@fitlab-ai/agent-infra 0.9.10 → 0.9.12

package/templates/.agents/skills/complete-task/reference/external-delivery.en.md

@@ -10,8 +10,8 @@ The platform adapter supplies authoritative Issue closing change requests across
 
 ## Authorization and Persistent Audit
 
-Only the current typed result's `mode=external`, `authorization`, and `selected` fields control the machine branch. `pr_status: created` is a compatibility shim for existing verifiers: it means a verifiable PR is bound, not that this task created it, and it cannot authorize lifecycle skipping by itself.
+Only the current typed result's `mode=external`, `authorization`, and `selected` fields control the machine branch. Persistent `pr_delivery_fact` stores the verified binding and provenance; it does not say that the current invocation created the PR and cannot authorize lifecycle skipping by itself.
 
-A successful bind atomically writes PR fields and appends a `Bind External PR` Activity Log entry containing the authorization source, Issue, PR URL/number, base/head repository/ref/SHA, merge time, and merge commit. Replaying identical complete evidence is a no-op; an existing same-number binding without the signature adds it once; number or identity changes fail. The PR create path must never run.
+A successful bind atomically writes `pr_delivery_fact` and appends a `Bind External PR` Activity Log entry containing the authorization source, Issue, PR URL/number, base/head repository/ref/SHA, merge time, and merge commit. Replaying identical complete evidence is a no-op; an existing same-number binding without the signature adds it once; number or identity changes fail. The PR create path must never run.
 
 External mode still passes identity, required-PR, local lifecycle, and terminal checks; review-ledger, manual-validation, post-review-commit, and platform-sync evidence is projected as warning/pending steps after lifecycle. Without a canonical review-code artifact, only existing verifier N/A rules apply. `--force` does not disable identity, local atomicity, or required-PR hard gates.

package/templates/.agents/skills/complete-task/reference/external-delivery.zh-CN.md

@@ -10,8 +10,8 @@ core 通过平台 adapter 读取 Issue 的权威 closing change requests，穷
 
 ## 授权与持久审计
 
-当次调用只以 typed result 的 `mode=external`、`authorization` 和 `selected` 为机器分支依据。`pr_status: created` 只是现有 verifier 的兼容 shim，表示任务已绑定可验证的 PR；它既不表示 PR 由本任务创建，也不能单独授权跳过 lifecycle。
+当次调用只以 typed result 的 `mode=external`、`authorization` 和 `selected` 为机器分支依据。持久化 `pr_delivery_fact` 保存已验证绑定及 provenance；它不表示本次调用创建了 PR，也不能单独授权跳过 lifecycle。
 
-成功绑定会原子写入 PR 字段并追加 `Bind External PR` Activity Log，记录授权来源、Issue、PR URL/编号、base/head repository/ref/SHA、合并时间和 merge commit。相同完整证据重试为 no-op；已有同号但缺审计签名时补写一次；编号或身份变化失败。不得调用 PR create 路径。
+成功绑定会原子写入 `pr_delivery_fact` 并追加 `Bind External PR` Activity Log，记录授权来源、Issue、PR URL/编号、base/head repository/ref/SHA、合并时间和 merge commit。相同完整证据重试为 no-op；已有同号但缺审计签名时补写一次；编号或身份变化失败。不得调用 PR create 路径。
 
 外部模式仍须通过身份、required-PR、本地生命周期与终态校验；review ledger、manual validation、post-review commit 和平台同步等外围证据在 lifecycle 后作为 warning/pending steps 投影。无 canonical review-code 时仅沿用 verifier 已定义的 N/A 规则；`--force` 不解除身份、本地原子性或 required-PR 硬门禁。

package/templates/.agents/skills/create-pr/SKILL.en.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # Create Pull Request
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 
 Create a Pull Request and, when task-related, sync the essential metadata and reviewer summary immediately.
@@ -19,7 +19,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 ## Task Context Resolution
 
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
+> The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve every other business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to the full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
 
 ## Step Start: started Marker
 
@@ -33,7 +33,7 @@ On a real `platform-pr create`, the typed core idempotently records `Create PR [
 
 Branch on the result:
 - absent / `"required"` -> continue to Step 1 below
-- `"disabled"` -> output the message below and **stop immediately**. Do not run any subsequent numbered step, do not trigger any PR-creation command, do not modify `pr_number` / `pr_status` in `task.md`, and do not publish a PR summary comment:
+- `"disabled"` -> output the message below and **stop immediately**. Do not run any subsequent numbered step, do not trigger any PR-creation command, do not modify `pr_delivery_fact` in `task.md`, and do not publish a PR summary comment:
 
 Populate `{next-step-commands}` for this scenario by running `agent-infra-internal agent-client next-steps --skill complete-task --task-ref {task-ref}`.
 
@@ -45,9 +45,7 @@ No Pull Request is required; run instead:
 
 ### 1. Parse Command Arguments
 
-Identify arguments from the command input:
-- arguments matching `TASK-{yyyyMMdd-HHmmss}` -> `{task-id}`
-- remaining arguments -> `{target-branch}`
+Parse the task scope first: an optional `--task <ref>` or `-t <ref>` selects `{task-id}`; a positional task ref is not interpreted. The remaining positional argument, when present, is `{target-branch}`.
 
 If `{task-id}` is provided, read `.agents/workspace/active/{task-id}/task.md` to load task metadata such as `issue_number` and `type`.
 If `{task-id}` is omitted, try to resolve it from the current session context; if it still cannot be determined, skip task-association logic in later steps.
@@ -66,7 +64,7 @@ Read the PR template through `.agents/rules/issue-pr-commands.md`, review recent
 
 ### 4. Check Remote Branch State
 
-Use `agent-infra-internal git-workflow inspect` for already-delivered upstream/remote facts. `create-pr` never performs the first push; a missing remote branch or a remote SHA that differs from local HEAD fails and points back to `commit`/push-only. Core rechecks the remote branch SHA before and immediately before bind, and requires exact repository/ref, base, and `head.sha` identity. A post-POST race never deletes the created PR or remote branch; the next retry recovers only by resource identity.
+Run `agent-infra-internal task-delivery {task-id} deliver --agent {standard-agent-token}` to deliver the task branch through one core. The core handles first creation, same-SHA no-op, a known-last-delivered SHA update with `--force-with-lease`, and unknown drift fail-closed. After delivery it verifies the remote SHA again and continues only when it equals local `HEAD`. Optional `--remote` / `--base` values must match the task binding. Core still rechecks the remote branch SHA before and immediately before bind, and requires exact repository/ref, base, and `head.sha` identity. A post-POST race never deletes the created PR or remote branch; the next retry recovers only by resource identity.
 
 ### 5. Create or Recover the PR
 
@@ -80,9 +78,9 @@ Capture the `result` field from `platform-pr create` (`pr_created`, `pr_reused`,
 
 ### 7. Generate the PR Code Change Report
 
-After creating or uniquely reusing the PR, run `agent-infra-internal platform-pr inspect {task-id}` to obtain the authoritative base/head SHAs, then follow `reference/change-report.md` to classify the complete PR additions/deletions, renames, and potentially unnecessary changes. Read that reference before this step.
+After creating or uniquely reusing the PR, run `agent-infra-internal platform-pr inspect {task-id}` to obtain the authoritative base/head SHAs, then follow `reference/change-report.md` to classify the complete PR line counts, Git blob byte sizes, renames, and potentially unnecessary changes. Read that reference before this step.
 
-The report is part of the reviewer summary below and must also appear in the final user response. Do not provide only a grand total or inspect only the last commit.
+The report is part of the reviewer summary below and must also appear in the final user response. Do not provide only total lines, omit byte changes, or inspect only the last commit.
 
 ### 8. Publish the Review Summary
 
@@ -94,7 +92,7 @@ Aggregate a reviewer-facing summary from those artifacts, append the `### PR Cod
 
 ### 9. Confirm Task Status
 
-After a PR is created or uniquely recovered, `platform-pr create` atomically updates `pr_number`, `pr_status`, canonical time/version metadata, and the Create PR completion log through the task write core. The caller verifies the structured result and does not edit those fields again.
+After a PR is created or uniquely recovered, `platform-pr create` atomically updates the verified `pr_delivery_fact`, canonical time/version metadata, and the Create PR completion log through the task write core. The caller verifies the structured result and does not edit the fact again.
 
 ### 10. Verification Gate
 
@@ -150,5 +148,5 @@ Next step (alternative) - Skip active monitoring and attempt completion:
 - Push rejected: suggest `git pull --rebase`
 - Existing PR found: show the current PR URL and stop
 - Inaccessible Issue metadata: skip inheritance and continue
-- PR creation failed with an associated `{task-id}`: run `agent-infra-internal task-warning {task-id} add --step create-pr --severity ACTION_REQUIRED --code PR_CREATE_FAILED --target pr --message "{reason}" --action "Fix push, permission, or platform issues and rerun create-pr"` to submit a structured warning intent, and do not write `pr_number`
+- PR creation failed with an associated `{task-id}`: run `agent-infra-internal task-warning {task-id} add --step create-pr --severity ACTION_REQUIRED --code PR_CREATE_FAILED --target pr --message "{reason}" --action "Fix push, permission, or platform issues and rerun create-pr"` to submit a structured warning intent, and do not write an incomplete `pr_delivery_fact`
 - PR summary comment failed with an associated `{task-id}`: record a `COMMENT_SYNC_FAILED` warning per `.agents/rules/pr-sync.md`, without rolling back an already-created PR

package/templates/.agents/skills/create-pr/SKILL.zh-CN.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # 创建 Pull Request
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 
 创建 Pull Request，并在与任务关联时立即补齐核心元数据和 reviewer 摘要。
@@ -19,7 +19,7 @@ description: >
 
 ## 任务上下文解析
 
-> 入口允许省略 task ref，也接受旧位置 task ref 或 `--task <ref>` / `-t <ref>`。先从完整参数中分离 task scope 并原样保留其他业务操作数，再调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空、位置 ref 或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为该完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
+> 入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。保留其余业务操作数后调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
 
 ## 步骤开始：started 标记
 
@@ -33,7 +33,7 @@ description: >
 
 按读取结果分支：
 - 缺省 / `"required"` → 继续到下方第 1 步
-- `"disabled"` → 输出以下消息后**立即停止**，不要执行任何后续编号步骤、不要触发任何 PR 创建命令、不要修改 `task.md` 的 `pr_number` / `pr_status`、不要发布 PR 摘要评论：
+- `"disabled"` → 输出以下消息后**立即停止**，不要执行任何后续编号步骤、不要触发任何 PR 创建命令、不要修改 `task.md` 的 `pr_delivery_fact`、不要发布 PR 摘要评论：
 
 使用 `agent-infra-internal agent-client next-steps --skill complete-task --task-ref {task-ref}` 生成本场景的 `{next-step-commands}`。
 
@@ -45,9 +45,7 @@ description: >
 
 ### 1. 解析命令参数
 
-从命令参数中识别：
-- 匹配 `TASK-{yyyyMMdd-HHmmss}` 格式的参数 -> `{task-id}`
-- 其余参数 -> `{target-branch}`
+先解析 task scope：可选的 `--task <ref>` 或 `-t <ref>` 绑定 `{task-id}`；位置 task ref 不再解释。剩余的可选位置参数绑定为 `{target-branch}`。
 
 如果提供了 `{task-id}`，读取 `.agents/workspace/active/{task-id}/task.md` 获取任务信息（例如 `issue_number`、`type` 等）。
 如果未提供，可从当前 session 上下文获取；仍无法确定 `{task-id}` 时，后续步骤中的任务关联逻辑跳过。
@@ -66,7 +64,7 @@ description: >
 
 ### 4. 检查远程分支状态
 
-调用 `agent-infra-internal git-workflow inspect` 检查已交付的 upstream/remote branch；`create-pr` 不执行首次 push，远端 branch 缺失或 SHA 与本地 HEAD 不一致时直接失败并指向 `commit`/push-only。随后在 locate/create/bind 前后再次读取远端 branch SHA，并要求 PR 的精确 repository/ref、base 和 `head.sha` 全部匹配；POST 后的竞态不自动删除已创建 PR 或远端 branch，下一次只按资源身份恢复。
+调用 `agent-infra-internal task-delivery {task-id} deliver --agent {standard-agent-token}` 统一交付任务分支。该 core 负责首次创建、相同 SHA no-op、已知最近交付 SHA 的 `--force-with-lease` 更新和未知漂移 fail-closed；交付成功后再次复核远端 SHA，并只在远端 branch SHA 等于本地 `HEAD` 时继续。可选的 `--remote` / `--base` 必须与任务已绑定值一致。随后在 locate/create/bind 前后再次读取远端 branch SHA，并要求 PR 的精确 repository/ref、base 和 `head.sha` 全部匹配；POST 后的竞态不自动删除已创建 PR 或远端 branch，下一次只按资源身份恢复。
 
 ### 5. 创建或恢复 PR
 
@@ -80,9 +78,9 @@ description: >
 
 ### 7. 生成 PR 代码增减报告
 
-创建或唯一复用 PR 后，调用 `agent-infra-internal platform-pr inspect {task-id}` 取得权威 base/head SHA，并按 `reference/change-report.md` 统计完整 PR 的分类增减、rename 与疑似不必要变化。执行本步骤前先读取该 reference。
+创建或唯一复用 PR 后，调用 `agent-infra-internal platform-pr inspect {task-id}` 取得权威 base/head SHA，并按 `reference/change-report.md` 统计完整 PR 的分类行数、Git blob 字节数、rename 与疑似不必要变化。执行本步骤前先读取该 reference。
 
-报告既是下方 reviewer 摘要的一部分，也必须出现在最终用户回复中；不得只给总行数或只统计最后一个 commit。
+报告既是下方 reviewer 摘要的一部分，也必须出现在最终用户回复中；不得只给总行数、忽略字节变化或只统计最后一个 commit。
 
 ### 8. 发布审查摘要
 
@@ -94,7 +92,7 @@ description: >
 
 ### 9. 确认任务状态
 
-`platform-pr create` 在成功创建或恢复唯一远端身份后，通过任务写入内核原子更新 `pr_number`、`pr_status`、规范时间/版本和 Create PR 完成日志。调用方只核对结构化结果，不再次编辑这些字段。
+`platform-pr create` 在成功创建或恢复唯一远端身份后，通过任务写入内核原子更新 verified `pr_delivery_fact`、规范时间/版本和 Create PR 完成日志。调用方只核对结构化结果，不再次编辑 fact。
 
 ### 10. 完成校验
 
@@ -151,5 +149,5 @@ agent-infra-internal task-verify {task-id} create-pr.completed --format text
 - 推送被拒绝：建议执行 `git pull --rebase`
 - 已存在 PR：直接输出当前 PR URL 并结束
 - 无法访问 Issue 元数据：跳过继承并继续
-- PR 创建失败且已关联 `{task-id}`：调用 `agent-infra-internal task-warning {task-id} add --step create-pr --severity ACTION_REQUIRED --code PR_CREATE_FAILED --target pr --message "{reason}" --action "修复推送、权限或平台问题后重跑 create-pr"` 提交结构化 warning 意图，不写 `pr_number`
+- PR 创建失败且已关联 `{task-id}`：调用 `agent-infra-internal task-warning {task-id} add --step create-pr --severity ACTION_REQUIRED --code PR_CREATE_FAILED --target pr --message "{reason}" --action "修复推送、权限或平台问题后重跑 create-pr"` 提交结构化 warning 意图，不写不完整 `pr_delivery_fact`
 - PR 摘要评论失败且已关联 `{task-id}`：按 `.agents/rules/pr-sync.md` 记录 `COMMENT_SYNC_FAILED` 告警，不回滚已创建 PR

package/templates/.agents/skills/create-pr/reference/change-report.en.md

@@ -1,7 +1,7 @@
 # PR Code Change Report
 
 <!-- pr-change-report-contract
-{"version":1,"source":"platform-pr-inspect","diff":"three-dot-find-renames-numstat","publish":["pr-summary","user-response"]}
+{"source":"platform-pr-inspect","diff":"three-dot-find-renames","metrics":["numstat-lines","git-blob-bytes"],"publish":["pr-summary","user-response"]}
 -->
 
 After a PR is created or uniquely reused, use the authoritative `base.sha` and `head.sha` returned by `platform-pr inspect` to measure the complete PR diff. Do not substitute the last commit or current worktree state.
@@ -9,12 +9,14 @@ After a PR is created or uniquely reused, use the authoritative `base.sha` and `
 ## Evidence Commands
 
 ```bash
-git diff --find-renames --numstat {base-sha}...{head-sha}
+node .agents/skills/create-pr/scripts/change-report.mjs --base {base-sha} --head {head-sha}
 git diff --find-renames --name-status {base-sha}...{head-sha}
 git diff --find-renames --summary {base-sha}...{head-sha}
 ```
 
-Count binary files in the file total but do not invent line counts for `-` numstat values. Explain renames and copies from `name-status` and `summary` separately so moves are not reported as full rewrites.
+The script calculates both `numstat` line counts and exact Git blob byte sizes between the merge base and head. Bytes provide a stable unit, cover binary files, and reveal same-line compaction; submodules are not blobs and contribute zero bytes. Added files have zero old bytes, deleted files have zero new bytes, pure renames have zero net bytes, and copies count only the new destination content.
+
+Count binary files in the file total but do not invent line counts for `-` numstat values. Explain renames and copies from the script's per-file records, `name-status`, and `summary` so moves are not reported as full rewrites.
 
 ## Classification and Reconciliation
 
@@ -27,13 +29,16 @@ Using the repository's actual structure, assign every file to exactly one closes
 - Documentation
 - Configuration, dependencies, and other files
 
-The table must contain component, file count, additions, deletions, and net change, followed by a total row. Category totals must reconcile exactly with the complete numstat total. Then list the largest changed files and distinguish source, tests, template mirrors, and pure renames.
+The table must contain component, file count, added lines, deleted lines, net lines, old bytes, new bytes, and net bytes, followed by a total row. Byte columns describe the blob content size of files involved in this change, not disk usage for the entire repository or worktree. Use exact integers; optional KiB/MiB values may aid readability but must not replace byte counts.
+
+Category line and byte totals must each reconcile exactly with the script's `totals`. Then list the largest files by line change and absolute net-byte change, distinguishing source, tests, template mirrors, and pure renames.
 
 ## Required Analysis
 
 Briefly explain:
 
 - where growth is concentrated and how runtime code compares with tests, docs, and templates;
+- whether net line and net byte changes tell different stories, especially for substantial same-line compaction or expansion;
 - which line changes are path moves, bilingual mirrors, or mechanical synchronization;
 - whether any change cannot be traced directly to the PR goal and may be unnecessary; if none, state the evidence;
 - when a test fixture is much larger than production changes, what risk it covers instead of judging it only by size.

package/templates/.agents/skills/create-pr/reference/change-report.zh-CN.md

@@ -1,7 +1,7 @@
 # PR 代码增减报告
 
 <!-- pr-change-report-contract
-{"version":1,"source":"platform-pr-inspect","diff":"three-dot-find-renames-numstat","publish":["pr-summary","user-response"]}
+{"source":"platform-pr-inspect","diff":"three-dot-find-renames","metrics":["numstat-lines","git-blob-bytes"],"publish":["pr-summary","user-response"]}
 -->
 
 PR 创建或复用成功后，使用 `platform-pr inspect` 返回的权威 `base.sha` 与 `head.sha` 统计完整 PR 差异，不以最后一个 commit 或工作树状态代替。
@@ -9,12 +9,14 @@ PR 创建或复用成功后，使用 `platform-pr inspect` 返回的权威 `base
 ## 证据命令
 
 ```bash
-git diff --find-renames --numstat {base-sha}...{head-sha}
+node .agents/skills/create-pr/scripts/change-report.mjs --base {base-sha} --head {head-sha}
 git diff --find-renames --name-status {base-sha}...{head-sha}
 git diff --find-renames --summary {base-sha}...{head-sha}
 ```
 
-`numstat` 中的二进制文件计入文件数，但不虚构行数。rename/copy 依据 `name-status` 与 `summary` 单独说明，避免把移动误报为整文件重写。
+脚本在 merge base 与 head 之间同时计算 `numstat` 行数和 Git blob 的精确字节数。字节比字符具有稳定口径，也能覆盖二进制文件和同行内缩减；子模块不是 blob，按 0 字节贡献核算。新增文件的旧字节数为 0，删除文件的新字节数为 0，纯 rename 的净字节数为 0，copy 只计新增目标内容。
+
+`numstat` 中的二进制文件计入文件数，但不虚构行数。rename/copy 依据脚本的逐文件记录、`name-status` 与 `summary` 单独说明，避免把移动误报为整文件重写。
 
 ## 分类与核算
 
@@ -27,13 +29,16 @@ git diff --find-renames --summary {base-sha}...{head-sha}
 - 文档
 - 配置、依赖与其他
 
-输出表格必须包含“部分、文件数、新增、删除、净增”，并有合计行。各类别之和必须与完整 `numstat` 总计一致。随后列出增减最大的文件，并区分源码、测试、模板镜像和纯 rename。
+输出表格必须包含“部分、文件数、新增行、删除行、净增行、旧字节、新字节、净字节”，并有合计行。字节列表示本次变更涉及文件的 blob 内容体积，不表示整个仓库或工作树的磁盘占用。使用精确整数；可附加 KiB/MiB 便于阅读，但不能替代字节数。
+
+各类别的行数和字节数之和必须分别与脚本的 `totals` 一致。随后分别列出行数变化和绝对净字节变化最大的文件，并区分源码、测试、模板镜像和纯 rename。
 
 ## 分析要求
 
 用简短结论回答：
 
 - 增长主要集中在哪里，运行时代码与测试/文档/模板各占多少；
+- 行数净变化与净字节变化是否给出不同结论，尤其指出同行内明显缩减或膨胀；
 - 哪些行数只是路径迁移、双语镜像或机械同步；
 - 是否存在与 PR 目标无法直接对应、疑似不必要的变化；若没有，明确说明判断依据；
 - 若某个测试 fixture 明显大于生产改动，解释它覆盖的风险，而不是仅以行数评价。

package/templates/.agents/skills/create-pr/scripts/change-report.mjs

@@ -0,0 +1,203 @@
+import { execFileSync } from "node:child_process";
+
+function fail(message) {
+  process.stderr.write(`${message}\n`);
+  process.exit(1);
+}
+
+function parseArgs(argv) {
+  const options = { cwd: process.cwd() };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    const value = argv[index + 1];
+
+    if ((argument === "--base" || argument === "--head" || argument === "--cwd") && value) {
+      options[argument.slice(2)] = value;
+      index += 1;
+      continue;
+    }
+
+    fail(`Unknown or incomplete argument: ${argument}`);
+  }
+
+  if (!options.base || !options.head) {
+    fail("Usage: change-report.mjs --base <sha> --head <sha> [--cwd <repository>]");
+  }
+
+  return options;
+}
+
+function git(args, options, encoding = "utf8") {
+  return execFileSync("git", args, {
+    cwd: options.cwd,
+    encoding,
+    maxBuffer: 64 * 1024 * 1024
+  });
+}
+
+function parseRawDiff(buffer) {
+  const tokens = buffer.toString("utf8").split("\0");
+  const files = [];
+
+  for (let index = 0; index < tokens.length && tokens[index];) {
+    const header = tokens[index++];
+    const [oldMode, newMode, oldOid, newOid, status] = header.slice(1).split(" ");
+    const firstPath = tokens[index++];
+    const hasPathPair = status.startsWith("R") || status.startsWith("C");
+    const secondPath = hasPathPair ? tokens[index++] : firstPath;
+
+    files.push({
+      status,
+      oldMode,
+      newMode,
+      oldOid,
+      newOid,
+      oldPath: status.startsWith("A") ? null : firstPath,
+      newPath: status.startsWith("D") ? null : secondPath
+    });
+  }
+
+  return files;
+}
+
+function parseNumstat(buffer) {
+  const tokens = buffer.toString("utf8").split("\0");
+  const stats = new Map();
+
+  for (let index = 0; index < tokens.length && tokens[index];) {
+    const record = tokens[index++];
+    const firstTab = record.indexOf("\t");
+    const secondTab = record.indexOf("\t", firstTab + 1);
+    const additions = record.slice(0, firstTab);
+    const deletions = record.slice(firstTab + 1, secondTab);
+    const path = record.slice(secondTab + 1);
+
+    if (path) {
+      stats.set(`path:${path}`, { additions, deletions });
+      continue;
+    }
+
+    const oldPath = tokens[index++];
+    const newPath = tokens[index++];
+    stats.set(`pair:${oldPath}\0${newPath}`, { additions, deletions });
+  }
+
+  return stats;
+}
+
+function objectSizes(files, options) {
+  const objectIds = new Set();
+
+  for (const file of files) {
+    if (file.oldMode !== "000000" && file.oldMode !== "160000" && !file.status.startsWith("C")) {
+      objectIds.add(file.oldOid);
+    }
+    if (file.newMode !== "000000" && file.newMode !== "160000") {
+      objectIds.add(file.newOid);
+    }
+  }
+
+  if (objectIds.size === 0) return new Map();
+
+  const ids = [...objectIds];
+  const output = execFileSync(
+    "git",
+    ["cat-file", "--batch-check=%(objectname) %(objecttype) %(objectsize)"],
+    {
+      cwd: options.cwd,
+      input: `${ids.join("\n")}\n`,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024
+    }
+  );
+  const sizes = new Map();
+
+  for (const line of output.trim().split("\n")) {
+    const [oid, type, size] = line.split(" ");
+    if (type === "blob") sizes.set(oid, Number(size));
+  }
+
+  return sizes;
+}
+
+function numericLineCount(value) {
+  return value === "-" ? null : Number(value);
+}
+
+function main() {
+  const options = parseArgs(process.argv.slice(2));
+  const mergeBase = git(["merge-base", options.base, options.head], options).trim();
+  const diffArgs = ["diff", "--no-ext-diff", "--find-renames", "-z", mergeBase, options.head];
+  const files = parseRawDiff(git([...diffArgs.slice(0, 2), "--raw", "--abbrev=64", ...diffArgs.slice(2)], options, null));
+  const numstat = parseNumstat(git([...diffArgs.slice(0, 2), "--numstat", ...diffArgs.slice(2)], options, null));
+  const sizes = objectSizes(files, options);
+
+  const reportFiles = files.map((file) => {
+    const key = file.status.startsWith("R") || file.status.startsWith("C")
+      ? `pair:${file.oldPath}\0${file.newPath}`
+      : `path:${file.newPath || file.oldPath}`;
+    const lines = numstat.get(key);
+    if (!lines) fail(`Missing numstat record for ${file.newPath || file.oldPath}`);
+
+    const oldBytes = file.oldMode === "000000" || file.oldMode === "160000" || file.status.startsWith("C")
+      ? 0
+      : sizes.get(file.oldOid);
+    const newBytes = file.newMode === "000000" || file.newMode === "160000"
+      ? 0
+      : sizes.get(file.newOid);
+    if (oldBytes === undefined || newBytes === undefined) {
+      fail(`Unable to resolve blob size for ${file.newPath || file.oldPath}`);
+    }
+
+    return {
+      status: file.status,
+      oldPath: file.oldPath,
+      newPath: file.newPath,
+      additions: numericLineCount(lines.additions),
+      deletions: numericLineCount(lines.deletions),
+      oldBytes,
+      newBytes,
+      netBytes: newBytes - oldBytes
+    };
+  });
+
+  const totals = reportFiles.reduce((result, file) => {
+    result.files += 1;
+    result.oldBytes += file.oldBytes;
+    result.newBytes += file.newBytes;
+    result.netBytes += file.netBytes;
+    if (file.additions === null || file.deletions === null) {
+      result.binaryFiles += 1;
+    } else {
+      result.textFiles += 1;
+      result.additions += file.additions;
+      result.deletions += file.deletions;
+    }
+    return result;
+  }, {
+    files: 0,
+    textFiles: 0,
+    binaryFiles: 0,
+    additions: 0,
+    deletions: 0,
+    oldBytes: 0,
+    newBytes: 0,
+    netBytes: 0
+  });
+
+  process.stdout.write(`${JSON.stringify({
+    version: 1,
+    base: options.base,
+    head: options.head,
+    mergeBase,
+    files: reportFiles,
+    totals
+  }, null, 2)}\n`);
+}
+
+try {
+  main();
+} catch (error) {
+  fail(error instanceof Error ? error.message : String(error));
+}

package/templates/.agents/skills/create-release-note/SKILL.en.md

@@ -109,13 +109,12 @@ If no historical release notes exist, use the following default Markdown format:
      - Commit co-authors from the typed context's commit `authors`
      - Issue reporters from typed `closingIssues[].author`
    - **Contribution count**: `PR count + co-authored commit count` for the same identity, merged across both sources
-   - **Name -> `@login` mapping**:
-     - For `platform-user` or `platform-noreply`, use the lowercased `login`
-     - Only for `unresolved`, use the Name heuristic: take the first token before a space and lowercase it
-     - If the login already appears in the PR author list, merge counts into that login so `Claude` and `@claude` do not become separate entries
-     - Merge all Name variants that map to the same login before counting and sorting; for example, `Claude` and `Claude Opus 4.6 (1M context)` should both collapse into `@claude`
+   - **`@login` mapping**: follow the identity safety boundary in `.agents/rules/release-commands.md`
+     - For `platform-user` or `platform-noreply` with a non-empty `login`, use the lowercased `login`
+     - Exclude `unresolved` identities from the contributor list; never infer a login from a name, email address, domain, brand, or same-named platform account
+     - Merge all Name variants carrying the same typed login before counting and sorting
      - Preserve bot identities as-is, for example `dependabot[bot]`
-     - If the login still cannot be determined reliably, output `@{lowercased first Name token}` and append `<!-- TODO(reviewer): confirm platform login for {original Name <email>} -->` below the `Contributors` section
+     - Do not add unresolved identity emails, placeholder mentions, or identity-verification TODOs to publishable notes
    - **Sorting**: descending by contribution count, then lexicographically by login for ties
    - **Deduplication**: use the final mapped `@login` as the key
    - **Issue reporter rules**:

package/templates/.agents/skills/create-release-note/SKILL.zh-CN.md

@@ -109,13 +109,12 @@ agent-infra-internal platform-release-notes context \
      - Commit co-authors：来自步骤 3 typed context 的 commit `authors`
      - Issue reporters：来自步骤 3 typed context 的 `closingIssues[].author`
    - **贡献数定义**：`该人的 PR 数 + 该人作为 co-author 的 commit 数`（同一身份跨来源合并计数）
-   - **Name → `@login` 映射**：
-     - `resolution` 为 `platform-user` 或 `platform-noreply` 时直接采用小写 `login`
-     - 仅当 `resolution` 为 `unresolved` 时按 Name 启发式：取首个空格前的 token 并转为小写
-     - 已出现在 PR author 列表中的 login，必须按该 login 合并计数，避免把 `Claude` 和 `@claude` 拆成两个条目
-     - 同一 login 的所有 Name 变体都必须归并后再计数与排序；例如 `Claude` 与 `Claude Opus 4.6 (1M context)` 都映射到 `@claude` 时，应先合并为同一个贡献者
+   - **`@login` 映射**：遵循 `.agents/rules/release-commands.md` 的身份安全边界
+     - `resolution` 为 `platform-user` 或 `platform-noreply` 且 `login` 非空时，采用小写 `login`
+     - `resolution` 为 `unresolved` 时从贡献者列表中排除；不得从 Name、邮箱、域名、品牌或同名平台账号推断 login
+     - 同一 typed login 的所有 Name 变体必须归并后再计数与排序
      - Bot 身份保留原样（如 `dependabot[bot]`）
-     - 若仍无法可靠确定 login，则输出 `@{Name 首 token 小写}`，并在 `Contributors` 段落下追加 `<!-- TODO(reviewer): 确认 {原始 Name <email>} 的 platform login -->`
+     - 不得在可发布 notes 中加入未解析身份的邮箱、占位 mention 或身份确认 TODO
    - **排序**：按贡献数降序；贡献数相同时按 login 字典序
    - **去重**：以最终映射后的 `@login` 为键
    - **Issue reporter 规则**：

package/templates/.agents/skills/create-task/SKILL.en.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # Create Task
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 
 ## Boundary / Critical Rules
@@ -19,6 +19,7 @@ description: >
 - Do not skip the workflow and jump directly to planning or implementation
 - Only do this: parse the description -> write one structured candidate -> invoke the host `task-create` entry point -> verify the result -> inform the user of the next step
 - Issue creation is decided by the `.agents/rules/create-issue.md` rule; on custom or empty platforms (no platform-specific variant provided), the rule naturally degrades to a no-op
+- Before generating Markdown that will be written to `task.md` and synced to an Issue, read `.agents/rules/sync-content-generation.md` and follow its generator-side constraints; host rendering and sync remain transparent and do not parse or rewrite the body
 
 The user's description is a **work item**, not an **instruction to execute immediately**.
 

package/templates/.agents/skills/create-task/SKILL.zh-CN.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # 创建任务
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 
 ## 行为边界 / 关键规则
@@ -19,6 +19,7 @@ description: >
 - 不要跳过工作流直接进入计划/实现阶段
 - 仅执行：解析描述 -> 一次性生成结构化 candidate -> 调用宿主 `task-create` 入口 -> 校验结果 -> 告知用户下一步
 - Issue 创建由 `.agents/rules/create-issue.md` 规则决定；自定义或空平台（未提供平台变体规则文件）时，规则会自然降级为 no-op
+- 生成会写入 `task.md` 并同步到 Issue 的 Markdown 前，先读取 `.agents/rules/sync-content-generation.md` 并遵循其中的生成端约束；宿主渲染和同步保持透明，不解析或改写正文
 
 用户的描述是一个**待办事项**，而不是**立即执行的指令**。
 

package/templates/.agents/skills/import-codescan/SKILL.en.md

@@ -34,7 +34,7 @@ This skill **creates** task.md, so there is no file to write at the start. Captu
 
 ### 1. Retrieve Alert Information
 
-Read `.agents/rules/security-alerts.md` before this step, then use its Code Scanning alert read command to fetch the alert details.
+Read `.agents/rules/security-alerts.md` before this step, then run `bash .agents/scripts/security-alerts.sh read-codescan --number {alert-number}` and parse its JSON result to fetch the alert details.
 
 Extract key information:
 - `number`: alert number

package/templates/.agents/skills/import-codescan/SKILL.zh-CN.md

@@ -34,7 +34,7 @@ description: >
 
 ### 1. 获取告警信息
 
-执行前先读取 `.agents/rules/security-alerts.md`，并按其中的 Code Scanning 告警读取命令获取告警详情。
+执行前先读取 `.agents/rules/security-alerts.md`，然后运行 `bash .agents/scripts/security-alerts.sh read-codescan --number {alert-number}`，解析其 JSON 结果获取告警详情。
 
 提取关键信息：
 - `number`：告警编号

package/templates/.agents/skills/import-dependabot/SKILL.en.md

@@ -34,7 +34,7 @@ This skill **creates** task.md, so there is no file to write at the start. Captu
 
 ### 1. Retrieve Alert Information
 
-Read `.agents/rules/security-alerts.md` before this step, then use its Dependabot alert read command to fetch the alert details.
+Read `.agents/rules/security-alerts.md` before this step, then run `bash .agents/scripts/security-alerts.sh read-dependabot --number {alert-number}` and parse its JSON result to fetch the alert details.
 
 Extract key information:
 - `number`: alert number

package/templates/.agents/skills/import-dependabot/SKILL.zh-CN.md

@@ -34,7 +34,7 @@ description: >
 
 ### 1. 获取告警信息
 
-执行前先读取 `.agents/rules/security-alerts.md`，并按其中的 Dependabot 告警读取命令获取告警详情。
+执行前先读取 `.agents/rules/security-alerts.md`，然后运行 `bash .agents/scripts/security-alerts.sh read-dependabot --number {alert-number}`，解析其 JSON 结果获取告警详情。
 
 提取关键信息：
 - `number`：告警编号

package/templates/.agents/skills/import-issue/SKILL.en.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # Import Issue
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 
 Import the specified Issue and create a task. Argument: issue number.

package/templates/.agents/skills/import-issue/SKILL.zh-CN.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # 导入 Issue
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 
 导入指定的 Issue 并创建任务。参数：issue 编号。