@fitlab-ai/agent-infra 0.9.0 → 0.9.1

package/lib/sandbox/runtimes/ai-tools.dockerfile

@@ -5,20 +5,41 @@ ENV NPM_CONFIG_PREFIX=/home/devuser/.npm-global
 ENV PATH="/home/devuser/.npm-global/bin:${PATH}"
 
 ARG AI_TOOL_PACKAGES=
-RUN set -e && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    set -e && \
     for pkg in ${AI_TOOL_PACKAGES}; do \
       npm install -g "$pkg"; \
     done
 
 ARG AI_TOOLS_SHELL_INSTALL_B64=
-RUN if [ -n "${AI_TOOLS_SHELL_INSTALL_B64}" ]; then \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    if [ -n "${AI_TOOLS_SHELL_INSTALL_B64}" ]; then \
       set -e && \
       echo "${AI_TOOLS_SHELL_INSTALL_B64}" | base64 -d > /tmp/ai-tools-install.sh && \
       bash /tmp/ai-tools-install.sh && \
       rm /tmp/ai-tools-install.sh; \
     fi
 
-RUN npm install -g pyright
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    npm install -g pyright
 
 RUN mkdir -p /home/devuser/.local/share /home/devuser/.local/state
 

package/lib/sandbox/runtimes/base.dockerfile

@@ -19,7 +19,14 @@ RUN if [ "${HOST_UID}" = "0" ]; then \
         useradd -u ${HOST_UID} -g ${HOST_GID} -m -s /bin/bash devuser; \
     fi
 
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     curl wget git vim file jq \
     build-essential ca-certificates gnupg lsb-release \
     libevent-core-2.1-7 libncursesw6 libtinfo6 \

package/lib/sandbox/runtimes/java17.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     openjdk-17-jdk maven \
     && rm -rf /var/lib/apt/lists/*

package/lib/sandbox/runtimes/java21.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     openjdk-21-jdk maven \
     && rm -rf /var/lib/apt/lists/*

package/lib/sandbox/runtimes/node20.dockerfile

@@ -1,3 +1,10 @@
-RUN bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_20.x | bash -' && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_20.x | bash -' && \
     apt-get install -y nodejs && \
     rm -rf /var/lib/apt/lists/*

package/lib/sandbox/runtimes/node22.dockerfile

@@ -1,3 +1,10 @@
-RUN bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_22.x | bash -' && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_22.x | bash -' && \
     apt-get install -y nodejs && \
     rm -rf /var/lib/apt/lists/*

package/lib/sandbox/runtimes/python3.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     python3 python3-pip python3-venv \
     && rm -rf /var/lib/apt/lists/*

package/lib/sandbox/shell.ts

@@ -12,6 +12,7 @@ type CommandOptions = {
   stdio?: StdioOptions;
   timeout?: number;
   shell?: boolean;
+  env?: NodeJS.ProcessEnv;
 };
 
 type RunProbeOptions = CommandOptions & {
@@ -23,7 +24,8 @@ function normalizeOptions(opts: CommandOptions = {}, stdio: StdioOptions): Comma
     cwd: opts.cwd,
     encoding: opts.encoding,
     stdio,
-    timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS
+    timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS,
+    env: opts.env
   };
 }
 

package/lib/task/commands/issue-body.ts

@@ -12,12 +12,13 @@ Print a deterministic Issue body extracted from a task's task.md.
   Omit <ref>           Resolve the unique active task for the current branch.
   <ref>               Bare numeric short id, or a full TASK-YYYYMMDD-HHMMSS id.
   --template <path>   Render the final body for the given GitHub Issue Form (scenario A);
-                      without it, print the default '描述 + 需求' body (scenario B).
+                      without it, print the default '任务输入 + 描述 + 需求' body (scenario B).
 
-Only the task title, '## 描述' and '## 需求' sections are ever emitted; the rest of
-task.md (scaffolding sections, placeholders) is never written to the body.
+Only the task title, '## 任务输入', '## 描述' and '## 需求' sections are ever
+emitted; the rest of task.md is never written to the body.
 `;
 
+const TASK_INPUT_ALIASES = ['任务输入', 'Task Input'];
 const DESCRIPTION_ALIASES = ['描述', 'Description'];
 const REQUIREMENTS_ALIASES = ['需求', 'Requirements'];
 
@@ -26,18 +27,22 @@ const REQUIREMENTS_ALIASES = ['需求', 'Requirements'];
  * task.md actually uses, with empty sections falling back to `N/A`.
  */
 function buildDefaultBody(content: string): string {
+  const taskInputHeading = findSectionHeading(content, TASK_INPUT_ALIASES);
   const descHeading = findSectionHeading(content, DESCRIPTION_ALIASES);
   const reqHeading = findSectionHeading(content, REQUIREMENTS_ALIASES);
+  const taskInput = extractSection(content, TASK_INPUT_ALIASES) || PLACEHOLDER;
   const description = extractSection(content, DESCRIPTION_ALIASES) || PLACEHOLDER;
   const requirements = extractSection(content, REQUIREMENTS_ALIASES) || PLACEHOLDER;
-  return `## ${descHeading}\n\n${description}\n\n## ${reqHeading}\n\n${requirements}\n`;
+  return `## ${taskInputHeading}\n\n${taskInput}\n\n## ${descHeading}\n\n${description}\n\n## ${reqHeading}\n\n${requirements}\n`;
 }
 
 function readTaskFields(content: string): TaskFields {
   return {
     title: extractTitle(content),
     description: extractSection(content, DESCRIPTION_ALIASES),
-    requirements: extractSection(content, REQUIREMENTS_ALIASES)
+    requirements: extractSection(content, REQUIREMENTS_ALIASES),
+    taskInput: extractSection(content, TASK_INPUT_ALIASES),
+    taskInputHeading: findSectionHeading(content, TASK_INPUT_ALIASES)
   };
 }
 

package/lib/task/events.ts

@@ -109,7 +109,7 @@ const FAMILY = {
   'review-plan': { artifact: 'review-plan', started: ['technical-design', 'technical-design-review'], completed: ['technical-design', 'technical-design-review'], target: 'technical-design-review', label: 'Review Plan' },
   code: { artifact: 'code', started: ['technical-design-review', 'code-review'], completed: ['technical-design-review', 'code-review'], target: 'code', label: 'Code Task' },
   'review-code': { artifact: 'review-code', started: ['code', 'code-review', 'commit'], completed: ['code', 'code-review', 'commit'], target: 'code-review', label: 'Review Code' },
-  'manual-validation': { artifact: 'manual-validation', started: ['code-review'], completed: ['code-review'], target: null, label: 'Complete Manual Validation' }
+  'manual-validation': { artifact: 'manual-validation', started: ['code-review', 'commit'], completed: ['code-review', 'commit'], target: null, label: 'Complete Manual Validation' }
 } as const;
 type EventFamily = keyof typeof FAMILY;
 

package/lib/task/issue-form.ts

@@ -4,6 +4,8 @@ type TaskFields = {
   title: string;
   description: string;
   requirements: string;
+  taskInput: string;
+  taskInputHeading: string;
 };
 
 // Field id -> task value mapping (single source of truth, per HD-1).
@@ -84,6 +86,8 @@ function renderTemplateBody(formText: string, fields: TaskFields): string {
     const value = mapped.trim() === '' ? PLACEHOLDER : mapped;
     sections.push(`### ${label}\n\n${value}`);
   }
+  const taskInput = fields.taskInput.trim() === '' ? PLACEHOLDER : fields.taskInput;
+  sections.push(`### ${fields.taskInputHeading}\n\n${taskInput}`);
   return `${sections.join('\n\n')}\n`;
 }
 

package/lib/task/review-fingerprint.ts

@@ -12,7 +12,16 @@ export const DEFAULT_POST_REVIEW_EXCLUDES: string[] = [];
 // The leading ":/" makes coverage fail-closed (everything from the repo root);
 // each exclude becomes a top-level negative pathspec. Projects extend the
 // denylist via review.post_review_exclude_globs (union, deduped).
-type ReviewGlobConfig = { post_review_exclude_globs?: unknown };
+type ReviewGlobConfig = Record<string, unknown> & { post_review_exclude_globs?: unknown };
+
+export function loadPostReviewConfig(repoRoot: string): ReviewGlobConfig {
+  try {
+    const config = JSON.parse(fs.readFileSync(path.join(repoRoot, ".agents", ".airc.json"), "utf8"));
+    return config.review && typeof config.review === "object" ? config.review : {};
+  } catch {
+    return {};
+  }
+}
 
 export function resolvePostReviewGlobs(
   config: ReviewGlobConfig = {},

package/lib/task/verification-engine.ts

@@ -10,11 +10,14 @@ import {
   extractReviewDiffFingerprint,
   extractReviewedSnapshotTree,
   findAuthoritativeReviewCodeArtifact,
+  loadPostReviewConfig,
   parseReviewVerdict,
   resolvePostReviewGlobs
 } from "./verification-review.ts";
 import { check as checkPlatformSync } from "../platform/verification-sync.ts";
 import { check as checkRequiredChecks } from "../platform/verification-required.ts";
+import { inspectPlatformPullRequest } from "../platform/pull-requests.ts";
+import { resolveReviewedHeadRelation } from "../platform/merged-pr-equivalence.ts";
 import { parseTypedTaskFrontmatter } from "./frontmatter.ts";
 import { parseLedger } from "./ledger.ts";
 import { loadVerificationConfig } from "./verification-config.ts";
@@ -268,20 +271,6 @@ function loadProjectName(): any {
   }
 }
 
-function loadReviewConfig(): any {
-  const configPath = path.join(repoRoot, ".agents", ".airc.json");
-  if (!fs.existsSync(configPath)) {
-    return {};
-  }
-
-  try {
-    const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
-    return config.review && typeof config.review === "object" ? config.review : {};
-  } catch {
-    return {};
-  }
-}
-
 function checkArtifact({ taskDir, config, artifactFile }: any): any {
   const resolvedArtifact = resolveArtifactPath(taskDir, config.file_pattern, artifactFile);
   if (!resolvedArtifact.ok) {
@@ -598,7 +587,7 @@ function resolveReviewSetting(config: any, key: any, fallback: any): any {
   if (config && config[key] !== undefined && config[key] !== null) {
     return config[key];
   }
-  const reviewConfig = loadReviewConfig();
+  const reviewConfig = loadPostReviewConfig(repoRoot);
   if (reviewConfig[key] !== undefined && reviewConfig[key] !== null) {
     return reviewConfig[key];
   }
@@ -706,7 +695,7 @@ function checkPostReviewCommit({ taskDir, config }: any): any {
   }
 
   const sha = baselineSource.sha;
-  const globs = resolvePostReviewGlobs(config, loadReviewConfig());
+  const globs = resolvePostReviewGlobs(config, loadPostReviewConfig(repoRoot));
   let commits;
   try {
     const out = execFileSync("git", ["-C", gitRoot, "rev-list", `${sha}..HEAD`, "--", ...globs], { encoding: "utf8" });
@@ -719,6 +708,33 @@ function checkPostReviewCommit({ taskDir, config }: any): any {
     return passResult("post-review-commit", `No post-review commits to code/rule paths since ${sha.slice(0, 8)}`);
   }
 
+  if (task.ok && Number(task.metadata.pr_number) > 0) {
+    const inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: gitRoot });
+    if (inspected.pullRequest) {
+      let localHead = "";
+      try {
+        localHead = execFileSync("git", ["-C", gitRoot, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+      } catch {
+        return blockedResult("post-review-commit", "Unable to resolve the local HEAD");
+      }
+      const relation = resolveReviewedHeadRelation({
+        gitRoot,
+        localHead,
+        lastReviewedCommit: sha,
+        pullRequest: inspected.pullRequest,
+        pathspecs: globs
+      });
+      if (relation.status === "merged-equivalent") {
+        return passResult("post-review-commit", `Reviewed PR head is content-equivalent to squash merge ${relation.mergeCommit.slice(0, 8)}`);
+      }
+      if (relation.status === "blocked") {
+        return blockedResult("post-review-commit", relation.message);
+      }
+    } else if (inspected.status === "blocked") {
+      return blockedResult("post-review-commit", inspected.error?.message || "PR merge snapshot is unavailable");
+    }
+  }
+
   let exempt = false;
   try {
     exempt = task.ok && parseLedger(task.content).some(
@@ -788,7 +804,7 @@ function checkReviewFact({ taskDir, artifactFile }: any): any {
 
   let actualSnapshot;
   try {
-    actualSnapshot = snapshotReview({ cwd: gitRoot, mode: "worktree", baseline, globs: resolvePostReviewGlobs({}, loadReviewConfig()) });
+    actualSnapshot = snapshotReview({ cwd: gitRoot, mode: "worktree", baseline, globs: resolvePostReviewGlobs({}, loadPostReviewConfig(repoRoot)) });
   } catch {
     return blockedResult(
       "review-fact",

package/lib/task/verification-review.ts

@@ -3,6 +3,7 @@ export {
   extractReviewDiffFingerprint,
   extractReviewedSnapshotTree,
   findAuthoritativeReviewCodeArtifact,
+  loadPostReviewConfig,
   parseReviewVerdict,
   resolvePostReviewGlobs
 } from './review-fingerprint.ts';

package/lib/task/verification.ts

@@ -63,7 +63,7 @@ const VERIFICATION_CATALOG: Readonly<Record<VerificationEvent, VerificationSpec>
   'block-task.completed': gate('block-task', 'blocked'),
   'cancel-task.completed': gate('cancel-task', 'completed'),
   'commit.completed': gate('commit', 'active'),
-  'complete-task.preflight': { skill: 'complete-task', expectedState: 'active', mode: 'checks', checks: ['review-ledger', 'post-review-commit', 'required-checks', 'platform-sync-preflight'] },
+  'complete-task.preflight': { skill: 'complete-task', expectedState: 'active', mode: 'checks', checks: ['review-ledger', 'post-review-commit', 'platform-sync-preflight'] },
   'complete-task.completed': gate('complete-task', 'completed'),
   'create-pr.completed': gate('create-pr', 'active'),
   'create-task.completed': gate('create-task', 'active'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fitlab-ai/agent-infra",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Bootstrap tool for AI multi-tool collaboration infrastructure — works with Claude Code, Codex, Gemini CLI, and OpenCode",
   "license": "MIT",
   "type": "module",

package/templates/.agents/rules/release-commands.en.md

@@ -1,5 +1,5 @@
 # Release Commands
 
-This code platform does not provide built-in release commands.
+This code platform does not provide a release-note adapter.
 
-Remote release automation is skipped for custom platforms unless you provide matching `.{platform}.en.md` rule templates and scripts. Continue using local release artifacts or your platform-specific release process.
+Use `agent-infra-internal platform-release-notes context` to receive a structured `PLATFORM_RELEASE_NOTES_UNSUPPORTED` no-op. Do not probe another platform client. Publishing remains a no-op until an adapter is provided.

package/templates/.agents/rules/release-commands.github.en.md

@@ -1,52 +1,22 @@
 # Release Platform Commands
 
-Read this file before loading release history, querying merged PRs, or publishing the Release notes.
+Release-note platform operations use a typed internal intent. Callers consume structured JSON and do not interpret platform commands, raw fields, identity email rules, or authentication errors.
 
-## Query Releases
+## Collect Release-note Context
 
 ```bash
-gh release list --limit {limit} --json tagName,isDraft,isPrerelease
-gh release view "{tag}" --json body,url
+agent-infra-internal platform-release-notes context \
+  --from-tag "v{prev-version}" --to-tag "v{version}" \
+  --branch "{branch}" --history-limit 3
 ```
 
-## Query Merged PRs
+The result contains release history, pull requests, closing Issues, and normalized contributor identities. Unsupported platforms return a stable `PLATFORM_RELEASE_NOTES_UNSUPPORTED` no-op.
 
-```bash
-gh pr list --state merged --base "{branch}" --json number,title,mergedAt,labels
-```
-
-When needed, read the linked Issue:
-
-```bash
-gh issue view {issue-number} --json number,title,labels,url
-```
-
-## Contributor Mapping Helpers
-
-Merged PR queries used for release notes should include authors when contributors are needed:
-
-```bash
-gh pr list --state merged --base "{branch}" --json number,title,mergedAt,labels,author
-```
-
-Linked Issue queries used for reporter attribution should include the author:
-
-```bash
-gh issue view {issue-number} --json number,title,labels,url,author
-```
-
-Map GitHub no-reply emails with this rule: if `Name <email>` contains an email matching `(\d+\+)?(\S+?)@users\.noreply\.github\.com`, use the second capture group lowercased as the login. This covers both `{id}+{login}@users.noreply.github.com` and `{login}@users.noreply.github.com`.
-
-## Publish the Release Notes
-
-The GitHub Release for `v{version}` is created and published automatically by the release workflow so Homebrew bottles have a stable upload target. This command writes the curated notes onto that existing Release, falling back to creating it if it does not exist yet.
+## Publish Release Notes
 
 ```bash
-if gh release view "v{version}" >/dev/null 2>&1; then
-  gh release edit "v{version}" --notes-file "{notes-file}"
-else
-  gh release create "v{version}" --title "v{version}" --notes-file "{notes-file}"
-fi
+agent-infra-internal platform-release-notes publish \
+  --tag "v{version}" --title "v{version}" --notes-file "{notes-file}"
 ```
 
-If commands fail, stop or escalate according to the calling skill.
+The command updates an existing Release or creates a missing one. `--dry-run` only plans the operation. Exit codes `0/1/2` mean success, failure, and blocked.

package/templates/.agents/rules/release-commands.github.zh-CN.md

@@ -1,52 +1,22 @@
 # Release 平台命令
 
-在读取历史 release、查询已合并 PR，或发布 Release notes 前先读取本文件。
+发布说明平台操作统一使用 typed internal intent。调用方只解释结构化 JSON，不解析平台命令、原始字段、身份邮箱规则或认证错误。
 
-## Release 查询
+## 收集发布说明上下文
 
 ```bash
-gh release list --limit {limit} --json tagName,isDraft,isPrerelease
-gh release view "{tag}" --json body,url
+agent-infra-internal platform-release-notes context \
+  --from-tag "v{prev-version}" --to-tag "v{version}" \
+  --branch "{branch}" --history-limit 3
 ```
 
-## 已合并 PR 查询
-
-```bash
-gh pr list --state merged --base "{branch}" --json number,title,mergedAt,labels
-```
-
-必要时读取关联 Issue：
-
-```bash
-gh issue view {issue-number} --json number,title,labels,url
-```
-
-## Contributor 映射辅助规则
-
-release notes 需要 contributors 时，已合并 PR 查询应包含 author：
-
-```bash
-gh pr list --state merged --base "{branch}" --json number,title,mergedAt,labels,author
-```
-
-关联 Issue 用于 reporter 归因时，查询应包含 author：
-
-```bash
-gh issue view {issue-number} --json number,title,labels,url,author
-```
-
-GitHub no-reply 邮箱映射规则：如果 `Name <email>` 中的 email 匹配 `(\d+\+)?(\S+?)@users\.noreply\.github\.com`，使用第二个捕获组的小写形式作为 login。该规则同时覆盖 `{id}+{login}@users.noreply.github.com` 和 `{login}@users.noreply.github.com`。
+结果包含历史发布、PR、关联 Issue 和规范化贡献者身份。不支持的平台返回稳定的 `PLATFORM_RELEASE_NOTES_UNSUPPORTED` no-op。
 
 ## 发布 Release notes
 
-`v{version}` 的 GitHub Release 由 release 工作流自动创建并发布，为 Homebrew bottle 提供稳定的上传落点。本命令把精修后的 notes 写到这个已存在的 Release 上；若 Release 尚不存在则兜底创建。
-
 ```bash
-if gh release view "v{version}" >/dev/null 2>&1; then
-  gh release edit "v{version}" --notes-file "{notes-file}"
-else
-  gh release create "v{version}" --title "v{version}" --notes-file "{notes-file}"
-fi
+agent-infra-internal platform-release-notes publish \
+  --tag "v{version}" --title "v{version}" --notes-file "{notes-file}"
 ```
 
-失败时按调用方规则停止或提示人工介入。
+命令更新既有 Release，缺失时创建；`--dry-run` 只规划操作。退出码 `0/1/2` 分别表示成功、失败和阻塞。

package/templates/.agents/rules/release-commands.zh-CN.md

@@ -1,5 +1,5 @@
 # Release 命令
 
-当前代码平台未内置发布命令支持。
+当前代码平台未提供发布说明 adapter。
 
-自定义平台会跳过远端发布自动化，除非你提供匹配的 `.{platform}.zh-CN.md` 规则模板和脚本。请继续使用本地发布产物或你的平台专属发布流程。
+调用 `agent-infra-internal platform-release-notes context` 会返回结构化的 `PLATFORM_RELEASE_NOTES_UNSUPPORTED` no-op，不得探测其他平台 client。在提供 adapter 前，发布操作同样保持 no-op。

package/templates/.agents/rules/review-handshake.en.md

@@ -92,7 +92,8 @@ When an executor judges an item to be a key design decision that needs human rul
 - `commit` reads only the highest-round Approved `review-code` artifact. Before committing it requires `pre_head == R`, complete worktree tree `W == T`, and normalized staged tree `S == T`; any mismatch blocks before `git commit` and reports added, missing, and different paths for both comparisons.
 - After a successful commit it sets `B=last_reviewed_commit=<new_head>`; B means only a reviewed snapshot anchored to a Git commit.
 - The `complete-task` `post-review-commit` gate uses only B. When B is absent, malformed, or missing as a Git object, it reports `reviewed snapshot was not anchored` and never falls back to R.
-- If new commits touch code / rule paths after B, the gate blocks and requires a fresh `review-code`.
+- If new commits touch code / rule paths after B, the gate blocks and requires a fresh `review-code`. The only automatic exception is a bound merged GitHub PR whose platform snapshot proves B is the original PR head, whose merge commit is in local HEAD history, whose reviewed changes exactly match the normalized patch of a single-parent squash commit, and whose protected paths have no later commits. Missing platform or Git evidence fails closed.
+- Required checks remain a pre-merge responsibility of branch protection / rulesets and the `review-code` / `watch-pr` routes. The post-review-commit gate still applies the strict / squash-equivalent relation above independently.
 - **Exemption**: append a ledger row `| PRC-1 | post-review-commit | - | - | human-decided | <ruling note> |` recording that a human explicitly allowed those commits without re-review.
 
 ## Gate behavior cheat sheet

package/templates/.agents/rules/review-handshake.zh-CN.md

@@ -92,7 +92,8 @@
 - `commit` 只读取最高轮 Approved `review-code` 产物；提交前比较 `pre_head == R`、完整工作区树 `W == T`、规范化暂存树 `S == T`，任一失配都在 `git commit` 前阻断并报告两组 added/missing/different 路径。
 - 成功提交后令 `B=last_reviewed_commit=<new_head>`；`B` 只表示已经落到 Git commit 的审查锚点。
 - `complete-task` 的 `post-review-commit` gate 只使用 B；B 缺失、畸形或对象不存在时报告 `reviewed snapshot was not anchored`，不得回退 R。
-- 若 B 之后代码 / 规则路径出现新提交，gate 会拦截，要求重新 `review-code`。
+- 若 B 之后代码 / 规则路径出现新提交，gate 会拦截，要求重新 `review-code`。唯一自动例外是绑定 GitHub PR 已合并，且平台快照证明 B 是原 PR head、merge commit 位于本地 HEAD 历史中、受审查变更与单父 squash commit 的规范化补丁完全一致，并且 merge 后受保护路径没有新提交；缺少任一平台或 Git 证据时 fail closed。
+- required checks 由合并前的分支保护 / ruleset 与 `review-code` / `watch-pr` 路由负责。post-review-commit 仍独立执行上述严格 / squash 等价判定。
 - **豁免**：在账本追加一行 `| PRC-1 | post-review-commit | - | - | human-decided | <裁定说明> |`，记录人工明确允许该批提交免复审。
 
 ## gate 行为速查

package/templates/.agents/rules/testing-discipline.en.md

@@ -41,6 +41,24 @@ This mirrors "Goal-Driven Execution" in AGENTS.md: define a verifiable success c
 
 ## Project-specific test policy
 
-Keep repository-specific commands, directory conventions, coverage thresholds, CI integration, and reporting services in the project's own test documentation. Before adding a test, inspect that local policy and place the test in the layer that matches its observable scope and runtime cost.
+Complete each item below for this repository. Record the chosen behavior and its boundaries so contributors can select and validate tests consistently.
 
-If the project does not define a layered test suite, use its complete test command for RED and GREEN verification. Do not invent a test hierarchy or coverage gate as part of an unrelated change.
+### 1. Test commands
+
+> TODO: Document the complete test command and any faster commands used during development.
+
+### 2. Test directories or tiers
+
+> TODO: Document the test directories or tiers and the rule for choosing among them.
+
+### 3. Coverage
+
+> TODO: Document how coverage is collected, any thresholds, and whether coverage blocks changes.
+
+### 4. Continuous integration
+
+> TODO: Document which CI checks run tests and which checks are blocking or informational.
+
+### 5. Reporting services
+
+> TODO: Document any external reporting services, badges, or artifacts and whether they affect acceptance.

package/templates/.agents/rules/testing-discipline.zh-CN.md

@@ -41,6 +41,24 @@ assert.match(content, /^name: code-task$/m);         // 正向断言已足够
 
 ## 项目级测试策略
 
-仓库特定的命令、目录约定、覆盖率阈值、CI 集成和报告服务应记录在项目自己的测试文档中。新增测试前先读取该策略，并按测试的可观察范围与运行成本选择对应层级。
+请为本仓库填写以下各项，记录选定行为及其边界，以便贡献者一致地选择并验证测试。
 
-如果项目没有定义分层测试套件，RED 与 GREEN 验证都使用项目的完整测试命令。不要在无关改动中自行引入测试层级或覆盖率门禁。
+### 1. 测试命令
+
+> TODO: 记录完整测试命令，以及开发期间使用的可选快速命令。
+
+### 2. 测试目录或层级
+
+> TODO: 记录测试目录或层级，以及选择对应目录或层级的规则。
+
+### 3. 覆盖率
+
+> TODO: 记录覆盖率采集方式、阈值，以及覆盖率是否阻塞变更。
+
+### 4. 持续集成
+
+> TODO: 记录运行测试的 CI 检查，以及哪些检查属于阻塞项或信息项。
+
+### 5. 报告服务
+
+> TODO: 记录外部报告服务、徽章或构件，以及它们是否影响验收。

package/templates/.agents/skills/analyze-task/SKILL.en.md

@@ -11,7 +11,7 @@ description: >
 ## Boundary / Critical Rules
 
 - This skill only outputs a requirements analysis document (`analysis.md` or `analysis-r{N}.md`) and does not modify any business code
-- Base the analysis strictly on the existing requirements, context, and source information in `task.md`
+- Base the analysis strictly on the existing task input, requirements, context, and source information in `task.md`
 - After executing this skill, you **must** immediately update task status in task.md
 
 Version stamp rule: when creating or updating `task.md` frontmatter, read `.agents/rules/version-stamp.md` first and write or refresh `agent_infra_version`.
@@ -56,6 +56,7 @@ Run `agent-infra-internal task-artifact {task-id} inspect --family analysis`. Co
 ### 3. Read Task Context
 
 Read `task.md` carefully to understand:
+- sources, facts and evidence, constraints, decision states, acceptance criteria, and open questions captured under `## Task Input` (fall back compatibly when the section is absent)
 - task title, description, and requirement list
 - context information (Issue, PR, branch, alert numbers, etc.)
 - currently known affected files and constraints
@@ -89,6 +90,8 @@ Runs after Step 0 state check and Step 3 (questioning is an external-state actio
 - no answer carried → restate `pending_question` and take Scenario B early-exit below (do not increase `question_count`).
 
 **4.3 Sufficiency judgment** (objective checklist; any gap hit means insufficient):
+- first aggregate `## Task Input`, description, context, requirements, and remote sources; an analysis-owned `## Requirements` section being unpopulated is not by itself insufficient;
+- goals, scope, constraints, or acceptance criteria already recorded in task input count as provided and must not be asked again;
 - description/requirements empty, or a single sentence with no verifiable acceptance criteria;
 - missing goal or impact scope (unclear what to change / who is affected);
 - requirement items contradict each other, or key terms are undefined and block analysis.