@fitlab-ai/agent-infra 0.9.13 → 0.9.14

package/templates/.agents/skills/complete-task/SKILL.zh-CN.md

@@ -14,6 +14,10 @@ description: >
 
 ## 行为边界 / 关键规则
 
+### 持久化报告证据
+
+生成收尾报告或同步内容时，先读取 `.agents/rules/evidence-reporting.md`。成功检查记录命令、范围、状态/结构化结果、实际结果和未覆盖部分；失败、阻塞或争议保留复现入口、准确位置和决定性摘录。
+
 - 本命令更新任务元数据并物理移动任务目录
 - 除非强制执行，不要转移有未完成工作流步骤的任务
 - 入口接受可选 `--external-pr <N>`；仅用于外部交付候选歧义时的显式选择，不绕过身份或平台门禁
@@ -24,7 +28,7 @@ description: >
 
 在加载 workflow / skill / rules 指令之后、做任何任务状态判断或用户可见结论之前，必须先执行状态核对。指令类文件读取不算对外动作或结论。
 
-运行以下命令，并把原文粘贴到本轮产物的 `## 状态核对` 段：
+运行以下命令，并在本轮产物的 `## 状态核对` 段记录任务/产物范围、关键结果和未覆盖部分；正常成功不粘贴完整目录清单或 `task.md` 尾部。失败、阻塞、身份不一致或争议时，附决定性原文行：
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -122,7 +126,7 @@ Please satisfy the hard prerequisite first, then retry complete-task.
 ### 3. 完成业务内容更新
 
 在 `.agents/workspace/active/{task-id}/task.md` 中只更新生命周期核心不负责的业务内容：
-- 新增或更新 `## 状态核对` 段，粘贴第 0 步审计命令原文（含 `$ ` 前缀行），放在 `## 活动日志` 之前
+- 新增或更新 `## 状态核对` 段，记录第 0 步审计命令、任务/产物范围、关键结果和未覆盖部分；正常成功不复制完整目录清单或 `task.md` 尾部，失败、阻塞、身份不一致或争议时附决定性原文行，放在 `## 活动日志` 之前
 - 标记所有工作流步骤为已完成
 - 逐项验证并勾选 `## 完成检查清单` 中的所有条目（将 `- [ ]` 改为 `- [x]`）
 
@@ -166,36 +170,19 @@ agent-infra-internal task-verify {task-id} complete-task.preflight --format text
 
 `--force` 不能解除身份、并发、本地原子性或 required-PR hard gate；这些能力失败时必须停止。其余审查、人工校验和平台证据由 terminal verification 记录为 warning/pending，并通过后续重试恢复。
 
-### 6. 执行宿主 finalization 入口并验证终态
+### 6. 执行宿主 finalization 入口
 
 ```bash
 agent-infra-internal task-finalization {task-id} complete --agent {standard-agent-token}
 ```
 
-finalization 按 lifecycle → task 评论 → `complete-task.completed` 校验的固定顺序执行，并将每一步的状态写入宿主 receipt。`result=completed` 即表示 lifecycle 已安全完成；若还有外围 warning，返回 `result=completed_with_warnings`、warnings 和 pending steps。`result=failed` 或 `result=blocked` 仅用于硬失败或 receipt/capability 失败，修复原因后以同一入口重试，不得宣称完成或手工补写局部状态。
-
-```bash
-ls .agents/workspace/completed/{task-id}/task.md
-```
-
-仅在 finalization 返回 `status=completed` 后确认任务目录已成功移动。
+finalization 按 lifecycle → task 评论 → `complete-task.completed` 校验的固定顺序执行，并将每一步的状态写入宿主 receipt。`result=completed` 即表示宿主已依据结构化结果和 receipt 安全完成；若还有外围 warning，返回 `result=completed_with_warnings`、warnings 和 pending steps。`result=failed` 或 `result=blocked` 仅用于硬失败或 receipt/capability 失败，修复原因后以同一入口重试，不得宣称完成或手工补写局部状态。沙箱不得从旧挂载执行 `ls completed` 或本地终态校验来重新裁决该结果。
 
 ### 7. 处理 finalization 重试与结果
 
 场景 A 与场景 B `finalization-retry` 都从宿主执行同一个 `task-finalization` 入口。receipt 只是重入提示，不是 canonical truth：每次重入都要重新验证终态 task 评论和完成校验；只有任务已处于 `completed` 且短号 registry 已释放时，才可跳过不可逆的 lifecycle。不得拆开调用旧的 lifecycle、评论同步或完成校验命令。若 task 评论或校验因网络问题返回 `blocked`，保留 receipt 和已完成状态，修复网络后重跑 complete-task；若生命周期仍未完成，任务保持 active 并从 receipt 的待处理步骤继续。
 
-完成结果必须包含本次 finalization 的结构化输出，确认任务产物和同步状态符合规范：
-
-```bash
-agent-infra-internal task-verify {task-id} complete-task.completed --format text
-```
-
-处理结果：
-- `status=completed` / 退出码 0（全部通过）-> 继续到「告知用户」步骤
-- `status=failed` / 退出码 1 -> 根据输出修复问题后重新运行 finalization
-- `status=blocked` / 退出码 2 -> 保留 receipt 与已完成的步骤并停止；稍后重跑 complete-task 进入 `finalization-retry`
-
-将校验输出保留在回复中作为当次验证输出。没有当次校验输出，不得声明完成。
+完成结果必须直接消费本次宿主 finalization 的结构化输出、receipt 和 warning projection。`completed` 或 `completed_with_warnings` 才允许继续；`failed` / `blocked` / `unknown` 必须保留 receipt 并停止，之后通过同一 finalization 入口重试。不要在沙箱旧挂载中另行运行 `ls completed` 或 `task-verify complete-task.completed`，也不要用其结果推翻宿主结果。
 
 ### accepted 后的 sandbox-control 结果恢复
 

package/templates/.agents/skills/create-task/SKILL.en.md

@@ -126,6 +126,14 @@ date "+%Y-%m-%d %H:%M:%S%z" | sed 's/\([+-][0-9][0-9]\)\([0-9][0-9]\)$/\1:\2/'
 - `blocked`: retain the candidate and retry the same file after the transient problem is fixed.
 - `failed`: report the stable error code. Never modify and retry a candidate under the same idempotency key.
 
+A controlled invocation may return `control` request evidence: `accepted: true`
+with `recovery: none` means the current result can be consumed; `accepted: false`
+with `recovery: new-request-id` means the request was not admitted and the same
+candidate may be retried with a new outer request ID after the transient problem
+is fixed; `recovery: same-request-id` or `recovery: inspect-domain-state` means
+the request was accepted, so do not create a new candidate or replay it
+automatically. Recover with the original request or inspect host task state first.
+
 ### 4. Platform Failure Compatibility
 
 The host service owns platform cascading. The compatibility recovery commands remain visible in the host warning and are not run from the sandbox:

package/templates/.agents/skills/create-task/SKILL.zh-CN.md

@@ -125,6 +125,13 @@ date "+%Y-%m-%d %H:%M:%S%z" | sed 's/\([+-][0-9][0-9]\)\([0-9][0-9]\)$/\1:\2/'
 - `blocked`：保留 candidate 文件，修复暂态问题后用同一文件重试。
 - `failed`：报告稳定错误码；幂等冲突时不得改写原 key 或原 candidate 后重试。
 
+受控调用可能在结果中返回 `control` 请求证据：`accepted: true` 且
+`recovery: none` 表示可以消费当前结果；`accepted: false` 且
+`recovery: new-request-id` 表示请求尚未受理，暂态问题恢复后才能用同一份
+candidate 和新的 outer request ID 重试；`recovery: same-request-id` 或
+`recovery: inspect-domain-state` 表示请求已经受理，不得创建新的 candidate 或
+自动重放，必须先使用原 request 检查结果或宿主任务状态。
+
 ### 4. 平台失败兼容说明
 
 平台级联由宿主服务完成。兼容的人工恢复命令仍由宿主 warning 指引，不在沙箱内执行：

package/templates/.agents/skills/import-codescan/SKILL.en.md

@@ -34,7 +34,7 @@ This skill **creates** task.md, so there is no file to write at the start. Captu
 
 ### 1. Retrieve Alert Information
 
-Read `.agents/rules/security-alerts.md` before this step, then run `bash .agents/scripts/security-alerts.sh read-codescan --number {alert-number}` and parse its JSON result to fetch the alert details.
+Read `.agents/rules/security-alerts.md` before this step, then run `agent-infra-internal platform-security read --kind code-scanning --number {alert-number}` and parse its JSON result to fetch the alert details.
 
 Extract key information:
 - `number`: alert number

package/templates/.agents/skills/import-codescan/SKILL.zh-CN.md

@@ -34,7 +34,7 @@ description: >
 
 ### 1. 获取告警信息
 
-执行前先读取 `.agents/rules/security-alerts.md`，然后运行 `bash .agents/scripts/security-alerts.sh read-codescan --number {alert-number}`，解析其 JSON 结果获取告警详情。
+执行前先读取 `.agents/rules/security-alerts.md`，然后运行 `agent-infra-internal platform-security read --kind code-scanning --number {alert-number}`，解析其 JSON 结果获取告警详情。
 
 提取关键信息：
 - `number`：告警编号

package/templates/.agents/skills/import-dependabot/SKILL.en.md

@@ -34,7 +34,7 @@ This skill **creates** task.md, so there is no file to write at the start. Captu
 
 ### 1. Retrieve Alert Information
 
-Read `.agents/rules/security-alerts.md` before this step, then run `bash .agents/scripts/security-alerts.sh read-dependabot --number {alert-number}` and parse its JSON result to fetch the alert details.
+Read `.agents/rules/security-alerts.md` before this step, then run `agent-infra-internal platform-security read --kind dependabot --number {alert-number}` and parse its JSON result to fetch the alert details.
 
 Extract key information:
 - `number`: alert number

package/templates/.agents/skills/import-dependabot/SKILL.zh-CN.md

@@ -34,7 +34,7 @@ description: >
 
 ### 1. 获取告警信息
 
-执行前先读取 `.agents/rules/security-alerts.md`，然后运行 `bash .agents/scripts/security-alerts.sh read-dependabot --number {alert-number}`，解析其 JSON 结果获取告警详情。
+执行前先读取 `.agents/rules/security-alerts.md`，然后运行 `agent-infra-internal platform-security read --kind dependabot --number {alert-number}`，解析其 JSON 结果获取告警详情。
 
 提取关键信息：
 - `number`：告警编号

package/templates/.agents/skills/init-labels/SKILL.en.md

@@ -19,17 +19,17 @@ Confirm that:
 
 If any prerequisite fails, stop and report the matching error.
 
-### 2. Run the bootstrap script
+### 2. Run the labels runtime intent
 
 Execute the complete label initialization flow with:
 
 ```bash
-bash .agents/skills/init-labels/scripts/init-labels.sh
+agent-infra-internal platform-metadata init-labels
 ```
 
-The script and `.agents/rules/label-milestone-setup.md` are responsible for:
+The runtime intent and `.agents/rules/label-milestone-setup.md` are responsible for:
 - Reading the configured `labels.in` mapping and preserving unrelated labels
-- Selecting the provider leaf or returning a clear no-op/degraded result
+- Selecting the platform capability or returning a clear no-op/degraded result
 - Creating or updating the standard label set and reporting the final summary
 - Printing the final execution summary
 
@@ -69,8 +69,8 @@ Show the current mapping and ask whether it should be updated.
 #### 4.3 Write the mapping and create labels
 
 1. Write the final mapping to `.agents/.airc.json` under `labels.in`.
-2. Run `bash .agents/skills/init-labels/scripts/init-labels.sh` to create or update one `in: {key}` label for each mapping key.
-3. After user confirmation, rerun the script with `--cleanup-stale-in` to delete stale `in:` labels that are no longer present in the final mapping.
+2. Run `agent-infra-internal platform-metadata init-labels` to create or update one `in: {key}` label for each mapping key.
+3. After user confirmation, rerun the intent with `--cleanup-stale-in` to delete stale `in:` labels that are no longer present in the final mapping.
 
 ### 5. Output and behavior guarantees
 
@@ -100,7 +100,7 @@ Next step - initialize milestones (optional):
 
 ## Error Handling
 
-- Provider capability unavailable: report the script's `degraded` or `no-op` result without claiming remote changes.
-- Provider authentication or repository access failure: report the script's non-zero exit status and diagnostic output; do not claim remote changes.
+- Platform capability unavailable: report the runtime's `degraded` or `no-op` result without claiming remote changes.
+- Platform authentication or repository access failure: report the runtime's non-zero exit status and diagnostic output; do not claim remote changes.
 - Permission error: prompt "No permission to manage labels in this repository"
 - API rate limit: prompt "platform API rate limit reached, please retry later"

package/templates/.agents/skills/init-labels/SKILL.zh-CN.md

@@ -19,17 +19,17 @@ description: >
 
 如果任一条件失败，停止并输出对应错误。
 
-### 2. 运行初始化脚本
+### 2. 运行 labels runtime intent
 
 执行以下命令，完成整套 label 初始化流程：
 
 ```bash
-bash .agents/skills/init-labels/scripts/init-labels.sh
+agent-infra-internal platform-metadata init-labels
 ```
 
-脚本与 `.agents/rules/label-milestone-setup.md` 共同负责：
+runtime intent 与 `.agents/rules/label-milestone-setup.md` 共同负责：
 - 读取配置的 `labels.in` 映射并保留无关 label
-- 选择 provider 叶子，或返回明确的 no-op/degraded 结果
+- 选择平台能力，或返回明确的 no-op/degraded 结果
 - 创建或更新标准 label 集合并输出最终摘要
 - 输出最终执行摘要
 
@@ -69,8 +69,8 @@ bash .agents/skills/init-labels/scripts/init-labels.sh
 #### 4.3 写入配置并创建 label
 
 1. 将最终映射写入 `.agents/.airc.json` 的 `labels.in` 字段。
-2. 执行 `bash .agents/skills/init-labels/scripts/init-labels.sh`，为每个映射 key 创建或更新 `in: {key}` label。
-3. 询问用户确认后，再使用 `--cleanup-stale-in` 重新执行脚本，清理不在最终映射中的旧 `in:` label。
+2. 执行 `agent-infra-internal platform-metadata init-labels`，为每个映射 key 创建或更新 `in: {key}` label。
+3. 询问用户确认后，再使用 `--cleanup-stale-in` 重新执行 intent，清理不在最终映射中的旧 `in:` label。
 
 ### 5. 输出与行为保证
 
@@ -100,7 +100,7 @@ bash .agents/skills/init-labels/scripts/init-labels.sh
 
 ## 错误处理
 
-- provider 能力不可用：如实报告脚本的 `degraded` 或 `no-op` 结果，不得声称远端已变更。
-- provider 认证或仓库访问失败：如实报告脚本的非零退出状态和诊断输出；不得声称远端已变更。
+- 平台能力不可用：如实报告 runtime 的 `degraded` 或 `no-op` 结果，不得声称远端已变更。
+- 平台认证或仓库访问失败：如实报告 runtime 的非零退出状态和诊断输出；不得声称远端已变更。
 - 权限不足：提示 "No permission to manage labels in this repository"
 - API 限流：提示 "platform API rate limit reached, please retry later"

package/templates/.agents/skills/init-milestones/SKILL.en.md

@@ -19,20 +19,18 @@ Confirm that:
 
 If any prerequisite fails, stop and report the matching error.
 
-### 2. Run the bootstrap script
+### 2. Run the milestones runtime intent
 
 Execute the complete milestone initialization flow with:
 
 ```bash
-bash .agents/skills/init-milestones/scripts/init-milestones.sh "$ARGUMENTS"
+agent-infra-internal platform-metadata init-milestones $ARGUMENTS
 ```
 
-The script and `.agents/rules/label-milestone-setup.md` are responsible for:
-- Creating and cleaning up a temporary workspace
-- Detecting whether `--history` was requested
-- Scanning all `v*` Git tags, selecting the highest valid version by SemVer precedence, and using compatibility default `0.1.0` when none is valid, without reading ecosystem manifests
-- Letting the provider leaf list and write current milestones
-- Building the desired milestone set and creating only the missing titles
+The runtime intent and `.agents/rules/label-milestone-setup.md` are responsible for:
+- Receiving the `--history` request and planning the desired milestones
+- Applying the established baseline, history, state, and title-idempotency contract
+- Letting runtime/provider code list and write current milestones
 - Printing the final execution summary
 
 ### 3. Standard milestone definitions
@@ -78,8 +76,8 @@ Next step - initialize labels (optional):
 
 ## Error Handling
 
-- Provider capability, authentication, or repository access failure: report the script's non-zero exit status and diagnostic output; do not claim remote changes.
-- Version detection failed: prompt "Unable to determine current version baseline"
-- No valid SemVer `v*` tags found in `--history` mode: prompt "No valid SemVer history tags found matching v*; only standard milestones will be created"
+- Platform capability, authentication, or repository access failure: report the runtime's non-zero exit status and diagnostic output; do not claim remote changes.
+- Version detection failed: report the runtime's version-baseline error
+- No valid SemVer `v*` tags found in `--history` mode: report the runtime's history diagnostic
 - Permission error: prompt "No permission to manage milestones in this repository"
 - API rate limit: prompt "platform API rate limit reached, please retry later"

package/templates/.agents/skills/init-milestones/SKILL.zh-CN.md

@@ -19,20 +19,18 @@ description: >
 
 如果任一条件失败，停止并输出对应错误。
 
-### 2. 运行初始化脚本
+### 2. 运行 milestones runtime intent
 
 执行以下命令，完成整套里程碑初始化流程：
 
 ```bash
-bash .agents/skills/init-milestones/scripts/init-milestones.sh "$ARGUMENTS"
+agent-infra-internal platform-metadata init-milestones $ARGUMENTS
 ```
 
-脚本与 `.agents/rules/label-milestone-setup.md` 共同负责：
-- 创建并清理临时工作目录
-- 检测是否传入 `--history`
-- 扫描所有 `v*` Git tag，按 SemVer precedence 选择最高合法版本；没有合法版本时使用兼容默认值 `0.1.0`，且不读取任何生态 manifest
-- 由 provider 叶子读取并写入当前里程碑
-- 构建目标里程碑集合，并且只创建缺失标题
+runtime intent 与 `.agents/rules/label-milestone-setup.md` 共同负责：
+- 接收 `--history` 请求并规划目标里程碑
+- 按既定基线、history、状态和标题幂等契约生成结果
+- 由 runtime/provider 读取并写入当前里程碑
 - 输出最终执行摘要
 
 ### 3. 标准里程碑定义
@@ -78,8 +76,8 @@ bash .agents/skills/init-milestones/scripts/init-milestones.sh "$ARGUMENTS"
 
 ## 错误处理
 
-- provider 能力、认证或仓库访问失败：如实报告脚本的非零退出状态和诊断输出；不得声称远端已变更。
-- 版本解析失败：提示 "Unable to determine current version baseline"
-- `--history` 模式下未找到合法 SemVer `v*` git tags：提示 "No valid SemVer history tags found matching v*; only standard milestones will be created"
+- 平台能力、认证或仓库访问失败：如实报告 runtime 的非零退出状态和诊断输出；不得声称远端已变更。
+- 版本解析失败：报告 runtime 返回的版本基线错误
+- `--history` 模式下未找到合法 SemVer `v*` git tags：报告 runtime 返回的 history 诊断
 - 权限不足：提示 "No permission to manage milestones in this repository"
 - API 限流：提示 "platform API rate limit reached, please retry later"

package/templates/.agents/skills/plan-task/SKILL.en.md

@@ -13,6 +13,11 @@ If the entry operands contain `--orchestrated`, bind `{execution-flag}` to `--or
 
 ## Boundary / Critical Rules
 
+### Persisted Report Evidence
+
+Before generating the plan report, read `.agents/rules/evidence-reporting.md`. Record the command, target scope, status or structured result, actual result, and uncovered parts for state checks and verification; include decisive raw excerpts only for failures, blocking conditions, or disputes.
+
+- When evaluating candidate qualification or `HD-N`, read `.agents/rules/decision-qualification.md`, audit normalized task constraints/candidates, and record the five qualification-audit tables in the plan artifact; unknown or unconfirmed constraints must not automatically exclude a candidate
 - This skill only outputs a technical plan document (`plan.md` or `plan-r{N}.md`) and does not modify any business code
 - This is a **mandatory human review checkpoint**; do not automatically proceed to implementation
 - Before generating task or lifecycle Markdown that will be synchronized to an Issue, read `.agents/rules/sync-content-generation.md` and apply its producer-side constraints; the sync path does not parse or rewrite the body
@@ -25,7 +30,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 After loading workflow / skill / rules instructions, and before any task-state judgment or user-visible conclusion, run the state check first. Reading instruction files does not count as an external-state action or conclusion.
 
-Run these commands and paste the raw output into this round's `## State Check` section:
+Run these commands and record the task/artifact scope, key result, and uncovered parts in this round's `## State Check` section; do not paste complete directory listings or task tails on normal success. Retain decisive raw lines only for failures, blocking conditions, identity mismatches, or disputes:
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -103,6 +108,14 @@ When this round introduces a new key design decision, first run `agent-infra-int
 
 ### 6. Output Plan Document
 
+Before writing this round's `{plan-artifact}`, create the controlled report skeleton:
+
+```bash
+agent-infra-internal task-artifact {task-id} init --family plan --artifact {plan-artifact} --locale en
+```
+
+The skeleton contains identity metadata, stable section markers, and required headings only; real plan content is required before the completion gate can pass. If the finalizer returns one provably safe structural error, call `task-artifact {task-id} repair --family plan --artifact {plan-artifact} --expected-sha256 {artifact-sha256} --expected-semantic-digest {semantic-digest}`, then rerun the same finalizer.
+
 Create `.agents/workspace/active/{task-id}/{plan-artifact}`.
 
 ### 7. Update Task Status

package/templates/.agents/skills/plan-task/SKILL.zh-CN.md

@@ -13,6 +13,11 @@ description: >
 
 ## 行为边界 / 关键规则
 
+### 持久化报告证据
+
+生成方案报告时，先读取 `.agents/rules/evidence-reporting.md`。状态核对和验证记录命令、目标范围、状态/结构化结果、实际结果和未覆盖部分；失败、阻塞或争议才附决定性原文摘录。
+
+- 涉及候选资格或 `HD-N` 判断时，先读取 `.agents/rules/decision-qualification.md`，基于 task.md 规范化约束/候选完成资格审计，并在方案产物记录五张资格审计表；不得把来源不明或未确认约束自动升级为排除条件
 - 本技能仅产出技术方案文档（`plan.md` 或 `plan-r{N}.md`）—— 不修改任何业务代码
 - 生成会同步到 Issue 的任务或生命周期 Markdown 前，先读取 `.agents/rules/sync-content-generation.md` 并遵循其中的生成端约束；同步端不解析或改写正文
 - 这是一个**强制性的人工审查检查点** —— 不要自动进入实现阶段
@@ -25,7 +30,7 @@ description: >
 
 在加载 workflow / skill / rules 指令之后、做任何任务状态判断或用户可见结论之前，必须先执行状态核对。指令类文件读取不算对外动作或结论。
 
-运行以下命令，并把原文粘贴到本轮产物的 `## 状态核对` 段：
+运行以下命令，并在本轮产物的 `## 状态核对` 段记录任务/产物范围、关键结果和未覆盖部分；正常成功不粘贴完整目录清单或 `task.md` 尾部。失败、阻塞、身份不一致或争议时，附决定性原文行：
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -83,6 +88,8 @@ agent-infra-internal task-event {task-id} plan.started --agent {standard-agent-t
 
 ### 5. 设计技术方案
 
+方案必须按 `.agents/rules/decision-qualification.md` 复核规范化约束和候选，并在方案产物保留五张资格审计表及真实上游关系；来源不明或未人工确认的约束不得自动排除候选。
+
 遵循 `.agents/workflows/feature-development.yaml` 中的 `technical-design` 步骤：
 
 **必要任务**：
@@ -104,6 +111,14 @@ agent-infra-internal task-event {task-id} plan.started --agent {standard-agent-t
 
 ### 6. 输出计划文档
 
+在首次写入本轮 `{plan-artifact}` 前，先创建受控报告骨架：
+
+```bash
+agent-infra-internal task-artifact {task-id} init --family plan --artifact {plan-artifact}
+```
+
+骨架只包含身份元数据、稳定 section marker 和必需标题；必须填入真实方案内容后才能通过完成门禁。finalizer 返回可证明的单个结构错误时，使用其 SHA 和 semantic digest 调用 `task-artifact {task-id} repair --family plan --artifact {plan-artifact} --expected-sha256 {artifact-sha256} --expected-semantic-digest {semantic-digest}`，然后完整重跑 finalizer。
+
 创建 `.agents/workspace/active/{task-id}/{plan-artifact}`。
 
 ### 7. 更新任务状态

package/templates/.agents/skills/plan-task/config/verify.en.json

@@ -17,25 +17,15 @@
     },
     "artifact": {
       "file_pattern": "plan.md|plan-r{N}.md",
-      "required_sections": [
-        "Problem Understanding",
-        "Constraints",
-        "Option Comparison",
-        "Technical Approach",
-        "Implementation Steps",
-        "File List",
-        "Verification Strategy",
-        "State Check"
-      ],
-      "required_patterns": [
-        "^\\$ "
-      ]
+      "schema": "plan"
     },
     "activity-log": {
       "expected_action_pattern": "(Plan Task|Technical Design) \\(Round \\d+\\)"
     },
     "review-ledger": {
-      "stage_scope": ["analysis"]
+      "stage_scope": [
+        "analysis"
+      ]
     },
     "platform-sync": {
       "when": "issue_number_exists",

package/templates/.agents/skills/plan-task/config/verify.zh-CN.json

@@ -17,25 +17,15 @@
     },
     "artifact": {
       "file_pattern": "plan.md|plan-r{N}.md",
-      "required_sections": [
-        "问题理解",
-        "约束条件",
-        "方案对比",
-        "技术方法",
-        "实施步骤",
-        "文件清单",
-        "验证策略",
-        "状态核对"
-      ],
-      "required_patterns": [
-        "^\\$ "
-      ]
+      "schema": "plan"
     },
     "activity-log": {
       "expected_action_pattern": "(Plan Task|Technical Design) \\(Round \\d+\\)"
     },
     "review-ledger": {
-      "stage_scope": ["analysis"]
+      "stage_scope": [
+        "analysis"
+      ]
     },
     "platform-sync": {
       "when": "issue_number_exists",

package/templates/.agents/skills/review-analysis/SKILL.en.md

@@ -15,6 +15,11 @@ Review the latest analysis artifact and produce `review-analysis.md` or `review-
 
 ## Boundary / Critical Rules
 
+### Persisted Report Evidence
+
+Before generating the review report, read `.agents/rules/evidence-reporting.md`. Normal inspection records the command, scope, structured result, actual conclusion, and uncovered parts; findings, blocking conditions, or disputes retain reproducible locations and decisive excerpts, while identity fields remain exact.
+
+- When reviewing candidate qualification or `HD-N`, read `.agents/rules/decision-qualification.md` and check the five qualification-audit tables, digests, QCR, and upstream relations; do not treat a process label as identity authentication
 - This skill only reviews analysis artifacts and writes a report; it does not modify product code.
 - Before generating task or lifecycle Markdown that will be synchronized to an Issue, read `.agents/rules/sync-content-generation.md` and apply its producer-side constraints; the sync path does not parse or rewrite the body
 - After executing this skill, you **must** immediately update task.md.
@@ -25,7 +30,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 After loading workflow / skill / rules instructions, and before any task-state judgment or user-visible conclusion, run the state check first.
 
-Run these commands and paste the raw output into this round's `## State Check` section:
+Run these commands and record the task/artifact scope, key result, and uncovered parts in this round's `## State Check` section; do not paste complete directory listings or task tails on normal success. Retain decisive raw lines only for failures, blocking conditions, identity mismatches, or disputes:
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -64,6 +69,14 @@ Check requirement completeness, risks, affected scope, open questions, and effor
 
 ### 5. Write Review Report
 
+Before writing this round's `{review-artifact}`, create the controlled review skeleton:
+
+```bash
+agent-infra-internal task-artifact {task-id} init --family review-analysis --artifact {review-artifact} --locale en
+```
+
+The skeleton contains identity metadata, stable section markers, and required headings only; complete review content is required before summary finalization. If structural finalization returns one provably safe error, call `task-artifact {task-id} repair --family review-analysis --artifact {review-artifact} --expected-sha256 {artifact-sha256} --expected-semantic-digest {semantic-digest}`, then rerun the original finalizer.
+
 Create `.agents/workspace/active/{task-id}/{review-artifact}`.
 
 > Read `reference/report-template.md` before writing the report.

package/templates/.agents/skills/review-analysis/SKILL.zh-CN.md

@@ -15,6 +15,11 @@ description: >
 
 ## 行为边界 / 关键规则
 
+### 持久化报告证据
+
+生成审查报告时，先读取 `.agents/rules/evidence-reporting.md`。正常检视记录命令、范围、结构化结果、实际结论和未覆盖部分；finding、阻塞或争议保留可复现位置与决定性摘录，身份字段必须精确保留。
+
+- 审查候选资格或 `HD-N` 判断时，先读取 `.agents/rules/decision-qualification.md`，逐项复核产物中的五张资格审计表、digest、QCR 和上游关系；不得把流程标签当作身份认证
 - 本技能只审查分析产物并写报告，不修改业务代码
 - 生成会同步到 Issue 的任务或生命周期 Markdown 前，先读取 `.agents/rules/sync-content-generation.md` 并遵循其中的生成端约束；同步端不解析或改写正文
 - 执行本技能后，你**必须**立即更新 task.md
@@ -25,7 +30,7 @@ description: >
 
 在加载 workflow / skill / rules 指令之后、做任何任务状态判断或用户可见结论之前，必须先执行状态核对。指令类文件读取不算对外动作或结论。
 
-运行以下命令，并把原文粘贴到本轮产物的 `## 状态核对` 段：
+运行以下命令，并在本轮产物的 `## 状态核对` 段记录任务/产物范围、关键结果和未覆盖部分；正常成功不粘贴完整目录清单或 `task.md` 尾部。失败、阻塞、身份不一致或争议时，附决定性原文行：
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -67,6 +72,14 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ### 5. 编写审查报告
 
+在首次写入本轮 `{review-artifact}` 前，先创建受控审查骨架：
+
+```bash
+agent-infra-internal task-artifact {task-id} init --family review-analysis --artifact {review-artifact}
+```
+
+骨架不生成审查结论、发现或计数；完成审查内容后才能进入 summary finalizer。结构 finalizer 返回可证明的单个错误时，使用其 SHA 和 semantic digest 调用 `task-artifact {task-id} repair --family review-analysis --artifact {review-artifact} --expected-sha256 {artifact-sha256} --expected-semantic-digest {semantic-digest}`，再重跑原 finalizer。
+
 创建 `.agents/workspace/active/{task-id}/{review-artifact}`。
 
 > 报告格式见 `reference/report-template.md`。写报告前先读取 `reference/report-template.md`。

package/templates/.agents/skills/review-analysis/config/verify.en.json

@@ -17,24 +17,7 @@
     },
     "artifact": {
       "file_pattern": "review-analysis.md|review-analysis-r{N}.md",
-      "required_sections": [
-        "Review Summary",
-        "Review Coverage Declaration",
-        "Requirement Analysis Coverage",
-        "Traceability Matrix",
-        "Findings",
-        "Non-blocking Advisories",
-        "Manual Validation Items",
-        "Conclusion and Recommendations",
-        "State Check",
-        "Evidence",
-        "Self-Doubt",
-        "Review Disagreement Ledger Writeback"
-      ],
-      "required_patterns": [
-        "^### Approval Decision$",
-        "^\\$ "
-      ]
+      "schema": "review-analysis"
     },
     "decision-details": {},
     "review-summary": {

package/templates/.agents/skills/review-analysis/config/verify.zh-CN.json

@@ -17,24 +17,7 @@
     },
     "artifact": {
       "file_pattern": "review-analysis.md|review-analysis-r{N}.md",
-      "required_sections": [
-        "审查摘要",
-        "检视覆盖声明",
-        "需求分析专项覆盖",
-        "追踪矩阵",
-        "问题清单",
-        "非阻塞建议",
-        "人工校验项",
-        "结论与建议",
-        "状态核对",
-        "证据原文",
-        "自我质疑",
-        "审查分歧账本回写"
-      ],
-      "required_patterns": [
-        "^### 审查决定$",
-        "^\\$ "
-      ]
+      "schema": "review-analysis"
     },
     "decision-details": {},
     "review-summary": {