's durable staging record; it must not publish the summary comment directly.
 
 When the ledger contains a valid `PRC-N` post-review exemption, the summary body must mirror the ruling reason, commit scope, human identity, and time from task.md, and state that this is a human override rather than an automatic verification success. If a matching workflow warning exists, also mirror its original failure code/message. If no warning exists yet, state only that the ruling is recorded and final gate verification is pending; do not claim that the exemption has passed. The same `--kind summary` intent remains the sole owner of the summary marker.
 
@@ -177,7 +177,7 @@ If a summary must mirror a human-decided `post-review-commit` exemption, make a
 agent-infra-internal task-finalization {task-id} complete --agent {standard-agent-token}
 ```
 
-Finalization runs lifecycle -> the terminal task comment -> the `complete-task.completed` gate in a fixed order and records each step in the host receipt. `result=completed` means the host safely completed the task from structured results and the receipt; if peripheral warnings remain, return `result=completed_with_warnings`, warnings, and pending steps. Use `result=failed` or `result=blocked` only for hard or receipt/capability failures, then fix the cause and retry through the same entry point; do not claim completion or hand-repair partial state. A sandbox must not run `ls completed` or a local terminal verification against its historical mount to re-decide this result.
+Finalization runs lifecycle -> terminal task comment -> core verification -> warning task-comment update -> summary -> post-summary verification in a fixed order and records every step in the host receipt. It clears the staging record only after all steps finish with no open warning. `result=completed` means the host safely completed the task from structured results and the receipt; if peripheral warnings remain, return `result=completed_with_warnings`, warnings, and pending steps. Use `result=failed` or `result=blocked` only for hard or receipt/capability failures, then fix the cause and retry through the same entry point; do not claim completion or hand-repair partial state. A sandbox must not run `ls completed` or a local terminal verification against its historical mount to re-decide this result.
 
 ### 7. Handle Finalization Retries and Results
 

package/templates/.agents/skills/complete-task/SKILL.zh-CN.md

@@ -9,7 +9,7 @@ description: >
 # 完成任务
 > `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
-宿主 finalization 使用 receipt v2（不可变 `receiptId`、单调 `revision` 和 canonical warnings）。生命周期/身份/required PR 等硬失败返回 `result: failed|blocked`；生命周期完成后，评论、外围验证和其他同步失败返回 `result: completed_with_warnings` 及六字段 warning，并仅重试 receipt 中的 pending step。
+宿主 finalization 使用 receipt v3（不可变 `receiptId`、单调 `revision`、摘要暂存和 canonical warnings）。生命周期/身份/required PR 等硬失败返回 `result: failed|blocked`；生命周期完成后，评论、外围验证和其他同步失败返回 `result: completed_with_warnings` 及六字段 warning，并仅重试 receipt 中的 pending step。
 
 
 ## 行为边界 / 关键规则
@@ -142,7 +142,7 @@ Please satisfy the hard prerequisite first, then retry complete-task.
 
 1. 调用 `agent-infra-internal platform-comment backfill {task-id} --agent {standard-agent-token}`，由 core 仅按 completion canonical inventory 固定顺序补发产物并在全部成功后精确恢复目标历史告警。
 2. 调用 `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --requirements --fields`。
-3. 把业务摘要写入临时文件，并调用 `agent-infra-internal platform-comment sync {task-id} --kind summary --body-file {path} --agent {standard-agent-token}`。
+3. 把业务摘要写入临时文件，并调用 `agent-infra-internal platform-comment stage-summary {task-id} --body-file {path}`。该命令把正文和 SHA-256 写入 task 目录的 durable staging record；本步骤不得直接发布 summary 评论。
 
 若账本含合法的 `PRC-N` post-review 豁免，摘要正文必须镜像 task.md 中的裁决理由、提交范围、人工身份与时间，并明确这是人工覆盖而非自动校验成功。已有匹配 workflow warning 时，同时镜像其原始 failure code/message；尚无 warning 时只写“裁决已记录、最终门禁待验证”，不得提前宣称豁免已通过。summary marker 仍由同一 `--kind summary` intent 唯一维护。
 
@@ -176,7 +176,7 @@ agent-infra-internal task-verify {task-id} complete-task.preflight --format text
 agent-infra-internal task-finalization {task-id} complete --agent {standard-agent-token}
 ```
 
-finalization 按 lifecycle → task 评论 → `complete-task.completed` 校验的固定顺序执行，并将每一步的状态写入宿主 receipt。`result=completed` 即表示宿主已依据结构化结果和 receipt 安全完成；若还有外围 warning，返回 `result=completed_with_warnings`、warnings 和 pending steps。`result=failed` 或 `result=blocked` 仅用于硬失败或 receipt/capability 失败，修复原因后以同一入口重试，不得宣称完成或手工补写局部状态。沙箱不得从旧挂载执行 `ls completed` 或本地终态校验来重新裁决该结果。
+finalization 按 lifecycle → task 评论 → core verification → warning task 评论更新 → summary → post-summary verification 的固定顺序执行，并将每一步的状态写入宿主 receipt。summary 使用暂存正文；仅在所有步骤完成且无未解决 warning 后清理 staging record。`result=completed` 即表示宿主已依据结构化结果和 receipt 安全完成；若还有外围 warning，返回 `result=completed_with_warnings`、warnings 和 pending steps。`result=failed` 或 `result=blocked` 仅用于硬失败或 receipt/capability 失败，修复原因后以同一入口重试，不得宣称完成或手工补写局部状态。沙箱不得从旧挂载执行 `ls completed` 或本地终态校验来重新裁决该结果。
 
 ### 7. 处理 finalization 重试与结果
 

package/templates/.agents/skills/plan-task/SKILL.en.md

@@ -114,7 +114,7 @@ Before writing this round's `{plan-artifact}`, create the controlled report skel
 agent-infra-internal task-artifact {task-id} init --family plan --artifact {plan-artifact} --locale en
 ```
 
-The skeleton contains identity metadata, stable section markers, and required headings only; real plan content is required before the completion gate can pass. If the finalizer returns one provably safe structural error, it returns a controlled recovery candidate; edit only its `candidatePath`, then rerun `task-artifact {task-id} finalize-local --family plan --artifact {plan-artifact} --recovery-id {recovery-id}` with the same `recoveryId`. Candidate-only is a protocol authorization boundary, not OS isolation; arbitrary same-UID host writers are outside the protocol's protection claim, and fingerprint/state checks fail closed on anomalies.
+The skeleton contains identity metadata, stable section markers, and required headings only; real plan content is required before the completion gate can pass. On a structural error, correct the formal artifact directly and rerun `task-artifact {task-id} finalize-local --family plan --artifact {plan-artifact}`; current structure, qualification, and summary facts are the only gate.
 
 Create `.agents/workspace/active/{task-id}/{plan-artifact}`.
 
@@ -135,8 +135,8 @@ agent-infra-internal task-artifact {task-id} finalize-local --family plan --arti
 ```
 
 - On `status=passed`, save that result's `artifactSha256` and `semanticDigest`; the finalizer has recorded the matching one-shot local provenance intent.
-- On `status=failed` with recovery context, after the completion gates pass, edit the returned `candidatePath` only once for this attempt, then rerun the finalizer completely with the same `recoveryId`; if it still fails with a new diagnostic and fingerprint while the gates continue to pass, continue to the next attempt; the formal artifact must remain unchanged until commit.
-- The recovery candidate must match the recorded task, round, artifact, baseline, and request identity. On baseline conflict, unknown state, an unsafe repair, repeated diagnostics or fingerprints, no progress, or the shared edit limit, stop without publishing a completed event.
+- On `status=failed`, correct the formal artifact directly and rerun the finalizer completely; if the current diagnostic remains unresolved, continue to the next attempt.
+- On an external formal-artifact change, an unsafe repair, repeated diagnostics or fingerprints, no progress, or the shared edit limit, stop without publishing a completed event.
 
 Use the digests from that same `status=passed` result in `agent-infra-internal task-event {task-id} plan.completed --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code} --artifact {plan-artifact} --artifact-sha256 {artifact-sha256} --semantic-digest {semantic-digest} {execution-flag}` so the core records the link, stage, agent, metadata, and Activity Log atomically.
   - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Plan Task (Round {N})** by {agent} — Plan completed, awaiting human review → {artifact-filename}

package/templates/.agents/skills/plan-task/SKILL.zh-CN.md

@@ -117,7 +117,7 @@ agent-infra-internal task-event {task-id} plan.started --agent {standard-agent-t
 agent-infra-internal task-artifact {task-id} init --family plan --artifact {plan-artifact}
 ```
 
-骨架只包含身份元数据、稳定 section marker 和必需标题；必须填入真实方案内容后才能通过完成门禁。finalizer 返回可证明的单个结构错误时，会返回受控 recovery candidate；只能编辑返回的 `candidatePath`，然后使用同一个 `recoveryId` 重跑 `task-artifact {task-id} finalize-local --family plan --artifact {plan-artifact} --recovery-id {recovery-id}`。candidate-only 是协议授权边界，不是操作系统隔离；同 UID 的任意宿主写入者不在本协议的防护承诺内，异常由指纹/状态校验失败关闭。
+骨架只包含身份元数据、稳定 section marker 和必需标题；必须填入真实方案内容后才能通过完成门禁。finalizer 返回结构错误时，直接修正正式产物后重跑 `task-artifact {task-id} finalize-local --family plan --artifact {plan-artifact}`；当前结构、资格和摘要事实是唯一门禁。
 
 创建 `.agents/workspace/active/{task-id}/{plan-artifact}`。
 
@@ -134,8 +134,8 @@ agent-infra-internal task-artifact {task-id} init --family plan --artifact {plan
   agent-infra-internal task-artifact {task-id} finalize-local --family plan --artifact {plan-artifact}
   ```
   - `status=passed`：保存本次返回的 `artifactSha256` 和 `semanticDigest`；finalizer 已记录对应的一次性本地 provenance intent。
-  - `status=failed` 且返回 recovery context：完成门禁通过后，本次只编辑返回的 `candidatePath` 一次，然后使用同一个 `recoveryId` 完整重跑 finalizer；若仍失败但诊断和指纹均未重复且安全门继续通过，继续下一轮；formal artifact 在 commit 前必须保持不变。
-  - recovery candidate 必须与记录的任务、轮次、产物、baseline 和 request identity 匹配；基线冲突、未知状态、无法安全修复、诊断或指纹重复、无进展，或达到共享规则的编辑上限时停止，不发布 completed 事件。
+  - `status=failed`：直接修正正式产物并完整重跑 finalizer；若仍失败且诊断未解决，继续下一轮。
+  - 当前正式产物发生外部变化、无法安全修复、诊断或指纹重复、无进展，或达到共享规则的编辑上限时停止，不发布 completed 事件。
 - 使用同一次 `status=passed` 返回的摘要执行 `agent-infra-internal task-event {task-id} plan.completed --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code} --artifact {plan-artifact} --artifact-sha256 {artifact-sha256} --semantic-digest {semantic-digest} {execution-flag}`，由核心登记链接、阶段、代理、时间、版本和 Activity Log。
 
 如果 task.md 中存在有效的 `platform_issue_identity`，执行以下同步操作（任一失败则跳过并继续）：

package/templates/.agents/skills/review-analysis/SKILL.en.md

@@ -75,7 +75,7 @@ Before writing this round's `{review-artifact}`, create the controlled review sk
 agent-infra-internal task-artifact {task-id} init --family review-analysis --artifact {review-artifact} --locale en
 ```
 
-The skeleton contains identity metadata, stable section markers, and required headings only; complete review content is required before summary finalization. If structural finalization returns one provably safe error, it returns a controlled recovery candidate; edit only its `candidatePath`, then rerun the original finalizer with the same `recoveryId`. Candidate-only is a protocol authorization boundary, not OS isolation; arbitrary same-UID host writers are outside the protocol's protection claim, and fingerprint/state checks fail closed on anomalies.
+The skeleton contains identity metadata, stable section markers, and required headings only; complete review content is required before summary finalization. On a structural error, follow `.agents/rules/local-artifact-repair.md` to correct the formal review artifact directly and rerun the original finalizer; current artifact content is the only input.
 
 Create `.agents/workspace/active/{task-id}/{review-artifact}`.
 
@@ -83,7 +83,7 @@ Create `.agents/workspace/active/{task-id}/{review-artifact}`.
 
 ### 6. Update Task Status
 
-After the report, call `agent-infra-internal task-review {task-id} preflight --stage analysis --artifact {review-artifact} {execution-flag}` before any ledger write. On failure, follow `.agents/rules/local-artifact-repair.md`; on success, bind `{recovery-id}` from the response. Only after preflight passes, submit each new finding with `agent-infra-internal task-ledger {task-id} finding-upsert --stage analysis --review-artifact {review-artifact} --ordinal {n} --severity {blocker|major|minor} --evidence {review-artifact}#{anchor}` or prior-response dispositions with `finding-review --id {ledger-id} --status {confirmed|closed|open|needs-human-decision} --evidence {evidence}`. Do not scan ids or edit ledger rows. After all ledger writes, call `agent-infra-internal task-review {task-id} finalize-summary --stage analysis --artifact {review-artifact} --recovery-id {recovery-id} {execution-flag}`; never treat an error type or `changed=false` as automatic authorization.
+After the report, call `agent-infra-internal task-review {task-id} preflight --stage analysis --artifact {review-artifact} {execution-flag}` before any ledger write. On failure, correct the formal artifact directly and rerun it. Only after preflight passes, submit each new finding with `agent-infra-internal task-ledger {task-id} finding-upsert --stage analysis --review-artifact {review-artifact} --ordinal {n} --severity {blocker|major|minor} --evidence {review-artifact}#{anchor}` or prior-response dispositions with `finding-review --id {ledger-id} --status {confirmed|closed|open|needs-human-decision} --evidence {evidence}`. Do not scan ids or edit ledger rows. After all ledger writes, call `agent-infra-internal task-review {task-id} finalize-summary --stage analysis --artifact {review-artifact} {execution-flag}`; never treat an error type or `changed=false` as automatic authorization.
 
 Bind and reuse this structured mapping from that one response:
 

package/templates/.agents/skills/review-analysis/SKILL.zh-CN.md

@@ -78,7 +78,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 agent-infra-internal task-artifact {task-id} init --family review-analysis --artifact {review-artifact}
 ```
 
-骨架不生成审查结论、发现或计数；完成审查内容后才能进入 summary finalizer。结构 finalizer 返回可证明的单个错误时，会返回受控 recovery candidate；只能编辑返回的 `candidatePath`，然后使用同一个 `recoveryId` 重跑原 finalizer。candidate-only 是协议授权边界，不是操作系统隔离；同 UID 的任意宿主写入者不在本协议的防护承诺内，异常由指纹/状态校验失败关闭。
+骨架不生成审查结论、发现或计数；完成审查内容后才能进入 summary finalizer。结构错误时，遵循 `.agents/rules/local-artifact-repair.md` 直接修正正式审查产物并重跑原 finalizer；当前产物内容是唯一输入。
 
 创建 `.agents/workspace/active/{task-id}/{review-artifact}`。
 
@@ -86,7 +86,7 @@ agent-infra-internal task-artifact {task-id} init --family review-analysis --art
 
 ### 6. 更新任务状态
 
-报告完成后，先调用 `agent-infra-internal task-review {task-id} preflight --stage analysis --artifact {review-artifact} {execution-flag}`，不得先写入账本。失败后是否继续编辑并重跑，必须遵循 `.agents/rules/local-artifact-repair.md`；通过时从返回值绑定 `{recovery-id}`。只有 preflight 通过后，才逐条调用 `agent-infra-internal task-ledger {task-id} finding-upsert --stage analysis --review-artifact {review-artifact} --ordinal {n} --severity {blocker|major|minor} --evidence {review-artifact}#{anchor}`，或复核上一轮响应时调用 `finding-review --id {ledger-id} --status {confirmed|closed|open|needs-human-decision} --evidence {相称证据}`。不得扫描编号或手写账本行。全部账本写入完成后调用 `agent-infra-internal task-review {task-id} finalize-summary --stage analysis --artifact {review-artifact} --recovery-id {recovery-id} {execution-flag}`；不能把失败类型或 `changed=false` 当作自动授权。
+报告完成后，先调用 `agent-infra-internal task-review {task-id} preflight --stage analysis --artifact {review-artifact} {execution-flag}`，不得先写入账本。失败后直接修正正式产物并重跑；只有 preflight 通过后，才逐条调用 `agent-infra-internal task-ledger {task-id} finding-upsert --stage analysis --review-artifact {review-artifact} --ordinal {n} --severity {blocker|major|minor} --evidence {review-artifact}#{anchor}`，或复核上一轮响应时调用 `finding-review --id {ledger-id} --status {confirmed|closed|open|needs-human-decision} --evidence {相称证据}`。不得扫描编号或手写账本行。全部账本写入完成后调用 `agent-infra-internal task-review {task-id} finalize-summary --stage analysis --artifact {review-artifact} {execution-flag}`；不能把失败类型或 `changed=false` 当作自动授权。
 
 从该次返回值绑定并复用以下结构化映射：
 

package/templates/.agents/skills/review-code/SKILL.en.md

@@ -102,7 +102,7 @@ Before writing this round's `{review-artifact}`, create the controlled review sk
 agent-infra-internal task-artifact {task-id} init --family review-code --artifact {review-artifact} --locale en
 ```
 
-The skeleton does not generate a verdict, findings, or counts; complete review content is required before summary finalization. If structural finalization returns one provably safe error, it returns a controlled recovery candidate; edit only its `candidatePath`, then rerun the original finalizer with the same `recoveryId`. Candidate-only is a protocol authorization boundary, not OS isolation; arbitrary same-UID host writers are outside the protocol's protection claim, and fingerprint/state checks fail closed on anomalies.
+The skeleton does not generate a verdict, findings, or counts; complete review content is required before summary finalization. On a structural error, follow `.agents/rules/local-artifact-repair.md` to correct the formal review artifact directly and rerun the original finalizer; current artifact content is the only input.
 
 Create `.agents/workspace/active/{task-id}/{review-artifact}`.
 
@@ -111,9 +111,9 @@ Create `.agents/workspace/active/{task-id}/{review-artifact}`.
 ### 6. Update Task Status
 
 Update task.md:
-- After the report, call `agent-infra-internal task-review {task-id} preflight --stage code --artifact {review-artifact} {execution-flag}` before any ledger write. On failure, follow `.agents/rules/local-artifact-repair.md`; on success, bind `{recovery-id}` from the response.
+- After the report, call `agent-infra-internal task-review {task-id} preflight --stage code --artifact {review-artifact} {execution-flag}` before any ledger write. On failure, correct the formal artifact directly and rerun it.
 - Only after preflight passes, submit each new finding with `agent-infra-internal task-ledger {task-id} finding-upsert --stage code --review-artifact {review-artifact} --ordinal {n} --severity {blocker|major|minor} --evidence {review-artifact}#{anchor}`; submit prior-response dispositions with `finding-review --id {ledger-id} --status {confirmed|closed|open|needs-human-decision} --evidence {evidence}`. When escalating to `needs-human-decision`, append `--needs-implementation true|false` using the judgment recorded in the detail block. Do not scan ids or edit ledger rows
-- After all ledger writes, call `agent-infra-internal task-review {task-id} finalize-summary --stage code --artifact {review-artifact} --recovery-id {recovery-id} {execution-flag}`; never treat an error type or `changed=false` as automatic authorization
+- After all ledger writes, call `agent-infra-internal task-review {task-id} finalize-summary --stage code --artifact {review-artifact} {execution-flag}`; never treat an error type or `changed=false` as automatic authorization
 
   Bind and reuse this structured mapping from that one response:
 

package/templates/.agents/skills/review-code/SKILL.zh-CN.md

@@ -101,7 +101,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 agent-infra-internal task-artifact {task-id} init --family review-code --artifact {review-artifact}
 ```
 
-骨架不生成审查结论、发现或计数；完成审查内容后才能进入 summary finalizer。结构 finalizer 返回可证明的单个错误时，会返回受控 recovery candidate；只能编辑返回的 `candidatePath`，然后使用同一个 `recoveryId` 重跑原 finalizer。candidate-only 是协议授权边界，不是操作系统隔离；同 UID 的任意宿主写入者不在本协议的防护承诺内，异常由指纹/状态校验失败关闭。
+骨架不生成审查结论、发现或计数；完成审查内容后才能进入 summary finalizer。结构错误时，遵循 `.agents/rules/local-artifact-repair.md` 直接修正正式审查产物并重跑原 finalizer；当前产物内容是唯一输入。
 
 创建 `.agents/workspace/active/{task-id}/{review-artifact}`。
 
@@ -109,9 +109,9 @@ agent-infra-internal task-artifact {task-id} init --family review-code --artifac
 
 ### 6. 更新任务状态
 
-- 报告完成后，先调用 `agent-infra-internal task-review {task-id} preflight --stage code --artifact {review-artifact} {execution-flag}`，不得先写入账本。失败后是否继续编辑并重跑，必须遵循 `.agents/rules/local-artifact-repair.md`；通过时从返回值绑定 `{recovery-id}`。
+- 报告完成后，先调用 `agent-infra-internal task-review {task-id} preflight --stage code --artifact {review-artifact} {execution-flag}`，不得先写入账本。失败后直接修正正式产物并重跑。
 - 只有 preflight 通过后，新 finding 才逐条调用 `agent-infra-internal task-ledger {task-id} finding-upsert --stage code --review-artifact {review-artifact} --ordinal {n} --severity {blocker|major|minor} --evidence {review-artifact}#{anchor}`；复核上一轮响应时调用 `finding-review --id {ledger-id} --status {confirmed|closed|open|needs-human-decision} --evidence {相称证据}`。升级为 `needs-human-decision` 时，按详情块中的判断追加 `--needs-implementation true|false`。不得扫描编号或手写账本行
-- 全部账本写入完成后调用 `agent-infra-internal task-review {task-id} finalize-summary --stage code --artifact {review-artifact} --recovery-id {recovery-id} {execution-flag}`；不能把失败类型或 `changed=false` 当作自动授权
+- 全部账本写入完成后调用 `agent-infra-internal task-review {task-id} finalize-summary --stage code --artifact {review-artifact} {execution-flag}`；不能把失败类型或 `changed=false` 当作自动授权
 
   从该次返回值绑定并复用以下结构化映射：
 

package/templates/.agents/skills/review-plan/SKILL.en.md

@@ -75,7 +75,7 @@ Before writing this round's `{review-artifact}`, create the controlled review sk
 agent-infra-internal task-artifact {task-id} init --family review-plan --artifact {review-artifact} --locale en
 ```
 
-The skeleton contains identity metadata, stable section markers, and required headings only; complete review content is required before summary finalization. If structural finalization returns one provably safe error, it returns a controlled recovery candidate; edit only its `candidatePath`, then rerun the original finalizer with the same `recoveryId`. Candidate-only is a protocol authorization boundary, not OS isolation; arbitrary same-UID host writers are outside the protocol's protection claim, and fingerprint/state checks fail closed on anomalies.
+The skeleton contains identity metadata, stable section markers, and required headings only; complete review content is required before summary finalization. On a structural error, follow `.agents/rules/local-artifact-repair.md` to correct the formal review artifact directly and rerun the original finalizer; current artifact content is the only input.
 
 Create `.agents/workspace/active/{task-id}/{review-artifact}`.
 
@@ -83,7 +83,7 @@ Create `.agents/workspace/active/{task-id}/{review-artifact}`.
 
 ### 6. Update Task Status
 
-After the report, call `agent-infra-internal task-review {task-id} preflight --stage plan --artifact {review-artifact} {execution-flag}` before any ledger write. On failure, follow `.agents/rules/local-artifact-repair.md`; on success, bind `{recovery-id}` from the response. Only after preflight passes, submit each new finding with `agent-infra-internal task-ledger {task-id} finding-upsert --stage plan --review-artifact {review-artifact} --ordinal {n} --severity {blocker|major|minor} --evidence {review-artifact}#{anchor}` or prior-response dispositions with `finding-review --id {ledger-id} --status {confirmed|closed|open|needs-human-decision} --evidence {evidence}`. Do not scan ids or edit ledger rows. After all ledger writes, call `agent-infra-internal task-review {task-id} finalize-summary --stage plan --artifact {review-artifact} --recovery-id {recovery-id} {execution-flag}`; never treat an error type or `changed=false` as automatic authorization.
+After the report, call `agent-infra-internal task-review {task-id} preflight --stage plan --artifact {review-artifact} {execution-flag}` before any ledger write. On failure, correct the formal artifact directly and rerun it. Only after preflight passes, submit each new finding with `agent-infra-internal task-ledger {task-id} finding-upsert --stage plan --review-artifact {review-artifact} --ordinal {n} --severity {blocker|major|minor} --evidence {review-artifact}#{anchor}` or prior-response dispositions with `finding-review --id {ledger-id} --status {confirmed|closed|open|needs-human-decision} --evidence {evidence}`. Do not scan ids or edit ledger rows. After all ledger writes, call `agent-infra-internal task-review {task-id} finalize-summary --stage plan --artifact {review-artifact} {execution-flag}`; never treat an error type or `changed=false` as automatic authorization.
 
 Bind and reuse this structured mapping from that one response:
 

package/templates/.agents/skills/review-plan/SKILL.zh-CN.md

@@ -78,7 +78,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 agent-infra-internal task-artifact {task-id} init --family review-plan --artifact {review-artifact}
 ```
 
-骨架不生成审查结论、发现或计数；完成审查内容后才能进入 summary finalizer。结构 finalizer 返回可证明的单个错误时，会返回受控 recovery candidate；只能编辑返回的 `candidatePath`，然后使用同一个 `recoveryId` 重跑原 finalizer。candidate-only 是协议授权边界，不是操作系统隔离；同 UID 的任意宿主写入者不在本协议的防护承诺内，异常由指纹/状态校验失败关闭。
+骨架不生成审查结论、发现或计数；完成审查内容后才能进入 summary finalizer。结构错误时，遵循 `.agents/rules/local-artifact-repair.md` 直接修正正式审查产物并重跑原 finalizer；当前产物内容是唯一输入。
 
 创建 `.agents/workspace/active/{task-id}/{review-artifact}`。
 
@@ -86,7 +86,7 @@ agent-infra-internal task-artifact {task-id} init --family review-plan --artifac
 
 ### 6. 更新任务状态
 
-报告完成后，先调用 `agent-infra-internal task-review {task-id} preflight --stage plan --artifact {review-artifact} {execution-flag}`，不得先写入账本。失败后是否继续编辑并重跑，必须遵循 `.agents/rules/local-artifact-repair.md`；通过时从返回值绑定 `{recovery-id}`。只有 preflight 通过后，才逐条调用 `agent-infra-internal task-ledger {task-id} finding-upsert --stage plan --review-artifact {review-artifact} --ordinal {n} --severity {blocker|major|minor} --evidence {review-artifact}#{anchor}`，或复核上一轮响应时调用 `finding-review --id {ledger-id} --status {confirmed|closed|open|needs-human-decision} --evidence {相称证据}`。不得扫描编号或手写账本行。全部账本写入完成后调用 `agent-infra-internal task-review {task-id} finalize-summary --stage plan --artifact {review-artifact} --recovery-id {recovery-id} {execution-flag}`；不能把失败类型或 `changed=false` 当作自动授权。
+报告完成后，先调用 `agent-infra-internal task-review {task-id} preflight --stage plan --artifact {review-artifact} {execution-flag}`，不得先写入账本。失败后直接修正正式产物并重跑；只有 preflight 通过后，才逐条调用 `agent-infra-internal task-ledger {task-id} finding-upsert --stage plan --review-artifact {review-artifact} --ordinal {n} --severity {blocker|major|minor} --evidence {review-artifact}#{anchor}`，或复核上一轮响应时调用 `finding-review --id {ledger-id} --status {confirmed|closed|open|needs-human-decision} --evidence {相称证据}`。不得扫描编号或手写账本行。全部账本写入完成后调用 `agent-infra-internal task-review {task-id} finalize-summary --stage plan --artifact {review-artifact} {execution-flag}`；不能把失败类型或 `changed=false` 当作自动授权。
 
 从该次返回值绑定并复用以下结构化映射：
 

package/templates/.agents/skills/run-task/SKILL.en.md

@@ -1,7 +1,7 @@
 ---
 name: run-task
 description: >
-  Orchestrate lifecycle stages from the task's current state with fresh executors/reviewers and one-use provenance receipts.
+  Orchestrate lifecycle stages from the task's current state with fresh executors/reviewers and recorded execution results.
   Use when one entry should advance an existing task until a safe commit or stable pause.
 ---
 
@@ -14,13 +14,13 @@ The entry point may omit the task ref; explicit task scope accepts only `--task
 The orchestrator delegates only and never executes a stage skill itself. First read `.agents/rules/no-mid-flow-questions.md`, `.agents/rules/lifecycle-orchestration.md`, and `reference/host-validation.md`.
 
 1. Resolve the canonical task ID, current Agent Client, and optional atomic policy flags, then run `task-snapshot`. If one explicit role field is present, all four are required.
-2. Before `begin-or-resume`, Codex selects a host. Without `AGENT_INFRA_CONTROL_TOKEN`, use direct-host. With task-bound control authority but no `AGENT_INFRA_CODEX_CONTROLLER_CONTEXT`, only run `codex-sandbox-controller run` with the complete policy and wait; the outer loop must not create a run, baseline, or receipt. With a context, run `verify-context` first. Stop on protocol, task/controller/process, lease, or source/profile discovery failures. Package/build/contract or hook/profile content drift is delivered as a structured warning and tells the user to rebuild the sandbox.
+2. Use the current host's native child spawn, wait, and result interfaces. Task-bound sandboxes forward task operations through the existing broker; retain task binding and checks for real external process operations.
 3. Run `task-orchestration {task-id} begin-or-resume --client {client}` with the complete explicit policy. With no explicit policy, core reads that client's configured policy; existing runs use persisted policy. Disk state outside the complete current structure fails closed without rewriting; finish or clear active runs before upgrading. Stop on paused/completed results.
 4. Run `route`. On `completed`, run `agent-infra-internal task-verify {task-id} run-task.completed --format text` and stop. Only a `running` result with non-null `next` supplies action, role, round, artifact, requested model, and requested effort.
-5. Codex runs `codex-lifecycle capability-arm --task-id {task-id}` once. The current loop's real PostToolUse must attest that ordinary tool response. Pass its `capabilityRef` marker, the exact routed model, and the exact routed reasoning effort to `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort} --capability-ref {capabilityRef}`. Core accepts only the phase attestation issued by the current controller issuer: `orchestration.prepare` reserves the capability, then `artifact.finalize-local` and `task-event.completed` validate and consume their own phases; the underlying capability is terminally consumed only after the completed commit is confirmed. Without current controller proof, direct-host returns `LOCAL_EXECUTION_AUTHORITY_UNAVAILABLE` and creates no recovery intent, baseline, receipt, or child. Activation then verifies that spawn belongs to the same session and turn and uses a distinct tool-use. Other clients use the same prepare without authority. Failure creates no baseline, receipt, or child.
-6. After prepare, run `task-orchestration <task-ref> dispatch` immediately before calling the fresh native child, then use route's exact model/effort and only the short task ref, skill, `--orchestrated`, and stage identity. The trusted hook-spawn first-observation time must fall between dispatch and the deadline. Its first provenance-sensitive command must be `await-activation --stage ... --round ... --artifact ... --role ...`; before `running`, it must not snapshot, emit stage-started, or write business files. The code stage may create a local checkpoint only through code-task's durable intent core; it must not delegate a separate commit stage or push. Only explicit `recover-prepared` may clear an expired orphan when the task fingerprint is exact and no matching unconsumed active lifecycle evidence remains.
-7. Codex uses SubagentStart/Stop and App Server actual evidence to activate, consume, and seal one receipt; trusted parent fallback must produce the same complete provenance. Timed-out waits do nothing. Advance only a sealed receipt and repeat step 4 only while running.
-8. Create a fresh child each round and never follow up with an old reviewer. Each requested/actual mismatch needs its own host fallback reason. Protocol, capability, receipt hook/evidence binding, source, controller, identity, ledger, or fingerprint failure pauses and fails closed; cross-root package/build/contract or hook/profile content drift is delivered as a warning instead of blocking natural evolution.
+5. Call `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort}` with route's exact policy. Codex runs current host preflight. Report actual task, policy, or host failures.
+6. After prepare, run `task-orchestration <task-ref> dispatch` before spawning a fresh native child with route's model/effort. Pass the short task ref, skill, `--orchestrated`, and stage identity. The child calls `await-activation --stage ... --round ... --artifact ... --role ...` to associate its actual identity before executing. Code-task creates the local checkpoint; do not delegate a separate commit stage or push. Retain existing write locks without introducing a new lock protocol around native spawn.
+7. Record actual start and terminal results through SubagentStart/Stop or parent spawn/wait and App Server observations. A timed-out wait does not imply success. Pause on actual identity, transport, or terminal failures. After the stage and child finish, call `advance`; repeat step 4 only while running.
+8. Create a fresh child each round and never reuse a reviewer. Record actual model/effort and host fallback reasons. Validate current identity, artifacts, ledger, and execution results. User rulings override derived historical plan requirements. Do not introduce child discovery, orphan recovery, or a dedicated recovery protocol.
 9. On pause or completion, run the matching typed verification and report the structured endpoint.
 
 ## Stop