@fitlab-ai/agent-infra 0.9.2 → 0.9.3

package/templates/.agents/skills/complete-task/SKILL.zh-CN.md

@@ -7,11 +7,14 @@ description: >
 ---
 
 # 完成任务
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+
 
 ## 行为边界 / 关键规则
 
 - 本命令更新任务元数据并物理移动任务目录
 - 除非强制执行，不要转移有未完成工作流步骤的任务
+- 入口接受可选 `--external-pr <N>`；仅用于外部交付候选歧义时的显式选择，不绕过身份或平台门禁
 
 版本戳规则：创建或更新 `task.md` frontmatter 时，先读取 `.agents/rules/version-stamp.md`，并写入或刷新 `agent_infra_version`。
 
@@ -53,6 +56,16 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ### 2. 验证完成前置条件（未满足则必须停止）
 
+先读取 `reference/external-delivery.md`，然后在 active 任务上调用：
+
+```bash
+agent-infra-internal platform-pr resolve-external {task-id} --agent {standard-agent-token} [--pr {external-pr}]
+```
+
+- `mode=external`：只以本次 typed result 的 `authorization` 和 `selected` 作为外部交付授权与绑定身份，继续本步骤的既有硬门禁。
+- `mode=normal`：走现有本地生命周期前置条件；历史 `pr_number` / `pr_status` 不构成外部授权。
+- `status=failed|blocked`：立即停止并展示稳定错误；`--force` 不得绕过。
+
 **门控读取（项目级 PR 流程策略）**：在执行本步骤前，读取 `.agents/.airc.json` 的 `prFlow` 字段（三态：字段缺省 = 默认推荐 PR、允许跳过；`"required"` = 强制 PR；`"disabled"` = 强制无 PR），以及 `task.md` frontmatter 的 `pr_status`（`pending` / `created` / `skipped`）。
 
 **PR 维度判定（先判 `prFlow` 强约束，后看 `pr_status`）**：
@@ -87,6 +100,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 - [ ] 代码已提交（没有与此任务相关的未提交变更）
 - [ ] 测试通过
 - [ ] 审查分歧账本无未关闭分歧、无未复审的 post-review 提交；绑定 PR 路径中本地 HEAD、`last_reviewed_commit`、PR head 严格一致，或已合并 squash 的平台快照与远端 Git 等价证据完整且当前 Git 凭据可读取证据 refs；无有效 PR 路径中本地单父重写与 `last_reviewed_commit` 内容等价且之后无受保护提交
+- [ ] 人工校验项已完成（最新 review-code 的 Manual validation 计数 > 0 时，须存在通过校验的 manual-validation 产物及其完成记录，且该完成记录位于最新 review-code 之后；计数为 0 或无未决项时跳过）
 
 > **⚠️ 前置条件分支判断 — 你必须先判断“继续”还是“停止”：**
 >
@@ -123,9 +137,9 @@ Please complete the missing steps first, or use --force to override.
 
 如果存在有效的 `issue_number`，严格按以下顺序执行：
 
-1. 按 artifact catalog 顺序，对本地已有产物逐项调用 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {artifact-agent} --backfill`。
-2. 调用 `agent-infra-internal platform-issue sync {task-id} --agent {agent} --requirements --fields`。
-3. 把业务摘要写入临时文件，并调用 `agent-infra-internal platform-comment sync {task-id} --kind summary --body-file {path} --agent {agent}`。
+1. 调用 `agent-infra-internal platform-comment backfill {task-id} --agent {standard-agent-token}`，由 core 仅按 completion canonical inventory 固定顺序补发产物并在全部成功后精确恢复目标历史告警。
+2. 调用 `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --requirements --fields`。
+3. 把业务摘要写入临时文件，并调用 `agent-infra-internal platform-comment sync {task-id} --kind summary --body-file {path} --agent {standard-agent-token}`。
 
 不要在本步骤同步 task 评论；它依赖 lifecycle 写入后的完整终态 task.md。不要设置 `status:` label，平台自动化应在 Issue 关闭后清理状态标签。
 
@@ -145,14 +159,14 @@ agent-infra-internal task-warning {task-id} add --step complete-task --severity
 agent-infra-internal task-verify {task-id} complete-task.preflight --format text
 ```
 
-该事件依次执行 `review-ledger`、`post-review-commit`、`platform-sync-preflight`。任一退出码非 0（fail/blocked）时，任务必须继续留在 active；从 gate 结果取稳定 code/target，通过 `task-warning ... add --step complete-task ...` 落账后停止。若审查基线或 head 不一致，必须先重新 `commit` / `review-code`；不得回退审查基线。
+该事件依次执行 `review-ledger`、`manual-validation`、`post-review-commit`、`platform-sync-preflight`。任一退出码非 0（fail/blocked）时，任务必须继续留在 active；从 gate 结果取稳定 code/target，通过 `task-warning ... add --step complete-task ...` 落账后停止。若审查基线或 head 不一致，必须先重新 `commit` / `review-code`；不得回退审查基线。
 
 `--force` 不解除本硬门禁：未关闭分歧必须先在账本闭合，未复审提交必须重新审查、具备有效豁免，或由平台适配器为绑定的变更请求（PR/MR）提供权威合并快照与远端 refs，并在隔离临时仓库中证明单父 squash merge 等价，或在无有效变更请求时由本地 Git 对象证明唯一受保护提交是内容等价的单父重写且之后无受保护提交；平台 preflight 必须通过。适配器不支持所需能力，平台事实、Git 对象、拓扑、内容证据缺失，或当前 Git 凭据不能读取远端证据 refs 时 fail closed。required checks 由平台适配器提供规范化状态，并在合并前通过分支保护 / ruleset 以及 `review-code` / `watch-pr` 路由承担。
 
 ### 6. 执行本地生命周期意图并验证转移
 
 ```bash
-agent-infra-internal task-lifecycle {task-id} complete --agent {agent}
+agent-infra-internal task-lifecycle {task-id} complete --agent {standard-agent-token}
 ```
 
 仅 `status=applied|no-op` 视为本地完成。`status=failed` 时展示 `error` 与 completed/pending steps，以同一 intent 重试；不得宣称完成或手工补写局部状态。
@@ -168,7 +182,7 @@ ls .agents/workspace/completed/{task-id}/task.md
 场景 A 与场景 B `finalization-retry` 都从 completed 目录执行本步骤。若存在有效的 `issue_number`，先调用：
 
 ```bash
-agent-infra-internal platform-comment sync {task-id} --kind task --agent {agent}
+agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}
 ```
 
 该调用失败时任务已归档，不能调用只接受 active 任务的 `task-warning`；保留 completed 状态并停止。修复网络或平台问题后重跑 complete-task，会由步骤 1 进入 `finalization-retry`，只重复本步骤。
@@ -231,6 +245,7 @@ Completed at: {completion-time}
    - 代码已提交但未审查
    - 审查发现阻塞项但未修复
    - PR 已创建但未合并
+   - 人工校验项未完成
 
 2. **回滚**：如果任务被错误转移：
    ```bash

package/templates/.agents/skills/complete-task/config/verify.en.json

@@ -25,6 +25,7 @@
       "require_all_checked": true
     },
     "review-ledger": {},
+    "manual-validation": {},
     "post-review-commit": {},
     "platform-sync-preflight": {
       "when": "issue_number_exists",

package/templates/.agents/skills/complete-task/config/verify.zh-CN.json

@@ -25,6 +25,7 @@
       "require_all_checked": true
     },
     "review-ledger": {},
+    "manual-validation": {},
     "post-review-commit": {},
     "platform-sync-preflight": {
       "when": "issue_number_exists",

package/templates/.agents/skills/complete-task/reference/external-delivery.en.md

@@ -0,0 +1,17 @@
+# External PR Delivery
+
+This scenario applies only to an active task whose completion canonical inventory is empty because an already-merged external PR delivered the implementation.
+
+## Typed State Machine
+
+Run `agent-infra-internal platform-pr resolve-external {task-id} --agent {agent} [--pr {N}]`. Core checks the completion inventory first. A non-empty inventory returns `mode=normal`, and supplying `--pr` then fails. An empty inventory requires a positive `issue_number`; otherwise core returns `EXTERNAL_DELIVERY_ISSUE_REQUIRED`.
+
+The platform adapter supplies authoritative Issue closing change requests across all pages. Only candidates with a matching base repository, complete identity, and merge evidence are eligible. One candidate is selected automatically; ambiguity, conflicts, and missing evidence fail closed. `--pr` may only select an authoritative eligible closing candidate and cannot bypass repository, Issue, merge, or identity validation.
+
+## Authorization and Persistent Audit
+
+Only the current typed result's `mode=external`, `authorization`, and `selected` fields control the machine branch. `pr_status: created` is a compatibility shim for existing verifiers: it means a verifiable PR is bound, not that this task created it, and it cannot authorize lifecycle skipping by itself.
+
+A successful bind atomically writes PR fields and appends a `Bind External PR` Activity Log entry containing the authorization source, Issue, PR URL/number, base/head repository/ref/SHA, merge time, and merge commit. Replaying identical complete evidence is a no-op; an existing same-number binding without the signature adds it once; number or identity changes fail. The PR create path must never run.
+
+External mode still passes review-ledger, manual-validation, post-review-commit, platform-sync, preflight, and terminal gates. Without a canonical review-code artifact, only existing verifier N/A rules apply. `--force` does not disable any hard gate.

package/templates/.agents/skills/complete-task/reference/external-delivery.zh-CN.md

@@ -0,0 +1,17 @@
+# 外部 PR 交付
+
+本场景只适用于 completion canonical inventory 为空、实现实际由已合并的外部 PR 交付的 active 任务。
+
+## Typed 状态机
+
+调用 `agent-infra-internal platform-pr resolve-external {task-id} --agent {agent} [--pr {N}]`。core 先检查 completion inventory；非空时返回 `mode=normal`，且显式 `--pr` 会失败。空 inventory 必须有正整数 `issue_number`，否则返回 `EXTERNAL_DELIVERY_ISSUE_REQUIRED`。
+
+core 通过平台 adapter 读取 Issue 的权威 closing change requests，穷尽分页后只把 base 仓库匹配任务仓库且已经合并、身份字段完整的候选视为 eligible。唯一候选自动选择；多候选、身份冲突或证据缺失均 fail closed。`--pr` 只能从权威 closing eligible 集合中显式选择，不能绕过仓库、Issue、合并或身份校验。
+
+## 授权与持久审计
+
+当次调用只以 typed result 的 `mode=external`、`authorization` 和 `selected` 为机器分支依据。`pr_status: created` 只是现有 verifier 的兼容 shim，表示任务已绑定可验证的 PR；它既不表示 PR 由本任务创建，也不能单独授权跳过 lifecycle。
+
+成功绑定会原子写入 PR 字段并追加 `Bind External PR` Activity Log，记录授权来源、Issue、PR URL/编号、base/head repository/ref/SHA、合并时间和 merge commit。相同完整证据重试为 no-op；已有同号但缺审计签名时补写一次；编号或身份变化失败。不得调用 PR create 路径。
+
+外部模式仍须通过 review ledger、manual validation、post-review commit、平台同步、preflight 与终态校验。无 canonical review-code 时仅沿用 verifier 已定义的 N/A 规则；`--force` 不解除任何硬门禁。

package/templates/.agents/skills/create-pr/SKILL.en.md

@@ -6,6 +6,8 @@ description: >
 ---
 
 # Create Pull Request
+> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+
 
 Create a Pull Request and, when task-related, sync the essential metadata and reviewer summary immediately.
 
@@ -72,7 +74,7 @@ If `{task-id}` is available and the related task provides `issue_number`, keep `
 
 ### 6. Sync PR Metadata
 
-Run `agent-infra-internal platform-pr sync {task-id} --agent {agent} --metadata --closing-issue`. The core copies type / `in:` labels, assignee, and a specific milestone from the Issue and maintains the closing association. Permission-bound items degrade independently, and the Issue is never updated in reverse.
+Run `agent-infra-internal platform-pr sync {task-id} --agent {standard-agent-token} --metadata --closing-issue`. The core copies type / `in:` labels, assignee, and a specific milestone from the Issue and maintains the closing association. Permission-bound items degrade independently, and the Issue is never updated in reverse.
 
 ### 7. Publish the Review Summary
 

package/templates/.agents/skills/create-pr/SKILL.zh-CN.md

@@ -6,6 +6,8 @@ description: >
 ---
 
 # 创建 Pull Request
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+
 
 创建 Pull Request，并在与任务关联时立即补齐核心元数据和 reviewer 摘要。
 
@@ -72,7 +74,7 @@ description: >
 
 ### 6. 同步 PR 元数据
 
-调用 `agent-infra-internal platform-pr sync {task-id} --agent {agent} --metadata --closing-issue`。core 从 Issue 复制 type / `in:` labels、assignee 和具体 milestone，并维护 Development 关联；逐项权限不足返回 degraded，不反向更新 Issue。
+调用 `agent-infra-internal platform-pr sync {task-id} --agent {standard-agent-token} --metadata --closing-issue`。core 从 Issue 复制 type / `in:` labels、assignee 和具体 milestone，并维护 Development 关联；逐项权限不足返回 degraded，不反向更新 Issue。
 
 ### 7. 发布审查摘要
 

package/templates/.agents/skills/create-pr/reference/comment-publish.en.md

@@ -6,7 +6,7 @@ Write the plain summary body to a temporary file, then run:
 
 ```bash
 agent-infra-internal platform-pr summary-sync {task-id} \
-  --agent {agent} --body-file {summary-body-file}
+  --agent {standard-agent-token} --body-file {summary-body-file}
 ```
 
 The caller does not add markers, HEAD metadata, or comment API parameters. A summary failure records the existing `create-pr` warning and does not roll back the PR.

package/templates/.agents/skills/create-pr/reference/comment-publish.zh-CN.md

@@ -6,7 +6,7 @@
 
 ```bash
 agent-infra-internal platform-pr summary-sync {task-id} \
-  --agent {agent} --body-file {summary-body-file}
+  --agent {standard-agent-token} --body-file {summary-body-file}
 ```
 
 调用方不添加 marker、HEAD 或评论 API 参数。摘要失败沿用 `create-pr` 错误处理并记录 warning，不回滚已创建 PR。结果映射沿用 `.agents/rules/pr-sync.md`。

package/templates/.agents/skills/create-release-note/SKILL.en.md

@@ -126,35 +126,36 @@ If no historical release notes exist, use the following default Markdown format:
      - Sort reporters by reported Issue count descending, then lexicographically by login for ties
 5. Empty sections: Omit sections with no entries
 
-### 8. Present and Confirm
+### 8. Stage, Present, and Confirm
 
-Show the generated release notes to the user.
-
-Ask:
-1. Need any adjustments?
-2. Write these notes onto the Release for this version?
-
-### 9. Publish the Release Notes (If Confirmed)
-
-9.1 Write the generated notes to a temp file **outside the working tree** so no uncommitted artifact is left behind in the repo (do not write into `.agents/workspace/` or any version-controlled directory):
+Write the candidate notes to a temporary file outside the working tree, then call typed stage to normalize the file and retain its structured `sha256`:
 
 ```bash
 NOTES_FILE="$(mktemp "${TMPDIR:-/tmp}/agent-infra-release-notes.XXXXXX")"
+agent-infra-internal platform-release-notes stage \
+  --notes-file "$NOTES_FILE"
 ```
 
-Write the notes content to `$NOTES_FILE`.
+Present the exact staged file and delete it before asking. Adjustments invalidate the digest. Only an unambiguous affirmative reply for this preview in the current session authorizes publishing; denial, questions, ambiguity, or interruption stop without publish.
+
+### 9. Recheck and Publish Release Notes
 
-9.2 Call the typed publish intent (use `$NOTES_FILE` for `{notes-file}`); it updates an existing Release or creates a missing one:
+After confirmation, write the confirmed normalized text to a new external temporary file and stage it again. Delete and return to preview if its digest differs. On a match, call:
 
 ```bash
 agent-infra-internal platform-release-notes publish \
-  --tag "v<version>" --title "v<version>" --notes-file "$NOTES_FILE"
+  --tag "v<version>" \
+  --title "v<version>" \
+  --notes-file "$NOTES_FILE" \
+  --expected-sha256 "{preview-sha256}"
 ```
 
-9.3 Remove the temp file whether publishing succeeds or fails:
+Delete the temporary file on every exit path. After success, render:
 
 ```bash
-rm -f "$NOTES_FILE"
+agent-infra-internal agent-client next-steps \
+  --skill post-release \
+  --version <version>
 ```
 
 Output:
@@ -174,7 +175,7 @@ The notes have been written to the Release. Edit further at the URL above if nee
 2. **Tags must exist**: Run the release skill first to create tags
 3. **Release auto-published**: the `v{version}` Release is created and published by the release workflow (the upload target for Homebrew bottles); this skill writes/refreshes the notes on that Release
 4. **Classification accuracy**: Auto-classification is based on title/scope/files; complex PRs may need manual adjustment
-5. **No leftover artifacts**: Always write notes to a temp file outside the working tree (`mktemp`) and delete it after publishing; never write into the repo directory
+5. **No leftover artifacts**: Delete preview files before asking and publish files on every exit path; interruption invalidates session-only notes and authorization
 
 ## Error Handling
 

package/templates/.agents/skills/create-release-note/SKILL.zh-CN.md

@@ -126,35 +126,36 @@ agent-infra-internal platform-release-notes context \
      - Reporter 之间按报告的 Issue 数量降序排列，数量相同时按 login 字典序
 5. 空部分：省略没有条目的部分
 
-### 8. 展示并确认
+### 8. Stage、展示并确认
 
-向用户展示生成的发布说明。
-
-询问：
-1. 需要调整吗？
-2. 是否把 notes 写入该版本的 Release？
-
-### 9. 发布 Release notes（如确认）
-
-9.1 把生成的 notes 写入**工作树之外**的临时文件，避免在仓库残留未提交产物（不要写入 `.agents/workspace/` 或任何受版本控制的目录）：
+把候选 notes 写入工作树外临时文件，调用 typed stage 规范化并保存结构化 `sha256`：
 
 ```bash
 NOTES_FILE="$(mktemp "${TMPDIR:-/tmp}/agent-infra-release-notes.XXXXXX")"
+agent-infra-internal platform-release-notes stage \
+  --notes-file "$NOTES_FILE"
 ```
 
-把 notes 内容写入 `$NOTES_FILE`。
+只展示 stage 后同一文件的精确内容，在询问前删除文件。调整会使旧 digest 失效。只有当前会话中针对当前预览的无歧义明确肯定答复才授权发布；否定、疑问、歧义或中断均停止。
+
+### 9. 复核并发布 Release notes
 
-9.2 调用 typed publish intent（命令中的 `{notes-file}` 用 `$NOTES_FILE`）；它会更新已存在的 Release，不存在时创建：
+确认后把已确认文本写入新的工作树外临时文件并再次 stage。digest 不一致时删除并回到预览；一致时调用：
 
 ```bash
 agent-infra-internal platform-release-notes publish \
-  --tag "v<version>" --title "v<version>" --notes-file "$NOTES_FILE"
+  --tag "v<version>" \
+  --title "v<version>" \
+  --notes-file "$NOTES_FILE" \
+  --expected-sha256 "{preview-sha256}"
 ```
 
-9.3 无论发布成功或失败，都删除临时文件：
+所有退出路径删除临时文件。成功后渲染：
 
 ```bash
-rm -f "$NOTES_FILE"
+agent-infra-internal agent-client next-steps \
+  --skill post-release \
+  --version <version>
 ```
 
 输出：
@@ -174,7 +175,7 @@ Release notes 已更新。
 2. **标签必须存在**：先执行 release 技能创建标签
 3. **Release 已自动发布**：`v{version}` 的 Release 由 release 工作流自动创建并发布（给 Homebrew bottle 提供上传落点）；本技能往该 Release 写入/刷新 notes
 4. **分类准确性**：自动分类基于标题/scope/文件；复杂的 PR 可能需要手动调整
-5. **不留残留产物**：notes 一律写入工作树之外的临时文件（`mktemp`）并在发布后删除，禁止写入仓库目录
+5. **不留残留产物**：预览文件在询问前删除，发布文件在所有退出路径删除；会话中断时授权和草稿失效
 
 ## 错误处理
 

package/templates/.agents/skills/create-task/SKILL.en.md

@@ -6,6 +6,8 @@ description: >
 ---
 
 # Create Task
+> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+
 
 ## Boundary / Critical Rules
 
@@ -131,12 +133,12 @@ Update `.agents/workspace/active/{task-id}/task.md`:
 After task.md is written, call the declarative intents; the internal core owns templates, body rendering, identity validation, capability degradation, idempotency, and task binding:
 
 ```bash
-agent-infra-internal platform-issue create {task-id} --agent {agent}
-agent-infra-internal platform-issue sync {task-id} --agent {agent} --status waiting-for-triage --assignees current --milestone initial --issue-type --fields
+agent-infra-internal platform-issue create {task-id} --agent {standard-agent-token}
+agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --status waiting-for-triage --assignees current --milestone initial --issue-type --fields
 ```
 
 Handle the result:
-- Intent created the Issue: `issue_number` was written through the task writer; run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {agent}`
+- Intent created the Issue: `issue_number` was written through the task writer; run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`
 - Rule failed (auth / network / template parse / etc.): do not roll back task.md or append an extra Activity Log entry; run `agent-infra-internal task-warning {task-id} add --step create-task --severity ACTION_REQUIRED --code ISSUE_CREATE_FAILED --target issue --message "{error_code}: {error_message}" --action "Fix auth/network/template issues and manually retry Issue creation, or create/find an Issue and write issue_number"` to submit a structured warning intent (callers do not allocate ids or edit rows), then follow Scenario C
 - Intent returned no-op/degraded: continue applicable operations without blocking the workflow
 - task.md already has a valid `issue_number`: create validates the binding and returns no-op without creating a duplicate

package/templates/.agents/skills/create-task/SKILL.zh-CN.md

@@ -6,6 +6,8 @@ description: >
 ---
 
 # 创建任务
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+
 
 ## 行为边界 / 关键规则
 
@@ -130,12 +132,12 @@ date "+%Y-%m-%d %H:%M:%S%z" | sed 's/\([+-][0-9][0-9]\)\([0-9][0-9]\)$/\1:\2/'
 在 task.md 落盘并记录 `Create Task` 后调用声明式 Issue intent；标题、正文、模板、身份校验、权限降级、幂等创建和 task.md 绑定均由 internal core 处理：
 
 ```bash
-agent-infra-internal platform-issue create {task-id} --agent {agent}
-agent-infra-internal platform-issue sync {task-id} --agent {agent} --status waiting-for-triage --assignees current --milestone initial --issue-type --fields
+agent-infra-internal platform-issue create {task-id} --agent {standard-agent-token}
+agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --status waiting-for-triage --assignees current --milestone initial --issue-type --fields
 ```
 
 处理结果：
-- intent 成功创建 Issue：`issue_number` 已由任务写入内核回写；调用 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {agent}`
+- intent 成功创建 Issue：`issue_number` 已由任务写入内核回写；调用 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`
 - 规则失败（认证 / 网络 / 模板解析等）：不回滚 task.md；不追加额外 Activity Log；先调用 `agent-infra-internal task-warning {task-id} add --step create-task --severity ACTION_REQUIRED --code ISSUE_CREATE_FAILED --target issue --message "{error_code}: {error_message}" --action "修复认证/网络/模板问题后手动重试 Issue 创建，或手动创建/找到 Issue 后写入 issue_number"` 提交结构化 warning 意图（调用方不分配编号或写表格）；再按"场景 C：Issue 创建失败"输出
 - intent 为 no-op/degraded：按结构化 operations 继续可执行部分；自定义或空平台不创建评论且不阻塞工作流
 - task.md 已存在有效 `issue_number`：create intent 校验绑定后返回 no-op，不重复创建

package/templates/.agents/skills/import-issue/SKILL.en.md

@@ -6,6 +6,8 @@ description: >
 ---
 
 # Import Issue
+> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+
 
 Import the specified Issue and create a task. Argument: issue number.
 
@@ -145,9 +147,9 @@ Update `.agents/workspace/active/{task-id}/task.md`:
 ### 5. Bind and Sync the Issue
 
 If task.md contains a valid `issue_number`, perform these sync actions (skip and continue on any failure):
-- Run `agent-infra-internal platform-issue bind {task-id} --issue {issue-number} --agent {agent}`
-- Run `agent-infra-internal platform-issue sync {task-id} --agent {agent} --assignees current --milestone initial`
-- After every scenario, run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {agent}`
+- Run `agent-infra-internal platform-issue bind {task-id} --issue {issue-number} --agent {standard-agent-token}`
+- Run `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --assignees current --milestone initial`
+- After every scenario, run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`
 
 ### 6. Verification Gate
 

package/templates/.agents/skills/import-issue/SKILL.zh-CN.md

@@ -6,6 +6,8 @@ description: >
 ---
 
 # 导入 Issue
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+
 
 导入指定的 Issue 并创建任务。参数：issue 编号。
 
@@ -145,9 +147,9 @@ date "+%Y-%m-%d %H:%M:%S%z" | sed 's/\([+-][0-9][0-9]\)\([0-9][0-9]\)$/\1:\2/'
 ### 5. 绑定并同步 Issue
 
 如果 task.md 中存在有效的 `issue_number`，执行以下同步操作（任一失败则跳过并继续）：
-- 调用 `agent-infra-internal platform-issue bind {task-id} --issue {issue-number} --agent {agent}` 校验并原子绑定
-- 调用 `agent-infra-internal platform-issue sync {task-id} --agent {agent} --assignees current --milestone initial`
-- 所有场景结束后，必须调用 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {agent}`
+- 调用 `agent-infra-internal platform-issue bind {task-id} --issue {issue-number} --agent {standard-agent-token}` 校验并原子绑定
+- 调用 `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --assignees current --milestone initial`
+- 所有场景结束后，必须调用 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`
 
 ### 6. 完成校验
 

package/templates/.agents/skills/plan-task/SKILL.en.md

@@ -7,6 +7,9 @@ description: >
 ---
 
 # Design Technical Plan
+> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+
+If the entry operands contain `--orchestrated`, bind `{execution-flag}` to `--orchestrated` and forward it unchanged to the completed event; otherwise bind it to an empty value. Never infer it from `orchestration.json`, environment variables, or prior artifacts.
 
 ## Boundary / Critical Rules
 
@@ -36,7 +39,7 @@ Before the state check is complete, do not make external-state assertions such a
 
 ## Step Start: Write the started Marker
 
-After resolving the artifact context and before this round's first artifact action, run `agent-infra-internal task-event {task-id} plan.started --agent {agent}` and verify the returned `artifactContext`.
+After resolving the artifact context and before this round's first artifact action, run `agent-infra-internal task-event {task-id} plan.started --agent {standard-agent-token}` and verify the returned `artifactContext`.
 
 ## Steps
 
@@ -110,14 +113,14 @@ Update `.agents/workspace/active/{task-id}/task.md`:
   - Overwrite the `effort` field in frontmatter with the new value
   - Append a `## Effort Re-estimate` section to this round's plan artifact `{plan-artifact}`, recording: `effort {old} → {new} (rationale: {short basis grounded in this plan})`
   If the re-estimated value matches the current value, skip it: do not write the `## Effort Re-estimate` section. The Flow A sync that follows reads the possibly updated frontmatter and propagates the new value to the Issue automatically.
-After the business fields are updated, run `agent-infra-internal task-event {task-id} plan.completed --agent {agent} --artifact {plan-artifact}` so the core atomically records the link, stage, agent, metadata, and Activity Log.
+After the business fields are updated, run `agent-infra-internal task-event {task-id} plan.completed --agent {standard-agent-token} --artifact {plan-artifact} {execution-flag}` so the core atomically records the link, stage, agent, metadata, and Activity Log.
   - {YYYY-MM-DD HH:mm:ss±HH:MM} — **Plan Task (Round {N})** by {agent} — Plan completed, awaiting human review → {artifact-filename}
   ```
 
 If task.md contains a valid `issue_number`, perform these sync actions (skip and continue on any failure):
-- Run `agent-infra-internal platform-issue sync {task-id} --agent {agent} --status pending-design-work --fields`
-- Run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {agent}`
-- Run `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {plan-artifact} --agent {agent}`
+- Run `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --status pending-design-work --fields`
+- Run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`
+- Run `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {plan-artifact} --agent {standard-agent-token}`
 
 ### 8. Verification Gate
 

package/templates/.agents/skills/plan-task/SKILL.zh-CN.md

@@ -7,6 +7,9 @@ description: >
 ---
 
 # 设计技术方案
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+
+若入口业务操作数包含 `--orchestrated`，绑定 `{execution-flag}` = `--orchestrated` 并原样转发给 completed 事件；否则绑定为空。不得从 `orchestration.json`、环境变量或历史产物推断该标记。
 
 ## 行为边界 / 关键规则
 
@@ -39,7 +42,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 确认前置条件和轮次后、本轮第一个产出动作之前执行：
 
 ```bash
-agent-infra-internal task-event {task-id} plan.started --agent {agent}
+agent-infra-internal task-event {task-id} plan.started --agent {standard-agent-token}
 ```
 
 ## 执行步骤
@@ -109,12 +112,12 @@ agent-infra-internal task-event {task-id} plan.started --agent {agent}
   - 用新值覆盖 frontmatter 的 `effort` 字段
   - 在本轮方案产物 `{plan-artifact}` 中追加 `## 工作量重估` 段，记录一条：`effort {old} → {new} (rationale: {基于本轮方案的简短依据})`
   若重估值与当前值一致，跳过：不写入 `## 工作量重估` 段。后续 Flow A 同步会读取可能更新过的 frontmatter，并自动把新值同步到 Issue。
-- 完成业务内容更新后执行 `agent-infra-internal task-event {task-id} plan.completed --agent {agent} --artifact {plan-artifact}`，由核心原子登记链接、阶段、代理、时间、版本和 Activity Log。
+- 完成业务内容更新后执行 `agent-infra-internal task-event {task-id} plan.completed --agent {standard-agent-token} --artifact {plan-artifact} {execution-flag}`，由核心原子登记链接、阶段、代理、时间、版本和 Activity Log。
 
 如果 task.md 中存在有效的 `issue_number`，执行以下同步操作（任一失败则跳过并继续）：
-- 调用 `agent-infra-internal platform-issue sync {task-id} --agent {agent} --status pending-design-work --fields`
-- 调用 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {agent}`
-- 调用 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {plan-artifact} --agent {agent}`
+- 调用 `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --status pending-design-work --fields`
+- 调用 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`
+- 调用 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {plan-artifact} --agent {standard-agent-token}`
 
 ### 8. 完成校验
 

package/templates/.agents/skills/post-release/SKILL.en.md

@@ -7,6 +7,8 @@ description: >
 
 # Post-release
 
+Require one explicit canonical SemVer `{version}`. Do not fall back to the latest tag.
+
 ## 1. Inspect Channel Facts
 
 ```bash

package/templates/.agents/skills/post-release/SKILL.zh-CN.md

@@ -7,6 +7,8 @@ description: >
 
 # 发布后处理
 
+要求用户显式提供唯一规范 SemVer `{version}`，不得回退到最新 tag。
+
 ## 1. 检查渠道事实
 
 ```bash

package/templates/.agents/skills/release/SKILL.en.md

@@ -7,36 +7,42 @@ description: >
 
 # Release
 
-Release state is derived from external facts and prepare/publish require separate authorization.
+Prepare, present the latest fact snapshot, and request one remote-publish authorization in a single invocation. External facts remain the source of truth.
 
-## 1. Validate Input and Entropy Report
+## 1. Validate Input and Entropy Checkpoint
 
-Confirm SemVer and the human release checkpoint.
+Require one canonical SemVer `{version}` and a satisfied entropy checkpoint.
 
-## 2. Inspect Facts
+## 2. Prepare and Inspect Facts
 
 ```bash
 agent-infra-internal release-workflow inspect {version}
 ```
 
-## 3. Prepare
+Run prepare and inspect again only when the snapshot is not prepared. Reuse prepared or partially published facts. Unknown state is blocked.
 
 ```bash
 agent-infra-internal release-workflow prepare {version} --entropy-report {path}
 ```
 
-Stop after prepare; never publish implicitly.
+## 3. Present and Confirm
 
-## 4. Publish Separately
+Present the latest snapshot. Only an unambiguous affirmative reply for that snapshot in the current session authorizes publishing. A denial, adjustment, question, ambiguity, interruption, or changed snapshot stops the write and requires a new preview.
 
-Only after explicit user authorization:
+## 4. Publish and Reinspect
 
 ```bash
 agent-infra-internal release-workflow publish {version}
 ```
 
-Push refs normally, preserve partial success for replay, and never force push.
+Push refs normally, preserve partial success for replay, never force push, and inspect again after the operation.
 
 ## 5. Report Facts
 
-Show the snapshot and render next-step client commands through the shared helper. Treat unknown external state as blocked.
+After a complete publish, render the versioned next step without exposing internal actions or skipping directly to post-release:
+
+```bash
+agent-infra-internal agent-client next-steps \
+  --skill create-release-note \
+  --version {version}
+```

package/templates/.agents/skills/release/SKILL.zh-CN.md

@@ -7,36 +7,42 @@ description: >
 
 # 版本发布
 
-发布由事实驱动，并拆为独立授权的 prepare 与 publish。
+在单次调用中准备发布、展示最新事实快照并请求一次远端发布授权。状态由外部事实重建。
 
-## 1. 检查输入与 entropy 报告
+## 1. 验证输入与人工检查点
 
-确认 SemVer 和人工发布检查点已满足。
+验证唯一参数 `{version}` 是规范 SemVer，并确认 entropy 人工检查点已满足。
 
-## 2. 检查事实
+## 2. 准备并检查发布事实
 
 ```bash
 agent-infra-internal release-workflow inspect {version}
 ```
 
-## 3. 准备发布
+未 prepared 时执行 prepare 并重新 inspect；已准备或部分发布时复用当前事实。unknown 必须 blocked。
 
 ```bash
 agent-infra-internal release-workflow prepare {version} --entropy-report {path}
 ```
 
-prepare 后停止，不得隐式 publish。
+## 3. 展示快照并确认
 
-## 4. 独立发布
+展示最新 snapshot。只有当前会话中针对该快照的无歧义明确肯定答复才授权发布；否定、调整、疑问、歧义或中断均停止。快照变化后重新确认。
 
-仅在用户明确授权后执行：
+## 4. 发布并复核
 
 ```bash
 agent-infra-internal release-workflow publish {version}
 ```
 
-逐 ref 普通 push；部分成功可重放，禁止 force push。
+逐 ref 普通 push；部分成功可重放，禁止 force push。操作后重新 inspect。
 
 ## 5. 输出事实摘要
 
-完整展示 snapshot 和后续 TUI 命令；unknown 必须视为 blocked。
+完整发布后渲染携带版本的下一步，不显示内部 action，也不直接跳到 post-release：
+
+```bash
+agent-infra-internal agent-client next-steps \
+  --skill create-release-note \
+  --version {version}
+```