@fitlab-ai/agent-infra 0.9.13 → 0.9.14

package/templates/.agents/skills/close-dependabot/SKILL.en.md

@@ -23,7 +23,7 @@ The skill still owns the security-alert API. When a related task exists, Step 7
 
 ### 1. Retrieve Alert Information
 
-Read `.agents/rules/security-alerts.md` before this step, then run `bash .agents/scripts/security-alerts.sh read-dependabot --number {alert-number}` and parse its JSON result to fetch the alert details.
+Read `.agents/rules/security-alerts.md` before this step, then run `agent-infra-internal platform-security read --kind dependabot --number {alert-number}` and parse its JSON result to fetch the alert details.
 
 Verify that the alert is in the `open` state. If it is already dismissed or fixed, inform the user and exit.
 
@@ -77,7 +77,7 @@ Confirm? (y/N)
 
 ### 6. Execute the Dismissal
 
-Write the user's explanation to `{comment-file}`, then run `bash .agents/scripts/security-alerts.sh dismiss-dependabot --number {alert-number} --reason {api-reason} --comment-file {comment-file}`. Parse the JSON result and continue only when the dismissal is `applied` or `no-op`.
+Write the user's explanation to `{comment-file}`, then run `agent-infra-internal platform-security dismiss --kind dependabot --number {alert-number} --reason {api-reason} --comment-file {comment-file}`. Parse the JSON result and continue only when the dismissal is `applied` or `no-op`.
 
 **API reason mapping**:
 - False Positive -> `not_used` or `inaccurate`

package/templates/.agents/skills/close-dependabot/SKILL.zh-CN.md

@@ -23,7 +23,7 @@ description: >
 
 ### 1. 获取告警信息
 
-执行前先读取 `.agents/rules/security-alerts.md`，然后运行 `bash .agents/scripts/security-alerts.sh read-dependabot --number {alert-number}`，解析其 JSON 结果获取告警详情。
+执行前先读取 `.agents/rules/security-alerts.md`，然后运行 `agent-infra-internal platform-security read --kind dependabot --number {alert-number}`，解析其 JSON 结果获取告警详情。
 
 验证告警处于 `open` 状态。如果已被关闭/修复，告知用户并退出。
 
@@ -77,7 +77,7 @@ CVE：{cve-id}
 
 ### 6. 执行关闭
 
-将用户说明写入 `{comment-file}`，然后运行 `bash .agents/scripts/security-alerts.sh dismiss-dependabot --number {alert-number} --reason {api-reason} --comment-file {comment-file}`。解析 JSON 结果，仅当关闭状态为 `applied` 或 `no-op` 时继续。
+将用户说明写入 `{comment-file}`，然后运行 `agent-infra-internal platform-security dismiss --kind dependabot --number {alert-number} --reason {api-reason} --comment-file {comment-file}`。解析 JSON 结果，仅当关闭状态为 `applied` 或 `no-op` 时继续。
 
 **API reason 映射**：
 - 误报 -> `not_used` 或 `inaccurate`

package/templates/.agents/skills/code-task/SKILL.en.md

@@ -15,6 +15,11 @@ Implement the approved plan and produce `code.md` or `code-r{N}.md`. This skill
 
 ## Boundary / Critical Rules
 
+### Persisted Report Evidence
+
+Before generating the implementation report, read `.agents/rules/evidence-reporting.md`. Successful tests record the command, target scope, status or structured result, actual result, and uncovered parts; failures, blocking conditions, or disputes retain a reproducible entry point, exact location, and decisive excerpt instead of complete successful stdout.
+
+- When evaluating candidate qualification or `HD-N`, read `.agents/rules/decision-qualification.md`, audit normalized task constraints/candidates, and record the five qualification-audit tables in the implementation report; unknown or unconfirmed constraints must not automatically exclude a candidate
 - Follow the latest plan artifact: `plan.md` or `plan-r{N}.md`
 - Before generating task or lifecycle Markdown that will be synchronized to an Issue, read `.agents/rules/sync-content-generation.md` and apply its producer-side constraints; the sync path does not parse or rewrite the body
 - Read `.agents/rules/compatibility-policy.md` before implementation. Implement only the compatibility budget explicitly approved by the plan; never retain old branches, result contracts, or migration shims merely to be “safe”
@@ -31,7 +36,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 After loading workflow / skill / rules instructions, and before any task-state judgment or user-visible conclusion, run the state check first.
 
-Run these commands and paste the raw output into this round's `## State Check` section:
+Run these commands and record the task/artifact scope, key result, and uncovered parts in this round's `## State Check` section; do not paste complete directory listings or task tails on normal success. Retain decisive raw lines only for failures, blocking conditions, identity mismatches, or disputes:
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -111,6 +116,14 @@ After the checkpoint succeeds, when task.md has an `issue_number`, run `agent-in
 
 ### 9. Write the Code Report
 
+Before writing this round's `{code-artifact}`, create the controlled report skeleton:
+
+```bash
+agent-infra-internal task-artifact {task-id} init --family code --artifact {code-artifact} --locale en
+```
+
+The skeleton contains identity metadata, stable section markers, and required headings only; real implementation and verification content is required before the completion gate can pass. If the finalizer returns one provably safe structural error, call `task-artifact {task-id} repair --family code --artifact {code-artifact} --expected-sha256 {artifact-sha256} --expected-semantic-digest {semantic-digest}`, then rerun the same finalizer.
+
 Create `.agents/workspace/active/{task-id}/{code-artifact}`.
 
 > Read `reference/report-template.md` before writing the report.

package/templates/.agents/skills/code-task/SKILL.zh-CN.md

@@ -15,6 +15,11 @@ description: >
 
 ## 行为边界 / 关键规则
 
+### 持久化报告证据
+
+生成实现报告时，先读取 `.agents/rules/evidence-reporting.md`。成功测试记录命令、目标范围、状态/结构化结果、实际结果和未覆盖部分；失败、阻塞或争议保留复现入口、准确位置和决定性摘录，不默认粘贴完整成功 stdout。
+
+- 涉及候选资格或 `HD-N` 判断时，先读取 `.agents/rules/decision-qualification.md`，基于 task.md 规范化约束/候选完成资格审计，并在实现报告记录五张资格审计表；不得把来源不明或未确认约束自动升级为排除条件
 - 严格遵循最新方案产物：`plan.md` 或 `plan-r{N}.md`
 - 生成会同步到 Issue 的任务或生命周期 Markdown 前，先读取 `.agents/rules/sync-content-generation.md` 并遵循其中的生成端约束；同步端不解析或改写正文
 - 实现前读取 `.agents/rules/compatibility-policy.md`；只实现方案明确批准的兼容预算，不以“稳妥”为由保留旧分支、旧结果契约或迁移 shim
@@ -44,7 +49,7 @@ description: >
 
 在加载 workflow / skill / rules 指令之后、做任何任务状态判断或用户可见结论之前，必须先执行状态核对。指令类文件读取不算对外动作或结论。
 
-运行以下命令，并把原文粘贴到本轮产物的 `## 状态核对` 段：
+运行以下命令，并在本轮产物的 `## 状态核对` 段记录任务/产物范围、关键结果和未覆盖部分；正常成功不粘贴完整目录清单或 `task.md` 尾部。失败、阻塞、身份不一致或争议时，附决定性原文行：
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -151,6 +156,14 @@ checkpoint 成功后，若任务存在 `issue_number`，调用 `agent-infra-inte
 
 ### 9. 编写实现报告
 
+在首次写入本轮 `{code-artifact}` 前，先创建受控报告骨架：
+
+```bash
+agent-infra-internal task-artifact {task-id} init --family code --artifact {code-artifact}
+```
+
+骨架只包含身份元数据、稳定 section marker 和必需标题；必须填入真实实现与验证内容后才能通过完成门禁。finalizer 返回可证明的单个结构错误时，使用其 SHA 和 semantic digest 调用 `task-artifact {task-id} repair --family code --artifact {code-artifact} --expected-sha256 {artifact-sha256} --expected-semantic-digest {semantic-digest}`，然后完整重跑 finalizer。
+
 创建 `.agents/workspace/active/{task-id}/{code-artifact}`。
 
 > 报告结构、必填章节和完整模板见 `reference/report-template.md`。写报告前先读取 `reference/report-template.md`。

package/templates/.agents/skills/code-task/config/verify.en.json

@@ -17,26 +17,17 @@
     },
     "artifact": {
       "file_pattern": "code.md|code-r{N}.md",
-      "required_sections": [
-        "Implementation Input",
-        "Modified Files",
-        "Key Code Explanation",
-        "Test Results",
-        "Differences from Plan",
-        "Items for Review",
-        "State Check",
-        "Evidence"
-      ],
-      "required_patterns": [
-        "^\\$ "
-      ]
+      "schema": "code"
     },
     "implementation-input": {},
     "activity-log": {
       "expected_action_pattern": "(Code Task|Code) \\(Round \\d+(?:(?:, fix for review-code(?:-r\\d+)?\\.md)|(?:, decision II-[1-9]\\d*))?\\)"
     },
     "review-ledger": {
-      "stage_scope": ["analysis", "plan"]
+      "stage_scope": [
+        "analysis",
+        "plan"
+      ]
     },
     "platform-sync": {
       "when": "issue_number_exists",

package/templates/.agents/skills/code-task/config/verify.zh-CN.json

@@ -17,26 +17,17 @@
     },
     "artifact": {
       "file_pattern": "code.md|code-r{N}.md",
-      "required_sections": [
-        "实现输入",
-        "变更文件",
-        "关键代码说明",
-        "测试结果",
-        "与方案的差异",
-        "供审查关注的内容",
-        "状态核对",
-        "证据原文"
-      ],
-      "required_patterns": [
-        "^\\$ "
-      ]
+      "schema": "code"
     },
     "implementation-input": {},
     "activity-log": {
       "expected_action_pattern": "(Code Task|Code) \\(Round \\d+(?:(?:, fix for review-code(?:-r\\d+)?\\.md)|(?:, decision II-[1-9]\\d*))?\\)"
     },
     "review-ledger": {
-      "stage_scope": ["analysis", "plan"]
+      "stage_scope": [
+        "analysis",
+        "plan"
+      ]
     },
     "platform-sync": {
       "when": "issue_number_exists",

package/templates/.agents/skills/code-task/reference/code-rules.en.md

@@ -16,26 +16,27 @@ Follow the `code` step in `.agents/workflows/feature-development.yaml`.
 **Implementation principles**:
 1. **Follow the plan strictly**: do not deviate from the technical plan
 2. **Work step by step**: execute the planned sequence
-3. **Keep testing continuously**: run the **smoke subset** continuously as work progresses (see the `test` skill)
+3. **Keep testing continuously**: run the **fast smoke subset** continuously as work progresses (see the `test` skill)
 4. **Keep it simple**: do not add unplanned features
 
 ## Run Test Verification
 
 During implementation:
-- **Inner loop**: after each change, run the project's **smoke subset** (see the `test` skill) for fast feedback
+- **Inner loop**: after each change, run the project's **fast smoke subset** (see the `test` skill) for fast feedback without repeating the build
+- **After each implementation step**: run the **smoke subset** to verify the complete build and unit tests
 - **Before writing the code report**: run the **core subset** as final verification so code entering review has passed the complete core checks
 
 > Refer to the `test` skill for project-specific commands; downstream projects without layered scripts should fall back to the full project test command.
 
 If tests fail:
 - analyze the failure first and prioritize fixing issues introduced by this implementation
-- after each fix, re-run at least the smoke subset, then upgrade to core for the next full-pass verification
+- after each fix, re-run at least the fast smoke subset; after completing the implementation step, run smoke, then upgrade to core for the next full-pass verification
 - only stop without producing the implementation artifact when the failure is caused by an external blocker, missing environment, or unclear requirement that cannot be resolved inside the task
 
 Two-way failure handling:
 1. implementation-caused failures:
    - fix the code, tests, docs, or fixtures introduced by this implementation
-   - re-run tests after each fix (smoke for the immediate fix verification, core for the round-level verification)
+   - re-run tests after each fix (fast smoke for the immediate fix verification, smoke for complete-build verification, core for the round-level verification)
    - continue until all required tests pass
 2. external blockers:
    - confirm the failure comes from missing environment, unrelated upstream breakage, or unclear requirements outside this task

package/templates/.agents/skills/code-task/reference/code-rules.zh-CN.md

@@ -16,26 +16,27 @@
 **实现原则**：
 1. **严格遵循方案**：不要偏离技术方案
 2. **按步骤推进**：按计划顺序执行
-3. **持续测试**：实现过程中持续运行 **smoke 子集**（参见 `test` skill）
+3. **持续测试**：实现过程中持续运行 **fast smoke 子集**（参见 `test` skill）
 4. **保持简单**：不要加入未计划的功能
 
 ## 运行测试验证
 
 实现过程中：
-- **内循环**：每次修改后运行项目测试的 **smoke 子集**（参见 `test` skill），快速反馈
+- **内循环**：每次修改后运行项目测试的 **fast smoke 子集**（参见 `test` skill），快速反馈且不重复构建
+- **完成一个实施步骤后**：运行 **smoke 子集**，验证完整构建及单元测试
 - **写实现报告前**：运行 **core 子集**做最终验证，确保进入审查的代码已通过完整的核心测试
 
 > 项目特定命令请参考 `test` skill；不存在分层 script 的下游项目回退到完整项目测试命令。
 
 如果测试失败：
 - 先分析失败原因，并优先修复由本次实现引入的问题
-- 每次修复后重新运行至少 smoke 子集，进入下一轮再升级到 core
+- 每次修复后重新运行至少 fast smoke 子集，完成实施步骤后再运行 smoke，并在进入下一轮前升级到 core
 - 只有当失败由外部阻塞、环境缺失或当前任务内无法澄清的需求问题导致时，才允许在不生成实现产物的情况下停止
 
 双分支失败处理：
 1. 本次实现引入的失败：
    - 修复由本次实现引入的代码、测试、文档或 fixture 问题
-   - 每次修复后重新运行测试（smoke 用于本次修复验证，core 用于本轮整体验证）
+   - 每次修复后重新运行测试（fast smoke 用于本次修复验证，smoke 验证完整构建，core 用于本轮整体验证）
    - 持续处理直到所有必需测试通过
 2. 外部阻塞：
    - 确认失败来自缺失环境、无关的上游损坏，或任务范围外的需求不明确

package/templates/.agents/skills/code-task/reference/dual-mode.en.md

@@ -20,7 +20,7 @@ The core scans `plan.md` / `plan-r{N}.md`, `review-plan.md` / `review-plan-r{N}.
 |---|---|---:|---|
 | no code artifact, and the latest review-plan is exactly `Approved` and references the latest plan | `init` | 0 | initial implementation, output `code.md`; a missing matching approval or `Approved-with-issues` returns an error |
 | latest review-plan is exactly `Approved`, references the latest plan, and the latest code completion receipt does not bind the same plan digest | `init` | 0 | enter a new implementation round. `Approved-with-issues` remains parse-compatible for history but is not cross-stage approval; missing or invalid receipts fail closed |
-| `rev_max < code_max` | `error` | 2 | latest code round is unreviewed; run `review-code` first |
+| the latest review-code completion receipt does not bind the latest code identity/SHA | `error` | 2 | latest code is unreviewed; run `review-code`; code and review-code family rounds may advance independently |
 | latest review-code is Approved and a pending implementation input was decided after that review completed | `decision` | 0 | select the earliest `II-N` and enter decision-driven implementation; false/not-required and consumed inputs do not trigger |
 | latest review-code is Approved with 0/0/0 | `refused` | 1 | already approved; do not run `code-task` again |
 | latest review-code is Approved with major/minor findings | `fix` | 0 | optional fix mode |

package/templates/.agents/skills/code-task/reference/dual-mode.zh-CN.md

@@ -20,7 +20,7 @@ agent-infra-internal task-artifact {task-id} inspect --family code
 |---|---|---:|---|
 | 无 code 产物，且最新 review-plan 精确为 `Approved` 并引用最新 plan | `init` | 0 | 初次实现，产物为 `code.md`；缺少匹配审批或为 `Approved-with-issues` 时返回 error |
 | 最新 review-plan 精确为 `Approved`，且其「审查输入」/「Review Input」字段引用最新 plan，而最新 code 的完成 receipt 未绑定相同 plan 摘要 | `init` | 0 | plan 内容在 code 输入之后获批；进入新一轮实现。`Approved-with-issues` 仅保留历史解析兼容，不构成跨阶段批准；缺失或无效 receipt 失败关闭 |
-| `rev_max < code_max` | `error` | 2 | 最新代码未审查，先运行 `review-code` |
+| 最新 review-code 的完成收据未绑定最新 code identity/SHA | `error` | 2 | 最新代码未审查，先运行 `review-code`；code 与 review-code 的 family 轮次可独立增长 |
 | 最新 review-code 为 Approved 且存在审查完成后产生的 pending 实现输入 | `decision` | 0 | 选择最早 `II-N`，进入裁决驱动实现；false/not-required 与 consumed 输入不触发 |
 | 最新 review-code 为 Approved 且 0/0/0 | `refused` | 1 | 已通过，无需再次运行 `code-task` |
 | 最新 review-code 为 Approved 但有 major/minor | `fix` | 0 | 可选修复模式 |

package/templates/.agents/skills/code-task/reference/fix-mode.en.md

@@ -41,7 +41,9 @@ For each fix:
 1. read the affected files
 2. apply the smallest necessary change
 3. verify the change addresses the review feedback
-4. run the project's **smoke subset** for immediate feedback (see the `test` skill)
+4. run the project's **fast smoke subset** for immediate feedback (see the `test` skill)
+
+After completing the repair round, run the **smoke subset** to verify the complete build and unit tests.
 
 ## Run Test Verification
 

package/templates/.agents/skills/code-task/reference/fix-mode.zh-CN.md

@@ -41,7 +41,9 @@ manual-validation 项不在修复范围。处理规则：
 1. 读取受影响文件
 2. 施加最小必要改动
 3. 验证改动确实解决了审查反馈
-4. 运行项目测试的 **smoke 子集**做即时反馈（参见 `test` skill）
+4. 运行项目测试的 **fast smoke 子集**做即时反馈（参见 `test` skill）
+
+完成本轮修复后，运行 **smoke 子集**，验证完整构建及单元测试。
 
 ## 运行测试验证
 

package/templates/.agents/skills/code-task/reference/report-template.en.md

@@ -1,5 +1,7 @@
 # Code Report Template
 
+> Before writing this report, use `task-artifact init` to create the skeleton and preserve every `artifact-section` marker; the skeleton contains no semantic result.
+
 Use this structure when creating `code.md` or `code-r{N}.md`.
 
 ## Output Template
@@ -20,11 +22,31 @@ Use this structure when creating `code.md` or `code-r{N}.md`.
 - **Decision Evidence**: `{decision-evidence or N/A}`
 - **Scope Summary**: {scope of this round's implementation input}
 
-## State Check
+## Qualification Audit
+
+> Use `.agents/rules/decision-qualification.md` and fill these five tables.
+
+### Constraint Dependencies
+| constraint_id | constraint_digest | role | evidence |
+| --- | --- | --- | --- |
+
+### Candidate Qualification
+| candidate_id | status | impact | constraint_ids | evidence |
+| --- | --- | --- | --- | --- |
+
+### Classification Results
+| decision_id | classification | evidence |
+| --- | --- | --- |
 
-> Paste the raw state-check command output; each command starts with `$ `.
+### Upstream Relations
+| upstream_family | upstream_artifact | upstream_round | upstream_sha256 | relation |
+| --- | --- | --- | --- | --- |
 
-## Modified Files
+### Dependency Snapshot
+| task_input_digest | non_constraint_input_digest | upstream_artifact_digest |
+| --- | --- | --- |
+
+## Changed Files
 
 ### New Files
 - `{file-path}` - {description}
@@ -32,7 +54,7 @@ Use this structure when creating `code.md` or `code-r{N}.md`.
 ### Modified Files
 - `{file-path}` - {change summary}
 
-## Key Code Explanation
+## Key Code Notes
 
 ### {Module/Feature Name}
 **File**: `{file-path}:{line-number}`
@@ -58,16 +80,6 @@ Use this structure when creating `code.md` or `code-r{N}.md`.
 ```
 
 
-## Evidence
-
-> Pair each "I verified X" claim with the corresponding raw tool output; the gate only checks that this section exists and at least one `$ ` line is present.
-
-- Claim: {verified claim}
-```text
-$ {command}
-{raw output}
-```
-
 ## Differences from Plan
 
 {describe any deviation from the approved plan}
@@ -80,12 +92,27 @@ $ {command}
 |------|----------|----------|
 | {finding} | {accepted / adjusted / refuted / cannot-judge} | {fix file:line, or counter-evidence file:line / raw command output} |
 
-## Items for Review
+## Review Focus
 
 **Focus areas for reviewers**:
 - {item 1}
 - {item 2}
 
+## State Check
+
+> Record the state-check command, task/artifact scope, key result, and uncovered parts; each command starts with `$ `.
+> Follow `.agents/rules/evidence-reporting.md`: record task/artifact scope, key result, and uncovered parts; do not paste complete successful stdout.
+
+## Raw Evidence
+
+> Follow `.agents/rules/evidence-reporting.md`: pair each claim with a `$ ` command and proportionate result summary; include a decisive raw excerpt only for failures, blocking conditions, or disputes.
+
+- Claim: {verified claim}
+```text
+$ {command}
+{result summary or decisive excerpt}
+```
+
 ## Known Issues
 
 {known issues or follow-up ideas}

package/templates/.agents/skills/code-task/reference/report-template.zh-CN.md

@@ -1,5 +1,7 @@
 # 实现报告模板
 
+> 写入本报告前，先用 `task-artifact init` 创建对应骨架，并保留每个 `artifact-section` marker；骨架不包含语义结果。
+
 创建 `code.md` 或 `code-r{N}.md` 时，使用以下结构。
 
 ## 输出模板
@@ -20,9 +22,29 @@
 - **裁决证据**：`{decision-evidence 或 N/A}`
 - **需求摘要**：{本轮实现输入的范围摘要}
 
-## 状态核对
+## 资格审计
+
+> 按 `.agents/rules/decision-qualification.md` 填写以下五张表。
+
+### 约束依赖
+| constraint_id | constraint_digest | role | evidence |
+| --- | --- | --- | --- |
+
+### 候选资格
+| candidate_id | status | impact | constraint_ids | evidence |
+| --- | --- | --- | --- | --- |
+
+### 分类结果
+| decision_id | classification | evidence |
+| --- | --- | --- |
+
+### 上游关系
+| upstream_family | upstream_artifact | upstream_round | upstream_sha256 | relation |
+| --- | --- | --- | --- | --- |
 
-> 粘贴状态核对命令原文；每条命令以 `$ ` 开头。
+### 依赖快照
+| task_input_digest | non_constraint_input_digest | upstream_artifact_digest |
+| --- | --- | --- |
 
 ## 变更文件
 
@@ -58,16 +80,6 @@
 ```
 
 
-## 证据原文
-
-> 每条“我验证了 X”断言都要配对对应 tool output 原文；gate 仅校验本段存在和至少一行 `$ `。
-
-- 断言：{verified claim}
-```text
-$ {command}
-{raw output}
-```
-
 ## 与方案的差异
 
 {describe any deviation from the approved plan}
@@ -86,6 +98,21 @@ $ {command}
 - {item 1}
 - {item 2}
 
+## 状态核对
+
+> 记录状态核对命令、任务/产物范围、关键结果和未覆盖部分；每条命令以 `$ ` 开头。
+> 按 `.agents/rules/evidence-reporting.md` 同时记录任务/产物范围、关键结果和未覆盖部分；正常成功不粘贴完整 stdout。
+
+## 证据原文
+
+> 遵循 `.agents/rules/evidence-reporting.md`：每条断言配对 `$ ` 命令和相称结果摘要；仅为失败、阻塞或争议附决定性原文摘录。
+
+- 断言：{verified claim}
+```text
+$ {command}
+{result summary or decisive excerpt}
+```
+
 ## 已知问题
 
 {known issues or follow-up ideas}

package/templates/.agents/skills/complete-manual-validation/SKILL.en.md

@@ -14,6 +14,10 @@ Lifecycle events require explicit trigger data: use `{trigger-initiator}=orchest
 
 ## Boundary / Critical Rules
 
+### Persisted Report Evidence
+
+Before generating the validation completion report, read `.agents/rules/evidence-reporting.md`. Record commands, scope, structured results, actual conclusions, and uncovered parts for state checks and synchronization; keep the stricter basename-only and sanitized-result boundaries for manual validation.
+
 - This skill closes the manual-validation status in an existing PR summary comment; it does not create a parallel ordinary validation comment.
 - It must write `manual-validation.md` or `manual-validation-r{N}.md` so later PR summary refreshes can reuse the validation result.
 - If the `sync-pr` summary comment is missing, fail instead of creating a partial fallback summary.
@@ -26,7 +30,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 After loading workflow / skill / rules instructions, and before any task-state judgment or user-visible conclusion, run the state check first. Reading instruction files does not count as an external-state action or conclusion.
 
-Run these commands and paste the raw output into this round's `## State Check` section:
+Run these commands and record the task/artifact scope, key result, and uncovered parts in this round's `## State Check` section; do not paste complete directory listings or task tails on normal success. Retain decisive raw lines only for failures, blocking conditions, identity mismatches, or disputes:
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text

package/templates/.agents/skills/complete-manual-validation/SKILL.zh-CN.md

@@ -14,6 +14,10 @@ description: >
 
 ## 行为边界 / 关键规则
 
+### 持久化报告证据
+
+生成验证完成报告时，先读取 `.agents/rules/evidence-reporting.md`。状态核对和同步结果记录命令、范围、结构化结果、实际结论和未覆盖部分；继续遵守人工验证的 basename-only 与 sanitized result 脱敏边界。
+
 - 本技能用于收尾已有 PR 摘要评论中的人工校验状态，不创建并行的普通验证留言。
 - 必须写入 `manual-validation.md` 或 `manual-validation-r{N}.md`，让后续 PR 摘要刷新可复用人工验证结果。
 - 找不到 `sync-pr` 摘要评论时失败，不创建部分摘要兜底。
@@ -26,7 +30,7 @@ description: >
 
 在加载 workflow / skill / rules 指令之后、做任何任务状态判断或用户可见结论之前，必须先执行状态核对。指令类文件读取不算对外动作或结论。
 
-运行以下命令，并把原文粘贴到本轮产物的 `## 状态核对` 段：
+运行以下命令，并在本轮产物的 `## 状态核对` 段记录任务/产物范围、关键结果和未覆盖部分；正常成功不粘贴完整目录清单或 `task.md` 尾部。失败、阻塞、身份不一致或争议时，附决定性原文行：
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text

package/templates/.agents/skills/complete-manual-validation/reference/report-template.en.md

@@ -15,6 +15,7 @@ $ git status -s
 $ ls -la .agents/workspace/active/{task-id}/
 $ tail .agents/workspace/active/{task-id}/task.md
 ```
+> Follow `.agents/rules/evidence-reporting.md`: record task scope, key result, and uncovered parts; do not paste the complete directory listing or task tail for normal success.
 
 ## Validation Verdict
 
@@ -46,3 +47,4 @@ $ tail .agents/workspace/active/{task-id}/task.md
 - Derive `Validation Scope` from the PR summary's manual-verification section.
 - `PR Summary Sync` must record success, skip, or failure.
 - Only write a passing artifact after the summary comment is updated or skipped because there is no diff.
+- Successful synchronization records the command, scope, structured result, and actual conclusion; failures, blocking conditions, or disputes retain decisive excerpts and manual-validation redaction boundaries.

package/templates/.agents/skills/complete-manual-validation/reference/report-template.zh-CN.md

@@ -15,6 +15,7 @@ $ git status -s
 $ ls -la .agents/workspace/active/{task-id}/
 $ tail .agents/workspace/active/{task-id}/task.md
 ```
+> 按 `.agents/rules/evidence-reporting.md` 记录任务范围、关键结果和未覆盖部分；正常成功不粘贴完整目录清单或 task tail。
 
 ## 验证结论
 
@@ -46,3 +47,4 @@ $ tail .agents/workspace/active/{task-id}/task.md
 - `验证范围` 来自 PR 摘要评论中的 `### ⚠️ 需人工校验` 段。
 - `PR 摘要同步` 必须记录成功、跳过或失败结果。
 - 只有在摘要评论已成功更新或无 diff 跳过时，才写入通过产物。
+- 成功同步记录命令、范围、结构化结果和实际结论；失败、阻塞或争议保留决定性摘录，并继续遵守人工验证脱敏边界。

package/templates/.agents/skills/complete-task/SKILL.en.md

@@ -14,6 +14,10 @@ Host finalization uses receipt v2 with an immutable `receiptId`, monotonic `revi
 
 ## Boundary / Critical Rules
 
+### Persisted Report Evidence
+
+Before generating a completion report or synchronized content, read `.agents/rules/evidence-reporting.md`. Successful checks record the command, scope, status or structured result, actual result, and uncovered parts; failures, blocking conditions, or disputes retain a reproducible entry point, exact location, and decisive excerpt.
+
 - This command updates task metadata AND physically moves the task directory
 - Do not move a task that has incomplete workflow steps unless forced
 - The entry point accepts optional `--external-pr <N>` only to select among ambiguous external-delivery candidates; it never bypasses identity or platform gates
@@ -24,7 +28,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 After loading workflow / skill / rules instructions, and before any task-state judgment or user-visible conclusion, run the state check first. Reading instruction files does not count as an external-state action or conclusion.
 
-Run these commands and paste the raw output into this round's `## State Check` section:
+Run these commands and record the task/artifact scope, key result, and uncovered parts in this round's `## State Check` section; do not paste complete directory listings or task tails on normal success. Retain decisive raw lines only for failures, blocking conditions, identity mismatches, or disputes:
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -123,7 +127,7 @@ If a hard gate is not met, stop immediately and do not execute Steps 3-8.
 ### 3. Complete Business-Only Content
 
 Update only content that the lifecycle core does not own:
-- Add or update the `## State Check` section with the raw Step 0 audit command output, including `$ ` prompt lines, before `## Activity Log`
+- Add or update the `## State Check` section with the Step 0 audit command, task/artifact scope, key result, and uncovered parts; for normal success, do not copy the full directory listing or `task.md` tail, and include decisive raw lines only for failures, blocking, identity mismatches, or disputes, before `## Activity Log`
 - Mark all workflow steps as complete
 - Verify and check off all items in `## Completion Checklist` (change `- [ ]` to `- [x]`)
 
@@ -167,36 +171,19 @@ If a summary must mirror a human-decided `post-review-commit` exemption, make a
 
 `--force` cannot lift identity, concurrency, local atomicity, or required-PR hard gates; failures there must stop. Other review, manual-validation, and platform evidence is recorded by terminal verification as warning/pending and can be repaired by retrying.
 
-### 6. Run the Host Finalization Entry Point and Verify the Terminal State
+### 6. Run the Host Finalization Entry Point
 
 ```bash
 agent-infra-internal task-finalization {task-id} complete --agent {standard-agent-token}
 ```
 
-Finalization runs lifecycle -> the terminal task comment -> the `complete-task.completed` gate in a fixed order and records each step in the host receipt. `result=completed` means lifecycle completed safely; if peripheral warnings remain, return `result=completed_with_warnings`, warnings, and pending steps. Use `result=failed` or `result=blocked` only for hard or receipt/capability failures, then fix the cause and retry through the same entry point; do not claim completion or hand-repair partial state.
-
-```bash
-ls .agents/workspace/completed/{task-id}/task.md
-```
-
-Check the task directory only after finalization returns `status=completed`.
+Finalization runs lifecycle -> the terminal task comment -> the `complete-task.completed` gate in a fixed order and records each step in the host receipt. `result=completed` means the host safely completed the task from structured results and the receipt; if peripheral warnings remain, return `result=completed_with_warnings`, warnings, and pending steps. Use `result=failed` or `result=blocked` only for hard or receipt/capability failures, then fix the cause and retry through the same entry point; do not claim completion or hand-repair partial state. A sandbox must not run `ls completed` or a local terminal verification against its historical mount to re-decide this result.
 
 ### 7. Handle Finalization Retries and Results
 
 Both Scenario A and Scenario B `finalization-retry` run the same `task-finalization` entry point from the host. The receipt is only a re-entry hint, not canonical truth: every re-entry revalidates the terminal task comment and completion gate; only an already `completed` task with its short-id registry entry released may skip the irreversible lifecycle. Do not split the operation into the former lifecycle, comment-sync, or completion-gate commands. If the task comment or gate is blocked by the network, preserve the receipt and completed steps, fix the network, and rerun complete-task. If lifecycle has not completed, keep the task active and resume the pending steps from the receipt.
 
-The result must include the structured output from this finalization run, confirming that the task artifact and sync state are valid:
-
-```bash
-agent-infra-internal task-verify {task-id} complete-task.completed --format text
-```
-
-Handle the result as follows:
-- `status=completed` / exit code 0 (all checks passed) -> continue to the "Inform User" step
-- `status=failed` / exit code 1 -> fix the reported issues and run finalization again
-- `status=blocked` / exit code 2 -> preserve the receipt and completed steps and stop; rerun complete-task later to enter `finalization-retry`
-
-Keep the gate output in your reply as fresh evidence. Do not claim completion without output from this run.
+Consume the structured finalization result, receipt, and warning projection directly. Continue only for `completed` or `completed_with_warnings`; preserve the receipt and stop for `failed`, `blocked`, or `unknown`, then retry through the same finalization entry point. Do not run `ls completed` or `task-verify complete-task.completed` from a stale sandbox mount, and do not let that local result overrule the host result.
 
 ### Accepted sandbox-control result recovery