@fitlab-ai/agent-infra 0.9.10 → 0.9.12

package/templates/.agents/rules/task-management.en.md

@@ -23,9 +23,8 @@ Map user intent to the corresponding workflow command:
 
 `--agent` values must converge on the standard AI collaborator tokens; OS usernames (e.g. `devuser`) and git usernames (e.g. a human name) are forbidden. The standard set (short tokens are the single source of truth for the activity log):
 
-- AI short tokens: `claude` / `codex` / `antigravity` / `opencode` / `cursor`
+- AI short tokens: `claude` / `codex` / `antigravity` / `opencode` / `cursor` / `traecli`
 - Long-name mapping (normalized to the short token before writing): `claude-code` -> `claude`, `antigravity-cli` -> `antigravity`
-- Historical `gemini` / `gemini-cli` remain read-only for `ai task log` rendering and are not writable
 - Manual-step exception: no matter which agent is used, a human-made decision is always declared as `human`
 
 The seven internal commands (`task-event` / `task-lifecycle` / `task-finalization` / `platform-issue` / `platform-comment` / `platform-pr` / `task-orchestration`) hard-validate `--agent` against a whitelist: they accept a short token, a long name, or `human`, and reject non-standard values with the matching `*_PAYLOAD_INVALID` error; long names are normalized to the short token before being persisted or forwarded. The `ai task log` renderer keeps unknown tokens grouped as `human` but appends a visible `(unknown)` marker.
@@ -50,7 +49,7 @@ The seven internal commands (`task-event` / `task-lifecycle` / `task-finalizatio
 - `review-plan`: update `current_step`, `updated_at`, `agent_infra_version`
 - `code-task`: update `current_step`, `updated_at`, `agent_infra_version`
 - `review-code`: update `current_step`, `updated_at`, `agent_infra_version`
-- `create-pr`: update `pr_number`, `updated_at`, `agent_infra_version`
+- `create-pr`: update the verified `pr_delivery_fact`, `updated_at`, `agent_infra_version`
 - `commit`: update `updated_at`, `agent_infra_version`; update `current_step` when needed (see `commit/reference/task-status-update.md`)
 - `complete-task`: update `status`, `current_step`, `completed_at`, `updated_at`, `agent_infra_version`
 - `block-task`: update `status`, `blocked_at`, `updated_at`, `agent_infra_version`

package/templates/.agents/rules/task-management.zh-CN.md

@@ -23,9 +23,8 @@
 
 `--agent` 取值必须收敛到标准 AI 合作者 token，禁止填入 OS 系统用户名（如 `devuser`）或 git 用户名（如 `季聿阶`）。标准集合（短名为活动日志唯一事实来源）：
 
-- AI 短名：`claude` / `codex` / `antigravity` / `opencode` / `cursor`
+- AI 短名：`claude` / `codex` / `antigravity` / `opencode` / `cursor` / `traecli`
 - 长名映射（写入前归一化为短名）：`claude-code` → `claude`、`antigravity-cli` → `antigravity`
-- 历史 `gemini` / `gemini-cli` 仅保留 `ai task log` 渲染兼容，不接受写入
 - 人工步骤例外：无论使用哪个 Agent，只要是人做的决定，统一声明 `human`
 
 七个内部命令（`task-event` / `task-lifecycle` / `task-finalization` / `platform-issue` / `platform-comment` / `platform-pr` / `task-orchestration`）对 `--agent` 做白名单硬校验：接受短名、长名或 `human`，非标准值返回对应 `*_PAYLOAD_INVALID` 错误；长名在落库/透传前归一化为短名。渲染端 `ai task log` 对无法识别的 token 保留 `human` 归类并附加 `(unknown)` 标记。
@@ -50,7 +49,7 @@
 - `review-plan`：更新 `current_step`、`updated_at`、`agent_infra_version`
 - `code-task`：更新 `current_step`、`updated_at`、`agent_infra_version`
 - `review-code`：更新 `current_step`、`updated_at`、`agent_infra_version`
-- `create-pr`：更新 `pr_number`、`updated_at`、`agent_infra_version`
+- `create-pr`：通过 `pr_delivery_fact` writer 更新 PR 绑定事实、`updated_at`、`agent_infra_version`
 - `commit`：更新 `updated_at`、`agent_infra_version`；必要时更新 `current_step`（详见 `commit/reference/task-status-update.md`）
 - `complete-task`：更新 `status`、`current_step`、`completed_at`、`updated_at`、`agent_infra_version`
 - `block-task`：更新 `status`、`blocked_at`、`updated_at`、`agent_infra_version`

package/templates/.agents/scripts/security-alerts.github.sh

@@ -0,0 +1,151 @@
+#!/bin/sh
+
+set -e
+
+operation="${1:-}"
+shift || true
+number=""
+reason=""
+comment_file=""
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --number)
+      number="${2:-}"
+      shift
+      ;;
+    --reason)
+      reason="${2:-}"
+      shift
+      ;;
+    --comment-file)
+      comment_file="${2:-}"
+      shift
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      exit 2
+      ;;
+  esac
+  shift
+done
+
+emit_error() {
+  code="$1"
+  message="$2"
+  node - "$operation" "$code" "$message" <<'NODE'
+const [operation, code, message] = process.argv.slice(2);
+process.stdout.write(`${JSON.stringify({ status: "failed", operation, error: { code, message } })}\n`);
+NODE
+}
+
+case "$operation" in
+  read-dependabot|dismiss-dependabot|read-codescan|dismiss-codescan) ;;
+  *)
+    emit_error "SECURITY_OPERATION_INVALID" "Unknown security alert operation."
+    exit 1
+    ;;
+esac
+
+case "$number" in
+  ''|*[!0-9]*)
+    emit_error "SECURITY_NUMBER_INVALID" "Alert number must be a positive integer."
+    exit 1
+    ;;
+esac
+
+if ! command -v gh >/dev/null 2>&1; then
+  emit_error "PLATFORM_CLI_MISSING" "The platform CLI is not installed."
+  exit 1
+fi
+if ! gh auth token >/dev/null 2>&1; then
+  emit_error "PLATFORM_NOT_AUTHENTICATED" "The platform CLI is not authenticated."
+  exit 1
+fi
+repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')" || {
+  emit_error "PLATFORM_REPOSITORY_UNAVAILABLE" "Unable to access the current repository."
+  exit 1
+}
+
+case "$operation" in
+  *dependabot*) endpoint="repos/$repo/dependabot/alerts/$number" ;;
+  *codescan*) endpoint="repos/$repo/code-scanning/alerts/$number" ;;
+esac
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT HUP INT TERM
+
+if [ "$operation" = "read-dependabot" ] || [ "$operation" = "read-codescan" ]; then
+  if ! gh api "$endpoint" > "$tmpdir/response.json" 2> "$tmpdir/error.txt"; then
+    emit_error "SECURITY_API_FAILED" "Unable to read the security alert."
+    exit 2
+  fi
+else
+  if [ -z "$reason" ] || [ -z "$comment_file" ] || [ ! -f "$comment_file" ]; then
+    emit_error "SECURITY_DISMISS_INPUT_INVALID" "Dismissal reason and comment file are required."
+    exit 1
+  fi
+  if ! gh api "$endpoint" > "$tmpdir/current.json" 2> "$tmpdir/error.txt"; then
+    emit_error "SECURITY_API_FAILED" "Unable to read the security alert before dismissal."
+    exit 2
+  fi
+  state="$(node - "$tmpdir/current.json" <<'NODE'
+const fs = require("node:fs");
+try {
+  const alert = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+  process.stdout.write(typeof alert.state === "string" ? alert.state : "invalid");
+} catch {
+  process.stdout.write("invalid");
+}
+NODE
+)"
+  case "$state" in
+    open) ;;
+    dismissed|fixed)
+      node - "$operation" "$tmpdir/current.json" <<'NODE'
+const fs = require("node:fs");
+const [operation, responsePath] = process.argv.slice(2);
+const data = JSON.parse(fs.readFileSync(responsePath, "utf8"));
+process.stdout.write(`${JSON.stringify({ status: "no-op", operation, data })}\n`);
+NODE
+      exit 0
+      ;;
+    *)
+      emit_error "SECURITY_RESPONSE_INVALID" "The platform returned an alert without a valid state."
+      exit 1
+      ;;
+  esac
+  node - "$reason" "$comment_file" > "$tmpdir/payload.json" <<'NODE'
+const fs = require("node:fs");
+const [reason, commentFile] = process.argv.slice(2);
+process.stdout.write(JSON.stringify({
+  state: "dismissed",
+  dismissed_reason: reason,
+  dismissed_comment: fs.readFileSync(commentFile, "utf8")
+}));
+NODE
+  if ! gh api --method PATCH "$endpoint" --input "$tmpdir/payload.json" > "$tmpdir/response.json" 2> "$tmpdir/error.txt"; then
+    emit_error "SECURITY_API_FAILED" "Unable to dismiss the security alert."
+    exit 2
+  fi
+fi
+
+node - "$operation" "$tmpdir/response.json" <<'NODE'
+const fs = require("node:fs");
+const [operation, responsePath] = process.argv.slice(2);
+const raw = fs.readFileSync(responsePath, "utf8").trim();
+let data = null;
+if (raw) {
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    process.stdout.write(`${JSON.stringify({
+      status: "failed",
+      operation,
+      error: { code: "SECURITY_RESPONSE_INVALID", message: "The platform returned invalid JSON." }
+    })}\n`);
+    process.exit(1);
+  }
+}
+process.stdout.write(`${JSON.stringify({ status: "applied", operation, data })}\n`);
+NODE

package/templates/.agents/scripts/security-alerts.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+
+set -e
+
+operation="${1:-}"
+
+node - "$operation" <<'NODE'
+const operation = process.argv[2] || "";
+const known = new Set([
+  "read-dependabot",
+  "dismiss-dependabot",
+  "read-codescan",
+  "dismiss-codescan"
+]);
+const payload = known.has(operation)
+  ? {
+      status: "degraded",
+      operation,
+      error: {
+        code: "PLATFORM_SECURITY_UNSUPPORTED",
+        message: "The current platform does not provide a security alert adapter."
+      }
+    }
+  : {
+      status: "failed",
+      operation,
+      error: { code: "SECURITY_OPERATION_INVALID", message: "Unknown security alert operation." }
+    };
+process.stdout.write(`${JSON.stringify(payload)}\n`);
+process.exit(known.has(operation) ? 0 : 1);
+NODE

package/templates/.agents/skills/analyze-task/SKILL.en.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # Analyze Task
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 If the entry operands contain `--orchestrated`, bind `{execution-flag}` to `--orchestrated` and forward it unchanged to the completed event; otherwise bind it to an empty value. Never infer it from `orchestration.json`, environment variables, or prior artifacts.
 
@@ -15,6 +15,7 @@ If the entry operands contain `--orchestrated`, bind `{execution-flag}` to `--or
 
 - This skill only outputs a requirements analysis document (`analysis.md` or `analysis-r{N}.md`) and does not modify any business code
 - Base the analysis strictly on the existing task input, requirements, context, and source information in `task.md`
+- Before generating task or lifecycle Markdown that will be synchronized to an Issue, read `.agents/rules/sync-content-generation.md` and apply its producer-side constraints; the sync path does not parse or rewrite the body
 - When old behavior, data, schemas, or callers are involved, read `.agents/rules/compatibility-policy.md` first. State current-only when admission evidence is absent; do not turn speculation into a requirement
 - After executing this skill, you **must** immediately update task status in task.md
 
@@ -24,7 +25,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 After loading workflow / skill / rules instructions, and before any task-state judgment or user-visible conclusion, run the state check first. Reading instruction files does not count as an external-state action or conclusion.
 
-Run these commands and paste the raw output into both the user-facing reply and this round's `## State Check` section:
+Run these commands and paste the raw output into this round's `## State Check` section:
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -34,7 +35,7 @@ Before the state check is complete, do not make external-state assertions such a
 
 ## Task Context Resolution
 
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
+> The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve every other business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to the full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
 
 > Resolve the task reference, then confirm that the task is in a state or directory supported by this skill and that `task.md` exists; if it cannot be located, handle it as a missing task and stop.
 

package/templates/.agents/skills/analyze-task/SKILL.zh-CN.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # 分析任务
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 若入口业务操作数包含 `--orchestrated`，绑定 `{execution-flag}` = `--orchestrated` 并原样转发给 completed 事件；否则绑定为空。不得从 `orchestration.json`、环境变量或历史产物推断该标记。
 
@@ -15,6 +15,7 @@ description: >
 
 - 本技能仅产出需求分析文档（`analysis.md` 或 `analysis-r{N}.md`）—— 不修改任何业务代码
 - 严格基于 `task.md` 中已有的任务输入、需求、上下文和来源信息展开分析
+- 生成会同步到 Issue 的任务或生命周期 Markdown 前，先读取 `.agents/rules/sync-content-generation.md` 并遵循其中的生成端约束；同步端不解析或改写正文
 - 涉及旧行为、旧数据、旧 schema 或旧调用方时，先读取 `.agents/rules/compatibility-policy.md`；没有兼容准入证据时明确采用 current-only，不把推测写成需求
 - 执行本技能后，你**必须**立即更新 task.md 中的任务状态
 
@@ -24,7 +25,7 @@ description: >
 
 在加载 workflow / skill / rules 指令之后、做任何任务状态判断或用户可见结论之前，必须先执行状态核对。指令类文件读取不算对外动作或结论。
 
-运行以下命令，并把原文粘贴到回复正文和本轮产物的 `## 状态核对` 段：
+运行以下命令，并把原文粘贴到本轮产物的 `## 状态核对` 段：
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -34,7 +35,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## 任务上下文解析
 
-> 入口允许省略 task ref，也接受旧位置 task ref 或 `--task <ref>` / `-t <ref>`。先从完整参数中分离 task scope 并原样保留其他业务操作数，再调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空、位置 ref 或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为该完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
+> 入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。保留其余业务操作数后调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
 
 > 解析任务引用，并确认任务位于本技能支持的状态或目录且存在 `task.md`；无法定位时按未找到任务处理并停止。
 

package/templates/.agents/skills/block-task/SKILL.en.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # Block Task
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 
 ## Boundary / Critical Rules
@@ -26,7 +26,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 ## Task Context Resolution
 
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
+> The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve every other business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to the full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
 
 > Resolve the task reference, then confirm that the task is in a state or directory supported by this skill and that `task.md` exists; if it cannot be located, handle it as a missing task and stop.
 

package/templates/.agents/skills/block-task/SKILL.zh-CN.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # 标记任务阻塞
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 
 ## 行为边界 / 关键规则
@@ -26,7 +26,7 @@ description: >
 
 ## 任务上下文解析
 
-> 入口允许省略 task ref，也接受旧位置 task ref 或 `--task <ref>` / `-t <ref>`。先从完整参数中分离 task scope 并原样保留其他业务操作数，再调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空、位置 ref 或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为该完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
+> 入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。保留其余业务操作数后调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
 
 > 解析任务引用，并确认任务位于本技能支持的状态或目录且存在 `task.md`；无法定位时按未找到任务处理并停止。
 

package/templates/.agents/skills/cancel-task/SKILL.en.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # Cancel Task
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 
 ## Boundary / Critical Rules
@@ -20,7 +20,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 ## Task Context Resolution
 
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
+> The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve every other business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to the full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
 
 > Resolve the task reference, then confirm that the task is in a state or directory supported by this skill and that `task.md` exists; if it cannot be located, handle it as a missing task and stop.
 

package/templates/.agents/skills/cancel-task/SKILL.zh-CN.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # 取消任务
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 
 ## 行为边界 / 关键规则
@@ -20,7 +20,7 @@ description: >
 
 ## 任务上下文解析
 
-> 入口允许省略 task ref，也接受旧位置 task ref 或 `--task <ref>` / `-t <ref>`。先从完整参数中分离 task scope 并原样保留其他业务操作数，再调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空、位置 ref 或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为该完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
+> 入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。保留其余业务操作数后调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
 
 > 解析任务引用，并确认任务位于本技能支持的状态或目录且存在 `task.md`；无法定位时按未找到任务处理并停止。
 

package/templates/.agents/skills/check-task/SKILL.en.md

@@ -15,7 +15,7 @@ description: >
 
 ## Task Context Resolution
 
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
+> The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve every other business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to the full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
 
 > Resolve the task reference, then confirm that the task is in a state or directory supported by this skill and that `task.md` exists; if it cannot be located, handle it as a missing task and stop.
 
@@ -26,7 +26,7 @@ description: >
 Run the deterministic CLI to collect every mechanical fact, and use its stdout as the factual base of your report:
 
 ```bash
-ai task status {task-id}
+ai task status --task {task-id}
 ```
 
 The command resolves the task across the active, blocked, and completed directories and prints five sections: the task header (`id`, short id, title), `Metadata` (frontmatter fields), `Artifacts` (files grouped by workflow stage), `Git` (branch match, uncommitted count, ahead/behind), and `Platform` (Issue/PR state). Treat that output as authoritative -- do not re-derive any of it by hand.

package/templates/.agents/skills/check-task/SKILL.zh-CN.md

@@ -15,7 +15,7 @@ description: >
 
 ## 任务上下文解析
 
-> 入口允许省略 task ref，也接受旧位置 task ref 或 `--task <ref>` / `-t <ref>`。先从完整参数中分离 task scope 并原样保留其他业务操作数，再调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空、位置 ref 或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为该完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
+> 入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。保留其余业务操作数后调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
 
 > 解析任务引用，并确认任务位于本技能支持的状态或目录且存在 `task.md`；无法定位时按未找到任务处理并停止。
 
@@ -26,7 +26,7 @@ description: >
 运行确定性 CLI 收集全部机械数据，并以其 stdout 作为状态报告的事实基底：
 
 ```bash
-ai task status {task-id}
+ai task status --task {task-id}
 ```
 
 该命令会跨 active、blocked、completed 三目录解析任务，并输出五段：任务头（`id`、短号、标题）、`Metadata`（frontmatter 字段）、`Artifacts`（按工作流阶段分组的产物）、`Git`（分支匹配、未提交数、ahead/behind）、`Platform`（Issue/PR 状态）。把该输出视为权威事实 —— 不要再手工复述其中任何内容。

package/templates/.agents/skills/close-codescan/SKILL.en.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # Dismiss Code Scanning Alert
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 
 Dismiss the specified Code Scanning (CodeQL) alert and record a justified reason.
@@ -23,7 +23,7 @@ The skill still owns the security-alert API. When a related task exists, Step 7
 
 ### 1. Retrieve Alert Information
 
-Read `.agents/rules/security-alerts.md` before this step, then use its Code Scanning alert read command to fetch the alert details.
+Read `.agents/rules/security-alerts.md` before this step, then run `bash .agents/scripts/security-alerts.sh read-codescan --number {alert-number}` and parse its JSON result to fetch the alert details.
 
 Verify that the alert is in the `open` state. If it is already dismissed or fixed, inform the user and exit.
 
@@ -71,7 +71,7 @@ Confirm? (y/N)
 
 ### 6. Execute the Dismissal
 
-Dismiss the alert by following the Code Scanning dismiss command in `.agents/rules/security-alerts.md`, passing the mapped `{api-reason}` and the user's explanation.
+Write the user's explanation to `{comment-file}`, then run `bash .agents/scripts/security-alerts.sh dismiss-codescan --number {alert-number} --reason {api-reason} --comment-file {comment-file}`. Parse the JSON result and continue only when the dismissal is `applied` or `no-op`.
 
 **API reason mapping** (per the Code Scanning API):
 - False Positive -> `false positive`

package/templates/.agents/skills/close-codescan/SKILL.zh-CN.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # 关闭 Code Scanning 告警
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 
 关闭指定的 Code Scanning（CodeQL）告警并记录合理的关闭理由。
@@ -23,7 +23,7 @@ description: >
 
 ### 1. 获取告警信息
 
-执行前先读取 `.agents/rules/security-alerts.md`，并按其中的 Code Scanning 告警读取命令获取告警详情。
+执行前先读取 `.agents/rules/security-alerts.md`，然后运行 `bash .agents/scripts/security-alerts.sh read-codescan --number {alert-number}`，解析其 JSON 结果获取告警详情。
 
 验证告警处于 `open` 状态。如果已被关闭/修复，告知用户并退出。
 
@@ -71,7 +71,7 @@ Code Scanning 告警 #{alert-number}
 
 ### 6. 执行关闭
 
-按 `.agents/rules/security-alerts.md` 中的 Code Scanning 告警关闭命令执行关闭操作，并传入映射后的 `{api-reason}` 与用户说明。
+将用户说明写入 `{comment-file}`，然后运行 `bash .agents/scripts/security-alerts.sh dismiss-codescan --number {alert-number} --reason {api-reason} --comment-file {comment-file}`。解析 JSON 结果，仅当关闭状态为 `applied` 或 `no-op` 时继续。
 
 **API reason 映射**（按 Code Scanning API）：
 - 误报 -> `false positive`

package/templates/.agents/skills/close-dependabot/SKILL.en.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # Dismiss Dependabot Alert
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 
 Dismiss the specified Dependabot security alert and record a justified reason.
@@ -23,7 +23,7 @@ The skill still owns the security-alert API. When a related task exists, Step 7
 
 ### 1. Retrieve Alert Information
 
-Read `.agents/rules/security-alerts.md` before this step, then use its Dependabot alert read command to fetch the alert details.
+Read `.agents/rules/security-alerts.md` before this step, then run `bash .agents/scripts/security-alerts.sh read-dependabot --number {alert-number}` and parse its JSON result to fetch the alert details.
 
 Verify that the alert is in the `open` state. If it is already dismissed or fixed, inform the user and exit.
 
@@ -77,7 +77,7 @@ Confirm? (y/N)
 
 ### 6. Execute the Dismissal
 
-Dismiss the alert by following the Dependabot dismiss command in `.agents/rules/security-alerts.md`, passing the mapped `{api-reason}` and the user's explanation.
+Write the user's explanation to `{comment-file}`, then run `bash .agents/scripts/security-alerts.sh dismiss-dependabot --number {alert-number} --reason {api-reason} --comment-file {comment-file}`. Parse the JSON result and continue only when the dismissal is `applied` or `no-op`.
 
 **API reason mapping**:
 - False Positive -> `not_used` or `inaccurate`

package/templates/.agents/skills/close-dependabot/SKILL.zh-CN.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # 关闭 Dependabot 告警
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 
 关闭指定的 Dependabot 安全告警并记录合理的关闭理由。
@@ -23,7 +23,7 @@ description: >
 
 ### 1. 获取告警信息
 
-执行前先读取 `.agents/rules/security-alerts.md`，并按其中的 Dependabot 告警读取命令获取告警详情。
+执行前先读取 `.agents/rules/security-alerts.md`，然后运行 `bash .agents/scripts/security-alerts.sh read-dependabot --number {alert-number}`，解析其 JSON 结果获取告警详情。
 
 验证告警处于 `open` 状态。如果已被关闭/修复，告知用户并退出。
 
@@ -77,7 +77,7 @@ CVE：{cve-id}
 
 ### 6. 执行关闭
 
-按 `.agents/rules/security-alerts.md` 中的 Dependabot 告警关闭命令执行关闭操作，并传入映射后的 `{api-reason}` 与用户说明。
+将用户说明写入 `{comment-file}`，然后运行 `bash .agents/scripts/security-alerts.sh dismiss-dependabot --number {alert-number} --reason {api-reason} --comment-file {comment-file}`。解析 JSON 结果，仅当关闭状态为 `applied` 或 `no-op` 时继续。
 
 **API reason 映射**：
 - 误报 -> `not_used` 或 `inaccurate`

package/templates/.agents/skills/code-task/SKILL.en.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # Code Task
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 If the entry operands contain `--orchestrated`, bind `{execution-flag}` to `--orchestrated` and forward it unchanged to the completed event; otherwise bind it to an empty value. Never infer it from `orchestration.json`, environment variables, or prior artifacts.
 
@@ -16,10 +16,11 @@ Implement the approved plan and produce `code.md` or `code-r{N}.md`. This skill
 ## Boundary / Critical Rules
 
 - Follow the latest plan artifact: `plan.md` or `plan-r{N}.md`
+- Before generating task or lifecycle Markdown that will be synchronized to an Issue, read `.agents/rules/sync-content-generation.md` and apply its producer-side constraints; the sync path does not parse or rewrite the body
 - Read `.agents/rules/compatibility-policy.md` before implementation. Implement only the compatibility budget explicitly approved by the plan; never retain old branches, result contracts, or migration shims merely to be “safe”
 - Fix mode verifies each finding of the latest `review-code` one by one: fix it if it holds, or rebut it and record it under unresolved if it is unfounded/hallucinated; do not expand to issues the review did not list; manual-validation items are out of scope
 - If implementation encounters a key design decision not covered by the plan, run `agent-infra-internal task-ledger {task-id} decision-next-id`, write the returned `HD-N` detail block per `.agents/rules/human-decision-context.md` and determine whether implementation is required, then run `decision-upsert --id {HD-N} --stage code --artifact {code-artifact} --needs-implementation {true|false}`. Do not scan ids, assemble ledger rows, ask mid-flow, or silently expand scope
-- Never auto-run `git add` or `git commit`
+- Do not invoke the `commit` skill or push to a remote; after tests pass, call the shared commit core with `delivery: { mode: 'local' }` to create the local checkpoint. The durable intent must close only after the checkpoint and task state sync succeed; only then emit `code.completed`
 - Create a new code artifact for each round and never overwrite an older one
 - After executing this skill, you **must** immediately update task.md
 
@@ -29,7 +30,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 After loading workflow / skill / rules instructions, and before any task-state judgment or user-visible conclusion, run the state check first.
 
-Run these commands and paste the raw output into both the user-facing reply and this round's `## State Check` section:
+Run these commands and paste the raw output into this round's `## State Check` section:
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -37,7 +38,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## Task Context Resolution
 
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
+> The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve every other business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to the full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
 
 > Resolve the task reference, then confirm that the task is in a state or directory supported by this skill and that `task.md` exists; if it cannot be located, handle it as a missing task and stop.
 
@@ -103,6 +104,8 @@ Use the project test commands from the `test` skill and iterate until all requir
 
 When triaging a test failure or unexpected behavior, first read `.agents/rules/debugging-guide.md` and locate the root cause via its four-phase flow; do not blindly patch and retry.
 
+After tests pass, call the shared commit core with `agent-infra-internal git-workflow commit --input {checkpoint-input}`. Pass `delivery: { "mode": "local" }`, explicit paths, expected HEAD/tree, task ref, agent, and the code round. This creates only a local checkpoint and does not contact a remote. The core writes a durable intent before committing and removes it after task-writer synchronization; do not emit `code.completed` if either checkpoint or task synchronization fails.
+
 ### 9. Write the Code Report
 
 Create `.agents/workspace/active/{task-id}/{code-artifact}`.
@@ -126,6 +129,6 @@ agent-infra-internal task-verify {task-id} code.completed --artifact {code-artif
 
 ### 12. Tell the User
 
-Use `reference/output-template.md` (or `reference/fix-mode.md` in fix mode) and render the selected next-step commands through the shared helper.
+Use `reference/output-template.md` (or `reference/fix-mode.md` in fix mode) and render the selected next-step commands through the shared helper. Do not push, create a PR, or invoke the `commit` skill here.
 
 > Before rendering the final output, read `.agents/rules/next-step-output.md` and apply both of its rules: (1) render `{task-ref}` in the "Next steps" commands as the current task's short id `NN` (see that file for lookup and fallback), while other `{task-id}` placeholders (report titles, paths) keep the full TASK-id form; (2) append the `Completed at` line as the very last line of the user-facing output (this applies to every user-facing output — success, error, and early-return paths alike, not only the success path).