@fitlab-ai/agent-infra 0.9.5 → 0.9.7

package/templates/.agents/skills/complete-task/SKILL.en.md

@@ -142,6 +142,8 @@ When an `issue_number` exists, execute in this exact order:
 2. Run `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --requirements --fields`.
 3. Write the business summary to a temporary file and run `agent-infra-internal platform-comment sync {task-id} --kind summary --body-file {path} --agent {standard-agent-token}`.
 
+When the ledger contains a valid `PRC-N` post-review exemption, the summary body must mirror the ruling reason, commit scope, human identity, and time from task.md, and state that this is a human override rather than an automatic verification success. If a matching workflow warning exists, also mirror its original failure code/message. If no warning exists yet, state only that the ruling is recorded and final gate verification is pending; do not claim that the exemption has passed. The same `--kind summary` intent remains the sole owner of the summary marker.
+
 Do not sync the task comment here; it requires the terminal task.md written by lifecycle. Do not set a `status:` label; platform automation clears status labels after the Issue closes.
 
 If any operation fails, the task must remain active and its short id must remain valid. Record the failure with the matching structured warning intent, then stop without entering Step 5:
@@ -162,6 +164,8 @@ agent-infra-internal task-verify {task-id} complete-task.preflight --format text
 
 This event runs `review-ledger`, `manual-validation`, `post-review-commit`, then `platform-sync-preflight`. On any non-zero exit (fail/blocked), keep the task active, derive the stable code/target from the gate result, record it through `task-warning ... add --step complete-task ...`, and stop. For a review/head mismatch, rerun `commit` or `review-code`; never fall back to the review baseline.
 
+When preflight's `post-review-commit` check passes through a human-decided exemption, update the same summary marker from Step 4 before entering Step 6. Add the original failure code/message and PRC id/evidence from the check output together with the ruling reason, commit scope, human identity, and time from task.md. When a warning exists, treat its historical record as canonical and reconcile it with the current check output; otherwise use the current check output as the original-failure source. Run the same `platform-comment sync ... --kind summary` intent again. If it fails, record `SUMMARY_SYNC_FAILED`, keep the task active, and stop before lifecycle.
+
 `--force` does not lift this hard gate: close ledger disagreements; re-review or exempt post-review commits, use the platform adapter's authoritative snapshot and remote refs for the bound change request (PR/MR) to prove a content-equivalent single-parent squash merge in an isolated temporary repository, or, without a valid change request, prove from local Git objects that the only protected commit is a content-equivalent single-parent rewrite with no later protected commits; then pass platform preflight. An unsupported adapter capability, missing required platform facts, Git objects, topology, or content evidence, or current Git credentials that cannot read the remote evidence refs fails closed. The platform adapter supplies normalized state for all checks, enforced before merge by the `review-code` / `watch-pr` routes; required checks remain additionally enforced by branch protection / rulesets.
 
 ### 6. Apply the Local Lifecycle Intent and Verify the Move

package/templates/.agents/skills/complete-task/SKILL.zh-CN.md

@@ -141,6 +141,8 @@ Please complete the missing steps first, or use --force to override.
 2. 调用 `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --requirements --fields`。
 3. 把业务摘要写入临时文件，并调用 `agent-infra-internal platform-comment sync {task-id} --kind summary --body-file {path} --agent {standard-agent-token}`。
 
+若账本含合法的 `PRC-N` post-review 豁免，摘要正文必须镜像 task.md 中的裁决理由、提交范围、人工身份与时间，并明确这是人工覆盖而非自动校验成功。已有匹配 workflow warning 时，同时镜像其原始 failure code/message；尚无 warning 时只写“裁决已记录、最终门禁待验证”，不得提前宣称豁免已通过。summary marker 仍由同一 `--kind summary` intent 唯一维护。
+
 不要在本步骤同步 task 评论；它依赖 lifecycle 写入后的完整终态 task.md。不要设置 `status:` label，平台自动化应在 Issue 关闭后清理状态标签。
 
 任一操作失败时，任务仍必须位于 active 且短号仍有效；先按失败类型调用以下结构化 warning intent，再立即停止，不进入步骤 5：
@@ -161,6 +163,8 @@ agent-infra-internal task-verify {task-id} complete-task.preflight --format text
 
 该事件依次执行 `review-ledger`、`manual-validation`、`post-review-commit`、`platform-sync-preflight`。任一退出码非 0（fail/blocked）时，任务必须继续留在 active；从 gate 结果取稳定 code/target，通过 `task-warning ... add --step complete-task ...` 落账后停止。若审查基线或 head 不一致，必须先重新 `commit` / `review-code`；不得回退审查基线。
 
+若 preflight 的 `post-review-commit` 以 human-decided exemption 通过，在进入步骤 6 前必须把该 check 输出中的原始 failure code/message 与 PRC id/evidence，连同 task.md 中的裁决理由、提交范围、人工身份与时间，原地补入步骤 4 的同一 summary marker。已有 warning 时以其历史记录为 canonical 证据并与本次 check 输出核对；无 warning 时以本次 check 输出补齐原始失败。再次调用同一 `platform-comment sync ... --kind summary`；失败时记录 `SUMMARY_SYNC_FAILED`、保持任务 active 并停止，不进入 lifecycle。
+
 `--force` 不解除本硬门禁：未关闭分歧必须先在账本闭合，未复审提交必须重新审查、具备有效豁免，或由平台适配器为绑定的变更请求（PR/MR）提供权威合并快照与远端 refs，并在隔离临时仓库中证明单父 squash merge 等价，或在无有效变更请求时由本地 Git 对象证明唯一受保护提交是内容等价的单父重写且之后无受保护提交；平台 preflight 必须通过。适配器不支持所需能力，平台事实、Git 对象、拓扑、内容证据缺失，或当前 Git 凭据不能读取远端证据 refs 时 fail closed。全部 checks 由平台适配器提供规范化状态，并在合并前通过 `review-code` / `watch-pr` 路由承担；其中 required checks 仍受分支保护 / ruleset 强制。
 
 ### 6. 执行本地生命周期意图并验证转移

package/templates/.agents/skills/post-release/SKILL.en.md

@@ -15,16 +15,42 @@ Require one explicit canonical SemVer `{version}`. Do not fall back to the lates
 agent-infra-internal release-workflow inspect {version}
 ```
 
-Pending or unknown is blocked; a definite failure is failed.
+Pending or unknown is blocked; a definite failure is failed. Report `complete` directly from external facts.
 
-## 2. Run Post-release
+## 2. Prepare Local Post-release Work
+
+When incomplete, run:
 
 ```bash
-agent-infra-internal release-workflow post {version}
+agent-infra-internal release-workflow post-prepare {version}
+agent-infra-internal release-workflow inspect {version}
 ```
 
-The core owns build, next development version, inline artifacts, explicit-path commit, normal push, and post-write inspection.
+The core owns build, the optional demo, next development version, inline artifacts, and the explicit-path post commit. This action must not push. Replays recover from Git and channel facts without repeating completed work.
+
+## 3. Check the Confirmation Snapshot
+
+- `complete`: report completion without asking or publishing.
+- `postConfirmation` present: display every field and its `sha256`, then continue to step 4.
+- `postConfirmation` absent: report diagnostics such as `isHead=false` or a dirty worktree/index and stop without asking or publishing.
 
-## 3. Report the Snapshot
+## 4. Authorize the Current Snapshot
+
+Only after displaying the complete `postConfirmation` in the current session, ask once whether to publish. Continue only for an unambiguous affirmative answer. Denial, adjustment, a question, ambiguity, or interruption stops. Authorization never carries across sessions or snapshots.
+
+## 5. Publish the Confirmed Snapshot
+
+```bash
+agent-infra-internal release-workflow post-publish {version} \
+  --expected-sha256 "{post-confirmation-sha256}"
+```
+
+The core re-inspects and verifies the digest before one normal branch push; force pushes are forbidden. On snapshot drift, stop and return to step 1 for a new display and authorization.
+
+## 6. Re-inspect and Report
+
+```bash
+agent-infra-internal release-workflow inspect {version}
+```
 
-Report channel, smoke, commit, and push facts without presenting degraded or blocked as complete.
+Report all channel, released/new version, smoke, post commit, and remote branch facts. Describe completion only for phase `complete`; never present failed, degraded, or blocked as success.

package/templates/.agents/skills/post-release/SKILL.zh-CN.md

@@ -15,16 +15,42 @@ description: >
 agent-infra-internal release-workflow inspect {version}
 ```
 
-pending/unknown 必须 blocked，确定失败必须 failed。
+pending/unknown 必须 blocked，确定失败必须 failed。`complete` 直接按外部事实报告完成。
 
-## 2. 执行后处理
+## 2. 准备本地后处理
+
+尚未完成时执行：
 
 ```bash
-agent-infra-internal release-workflow post {version}
+agent-infra-internal release-workflow post-prepare {version}
+agent-infra-internal release-workflow inspect {version}
 ```
 
-core 负责 build、下一开发版本、内联产物、显式路径 commit 与普通 push，并在写后复核。
+core 负责 build、可选 demo、下一开发版本、内联产物和显式路径 post commit；该动作不得 push。重跑从 Git 与渠道事实恢复，不重复已完成操作。
+
+## 3. 检查确认快照
+
+- `complete`：报告完成，不询问、不 publish。
+- 存在 `postConfirmation`：展示完整字段和 `sha256`，进入步骤 4。
+- 不存在 `postConfirmation`：报告 `isHead=false`、工作树或暂存区非空等诊断并停止，不询问、不 publish。
 
-## 3. 输出摘要
+## 4. 获取当前快照授权
+
+仅在当前会话已展示完整 `postConfirmation` 后询问一次是否发布。只有无歧义肯定答复才继续；否定、调整、疑问、歧义或中断均停止。授权不跨会话或快照复用。
+
+## 5. 发布已确认快照
+
+```bash
+agent-infra-internal release-workflow post-publish {version} \
+  --expected-sha256 "{post-confirmation-sha256}"
+```
+
+core 重新 inspect 并校验摘要后仅执行普通 branch push，禁止 force push。摘要漂移时停止并回到步骤 1 重新展示、重新确认。
+
+## 6. 写后复核并报告
+
+```bash
+agent-infra-internal release-workflow inspect {version}
+```
 
-报告全部渠道、smoke、commit 与 push 事实，不把 degraded/blocked 表述为完成。
+报告全部渠道、released/new version、smoke、post commit 与远端 branch 事实；只有阶段为 `complete` 才表述为完成，不把 failed/degraded/blocked 表述为成功。

package/templates/.agents/skills/run-manual-validation/SKILL.en.md

@@ -0,0 +1,42 @@
+---
+name: run-manual-validation
+description: >
+  Safely run task manual validation on the host and record standard evidence.
+  Use when validation needs host credentials, a real container, or in-place worktree state.
+  Only invoke automatically when the conversation includes a resolvable task reference.
+---
+
+# Run Manual Validation
+
+## Boundary
+
+- Select the validation mode, call the sole mechanical entry point, and record evidence; do not mark PR manual validation complete.
+- `complete-manual-validation` remains the maintainer's final registration after coverage is judged sufficient.
+- Never manipulate temporary worktrees, leases, or containers directly; only call `ai task validate`.
+- Never record tokens, environment variables, full argv, absolute user paths, or raw transcripts in the artifact.
+
+## Step 0: State Check (pre-execution hard gate)
+
+Resolve the task reference, then run this command and copy its original output into the artifact:
+
+```bash
+agent-infra-internal task-snapshot {task-id} --format text
+```
+
+## Steps
+
+1. Read `reference/discovery-and-execution.md` and parse the input mode. Stop before started without an artifact for invalid or partial input.
+2. Run `agent-infra-internal task-artifact {task-id} inspect --family validation-run` and read the latest review-code manual-validation items. Then run `agent-infra-internal platform-pr inspect {task-id}` and use the reference status matrix to discover, merge, and number items. Only automatic mode stops before started when reliable sources are empty or the sole possible source is unreadable; valid explicit mode always continues with the user command as effective work.
+3. Take the round and artifact name from the core result. After confirming valid explicit work or a non-empty discovered list, run `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token}` and classify each item as `executable|unavailable|unknown|unsafe|unresolved`.
+4. Invoke every executable item separately with `ai task validate {task-ref} --scope snapshot --format json -- {command...}`. Only make a second explicit inplace invocation for that item when evidence proves it is required. If no item is executable, run no fabricated command but still produce coverage-gap evidence.
+5. Read `reference/report-template.md`, create `validation-run.md|validation-run-r{N}.md`, and record the input mode, discovered list, per-item results, CLI JSON allowlist, and sanitized summaries.
+6. Run `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --artifact {artifact}`. When an Issue exists, run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}` and then `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {standard-agent-token}`.
+7. Run `agent-infra-internal task-verify {task-id} validation-run.completed --artifact {artifact} --format text`; fix failures and rerun it.
+8. Report the evidence path, coverage gaps, and verification result; explicitly leave the decision to run `complete-manual-validation` to the maintainer. Read `.agents/rules/next-step-output.md` and end with `Completed at`.
+
+## Completion Checklist
+
+- [ ] Used `ai task validate` for every executable item, or recorded that none were executable
+- [ ] Recorded sanitized validation-run evidence
+- [ ] Did not change PR manual validation completion state
+- [ ] Updated task.md and passed completion verification

package/templates/.agents/skills/run-manual-validation/SKILL.zh-CN.md

@@ -0,0 +1,42 @@
+---
+name: run-manual-validation
+description: >
+  在宿主机安全运行任务人工校验并记录标准证据。
+  当校验依赖宿主权限、真实容器或原位工作树状态时使用。
+  仅当对话包含可解析的任务引用时才可自动调用本技能。
+---
+
+# 运行人工校验
+
+## 行为边界
+
+- 本技能负责选择校验模式、调用唯一机械入口并记录证据；不把 PR 人工校验标为完成。
+- `complete-manual-validation` 仍是维护者确认覆盖充分后的最终登记入口。
+- 禁止直接操作临时 worktree、lease 或 container；只调用 `ai task validate`。
+- 产物不得记录 token、环境变量、完整 argv、绝对用户路径或原始 transcript。
+
+## 第 0 步：状态核对（执行前硬约束）
+
+解析任务引用后运行，并把原文写入产物：
+
+```bash
+agent-infra-internal task-snapshot {task-id} --format text
+```
+
+## 执行步骤
+
+1. 读取 `reference/discovery-and-execution.md`，解析输入模式；非法或半截输入在 started 前停止，不写产物。
+2. 运行 `agent-infra-internal task-artifact {task-id} inspect --family validation-run`，读取最新 review-code 人工校验项；再运行 `agent-infra-internal platform-pr inspect {task-id}`，按 reference 的状态矩阵发现、归并并编号。仅在自动模式下，可靠来源无项或唯一可能来源不可读时才在 started 前停止；合法显式模式始终以用户命令作为有效工作继续。
+3. 从核心结果取得轮次和产物名；确认存在有效显式工作或非空发现清单后，运行 `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token}`，并逐项分类为 `executable|unavailable|unknown|unsafe|unresolved`。
+4. 每个可执行项分别调用 `ai task validate {task-ref} --scope snapshot --format json -- {command...}`；只有证据表明必须原位时才对该项进行第二次显式 inplace 调用。零项可执行时不运行伪造命令，但仍继续产出覆盖缺口证据。
+5. 读取 `reference/report-template.md`，创建 `validation-run.md|validation-run-r{N}.md`；记录输入模式、发现清单、逐项结果、CLI JSON allowlist 与去敏摘要。
+6. 运行 `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --artifact {artifact}`。存在 Issue 时依次运行 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}` 和 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {standard-agent-token}`。
+7. 运行 `agent-infra-internal task-verify {task-id} validation-run.completed --artifact {artifact} --format text`；未通过则修复后重跑。
+8. 告知用户证据路径、覆盖缺口和验证结果；明确仍需维护者判断是否执行 `complete-manual-validation`。读取 `.agents/rules/next-step-output.md`，最后一行输出 `Completed at`。
+
+## 完成检查清单
+
+- [ ] 每个可执行项均已使用 `ai task validate`，或已记录零项可执行
+- [ ] 已记录去敏 validation-run 证据
+- [ ] 未修改 PR 人工验证完成状态
+- [ ] 已更新 task.md 并通过完成校验

package/templates/.agents/skills/run-manual-validation/config/verify.en.json

@@ -0,0 +1,25 @@
+{
+  "skill": "run-manual-validation",
+  "checks": {
+    "task-meta": {
+      "required_fields": ["id", "type", "workflow", "status", "created_at", "updated_at", "agent_infra_version", "current_step", "assigned_to"]
+    },
+    "artifact": {
+      "file_pattern": "validation-run.md|validation-run-r{N}.md",
+      "required_sections": ["Input Mode", "State Check", "Validation Target", "Discovered Items", "Mode Decision", "Command Summary", "Structured Evidence", "Per-item Results", "Cleanup and Recovery", "Remaining Coverage", "Raw Evidence"],
+      "required_patterns": ["^\\$ "]
+    },
+    "activity-log": { "expected_action_pattern": "Run Manual Validation \\(Round \\d+\\)" },
+    "review-ledger": { "stage_scope": ["analysis", "plan", "code"] },
+    "platform-sync": {
+      "when": "issue_number_exists",
+      "expected_comment_marker": "<!-- sync-issue:{task-id}:{artifact-stem} -->",
+      "verify_comment_content": true,
+      "verify_task_comment_content": true,
+      "verify_issue_type": true,
+      "verify_issue_fields": false,
+      "verify_milestone": true,
+      "expected_comment_marker_key": "artifact"
+    }
+  }
+}

package/templates/.agents/skills/run-manual-validation/config/verify.zh-CN.json

@@ -0,0 +1,25 @@
+{
+  "skill": "run-manual-validation",
+  "checks": {
+    "task-meta": {
+      "required_fields": ["id", "type", "workflow", "status", "created_at", "updated_at", "agent_infra_version", "current_step", "assigned_to"]
+    },
+    "artifact": {
+      "file_pattern": "validation-run.md|validation-run-r{N}.md",
+      "required_sections": ["输入模式", "状态核对", "验证目标", "发现清单", "模式判定", "命令摘要", "结构化证据", "逐项结果", "清理与恢复", "尚未覆盖", "证据原文"],
+      "required_patterns": ["^\\$ "]
+    },
+    "activity-log": { "expected_action_pattern": "Run Manual Validation \\(Round \\d+\\)" },
+    "review-ledger": { "stage_scope": ["analysis", "plan", "code"] },
+    "platform-sync": {
+      "when": "issue_number_exists",
+      "expected_comment_marker": "<!-- sync-issue:{task-id}:{artifact-stem} -->",
+      "verify_comment_content": true,
+      "verify_task_comment_content": true,
+      "verify_issue_type": true,
+      "verify_issue_fields": false,
+      "verify_milestone": true,
+      "expected_comment_marker_key": "artifact"
+    }
+  }
+}

package/templates/.agents/skills/run-manual-validation/reference/discovery-and-execution.en.md

@@ -0,0 +1,67 @@
+# Automatic Discovery and Per-item Execution
+
+Read this file before parsing input, discovering manual-validation items, or constructing validation actions.
+
+## Input Modes
+
+| Input | Handling |
+|-------|----------|
+| Non-empty target and command surround a literal `--` | Explicit mode; the command is authoritative for that target |
+| A literal `--` is present but the target or command is empty | Invalid input; stop before `validation-run.started` |
+| No `--` and only a task ref | Automatic mode |
+| No `--` and additional positional arguments | Invalid or partial input; do not ignore arguments or guess a command |
+
+Explicit mode still reads available sources to map coverage, but it must not synthesize another command for the same target. Only automatic mode constructs actions for discovered items.
+
+## Work Gate Matrix
+
+| mode | source state | gate |
+|------|--------------|------|
+| `explicit` | `any` | `continue` |
+| `automatic` | `items` | `continue` |
+| `automatic` | `empty` | `stop` |
+| `automatic` | `unreadable-only` | `stop` |
+
+The user command is effective work in valid explicit mode. Empty or unreadable sources affect only coverage mapping and reporting and must not cause an early stop. Automatic mode depends on reliable discovery results.
+
+## Discovery Sources
+
+1. Read manual-validation items from the latest `review-code` returned by `task-artifact`; this is the canonical local source. Read only that round's structured list, never task.md prose, older reviews, the activity log, or comment history.
+2. Run `agent-infra-internal platform-pr inspect {task-id}` and read the bound PR body's pending manual-validation list from a successful response as the supplemental source.
+3. Deduplicate semantically by target, required environment, and expected assertion. Merge identical items with review-code details taking precedence, append PR-only items, and classify material conflicts as `unresolved`.
+4. Assign report-local IDs `MV-1..N` and record source, target, expected assertion, required capability, and candidate steps. Do not write the task ledger.
+
+## PR Source Status
+
+| PR inspect result | Local items exist | No local items |
+|-------------------|-------------------|----------------|
+| Success | Merge lists; use only local items if the PR list is empty | Use the PR list; stop before started when both lists are empty |
+| `no-op` + `PR_NOT_LINKED` | Use local items only | Stop normally before started |
+| `failed` or `blocked` | Continue with local items; record typed status, stable error code, and the source coverage gap | Fail closed before started and request a retry after platform access is restored |
+
+Explicit mode may run its authoritative command when PR inspection fails, but the report must state that the PR list could not be reconciled. Never treat a read failure as an empty list or record the raw remote response.
+
+## Classification and Safe Actions
+
+Assign exactly one classification per item:
+
+- `executable`: host capability is supported by sufficient evidence and the action is minimal, non-interactive, and scoped.
+- `unavailable`: the required platform, filesystem semantics, permission, container, or account is definitely absent.
+- `unknown`: only weak signals exist and a safe probe cannot prove capability.
+- `unsafe`: validation would require destructive, secret-exposing, or unsanitizable actions.
+- `unresolved`: sources materially conflict about the environment or expected assertion.
+
+Only `executable` items may run. Commands must not expose credentials, environment variables, full argv, absolute user paths, or raw transcripts. Leave a coverage gap when safety cannot be established.
+
+## Per-item Execution
+
+1. Invoke each executable item separately:
+
+   ```bash
+   ai task validate {task-ref} --scope snapshot --format json -- {command...}
+   ```
+
+2. Only when the item or first-run evidence proves a dependency on uncommitted content, original mounts, or in-place permissions, explicitly invoke that item a second time with `--scope inplace` and record the reason.
+3. One item failure does not stop independent remaining items. Record exit status, cleanup, and the sanitized JSON allowlist separately.
+4. When the list is non-empty but no item is `executable`, still create and complete a validation-run artifact after started; do not run placeholder or fabricated commands.
+5. Always stop before started for invalid input. In automatic mode, also stop before started without an artifact when both sources are reliably empty or the sole possible source is unreadable with no local items; those source-based stop conditions do not apply to valid explicit mode.

package/templates/.agents/skills/run-manual-validation/reference/discovery-and-execution.zh-CN.md

@@ -0,0 +1,67 @@
+# 自动发现与逐项执行
+
+在解析输入、发现人工校验项或构造验证动作前读取本文件。
+
+## 输入模式
+
+| 输入 | 处理 |
+|------|------|
+| literal `--` 前后分别有非空验证目标和命令 | 显式模式；命令为该目标的权威动作 |
+| 存在 literal `--`，但目标或命令为空 | 非法输入；在 `validation-run.started` 前停止 |
+| 不存在 `--`，且只有 task ref | 自动模式 |
+| 不存在 `--`，但还有位置参数 | 非法/半截输入；不得忽略参数或猜测命令 |
+
+显式模式也要读取可用来源以映射覆盖范围，但不得为同一目标另行合成命令。自动模式才为发现项构造动作。
+
+## 工作门禁矩阵
+
+| mode | source state | gate |
+|------|--------------|------|
+| `explicit` | `any` | `continue` |
+| `automatic` | `items` | `continue` |
+| `automatic` | `empty` | `stop` |
+| `automatic` | `unreadable-only` | `stop` |
+
+合法显式模式的用户命令本身就是有效工作；来源为空或不可读只影响覆盖映射和报告，不得触发早退。自动模式必须依赖可靠发现结果。
+
+## 发现来源
+
+1. 从 `task-artifact` 返回的最新 `review-code` 读取人工校验项，作为 canonical 本地来源。只读取该轮结构化的人工校验清单，不扫描 task.md 自由文本、旧审查轮次、活动日志或评论历史。
+2. 运行 `agent-infra-internal platform-pr inspect {task-id}`，从成功返回的绑定 PR 正文读取待人工验证清单，作为补充来源。
+3. 按目标、所需环境和预期断言语义去重。相同项合并来源并优先采用 review-code 细节；PR 独有项追加；关键要求冲突的项标为 `unresolved`。
+4. 为本轮清单分配局部 ID `MV-1..N`，记录来源、目标、预期断言、所需能力和候选步骤；不得写入 task ledger。
+
+## PR 来源状态
+
+| PR inspect 结果 | 本地有项目 | 本地无项目 |
+|-----------------|------------|------------|
+| 成功 | 合并清单；PR 空清单时仅用本地项 | 使用 PR 清单；两边均为空时 started 前正常停止 |
+| `no-op` + `PR_NOT_LINKED` | 仅使用本地项 | started 前正常停止 |
+| `failed` 或 `blocked` | 继续本地项；在报告记录 typed 状态、稳定错误码和来源覆盖缺口 | started 前 fail closed，提示恢复平台访问后重试 |
+
+显式模式在 PR 检查失败时仍可执行权威命令，但必须记录无法核对 PR 清单。不要把读取失败当作空清单，也不要记录原始远端响应。
+
+## 分类与安全动作
+
+逐项选择一种分类：
+
+- `executable`：宿主能力已有充分证据；动作最小、非交互且作用域受限。
+- `unavailable`：明确缺少所需平台、文件系统语义、权限、容器或账号。
+- `unknown`：仅有弱信号，安全探测也无法证明能力。
+- `unsafe`：只能通过破坏性、泄密或无法去敏的动作验证。
+- `unresolved`：来源对环境或预期断言存在关键冲突。
+
+只有 `executable` 可以运行。命令不得输出凭据、环境变量、完整 argv、绝对用户路径或原始 transcript；不能证明安全就保留覆盖缺口。
+
+## 逐项执行
+
+1. 每个可执行项分别调用：
+
+   ```bash
+   ai task validate {task-ref} --scope snapshot --format json -- {command...}
+   ```
+
+2. 仅当项目要求或首次证据证明依赖未提交内容、原挂载或原位权限时，再为该项显式调用一次 `--scope inplace`，并记录升级理由。
+3. 单项失败不阻止其余独立项；分别记录退出状态、cleanup 和去敏 JSON allowlist。
+4. 清单非空但没有 `executable` 项时，仍在 started 后生成 validation-run 产物并完成 lifecycle，不运行占位或伪造命令。
+5. 输入非法时始终在 started 前停止。自动模式下，两来源可靠地确认无项，或唯一可能来源不可读且本地无项时，也在 started 前停止且不写产物；合法显式模式不适用这两个来源停止条件。

package/templates/.agents/skills/run-manual-validation/reference/report-template.en.md

@@ -0,0 +1,69 @@
+# Validation Run Evidence
+
+## Input Mode
+
+- Mode: `{explicit|automatic}`
+- Input decision: {sanitized-input-decision}
+- PR source status: `{success|no-op|failed|blocked}` / `{stable-code-or-none}`
+
+## State Check
+
+```text
+$ agent-infra-internal task-snapshot {task-id} --format text
+{raw-output}
+```
+
+## Validation Target
+
+{target-and-coverage}
+
+## Discovered Items
+
+| ID | Source | Target | Required Capability | Expected Assertion | Classification |
+|----|--------|--------|---------------------|--------------------|----------------|
+| `MV-{N}` | `{review-code|pr|merged|explicit}` | {target} | {capability} | {expected-assertion} | `{executable|unavailable|unknown|unsafe|unresolved}` |
+
+## Mode Decision
+
+- Mode: `{snapshot|inplace}`
+- Reason: {reason}
+- Runtime upgrade: {none-or-reason}
+
+## Command Summary
+
+- Command name: `{basename-only}`
+- Do not record full argv, environment variables, or raw output.
+
+## Structured Evidence
+
+```json
+{sanitized-ai-task-validate-json}
+```
+
+## Per-item Results
+
+### MV-{N}
+
+- Source: `{source}`
+- Classification: `{classification}`
+- Scope: `{snapshot|inplace|not-run}`
+- Command name: `{basename-only|not-run}`
+- Exit status: `{exit-status|not-run}`
+- Runtime upgrade: {none-or-reason}
+- Result: {sanitized-result-or-coverage-gap}
+- Cleanup: {cleanup-result}
+
+## Cleanup and Recovery
+
+{cleanup-and-recovery-result}
+
+## Remaining Coverage
+
+{remaining-manual-validation-items}
+
+## Raw Evidence
+
+```text
+$ ai task validate {task-ref} --scope {scope} --format json -- {redacted-command}
+{sanitized-result}
+```

package/templates/.agents/skills/run-manual-validation/reference/report-template.zh-CN.md

@@ -0,0 +1,69 @@
+# 验证运行证据
+
+## 输入模式
+
+- 模式：`{explicit|automatic}`
+- 输入判定：{sanitized-input-decision}
+- PR 来源状态：`{success|no-op|failed|blocked}` / `{stable-code-or-none}`
+
+## 状态核对
+
+```text
+$ agent-infra-internal task-snapshot {task-id} --format text
+{raw-output}
+```
+
+## 验证目标
+
+{target-and-coverage}
+
+## 发现清单
+
+| ID | 来源 | 目标 | 所需能力 | 预期断言 | 分类 |
+|----|------|------|----------|----------|------|
+| `MV-{N}` | `{review-code|pr|merged|explicit}` | {target} | {capability} | {expected-assertion} | `{executable|unavailable|unknown|unsafe|unresolved}` |
+
+## 模式判定
+
+- 模式：`{snapshot|inplace}`
+- 依据：{reason}
+- 运行时升级：{none-or-reason}
+
+## 命令摘要
+
+- 命令名称：`{basename-only}`
+- 不记录完整 argv、环境变量或原始输出。
+
+## 结构化证据
+
+```json
+{sanitized-ai-task-validate-json}
+```
+
+## 逐项结果
+
+### MV-{N}
+
+- 来源：`{source}`
+- 分类：`{classification}`
+- Scope：`{snapshot|inplace|not-run}`
+- 命令名称：`{basename-only|not-run}`
+- 退出状态：`{exit-status|not-run}`
+- 运行时升级：{none-or-reason}
+- 结果：{sanitized-result-or-coverage-gap}
+- Cleanup：{cleanup-result}
+
+## 清理与恢复
+
+{cleanup-and-recovery-result}
+
+## 尚未覆盖
+
+{remaining-manual-validation-items}
+
+## 证据原文
+
+```text
+$ ai task validate {task-ref} --scope {scope} --format json -- {redacted-command}
+{sanitized-result}
+```

package/templates/.agents/skills/run-task/SKILL.en.md

@@ -9,13 +9,15 @@ description: >
 
 The orchestrator delegates only and never executes a stage skill itself. First read `.agents/rules/no-mid-flow-questions.md`, `.agents/rules/lifecycle-orchestration.md`, and `reference/host-validation.md`.
 
-1. Resolve the task, current Agent Client, and optional atomic policy flags `--executor-model`, `--executor-reasoning-effort`, `--reviewer-model`, and `--reviewer-reasoning-effort`, then run `task-snapshot`. If any explicit policy flag is present, all four role fields are required and must not be merged with configuration; both roles may use the same model.
-2. Run `task-orchestration {task-id} begin-or-resume --client {client}` with the complete explicit policy. With no explicit policy, core reads only that client's `agentClients[].orchestration`; an existing v2 run uses its persisted policy. Only on `ORCHESTRATION_MODEL_POLICY_REQUIRED`, show the complete/partial/interactive-only `agent-client model-selection` context and collect one complete policy; no answer means no run is created. Stop on paused/completed results.
-3. Run `route` and read its structured result. On `completed`, immediately run `agent-infra-internal task-verify {task-id} run-task.completed --format text` and stop. Only when the result is `running` with a non-null `next`, use its single action, role, round, artifact, `requestedModel`, and `requestedReasoningEffort`; never infer them from review prose, session defaults, or a partial tool schema.
-4. Only for the `running` result from step 3, run `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort}` so core validates both fields and host evidence before snapshotting. Claude Code's native start event currently cannot provide stable actual model/effort evidence, so it returns `ORCHESTRATION_CLIENT_UNSUPPORTED` and stops like any other client without that evidence. Only after validation succeeds, start a fresh native child with the same model/effort overrides and only the short task ref, skill name, literal `--orchestrated` execution marker, and minimal handoff. The child must forward that marker to every provenance-sensitive command in the stage.
-5. Native start/stop hooks correlate the unique pending delegation and let core compute workspace changes and seal the receipt. After the child returns, run `advance`. Repeat step 3 only for `running`; stop immediately for `paused` or `completed`.
-6. Create a new child every round and never follow up with an old reviewer. Native start must report actual model and actual reasoning effort; each requested/actual mismatch needs its own host fallback reason, and requested values must never be fabricated as actual evidence. Capability, hook, identity, evidence, ledger, or fingerprint failures must call `pause` and fail closed.
-7. On pause or completion, run the matching typed verification and report the structured run summary, pause reason, commit endpoint, or clean completion evidence.
+1. Resolve the canonical task ID, current Agent Client, and optional atomic policy flags, then run `task-snapshot`. If one explicit role field is present, all four are required.
+2. Before `begin-or-resume`, Codex selects a host. Without `AGENT_INFRA_CONTROL_TOKEN`, use direct-host. With task-bound control authority but no `AGENT_INFRA_CODEX_CONTROLLER_CONTEXT`, only run `codex-sandbox-controller run --task-id {task-id} --task-ref {task-ref}` with the complete policy and wait; the outer loop must not create a run, baseline, or receipt. With a context, run `verify-context --task-id {task-id}` first. Stop on any bootstrap, bundle, source/profile discovery, or context failure.
+3. Run `task-orchestration {task-id} begin-or-resume --client {client}` with the complete explicit policy. With no explicit policy, core reads that client's configured policy; existing v2/v3 runs use persisted policy. Stop on paused/completed results.
+4. Run `route`. On `completed`, run `agent-infra-internal task-verify {task-id} run-task.completed --format text` and stop. Only a `running` result with non-null `next` supplies action, role, round, artifact, requested model, and requested effort.
+5. Codex runs `codex-lifecycle capability-arm --task-id {task-id}` once. The current loop's real PostToolUse must attest that ordinary tool response. Pass only its marker token to `prepare --client {client} --capability-token {token}`. Before snapshotting, core atomically consumes it, verifies task, hook source, build, contract, and controller binding, and persists the capability session, turn, and tool-use origin. Activation then verifies that spawn belongs to the same session and turn and uses a distinct tool-use. Other clients use the same prepare without a token. Failure creates no baseline, receipt, or child.
+6. After prepare, run `task-orchestration <task-ref> dispatch` immediately before calling the fresh native child, then use route's exact model/effort and only the short task ref, skill, `--orchestrated`, and stage identity. The trusted hook-spawn first-observation time must fall between dispatch and the deadline. Its first provenance-sensitive command must be `await-activation --stage ... --round ... --artifact ... --role ...`; before `running`, it must not snapshot, emit stage-started, write business files, or start commit. Only explicit `recover-prepared` may clear an expired orphan when the task fingerprint is exact, no commit intent exists, and no matching unconsumed active lifecycle evidence remains.
+7. Codex uses SubagentStart/Stop and App Server actual evidence to activate, consume, and seal one v3 receipt; trusted parent fallback must produce the same provenance. Timed-out waits do nothing. Advance only a sealed receipt and repeat step 4 only while running.
+8. Create a fresh child each round and never follow up with an old reviewer. Each requested/actual mismatch needs its own host fallback reason. Capability, hook, source, controller, build, identity, ledger, or fingerprint failure pauses and fails closed.
+9. On pause or completion, run the matching typed verification and report the structured endpoint.
 
 ## Stop
 

package/templates/.agents/skills/run-task/SKILL.zh-CN.md

@@ -9,13 +9,15 @@ description: >
 
 总控只编排，不直接执行任何阶段技能。执行前先读取 `.agents/rules/no-mid-flow-questions.md`、`.agents/rules/lifecycle-orchestration.md` 与 `reference/host-validation.md`。
 
-1. 解析任务引用、当前 Agent Client，以及可选的原子策略 `--executor-model`、`--executor-reasoning-effort`、`--reviewer-model`、`--reviewer-reasoning-effort`，并执行 `agent-infra-internal task-snapshot {task-id} --format text`。任一显式策略字段出现时四个 role 字段必须完整，不得与配置拼接；两个角色可以使用同一模型。
-2. 调用 `agent-infra-internal task-orchestration {task-id} begin-or-resume --client {client}` 并转发完整显式策略。完全没有显式策略时由核心读取当前 client 的 `agentClients[].orchestration`；已有 v2 run 使用持久化策略。仅当核心返回 `ORCHESTRATION_MODEL_POLICY_REQUIRED` 时，先用 `agent-client model-selection` 展示 complete/partial/interactive-only 来源，再一次收集完整策略；未回答则不创建 run。若为 paused/completed，按结构化结果停止。
-3. 调用 `route` 并读取结构化结果。若返回 `completed`，立即运行 `agent-infra-internal task-verify {task-id} run-task.completed --format text` 并停止；仅当返回 `running` 且 `next` 非空时读取唯一 action、role、round、artifact、`requestedModel` 和 `requestedReasoningEffort`，不得从审查文案、会话默认或局部 tool schema 自行推断。
-4. 仅对步骤 3 的 `running` 结果调用 `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort}`；核心在记录工作区基线前校验两字段与宿主证据能力。当前 Claude Code 的原生 start 事件无法稳定提供 actual model/effort，因此与其他缺少该证据的客户端一样返回 `ORCHESTRATION_CLIENT_UNSUPPORTED` 并停止。只有校验成功时才用当前客户端的 fresh 原生子 Agent 启动指定角色，并显式覆盖同一 model/effort；只传短任务引用、skill 名、字面执行标记 `--orchestrated` 和最小交接摘要，不传 receipt identity，不继承总控历史。子 Agent 必须把该标记转发给本阶段所有 provenance 敏感命令。
-5. 原生 start/stop hook 通过唯一 pending delegation 自动关联任务，并由核心计算工作区变化、封存 receipt；子 Agent 返回后调用 `advance`。只有 `running` 才重复步骤 3；`paused` 或 `completed` 立即停止。
-6. 每轮创建新 child；禁止 follow-up 复用 reviewer。原生 start 必须回传 actual model 与 actual reasoning effort；任一 actual 与 requested 不同时必须有各自的宿主降级理由，缺失时不得用 requested 值补造。任何 capability、hook、身份、证据、账本或 fingerprint 异常都调用 `pause` 并失败关闭。
-7. 完成或暂停后运行对应 typed verification，并把结构化 run 摘要、暂停原因、commit 终点或 clean completion evidence 告知用户。
+1. 解析规范任务 ID、当前 Agent Client，以及可选的原子策略 `--executor-model`、`--executor-reasoning-effort`、`--reviewer-model`、`--reviewer-reasoning-effort`，并执行 `agent-infra-internal task-snapshot {task-id} --format text`。任一显式策略字段出现时四个 role 字段必须完整，不得与配置拼接；两个角色可以使用同一模型。
+2. Codex 在 `begin-or-resume` 前选择宿主：没有 `AGENT_INFRA_CONTROL_TOKEN` 时使用 direct-host；有 task-bound control authority 但没有 `AGENT_INFRA_CODEX_CONTROLLER_CONTEXT` 时，只调用 `agent-infra-internal codex-sandbox-controller run --task-id {task-id} --task-ref {task-ref}`（转发完整显式策略）并等待其终态，外层不得创建 run、baseline 或 receipt；已有 context 时先调用 `verify-context --task-id {task-id}`。controller 的 bootstrap、bundle、source/profile discovery 或 context 任一校验失败即停止。
+3. 调用 `agent-infra-internal task-orchestration {task-id} begin-or-resume --client {client}` 并转发完整显式策略。完全没有显式策略时由核心读取当前 client 的 `agentClients[].orchestration`；已有 v2/v3 run 使用持久化策略。仅当核心返回 `ORCHESTRATION_MODEL_POLICY_REQUIRED` 时，先用 `agent-client model-selection` 展示 complete/partial/interactive-only 来源，再一次收集完整策略；未回答则不创建 run。若为 paused/completed，按结构化结果停止。
+4. 调用 `route` 并读取结构化结果。若返回 `completed`，立即运行 `agent-infra-internal task-verify {task-id} run-task.completed --format text` 并停止；仅当返回 `running` 且 `next` 非空时读取唯一 action、role、round、artifact、`requestedModel` 和 `requestedReasoningEffort`，不得自行推断。
+5. Codex 先调用一次 `agent-infra-internal codex-lifecycle capability-arm --task-id {task-id}`。该普通工具调用必须由当前 loop 的真实 PostToolUse 回写 attestation；仅把返回的 marker 中 token 传给 `prepare --client {client} --capability-token {token}`。核心在快照前原子消费 token，校验 task、hook source、build、contract 与 controller binding，并持久化 capability 的 session、turn、tool-use 来源。activation 再校验 spawn 与该来源属于同一 session/turn，且 spawn 使用独立的 tool-use。其他客户端直接调用同一 prepare（无 token）。任一失败不得创建 baseline、receipt 或 child。
+6. prepare 成功后，在调用 fresh 原生子 Agent 的紧邻前一步执行 `task-orchestration <task-ref> dispatch`，再显式覆盖 route 返回的 model/effort；只传短任务引用、skill 名、`--orchestrated` 与 stage/round/artifact/role。可信 hook-spawn 首次观察时间必须位于 dispatch 与 deadline 之间。child 的第一条 provenance-sensitive 命令必须是 `await-activation --stage ... --round ... --artifact ... --role ...`；返回 running 前禁止 snapshot、阶段 started、业务写入或 commit-start。超时由核心暂停；崩溃遗留 prepared receipt 只能在 exact workspace fingerprint、无 commit intent、无匹配的未消费 active lifecycle evidence 且 deadline 已过时显式 `recover-prepared`。
+7. Codex 用 SubagentStart/Stop 与 App Server actual evidence 激活、消费并封存唯一 receipt；受信 parent fallback 仍必须形成相同 v3 provenance。timed-out wait 无动作；只有 empty turns 或协议 `inProgress` 可等待，malformed、身份/传输错误或异常 terminal 均暂停。子 Agent 返回后只对 sealed receipt 调用 `advance`；只有 `running` 才重复步骤 4。
+8. 每轮创建新 child；禁止 follow-up 复用 reviewer。actual model/effort 与 requested 不同时必须有各自的宿主降级理由。任何 capability、hook、source、controller、build、身份、账本或 fingerprint 异常都调用 `pause` 并失败关闭。
+9. 完成或暂停后运行对应 typed verification，并把结构化 run 摘要、暂停原因、commit 终点或 clean completion evidence 告知用户。
 
 ## 停止