@fitlab-ai/agent-infra 0.9.9 → 0.9.11

package/templates/.agents/skills/restore-task/SKILL.zh-CN.md

@@ -6,7 +6,7 @@ description: >
 ---
 
 # 还原任务
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 
 从带有 sync 标记的平台 Issue 评论中恢复本地任务工作区文件。

package/templates/.agents/skills/review-analysis/SKILL.en.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # Requirement Analysis Review
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 If the entry operands contain `--orchestrated`, bind `{execution-flag}` to `--orchestrated` and forward it unchanged to both the summary finalizer and completed event; otherwise bind it to an empty value. Never infer it from `orchestration.json`, environment variables, or prior artifacts.
 
@@ -24,7 +24,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 After loading workflow / skill / rules instructions, and before any task-state judgment or user-visible conclusion, run the state check first.
 
-Run these commands and paste the raw output into both the user-facing reply and this round's `## State Check` section:
+Run these commands and paste the raw output into this round's `## State Check` section:
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -32,7 +32,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## Task Context Resolution
 
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
+> The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve every other business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to the full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
 
 > Resolve the task reference, then confirm that the task is in a state or directory supported by this skill and that `task.md` exists; if it cannot be located, handle it as a missing task and stop.
 
@@ -85,6 +85,8 @@ The intent atomically finalizes the report summary and returns the same ledger s
 
 If task.md has a valid `issue_number`, run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`, then `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {review-artifact} --agent {standard-agent-token}`.
 
+Before writing the summary, the finalization intent checks decision-detail ids; it auto-removes a duplicate only when exactly one formal `[needs-human-decision]` block remains and every other same-id block is clearly short and informal, then reruns the read-only check. Ambiguous duplicates fail closed. If this check or repair fails, stop before the completion event.
+
 ### 7. Run Completion Gate
 
 ```bash

package/templates/.agents/skills/review-analysis/SKILL.zh-CN.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # 需求分析审查
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 若入口业务操作数包含 `--orchestrated`，绑定 `{execution-flag}` = `--orchestrated` 并原样转发给 summary finalizer 与 completed 事件；否则绑定为空。不得从 `orchestration.json`、环境变量或历史产物推断该标记。
 
@@ -24,7 +24,7 @@ description: >
 
 在加载 workflow / skill / rules 指令之后、做任何任务状态判断或用户可见结论之前，必须先执行状态核对。指令类文件读取不算对外动作或结论。
 
-运行以下命令，并把原文粘贴到回复正文和本轮产物的 `## 状态核对` 段：
+运行以下命令，并把原文粘贴到本轮产物的 `## 状态核对` 段：
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -34,7 +34,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## 任务上下文解析
 
-> 入口允许省略 task ref，也接受旧位置 task ref 或 `--task <ref>` / `-t <ref>`。先从完整参数中分离 task scope 并原样保留其他业务操作数，再调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空、位置 ref 或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为该完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
+> 入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。保留其余业务操作数后调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
 
 > 解析任务引用，并确认任务位于本技能支持的状态或目录且存在 `task.md`；无法定位时按未找到任务处理并停止。
 
@@ -88,6 +88,8 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 如果 task.md 中存在有效的 `issue_number`，调用 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`，再调用 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {review-artifact} --agent {standard-agent-token}`；失败按 `.agents/rules/issue-sync.md` 记录 warning。
 
+最终化 intent 会在写入摘要前检查详情块 ID；只有“一个正式 `[needs-human-decision]` 块 + 明确的简短非正式重复块”才会自动删除重复块并重新做只读检查，无法唯一判断时失败关闭。该检查或自动修复失败时，停止在完成事件之前。
+
 ### 7. 完成校验
 
 ```bash

package/templates/.agents/skills/review-analysis/config/verify.en.json

@@ -36,6 +36,7 @@
         "^\\$ "
       ]
     },
+    "decision-details": {},
     "review-summary": {
       "stage": "analysis"
     },

package/templates/.agents/skills/review-analysis/config/verify.zh-CN.json

@@ -36,6 +36,7 @@
         "^\\$ "
       ]
     },
+    "decision-details": {},
     "review-summary": {
       "stage": "analysis"
     },

package/templates/.agents/skills/review-code/SKILL.en.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # Code Review
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 If the entry operands contain `--orchestrated`, bind `{execution-flag}` to `--orchestrated` and forward it unchanged to both the summary finalizer and completed event; otherwise bind it to an empty value. Never infer it from `orchestration.json`, environment variables, or prior artifacts.
 
@@ -33,7 +33,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 After loading workflow / skill / rules instructions, and before any task-state judgment or user-visible conclusion, run the state check first. Reading instruction files does not count as an external-state action or conclusion.
 
-Run these commands and paste the raw output into both the user-facing reply and this round's `## State Check` section:
+Run these commands and paste the raw output into this round's `## State Check` section:
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -43,7 +43,7 @@ Before the state check is complete, do not make external-state assertions such a
 
 ## Task Context Resolution
 
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
+> The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve every other business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to the full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
 
 > Resolve the task reference, then confirm that the task is in a state or directory supported by this skill and that `task.md` exists; if it cannot be located, handle it as a missing task and stop.
 
@@ -121,6 +121,8 @@ If task.md contains a valid `issue_number`, perform these sync actions (skip and
 - Run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`
 - Run `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {review-artifact} --agent {standard-agent-token}`
 
+Before writing the summary, the finalization intent checks decision-detail ids; it auto-removes a duplicate only when exactly one formal `[needs-human-decision]` block remains and every other same-id block is clearly short and informal, then reruns the read-only check. Ambiguous duplicates fail closed. If this check or repair fails, stop before the completion event.
+
 ### 7. Verification Gate
 
 Run the verification gate to confirm the task artifact and sync state are valid:

package/templates/.agents/skills/review-code/SKILL.zh-CN.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # 代码审查
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 若入口业务操作数包含 `--orchestrated`，绑定 `{execution-flag}` = `--orchestrated` 并原样转发给 summary finalizer 与 completed 事件；否则绑定为空。不得从 `orchestration.json`、环境变量或历史产物推断该标记。
 
@@ -33,7 +33,7 @@ description: >
 
 在加载 workflow / skill / rules 指令之后、做任何任务状态判断或用户可见结论之前，必须先执行状态核对。指令类文件读取不算对外动作或结论。
 
-运行以下命令，并把原文粘贴到回复正文和本轮产物的 `## 状态核对` 段：
+运行以下命令，并把原文粘贴到本轮产物的 `## 状态核对` 段：
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -43,7 +43,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## 任务上下文解析
 
-> 入口允许省略 task ref，也接受旧位置 task ref 或 `--task <ref>` / `-t <ref>`。先从完整参数中分离 task scope 并原样保留其他业务操作数，再调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空、位置 ref 或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为该完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
+> 入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。保留其余业务操作数后调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
 
 > 解析任务引用，并确认任务位于本技能支持的状态或目录且存在 `task.md`；无法定位时按未找到任务处理并停止。
 
@@ -119,6 +119,8 @@ agent-infra-internal task-snapshot {task-id} --format text
 - 调用 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`
 - 调用 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {review-artifact} --agent {standard-agent-token}`
 
+最终化 intent 会在写入摘要前检查详情块 ID；只有“一个正式 `[needs-human-decision]` 块 + 明确的简短非正式重复块”才会自动删除重复块并重新做只读检查，无法唯一判断时失败关闭。该检查或自动修复失败时，停止在完成事件之前。
+
 ### 7. 完成校验
 
 运行完成校验，确认任务产物和同步状态符合规范：

package/templates/.agents/skills/review-code/config/verify.en.json

@@ -41,6 +41,7 @@
         "^- \\*\\*Reviewed Snapshot Tree\\*\\*[:：]\\s*[0-9a-f]{40,64}\\s*$"
       ]
     },
+    "decision-details": {},
     "review-summary": {
       "stage": "code"
     },

package/templates/.agents/skills/review-code/config/verify.zh-CN.json

@@ -41,6 +41,7 @@
         "^- \\*\\*审查快照树\\*\\*[:：]\\s*[0-9a-f]{40,64}\\s*$"
       ]
     },
+    "decision-details": {},
     "review-summary": {
       "stage": "code"
     },

package/templates/.agents/skills/review-code/reference/migration-risks.en.md

@@ -6,20 +6,23 @@ Use when changes touch persistent formats, schemas, configuration/frontmatter, c
 
 ## Review Questions
 
-- Can old data or configuration be read safely, and is the post-write version boundary explicit?
-- Is migration repeatable, and can execution recover or continue after partial failure?
-- Does the rollback path match the compatibility window between old and new formats?
+- Does compatibility pass the subject, necessity, window, and exit gate in `.agents/rules/compatibility-policy.md`? If not, should the change be current-only?
+- Is an approved conversion concentrated at one boundary and followed by current-format-only writes, rather than teaching business logic multiple versions?
+- Does temporarily retained compatibility include a co-located `TODO(compat): Remove ... once ...` at its single boundary, naming the removal target and a verifiable condition? A task or issue does not replace this TODO.
+- If migration is required, is it repeatable, and can partial failure recover or stop safely?
+- When an old format is removed, are its branches, fixtures, tests, and documentation removed in the same change?
 
 ## Evidence Requirements
 
-Record the transition from old input to new state, version decisions, and failure states. Prefer migration tests, fixtures, state transitions, or specification conflicts.
+Record compatibility admission evidence first. For approved compatibility, record the single conversion from old input to current state, version decisions, co-located `TODO(compat)`, exit condition, and failure states. Prefer consumer or stored-data evidence, migration tests, fixtures, state transitions, or specification conflicts.
 
 ## Common Counterexamples
 
-- Testing only fresh installation and ignoring existing state.
+- Retaining an old read path “just in case” without real consumers or stored data.
+- Dual-writing formats or maintaining several state machines in the normal path.
 - Assuming migration succeeds once while ignoring retries and partial writes.
 - Replacing data-semantic validation with format-existence checks.
 
 ## When Closure Is Not Possible
 
-Record reproducible corruption or compatibility failures as findings, checks requiring real historical data as manual-validation, and missing samples or rollback evidence as a gap.
+Record unauthorized compatibility, dual writes, and shims without an exit condition as findings. For approved migrations, record reproducible corruption as a finding and checks requiring real historical data as manual-validation. Missing compatibility admission evidence cannot be treated as a harmless gap while approving the change.

package/templates/.agents/skills/review-code/reference/migration-risks.zh-CN.md

@@ -6,20 +6,23 @@
 
 ## 检视问题
 
-- 旧数据或旧配置能否被安全读取，写入后的版本边界是否明确。
-- 迁移是否可重复执行，部分失败后能否恢复或继续。
-- 回滚路径是否与新旧格式的兼容窗口一致。
+- 兼容是否通过 `.agents/rules/compatibility-policy.md` 的对象、必要性、期限和退出条件准入；未准入时是否应直接 current-only。
+- 获准转换是否集中在一个边界，转换后只写当前格式，而不是让业务核心理解多个版本。
+- 暂时保留的兼容是否在唯一边界就地包含 `TODO(compat): Remove ... once ...`，并写明删除对象和可验证条件；任务或 Issue 不替代该 TODO。
+- 若确需迁移，是否可重复执行，部分失败后能否恢复或安全停止。
+- 删除旧格式时，专属分支、fixture、测试和文档是否同轮删除。
 
 ## 证据要求
 
-记录旧输入到新状态的转换、版本判定和失败状态；优先使用迁移测试、fixture、状态转换或规范冲突。
+先记录兼容准入证据；获准兼容时再记录旧输入到当前状态的唯一转换、版本判定、就地 `TODO(compat)`、退出条件和失败状态。优先使用消费者/存量数据证据、迁移测试、fixture、状态转换或规范冲突。
 
 ## 常见反例
 
-- 只验证全新安装，不验证已有状态。
+- 没有真实消费者或存量数据，只因“可能需要”就保留旧读取。
+- 同时写新旧格式，或在主路径里维护多套状态机。
 - 假设迁移一次成功，忽略重试和部分写入。
 - 用格式存在性测试替代数据语义验证。
 
 ## 无法闭环时
 
-可复现的数据损坏或兼容失败形成 finding；需要真实历史数据的验证进入 manual-validation；缺少样本或回滚证据时记录 gap。
+未经授权的兼容层、双写或无退出条件 shim 形成 finding。已获准迁移中的可复现数据损坏形成 finding；需要真实历史数据的验证进入 manual-validation；缺少兼容准入证据时不能仅记录 gap 后放行。

package/templates/.agents/skills/review-plan/SKILL.en.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # Technical Plan Review
-> `--agent` values follow the "Collaborator Token Specification" in `.agents/rules/task-management.md`: standard AI short tokens (`claude`/`codex`/`antigravity`/`opencode`/`cursor`), long-name normalization (`claude-code`->`claude`, `antigravity-cli`->`antigravity`), or the `human` manual exception.
+> `--agent` values are defined in `.agents/rules/task-management.md` under “Collaborator Token Specification”.
 
 If the entry operands contain `--orchestrated`, bind `{execution-flag}` to `--orchestrated` and forward it unchanged to both the summary finalizer and completed event; otherwise bind it to an empty value. Never infer it from `orchestration.json`, environment variables, or prior artifacts.
 
@@ -24,7 +24,7 @@ Version stamp rule: when creating or updating `task.md` frontmatter, read `.agen
 
 After loading workflow / skill / rules instructions, and before any task-state judgment or user-visible conclusion, run the state check first.
 
-Run these commands and paste the raw output into both the user-facing reply and this round's `## State Check` section:
+Run these commands and paste the raw output into this round's `## State Check` section:
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -32,7 +32,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## Task Context Resolution
 
-> The entry point may omit the task ref and also accepts a legacy positional ref or `--task <ref>` / `-t <ref>`. Separate task scope from the full arguments while preserving every business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty, one positional ref, or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to that full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
+> The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve every other business operand, then call `agent-infra-internal task-context resolve {task-scope}` where `{task-scope}` is empty or one task flag. Read only `taskId` from the structured result and bind `{task-id}` to the full `TASK-YYYYMMDD-HHMMSS` for downstream commands. Pass through resolution failures without scanning tasks locally.
 
 > Resolve the task reference, then confirm that the task is in a state or directory supported by this skill and that `task.md` exists; if it cannot be located, handle it as a missing task and stop.
 
@@ -85,6 +85,8 @@ The intent atomically finalizes the report summary and returns the same ledger s
 
 If task.md has a valid `issue_number`, run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`, then `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {review-artifact} --agent {standard-agent-token}`.
 
+Before writing the summary, the finalization intent checks decision-detail ids; it auto-removes a duplicate only when exactly one formal `[needs-human-decision]` block remains and every other same-id block is clearly short and informal, then reruns the read-only check. Ambiguous duplicates fail closed. If this check or repair fails, stop before the completion event.
+
 ### 7. Run Completion Gate
 
 ```bash

package/templates/.agents/skills/review-plan/SKILL.zh-CN.md

@@ -7,7 +7,7 @@ description: >
 ---
 
 # 技术方案审查
-> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」：标准 AI 短名（`claude`/`codex`/`antigravity`/`opencode`/`cursor`）、长名归一化（`claude-code`→`claude`、`antigravity-cli`→`antigravity`）或人工例外 `human`。
+> `--agent` 取值见 `.agents/rules/task-management.md`「合作者 token 规范」。
 
 若入口业务操作数包含 `--orchestrated`，绑定 `{execution-flag}` = `--orchestrated` 并原样转发给 summary finalizer 与 completed 事件；否则绑定为空。不得从 `orchestration.json`、环境变量或历史产物推断该标记。
 
@@ -24,7 +24,7 @@ description: >
 
 在加载 workflow / skill / rules 指令之后、做任何任务状态判断或用户可见结论之前，必须先执行状态核对。指令类文件读取不算对外动作或结论。
 
-运行以下命令，并把原文粘贴到回复正文和本轮产物的 `## 状态核对` 段：
+运行以下命令，并把原文粘贴到本轮产物的 `## 状态核对` 段：
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -34,7 +34,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## 任务上下文解析
 
-> 入口允许省略 task ref，也接受旧位置 task ref 或 `--task <ref>` / `-t <ref>`。先从完整参数中分离 task scope 并原样保留其他业务操作数，再调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空、位置 ref 或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为该完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
+> 入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。保留其余业务操作数后调用 `agent-infra-internal task-context resolve {task-scope}`；`{task-scope}` 为空或 task flag 之一。只读取结构化结果的 `taskId`，后续把 `{task-id}` 绑定为完整 `TASK-YYYYMMDD-HHMMSS`。解析失败时透传非零退出码，不自行扫描任务。
 
 > 解析任务引用，并确认任务位于本技能支持的状态或目录且存在 `task.md`；无法定位时按未找到任务处理并停止。
 
@@ -88,6 +88,8 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 如果 task.md 中存在有效的 `issue_number`，调用 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`，再调用 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {review-artifact} --agent {standard-agent-token}`；失败按 `.agents/rules/issue-sync.md` 记录 warning。
 
+最终化 intent 会在写入摘要前检查详情块 ID；只有“一个正式 `[needs-human-decision]` 块 + 明确的简短非正式重复块”才会自动删除重复块并重新做只读检查，无法唯一判断时失败关闭。该检查或自动修复失败时，停止在完成事件之前。
+
 ### 7. 完成校验
 
 ```bash

package/templates/.agents/skills/review-plan/config/verify.en.json

@@ -36,6 +36,7 @@
         "^\\$ "
       ]
     },
+    "decision-details": {},
     "review-summary": {
       "stage": "plan"
     },

package/templates/.agents/skills/review-plan/config/verify.zh-CN.json

@@ -36,6 +36,7 @@
         "^\\$ "
       ]
     },
+    "decision-details": {},
     "review-summary": {
       "stage": "plan"
     },

package/templates/.agents/skills/run-manual-validation/SKILL.en.md

@@ -8,11 +8,15 @@ description: >
 
 # Run Manual Validation
 
+## Task Context Resolution
+
+The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Parse `--scope`, `--timeout`, and `--format` before `--`, preserve the user command after `--` verbatim, then call `agent-infra-internal task-context resolve {task-scope}`. Pass through resolution failures without scanning tasks locally. The internal `task-validate` protocol continues to use a positional task ref.
+
 ## Boundary
 
 - Select the validation mode, call the sole mechanical entry point, and record evidence; do not mark PR manual validation complete.
 - `complete-manual-validation` remains the maintainer's final registration after coverage is judged sufficient.
-- Never manipulate temporary worktrees, leases, or containers directly; only call `ai task validate`.
+- Never manipulate temporary worktrees, leases, or containers directly; only call `agent-infra-internal task-validate`.
 - Never record tokens, environment variables, full argv, absolute user paths, or raw transcripts in the artifact.
 
 ## Step 0: State Check (pre-execution hard gate)
@@ -28,7 +32,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 1. Read `reference/discovery-and-execution.md` and parse the input mode. Stop before started without an artifact for invalid or partial input.
 2. Run `agent-infra-internal task-artifact {task-id} inspect --family validation-run` and read the latest review-code manual-validation items. Then run `agent-infra-internal platform-pr inspect {task-id}` and use the reference status matrix to discover, merge, and number items. Only automatic mode stops before started when reliable sources are empty or the sole possible source is unreadable; valid explicit mode always continues with the user command as effective work.
 3. Take the round and artifact name from the core result. After confirming valid explicit work or a non-empty discovered list, run `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token}` and classify each item as `executable|unavailable|unknown|unsafe|unresolved`.
-4. Invoke every executable item separately with `ai task validate {task-ref} --scope snapshot --format json -- {command...}`. Only make a second explicit inplace invocation for that item when evidence proves it is required. If no item is executable, run no fabricated command but still produce coverage-gap evidence.
+4. Invoke every executable item separately with `agent-infra-internal task-validate {task-ref} --scope snapshot --format json -- {command...}`. Only make a second explicit inplace invocation for that item when evidence proves it is required. If no item is executable, run no fabricated command but still produce coverage-gap evidence.
 5. Read `reference/report-template.md`, create `validation-run.md|validation-run-r{N}.md`, and record the input mode, discovered list, per-item results, CLI JSON allowlist, and sanitized summaries.
 6. Run `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --artifact {artifact}`. When an Issue exists, run `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}` and then `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {standard-agent-token}`.
 7. Run `agent-infra-internal task-verify {task-id} validation-run.completed --artifact {artifact} --format text`; fix failures and rerun it.
@@ -36,7 +40,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## Completion Checklist
 
-- [ ] Used `ai task validate` for every executable item, or recorded that none were executable
+- [ ] Used `agent-infra-internal task-validate` for every executable item, or recorded that none were executable
 - [ ] Recorded sanitized validation-run evidence
 - [ ] Did not change PR manual validation completion state
 - [ ] Updated task.md and passed completion verification

package/templates/.agents/skills/run-manual-validation/SKILL.zh-CN.md

@@ -8,11 +8,15 @@ description: >
 
 # 运行人工校验
 
+## 任务上下文解析
+
+入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。先解析 `--scope`、`--timeout`、`--format`，在 `--` 后原样保留用户命令，再调用 `agent-infra-internal task-context resolve {task-scope}`。解析失败时透传非零退出码，不自行扫描任务。内部 `task-validate` 协议仍使用位置 task ref。
+
 ## 行为边界
 
 - 本技能负责选择校验模式、调用唯一机械入口并记录证据；不把 PR 人工校验标为完成。
 - `complete-manual-validation` 仍是维护者确认覆盖充分后的最终登记入口。
-- 禁止直接操作临时 worktree、lease 或 container；只调用 `ai task validate`。
+- 禁止直接操作临时 worktree、lease 或 container；只调用 `agent-infra-internal task-validate`。
 - 产物不得记录 token、环境变量、完整 argv、绝对用户路径或原始 transcript。
 
 ## 第 0 步：状态核对（执行前硬约束）
@@ -28,7 +32,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 1. 读取 `reference/discovery-and-execution.md`，解析输入模式；非法或半截输入在 started 前停止，不写产物。
 2. 运行 `agent-infra-internal task-artifact {task-id} inspect --family validation-run`，读取最新 review-code 人工校验项；再运行 `agent-infra-internal platform-pr inspect {task-id}`，按 reference 的状态矩阵发现、归并并编号。仅在自动模式下，可靠来源无项或唯一可能来源不可读时才在 started 前停止；合法显式模式始终以用户命令作为有效工作继续。
 3. 从核心结果取得轮次和产物名；确认存在有效显式工作或非空发现清单后，运行 `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token}`，并逐项分类为 `executable|unavailable|unknown|unsafe|unresolved`。
-4. 每个可执行项分别调用 `ai task validate {task-ref} --scope snapshot --format json -- {command...}`；只有证据表明必须原位时才对该项进行第二次显式 inplace 调用。零项可执行时不运行伪造命令，但仍继续产出覆盖缺口证据。
+4. 每个可执行项分别调用 `agent-infra-internal task-validate {task-ref} --scope snapshot --format json -- {command...}`；只有证据表明必须原位时才对该项进行第二次显式 inplace 调用。零项可执行时不运行伪造命令，但仍继续产出覆盖缺口证据。
 5. 读取 `reference/report-template.md`，创建 `validation-run.md|validation-run-r{N}.md`；记录输入模式、发现清单、逐项结果、CLI JSON allowlist 与去敏摘要。
 6. 运行 `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --artifact {artifact}`。存在 Issue 时依次运行 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}` 和 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {standard-agent-token}`。
 7. 运行 `agent-infra-internal task-verify {task-id} validation-run.completed --artifact {artifact} --format text`；未通过则修复后重跑。
@@ -36,7 +40,7 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 ## 完成检查清单
 
-- [ ] 每个可执行项均已使用 `ai task validate`，或已记录零项可执行
+- [ ] 每个可执行项均已使用 `agent-infra-internal task-validate`，或已记录零项可执行
 - [ ] 已记录去敏 validation-run 证据
 - [ ] 未修改 PR 人工验证完成状态
 - [ ] 已更新 task.md 并通过完成校验

package/templates/.agents/skills/run-manual-validation/reference/discovery-and-execution.en.md

@@ -58,7 +58,7 @@ Only `executable` items may run. Commands must not expose credentials, environme
 1. Invoke each executable item separately:
 
    ```bash
-   ai task validate {task-ref} --scope snapshot --format json -- {command...}
+   agent-infra-internal task-validate {task-ref} --scope snapshot --format json -- {command...}
    ```
 
 2. Only when the item or first-run evidence proves a dependency on uncommitted content, original mounts, or in-place permissions, explicitly invoke that item a second time with `--scope inplace` and record the reason.

package/templates/.agents/skills/run-manual-validation/reference/discovery-and-execution.zh-CN.md

@@ -58,7 +58,7 @@
 1. 每个可执行项分别调用：
 
    ```bash
-   ai task validate {task-ref} --scope snapshot --format json -- {command...}
+   agent-infra-internal task-validate {task-ref} --scope snapshot --format json -- {command...}
    ```
 
 2. 仅当项目要求或首次证据证明依赖未提交内容、原挂载或原位权限时，再为该项显式调用一次 `--scope inplace`，并记录升级理由。

package/templates/.agents/skills/run-manual-validation/reference/report-template.en.md

@@ -37,7 +37,7 @@ $ agent-infra-internal task-snapshot {task-id} --format text
 ## Structured Evidence
 
 ```json
-{sanitized-ai-task-validate-json}
+{sanitized-task-validate-json}
 ```
 
 ## Per-item Results
@@ -64,6 +64,6 @@ $ agent-infra-internal task-snapshot {task-id} --format text
 ## Raw Evidence
 
 ```text
-$ ai task validate {task-ref} --scope {scope} --format json -- {redacted-command}
+$ agent-infra-internal task-validate {task-ref} --scope {scope} --format json -- {redacted-command}
 {sanitized-result}
 ```

package/templates/.agents/skills/run-manual-validation/reference/report-template.zh-CN.md

@@ -37,7 +37,7 @@ $ agent-infra-internal task-snapshot {task-id} --format text
 ## 结构化证据
 
 ```json
-{sanitized-ai-task-validate-json}
+{sanitized-task-validate-json}
 ```
 
 ## 逐项结果
@@ -64,6 +64,6 @@ $ agent-infra-internal task-snapshot {task-id} --format text
 ## 证据原文
 
 ```text
-$ ai task validate {task-ref} --scope {scope} --format json -- {redacted-command}
+$ agent-infra-internal task-validate {task-ref} --scope {scope} --format json -- {redacted-command}
 {sanitized-result}
 ```

package/templates/.agents/skills/run-task/SKILL.en.md

@@ -7,16 +7,20 @@ description: >
 
 # Run Task Lifecycle
 
+## Task Context Resolution
+
+The entry point may omit the task ref; explicit task scope accepts only `--task <ref>` or `-t <ref>`, and positional task refs are not interpreted. Preserve the four policy options and their values, then call `agent-infra-internal task-context resolve {task-scope}`. Pass through resolution failures without scanning tasks locally. The internal orchestration protocol continues to use a positional task ref.
+
 The orchestrator delegates only and never executes a stage skill itself. First read `.agents/rules/no-mid-flow-questions.md`, `.agents/rules/lifecycle-orchestration.md`, and `reference/host-validation.md`.
 
 1. Resolve the canonical task ID, current Agent Client, and optional atomic policy flags, then run `task-snapshot`. If one explicit role field is present, all four are required.
-2. Before `begin-or-resume`, Codex selects a host. Without `AGENT_INFRA_CONTROL_TOKEN`, use direct-host. With task-bound control authority but no `AGENT_INFRA_CODEX_CONTROLLER_CONTEXT`, only run `codex-sandbox-controller run` with the complete policy and wait; the outer loop must not create a run, baseline, or receipt. With a context, run `verify-context` first. Stop on any bootstrap, bundle, source/profile discovery, or context failure.
+2. Before `begin-or-resume`, Codex selects a host. Without `AGENT_INFRA_CONTROL_TOKEN`, use direct-host. With task-bound control authority but no `AGENT_INFRA_CODEX_CONTROLLER_CONTEXT`, only run `codex-sandbox-controller run` with the complete policy and wait; the outer loop must not create a run, baseline, or receipt. With a context, run `verify-context` first. Stop on protocol, task/controller/process, lease, or source/profile discovery failures. Package/build/contract or hook/profile content drift is delivered as a structured warning and tells the user to rebuild the sandbox.
 3. Run `task-orchestration {task-id} begin-or-resume --client {client}` with the complete explicit policy. With no explicit policy, core reads that client's configured policy; existing runs use persisted policy. Disk state outside the complete current structure fails closed without rewriting; finish or clear active runs before upgrading. Stop on paused/completed results.
 4. Run `route`. On `completed`, run `agent-infra-internal task-verify {task-id} run-task.completed --format text` and stop. Only a `running` result with non-null `next` supplies action, role, round, artifact, requested model, and requested effort.
 5. Codex runs `codex-lifecycle capability-arm --task-id {task-id}` once. The current loop's real PostToolUse must attest that ordinary tool response. Pass its marker token, the exact routed model, and the exact routed reasoning effort to `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort} --capability-token {token}`. Core first validates the exact routed model/effort, capability provenance, and controller binding, then captures a read-only snapshot, builds an in-memory prepared receipt, atomically consumes the token, and saves the prepared state with the capability session, turn, and tool-use origin. Activation then verifies that spawn belongs to the same session and turn and uses a distinct tool-use. Other clients use the same prepare without a token. Failure creates no baseline, receipt, or child.
 6. After prepare, run `task-orchestration <task-ref> dispatch` immediately before calling the fresh native child, then use route's exact model/effort and only the short task ref, skill, `--orchestrated`, and stage identity. The trusted hook-spawn first-observation time must fall between dispatch and the deadline. Its first provenance-sensitive command must be `await-activation --stage ... --round ... --artifact ... --role ...`; before `running`, it must not snapshot, emit stage-started, write business files, or start commit. Only explicit `recover-prepared` may clear an expired orphan when the task fingerprint is exact and no matching unconsumed active lifecycle evidence remains.
 7. Codex uses SubagentStart/Stop and App Server actual evidence to activate, consume, and seal one receipt; trusted parent fallback must produce the same complete provenance. Timed-out waits do nothing. Advance only a sealed receipt and repeat step 4 only while running.
-8. Create a fresh child each round and never follow up with an old reviewer. Each requested/actual mismatch needs its own host fallback reason. Capability, hook, source, controller, build, identity, ledger, or fingerprint failure pauses and fails closed.
+8. Create a fresh child each round and never follow up with an old reviewer. Each requested/actual mismatch needs its own host fallback reason. Protocol, capability, receipt hook/evidence binding, source, controller, identity, ledger, or fingerprint failure pauses and fails closed; cross-root package/build/contract or hook/profile content drift is delivered as a warning instead of blocking natural evolution.
 9. On pause or completion, run the matching typed verification and report the structured endpoint.
 
 ## Stop

package/templates/.agents/skills/run-task/SKILL.zh-CN.md

@@ -7,16 +7,20 @@ description: >
 
 # 运行任务生命周期
 
+## 任务上下文解析
+
+入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。保留四个策略选项及其值，再调用 `agent-infra-internal task-context resolve {task-scope}`。解析失败时透传非零退出码，不自行扫描任务。内部 orchestration 协议仍使用位置 task ref。
+
 总控只编排，不直接执行任何阶段技能。执行前先读取 `.agents/rules/no-mid-flow-questions.md`、`.agents/rules/lifecycle-orchestration.md` 与 `reference/host-validation.md`。
 
 1. 解析规范任务 ID、当前 Agent Client，以及可选的原子策略 `--executor-model`、`--executor-reasoning-effort`、`--reviewer-model`、`--reviewer-reasoning-effort`，并执行 `agent-infra-internal task-snapshot {task-id} --format text`。任一显式策略字段出现时四个 role 字段必须完整，不得与配置拼接；两个角色可以使用同一模型。
-2. Codex 在 `begin-or-resume` 前选择宿主：没有 `AGENT_INFRA_CONTROL_TOKEN` 时使用 direct-host；有 task-bound control authority 但没有 `AGENT_INFRA_CODEX_CONTROLLER_CONTEXT` 时，只调用 `agent-infra-internal codex-sandbox-controller run`（转发完整显式策略）并等待其终态，外层不得创建 run、baseline 或 receipt；已有 context 时先调用 `verify-context`。controller 的 bootstrap、bundle、source/profile discovery 或 context 任一校验失败即停止。
+2. Codex 在 `begin-or-resume` 前选择宿主：没有 `AGENT_INFRA_CONTROL_TOKEN` 时使用 direct-host；有 task-bound control authority 但没有 `AGENT_INFRA_CODEX_CONTROLLER_CONTEXT` 时，只调用 `agent-infra-internal codex-sandbox-controller run`（转发完整显式策略）并等待其终态，外层不得创建 run、baseline 或 receipt；已有 context 时先调用 `verify-context`。protocol、task/controller/process、lease 或 source/profile discovery 校验失败即停止；package/build/contract 或 hook/profile 内容漂移只输出结构化 warning，并提示用户重建 sandbox。
 3. 调用 `agent-infra-internal task-orchestration {task-id} begin-or-resume --client {client}` 并转发完整显式策略。完全没有显式策略时由核心读取当前 client 的 `agentClients[].orchestration`；existing run 使用持久化策略。磁盘状态不符合当前完整结构时核心失败关闭且不改写；升级前必须完成或清空 active run。仅当核心返回 `ORCHESTRATION_MODEL_POLICY_REQUIRED` 时，先用 `agent-client model-selection` 展示 complete/partial/interactive-only 来源，再一次收集完整策略；未回答则不创建 run。若为 paused/completed，按结构化结果停止。
 4. 调用 `route` 并读取结构化结果。若返回 `completed`，立即运行 `agent-infra-internal task-verify {task-id} run-task.completed --format text` 并停止；仅当返回 `running` 且 `next` 非空时读取唯一 action、role、round、artifact、`requestedModel` 和 `requestedReasoningEffort`，不得自行推断。
 5. Codex 先调用一次 `agent-infra-internal codex-lifecycle capability-arm --task-id {task-id}`。该普通工具调用必须由当前 loop 的真实 PostToolUse 回写 attestation；把 route 返回的精确 model、effort 和 marker 中 token 一并传给 `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort} --capability-token {token}`。核心先校验精确的 model/effort、capability provenance 与 controller binding，再只读捕获快照、构造内存中的 prepared receipt，最后原子消费 token 并保存 prepared 状态，同时持久化 capability 的 session、turn、tool-use 来源。activation 再校验 spawn 与该来源属于同一 session/turn，且 spawn 使用独立的 tool-use。其他客户端直接调用同一 prepare（无 token）。任一失败不得创建 baseline、receipt 或 child。
 6. prepare 成功后，在调用 fresh 原生子 Agent 的紧邻前一步执行 `task-orchestration <task-ref> dispatch`，再显式覆盖 route 返回的 model/effort；只传短任务引用、skill 名、`--orchestrated` 与 stage/round/artifact/role。可信 hook-spawn 首次观察时间必须位于 dispatch 与 deadline 之间。child 的第一条 provenance-sensitive 命令必须是 `await-activation --stage ... --round ... --artifact ... --role ...`；返回 running 前禁止 snapshot、阶段 started、业务写入或 commit。超时由核心暂停；崩溃遗留 prepared receipt 只能在 exact workspace fingerprint、无匹配的未消费 active lifecycle evidence 且 deadline 已过时显式 `recover-prepared`。
 7. Codex 用 SubagentStart/Stop 与 App Server actual evidence 激活、消费并封存唯一 receipt；受信 parent fallback 仍必须形成相同的完整 provenance。timed-out wait 无动作；只有 empty turns 或协议 `inProgress` 可等待，malformed、身份/传输错误或异常 terminal 均暂停。子 Agent 返回后只对 sealed receipt 调用 `advance`；只有 `running` 才重复步骤 4。
-8. 每轮创建新 child；禁止 follow-up 复用 reviewer。actual model/effort 与 requested 不同时必须有各自的宿主降级理由。任何 capability、hook、source、controller、build、身份、账本或 fingerprint 异常都调用 `pause` 并失败关闭。
+8. 每轮创建新 child；禁止 follow-up 复用 reviewer。actual model/effort 与 requested 不同时必须有各自的宿主降级理由。protocol、capability、receipt 内 hook/evidence binding、source、controller、身份、账本或 fingerprint 异常都调用 `pause` 并失败关闭；跨根 package/build/contract 或 hook/profile 内容漂移按 warning 交付，不把自然演进差异当成硬失败。
 9. 完成或暂停后运行对应 typed verification，并把结构化 run 摘要、暂停原因、commit 终点或 clean completion evidence 告知用户。
 
 ## 停止

package/templates/.agents/skills/run-task/reference/host-validation.en.md

@@ -10,13 +10,13 @@ Before publishing support for a client, prove the lifecycle evidence chain with
 - Explicit requested model/effort reaches each executor/reviewer. A fallback of either field reports the corresponding actual value and its own non-empty reason.
   > claude-code exception: requested reasoning effort does not yet support per-role dispatch to executor/reviewer — `.claude/agents/{executor,reviewer}.md` is a repository-level shared singleton, and writing it per role would race across concurrent tasks. This client only needs to honestly record the actual model/actual reasoning effort observed in native Start/Stop host events (`delegationEvidence.actualReasoningEffort` is declared `spawn-ack`); when not observed it is recorded as missing, which is not treated as a fallback requiring its own reason and does not fail closed. This exception does not apply to any other client.
 - Candidate-checkout and packed-install behavior match, with model policy, receipts, and verification results auditable in `orchestration.json`.
-- Direct-host project/managed source and sandbox isolated-user source preserve the same build, contract, profile, and controller provenance through prepare/start/stop/consume.
+- Direct-host and sandbox controller hooks/profiles must come from trusted sources. Cross-root build/contract/profile content drift emits an actionable warning, while controller/task/process/lease and the receipt's hook/evidence binding remain identical through prepare/start/stop/consume.
 
 ## Validation Sequence
 
 1. Record client version, feature state, and launch command in a clean temporary repository.
 2. Start a fresh executor and reviewer, retaining redacted raw stdin and the structured run. Validate both native start/stop and the parent PostTool fallback; timed-out waits must do nothing. Never synthesize a field the host did not emit.
-3. Validate model/effort match paths, single and dual justified fallbacks, and fail-closed behavior for missing actual fields.
+3. Validate model/effort match paths, single and dual justified fallbacks, and fail-closed behavior for missing actual fields. Confirm package/build/contract or hook/profile content drift produces only an actionable warning telling the user to rebuild the sandbox.
 4. Validate the same commit from a candidate checkout and an `npm pack` install; record the tarball hash and results.
 5. Commit only redacted summaries and non-sensitive fixtures. Remove or replace tokens, user-specific absolute paths, transcript content, and credentials.
 6. For sandbox, run at least ten cold executor starts and ten cold reviewer starts. Record monotonic prepared, spawn-dispatch, SubagentStart, and activation-completed timestamps plus p50/p95/max. Enable only when max plus 20% fits the deadline and symlink/config/plugin/lease/context/build failure injection and terminal cleanup audits pass.

package/templates/.agents/skills/run-task/reference/host-validation.zh-CN.md

@@ -10,13 +10,13 @@
 - 显式 requested model/effort 能传给 executor/reviewer；宿主对任一字段回退时，事件能给出对应 actual 值与独立的非空 fallback reason。
   > claude-code 例外：requested reasoning effort 暂不支持按角色下发给 executor/reviewer——`.claude/agents/{executor,reviewer}.md` 是仓库级共享单例，动态写入存在跨任务竞态，解决该竞态超出本任务范围。该客户端只要求如实记录宿主原生 Start/Stop 事件中能观察到的 actual model/actual reasoning effort（`delegationEvidence.actualReasoningEffort` 声明为 `spawn-ack`）；观察不到时记录为缺失，不视为需要独立 fallback reason 的回退场景，也不构成 fail-closed 阻断。此例外不适用于其他客户端。
 - candidate checkout 与打包安装后的行为一致，且模型策略、receipt 与验证结果可从 `orchestration.json` 复核。
-- direct-host 的 project/managed source 与 sandbox controller 的 isolated-user source、build/contract/profile/controller digest 必须在 prepare/start/stop/consume 全链路一致。
+- direct-host 与 sandbox controller 使用的 hook/profile 必须来自受信来源；build/contract/profile 内容在跨根比较中允许漂移并输出可操作 warning，但 controller/task/process/lease 与 receipt 内 hook/evidence binding 仍须在 prepare/start/stop/consume 全链路一致。
 
 ## 验证顺序
 
 1. 在干净临时仓库记录客户端版本、feature 状态和启动命令。
 2. 分别启动 fresh executor 与 fresh reviewer，保存去敏后的原始 stdin 和结构化 run；同时验证原生 start/stop 与 parent PostTool fallback。timed-out wait 必须无动作；不得补写宿主未产生的字段。
-3. 分别验证 model/effort 的 requested/actual 一致路径、单项与双项有理由 fallback 路径，并确认缺 actual 字段会失败关闭。
+3. 分别验证 model/effort 的 requested/actual 一致路径、单项与双项有理由 fallback 路径，并确认缺 actual 字段会失败关闭；对 package/build/contract 或 hook/profile 内容漂移确认只产生可操作 warning，并提示用户重建 sandbox。
 4. 对同一 commit 执行 candidate checkout 与 `npm pack` 安装验证，记录 tarball 哈希和结果。
 5. 仅把去敏摘要与非敏感 fixture 纳入版本库；token、绝对用户路径、transcript 内容和凭证必须删除或替换。
 6. sandbox backend 另做至少 10 次 executor 与 10 次 reviewer 冷启动，记录 prepared、spawn dispatch、SubagentStart、activation completed 的单调时钟及 p50/p95/max；仅当 max 加 20% 余量不超过 deadline，并通过 symlink/config/plugin/lease/context/build 失败注入和终态清理审计时启用。