@fitlab-ai/agent-infra 0.9.9 → 0.9.11

package/templates/.agents/skills/create-pr/SKILL.en.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # Create Pull Request
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 
 Create a Pull Request and, when task-related, sync the essential metadata and reviewer summary immediately.
@@ -19,7 +19,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 ## Task Context Resolution
 
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
+> The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve every other business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to the full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
 
 ## Step Start: started Marker
 
@@ -45,9 +45,7 @@ No Pull Request is required; run instead:
 
 ### 1. Parse Command Arguments
 
-Identify arguments from the command input:
-- arguments matching `TASK-{yyyyMMdd-HHmmss}` -> `{task-id}`
-- remaining arguments -> `{target-branch}`
+Parse the task scope first: an optional `--task <ref>` or `-t <ref>` selects `{task-id}`; a positional task ref is not interpreted. The remaining positional argument, when present, is `{target-branch}`.
 
 If `{task-id}` is provided, read `.agents/workspace/active/{task-id}/task.md` to load task metadata such as `issue_number` and `type`.
 If `{task-id}` is omitted, try to resolve it from the current session context; if it still cannot be determined, skip task-association logic in later steps.
@@ -78,19 +76,25 @@ If `{task-id}` is available and the related task provides `issue_number`, keep `
 
 Capture the `result` field from `platform-pr create` (`pr_created`, `pr_reused`, or `no_op`), then run `agent-infra-internal platform-pr sync {task-id} --agent {standard-agent-token} --metadata --closing-issue --result {primary-result}`. The core copies type / `in:` labels, assignee, and a specific milestone from the Issue and maintains the closing association. Permission-bound items degrade independently, and the Issue is never updated in reverse. After the PR identity is bound, metadata or summary sync failures produce `pr_created_with_warnings`, `pr_reused_with_warnings`, or `no_op_with_warnings` from that primary result, preserve the primary-action fact, and retry only unfinished sync steps.
 
-### 7. Publish the Review Summary
+### 7. Generate the PR Code Change Report
+
+After creating or uniquely reusing the PR, run `agent-infra-internal platform-pr inspect {task-id}` to obtain the authoritative base/head SHAs, then follow `reference/change-report.md` to classify the complete PR line counts, Git blob byte sizes, renames, and potentially unnecessary changes. Read that reference before this step.
+
+The report is part of the reviewer summary below and must also appear in the final user response. Do not provide only total lines, omit byte changes, or inspect only the last commit.
+
+### 8. Publish the Review Summary
 
 Read the latest context artifacts when they exist: `plan.md` / `plan-r{N}.md`, `review-plan.md` / `review-plan-r{N}.md`, `code.md` / `code-r{N}.md`, and `review-code.md` / `review-code-r{N}.md`.
 
-Aggregate a reviewer-facing summary from those artifacts and maintain a single idempotent summary comment via the hidden marker. Pass the same `--result {primary-result}` to `summary-sync`; a sync substep must not infer whether the PR was created or reused.
+Aggregate a reviewer-facing summary from those artifacts, append the `### PR Code Changes` section generated in step 7, and maintain a single idempotent summary comment via the hidden marker. Pass the same `--result {primary-result}` to `summary-sync`; a sync substep must not infer whether the PR was created or reused.
 
 > Canonical context, aggregation, and the `summary-sync` call live in `reference/comment-publish.md`, which points to `.agents/rules/pr-sync.md`. Read that reference before publishing.
 
-### 8. Confirm Task Status
+### 9. Confirm Task Status
 
 After a PR is created or uniquely recovered, `platform-pr create` atomically updates `pr_number`, `pr_status`, canonical time/version metadata, and the Create PR completion log through the task write core. The caller verifies the structured result and does not edit those fields again.
 
-### 9. Verification Gate
+### 10. Verification Gate
 
 If this operation is associated with `{task-id}`, run the verification gate to confirm task metadata and sync state. If there is no task context, skip this step.
 
@@ -105,13 +109,13 @@ Handle the result as follows:
 
 Keep the gate output in your reply as fresh evidence. Do not claim completion without output from this run.
 
-### 10. Inform User
+### 11. Inform User
 
 > Execute this step only after the verification gate passes.
 
 > Before rendering next steps, read `.agents/rules/next-step-output.md`, invoke the shared helper only for the selected scenario, and insert its stdout at `{next-step-commands}`.
 
-Explain the created PR URL, summarize metadata sync and summary-comment results, and recommend watching the PR's checks next (render `{task-ref}` as the short id `NN` per `.agents/rules/next-step-output.md`):
+Explain the created PR URL, summarize metadata sync and summary-comment results, show the complete step 7 category table and necessity conclusion, and recommend watching the PR's checks next (render `{task-ref}` as the short id `NN` per `.agents/rules/next-step-output.md`):
 
 Populate `{next-step-commands}` for this scenario by running `agent-infra-internal agent-client next-steps --skill watch-pr --task-ref {task-ref}`.
 

package/templates/.agents/skills/create-pr/SKILL.zh-CN.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # 创建 Pull Request
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 
 创建 Pull Request，并在与任务关联时立即补齐核心元数据和 reviewer 摘要。
@@ -19,7 +19,7 @@ description: >
 
 ## 任务上下文解析
 
-> 入口允许省略 task ref，也接受旧位置 task ref 或 `--task <ref>` / `-t <ref>`。先从完整参数中分离 task scope 并原样保留其他业务操作数，再调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空、位置 ref 或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为该完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
+> 入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。保留其余业务操作数后调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
 
 ## 步骤开始：started 标记
 
@@ -45,9 +45,7 @@ description: >
 
 ### 1. 解析命令参数
 
-从命令参数中识别：
-- 匹配 `TASK-{yyyyMMdd-HHmmss}` 格式的参数 -> `{task-id}`
-- 其余参数 -> `{target-branch}`
+先解析 task scope：可选的 `--task <ref>` 或 `-t <ref>` 绑定 `{task-id}`；位置 task ref 不再解释。剩余的可选位置参数绑定为 `{target-branch}`。
 
 如果提供了 `{task-id}`，读取 `.agents/workspace/active/{task-id}/task.md` 获取任务信息（例如 `issue_number`、`type` 等）。
 如果未提供，可从当前 session 上下文获取；仍无法确定 `{task-id}` 时，后续步骤中的任务关联逻辑跳过。
@@ -78,19 +76,25 @@ description: >
 
 记录 `platform-pr create` 结构化结果中的 `result`（`pr_created`、`pr_reused` 或 `no_op`），并调用 `agent-infra-internal platform-pr sync {task-id} --agent {standard-agent-token} --metadata --closing-issue --result {primary-result}`。core 从 Issue 复制 type / `in:` labels、assignee 和具体 milestone，并维护 Development 关联；逐项权限不足返回 degraded，不反向更新 Issue。PR 已成功绑定后，metadata/summary 同步失败只产生与 primary result 对应的 `pr_created_with_warnings`、`pr_reused_with_warnings` 或 `no_op_with_warnings`，保留主动作事实，重试只执行未完成的同步步骤。
 
-### 7. 发布审查摘要
+### 7. 生成 PR 代码增减报告
+
+创建或唯一复用 PR 后，调用 `agent-infra-internal platform-pr inspect {task-id}` 取得权威 base/head SHA，并按 `reference/change-report.md` 统计完整 PR 的分类行数、Git blob 字节数、rename 与疑似不必要变化。执行本步骤前先读取该 reference。
+
+报告既是下方 reviewer 摘要的一部分，也必须出现在最终用户回复中；不得只给总行数、忽略字节变化或只统计最后一个 commit。
+
+### 8. 发布审查摘要
 
 读取最新的上下文产物：`plan.md` / `plan-r{N}.md`、`review-plan.md` / `review-plan-r{N}.md`、`code.md` / `code-r{N}.md`、`review-code.md` / `review-code-r{N}.md`（存在时）。
 
-基于这些产物聚合 reviewer 摘要，并使用隐藏标记维护唯一且幂等的摘要评论。调用 `summary-sync` 时继续传递同一个 `--result {primary-result}`，不得根据同步子步骤猜测 PR 是创建还是复用。
+基于这些产物聚合 reviewer 摘要，并追加第 7 步生成的 `### PR 代码增减` 段落，再使用隐藏标记维护唯一且幂等的摘要评论。调用 `summary-sync` 时继续传递同一个 `--result {primary-result}`，不得根据同步子步骤猜测 PR 是创建还是复用。
 
 > canonical context、摘要聚合和 `summary-sync` 调用见 `reference/comment-publish.md`（其引用 `.agents/rules/pr-sync.md`）。发布摘要前先读取该 reference。
 
-### 8. 确认任务状态
+### 9. 确认任务状态
 
 `platform-pr create` 在成功创建或恢复唯一远端身份后，通过任务写入内核原子更新 `pr_number`、`pr_status`、规范时间/版本和 Create PR 完成日志。调用方只核对结构化结果，不再次编辑这些字段。
 
-### 9. 完成校验
+### 10. 完成校验
 
 如果本次操作关联了 `{task-id}`，运行完成校验，确认任务元数据和同步状态符合规范；如果没有任务上下文，跳过本步骤。
 
@@ -105,13 +109,13 @@ agent-infra-internal task-verify {task-id} create-pr.completed --format text
 
 将校验输出保留在回复中作为当次验证输出。没有当次校验输出，不得声明完成。
 
-### 10. 告知用户
+### 11. 告知用户
 
 > 仅在校验通过后执行本步骤。
 
 > 渲染下一步前先读取 `.agents/rules/next-step-output.md`，仅为已选场景调用统一 helper，并将 stdout 填入 `{next-step-commands}`。
 
-说明 PR URL、元数据同步结果、摘要评论结果，并推荐下一步进入 PR 监控（按 `.agents/rules/next-step-output.md` 把 `{task-ref}` 渲染为短号 `NN`）：
+说明 PR URL、元数据同步结果、摘要评论结果，完整展示第 7 步的分类统计表与必要性结论，并推荐下一步进入 PR 监控（按 `.agents/rules/next-step-output.md` 把 `{task-ref}` 渲染为短号 `NN`）：
 
 使用 `agent-infra-internal agent-client next-steps --skill watch-pr --task-ref {task-ref}` 生成本场景的 `{next-step-commands}`。
 

package/templates/.agents/skills/create-pr/reference/change-report.en.md

@@ -0,0 +1,46 @@
+# PR Code Change Report
+
+<!-- pr-change-report-contract
+{"source":"platform-pr-inspect","diff":"three-dot-find-renames","metrics":["numstat-lines","git-blob-bytes"],"publish":["pr-summary","user-response"]}
+-->
+
+After a PR is created or uniquely reused, use the authoritative `base.sha` and `head.sha` returned by `platform-pr inspect` to measure the complete PR diff. Do not substitute the last commit or current worktree state.
+
+## Evidence Commands
+
+```bash
+node .agents/skills/create-pr/scripts/change-report.mjs --base {base-sha} --head {head-sha}
+git diff --find-renames --name-status {base-sha}...{head-sha}
+git diff --find-renames --summary {base-sha}...{head-sha}
+```
+
+The script calculates both `numstat` line counts and exact Git blob byte sizes between the merge base and head. Bytes provide a stable unit, cover binary files, and reveal same-line compaction; submodules are not blobs and contribute zero bytes. Added files have zero old bytes, deleted files have zero new bytes, pure renames have zero net bytes, and copies count only the new destination content.
+
+Count binary files in the file total but do not invent line counts for `-` numstat values. Explain renames and copies from the script's per-file records, `name-status`, and `summary` so moves are not reported as full rewrites.
+
+## Classification and Reconciliation
+
+Using the repository's actual structure, assign every file to exactly one closest category and omit categories that do not apply:
+
+- Runtime code
+- Tests and test support
+- Skills, workflows, and collaboration rules
+- Templates or generated mirrors
+- Documentation
+- Configuration, dependencies, and other files
+
+The table must contain component, file count, added lines, deleted lines, net lines, old bytes, new bytes, and net bytes, followed by a total row. Byte columns describe the blob content size of files involved in this change, not disk usage for the entire repository or worktree. Use exact integers; optional KiB/MiB values may aid readability but must not replace byte counts.
+
+Category line and byte totals must each reconcile exactly with the script's `totals`. Then list the largest files by line change and absolute net-byte change, distinguishing source, tests, template mirrors, and pure renames.
+
+## Required Analysis
+
+Briefly explain:
+
+- where growth is concentrated and how runtime code compares with tests, docs, and templates;
+- whether net line and net byte changes tell different stories, especially for substantial same-line compaction or expansion;
+- which line changes are path moves, bilingual mirrors, or mechanical synchronization;
+- whether any change cannot be traced directly to the PR goal and may be unnecessary; if none, state the evidence;
+- when a test fixture is much larger than production changes, what risk it covers instead of judging it only by size.
+
+Add the complete report as a `### PR Code Changes` section in the reviewer summary body. Preserve the same table and conclusion in the user-visible create-pr completion response. Do not create a second PR comment for this report.

package/templates/.agents/skills/create-pr/reference/change-report.zh-CN.md

@@ -0,0 +1,46 @@
+# PR 代码增减报告
+
+<!-- pr-change-report-contract
+{"source":"platform-pr-inspect","diff":"three-dot-find-renames","metrics":["numstat-lines","git-blob-bytes"],"publish":["pr-summary","user-response"]}
+-->
+
+PR 创建或复用成功后，使用 `platform-pr inspect` 返回的权威 `base.sha` 与 `head.sha` 统计完整 PR 差异，不以最后一个 commit 或工作树状态代替。
+
+## 证据命令
+
+```bash
+node .agents/skills/create-pr/scripts/change-report.mjs --base {base-sha} --head {head-sha}
+git diff --find-renames --name-status {base-sha}...{head-sha}
+git diff --find-renames --summary {base-sha}...{head-sha}
+```
+
+脚本在 merge base 与 head 之间同时计算 `numstat` 行数和 Git blob 的精确字节数。字节比字符具有稳定口径，也能覆盖二进制文件和同行内缩减；子模块不是 blob，按 0 字节贡献核算。新增文件的旧字节数为 0，删除文件的新字节数为 0，纯 rename 的净字节数为 0，copy 只计新增目标内容。
+
+`numstat` 中的二进制文件计入文件数，但不虚构行数。rename/copy 依据脚本的逐文件记录、`name-status` 与 `summary` 单独说明，避免把移动误报为整文件重写。
+
+## 分类与核算
+
+结合仓库实际结构，把每个文件唯一归入以下最贴近的类别；不适用的类别省略：
+
+- 运行时代码
+- 测试与测试辅助设施
+- Skill / workflow / 协作规则
+- 模板或生成镜像
+- 文档
+- 配置、依赖与其他
+
+输出表格必须包含“部分、文件数、新增行、删除行、净增行、旧字节、新字节、净字节”，并有合计行。字节列表示本次变更涉及文件的 blob 内容体积，不表示整个仓库或工作树的磁盘占用。使用精确整数；可附加 KiB/MiB 便于阅读，但不能替代字节数。
+
+各类别的行数和字节数之和必须分别与脚本的 `totals` 一致。随后分别列出行数变化和绝对净字节变化最大的文件，并区分源码、测试、模板镜像和纯 rename。
+
+## 分析要求
+
+用简短结论回答：
+
+- 增长主要集中在哪里，运行时代码与测试/文档/模板各占多少；
+- 行数净变化与净字节变化是否给出不同结论，尤其指出同行内明显缩减或膨胀；
+- 哪些行数只是路径迁移、双语镜像或机械同步；
+- 是否存在与 PR 目标无法直接对应、疑似不必要的变化；若没有，明确说明判断依据；
+- 若某个测试 fixture 明显大于生产改动，解释它覆盖的风险，而不是仅以行数评价。
+
+将完整报告以 `### PR 代码增减` 段落写入 reviewer 摘要正文，并在 create-pr 的用户可见完成回复中原样保留同一张统计表与结论。不要把报告另建成第二条 PR 评论。

package/templates/.agents/skills/create-pr/scripts/change-report.mjs

@@ -0,0 +1,203 @@
+import { execFileSync } from "node:child_process";
+
+function fail(message) {
+  process.stderr.write(`${message}\n`);
+  process.exit(1);
+}
+
+function parseArgs(argv) {
+  const options = { cwd: process.cwd() };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    const value = argv[index + 1];
+
+    if ((argument === "--base" || argument === "--head" || argument === "--cwd") && value) {
+      options[argument.slice(2)] = value;
+      index += 1;
+      continue;
+    }
+
+    fail(`Unknown or incomplete argument: ${argument}`);
+  }
+
+  if (!options.base || !options.head) {
+    fail("Usage: change-report.mjs --base <sha> --head <sha> [--cwd <repository>]");
+  }
+
+  return options;
+}
+
+function git(args, options, encoding = "utf8") {
+  return execFileSync("git", args, {
+    cwd: options.cwd,
+    encoding,
+    maxBuffer: 64 * 1024 * 1024
+  });
+}
+
+function parseRawDiff(buffer) {
+  const tokens = buffer.toString("utf8").split("\0");
+  const files = [];
+
+  for (let index = 0; index < tokens.length && tokens[index];) {
+    const header = tokens[index++];
+    const [oldMode, newMode, oldOid, newOid, status] = header.slice(1).split(" ");
+    const firstPath = tokens[index++];
+    const hasPathPair = status.startsWith("R") || status.startsWith("C");
+    const secondPath = hasPathPair ? tokens[index++] : firstPath;
+
+    files.push({
+      status,
+      oldMode,
+      newMode,
+      oldOid,
+      newOid,
+      oldPath: status.startsWith("A") ? null : firstPath,
+      newPath: status.startsWith("D") ? null : secondPath
+    });
+  }
+
+  return files;
+}
+
+function parseNumstat(buffer) {
+  const tokens = buffer.toString("utf8").split("\0");
+  const stats = new Map();
+
+  for (let index = 0; index < tokens.length && tokens[index];) {
+    const record = tokens[index++];
+    const firstTab = record.indexOf("\t");
+    const secondTab = record.indexOf("\t", firstTab + 1);
+    const additions = record.slice(0, firstTab);
+    const deletions = record.slice(firstTab + 1, secondTab);
+    const path = record.slice(secondTab + 1);
+
+    if (path) {
+      stats.set(`path:${path}`, { additions, deletions });
+      continue;
+    }
+
+    const oldPath = tokens[index++];
+    const newPath = tokens[index++];
+    stats.set(`pair:${oldPath}\0${newPath}`, { additions, deletions });
+  }
+
+  return stats;
+}
+
+function objectSizes(files, options) {
+  const objectIds = new Set();
+
+  for (const file of files) {
+    if (file.oldMode !== "000000" && file.oldMode !== "160000" && !file.status.startsWith("C")) {
+      objectIds.add(file.oldOid);
+    }
+    if (file.newMode !== "000000" && file.newMode !== "160000") {
+      objectIds.add(file.newOid);
+    }
+  }
+
+  if (objectIds.size === 0) return new Map();
+
+  const ids = [...objectIds];
+  const output = execFileSync(
+    "git",
+    ["cat-file", "--batch-check=%(objectname) %(objecttype) %(objectsize)"],
+    {
+      cwd: options.cwd,
+      input: `${ids.join("\n")}\n`,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024
+    }
+  );
+  const sizes = new Map();
+
+  for (const line of output.trim().split("\n")) {
+    const [oid, type, size] = line.split(" ");
+    if (type === "blob") sizes.set(oid, Number(size));
+  }
+
+  return sizes;
+}
+
+function numericLineCount(value) {
+  return value === "-" ? null : Number(value);
+}
+
+function main() {
+  const options = parseArgs(process.argv.slice(2));
+  const mergeBase = git(["merge-base", options.base, options.head], options).trim();
+  const diffArgs = ["diff", "--no-ext-diff", "--find-renames", "-z", mergeBase, options.head];
+  const files = parseRawDiff(git([...diffArgs.slice(0, 2), "--raw", "--abbrev=64", ...diffArgs.slice(2)], options, null));
+  const numstat = parseNumstat(git([...diffArgs.slice(0, 2), "--numstat", ...diffArgs.slice(2)], options, null));
+  const sizes = objectSizes(files, options);
+
+  const reportFiles = files.map((file) => {
+    const key = file.status.startsWith("R") || file.status.startsWith("C")
+      ? `pair:${file.oldPath}\0${file.newPath}`
+      : `path:${file.newPath || file.oldPath}`;
+    const lines = numstat.get(key);
+    if (!lines) fail(`Missing numstat record for ${file.newPath || file.oldPath}`);
+
+    const oldBytes = file.oldMode === "000000" || file.oldMode === "160000" || file.status.startsWith("C")
+      ? 0
+      : sizes.get(file.oldOid);
+    const newBytes = file.newMode === "000000" || file.newMode === "160000"
+      ? 0
+      : sizes.get(file.newOid);
+    if (oldBytes === undefined || newBytes === undefined) {
+      fail(`Unable to resolve blob size for ${file.newPath || file.oldPath}`);
+    }
+
+    return {
+      status: file.status,
+      oldPath: file.oldPath,
+      newPath: file.newPath,
+      additions: numericLineCount(lines.additions),
+      deletions: numericLineCount(lines.deletions),
+      oldBytes,
+      newBytes,
+      netBytes: newBytes - oldBytes
+    };
+  });
+
+  const totals = reportFiles.reduce((result, file) => {
+    result.files += 1;
+    result.oldBytes += file.oldBytes;
+    result.newBytes += file.newBytes;
+    result.netBytes += file.netBytes;
+    if (file.additions === null || file.deletions === null) {
+      result.binaryFiles += 1;
+    } else {
+      result.textFiles += 1;
+      result.additions += file.additions;
+      result.deletions += file.deletions;
+    }
+    return result;
+  }, {
+    files: 0,
+    textFiles: 0,
+    binaryFiles: 0,
+    additions: 0,
+    deletions: 0,
+    oldBytes: 0,
+    newBytes: 0,
+    netBytes: 0
+  });
+
+  process.stdout.write(`${JSON.stringify({
+    version: 1,
+    base: options.base,
+    head: options.head,
+    mergeBase,
+    files: reportFiles,
+    totals
+  }, null, 2)}\n`);
+}
+
+try {
+  main();
+} catch (error) {
+  fail(error instanceof Error ? error.message : String(error));
+}

package/templates/.agents/skills/create-release-note/SKILL.en.md

@@ -109,13 +109,12 @@ If no historical release notes exist, use the following default Markdown format:
      - Commit co-authors from the typed context's commit `authors`
      - Issue reporters from typed `closingIssues[].author`
    - **Contribution count**: `PR count + co-authored commit count` for the same identity, merged across both sources
-   - **Name -> `@login` mapping**:
-     - For `platform-user` or `platform-noreply`, use the lowercased `login`
-     - Only for `unresolved`, use the Name heuristic: take the first token before a space and lowercase it
-     - If the login already appears in the PR author list, merge counts into that login so `Claude` and `@claude` do not become separate entries
-     - Merge all Name variants that map to the same login before counting and sorting; for example, `Claude` and `Claude Opus 4.6 (1M context)` should both collapse into `@claude`
+   - **`@login` mapping**: follow the identity safety boundary in `.agents/rules/release-commands.md`
+     - For `platform-user` or `platform-noreply` with a non-empty `login`, use the lowercased `login`
+     - Exclude `unresolved` identities from the contributor list; never infer a login from a name, email address, domain, brand, or same-named platform account
+     - Merge all Name variants carrying the same typed login before counting and sorting
      - Preserve bot identities as-is, for example `dependabot[bot]`
-     - If the login still cannot be determined reliably, output `@{lowercased first Name token}` and append `<!-- TODO(reviewer): confirm platform login for {original Name <email>} -->` below the `Contributors` section
+     - Do not add unresolved identity emails, placeholder mentions, or identity-verification TODOs to publishable notes
    - **Sorting**: descending by contribution count, then lexicographically by login for ties
    - **Deduplication**: use the final mapped `@login` as the key
    - **Issue reporter rules**:

package/templates/.agents/skills/create-release-note/SKILL.zh-CN.md

@@ -109,13 +109,12 @@ agent-infra-internal platform-release-notes context \
      - Commit co-authors：来自步骤 3 typed context 的 commit `authors`
      - Issue reporters：来自步骤 3 typed context 的 `closingIssues[].author`
    - **贡献数定义**：`该人的 PR 数 + 该人作为 co-author 的 commit 数`（同一身份跨来源合并计数）
-   - **Name → `@login` 映射**：
-     - `resolution` 为 `platform-user` 或 `platform-noreply` 时直接采用小写 `login`
-     - 仅当 `resolution` 为 `unresolved` 时按 Name 启发式：取首个空格前的 token 并转为小写
-     - 已出现在 PR author 列表中的 login，必须按该 login 合并计数，避免把 `Claude` 和 `@claude` 拆成两个条目
-     - 同一 login 的所有 Name 变体都必须归并后再计数与排序；例如 `Claude` 与 `Claude Opus 4.6 (1M context)` 都映射到 `@claude` 时，应先合并为同一个贡献者
+   - **`@login` 映射**：遵循 `.agents/rules/release-commands.md` 的身份安全边界
+     - `resolution` 为 `platform-user` 或 `platform-noreply` 且 `login` 非空时，采用小写 `login`
+     - `resolution` 为 `unresolved` 时从贡献者列表中排除；不得从 Name、邮箱、域名、品牌或同名平台账号推断 login
+     - 同一 typed login 的所有 Name 变体必须归并后再计数与排序
      - Bot 身份保留原样（如 `dependabot[bot]`）
-     - 若仍无法可靠确定 login，则输出 `@{Name 首 token 小写}`，并在 `Contributors` 段落下追加 `<!-- TODO(reviewer): 确认 {原始 Name <email>} 的 platform login -->`
+     - 不得在可发布 notes 中加入未解析身份的邮箱、占位 mention 或身份确认 TODO
    - **排序**：按贡献数降序；贡献数相同时按 login 字典序
    - **去重**：以最终映射后的 `@login` 为键
    - **Issue reporter 规则**：

package/templates/.agents/skills/create-task/SKILL.en.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # Create Task
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 
 ## Boundary / Critical Rules

package/templates/.agents/skills/create-task/SKILL.zh-CN.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # 创建任务
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 
 ## 行为边界 / 关键规则

package/templates/.agents/skills/import-issue/SKILL.en.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # Import Issue
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 
 Import the specified Issue and create a task. Argument: issue number.

package/templates/.agents/skills/import-issue/SKILL.zh-CN.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # 导入 Issue
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 
 导入指定的 Issue 并创建任务。参数：issue 编号。

package/templates/.agents/skills/plan-task/SKILL.en.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # Design Technical Plan
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 If the entry operands contain `--orchestrated`, bind `{execution-flag}` to `--orchestrated` and forward it unchanged to the completed event; otherwise bind it to an empty value. Never infer it from `orchestration.json`, environment variables, or prior artifacts.
 
@@ -15,6 +15,7 @@ If the entry operands contain `--orchestrated`, bind `{execution-flag}` to `--or
 
 - This skill only outputs a technical plan document (`plan.md` or `plan-r{N}.md`) and does not modify any business code
 - This is a **mandatory human review checkpoint**; do not automatically proceed to implementation
+- When the plan touches compatibility, migration, old formats, or old entry points, read `.agents/rules/compatibility-policy.md` first. Do not design adapters, shims, dual writes, or parallel state machines without passing its admission gate
 - After executing this skill, you **must** immediately update task status in task.md
 
 Version stamp rule: when creating or updating `task.md` frontmatter, read `.agents/rules/version-stamp.md` first and write or refresh `agent_infra_version`.
@@ -23,7 +24,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 After loading workflow / skill / rules instructions, and before any task-state judgment or user-visible conclusion, run the state check first. Reading instruction files does not count as an external-state action or conclusion.
 
-Run these commands and paste the raw output into both the user-facing reply and this round's `## State Check` section:
+Run these commands and paste the raw output into this round's `## State Check` section:
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -33,7 +34,7 @@ Before the state check is complete, do not make external-state assertions such a
 
 ## Task Context Resolution
 
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
+> The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve every other business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to the full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
 
 > Resolve the task reference, then confirm that the task is in a state or directory supported by this skill and that `task.md` exists; if it cannot be located, handle it as a missing task and stop.
 
@@ -75,7 +76,7 @@ Use it to understand:
 
 - Read the relevant source files identified in the analysis
 - Understand the current architecture and patterns
-- Identify constraints (backward compatibility, performance, etc.)
+- Identify explicit constraints, including evidenced and approved compatibility or performance requirements; do not infer a compatibility promise
 - Consider edge cases and failure scenarios
 
 ### 5. Design the Technical Plan

package/templates/.agents/skills/plan-task/SKILL.zh-CN.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # 设计技术方案
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 若入口业务操作数包含 `--orchestrated`，绑定 `{execution-flag}` = `--orchestrated` 并原样转发给 completed 事件；否则绑定为空。不得从 `orchestration.json`、环境变量或历史产物推断该标记。
 
@@ -15,6 +15,7 @@ description: >
 
 - 本技能仅产出技术方案文档（`plan.md` 或 `plan-r{N}.md`）—— 不修改任何业务代码
 - 这是一个**强制性的人工审查检查点** —— 不要自动进入实现阶段
+- 方案涉及兼容、迁移、旧格式或旧入口时，先读取 `.agents/rules/compatibility-policy.md`；未通过准入门槛时不得设计 adapter、shim、双写或并行状态机
 - 执行本技能后，你**必须**立即更新 task.md 中的任务状态
 
 版本戳规则：创建或更新 `task.md` frontmatter 时，先读取 `.agents/rules/version-stamp.md`，并写入或刷新 `agent_infra_version`。
@@ -23,7 +24,7 @@ description: >
 
 在加载 workflow / skill / rules 指令之后、做任何任务状态判断或用户可见结论之前，必须先执行状态核对。指令类文件读取不算对外动作或结论。
 
-运行以下命令，并把原文粘贴到回复正文和本轮产物的 `## 状态核对` 段：
+运行以下命令，并把原文粘贴到本轮产物的 `## 状态核对` 段：
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -33,7 +34,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## 任务上下文解析
 
-> 入口允许省略 task ref，也接受旧位置 task ref 或 `--task <ref>` / `-t <ref>`。先从完整参数中分离 task scope 并原样保留其他业务操作数，再调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空、位置 ref 或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为该完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
+> 入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。保留其余业务操作数后调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
 
 > 解析任务引用，并确认任务位于本技能支持的状态或目录且存在 `task.md`；无法定位时按未找到任务处理并停止。
 
@@ -76,7 +77,7 @@ agent-infra-internal task-event {task-id} plan.started --agent {standard-agent-t
 
 - 阅读分析中识别的相关源码文件
 - 理解当前架构和模式
-- 识别约束条件（向后兼容性、性能等）
+- 识别明确约束（包括有证据且已获准的兼容性、性能等），不自行推导兼容承诺
 - 考虑边界情况和错误场景
 
 ### 5. 设计技术方案

package/templates/.agents/skills/restore-task/SKILL.en.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # Restore Task
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 
 Restore local task workspace files from platform Issue comments that contain sync markers.