@fitlab-ai/agent-infra 0.11.2 → 0.11.3

package/templates/.agents/skills/complete-manual-validation/SKILL.zh-CN.md

@@ -21,7 +21,7 @@ description: >
 - 本技能用于收尾已有 PR 摘要评论中的人工校验状态，不创建并行的普通验证留言。
 - 必须写入 `manual-validation.md` 或 `manual-validation-r{N}.md`，让后续 PR 摘要刷新可复用人工验证结果。
 - 找不到 `sync-pr` 摘要评论时失败，不创建部分摘要兜底；receipt、通过日志和 final summary 未全部提交前，远端只允许 pending/non-pass 状态。
-- 生成会同步到 Issue 的人工验证 artifact Markdown 前，先读取 `.agents/rules/sync-content-generation.md` 并遵循其中的生成端约束；Issue 同步保持透明，不解析或改写正文。
+- 生成会由 task 评论和 PR 摘要引用的人工验证 artifact Markdown 前，先读取 `.agents/rules/sync-content-generation.md` 并遵循其中的生成端约束；人工验证 artifact 保留在本地，不发布为 Issue artifact 评论。
 - 执行本技能后必须立即更新 `task.md`。
 
 版本戳规则：创建或更新 `task.md` frontmatter 时，先读取 `.agents/rules/version-stamp.md`，并写入或刷新 `agent_infra_version`。
@@ -106,7 +106,7 @@ coordinator 负责 pending summary、receipt、通过日志、final promotion
 
 transaction coordinator 成功后，核心已使用同一 transaction/receipt/head identity 原子登记 `manual-validation.completed`；不要手工补写 Activity Log。
 
-如任务存在有效 `platform_issue_identity`，调用 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`，再调用 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {manual-validation-artifact} --agent {standard-agent-token}`。
+如任务存在有效 `platform_issue_identity`，仅调用 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`。人工验证 artifact 继续作为本地证据和 PR 摘要输入，不发布为 Issue 评论。
 
 ### 8. 完成校验
 

package/templates/.agents/skills/complete-task/SKILL.en.md

@@ -59,7 +59,7 @@ If not found in `active/`, check `blocked/` and `completed/`:
 - If in `completed/` without a matching entry: report the incomplete terminal identity and stop without hand-repairing it
 - If in `blocked/`: Inform user the task is blocked; suggest unblocking first
 
-Scenario A is the normal active-task path. Scenario B `finalization-retry` retries only the archived task comment and terminal gate.
+Scenario A is the normal active-task path. Scenario B `finalization-retry` retries allowed artifact backfill, the terminal task comment, completion verification, and summary sealing without moving lifecycle backward.
 
 ### 2. Verify Completion Prerequisites (Failure Must Stop)
 
@@ -141,9 +141,8 @@ Check whether task.md has a valid `platform_issue_identity`. If it does not, ski
 
 When a valid `platform_issue_identity` exists, execute in this exact order:
 
-1. Run `agent-infra-internal platform-comment backfill {task-id} --agent {standard-agent-token}` so core publishes only the completion canonical inventory in fixed order and resolves matching historical warnings only after full success.
-2. Run `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --requirements --fields`.
-3. Write the business summary to a temporary file and run `agent-infra-internal platform-comment stage-summary {task-id} --body-file {path}`. This stores the body and SHA-256 in the task's durable staging record; it must not publish the summary comment directly.
+1. Run `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --requirements --fields`.
+2. Write the business summary to a temporary file and run `agent-infra-internal platform-comment stage-summary {task-id} --body-file {path}`. This stores the body and SHA-256 in the task's durable staging record; it must not publish the summary comment directly.
 
 When the ledger contains a valid `PRC-N` post-review exemption, the summary body must mirror the ruling reason, commit scope, human identity, and time from task.md, and state that this is a human override rather than an automatic verification success. If a matching workflow warning exists, also mirror its original failure code/message. If no warning exists yet, state only that the ruling is recorded and final gate verification is pending; do not claim that the exemption has passed. The same `--kind summary` intent remains the sole owner of the summary marker.
 
@@ -152,7 +151,7 @@ Do not sync the task comment here; it requires the terminal task.md written by l
 If any operation fails, the task must remain active and its short id must remain valid. Record the failure with the matching structured warning intent, then continue to Step 5. Platform failures do not block the local lifecycle:
 
 ```bash
-agent-infra-internal task-warning {task-id} add --step complete-task --severity ACTION_REQUIRED --code {COMMENT_SYNC_FAILED|REQUIREMENTS_SYNC_FAILED|SUMMARY_SYNC_FAILED|NETWORK_RETRY_EXHAUSTED} --target {artifact|issue|summary|platform} --message "{error_code}: {error_message}" --action "Fix the platform sync problem and rerun complete-task"
+agent-infra-internal task-warning {task-id} add --step complete-task --severity ACTION_REQUIRED --code {REQUIREMENTS_SYNC_FAILED|SUMMARY_SYNC_FAILED|NETWORK_RETRY_EXHAUSTED} --target {issue|summary|platform} --message "{error_code}: {error_message}" --action "Fix the platform sync problem and rerun complete-task"
 ```
 
 The core deduplicates the stable `step/code/target` tuple. Callers must not allocate warning ids or edit ledger rows.
@@ -177,11 +176,11 @@ If a summary must mirror a human-decided `post-review-commit` exemption, make a
 agent-infra-internal task-finalization {task-id} complete --agent {standard-agent-token}
 ```
 
-Finalization runs lifecycle -> terminal task comment -> core verification -> warning task-comment update -> summary -> post-summary verification in a fixed order and records every step in the host receipt. It clears the staging record only after all steps finish with no open warning. `result=completed` means the host safely completed the task from structured results and the receipt; if peripheral warnings remain, return `result=completed_with_warnings`, warnings, and pending steps. Use `result=failed` or `result=blocked` only for hard or receipt/capability failures, then fix the cause and retry through the same entry point; do not claim completion or hand-repair partial state. A sandbox must not run `ls completed` or a local terminal verification against its historical mount to re-decide this result.
+Finalization runs allowed artifact backfill -> lifecycle -> terminal task comment -> core verification -> warning task-comment update -> summary seal in a fixed order. Every backfill must reach a successful terminal result before lifecycle starts. Summary seal always reads the durable staging record retained in the task directory; the platform entry point validates marker, owner, and digest, performs any required delete/recreate, and reads back final remote order. Re-entry repeats this idempotent operation instead of recovering local input from a remote comment. `result=completed` means the host safely completed the task from structured results and the receipt; if peripheral warnings or pending steps remain, return `result=completed_with_warnings`, warnings, and pending steps. Use `result=failed` or `result=blocked` only for hard or receipt/capability failures, then fix the cause and retry through the same entry point; do not claim completion or hand-repair partial state. A sandbox must not run `ls completed` or a local terminal verification against its historical mount to re-decide this result.
 
 ### 7. Handle Finalization Retries and Results
 
-Both Scenario A and Scenario B `finalization-retry` run the same `task-finalization` entry point from the host. The receipt is only a re-entry hint, not canonical truth: every re-entry revalidates the terminal task comment and completion gate; only an already `completed` task with its short-id registry entry released may skip the irreversible lifecycle. Do not split the operation into the former lifecycle, comment-sync, or completion-gate commands. If the task comment or gate is blocked by the network, preserve the receipt and completed steps, fix the network, and rerun complete-task. If lifecycle has not completed, keep the task active and resume the pending steps from the receipt.
+Both Scenario A and Scenario B `finalization-retry` run the same `task-finalization` entry point from the host. The receipt is only a re-entry hint, not canonical truth: every re-entry revalidates allowed artifact backfill, the terminal task comment, and completion verification, then repeats summary seal from the retained durable staging record; only an already `completed` task with its short-id registry entry released may skip the irreversible lifecycle. Do not split the operation into the former lifecycle, comment-sync, or completion-gate commands. If backfill, the task comment, summary seal, or verification is blocked by the network, preserve the receipt, durable staging record, and completed steps, fix the network, and rerun complete-task. If lifecycle has not completed, keep the task active and resume the pending steps from the receipt.
 
 Consume the structured finalization result, receipt, and warning projection directly. Continue only for `completed` or `completed_with_warnings`; preserve the receipt and stop for `failed`, `blocked`, or `unknown`, then retry through the same finalization entry point. Do not run `ls completed` or `task-verify complete-task.completed` from a stale sandbox mount, and do not let that local result overrule the host result.
 

package/templates/.agents/skills/complete-task/SKILL.zh-CN.md

@@ -58,7 +58,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 - 如果在 `completed/` 但缺少匹配日志：告知用户任务已完成但终态身份不完整并停止，不手工修补
 - 如果在 `blocked/`：告知用户任务被阻塞；建议先解除阻塞
 
-场景 A 为 active 任务的正常完成路径；场景 B `finalization-retry` 只重试归档后的 task 评论与终态门禁。
+场景 A 为 active 任务的正常完成路径；场景 B `finalization-retry` 重试允许的 artifact 回填、终态 task 评论、完成校验和摘要封口，不回迁生命周期。
 
 ### 2. 验证完成前置条件（未满足则必须停止）
 
@@ -140,9 +140,8 @@ Please satisfy the hard prerequisite first, then retry complete-task.
 
 如果存在有效的 `platform_issue_identity`，严格按以下顺序执行：
 
-1. 调用 `agent-infra-internal platform-comment backfill {task-id} --agent {standard-agent-token}`，由 core 仅按 completion canonical inventory 固定顺序补发产物并在全部成功后精确恢复目标历史告警。
-2. 调用 `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --requirements --fields`。
-3. 把业务摘要写入临时文件，并调用 `agent-infra-internal platform-comment stage-summary {task-id} --body-file {path}`。该命令把正文和 SHA-256 写入 task 目录的 durable staging record；本步骤不得直接发布 summary 评论。
+1. 调用 `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --requirements --fields`。
+2. 把业务摘要写入临时文件，并调用 `agent-infra-internal platform-comment stage-summary {task-id} --body-file {path}`。该命令把正文和 SHA-256 写入 task 目录的 durable staging record；本步骤不得直接发布 summary 评论。
 
 若账本含合法的 `PRC-N` post-review 豁免，摘要正文必须镜像 task.md 中的裁决理由、提交范围、人工身份与时间，并明确这是人工覆盖而非自动校验成功。已有匹配 workflow warning 时，同时镜像其原始 failure code/message；尚无 warning 时只写“裁决已记录、最终门禁待验证”，不得提前宣称豁免已通过。summary marker 仍由同一 `--kind summary` intent 唯一维护。
 
@@ -151,7 +150,7 @@ Please satisfy the hard prerequisite first, then retry complete-task.
 任一操作失败时，任务仍必须位于 active 且短号仍有效；按失败类型调用以下结构化 warning intent，随后继续步骤 5。平台失败不会阻止本地生命周期。
 
 ```bash
-agent-infra-internal task-warning {task-id} add --step complete-task --severity ACTION_REQUIRED --code {COMMENT_SYNC_FAILED|REQUIREMENTS_SYNC_FAILED|SUMMARY_SYNC_FAILED|NETWORK_RETRY_EXHAUSTED} --target {artifact|issue|summary|platform} --message "{error_code}: {error_message}" --action "修复平台同步问题后重跑 complete-task"
+agent-infra-internal task-warning {task-id} add --step complete-task --severity ACTION_REQUIRED --code {REQUIREMENTS_SYNC_FAILED|SUMMARY_SYNC_FAILED|NETWORK_RETRY_EXHAUSTED} --target {issue|summary|platform} --message "{error_code}: {error_message}" --action "修复平台同步问题后重跑 complete-task"
 ```
 
 相同 `step/code/target` 组合由核心幂等去重；调用方不分配 warning id 或手写账本行。
@@ -176,11 +175,11 @@ agent-infra-internal task-verify {task-id} complete-task.preflight --format text
 agent-infra-internal task-finalization {task-id} complete --agent {standard-agent-token}
 ```
 
-finalization 按 lifecycle → task 评论 → core verification → warning task 评论更新 → summary → post-summary verification 的固定顺序执行，并将每一步的状态写入宿主 receipt。summary 使用暂存正文；仅在所有步骤完成且无未解决 warning 后清理 staging record。`result=completed` 即表示宿主已依据结构化结果和 receipt 安全完成；若还有外围 warning，返回 `result=completed_with_warnings`、warnings 和 pending steps。`result=failed` 或 `result=blocked` 仅用于硬失败或 receipt/capability 失败，修复原因后以同一入口重试，不得宣称完成或手工补写局部状态。沙箱不得从旧挂载执行 `ls completed` 或本地终态校验来重新裁决该结果。
+finalization 按允许的 artifact backfill → lifecycle → task 评论 → core verification → warning task 评论更新 → summary seal 的固定顺序执行。每项 backfill 必须取得成功终态，否则不得进入 lifecycle。summary seal 始终读取任务目录中保留的 durable staging record；平台入口负责校验 marker、owner 和 digest，必要时删除并重建摘要，再复读最终远端顺序。重入直接重复该幂等操作，不从远端评论反向恢复本地正文。`result=completed` 即表示宿主已依据结构化结果和 receipt 安全完成；若还有外围 warning 或 pending step，返回 `result=completed_with_warnings`、warnings 和 pending steps。`result=failed` 或 `result=blocked` 仅用于硬失败或 receipt/capability 失败，修复原因后以同一入口重试，不得宣称完成或手工补写局部状态。沙箱不得从旧挂载执行 `ls completed` 或本地终态校验来重新裁决该结果。
 
 ### 7. 处理 finalization 重试与结果
 
-场景 A 与场景 B `finalization-retry` 都从宿主执行同一个 `task-finalization` 入口。receipt 只是重入提示，不是 canonical truth：每次重入都要重新验证终态 task 评论和完成校验；只有任务已处于 `completed` 且短号 registry 已释放时，才可跳过不可逆的 lifecycle。不得拆开调用旧的 lifecycle、评论同步或完成校验命令。若 task 评论或校验因网络问题返回 `blocked`，保留 receipt 和已完成状态，修复网络后重跑 complete-task；若生命周期仍未完成，任务保持 active 并从 receipt 的待处理步骤继续。
+场景 A 与场景 B `finalization-retry` 都从宿主执行同一个 `task-finalization` 入口。receipt 只是重入提示，不是 canonical truth：每次重入都要重新核对允许的 artifact 回填、终态 task 评论、完成校验，并使用保留的 durable staging record 重做 summary seal；只有任务已处于 `completed` 且短号 registry 已释放时，才可跳过不可逆的 lifecycle。不得拆开调用旧的 lifecycle、评论同步或完成校验命令。若回填、task 评论、summary seal 或校验因网络问题返回 `blocked`，保留 receipt、durable staging record 和已完成状态，修复网络后重跑 complete-task；若生命周期仍未完成，任务保持 active 并从 receipt 的待处理步骤继续。
 
 完成结果必须直接消费本次宿主 finalization 的结构化输出、receipt 和 warning projection。`completed` 或 `completed_with_warnings` 才允许继续；`failed` / `blocked` / `unknown` 必须保留 receipt 并停止，之后通过同一 finalization 入口重试。不要在沙箱旧挂载中另行运行 `ls completed` 或 `task-verify complete-task.completed`，也不要用其结果推翻宿主结果。
 

package/templates/.agents/skills/run-manual-validation/SKILL.en.md

@@ -26,7 +26,7 @@ Before generating a validation report, read `.agents/rules/evidence-reporting.md
 - `complete-manual-validation` remains the maintainer's final registration after coverage is judged sufficient.
 - Never manipulate temporary worktrees, leases, or containers directly; only call `agent-infra-internal task-validate`.
 - Never record tokens, environment variables, full argv, absolute user paths, or raw transcripts in the artifact; the core must write one current-only evidence envelope for each validation target.
-- Before generating a validation artifact Markdown file that will be synced to an Issue, read `.agents/rules/sync-content-generation.md` and follow its generator-side constraints; Issue sync remains transparent and does not parse or rewrite the body.
+- Before generating validation artifact Markdown referenced by the task comment, read `.agents/rules/sync-content-generation.md` and follow its generator-side constraints. Keep the validation artifact local instead of publishing it as an Issue artifact comment.
 - The branch-only fallback writes to `.agents/workspace/validations/{branch-slug}/` and is marked `recoverable: false`: no task.md write-back, no lifecycle events, no Issue sync, no `task-verify`; the artifact must be carried back to the host that owns the task workspace for registration.
 
 ## Step 0: State Check (pre-execution hard gate)
@@ -46,7 +46,7 @@ Branch-only has no `{task-id}`: skip this step and record `not-applicable (branc
 3. Take the round and artifact name from the core result. After confirming valid explicit work or a non-empty discovered list, run `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code}` and classify each item as `executable|unavailable|unknown|unsafe|unresolved`.
 4. Allocate an `{evidence-file}` for each validation target and invoke every executable item separately with `agent-infra-internal task-validate {task-ref} --scope snapshot --format json --evidence-file {evidence-file} -- {command...}`. Only make a second explicit inplace invocation for that item when evidence proves it is required, using its evidence file. If no item is executable, run no fabricated command but still produce coverage-gap evidence.
 5. Read `reference/report-template.md`, create `validation-run.md|validation-run-r{N}.md`, and record the input mode, discovered list, per-item results, CLI JSON allowlist, and sanitized summaries.
-6. Run `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code} --artifact {artifact}`. When an Issue exists, run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}` and then `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {standard-agent-token}`.
+6. Run `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code} --artifact {artifact}`. When an Issue exists, run only `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`; do not publish the validation artifact as an Issue comment.
 7. Run `agent-infra-internal task-verify {task-id} validation-run.completed --artifact {artifact} --format text`; fix failures and rerun it.
 8. Report the evidence path, coverage gaps, and verification result; explicitly leave the decision to run `complete-manual-validation` to the maintainer. Read `.agents/rules/next-step-output.md` and end with `Completed at`.
 

package/templates/.agents/skills/run-manual-validation/SKILL.zh-CN.md

@@ -26,7 +26,7 @@ description: >
 - `complete-manual-validation` 仍是维护者确认覆盖充分后的最终登记入口。
 - 禁止直接操作临时 worktree、lease 或 container；只调用 `agent-infra-internal task-validate`。
 - 产物不得记录 token、环境变量、完整 argv、绝对用户路径或原始 transcript；每个验证目标必须由核心写入同一 current-only evidence envelope。
-- 生成会同步到 Issue 的验证 artifact Markdown 前，先读取 `.agents/rules/sync-content-generation.md` 并遵循其中的生成端约束；Issue 同步保持透明，不解析或改写正文。
+- 生成会由 task 评论引用的验证 artifact Markdown 前，先读取 `.agents/rules/sync-content-generation.md` 并遵循其中的生成端约束；验证 artifact 保留在本地，不发布为 Issue artifact 评论。
 - branch-only 降级路径走 `.agents/workspace/validations/{branch-slug}/`，标记 `recoverable: false`：不写 task.md、不发 lifecycle 事件、不同步 Issue、不跑 `task-verify`；产物须带回宿主机，由维护者登记。
 
 ## 第 0 步：状态核对（执行前硬约束）
@@ -46,7 +46,7 @@ branch-only 无 `{task-id}`，跳过本步，并在产物 `## 状态核对` 记
 3. 从核心结果取得轮次和产物名；确认存在有效显式工作或非空发现清单后，运行 `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code}`，并逐项分类为 `executable|unavailable|unknown|unsafe|unresolved`。
 4. 为每个验证目标分配 `{evidence-file}`，分别调用 `agent-infra-internal task-validate {task-ref} --scope snapshot --format json --evidence-file {evidence-file} -- {command...}`；只有证据表明必须原位时才对该项进行第二次显式 inplace 调用并写入对应 evidence 文件。零项可执行时不运行伪造命令，但仍继续产出覆盖缺口证据。
 5. 读取 `reference/report-template.md`，创建 `validation-run.md|validation-run-r{N}.md`；记录输入模式、发现清单、逐项结果、CLI JSON allowlist 与去敏摘要。
-6. 运行 `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code} --artifact {artifact}`。存在 Issue 时依次运行 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}` 和 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {standard-agent-token}`。
+6. 运行 `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code} --artifact {artifact}`。存在 Issue 时仅运行 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`；验证 artifact 不发布为 Issue 评论。
 7. 运行 `agent-infra-internal task-verify {task-id} validation-run.completed --artifact {artifact} --format text`；未通过则修复后重跑。
 8. 告知用户证据路径、覆盖缺口和验证结果；明确仍需维护者判断是否执行 `complete-manual-validation`。读取 `.agents/rules/next-step-output.md`，最后一行输出 `Completed at`。
 

package/templates/.agents/skills/run-task/SKILL.en.md

@@ -14,14 +14,15 @@ The entry point may omit the task ref; explicit task scope accepts only `--task
 The orchestrator delegates only and never executes a stage skill itself. First read `.agents/rules/no-mid-flow-questions.md`, `.agents/rules/lifecycle-orchestration.md`, and `reference/host-validation.md`.
 
 1. Resolve the canonical task ID, current Agent Client, and optional atomic policy flags, then run `task-snapshot`. If one explicit role field is present, all four are required.
-2. Use the current host's native child spawn, wait, and result interfaces. Task-bound sandboxes forward task operations through the existing broker; retain task binding and checks for real external process operations.
-3. Run `task-orchestration {task-id} begin-or-resume --client {client}` with the complete explicit policy. With no explicit policy, core reads that client's configured policy; existing runs use persisted policy. Disk state outside the complete current structure fails closed without rewriting; finish or clear active runs before upgrading. Stop on paused/completed results.
-4. Run `route`. On `completed`, run `agent-infra-internal task-verify {task-id} run-task.completed --format text` and stop. Only a `running` result with non-null `next` supplies action, role, round, artifact, requested model, and requested effort.
-5. Call `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort}` with route's exact policy. Codex runs current host preflight. Report actual task, policy, or host failures.
-6. After prepare, run `task-orchestration <task-ref> dispatch` before spawning a fresh native child with route's model/effort. Pass the short task ref, skill, `--orchestrated`, and stage identity. The child calls `await-activation --stage ... --round ... --artifact ... --role ...` to associate its actual identity before executing. Code-task creates the local checkpoint; do not delegate a separate commit stage or push. Retain existing write locks without introducing a new lock protocol around native spawn.
-7. Record actual start and terminal results through SubagentStart/Stop or parent spawn/wait and App Server observations. A timed-out wait does not imply success. Pause on actual identity, transport, or terminal failures. After the stage and child finish, call `advance`; repeat step 4 only while running.
-8. Create a fresh child each round and never reuse a reviewer. Record actual model/effort and host fallback reasons. Validate current identity, artifacts, ledger, and execution results. User rulings override derived historical plan requirements. Do not introduce child discovery, orphan recovery, or a dedicated recovery protocol.
-9. On pause or completion, run the matching typed verification and report the structured endpoint.
+2. Use the current host's native child spawn, wait, and result interfaces. Task-bound sandboxes execute ordinary task orchestration locally in the current worktree; Codex controller `open`, `verify`, and `close` remain restricted broker operations. Retain task binding and checks for real external process operations.
+3. Before each loop, run `agent-infra-internal task-lifecycle {task-id} recover-started --agent {client} --auto`. The client adapter owns recovery capability and stop-evidence validation; an unsupported adapter or a run that needs no recovery returns `no-op`. Continue only after `no-op` or `applied`. Stop on every other result; a later operator invocation retries from persisted state without routing or dispatching a child.
+4. Run `task-orchestration {task-id} begin-or-resume --client {client}` with the complete explicit policy. With no explicit policy, core reads that client's configured policy; existing runs use persisted policy. Disk state outside the complete current structure fails closed without rewriting; finish or clear active runs before upgrading. Stop on paused/completed results.
+5. Run `route`. On `completed`, run `agent-infra-internal task-verify {task-id} run-task.completed --format text` and stop. Only a `running` result with non-null `next` supplies action, role, round, artifact, requested model, and requested effort.
+6. Call `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort}` with route's exact policy. The client adapter runs host preflight. Report actual task, policy, or host failures.
+7. After prepare, run `task-orchestration <task-ref> dispatch` before spawning a fresh native child with route's model/effort. Pass the short task ref, skill, `--orchestrated`, and stage identity. The child calls `await-activation --stage ... --round ... --artifact ... --role ...` to associate its actual identity before executing. Code-task creates the local checkpoint; do not delegate a separate commit stage or push. Retain existing write locks without introducing a new lock protocol around native spawn.
+8. Record actual start and terminal results through the current host's native lifecycle events and result interfaces. A timed-out wait does not imply success. Pause on actual identity, transport, or terminal failures. After the stage and child finish, call `advance`; repeat step 3 only while running.
+9. Create a fresh child each round and never reuse a reviewer. Record actual model/effort and host fallback reasons. Validate current identity, artifacts, ledger, and execution results. User rulings override derived historical plan requirements. Do not introduce child discovery, orphan recovery, or a dedicated recovery protocol.
+10. On pause or completion, run the matching typed verification and report the structured endpoint.
 
 ## Stop
 

package/templates/.agents/skills/run-task/SKILL.zh-CN.md

@@ -14,14 +14,15 @@ description: >
 总控只编排，不直接执行任何阶段技能。执行前先读取 `.agents/rules/no-mid-flow-questions.md`、`.agents/rules/lifecycle-orchestration.md` 与 `reference/host-validation.md`。
 
 1. 解析规范任务 ID、当前 Agent Client，以及可选的原子策略 `--executor-model`、`--executor-reasoning-effort`、`--reviewer-model`、`--reviewer-reasoning-effort`，并执行 `agent-infra-internal task-snapshot {task-id} --format text`。任一显式策略字段出现时四个 role 字段必须完整，不得与配置拼接；两个角色可以使用同一模型。
-2. 使用当前宿主的原生子 Agent 启动、等待与结果接口。task-bound sandbox 通过现有 broker 转发任务操作；保留任务绑定与真实外部进程操作检查。
-3. 调用 `agent-infra-internal task-orchestration {task-id} begin-or-resume --client {client}` 并转发完整显式策略。完全没有显式策略时由核心读取当前 client 的 `agentClients[].orchestration`；existing run 使用持久化策略。磁盘状态不符合当前完整结构时核心失败关闭且不改写；升级前必须完成或清空 active run。仅当核心返回 `ORCHESTRATION_MODEL_POLICY_REQUIRED` 时，先用 `agent-client model-selection` 展示 complete/partial/interactive-only 来源，再一次收集完整策略；未回答则不创建 run。若为 paused/completed，按结构化结果停止。
-4. 调用 `route` 并读取结构化结果。若返回 `completed`，立即运行 `agent-infra-internal task-verify {task-id} run-task.completed --format text` 并停止；仅当返回 `running` 且 `next` 非空时读取唯一 action、role、round、artifact、`requestedModel` 和 `requestedReasoningEffort`，不得自行推断。
-5. 调用 `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort}`，使用 route 返回的精确策略。Codex 执行当前宿主 preflight；任务身份、策略或宿主检查失败时记录实际诊断。
-6. prepare 成功后，在调用 fresh 原生子 Agent 前执行 `task-orchestration <task-ref> dispatch`，显式指定 route 返回的 model/effort；传递短任务引用、skill 名、`--orchestrated` 与 stage/round/artifact/role。child 调用 `await-activation --stage ... --round ... --artifact ... --role ...`，确认当前阶段与实际 child 关联后执行。代码阶段通过 code-task 创建本地 checkpoint；禁止单独委派 commit 阶段或推送。保留已有写锁，不把实际 spawn 纳入新建锁协议。
-7. Codex 通过 SubagentStart/Stop 或 parent spawn/wait 与 App Server 记录实际启动及终态。timed-out wait 不推断成功；身份、传输或异常终态失败如实暂停。阶段结果和 child 完成后调用 `advance`；只有 `running` 才重复步骤 4。
-8. 每轮创建新 child；禁止 follow-up 复用 reviewer。如实记录 actual model/effort 及宿主降级理由。检查当前身份、产物、账本与实际执行结果；用户裁决优先于历史方案派生要求。不得新增 child discovery、孤立 child 恢复或专用恢复协议。
-9. 完成或暂停后运行对应 typed verification，并把结构化 run 摘要、暂停原因、commit 终点或 clean completion evidence 告知用户。
+2. 使用当前宿主的原生子 Agent 启动、等待与结果接口。task-bound sandbox 在当前 worktree 本地执行普通任务编排；Codex controller 的 `open`、`verify`、`close` 继续通过受限 broker 执行。保留任务绑定与真实外部进程操作检查。
+3. 每次进入循环时先调用 `agent-infra-internal task-lifecycle {task-id} recover-started --agent {client} --auto`。客户端适配器负责恢复能力和停止证据校验；没有该能力或无需恢复时返回 `no-op`。仅在结构化结果为 `no-op` 或 `applied` 时继续，其他结果安全停止；下一次人为调用按持久化状态幂等重试，不 route、不派发 child。
+4. 调用 `agent-infra-internal task-orchestration {task-id} begin-or-resume --client {client}` 并转发完整显式策略。完全没有显式策略时由核心读取当前 client 的 `agentClients[].orchestration`；existing run 使用持久化策略。磁盘状态不符合当前完整结构时核心失败关闭且不改写；升级前必须完成或清空 active run。仅当核心返回 `ORCHESTRATION_MODEL_POLICY_REQUIRED` 时，先用 `agent-client model-selection` 展示 complete/partial/interactive-only 来源，再一次收集完整策略；未回答则不创建 run。若为 paused/completed，按结构化结果停止。
+5. 调用 `route` 并读取结构化结果。若返回 `completed`，立即运行 `agent-infra-internal task-verify {task-id} run-task.completed --format text` 并停止；仅当返回 `running` 且 `next` 非空时读取唯一 action、role、round、artifact、`requestedModel` 和 `requestedReasoningEffort`，不得自行推断。
+6. 调用 `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort}`，使用 route 返回的精确策略。客户端适配器执行宿主 preflight；任务身份、策略或宿主检查失败时记录实际诊断。
+7. prepare 成功后，在调用 fresh 原生子 Agent 前执行 `task-orchestration <task-ref> dispatch`，显式指定 route 返回的 model/effort；传递短任务引用、skill 名、`--orchestrated` 与 stage/round/artifact/role。child 调用 `await-activation --stage ... --round ... --artifact ... --role ...`，确认当前阶段与实际 child 关联后执行。代码阶段通过 code-task 创建本地 checkpoint；禁止单独委派 commit 阶段或推送。保留已有写锁，不把实际 spawn 纳入新建锁协议。
+8. 通过当前宿主的原生生命周期事件和结果接口记录实际启动及终态。timed-out wait 不推断成功；身份、传输或异常终态失败如实暂停。阶段结果和 child 完成后调用 `advance`；只有 `running` 才重复步骤 3。
+9. 每轮创建新 child；禁止 follow-up 复用 reviewer。如实记录 actual model/effort 及宿主降级理由。检查当前身份、产物、账本与实际执行结果；用户裁决优先于历史方案派生要求。不得新增 child discovery、孤立 child 恢复或专用恢复协议。
+10. 完成或暂停后运行对应 typed verification，并把结构化 run 摘要、暂停原因、commit 终点或 clean completion evidence 告知用户。
 
 ## 停止
 

package/dist/lib/sandbox/control/task-workflow.js

@@ -1,74 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { readStableFile, SecureFileError, writeAtomicFile } from '../../task/secure-fs.js';
-import { TASK_WORKFLOW_COMMANDS, TASK_WORKFLOW_OPERATIONS } from '../../task/workflow-command.js';
-export function validateTaskWorkflowRequest(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
-    const request = value;
-    if (Object.keys(request).sort().join(',') !== 'args,generation,id,operation,taskId,version'
-        || request.version !== 1 || typeof request.id !== 'string' || !/^[a-f0-9-]{16,64}$/u.test(request.id)
-        || typeof request.taskId !== 'string' || !/^TASK-\d{8}-\d{6}$/u.test(request.taskId)
-        || typeof request.generation !== 'string' || !request.generation
-        || !Object.hasOwn(TASK_WORKFLOW_COMMANDS, request.operation)
-        || !Array.isArray(request.args) || request.args.length < 2 || request.args.length > 128
-        || !request.args.every((arg) => typeof arg === 'string' && !/[\r\n]/u.test(arg))
-        || request.args[0] !== request.taskId)
-        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
-    const [, selector] = TASK_WORKFLOW_COMMANDS[request.operation];
-    if (selector !== null && request.args[1] !== selector)
-        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
-    return request;
-}
-/** Preserve argv verbatim; the domain command owns option parsing and validation. */
-export function createTaskWorkflowRequest(command, args, taskId, generation) {
-    const operation = TASK_WORKFLOW_OPERATIONS.find((key) => {
-        const [name, selector] = TASK_WORKFLOW_COMMANDS[key];
-        return name === command && (selector === null || selector === args[1]);
-    });
-    if (!operation)
-        throw new Error('TASK_WORKFLOW_OPERATION_UNSUPPORTED');
-    return validateTaskWorkflowRequest({ version: 1, id: randomUUID(), taskId, generation, operation, args: [...args] });
-}
-export function canonicalArtifactName(value) {
-    return /^(?:analysis|plan|code|review-analysis|review-plan|review-code)(?:-r[1-9]\d*)?\.md$/u.test(value)
-        && path.basename(value) === value;
-}
-function assertTaskArtifactDirectory(directory) {
-    const resolved = path.resolve(directory);
-    let stat;
-    try {
-        stat = fs.lstatSync(resolved);
-    }
-    catch {
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'task directory is unavailable');
-    }
-    if (!stat.isDirectory() || stat.isSymbolicLink()) {
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'task directory must be a real directory');
-    }
-    return resolved;
-}
-export async function readTaskArtifact(taskDir, input) {
-    if (!canonicalArtifactName(input.artifact))
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact must be a canonical top-level basename');
-    const root = assertTaskArtifactDirectory(taskDir);
-    const candidate = path.join(root, input.artifact);
-    if (path.dirname(candidate) !== root)
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact escapes task directory');
-    const stable = await readStableFile(candidate, {
-        maxBytes: 1024 * 1024,
-        ...(input.expectedSha256 ? { expectedSha256: input.expectedSha256 } : {})
-    });
-    return { artifact: input.artifact, bytes: stable.bytes, sha256: stable.sha256 };
-}
-export async function writeTaskArtifact(taskDir, artifact) {
-    if (!canonicalArtifactName(artifact.artifact))
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact must be a canonical top-level basename');
-    const root = assertTaskArtifactDirectory(taskDir);
-    const target = path.join(root, artifact.artifact);
-    if (path.dirname(target) !== root)
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact escapes task directory');
-    await writeAtomicFile(target, artifact.bytes, 0o600, artifact.expectedSha256);
-}
-//# sourceMappingURL=task-workflow.js.map

package/dist/lib/sandbox/control/workflow-executor.js

@@ -1,142 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { TASK_WORKFLOW_COMMANDS } from '../../task/workflow-command.js';
-import { parseArtifactCommand, executeArtifactCommand } from '../../task/artifact-command.js';
-import { parseReviewCommand } from '../../task/review-command.js';
-import { prepareLocalArtifact, preflightLocalArtifact, commitLocalArtifactProvenance } from '../../task/local-artifact-finalization.js';
-import { prepareReviewSummaryCandidate, preflightReviewSummary } from '../../task/review-finalization.js';
-import { withTaskExecutionLock } from '../../task/task-execution-lock.js';
-import { dispatchWorkflowCommand } from '../../task/workflow-dispatch.js';
-import { assertSandboxTaskSource } from '../workspace-view.js';
-import { appendDiagnosticAudit } from './audit.js';
-import { readTaskArtifact } from './task-workflow.js';
-import { applyTaskEvent } from '../../task/events.js';
-import { parseTaskEventRequest } from '../../internal/task-event.js';
-function executionResult(result) {
-    return { exitCode: result.status === 'failed' || result.status === 'refused' ? 1 : 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
-}
-function replaceCurrentArtifactAtomically(file, content) {
-    const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
-    try {
-        fs.writeFileSync(temporary, content, { encoding: 'utf8', flag: 'wx' });
-        fs.renameSync(temporary, file);
-    }
-    finally {
-        try {
-            fs.unlinkSync(temporary);
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT')
-                throw error;
-        }
-    }
-}
-/** The broker already authorized this host executor; domain operations own validation. */
-export async function executeTaskWorkflow(manifest, request, lifecycleRecoveryAttestation = null, options = {}) {
-    let publicationCommitted = false;
-    let faultTriggered = false;
-    const fault = (window) => {
-        if (faultTriggered || options.faultWindow !== window)
-            return;
-        faultTriggered = true;
-        throw new Error(`TASK_WORKFLOW_FAULT_INJECTED:${window}`);
-    };
-    const response = (result) => {
-        fault('before-result-return');
-        return executionResult(result);
-    };
-    try {
-        fault('before-call');
-        const taskDir = assertSandboxTaskSource(manifest.repoRoot, request.taskId);
-        const [command] = TASK_WORKFLOW_COMMANDS[request.operation];
-        if (request.operation === 'event') {
-            const eventRequest = parseTaskEventRequest(request.args);
-            const boundEventRequest = lifecycleRecoveryAttestation && eventRequest.requestId === undefined
-                ? { ...eventRequest, requestId: lifecycleRecoveryAttestation.lifecycleRequestId }
-                : eventRequest;
-            fault('before-domain-write');
-            const result = applyTaskEvent(boundEventRequest, {
-                repoRoot: manifest.repoRoot,
-                lifecycleRecoveryAttestation,
-                deferLifecycleRecoveryConsumption: true
-            });
-            publicationCommitted = result.changed;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        if (command !== 'task-artifact' && command !== 'task-review') {
-            // The broker owns this short-lived executor; no global service or worker
-            // credential participates in the command's authority or recovery path.
-            fault('before-domain-write');
-            const result = dispatchWorkflowCommand(manifest.repoRoot, request.operation, request.args);
-            publicationCommitted = result.changed === true;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        const input = command === 'task-artifact' ? parseArtifactCommand(request.args) : parseReviewCommand(request.args);
-        if (command === 'task-artifact' && 'operation' in input && input.operation === 'inspect') {
-            fault('before-domain-write');
-            const result = executeArtifactCommand(input, { repoRoot: manifest.repoRoot });
-            publicationCommitted = result.changed === true;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        if ('operation' in input && input.operation === 'init') {
-            fault('before-domain-write');
-            const result = executeArtifactCommand(input, { repoRoot: manifest.repoRoot, artifactDir: taskDir });
-            publicationCommitted = result.changed === true;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        return await withTaskExecutionLock(manifest.repoRoot, request.taskId, `sandbox-control.${request.operation}`, async () => {
-            const artifact = await readTaskArtifact(taskDir, { artifact: input.artifact });
-            const content = artifact.bytes.toString('utf8');
-            fault('before-domain-write');
-            let result;
-            if ('operation' in input) {
-                const { family } = input;
-                if (family !== 'analysis' && family !== 'plan' && family !== 'code')
-                    throw new Error('ARTIFACT_IDENTITY_INVALID');
-                const local = { taskRef: request.taskId, family, artifact: input.artifact, repoRoot: manifest.repoRoot, lockAlreadyHeld: true };
-                if (input.operation === 'preflight') {
-                    const result = preflightLocalArtifact(local);
-                    return response(result);
-                }
-                const prepared = prepareLocalArtifact(local, content);
-                result = commitLocalArtifactProvenance(prepared);
-            }
-            else {
-                if (input.overrideTicket)
-                    throw new Error('TASK_WORKFLOW_OVERRIDE_UNSUPPORTED');
-                const family = `review-${input.stage}`;
-                if (request.operation === 'review-preflight') {
-                    const result = preflightReviewSummary(input, { repoRoot: manifest.repoRoot, lockAlreadyHeld: true });
-                    return response(result);
-                }
-                const prepared = prepareReviewSummaryCandidate(input, content, { repoRoot: manifest.repoRoot, lockAlreadyHeld: true });
-                if (input.dryRun || prepared.result.status === 'planned')
-                    return executionResult(prepared.result);
-                if (prepared.result.status === 'failed')
-                    return executionResult(prepared.result);
-                if (prepared.result.changed)
-                    replaceCurrentArtifactAtomically(path.join(taskDir, input.artifact), prepared.content);
-                result = prepared.result;
-            }
-            publicationCommitted ||= result.changed === true;
-            if (result.status !== 'failed')
-                appendDiagnosticAudit(manifest, 'task-workflow-artifact-finalized', {
-                    requestId: request.id, sandboxTaskId: request.taskId, workflowOperation: request.operation,
-                    artifact: input.artifact, sha256: result.artifactSha256, semanticDigest: result.semanticDigest
-                });
-            fault('after-atomic-rename');
-            return response(result);
-        });
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        const code = error?.code ?? /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1] ?? 'TASK_WORKFLOW_REQUEST_INVALID';
-        return executionResult({ status: 'failed', changed: publicationCommitted ? null : false, error: { code, message } });
-    }
-}
-//# sourceMappingURL=workflow-executor.js.map