@fitlab-ai/agent-infra 0.9.6 → 0.9.8

package/templates/.agents/rules/review-handshake.en.md

@@ -94,7 +94,9 @@ When an executor judges an item to be a key design decision that needs human rul
 - The `complete-task` `post-review-commit` gate uses only B. When B is absent, malformed, or missing as a Git object, it reports `reviewed snapshot was not anchored` and never falls back to R.
 - If new commits touch code / rule paths after B, the gate blocks and requires a fresh `review-code`. Automatic exceptions are limited to: (1) a bound platform change request (PR/MR) is merged and its platform adapter supplies an authoritative snapshot plus remote Git evidence refs; the gate fetches the reviewed head and target branch into an isolated temporary repository and proves B is the original change-request head, its merge commit is in authoritative target history, its reviewed changes exactly match the normalized patch of a single-parent squash commit, and its protected paths have no later commits; or (2) no valid change request, exactly one protected-path commit after B, that commit is a single-parent local rewrite in HEAD history, it has the same full tree or protected content as B, and no protected-path commits follow it. An unsupported adapter capability, missing required platform / Git evidence, or Git credentials that cannot read those remote refs fails closed.
 - Required checks remain a pre-merge responsibility of branch protection / rulesets and the `review-code` / `watch-pr` routes. The post-review-commit gate still applies the applicable strict, PR-squash, or local-rewrite equivalence independently.
-- **Exemption**: append a ledger row `| PRC-1 | post-review-commit | - | - | human-decided | <ruling note> |` recording that a human explicitly allowed those commits without re-review.
+- **Exemption**: the canonical row is `| PRC-1 | post-review-commit | - | - | human-decided | <ruling note> |`. The id must be `PRC-N`, round and severity must be `-`, status must be `human-decided`, and evidence must be non-empty single-line text that records the ruling reason and applicable commit scope. Any malformed post-review row fails closed.
+- A merged-PR human exemption may override only the stable `PR_MERGE_IDENTITY_INVALID` failure. Blocked results, missing evidence, content/topology/target-history mismatches, and all other failed codes must not consume PRC. The passing result must preserve the original failure code/message and every consumed PRC id/evidence, and must not describe the result as automatic equivalence.
+- task.md is the persistent source of truth. Before preflight, the platform summary mirrors an existing warning or, without one, states only that the ruling awaits verification. After the exemption gate passes, the caller uses the gate output to complete the original-failure evidence and updates the same summary marker in place. The summary also mirrors the ruling reason, commit scope, human identity, and time from task.md.
 
 ## Gate behavior cheat sheet
 

package/templates/.agents/rules/review-handshake.zh-CN.md

@@ -94,7 +94,9 @@
 - `complete-task` 的 `post-review-commit` gate 只使用 B；B 缺失、畸形或对象不存在时报告 `reviewed snapshot was not anchored`，不得回退 R。
 - 若 B 之后代码 / 规则路径出现新提交，gate 会拦截，要求重新 `review-code`。自动例外仅限两类：(1) 绑定的平台变更请求（PR/MR）已合并，且平台适配器提供权威快照与远端 Git 证据引用；gate 在隔离的临时仓库中抓取受审查 head 与目标分支，证明 B 是原变更请求 head、merge commit 位于权威目标分支历史中、受审查变更与单父 squash commit 的规范化补丁完全一致，并且 merge 后受保护路径没有新提交；(2) 无有效变更请求，B 后恰有一个受保护路径提交，该提交是本地 HEAD 历史中的单父重写，且它与 B 的完整 tree 相同或受保护内容相同，重写后也没有受保护路径提交。适配器不支持该能力，缺少所需平台 / Git 证据，或当前 Git 凭据不能读取这些远端 refs 时 fail closed。
 - 全部 PR checks 由合并前的 `review-code` / `watch-pr` 路由负责，其中 required checks 仍受分支保护 / ruleset 强制。post-review-commit 仍独立执行适用的严格 / PR squash / 本地重写等价判定。
-- **豁免**：在账本追加一行 `| PRC-1 | post-review-commit | - | - | human-decided | <裁定说明> |`，记录人工明确允许该批提交免复审。
+- **豁免**：canonical 行形状为 `| PRC-1 | post-review-commit | - | - | human-decided | <裁定说明> |`。id 必须为 `PRC-N`，round/severity 必须为 `-`，status 必须为 `human-decided`，evidence 必须为非空单行文本并记录裁定理由与适用提交范围；任何不符合形状的 post-review 行均 fail closed。
+- merged-PR 人工豁免只可覆盖稳定的 `PR_MERGE_IDENTITY_INVALID`；blocked、证据缺失、内容/拓扑/目标历史不一致及其他 failed code 不得消费 PRC。通过消息必须保留原 failure code/message 与所消费的 PRC id/evidence，且不得表述为自动等价成功。
+- task.md 是持久化事实源。平台摘要在 preflight 前镜像既有 warning，或在无 warning 时只声明裁决待验证；人工豁免 gate 通过后，再以 gate 输出补齐原始失败并原地更新同一 summary marker。摘要同时镜像 task.md 中的裁决理由、提交范围、人工身份与时间。
 
 ## gate 行为速查
 

package/templates/.agents/skills/code-task/reference/dual-mode.en.md

@@ -10,6 +10,8 @@ agent-infra-internal task-artifact {task-id} inspect --family code
 
 The core scans `plan.md` / `plan-r{N}.md`, `review-plan.md` / `review-plan-r{N}.md`, `code.md` / `code-r{N}.md`, and `review-code.md` / `review-code-r{N}.md` in the task directory.
 
+`code.started` persists the plan identity and SHA-256 for the round in task.md frontmatter. `code.completed` must read the canonical plan from the implementation report's `Plan Input` field and match both that start context and the current latest plan; missing, mismatched, or changed input fails closed.
+
 ## Eight Branches
 
 > Branches are evaluated top-down in this table; the first match returns and skips later rows.
@@ -17,7 +19,7 @@ The core scans `plan.md` / `plan-r{N}.md`, `review-plan.md` / `review-plan-r{N}.
 | Condition | mode | exit | Behavior |
 |---|---|---:|---|
 | no code artifact, and the latest review-plan is exactly `Approved` and references the latest plan | `init` | 0 | initial implementation, output `code.md`; a missing matching approval or `Approved-with-issues` returns an error |
-| latest review-plan is exactly `Approved`, references the latest plan, and is newer than the latest code | `init` | 0 | enter a new implementation round. `Approved-with-issues` remains parse-compatible for history but is not cross-stage approval |
+| latest review-plan is exactly `Approved`, references the latest plan, and the latest code completion receipt does not bind the same plan digest | `init` | 0 | enter a new implementation round. `Approved-with-issues` remains parse-compatible for history but is not cross-stage approval; missing or invalid receipts fail closed |
 | `rev_max < code_max` | `error` | 2 | latest code round is unreviewed; run `review-code` first |
 | latest review-code is Approved and a pending implementation input was decided after that review completed | `decision` | 0 | select the earliest `II-N` and enter decision-driven implementation; false/not-required and consumed inputs do not trigger |
 | latest review-code is Approved with 0/0/0 | `refused` | 1 | already approved; do not run `code-task` again |

package/templates/.agents/skills/code-task/reference/dual-mode.zh-CN.md

@@ -10,6 +10,8 @@ agent-infra-internal task-artifact {task-id} inspect --family code
 
 核心扫描任务目录中的 `plan.md` / `plan-r{N}.md`、`review-plan.md` / `review-plan-r{N}.md`、`code.md` / `code-r{N}.md` 和 `review-code.md` / `review-code-r{N}.md`。
 
+`code.started` 会在 task.md frontmatter 中绑定本轮方案文件及其 SHA-256。`code.completed` 必须从实现报告的“方案输入”/“Plan Input”字段读取 canonical plan，并同时匹配该开始上下文和当前最新 plan；缺失、身份不一致或内容变化均失败关闭。
+
 ## 8 个分支
 
 > 分支按表中自上而下的顺序评估，命中即返回；后续分支不再判定。
@@ -17,7 +19,7 @@ agent-infra-internal task-artifact {task-id} inspect --family code
 | 条件 | mode | exit | 行为 |
 |---|---|---:|---|
 | 无 code 产物，且最新 review-plan 精确为 `Approved` 并引用最新 plan | `init` | 0 | 初次实现，产物为 `code.md`；缺少匹配审批或为 `Approved-with-issues` 时返回 error |
-| 最新 review-plan 精确为 `Approved`，且其「审查输入」/「Review Input」字段引用最新 plan，mtime 又晚于最新 code | `init` | 0 | plan 已在 code 之后获批；进入新一轮实现。`Approved-with-issues` 仅保留历史解析兼容，不构成跨阶段批准 |
+| 最新 review-plan 精确为 `Approved`，且其「审查输入」/「Review Input」字段引用最新 plan，而最新 code 的完成 receipt 未绑定相同 plan 摘要 | `init` | 0 | plan 内容在 code 输入之后获批；进入新一轮实现。`Approved-with-issues` 仅保留历史解析兼容，不构成跨阶段批准；缺失或无效 receipt 失败关闭 |
 | `rev_max < code_max` | `error` | 2 | 最新代码未审查，先运行 `review-code` |
 | 最新 review-code 为 Approved 且存在审查完成后产生的 pending 实现输入 | `decision` | 0 | 选择最早 `II-N`，进入裁决驱动实现；false/not-required 与 consumed 输入不触发 |
 | 最新 review-code 为 Approved 且 0/0/0 | `refused` | 1 | 已通过，无需再次运行 `code-task` |

package/templates/.agents/skills/complete-task/SKILL.en.md

@@ -142,6 +142,8 @@ When an `issue_number` exists, execute in this exact order:
 2. Run `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --requirements --fields`.
 3. Write the business summary to a temporary file and run `agent-infra-internal platform-comment sync {task-id} --kind summary --body-file {path} --agent {standard-agent-token}`.
 
+When the ledger contains a valid `PRC-N` post-review exemption, the summary body must mirror the ruling reason, commit scope, human identity, and time from task.md, and state that this is a human override rather than an automatic verification success. If a matching workflow warning exists, also mirror its original failure code/message. If no warning exists yet, state only that the ruling is recorded and final gate verification is pending; do not claim that the exemption has passed. The same `--kind summary` intent remains the sole owner of the summary marker.
+
 Do not sync the task comment here; it requires the terminal task.md written by lifecycle. Do not set a `status:` label; platform automation clears status labels after the Issue closes.
 
 If any operation fails, the task must remain active and its short id must remain valid. Record the failure with the matching structured warning intent, then stop without entering Step 5:
@@ -162,6 +164,8 @@ agent-infra-internal task-verify {task-id} complete-task.preflight --format text
 
 This event runs `review-ledger`, `manual-validation`, `post-review-commit`, then `platform-sync-preflight`. On any non-zero exit (fail/blocked), keep the task active, derive the stable code/target from the gate result, record it through `task-warning ... add --step complete-task ...`, and stop. For a review/head mismatch, rerun `commit` or `review-code`; never fall back to the review baseline.
 
+When preflight's `post-review-commit` check passes through a human-decided exemption, update the same summary marker from Step 4 before entering Step 6. Add the original failure code/message and PRC id/evidence from the check output together with the ruling reason, commit scope, human identity, and time from task.md. When a warning exists, treat its historical record as canonical and reconcile it with the current check output; otherwise use the current check output as the original-failure source. Run the same `platform-comment sync ... --kind summary` intent again. If it fails, record `SUMMARY_SYNC_FAILED`, keep the task active, and stop before lifecycle.
+
 `--force` does not lift this hard gate: close ledger disagreements; re-review or exempt post-review commits, use the platform adapter's authoritative snapshot and remote refs for the bound change request (PR/MR) to prove a content-equivalent single-parent squash merge in an isolated temporary repository, or, without a valid change request, prove from local Git objects that the only protected commit is a content-equivalent single-parent rewrite with no later protected commits; then pass platform preflight. An unsupported adapter capability, missing required platform facts, Git objects, topology, or content evidence, or current Git credentials that cannot read the remote evidence refs fails closed. The platform adapter supplies normalized state for all checks, enforced before merge by the `review-code` / `watch-pr` routes; required checks remain additionally enforced by branch protection / rulesets.
 
 ### 6. Apply the Local Lifecycle Intent and Verify the Move

package/templates/.agents/skills/complete-task/SKILL.zh-CN.md

@@ -141,6 +141,8 @@ Please complete the missing steps first, or use --force to override.
 2. 调用 `agent-infra-internal platform-issue sync {task-id} --agent {standard-agent-token} --requirements --fields`。
 3. 把业务摘要写入临时文件，并调用 `agent-infra-internal platform-comment sync {task-id} --kind summary --body-file {path} --agent {standard-agent-token}`。
 
+若账本含合法的 `PRC-N` post-review 豁免，摘要正文必须镜像 task.md 中的裁决理由、提交范围、人工身份与时间，并明确这是人工覆盖而非自动校验成功。已有匹配 workflow warning 时，同时镜像其原始 failure code/message；尚无 warning 时只写“裁决已记录、最终门禁待验证”，不得提前宣称豁免已通过。summary marker 仍由同一 `--kind summary` intent 唯一维护。
+
 不要在本步骤同步 task 评论；它依赖 lifecycle 写入后的完整终态 task.md。不要设置 `status:` label，平台自动化应在 Issue 关闭后清理状态标签。
 
 任一操作失败时，任务仍必须位于 active 且短号仍有效；先按失败类型调用以下结构化 warning intent，再立即停止，不进入步骤 5：
@@ -161,6 +163,8 @@ agent-infra-internal task-verify {task-id} complete-task.preflight --format text
 
 该事件依次执行 `review-ledger`、`manual-validation`、`post-review-commit`、`platform-sync-preflight`。任一退出码非 0（fail/blocked）时，任务必须继续留在 active；从 gate 结果取稳定 code/target，通过 `task-warning ... add --step complete-task ...` 落账后停止。若审查基线或 head 不一致，必须先重新 `commit` / `review-code`；不得回退审查基线。
 
+若 preflight 的 `post-review-commit` 以 human-decided exemption 通过，在进入步骤 6 前必须把该 check 输出中的原始 failure code/message 与 PRC id/evidence，连同 task.md 中的裁决理由、提交范围、人工身份与时间，原地补入步骤 4 的同一 summary marker。已有 warning 时以其历史记录为 canonical 证据并与本次 check 输出核对；无 warning 时以本次 check 输出补齐原始失败。再次调用同一 `platform-comment sync ... --kind summary`；失败时记录 `SUMMARY_SYNC_FAILED`、保持任务 active 并停止，不进入 lifecycle。
+
 `--force` 不解除本硬门禁：未关闭分歧必须先在账本闭合，未复审提交必须重新审查、具备有效豁免，或由平台适配器为绑定的变更请求（PR/MR）提供权威合并快照与远端 refs，并在隔离临时仓库中证明单父 squash merge 等价，或在无有效变更请求时由本地 Git 对象证明唯一受保护提交是内容等价的单父重写且之后无受保护提交；平台 preflight 必须通过。适配器不支持所需能力，平台事实、Git 对象、拓扑、内容证据缺失，或当前 Git 凭据不能读取远端证据 refs 时 fail closed。全部 checks 由平台适配器提供规范化状态，并在合并前通过 `review-code` / `watch-pr` 路由承担；其中 required checks 仍受分支保护 / ruleset 强制。
 
 ### 6. 执行本地生命周期意图并验证转移

package/templates/.agents/skills/run-manual-validation/SKILL.en.md

@@ -25,18 +25,18 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## Steps
 
-1. Resolve `{task-ref}`, the validation target, and the command after the literal `--`; stop without writing an artifact if any is missing.
-2. Run `agent-infra-internal task-artifact {task-id} inspect --family validation-run`, take the round and artifact name from the core result, then run `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token}`.
-3. Use snapshot for fixed-commit checks and inplace for uncommitted content, original mounts, or original permissions; when uncertain, start with snapshot and upgrade only with evidence.
-4. Call `ai task validate {task-ref} --scope {scope} --format json -- {command...}`. A runtime upgrade must be a second explicit inplace call with its reason recorded.
-5. Read `reference/report-template.md`, create `validation-run.md|validation-run-r{N}.md`, and record only the CLI JSON allowlist and a sanitized summary.
+1. Read `reference/discovery-and-execution.md` and parse the input mode. Stop before started without an artifact for invalid or partial input.
+2. Run `agent-infra-internal task-artifact {task-id} inspect --family validation-run` and read the latest review-code manual-validation items. Then run `agent-infra-internal platform-pr inspect {task-id}` and use the reference status matrix to discover, merge, and number items. Only automatic mode stops before started when reliable sources are empty or the sole possible source is unreadable; valid explicit mode always continues with the user command as effective work.
+3. Take the round and artifact name from the core result. After confirming valid explicit work or a non-empty discovered list, run `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token}` and classify each item as `executable|unavailable|unknown|unsafe|unresolved`.
+4. Invoke every executable item separately with `ai task validate {task-ref} --scope snapshot --format json -- {command...}`. Only make a second explicit inplace invocation for that item when evidence proves it is required. If no item is executable, run no fabricated command but still produce coverage-gap evidence.
+5. Read `reference/report-template.md`, create `validation-run.md|validation-run-r{N}.md`, and record the input mode, discovered list, per-item results, CLI JSON allowlist, and sanitized summaries.
 6. Run `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --artifact {artifact}`. When an Issue exists, run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}` and then `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {standard-agent-token}`.
 7. Run `agent-infra-internal task-verify {task-id} validation-run.completed --artifact {artifact} --format text`; fix failures and rerun it.
 8. Report the evidence path, coverage gaps, and verification result; explicitly leave the decision to run `complete-manual-validation` to the maintainer. Read `.agents/rules/next-step-output.md` and end with `Completed at`.
 
 ## Completion Checklist
 
-- [ ] Used `ai task validate`
+- [ ] Used `ai task validate` for every executable item, or recorded that none were executable
 - [ ] Recorded sanitized validation-run evidence
 - [ ] Did not change PR manual validation completion state
 - [ ] Updated task.md and passed completion verification

package/templates/.agents/skills/run-manual-validation/SKILL.zh-CN.md

@@ -25,18 +25,18 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## 执行步骤
 
-1. 解析 `{task-ref}`、验证目标和 `--` 后的命令；缺失时停止，不写产物。
-2. 运行 `agent-infra-internal task-artifact {task-id} inspect --family validation-run`，从核心结果取得轮次和产物名；随后运行 `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token}`。
-3. 选择模式：固定提交只查用 snapshot；依赖未提交内容、原挂载或原位权限用 inplace；不确定时先 snapshot，只有证据表明必须原位时才升级。
-4. 调用 `ai task validate {task-ref} --scope {scope} --format json -- {command...}`。运行时升级必须作为第二次显式 inplace 调用，并记录理由。
-5. 读取 `reference/report-template.md`，创建 `validation-run.md|validation-run-r{N}.md`；只写 CLI JSON allowlist 与去敏摘要。
+1. 读取 `reference/discovery-and-execution.md`，解析输入模式；非法或半截输入在 started 前停止，不写产物。
+2. 运行 `agent-infra-internal task-artifact {task-id} inspect --family validation-run`，读取最新 review-code 人工校验项；再运行 `agent-infra-internal platform-pr inspect {task-id}`，按 reference 的状态矩阵发现、归并并编号。仅在自动模式下，可靠来源无项或唯一可能来源不可读时才在 started 前停止；合法显式模式始终以用户命令作为有效工作继续。
+3. 从核心结果取得轮次和产物名；确认存在有效显式工作或非空发现清单后，运行 `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token}`，并逐项分类为 `executable|unavailable|unknown|unsafe|unresolved`。
+4. 每个可执行项分别调用 `ai task validate {task-ref} --scope snapshot --format json -- {command...}`；只有证据表明必须原位时才对该项进行第二次显式 inplace 调用。零项可执行时不运行伪造命令，但仍继续产出覆盖缺口证据。
+5. 读取 `reference/report-template.md`，创建 `validation-run.md|validation-run-r{N}.md`；记录输入模式、发现清单、逐项结果、CLI JSON allowlist 与去敏摘要。
 6. 运行 `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --artifact {artifact}`。存在 Issue 时依次运行 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}` 和 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {standard-agent-token}`。
 7. 运行 `agent-infra-internal task-verify {task-id} validation-run.completed --artifact {artifact} --format text`；未通过则修复后重跑。
 8. 告知用户证据路径、覆盖缺口和验证结果；明确仍需维护者判断是否执行 `complete-manual-validation`。读取 `.agents/rules/next-step-output.md`，最后一行输出 `Completed at`。
 
 ## 完成检查清单
 
-- [ ] 已使用 `ai task validate`
+- [ ] 每个可执行项均已使用 `ai task validate`，或已记录零项可执行
 - [ ] 已记录去敏 validation-run 证据
 - [ ] 未修改 PR 人工验证完成状态
 - [ ] 已更新 task.md 并通过完成校验

package/templates/.agents/skills/run-manual-validation/config/verify.en.json

@@ -1,14 +1,25 @@
 {
   "skill": "run-manual-validation",
   "checks": {
-    "task-meta": { "required_fields": ["id", "type", "workflow", "status", "created_at", "updated_at", "agent_infra_version", "current_step", "assigned_to"] },
+    "task-meta": {
+      "required_fields": ["id", "type", "workflow", "status", "created_at", "updated_at", "agent_infra_version", "current_step", "assigned_to"]
+    },
     "artifact": {
       "file_pattern": "validation-run.md|validation-run-r{N}.md",
-      "required_sections": ["State Check", "Validation Target", "Mode Decision", "Command Summary", "Structured Evidence", "Cleanup and Recovery", "Remaining Coverage", "Raw Evidence"],
+      "required_sections": ["Input Mode", "State Check", "Validation Target", "Discovered Items", "Mode Decision", "Command Summary", "Structured Evidence", "Per-item Results", "Cleanup and Recovery", "Remaining Coverage", "Raw Evidence"],
       "required_patterns": ["^\\$ "]
     },
     "activity-log": { "expected_action_pattern": "Run Manual Validation \\(Round \\d+\\)" },
     "review-ledger": { "stage_scope": ["analysis", "plan", "code"] },
-    "platform-sync": { "when": "issue_number_exists", "expected_comment_marker": "<!-- sync-issue:{task-id}:{artifact-stem} -->", "verify_comment_content": true, "verify_task_comment_content": true, "verify_issue_type": true, "verify_issue_fields": false, "verify_milestone": true, "expected_comment_marker_key": "artifact" }
+    "platform-sync": {
+      "when": "issue_number_exists",
+      "expected_comment_marker": "<!-- sync-issue:{task-id}:{artifact-stem} -->",
+      "verify_comment_content": true,
+      "verify_task_comment_content": true,
+      "verify_issue_type": true,
+      "verify_issue_fields": false,
+      "verify_milestone": true,
+      "expected_comment_marker_key": "artifact"
+    }
   }
 }

package/templates/.agents/skills/run-manual-validation/config/verify.zh-CN.json

@@ -1,14 +1,25 @@
 {
   "skill": "run-manual-validation",
   "checks": {
-    "task-meta": { "required_fields": ["id", "type", "workflow", "status", "created_at", "updated_at", "agent_infra_version", "current_step", "assigned_to"] },
+    "task-meta": {
+      "required_fields": ["id", "type", "workflow", "status", "created_at", "updated_at", "agent_infra_version", "current_step", "assigned_to"]
+    },
     "artifact": {
       "file_pattern": "validation-run.md|validation-run-r{N}.md",
-      "required_sections": ["状态核对", "验证目标", "模式判定", "命令摘要", "结构化证据", "清理与恢复", "尚未覆盖", "证据原文"],
+      "required_sections": ["输入模式", "状态核对", "验证目标", "发现清单", "模式判定", "命令摘要", "结构化证据", "逐项结果", "清理与恢复", "尚未覆盖", "证据原文"],
       "required_patterns": ["^\\$ "]
     },
     "activity-log": { "expected_action_pattern": "Run Manual Validation \\(Round \\d+\\)" },
     "review-ledger": { "stage_scope": ["analysis", "plan", "code"] },
-    "platform-sync": { "when": "issue_number_exists", "expected_comment_marker": "<!-- sync-issue:{task-id}:{artifact-stem} -->", "verify_comment_content": true, "verify_task_comment_content": true, "verify_issue_type": true, "verify_issue_fields": false, "verify_milestone": true, "expected_comment_marker_key": "artifact" }
+    "platform-sync": {
+      "when": "issue_number_exists",
+      "expected_comment_marker": "<!-- sync-issue:{task-id}:{artifact-stem} -->",
+      "verify_comment_content": true,
+      "verify_task_comment_content": true,
+      "verify_issue_type": true,
+      "verify_issue_fields": false,
+      "verify_milestone": true,
+      "expected_comment_marker_key": "artifact"
+    }
   }
 }

package/templates/.agents/skills/run-manual-validation/reference/discovery-and-execution.en.md

@@ -0,0 +1,67 @@
+# Automatic Discovery and Per-item Execution
+
+Read this file before parsing input, discovering manual-validation items, or constructing validation actions.
+
+## Input Modes
+
+| Input | Handling |
+|-------|----------|
+| Non-empty target and command surround a literal `--` | Explicit mode; the command is authoritative for that target |
+| A literal `--` is present but the target or command is empty | Invalid input; stop before `validation-run.started` |
+| No `--` and only a task ref | Automatic mode |
+| No `--` and additional positional arguments | Invalid or partial input; do not ignore arguments or guess a command |
+
+Explicit mode still reads available sources to map coverage, but it must not synthesize another command for the same target. Only automatic mode constructs actions for discovered items.
+
+## Work Gate Matrix
+
+| mode | source state | gate |
+|------|--------------|------|
+| `explicit` | `any` | `continue` |
+| `automatic` | `items` | `continue` |
+| `automatic` | `empty` | `stop` |
+| `automatic` | `unreadable-only` | `stop` |
+
+The user command is effective work in valid explicit mode. Empty or unreadable sources affect only coverage mapping and reporting and must not cause an early stop. Automatic mode depends on reliable discovery results.
+
+## Discovery Sources
+
+1. Read manual-validation items from the latest `review-code` returned by `task-artifact`; this is the canonical local source. Read only that round's structured list, never task.md prose, older reviews, the activity log, or comment history.
+2. Run `agent-infra-internal platform-pr inspect {task-id}` and read the bound PR body's pending manual-validation list from a successful response as the supplemental source.
+3. Deduplicate semantically by target, required environment, and expected assertion. Merge identical items with review-code details taking precedence, append PR-only items, and classify material conflicts as `unresolved`.
+4. Assign report-local IDs `MV-1..N` and record source, target, expected assertion, required capability, and candidate steps. Do not write the task ledger.
+
+## PR Source Status
+
+| PR inspect result | Local items exist | No local items |
+|-------------------|-------------------|----------------|
+| Success | Merge lists; use only local items if the PR list is empty | Use the PR list; stop before started when both lists are empty |
+| `no-op` + `PR_NOT_LINKED` | Use local items only | Stop normally before started |
+| `failed` or `blocked` | Continue with local items; record typed status, stable error code, and the source coverage gap | Fail closed before started and request a retry after platform access is restored |
+
+Explicit mode may run its authoritative command when PR inspection fails, but the report must state that the PR list could not be reconciled. Never treat a read failure as an empty list or record the raw remote response.
+
+## Classification and Safe Actions
+
+Assign exactly one classification per item:
+
+- `executable`: host capability is supported by sufficient evidence and the action is minimal, non-interactive, and scoped.
+- `unavailable`: the required platform, filesystem semantics, permission, container, or account is definitely absent.
+- `unknown`: only weak signals exist and a safe probe cannot prove capability.
+- `unsafe`: validation would require destructive, secret-exposing, or unsanitizable actions.
+- `unresolved`: sources materially conflict about the environment or expected assertion.
+
+Only `executable` items may run. Commands must not expose credentials, environment variables, full argv, absolute user paths, or raw transcripts. Leave a coverage gap when safety cannot be established.
+
+## Per-item Execution
+
+1. Invoke each executable item separately:
+
+   ```bash
+   ai task validate {task-ref} --scope snapshot --format json -- {command...}
+   ```
+
+2. Only when the item or first-run evidence proves a dependency on uncommitted content, original mounts, or in-place permissions, explicitly invoke that item a second time with `--scope inplace` and record the reason.
+3. One item failure does not stop independent remaining items. Record exit status, cleanup, and the sanitized JSON allowlist separately.
+4. When the list is non-empty but no item is `executable`, still create and complete a validation-run artifact after started; do not run placeholder or fabricated commands.
+5. Always stop before started for invalid input. In automatic mode, also stop before started without an artifact when both sources are reliably empty or the sole possible source is unreadable with no local items; those source-based stop conditions do not apply to valid explicit mode.

package/templates/.agents/skills/run-manual-validation/reference/discovery-and-execution.zh-CN.md

@@ -0,0 +1,67 @@
+# 自动发现与逐项执行
+
+在解析输入、发现人工校验项或构造验证动作前读取本文件。
+
+## 输入模式
+
+| 输入 | 处理 |
+|------|------|
+| literal `--` 前后分别有非空验证目标和命令 | 显式模式；命令为该目标的权威动作 |
+| 存在 literal `--`，但目标或命令为空 | 非法输入；在 `validation-run.started` 前停止 |
+| 不存在 `--`，且只有 task ref | 自动模式 |
+| 不存在 `--`，但还有位置参数 | 非法/半截输入；不得忽略参数或猜测命令 |
+
+显式模式也要读取可用来源以映射覆盖范围，但不得为同一目标另行合成命令。自动模式才为发现项构造动作。
+
+## 工作门禁矩阵
+
+| mode | source state | gate |
+|------|--------------|------|
+| `explicit` | `any` | `continue` |
+| `automatic` | `items` | `continue` |
+| `automatic` | `empty` | `stop` |
+| `automatic` | `unreadable-only` | `stop` |
+
+合法显式模式的用户命令本身就是有效工作；来源为空或不可读只影响覆盖映射和报告，不得触发早退。自动模式必须依赖可靠发现结果。
+
+## 发现来源
+
+1. 从 `task-artifact` 返回的最新 `review-code` 读取人工校验项，作为 canonical 本地来源。只读取该轮结构化的人工校验清单，不扫描 task.md 自由文本、旧审查轮次、活动日志或评论历史。
+2. 运行 `agent-infra-internal platform-pr inspect {task-id}`，从成功返回的绑定 PR 正文读取待人工验证清单，作为补充来源。
+3. 按目标、所需环境和预期断言语义去重。相同项合并来源并优先采用 review-code 细节；PR 独有项追加；关键要求冲突的项标为 `unresolved`。
+4. 为本轮清单分配局部 ID `MV-1..N`，记录来源、目标、预期断言、所需能力和候选步骤；不得写入 task ledger。
+
+## PR 来源状态
+
+| PR inspect 结果 | 本地有项目 | 本地无项目 |
+|-----------------|------------|------------|
+| 成功 | 合并清单；PR 空清单时仅用本地项 | 使用 PR 清单；两边均为空时 started 前正常停止 |
+| `no-op` + `PR_NOT_LINKED` | 仅使用本地项 | started 前正常停止 |
+| `failed` 或 `blocked` | 继续本地项；在报告记录 typed 状态、稳定错误码和来源覆盖缺口 | started 前 fail closed，提示恢复平台访问后重试 |
+
+显式模式在 PR 检查失败时仍可执行权威命令，但必须记录无法核对 PR 清单。不要把读取失败当作空清单，也不要记录原始远端响应。
+
+## 分类与安全动作
+
+逐项选择一种分类：
+
+- `executable`：宿主能力已有充分证据；动作最小、非交互且作用域受限。
+- `unavailable`：明确缺少所需平台、文件系统语义、权限、容器或账号。
+- `unknown`：仅有弱信号，安全探测也无法证明能力。
+- `unsafe`：只能通过破坏性、泄密或无法去敏的动作验证。
+- `unresolved`：来源对环境或预期断言存在关键冲突。
+
+只有 `executable` 可以运行。命令不得输出凭据、环境变量、完整 argv、绝对用户路径或原始 transcript；不能证明安全就保留覆盖缺口。
+
+## 逐项执行
+
+1. 每个可执行项分别调用：
+
+   ```bash
+   ai task validate {task-ref} --scope snapshot --format json -- {command...}
+   ```
+
+2. 仅当项目要求或首次证据证明依赖未提交内容、原挂载或原位权限时，再为该项显式调用一次 `--scope inplace`，并记录升级理由。
+3. 单项失败不阻止其余独立项；分别记录退出状态、cleanup 和去敏 JSON allowlist。
+4. 清单非空但没有 `executable` 项时，仍在 started 后生成 validation-run 产物并完成 lifecycle，不运行占位或伪造命令。
+5. 输入非法时始终在 started 前停止。自动模式下，两来源可靠地确认无项，或唯一可能来源不可读且本地无项时，也在 started 前停止且不写产物；合法显式模式不适用这两个来源停止条件。

package/templates/.agents/skills/run-manual-validation/reference/report-template.en.md

@@ -1,5 +1,11 @@
 # Validation Run Evidence
 
+## Input Mode
+
+- Mode: `{explicit|automatic}`
+- Input decision: {sanitized-input-decision}
+- PR source status: `{success|no-op|failed|blocked}` / `{stable-code-or-none}`
+
 ## State Check
 
 ```text
@@ -11,6 +17,12 @@ $ agent-infra-internal task-snapshot {task-id} --format text
 
 {target-and-coverage}
 
+## Discovered Items
+
+| ID | Source | Target | Required Capability | Expected Assertion | Classification |
+|----|--------|--------|---------------------|--------------------|----------------|
+| `MV-{N}` | `{review-code|pr|merged|explicit}` | {target} | {capability} | {expected-assertion} | `{executable|unavailable|unknown|unsafe|unresolved}` |
+
 ## Mode Decision
 
 - Mode: `{snapshot|inplace}`
@@ -28,6 +40,19 @@ $ agent-infra-internal task-snapshot {task-id} --format text
 {sanitized-ai-task-validate-json}
 ```
 
+## Per-item Results
+
+### MV-{N}
+
+- Source: `{source}`
+- Classification: `{classification}`
+- Scope: `{snapshot|inplace|not-run}`
+- Command name: `{basename-only|not-run}`
+- Exit status: `{exit-status|not-run}`
+- Runtime upgrade: {none-or-reason}
+- Result: {sanitized-result-or-coverage-gap}
+- Cleanup: {cleanup-result}
+
 ## Cleanup and Recovery
 
 {cleanup-and-recovery-result}

package/templates/.agents/skills/run-manual-validation/reference/report-template.zh-CN.md

@@ -1,5 +1,11 @@
 # 验证运行证据
 
+## 输入模式
+
+- 模式：`{explicit|automatic}`
+- 输入判定：{sanitized-input-decision}
+- PR 来源状态：`{success|no-op|failed|blocked}` / `{stable-code-or-none}`
+
 ## 状态核对
 
 ```text
@@ -11,6 +17,12 @@ $ agent-infra-internal task-snapshot {task-id} --format text
 
 {target-and-coverage}
 
+## 发现清单
+
+| ID | 来源 | 目标 | 所需能力 | 预期断言 | 分类 |
+|----|------|------|----------|----------|------|
+| `MV-{N}` | `{review-code|pr|merged|explicit}` | {target} | {capability} | {expected-assertion} | `{executable|unavailable|unknown|unsafe|unresolved}` |
+
 ## 模式判定
 
 - 模式：`{snapshot|inplace}`
@@ -28,6 +40,19 @@ $ agent-infra-internal task-snapshot {task-id} --format text
 {sanitized-ai-task-validate-json}
 ```
 
+## 逐项结果
+
+### MV-{N}
+
+- 来源：`{source}`
+- 分类：`{classification}`
+- Scope：`{snapshot|inplace|not-run}`
+- 命令名称：`{basename-only|not-run}`
+- 退出状态：`{exit-status|not-run}`
+- 运行时升级：{none-or-reason}
+- 结果：{sanitized-result-or-coverage-gap}
+- Cleanup：{cleanup-result}
+
 ## 清理与恢复
 
 {cleanup-and-recovery-result}

package/templates/.agents/skills/run-task/SKILL.en.md

@@ -9,13 +9,15 @@ description: >
 
 The orchestrator delegates only and never executes a stage skill itself. First read `.agents/rules/no-mid-flow-questions.md`, `.agents/rules/lifecycle-orchestration.md`, and `reference/host-validation.md`.
 
-1. Resolve the task, current Agent Client, and optional atomic policy flags `--executor-model`, `--executor-reasoning-effort`, `--reviewer-model`, and `--reviewer-reasoning-effort`, then run `task-snapshot`. If any explicit policy flag is present, all four role fields are required and must not be merged with configuration; both roles may use the same model.
-2. Run `task-orchestration {task-id} begin-or-resume --client {client}` with the complete explicit policy. With no explicit policy, core reads only that client's `agentClients[].orchestration`; an existing v2 run uses its persisted policy. Only on `ORCHESTRATION_MODEL_POLICY_REQUIRED`, show the complete/partial/interactive-only `agent-client model-selection` context and collect one complete policy; no answer means no run is created. Stop on paused/completed results.
-3. Run `route` and read its structured result. On `completed`, immediately run `agent-infra-internal task-verify {task-id} run-task.completed --format text` and stop. Only when the result is `running` with a non-null `next`, use its single action, role, round, artifact, `requestedModel`, and `requestedReasoningEffort`; never infer them from review prose, session defaults, or a partial tool schema.
-4. Only for the `running` result from step 3, run `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort}` so core validates both fields and host evidence before snapshotting. Codex also validates the CLI, features, hook trust/discovery, and App Server schema first; a failed preflight creates neither a receipt nor a workspace baseline. Claude Code's native start event still cannot provide stable actual model/effort evidence and returns `ORCHESTRATION_CLIENT_UNSUPPORTED`. Only after validation succeeds, start a fresh native child with the same model/effort overrides and only the short task ref, skill name, literal `--orchestrated` execution marker, and minimal handoff. The child must forward that marker to every provenance-sensitive command in the stage.
-5. Codex prefers SubagentStart/Stop plus App Server actual evidence to activate, consume, and seal the unique receipt. When a custom role does not emit native start/stop, trusted parent PostTool spawn uniquely resolves the child from rollout evidence and a completed wait validates the terminal before idempotent sealing. Timed-out waits do nothing; only empty turns or protocol `inProgress` may wait, while malformed, identity/transport errors, or abnormal terminals pause. Other supported clients keep native start/stop correlation. After the child returns, run `advance` only for a sealed receipt. Repeat step 3 only for `running`; stop immediately for `paused` or `completed`.
-6. Create a new child every round and never follow up with an old reviewer. Native start must report actual model and actual reasoning effort; each requested/actual mismatch needs its own host fallback reason, and requested values must never be fabricated as actual evidence. Capability, hook, identity, evidence, ledger, or fingerprint failures must call `pause` and fail closed.
-7. On pause or completion, run the matching typed verification and report the structured run summary, pause reason, commit endpoint, or clean completion evidence.
+1. Resolve the canonical task ID, current Agent Client, and optional atomic policy flags, then run `task-snapshot`. If one explicit role field is present, all four are required.
+2. Before `begin-or-resume`, Codex selects a host. Without `AGENT_INFRA_CONTROL_TOKEN`, use direct-host. With task-bound control authority but no `AGENT_INFRA_CODEX_CONTROLLER_CONTEXT`, only run `codex-sandbox-controller run --task-id {task-id} --task-ref {task-ref}` with the complete policy and wait; the outer loop must not create a run, baseline, or receipt. With a context, run `verify-context --task-id {task-id}` first. Stop on any bootstrap, bundle, source/profile discovery, or context failure.
+3. Run `task-orchestration {task-id} begin-or-resume --client {client}` with the complete explicit policy. With no explicit policy, core reads that client's configured policy; existing v2/v3 runs use persisted policy. Stop on paused/completed results.
+4. Run `route`. On `completed`, run `agent-infra-internal task-verify {task-id} run-task.completed --format text` and stop. Only a `running` result with non-null `next` supplies action, role, round, artifact, requested model, and requested effort.
+5. Codex runs `codex-lifecycle capability-arm --task-id {task-id}` once. The current loop's real PostToolUse must attest that ordinary tool response. Pass only its marker token to `prepare --client {client} --capability-token {token}`. Before snapshotting, core atomically consumes it, verifies task, hook source, build, contract, and controller binding, and persists the capability session, turn, and tool-use origin. Activation then verifies that spawn belongs to the same session and turn and uses a distinct tool-use. Other clients use the same prepare without a token. Failure creates no baseline, receipt, or child.
+6. After prepare, run `task-orchestration <task-ref> dispatch` immediately before calling the fresh native child, then use route's exact model/effort and only the short task ref, skill, `--orchestrated`, and stage identity. The trusted hook-spawn first-observation time must fall between dispatch and the deadline. Its first provenance-sensitive command must be `await-activation --stage ... --round ... --artifact ... --role ...`; before `running`, it must not snapshot, emit stage-started, write business files, or start commit. Only explicit `recover-prepared` may clear an expired orphan when the task fingerprint is exact, no commit intent exists, and no matching unconsumed active lifecycle evidence remains.
+7. Codex uses SubagentStart/Stop and App Server actual evidence to activate, consume, and seal one v3 receipt; trusted parent fallback must produce the same provenance. Timed-out waits do nothing. Advance only a sealed receipt and repeat step 4 only while running.
+8. Create a fresh child each round and never follow up with an old reviewer. Each requested/actual mismatch needs its own host fallback reason. Capability, hook, source, controller, build, identity, ledger, or fingerprint failure pauses and fails closed.
+9. On pause or completion, run the matching typed verification and report the structured endpoint.
 
 ## Stop
 

package/templates/.agents/skills/run-task/SKILL.zh-CN.md

@@ -9,13 +9,15 @@ description: >
 
 总控只编排，不直接执行任何阶段技能。执行前先读取 `.agents/rules/no-mid-flow-questions.md`、`.agents/rules/lifecycle-orchestration.md` 与 `reference/host-validation.md`。
 
-1. 解析任务引用、当前 Agent Client，以及可选的原子策略 `--executor-model`、`--executor-reasoning-effort`、`--reviewer-model`、`--reviewer-reasoning-effort`，并执行 `agent-infra-internal task-snapshot {task-id} --format text`。任一显式策略字段出现时四个 role 字段必须完整，不得与配置拼接；两个角色可以使用同一模型。
-2. 调用 `agent-infra-internal task-orchestration {task-id} begin-or-resume --client {client}` 并转发完整显式策略。完全没有显式策略时由核心读取当前 client 的 `agentClients[].orchestration`；已有 v2 run 使用持久化策略。仅当核心返回 `ORCHESTRATION_MODEL_POLICY_REQUIRED` 时，先用 `agent-client model-selection` 展示 complete/partial/interactive-only 来源，再一次收集完整策略；未回答则不创建 run。若为 paused/completed，按结构化结果停止。
-3. 调用 `route` 并读取结构化结果。若返回 `completed`，立即运行 `agent-infra-internal task-verify {task-id} run-task.completed --format text` 并停止；仅当返回 `running` 且 `next` 非空时读取唯一 action、role、round、artifact、`requestedModel` 和 `requestedReasoningEffort`，不得从审查文案、会话默认或局部 tool schema 自行推断。
-4. 仅对步骤 3 的 `running` 结果调用 `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort}`；核心在记录工作区基线前校验两字段与宿主证据能力。Codex 还会先验证 CLI、feature、hook trust/discovery 与 App Server schema；任一 preflight 失败均不得创建 receipt 或工作区基线。当前 Claude Code 的原生 start 事件无法稳定提供 actual model/effort，因此仍返回 `ORCHESTRATION_CLIENT_UNSUPPORTED`。只有校验成功时才用当前客户端的 fresh 原生子 Agent 启动指定角色，并显式覆盖同一 model/effort；只传短任务引用、skill 名、字面执行标记 `--orchestrated` 和最小交接摘要，不传 receipt identity，不继承总控历史。子 Agent 必须把该标记转发给本阶段所有 provenance 敏感命令。
-5. Codex 优先用 SubagentStart/Stop 与 App Server actual evidence 激活、消费并封存唯一 receipt；当 custom role 未投递原生 start/stop 时，受信 parent PostTool spawn 从 rollout 唯一解析 child，completed wait 再验证 terminal 并幂等封存。timed-out wait 无动作；只有 empty turns 或协议 `inProgress` 可等待，malformed、身份/传输错误或异常 terminal 均暂停。其他受支持客户端沿用原生 start/stop hook 关联。子 Agent 返回后只对 sealed receipt 调用 `advance`；只有 `running` 才重复步骤 3，`paused` 或 `completed` 立即停止。
-6. 每轮创建新 child；禁止 follow-up 复用 reviewer。原生 start 必须回传 actual model 与 actual reasoning effort；任一 actual 与 requested 不同时必须有各自的宿主降级理由，缺失时不得用 requested 值补造。任何 capability、hook、身份、证据、账本或 fingerprint 异常都调用 `pause` 并失败关闭。
-7. 完成或暂停后运行对应 typed verification，并把结构化 run 摘要、暂停原因、commit 终点或 clean completion evidence 告知用户。
+1. 解析规范任务 ID、当前 Agent Client，以及可选的原子策略 `--executor-model`、`--executor-reasoning-effort`、`--reviewer-model`、`--reviewer-reasoning-effort`，并执行 `agent-infra-internal task-snapshot {task-id} --format text`。任一显式策略字段出现时四个 role 字段必须完整，不得与配置拼接；两个角色可以使用同一模型。
+2. Codex 在 `begin-or-resume` 前选择宿主：没有 `AGENT_INFRA_CONTROL_TOKEN` 时使用 direct-host；有 task-bound control authority 但没有 `AGENT_INFRA_CODEX_CONTROLLER_CONTEXT` 时，只调用 `agent-infra-internal codex-sandbox-controller run --task-id {task-id} --task-ref {task-ref}`（转发完整显式策略）并等待其终态，外层不得创建 run、baseline 或 receipt；已有 context 时先调用 `verify-context --task-id {task-id}`。controller 的 bootstrap、bundle、source/profile discovery 或 context 任一校验失败即停止。
+3. 调用 `agent-infra-internal task-orchestration {task-id} begin-or-resume --client {client}` 并转发完整显式策略。完全没有显式策略时由核心读取当前 client 的 `agentClients[].orchestration`；已有 v2/v3 run 使用持久化策略。仅当核心返回 `ORCHESTRATION_MODEL_POLICY_REQUIRED` 时，先用 `agent-client model-selection` 展示 complete/partial/interactive-only 来源，再一次收集完整策略；未回答则不创建 run。若为 paused/completed，按结构化结果停止。
+4. 调用 `route` 并读取结构化结果。若返回 `completed`，立即运行 `agent-infra-internal task-verify {task-id} run-task.completed --format text` 并停止；仅当返回 `running` 且 `next` 非空时读取唯一 action、role、round、artifact、`requestedModel` 和 `requestedReasoningEffort`，不得自行推断。
+5. Codex 先调用一次 `agent-infra-internal codex-lifecycle capability-arm --task-id {task-id}`。该普通工具调用必须由当前 loop 的真实 PostToolUse 回写 attestation；仅把返回的 marker 中 token 传给 `prepare --client {client} --capability-token {token}`。核心在快照前原子消费 token，校验 task、hook source、build、contract 与 controller binding，并持久化 capability 的 session、turn、tool-use 来源。activation 再校验 spawn 与该来源属于同一 session/turn，且 spawn 使用独立的 tool-use。其他客户端直接调用同一 prepare（无 token）。任一失败不得创建 baseline、receipt 或 child。
+6. prepare 成功后，在调用 fresh 原生子 Agent 的紧邻前一步执行 `task-orchestration <task-ref> dispatch`，再显式覆盖 route 返回的 model/effort；只传短任务引用、skill 名、`--orchestrated` 与 stage/round/artifact/role。可信 hook-spawn 首次观察时间必须位于 dispatch 与 deadline 之间。child 的第一条 provenance-sensitive 命令必须是 `await-activation --stage ... --round ... --artifact ... --role ...`；返回 running 前禁止 snapshot、阶段 started、业务写入或 commit-start。超时由核心暂停；崩溃遗留 prepared receipt 只能在 exact workspace fingerprint、无 commit intent、无匹配的未消费 active lifecycle evidence 且 deadline 已过时显式 `recover-prepared`。
+7. Codex 用 SubagentStart/Stop 与 App Server actual evidence 激活、消费并封存唯一 receipt；受信 parent fallback 仍必须形成相同 v3 provenance。timed-out wait 无动作；只有 empty turns 或协议 `inProgress` 可等待，malformed、身份/传输错误或异常 terminal 均暂停。子 Agent 返回后只对 sealed receipt 调用 `advance`；只有 `running` 才重复步骤 4。
+8. 每轮创建新 child；禁止 follow-up 复用 reviewer。actual model/effort 与 requested 不同时必须有各自的宿主降级理由。任何 capability、hook、source、controller、build、身份、账本或 fingerprint 异常都调用 `pause` 并失败关闭。
+9. 完成或暂停后运行对应 typed verification，并把结构化 run 摘要、暂停原因、commit 终点或 clean completion evidence 告知用户。
 
 ## 停止
 

package/templates/.agents/skills/run-task/reference/host-validation.en.md

@@ -6,8 +6,11 @@ Before publishing support for a client, prove the lifecycle evidence chain with
 
 - Client version, enabled multi-agent capability, launch surface, and trust boundary.
 - Raw start/stop events, or the parent PostTool spawn/completed-wait fallback when custom roles omit them, stably correlate the managed agent, parent/child identity, fresh spawn mode, actual model, and actual reasoning effort.
+  > Direct-host clients that structurally do not emit fork/spawn-mode event fields (currently claude-code) may derive identity correlation solely from parent/child identity uniqueness plus the receipt's one-shot state machine, without an additional fresh-spawn-mode proof; the client must still honestly record this gap and how the substitute guarantee is composed, and must never fabricate spawn-mode evidence. This exception does not apply to any other client. Concretely, claude-code's identity guarantee is provided only by non-empty and mutually distinct `parentId`/`childId`, a unique `childId` within the same run, and the receipt's one-shot state machine — it carries none of Codex's `spawn_mode` fork proof and is weaker than Codex's.
 - Explicit requested model/effort reaches each executor/reviewer. A fallback of either field reports the corresponding actual value and its own non-empty reason.
+  > claude-code exception: requested reasoning effort does not yet support per-role dispatch to executor/reviewer — `.claude/agents/{executor,reviewer}.md` is a repository-level shared singleton, and writing it per role would race across concurrent tasks. This client only needs to honestly record the actual model/actual reasoning effort observed in native Start/Stop host events (`delegationEvidence.actualReasoningEffort` is declared `spawn-ack`); when not observed it is recorded as missing, which is not treated as a fallback requiring its own reason and does not fail closed. This exception does not apply to any other client.
 - Candidate-checkout and packed-install behavior match, with model policy, receipts, and verification results auditable in `orchestration.json`.
+- Direct-host project/managed source and sandbox isolated-user source preserve the same build, contract, profile, and controller provenance through prepare/start/stop/consume.
 
 ## Validation Sequence
 
@@ -16,5 +19,6 @@ Before publishing support for a client, prove the lifecycle evidence chain with
 3. Validate model/effort match paths, single and dual justified fallbacks, and fail-closed behavior for missing actual fields.
 4. Validate the same commit from a candidate checkout and an `npm pack` install; record the tarball hash and results.
 5. Commit only redacted summaries and non-sensitive fixtures. Remove or replace tokens, user-specific absolute paths, transcript content, and credentials.
+6. For sandbox, run at least ten cold executor starts and ten cold reviewer starts. Record monotonic prepared, spawn-dispatch, SubagentStart, and activation-completed timestamps plus p50/p95/max. Enable only when max plus 20% fits the deadline and symlink/config/plugin/lease/context/build failure injection and terminal cleanup audits pass.
 
-If any required field cannot be observed reliably from the real host, keep that client's orchestration capability `unsupported` and record the gap as manual validation. Codex may advertise `experimental`, but every `prepare` must still pass static preflight and either native start/stop or the parent spawn/completed-wait fallback must produce verifiable consumed host evidence. The fallback may wait only for empty turns or protocol `inProgress`; malformed, identity/transport errors, or abnormal terminals pause deterministically.
+If any required field cannot be observed reliably from the real host, keep that client's orchestration capability `unsupported` and record the gap as manual validation. Codex may advertise `experimental`, but every `prepare` must still pass static preflight and either native start/stop or the parent spawn/completed-wait fallback must produce verifiable consumed host evidence. The fallback may wait only for empty turns or protocol `inProgress`; malformed, identity/transport errors, or abnormal terminals pause deterministically. The claude-code exception above is already scoped in the second bullet and does not change this rule's fail-closed requirement for any other field or client.

package/templates/.agents/skills/run-task/reference/host-validation.zh-CN.md

@@ -6,8 +6,11 @@
 
 - 客户端版本、启用的多代理能力、启动入口与信任边界。
 - 原始 start/stop 事件，或 custom role 缺少它们时的 parent PostTool spawn/completed-wait fallback，能稳定关联 managed agent、parent/child identity、fresh spawn mode、actual model 和 actual reasoning effort。
+  > 结构上不提供 fork/spawn-mode 事件字段的 direct-host 客户端（当前为 claude-code），身份关联允许仅由 parent/child identity 的唯一性与一次性状态机提供，不要求额外的 fresh spawn mode 证明；该客户端仍需如实记录这一缺口与替代保证的构成，不得补造 spawn mode 证据。此例外不适用于其他客户端。具体而言，claude-code 的身份保证仅由 `parentId`/`childId` 非空且互不相等、同一 run 内 `childId` 唯一、receipt 一次性状态机三者提供，不含 codex 式的 `spawn_mode` fork 证明，强度弱于 codex。
 - 显式 requested model/effort 能传给 executor/reviewer；宿主对任一字段回退时，事件能给出对应 actual 值与独立的非空 fallback reason。
+  > claude-code 例外：requested reasoning effort 暂不支持按角色下发给 executor/reviewer——`.claude/agents/{executor,reviewer}.md` 是仓库级共享单例，动态写入存在跨任务竞态，解决该竞态超出本任务范围。该客户端只要求如实记录宿主原生 Start/Stop 事件中能观察到的 actual model/actual reasoning effort（`delegationEvidence.actualReasoningEffort` 声明为 `spawn-ack`）；观察不到时记录为缺失，不视为需要独立 fallback reason 的回退场景，也不构成 fail-closed 阻断。此例外不适用于其他客户端。
 - candidate checkout 与打包安装后的行为一致，且模型策略、receipt 与验证结果可从 `orchestration.json` 复核。
+- direct-host 的 project/managed source 与 sandbox controller 的 isolated-user source、build/contract/profile/controller digest 必须在 prepare/start/stop/consume 全链路一致。
 
 ## 验证顺序
 
@@ -16,5 +19,6 @@
 3. 分别验证 model/effort 的 requested/actual 一致路径、单项与双项有理由 fallback 路径，并确认缺 actual 字段会失败关闭。
 4. 对同一 commit 执行 candidate checkout 与 `npm pack` 安装验证，记录 tarball 哈希和结果。
 5. 仅把去敏摘要与非敏感 fixture 纳入版本库；token、绝对用户路径、transcript 内容和凭证必须删除或替换。
+6. sandbox backend 另做至少 10 次 executor 与 10 次 reviewer 冷启动，记录 prepared、spawn dispatch、SubagentStart、activation completed 的单调时钟及 p50/p95/max；仅当 max 加 20% 余量不超过 deadline，并通过 symlink/config/plugin/lease/context/build 失败注入和终态清理审计时启用。
 
-任一字段无法从真实宿主稳定观察时，该客户端的 orchestration capability 保持 `unsupported`，并把缺口记录为人工验证项。Codex 可声明为 `experimental`，但每次 `prepare` 仍必须通过静态 preflight，且原生 start/stop 或 parent spawn/completed-wait fallback 必须形成可验证的 consumed host evidence。fallback 只允许 empty turns/协议 `inProgress` 等待；malformed、身份/传输错误或异常 terminal 都稳定暂停。
+任一字段无法从真实宿主稳定观察时，该客户端的 orchestration capability 保持 `unsupported`，并把缺口记录为人工验证项。Codex 可声明为 `experimental`，但每次 `prepare` 仍必须通过静态 preflight，且原生 start/stop 或 parent spawn/completed-wait fallback 必须形成可验证的 consumed host evidence。fallback 只允许 empty turns/协议 `inProgress` 等待；malformed、身份/传输错误或异常 terminal 都稳定暂停。上述关于 claude-code 的例外已在第 2 条单独说明，不改变本条对其余字段/客户端的 fail-closed 要求。