@fitlab-ai/agent-infra 0.9.8 → 0.9.9

package/templates/.agents/skills/block-task/SKILL.en.md

@@ -99,7 +99,7 @@ Keep the gate output in your reply as fresh evidence. Do not claim completion wi
 
 > Before rendering next steps, read `.agents/rules/next-step-output.md`, invoke the shared helper only for the selected scenario, and insert its stdout at `{next-step-commands}`.
 
-> **Optional sandbox-cleanup hint (gated)**: Render the "Optional: clean up this task's sandbox" block — placed after "Archived to" and before "To unblock" in the output below — only when BOTH (1) `.agents/.airc.json` has a `sandbox` field and (2) task.md's `branch` field exists and is not `main` / `master`; otherwise omit the whole block. `{branch}` is the `branch` value from the task.md you already loaded (the task has moved to blocked/, so read it from `.agents/workspace/blocked/{task-id}/task.md`). This block is independent of "Next step" semantics.
+> **Optional sandbox-cleanup hint (gated)**: Render the "Optional: clean up this task's sandbox" block — placed after "Archived to" and before "To unblock" in the output below — only when BOTH (1) `.agents/.airc.json` has a `sandbox` field and (2) task.md's `branch` field exists and is not `main` / `master`; otherwise omit the whole block. Blocked task-bound sandboxes are protected from automatic batch cleanup; if cleanup is necessary, manually verify their identity first. This block is independent of "Next step" semantics.
 
 Output format:
 Populate `{next-step-commands}` for this scenario by running `agent-infra-internal agent-client next-steps --skill check-task --task-ref {task-ref}`.
@@ -112,9 +112,7 @@ Required to unblock: {what's needed}
 Archived to: .agents/workspace/blocked/{task-id}/
 
 Optional: clean up this task's sandbox
-(The task is blocked and moved to blocked/; the sandbox container and per-branch config directory are not reclaimed automatically. Run this if you no longer need them:)
-
-ai sandbox rm {branch}
+(The task is blocked and moved to blocked/; task-bound sandboxes are protected from automatic `ai sandbox rm --unbound` cleanup. If cleanup is necessary, manually verify the container, control manifest, and worktree identity first.)
 
 To unblock when the issue is resolved:
   agent-infra-internal task-lifecycle {task-id} activate --agent {standard-agent-token} --note "{activation note}"

package/templates/.agents/skills/block-task/SKILL.zh-CN.md

@@ -100,7 +100,7 @@ agent-infra-internal task-verify {task-id} block-task.completed --format text
 
 > 渲染下一步前先读取 `.agents/rules/next-step-output.md`，仅为已选场景调用统一 helper，并将 stdout 填入 `{next-step-commands}`。
 
-> **可选沙箱清理提示（门控渲染）**：仅当同时满足 (1) `.agents/.airc.json` 存在 `sandbox` 字段、(2) task.md 的 `branch` 字段存在且不是 `main` / `master` 时，才渲染下方输出中「归档路径」之后、「解除阻塞时执行」之前的「可选：清理本任务的沙箱」块；任一不满足则整段省略。`{branch}` 取已读入的 task.md 的 `branch` 值（任务此时已移动到 blocked/，从 `.agents/workspace/blocked/{task-id}/task.md` 读取）。该块独立于「下一步」语义。
+> **可选沙箱清理提示（门控渲染）**：仅当同时满足 (1) `.agents/.airc.json` 存在 `sandbox` 字段、(2) task.md 的 `branch` 字段存在且不是 `main` / `master` 时，才渲染下方输出中「归档路径」之后、「解除阻塞时执行」之前的「可选：清理本任务的沙箱」块；任一不满足则整段省略。blocked task-bound 沙箱受保护，不通过自动批量清理；如确需清理，请人工核对身份。该块独立于「下一步」语义。
 
 输出格式：
 使用 `agent-infra-internal agent-client next-steps --skill check-task --task-ref {task-ref}` 生成本场景的 `{next-step-commands}`。
@@ -113,9 +113,7 @@ agent-infra-internal task-verify {task-id} block-task.completed --format text
 归档路径：.agents/workspace/blocked/{task-id}/
 
 可选：清理本任务的沙箱
-（任务已阻塞并移到 blocked/，沙箱容器和 per-branch 配置目录不会自动回收。如果不再需要可执行：）
-
-ai sandbox rm {branch}
+（任务已阻塞并移到 blocked/，task-bound 沙箱受保护，不会被 `ai sandbox rm --unbound` 自动删除；如确需清理，请先人工核对容器、控制清单和工作树身份。）
 
 解除阻塞时执行：
   agent-infra-internal task-lifecycle {task-id} activate --agent {standard-agent-token} --note "{恢复说明}"

package/templates/.agents/skills/cancel-task/SKILL.en.md

@@ -106,7 +106,7 @@ Keep the gate output in your reply as fresh evidence. Do not claim completion wi
 
 > Before rendering next steps, read `.agents/rules/next-step-output.md`, invoke the shared helper only for the selected scenario, and insert its stdout at `{next-step-commands}`.
 
-> **Optional sandbox-cleanup hint (gated)**: Render the "Optional: clean up this task's sandbox" block — placed after "Target path" and before "Next step" in the output below — only when BOTH (1) `.agents/.airc.json` has a `sandbox` field and (2) task.md's `branch` field exists and is not `main` / `master`; otherwise omit the whole block. `{branch}` is the `branch` value from the task.md you already loaded (the task has moved to completed/, so read it from `.agents/workspace/completed/{task-id}/task.md`). This block is independent of "Next steps" semantics.
+> **Optional sandbox-cleanup hint (gated)**: Render the "Optional: clean up this task's sandbox" block — placed after "Target path" and before "Next step" in the output below — only when BOTH (1) `.agents/.airc.json` has a `sandbox` field and (2) task.md's `branch` field exists and is not `main` / `master`; otherwise omit the whole block. Use the full `{task-id}` for cleanup; do not substitute the branch name. This block is independent of "Next steps" semantics.
 
 Output format:
 Populate `{next-step-commands}` for this scenario by running `agent-infra-internal agent-client next-steps --skill check-task --task-ref {task-ref}`.
@@ -119,9 +119,9 @@ Status label: {status-label or skipped}
 Target path: .agents/workspace/completed/{task-id}/
 
 Optional: clean up this task's sandbox
-(The task is archived; the sandbox container and per-branch config directory are not reclaimed automatically. Run this if you no longer need them:)
+(The task is completed and archived; the sandbox container and per-branch config directory are not reclaimed automatically. Run this if you no longer need them:)
 
-ai sandbox rm {branch}
+ai sandbox rm {task-id}
 
 Next step - inspect the moved task:
 {next-step-commands}

package/templates/.agents/skills/cancel-task/SKILL.zh-CN.md

@@ -105,7 +105,7 @@ agent-infra-internal task-verify {task-id} cancel-task.completed --format text
 
 > 渲染下一步前先读取 `.agents/rules/next-step-output.md`，仅为已选场景调用统一 helper，并将 stdout 填入 `{next-step-commands}`。
 
-> **可选沙箱清理提示（门控渲染）**：仅当同时满足 (1) `.agents/.airc.json` 存在 `sandbox` 字段、(2) task.md 的 `branch` 字段存在且不是 `main` / `master` 时，才渲染下方输出中「目标路径」之后、「下一步」之前的「可选：清理本任务的沙箱」块；任一不满足则整段省略。`{branch}` 取已读入的 task.md 的 `branch` 值（任务此时已移动到 completed/，从 `.agents/workspace/completed/{task-id}/task.md` 读取）。该块独立于「下一步」语义。
+> **可选沙箱清理提示（门控渲染）**：仅当同时满足 (1) `.agents/.airc.json` 存在 `sandbox` 字段、(2) task.md 的 `branch` 字段存在且不是 `main` / `master` 时，才渲染下方输出中「目标路径」之后、「下一步」之前的「可选：清理本任务的沙箱」块；任一不满足则整段省略。清理时使用完整 `{task-id}`，不要改用 branch 名。该块独立于「下一步」语义。
 
 输出格式：
 使用 `agent-infra-internal agent-client next-steps --skill check-task --task-ref {task-ref}` 生成本场景的 `{next-step-commands}`。
@@ -118,9 +118,9 @@ agent-infra-internal task-verify {task-id} cancel-task.completed --format text
 目标路径：.agents/workspace/completed/{task-id}/
 
 可选：清理本任务的沙箱
-（任务已归档，沙箱容器和 per-branch 配置目录不会自动回收。如果不再需要可执行：）
+（任务已完成并归档，沙箱容器和 per-branch 配置目录不会自动回收。如果不再需要可执行：）
 
-ai sandbox rm {branch}
+ai sandbox rm {task-id}
 
 下一步 - 查看已转移任务：
 {next-step-commands}

package/templates/.agents/skills/close-codescan/SKILL.en.md

@@ -93,7 +93,7 @@ Only `status=applied|no-op` means local archival completed. If the API dismissal
 
 > Before rendering next steps, read `.agents/rules/next-step-output.md`, invoke the shared helper only for the selected scenario, and insert its stdout at `{next-step-commands}`.
 
-> **Optional sandbox-cleanup hint (gated)**: Render the "Optional: clean up this task's sandbox" block — placed after the "Note:" line and before "Next step" in the output below — only when ALL of (1) `.agents/.airc.json` has a `sandbox` field, (2) step 7 located a related task by the alert number, and (3) that related task's task.md `branch` field exists and is not `main` / `master`; otherwise omit the whole block. `{branch}` is the `branch` value from the related task.md located in step 7. This block is independent of "Next step" semantics.
+> **Optional sandbox-cleanup hint (gated)**: Render the cleanup hint only when ALL of (1) `.agents/.airc.json` has a `sandbox` field, (2) step 7 located a related task by the alert number, (3) that task's task.md `branch` exists and is not `main` / `master`, and (4) task state and sandbox workspace identity were cross-validated without conflict. The state and identity select the command: use the full `{task-id}` only for `completed` + `task-bound`; use `{branch}` only when `branch-only` identity was explicitly verified; omit an automatic cleanup command for `active`; for `blocked` / `archive`, render a manual-verification note without a command. If state or identity is missing or conflicting, omit the whole block. Dismissing the alert never implies that the task is completed. This block is independent of "Next step" semantics.
 
 Populate `{next-step-commands}` for this scenario by running `agent-infra-internal agent-client next-steps --skill complete-task --task-ref {task-ref}`.
 
@@ -110,7 +110,11 @@ View: {html_url}
 Note: it can be reopened on the platform if necessary.
 
 Optional: clean up this task's sandbox
-(The related task's sandbox container and per-branch config directory are not reclaimed automatically. Run this if you no longer need them:)
+(Only for a `completed` related task with `task-bound` identity, use the full task ID:)
+
+ai sandbox rm {task-id}
+
+(Only when `branch-only` identity was explicitly verified, use the branch name:)
 
 ai sandbox rm {branch}
 

package/templates/.agents/skills/close-codescan/SKILL.zh-CN.md

@@ -93,7 +93,7 @@ agent-infra-internal task-lifecycle {task-id} close-codescan --agent {standard-a
 
 > 渲染下一步前先读取 `.agents/rules/next-step-output.md`，仅为已选场景调用统一 helper，并将 stdout 填入 `{next-step-commands}`。
 
-> **可选沙箱清理提示（门控渲染）**：仅当同时满足 (1) `.agents/.airc.json` 存在 `sandbox` 字段、(2) 第 7 步按告警号定位到了关联任务、(3) 该关联任务 task.md 的 `branch` 字段存在且不是 `main` / `master` 时，才渲染下方输出中「注意：…」之后、「下一步」之前的「可选：清理本任务的沙箱」块；任一不满足则整段省略。`{branch}` 取第 7 步定位到的关联任务 task.md 的 `branch` 值。该块独立于「下一步」语义。
+> **可选沙箱清理提示（门控渲染）**：仅当同时满足 (1) `.agents/.airc.json` 存在 `sandbox` 字段、(2) 第 7 步按告警号定位到了关联任务、(3) 该任务 task.md 的 `branch` 存在且不是 `main` / `master`、(4) 任务状态与沙箱 workspace identity 已交叉校验且无冲突时，才渲染清理提示。状态和 identity 决定命令：仅 `completed` + `task-bound` 使用完整 `{task-id}`；仅在明确核对为 `branch-only` 时使用 `{branch}`；`active` 不渲染自动清理命令；`blocked` / `archive` 只渲染人工核对提示，不渲染命令。状态或 identity 缺失、冲突时整段省略；关闭告警本身不能推断任务已完成。该块独立于「下一步」语义。
 
 使用 `agent-infra-internal agent-client next-steps --skill complete-task --task-ref {task-ref}` 生成本场景的 `{next-step-commands}`。
 
@@ -110,7 +110,11 @@ Code Scanning 告警 #{alert-number} 已关闭。
 注意：如有需要，可在 平台上重新打开。
 
 可选：清理本任务的沙箱
-（关联任务的沙箱容器和 per-branch 配置目录不会自动回收。如果不再需要可执行：）
+（仅在关联任务为 `completed` 且 identity 为 `task-bound` 时，使用完整任务 ID：）
+
+ai sandbox rm {task-id}
+
+（仅在明确核对 identity 为 `branch-only` 时，使用分支名：）
 
 ai sandbox rm {branch}
 

package/templates/.agents/skills/close-dependabot/SKILL.en.md

@@ -101,7 +101,7 @@ Only `status=applied|no-op` means local archival completed. If the API dismissal
 
 > Before rendering next steps, read `.agents/rules/next-step-output.md`, invoke the shared helper only for the selected scenario, and insert its stdout at `{next-step-commands}`.
 
-> **Optional sandbox-cleanup hint (gated)**: Render the "Optional: clean up this task's sandbox" block — placed after the "Note:" line and before "Next step" in the output below — only when ALL of (1) `.agents/.airc.json` has a `sandbox` field, (2) step 7 located a related task by the alert number, and (3) that related task's task.md `branch` field exists and is not `main` / `master`; otherwise omit the whole block. `{branch}` is the `branch` value from the related task.md located in step 7. This block is independent of "Next step" semantics.
+> **Optional sandbox-cleanup hint (gated)**: Render the cleanup hint only when ALL of (1) `.agents/.airc.json` has a `sandbox` field, (2) step 7 located a related task by the alert number, (3) that task's task.md `branch` exists and is not `main` / `master`, and (4) task state and sandbox workspace identity were cross-validated without conflict. The state and identity select the command: use the full `{task-id}` only for `completed` + `task-bound`; use `{branch}` only when `branch-only` identity was explicitly verified; omit an automatic cleanup command for `active`; for `blocked` / `archive`, render a manual-verification note without a command. If state or identity is missing or conflicting, omit the whole block. Dismissing the alert never implies that the task is completed. This block is independent of "Next step" semantics.
 
 Populate `{next-step-commands}` for this scenario by running `agent-infra-internal agent-client next-steps --skill complete-task --task-ref {task-ref}`.
 
@@ -118,7 +118,11 @@ View: {alert-url}
 Note: it can be reopened on the platform if necessary.
 
 Optional: clean up this task's sandbox
-(The related task's sandbox container and per-branch config directory are not reclaimed automatically. Run this if you no longer need them:)
+(Only for a `completed` related task with `task-bound` identity, use the full task ID:)
+
+ai sandbox rm {task-id}
+
+(Only when `branch-only` identity was explicitly verified, use the branch name:)
 
 ai sandbox rm {branch}
 

package/templates/.agents/skills/close-dependabot/SKILL.zh-CN.md

@@ -101,7 +101,7 @@ agent-infra-internal task-lifecycle {task-id} close-dependabot --agent {standard
 
 > 渲染下一步前先读取 `.agents/rules/next-step-output.md`，仅为已选场景调用统一 helper，并将 stdout 填入 `{next-step-commands}`。
 
-> **可选沙箱清理提示（门控渲染）**：仅当同时满足 (1) `.agents/.airc.json` 存在 `sandbox` 字段、(2) 第 7 步按告警号定位到了关联任务、(3) 该关联任务 task.md 的 `branch` 字段存在且不是 `main` / `master` 时，才渲染下方输出中「注意：…」之后、「下一步」之前的「可选：清理本任务的沙箱」块；任一不满足则整段省略。`{branch}` 取第 7 步定位到的关联任务 task.md 的 `branch` 值。该块独立于「下一步」语义。
+> **可选沙箱清理提示（门控渲染）**：仅当同时满足 (1) `.agents/.airc.json` 存在 `sandbox` 字段、(2) 第 7 步按告警号定位到了关联任务、(3) 该任务 task.md 的 `branch` 存在且不是 `main` / `master`、(4) 任务状态与沙箱 workspace identity 已交叉校验且无冲突时，才渲染清理提示。状态和 identity 决定命令：仅 `completed` + `task-bound` 使用完整 `{task-id}`；仅在明确核对为 `branch-only` 时使用 `{branch}`；`active` 不渲染自动清理命令；`blocked` / `archive` 只渲染人工核对提示，不渲染命令。状态或 identity 缺失、冲突时整段省略；关闭告警本身不能推断任务已完成。该块独立于「下一步」语义。
 
 使用 `agent-infra-internal agent-client next-steps --skill complete-task --task-ref {task-ref}` 生成本场景的 `{next-step-commands}`。
 
@@ -118,7 +118,11 @@ agent-infra-internal task-lifecycle {task-id} close-dependabot --agent {standard
 注意：如有需要，可在平台侧重新打开。
 
 可选：清理本任务的沙箱
-（关联任务的沙箱容器和 per-branch 配置目录不会自动回收。如果不再需要可执行：）
+（仅在关联任务为 `completed` 且 identity 为 `task-bound` 时，使用完整任务 ID：）
+
+ai sandbox rm {task-id}
+
+（仅在明确核对 identity 为 `branch-only` 时，使用分支名：）
 
 ai sandbox rm {branch}
 

package/templates/.agents/skills/commit/SKILL.en.md

@@ -1,169 +1,85 @@
 ---
 name: commit
 description: >
-  Commit the current changes to Git.
-  Use when finished work needs to be turned into a Git commit.
+  Commit current changes to Git.
+  Use when completed work needs to be recorded as a Git commit.
 ---
 
-# Commit Changes
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+# Commit code
 
+Use the standard agent token from `.agents/rules/task-management.md`.
 
-Create a Git commit without overwriting user work and update the related task state when needed.
+Create a Git commit without overwriting local work, and update the associated task only when a task context exists.
 
-When updating related `task.md` frontmatter, read `.agents/rules/version-stamp.md` first and write or refresh `agent_infra_version`.
+The commit core returns one primary result: `committed`, `no_op`, `committed_with_warnings`, `failed`, or `blocked`, with structured `warnings`. A push failure or protected-branch policy never rolls back a local commit.
 
-When the entry business operands literally contain `--orchestrated`, bind `{execution-flag}` to `--orchestrated`; otherwise bind it to empty. Never infer the source from a run file or environment.
+## Task context
 
-Direct invocation still requires explicit user authorization. An orchestrated invocation may continue only after the commit intent validates its activated receipt and one-use `commitAuthorization` before side effects; every other commit gate remains unchanged.
+Resolve the optional task scope with `agent-infra-internal task-context resolve {task-scope}`.
 
-## Common Rationalizations and Rebuttals
+- An explicit task-resolution failure stops the operation.
+- Without an explicit task scope, only `TASK_CONTEXT_NOT_FOUND` may enter taskless direct mode; detached HEAD, malformed candidates, and multiple matches fail closed.
+- If the literal `--orchestrated` is present in the business operands, use `mode=orchestrated`; otherwise use `mode=direct`. Never infer the mode from files or environment.
+- Taskless direct mode does not read, create, or complete task intent, receipt, checkpoint, or task.md records.
+- Task-bound direct mode does not require a delegation receipt; orchestrated mode must validate the matching activated commit receipt and capability in the core.
+- After resolution, use only the core-returned `taskId`; never infer task identity from the environment, branch, or filename.
 
-| Rationalization | Rebuttal |
-|------|------|
-| "The tests already ran earlier, so I do not need to rerun them." | The staged content is the current truth; before committing, re-check `git status` and `git diff` instead of relying on memory. |
-| "`git add -A` is faster." | `git add -A` and `git add .` are forbidden; stage only explicitly listed files to avoid including unrelated changes. |
-| "This file has a copyright header, but the year can wait." | If you changed it, update the copyright year using `date +%Y`; this is a hard pre-commit check. |
+## 1. Inspect local changes
 
-## Task Context Resolution
-
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
-
-Without explicit task scope, only `TASK_CONTEXT_NOT_FOUND` may continue through the existing bare-commit path. Detached HEAD, damaged candidates, or multiple matches are ambiguity errors. Any explicit task-scope failure is fatal.
-
-## Step Start: Recover or Create a Controlled Attempt
-
-When `{task-id}` is resolved, call `commit-status` first. Finalize `recoverable`; safely clear `prepared` and query status again; reuse `retryable-start` through `commit-recover --agent {standard-agent-token}`. Fail closed for `invalid` / `conflict` / `orphaned-start`. For `idle`, call `commit-start --agent {standard-agent-token}` so the core atomically writes the structured started entry and returns its attempt/baseline.
-
-Read `{commit-attempt}` only from structured `commit-start` / `commit-recover` output. Never hand-write, copy, or guess an attempt. A bare commit without task context skips this protocol.
-
-## 1. Check Local Modifications (CRITICAL)
-
-Before any edit, inspect:
+Before editing, run:
 
 ```bash
 git status --short
 git diff
 ```
 
-Respect existing user changes. If your planned edit conflicts with them, stop and ask before proceeding.
-
-## 2. Update Copyright Headers
-
-Use the current year dynamically and only update files that are already modified.
-
-> The full copyright workflow lives in `reference/copyright-check.md`. Read `reference/copyright-check.md` before editing any header.
-
-## 3. Build the Commit Message
-
-Review status, diff, and recent history, then prepare a Conventional Commit with the correct co-author lines.
-
-> Commit message rules, examples, and multi-agent co-authorship details live in `reference/commit-message.md`. Read `reference/commit-message.md` before writing the commit.
-
-## 4. Create the Commit
-
-When `{task-id}` was resolved, read `reference/commit-orchestration.md` before this step and complete `commit-begin` before any successful Git/platform side effect. A taskless Git-only commit skips the intent protocol entirely.
-
-Detect the restricted push-only scenario first. Otherwise write message, explicit paths, and expected HEAD/tree to JSON and call `agent-infra-internal git-workflow commit --input {file}`.
-
-Immediately after a normal commit succeeds, run the committed checkpoint from that reference. If the checkpoint fails, retain the intent and stop before push or success-state writes.
-
-If this commit is associated with a task and a `review-code` artifact exists, read the highest-round `review-code` artifact before committing:
-- If that artifact's `Overall Verdict` / `总体结论` is Approved, parse `R`, `F`, and `Reviewed Snapshot Tree` / `审查快照树` (`T`)
-- After staging the explicit files, record `pre_head=$(git rev-parse HEAD)` and use the helper's JSON mode to generate the complete worktree tree `W` and normalized staged tree `S`
-- Before `git commit`, require `pre_head == R && W == T && S == T`; use the helper's `compare` mode to produce added, missing, and different diagnostics for both worktree and staged snapshots
-- If any condition fails, enter Scenario 4 in `reference/task-status-update.md`; do not run `git commit`, push, successful state updates, PR summary sync, or the completion gate
-- After all comparisons match and the commit succeeds, the Step 6 `commit-complete` core finalizer atomically writes `last_reviewed_commit` and Commit done; the caller must not write them
-- Do not scan backward to earlier Approved artifacts; the highest-round `review-code` artifact is the only authoritative source
-
-## 5. Push to the Existing PR When Applicable
+Respect existing user changes and stop on a conflict according to the no-mid-flow-questions rule.
 
-After a new commit is created, or when Step 4 selects push-only, push HEAD normally if the current branch already has an open Pull Request. Otherwise keep the current behavior (the first push is still handled by `create-pr`). This adds no extra/empty commit and never pushes when there is no PR.
+## 2. Update copyright years
 
-> Detect whether the current branch has an open PR — and authenticate to the platform — per `.agents/rules/issue-pr-commands.md`; if that rule is unavailable or detection fails, follow the degradation below.
+Get the current year dynamically and update only touched files that contain a copyright header. Read `reference/copyright-check.md` for the complete procedure.
 
-a. Detect whether the current branch (head) has an open PR per `.agents/rules/issue-pr-commands.md`.
+## 3. Create the commit message
 
-b. On an open PR -> push the current branch:
+Review status, diff, and recent history. Use an imperative Conventional Commit message and read `reference/commit-message.md` for co-author handling.
 
-Use `agent-infra-internal git-workflow push --input {file}` for per-ref normal push and verification. Never force push.
+## 4. Call the single commit core
 
-After push succeeds and remote verification completes, immediately run the pushed checkpoint from `reference/commit-orchestration.md`.
+Read `reference/commit-orchestration.md` before this step.
 
-c. Safe degradation (never block an already completed `git commit`; only warn the user):
-   - Platform unavailable / unauthenticated / detection failed / no open PR -> do not push; continue.
-   - `git push` fails (needs `git pull --rebase`, no upstream, network error) -> keep the local commit and tell the user to push manually.
-
-Fold the push outcome (pushed / skipped(no PR) / failed) into the next step's "Update Task Status" Activity Log note or user output.
-
-## 6. Update Task Status When Applicable
-
-After checkpoints and before synchronization or the completion gate, call `commit-complete`. Under the task lock, core writes the review anchor, Commit done, and planned orchestration bytes, then deletes the intent last. On failure retain the intent and let the next skill run use status/recover.
-
-```bash
-agent-infra-internal task-orchestration {task-id} commit-complete --token "$commit_intent_token" --agent {standard-agent-token}
-```
-
-Get the current time:
+Write the message, explicit paths, expected HEAD/tree, task scope, agent, mode, and optional push policy to a temporary JSON file, then call:
 
 ```bash
-date "+%Y-%m-%d %H:%M:%S%z" | sed 's/\([+-][0-9][0-9]\)\([0-9][0-9]\)$/\1:\2/'
+agent-infra-internal git-workflow commit --input {commit-operation.json}
 ```
 
-> The full five-case status matrix, prerequisite checks, and multi-TUI next-step commands live in `reference/task-status-update.md`. Read `reference/task-status-update.md` before updating task state.
-
-> Before rendering next steps, read `.agents/rules/next-step-output.md` and invoke the shared helper for the scenario selected from `reference/task-status-update.md`.
-
-After core finalization succeeds, choose exactly one next-step case:
-- open PR and successful push -> `watch-pr {task-ref}`; this takes precedence over the final-commit `prFlow` route
-- failed push -> keep the task active and show only push/synchronization diagnostics; do not show `watch-pr` or `complete-task`
-- final commit -> render the next step by `.agents/.airc.json`'s `prFlow` (`disabled` -> single option `complete-task`; `required` -> single option `create-pr`; absent -> two options `create-pr` / `complete-task`); see Case 1 in `reference/task-status-update.md`
-- more work remains -> update task.md and stop
-- ready for review -> `review-code {task-id}`
+Taskless direct mode omits `taskRef`; orchestrated mode must pass `taskRef`, `agent`, and `mode: "orchestrated"`. The core owns repository/worktree mutation locking, task locking when bound, path and sensitive-file checks, staged scope, HEAD/tree, branch/ref, commit, push, protected-branch policy, warnings, and idempotency.
 
-## 7. Sync Issue Metadata When Applicable
+- Create at most one local commit for explicit changes.
+- If there are no changes but HEAD is ahead and delivery is requested, perform push-only and do not create an empty commit.
+- Skip automatic push on `main` / `master` with `COMMIT_AUTOPUSH_PROTECTED_BRANCH`; retain the local commit.
+- Return `COMMIT_PUSH_FAILED` as a warning on ordinary push failure; a retry only repairs push and never creates a second commit.
+- Successful taskless operations write no task.md, review, receipt, checkpoint, or Activity Log record.
 
-When `{task-id}` exists and task.md contains a valid `issue_number`, sync the linked Issue `in:` labels and requirement checkboxes. Otherwise, skip this step.
+## 5. Finish task and platform synchronization
 
-> Trigger conditions and the declarative `platform-issue` call live in `reference/issue-metadata-sync.md`. Read that file before running this step.
->
-> If this step touches the code-hosting platform, complete the prerequisite checks in `.agents/rules/issue-pr-commands.md` first.
+Continue task synchronization only for task-bound operations. For an associated Issue or PR, follow the issue, PR-summary, and platform rules; the commit path passes `--result no_op` to summary-sync because it only synchronizes an existing PR identity. Synchronization failures are warnings and do not roll back the local commit.
 
-Failure handling matches "Update Task Status When Applicable": warn, but do **not** block an already completed `git commit`.
-
-## 8. Sync PR Summary When Applicable
-
-When `{task-id}` exists and task.md contains a valid `pr_number`, refresh the PR summary comment marked with the PR summary marker defined in `.agents/rules/pr-sync.md` on the PR. Otherwise, skip this step.
-
-> The full trigger conditions, aggregation rules, PATCH/POST flow, shell-safety constraints, and error handling live in `reference/pr-summary-sync.md` (which in turn points to `.agents/rules/pr-sync.md`). Read `reference/pr-summary-sync.md` before executing this step.
->
-> If this step touches the code-hosting platform, complete the prerequisite checks in `.agents/rules/issue-pr-commands.md` first so the runtime context required by `.agents/rules/pr-sync.md` is ready.
-
-Failure handling matches "Update Task Status When Applicable": warn, but do **not** block an already completed `git commit`.
-
-## 9. Verification Gate
-
-If this operation is associated with `{task-id}`, run the verification gate to confirm task metadata and sync state. If there is no task context, skip this step.
+After task-bound finalization, run:
 
 ```bash
+date "+%Y-%m-%d %H:%M:%S%z" | sed 's/\([+-][0-9][0-9]\)\([0-9][0-9]\)$/\1:\2/'
 agent-infra-internal task-verify {task-id} commit.completed --format text
 ```
 
-Handle the result as follows:
-- exit code 0 (all checks passed) -> continue the remaining wrap-up steps
-- exit code 1 (validation failed) -> fix the reported issues and run the gate again
-- exit code 2 (network blocked) -> stop and tell the user that human intervention is required
+Do not claim task finalization without fresh verification output.
 
-Keep the gate output in your reply as fresh evidence. Do not claim completion without output from this run.
+## 6. Render the next step
 
-Run this gate only after core finalization succeeds; never place it before `commit-complete`.
+Read `.agents/rules/next-step-output.md` immediately before calling the single next-step helper. A failed push keeps the task active and reports diagnostics; a final commit routes to `create-pr` or `complete-task` according to `prFlow`.
 
 ## Notes
 
-- Never commit secrets such as `.env`, credentials, or keys
-- Keep the current agent first in the co-author block
-- Do not use `git add -A` or `git add .`
-
-## Error Handling
-
-- If the task status update fails, warn the user but do not block the commit
+- Never commit `.env`, credentials, keys, or other sensitive files.
+- Never use `git add -A` or `git add .`.
+- Never hand-write task Activity Log, review anchors, receipts, or checkpoints.