@lazyingart/agintiflow 0.20.178 → 0.20.181

package/docs/autonomous-artifact-pipelines.md

@@ -11,6 +11,7 @@ Each pipeline should create these project-local files or equivalents:
 - Task manifest: stable chunk IDs, source locations, dependencies, prompt/schema version, and output paths.
 - Schema and validator: the exact artifact shape plus semantic checks that define a promotable output.
 - Runners: writer, reviewer, repairer, monitor, merge, compile/export, and status commands.
+- Freshness markers: run IDs, heartbeats, log/status timestamps, and tmux markers that separate a current run from old scrollback.
 - Completion report: counts, first missing ID, failed/quarantined items, latest previews, final artifact paths, and resume commands.
 
 The target repository owns its schemas, prompts, chunk policy, and rendering code. AgInTiFlow owns the behavior: inspect, create missing scripts, run observable sessions, preserve valid work, validate, repair, compile, and report evidence.
@@ -27,10 +28,12 @@ The repairer runs independently of the writer. It can wake from status files, ha
 
 The monitor is gentle. It waits through healthy progress and provider limits, restarts only on hard evidence of stall or crash, and records each decision.
 
+When the monitor restarts a tmux worker, it should require a fresh run marker or updated heartbeat before judging the new run. Capturing a pane immediately after restart can include old failures; those lines are history unless they occur after the current marker or current log timestamp.
+
 ## Concurrency
 
 Parallelism is optional. When used, each worker needs deterministic shard ownership, separate logs, atomic writes, and no direct compile responsibility. Merge, promotion, compilation, publishing, and commits should be serialized unless the project already has a safe coordinator.
 
 ## Completion
 
-A run is complete only when the final artifact was built from the current manifest and the status report shows full coverage or intentional quarantine. A successful tmux pane, a page count, or a single preview file is not enough.
+A run is complete only when the final artifact was built from the current manifest and the status report shows full coverage or intentional quarantine. A successful tmux pane, stale scrollback, a page count, or a single preview file is not enough.

package/docs/self-healing-pipelines.md

@@ -14,10 +14,12 @@ Concurrency is a tool, not a product stance. AgInTiFlow should choose sequential
 
 Review and repair are separate from writing. A reviewer should detect missing source units, repeated filler, malformed structured data, source drift, and known quality failures, then produce candidate repairs or failed-only requests. A repairer should be able to run independently of the writer, wake from status files, run bounded passes, and exit without blocking healthy progress.
 
+Tmux evidence must be fresh. Tmux panes preserve old scrollback, so after a restart the agent should emit a unique run marker into the pane and durable log/status file, then verify output after that marker. If no marker exists, it must compare log mtimes, process PID/elapsed time, and status timestamps before claiming the current run is healthy. Old failures in scrollback are useful history, not proof that the restarted worker is still failing.
+
 ## Boundaries
 
 AgInTiFlow should not embed project-specific schemas in its core. A book writer, data pipeline, or build system owns its own validators and artifact layout. AgInTiFlow provides the reusable behavior: diagnose, preserve valid work, patch the local workflow, verify, build checkpoint artifacts, restart only affected sessions, and report exact resume commands.
 
 ## Verification
 
-After a repair, the agent should run syntax checks for changed scripts, perform a dry-run or bounded batch when safe, inspect counters and first-missing IDs, and keep unrelated tmux sessions running. If the same symptom repeats, the agent should improve the project workflow or a reusable AgInTiFlow skill instead of repeatedly sending manual nudges.
+After a repair, the agent should run syntax checks for changed scripts, perform a dry-run or bounded batch when safe, inspect counters, first-missing IDs, fresh run markers, and timestamps, and keep unrelated tmux sessions running. If the same symptom repeats, the agent should improve the project workflow or a reusable AgInTiFlow skill instead of repeatedly sending manual nudges.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.178",
+  "version": "0.20.181",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",
@@ -91,7 +91,7 @@
   "scripts": {
     "start": "node run.js",
     "web": "node web.js",
-    "check": "node --check run.js && node --check web.js && node --check bin/aginti-cli.js && node --check src/*.js && node --check src/mcp/*.js && node --check public/app.js && node --check scripts/seed-supervised-homework.js && node --check scripts/smoke-mcp.js && node --check scripts/smoke-web-ui.js && node --check scripts/fixtures/mcp-stdio-smoke-server.mjs",
+    "check": "node --check run.js && node --check web.js && node --check bin/aginti-cli.js && node --check src/*.js && node --check src/mcp/*.js && node --check public/app.js && node --check scripts/seed-supervised-homework.js && node --check scripts/smoke-mcp.js && node --check scripts/smoke-web-ui.js && node --check scripts/smoke-scs-evidence-visibility.js && node --check scripts/fixtures/mcp-stdio-smoke-server.mjs",
     "setup:toolchain-docker": "scripts/setup-agent-toolchain-docker.sh",
     "smoke:coding-tools": "node scripts/smoke-coding-tools.js",
     "smoke:dynamic-step-budget": "node scripts/smoke-dynamic-step-budget.js",
@@ -102,6 +102,7 @@
     "smoke:cli-chat": "node scripts/smoke-cli-chat.js",
     "smoke:docker-command": "node scripts/smoke-docker-command.js",
     "smoke:skills": "node scripts/smoke-skills.js",
+    "smoke:scs-evidence": "node scripts/smoke-scs-evidence-visibility.js",
     "smoke:skillmesh": "node scripts/smoke-skillmesh.js",
     "smoke:toolchain-docker": "node scripts/smoke-toolchain-docker.js",
     "smoke:inbox": "node scripts/smoke-inbox.js",

package/references/aginti-generalization-audit-2026-05-20.md

@@ -0,0 +1,66 @@
+# AgInTiFlow Generalization Audit
+
+Date: 2026-05-20
+
+## Scope
+
+This audit checks whether the core AgInTiFlow runtime learned a general problem-solving capability, or whether it accidentally hard-coded a project-specific browser workflow.
+
+Reviewed areas:
+
+- SCS controller and evidence gates
+- Engineering guidance and dynamic step budget
+- Built-in skills and project-local skill loading
+- Smoke tests that protect browser workflows, upload contracts, and SCS validation
+
+## Findings
+
+AgInTiFlow core should stay task-independent. It may know that browser work often needs page-state reconciliation, scoped selectors, attachment verification, model/duration verification, submit evidence, and external blocker handling. It should not know a private platform name, a private repository name, a private character set, a fixed prompt, or fixed asset filenames.
+
+The useful general capability is:
+
+- derive a task contract from the user's request
+- preserve exact input paths and forbidden actions
+- reject plans that invent unrequested uploads or skipped UI actions
+- require concrete browser, visual, filesystem, or command evidence before finish
+- route failed finish claims back to a validator/replan loop
+- load narrow project-local skills from `.aginti/skills/<skill-id>/SKILL.md`
+
+## Remediation
+
+Project-specific browser/video terms were removed from core heuristics and smoke fixtures. Generic Chinese and English browser workflow terms remain because they apply across websites.
+
+Kept in core:
+
+- generic browser composer guidance
+- generic upload/asset-library/reference-media verification
+- generic model, mode, duration, and submit-state verification
+- generic external blocker handling such as login, captcha, credits, permission, server error, or user confirmation
+- project-local skill loading and skill-creation workflow
+
+Moved out of core:
+
+- private platform names
+- private repository names
+- private asset filenames
+- private character names
+- task-specific model branding examples
+
+## Design Rule
+
+If a future task requires special UI labels, account behavior, reference media, or platform-specific workarounds, create or update a project-local skill. Only promote a rule into AgInTiFlow core when the rule applies to a broad class of tasks such as browser form submission, book generation, LaTeX compilation, translation, testing, or deployment.
+
+## Verification
+
+Commands run:
+
+```bash
+npm run check
+npm run smoke:model-roles
+node scripts/smoke-skills.js
+node scripts/smoke-dynamic-step-budget.js
+node scripts/smoke-coding-tools.js
+rg -n --hidden --glob '!node_modules/**' --glob '!.git/**' --glob '!dist/**' --glob '!coverage/**' 'xiaoyunque|小云雀|xyq|jianying|LALACHAN|啦啦|拉拉|阿芽|飒飒|Seedance|沉浸式短片|Trio\.png|display\.png|R1\.jpg|patchwork-leather|duanpian' .
+```
+
+Result: checks passed, and the repository search found no remaining private workflow terms in AgInTiFlow runtime code, tests, or general references after excluding this audit's own search expression.

package/references/codex-session-cross-references.md

@@ -40,30 +40,30 @@ AgInTiFlow relevance:
 - AgInTiFlow must not own or silently mutate AAPS-selected project, workflow,
   program, block, or working file.
 
-### LALACHAN Browser And AgInTi Supervision Source Session
+### Browser Automation And AgInTi Supervision Source Session
 
 - Session: `019dc795-e538-75b2-8a03-bc103b32985d`
-- Status context shown by Codex: `~/ProjectsLFS/LALACHAN`
-- Primary repo involved: `/home/lachlan/ProjectsLFS/LALACHAN`
+- Status context shown by Codex: a project-local media/browser workflow repo
+- Primary repo involved: project-local, outside AgInTiFlow core
 - Related AgInTiFlow repo: `/home/lachlan/ProjectsLFS/Agent/AgInTiFlow`
 - Role: failure-source and product-requirement session.
 
-This session started from LALACHAN/Xiaoyunque browser video workflows and exposed
-a general AgInTiFlow weakness: the executor could claim progress or completion
+This session started from a project-local browser video workflow and exposed a
+general AgInTiFlow weakness: the executor could claim progress or completion
 without enough evidence that the requested browser state, upload state, selected
 mode, selected model, prompt, reference media, or generated artifact actually
 existed.
 
 Important lesson from this session:
 
-- Do not hard-code Xiaoyunque-specific rules into AgInTiFlow core.
+- Do not hard-code project-specific browser workflow rules into AgInTiFlow core.
 - Keep domain details in project-local skills such as `.aginti/skills/<id>/SKILL.md`.
 - Improve the core agent harness instead: task contract, monitor, evidence ledger,
   validator gate, replan loop, and real blocker reporting.
 
 Project-local skill produced from this direction:
 
-- `/home/lachlan/ProjectsLFS/LALACHAN/.aginti/skills/xiaoyunque-video-browser/SKILL.md`
+- `.aginti/skills/<project-browser-workflow>/SKILL.md` in the task repository
 
 ### ZhJpBook And AgInTiFlow Implementation Session
 
@@ -76,7 +76,7 @@ Project-local skill produced from this direction:
 This session used a long bilingual book pipeline to stress AgInTiFlow's ability
 to run durable, evidence-based work: source conversion, chunking, DeepSeek JSON
 writing, validation, monitoring, PDF compilation, artifact handling, and recovery.
-The same core principle from the LALACHAN session was then implemented in
+The same core principle from the browser workflow session was then implemented in
 AgInTiFlow.
 
 Relevant AgInTiFlow commits:
@@ -127,7 +127,7 @@ These sessions should be read together:
 - Agent Meta-AAPS supplies the cross-repo bridge: AAPS borrows useful
   AgInTiFlow interaction patterns while keeping AAPS as the state and semantics
   owner.
-- LALACHAN supplies the concrete failure mode: browser automation and media tasks
+- The browser workflow session supplies the concrete failure mode: browser automation and media tasks
   can look successful while the visible external state is wrong or unverified.
 - ZhJpBook supplies the long-running pipeline pressure: the agent must keep
   moving through scripts, monitors, validators, and artifacts without accepting

package/scripts/smoke-coding-tools.js

@@ -448,7 +448,7 @@ try {
   assert(hostLocalhostJsonProbePolicy.allowed, "host localhost JSON probe should not require full-host destructive access");
   assert(hostLocalhostJsonProbePolicy.category === "network-fetch", "host localhost JSON probe should stay classified as network-fetch");
   const absolutePythonHelperPolicy = evaluateCommandPolicy(
-    "/home/lachlan/miniconda3/bin/python scripts/xyq_cdp_browser.py list-pages",
+    "/home/lachlan/miniconda3/bin/python scripts/browser_cdp_helper.py list-pages",
     hostWorkspacePolicy
   );
   assert(absolutePythonHelperPolicy.allowed, "host absolute Python helper script should be allowed without full-host destructive access");

package/scripts/smoke-dynamic-step-budget.js

@@ -7,6 +7,7 @@ import { runAgent } from "../src/agent-runner.js";
 import { resolveRuntimeConfig } from "../src/config.js";
 import {
   browserSubmitFinishIssue,
+  isRecoverableShellToolResult,
   isSuspiciousBroadBrowserToolResult,
   shouldActivateScs,
   shouldReviewToolResult,
@@ -85,6 +86,29 @@ try {
     shouldReviewToolResult(broadBrowserClick, { meta: {} }),
     "SCS should review suspicious broad browser click results"
   );
+  const blockedSecretProbe = {
+    toolName: "run_command",
+    blocked: true,
+    args: { command: "env | grep API_KEY" },
+    reason: "Command is blocked because it references secrets or credential files.",
+  };
+  assert(isRecoverableShellToolResult(blockedSecretProbe), "SCS should classify blocked secret probes as recoverable shell results");
+  assert(
+    !shouldReviewToolResult(blockedSecretProbe, { meta: {} }),
+    "SCS should not derail the phase for a safely blocked credential probe"
+  );
+  const malformedReadOnlyCheck = {
+    toolName: "run_command",
+    ok: false,
+    exitCode: 2,
+    args: { command: "for f in *.pdf; do python3 -c 'print(\"oops\")'" },
+    stderr: "/bin/bash: -c: line 9: syntax error: unexpected end of file",
+  };
+  assert(isRecoverableShellToolResult(malformedReadOnlyCheck), "SCS should classify shell quoting mistakes as recoverable");
+  assert(
+    !shouldReviewToolResult(malformedReadOnlyCheck, { meta: {} }),
+    "SCS should let the normal agent loop repair simple shell quoting mistakes"
+  );
   assert(
     !isSuspiciousBroadBrowserToolResult({
       toolName: "run_command",
@@ -96,19 +120,19 @@ try {
   );
   assert(
     recommendedMaxStepsForTask({
-      goal: "Use Chrome CDP to upload five images, select an asset-library video, choose non-VIP model, and submit the Xiaoyunque browser composer.",
+      goal: "Use Chrome CDP to upload five images, select an asset-library video, choose the requested non-premium model tier, and submit the browser composer.",
     }) >= 48,
     "browser submit workflows need a larger default step budget"
   );
   assert(
     browserSubmitFinishIssue(
-      "小云雀网页上传五张图，从资产库选择参考视频，然后提交生成",
-      "资产库旧三人视频 未执行；提交 未执行；步骤不足。"
+      "网页创作器上传五张图，从素材库选择参考视频，然后提交生成",
+      "素材库参考视频 未执行；提交 未执行；步骤不足。"
     ),
     "SCS finish gate should reject unfinished browser submit reports"
   );
   assert(
-    !browserSubmitFinishIssue("小云雀网页提交生成", "停止：积分不足，需要用户处理 credits not enough。"),
+    !browserSubmitFinishIssue("网页创作器提交生成", "停止：积分不足，需要用户处理 credits not enough。"),
     "SCS finish gate should allow real external browser blockers"
   );
 

package/scripts/smoke-model-roles.js

@@ -11,7 +11,13 @@ import {
 } from "../src/model-routing.js";
 import { normalizeTextToolCallResponse, parseTextToolCalls, usesTextToolProtocol } from "../src/model-client.js";
 import { modelRoleChoices, selectorVisibleWindow } from "../src/interactive-cli.js";
-import { buildScsEvidencePack, buildSupervisorInstruction, reviewScsFinish, shouldRequestScsReplan } from "../src/scs-controller.js";
+import {
+  buildScsEvidencePack,
+  buildSupervisorInstruction,
+  deterministicPlanActionContradiction,
+  reviewScsFinish,
+  shouldRequestScsReplan,
+} from "../src/scs-controller.js";
 import { buildScsEvidenceLedger, deriveScsTaskContract, evaluateScsEvidence } from "../src/scs-evidence.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -249,9 +255,28 @@ assert(scsEvidence.includes("evidenceLedger"), "SCS evidence pack should include
 assert(scsEvidence.includes("evaluation"), "SCS evidence pack should include deterministic contract evaluation");
 
 const uploadContract = deriveScsTaskContract({
-  goal: "Upload five images in the browser composer and verify visible thumbnails. Do not submit.",
+  goal:
+    "Upload five images in the browser composer and verify visible thumbnails: /tmp/reference-a.png /tmp/reference-b.png /tmp/reference-c.png. Do not submit.",
   taskProfile: "website",
 });
+assert(
+  uploadContract.exactInputPaths.includes("/tmp/reference-a.png") &&
+    uploadContract.exactInputPaths.includes("/tmp/reference-b.png") &&
+    uploadContract.exactInputPaths.includes("/tmp/reference-c.png"),
+  "SCS contract should preserve exact input/reference paths for browser upload tasks"
+);
+const uploadImagePlanContradiction = deterministicPlanActionContradiction(
+  "Find the latest .mp4 in the project, upload the video file, then click submit.",
+  uploadContract
+);
+assert(
+  /video-file upload/i.test(uploadImagePlanContradiction || ""),
+  "SCS deterministic plan gate should reject invented video-file uploads for image-upload tasks"
+);
+assert(
+  !deterministicPlanActionContradiction("Upload the five images, verify thumbnails, and do not submit.", uploadContract),
+  "SCS deterministic plan gate should allow matching image-upload plans"
+);
 assert(uploadContract.requiresExternalEvidence, "browser upload contract should require external evidence");
 assert(
   uploadContract.requiredEvidence.some((item) => item.category === "browser"),
@@ -272,7 +297,7 @@ const weakUploadLedger = buildScsEvidenceLedger({
           toolName: "run_command",
           ok: true,
           exitCode: 0,
-          args: { command: "scripts/cdp-helper set-file-input PAGE_ID display.png R1.jpg" },
+          args: { command: "scripts/cdp-helper set-file-input PAGE_ID reference-a.png reference-b.jpg" },
           stdout: '{"ok":true,"nodeCount":1}',
         }),
       },
@@ -292,7 +317,7 @@ const strongUploadLedger = buildScsEvidenceLedger({
           toolName: "run_command",
           ok: true,
           exitCode: 0,
-          args: { command: "scripts/cdp-helper upload-images-verify PAGE_ID display.png R1.jpg --screenshot outputs/upload.png" },
+          args: { command: "scripts/cdp-helper upload-images-verify PAGE_ID reference-a.png reference-b.jpg --screenshot outputs/upload.png" },
           stdout: '{"ok":true,"visibleEvidenceCount":5,"screenshot":"outputs/upload.png"}',
         }),
       },
@@ -365,6 +390,42 @@ const jsonObjectContract = deriveScsTaskContract({
 const virtualFileContract = deriveScsTaskContract({
   goal: "Create file: /workspace/virtual-output.txt with virtual Docker path support.",
 });
+const outputListContract = deriveScsTaskContract({
+  goal: [
+    "Create:",
+    "- `work/demo/generate_items.py`",
+    "- `work/demo/review_items.py`",
+    "",
+    "Validate with `work/demo/validate_items.py` before promoting output.",
+    "Do not treat `work/demo/existing_validator.py` as an output artifact.",
+    "",
+    "Output structure:",
+    "- `build/demo/primary/color/book.pdf`",
+    "- `build/demo/secondary/color/book.pdf`",
+    "",
+    "Each generated item file goes to:",
+    "`data/demo/items/{item_id}.json`",
+  ].join("\n"),
+  taskProfile: "code",
+});
+const manyOutputContract = deriveScsTaskContract({
+  goal: [
+    "Required outputs:",
+    "- `out/a01.json`",
+    "- `out/a02.json`",
+    "- `out/a03.json`",
+    "- `out/a04.json`",
+    "- `out/a05.json`",
+    "- `out/a06.json`",
+    "- `out/a07.json`",
+    "- `out/a08.json`",
+    "- `out/a09.json`",
+    "- `out/a10.json`",
+    "- `out/a11.json`",
+    "- `out/a12.json`",
+  ].join("\n"),
+  taskProfile: "code",
+});
 const generatedReviewContract = deriveScsTaskContract({
   goal: [
     "Review focus: changed files only",
@@ -398,6 +459,23 @@ assert(
     !virtualFileContract.requiredEvidence.some((item) => item.category === "artifact"),
   "virtual output filename should require file evidence without treating output in the filename as an artifact"
 );
+assert(
+  outputListContract.exactOutputPaths.includes("work/demo/generate_items.py") &&
+    outputListContract.exactOutputPaths.includes("work/demo/review_items.py") &&
+    outputListContract.exactOutputPaths.includes("build/demo/primary/color/book.pdf") &&
+    outputListContract.exactOutputPaths.includes("build/demo/secondary/color/book.pdf"),
+  "SCS should infer exact outputs from Create/Output structure list sections"
+);
+assert(
+  !outputListContract.exactOutputPaths.includes("work/demo/validate_items.py") &&
+    !outputListContract.exactOutputPaths.includes("work/demo/existing_validator.py") &&
+    !outputListContract.exactOutputPaths.some((item) => item.includes("{item_id}")),
+  "SCS should not treat validator/tool paths or templated paths as exact output artifacts"
+);
+assert(
+  manyOutputContract.exactOutputPaths.length === 12 && manyOutputContract.exactOutputPaths.includes("out/a12.json"),
+  "SCS should preserve more than eight exact output paths for multi-artifact tasks"
+);
 assert(
   generatedReviewContract.requiredEvidence.some((item) => item.category === "command") &&
     !generatedReviewContract.requiredEvidence.some((item) => item.category === "file") &&

package/scripts/smoke-permission-modes.js

@@ -114,6 +114,11 @@ async function main() {
   assert(dangerAbsoluteMkdir.trustedDangerOverride === true, "danger absolute host path should be explicit override");
   const dangerPublish = evaluateCommandPolicy("npm publish", danger);
   assert(dangerPublish.allowed === false, "danger should still block hard publish/token guardrails");
+  const workspaceCdSecretProbe = evaluateCommandPolicy(
+    `cd ${workspace} && env | grep -i 'deepseek\\\\|API_KEY' | head -5; echo "EXIT:$?"`,
+    danger
+  );
+  assert(workspaceCdSecretProbe.allowed === false, "workspace-root cd must not bypass secret command guardrails");
   const outsidePath = path.join(tempRoot, "outside-danger.txt");
   const dangerOutside = await executeWorkspaceTool("write_file", { path: outsidePath, content: "danger outside ok" }, danger);
   assert(dangerOutside.ok === true, "danger should allow outside workspace file write");

package/scripts/smoke-skills.js

@@ -66,7 +66,7 @@ assert(
   ),
   "browser automation prompt did not select browser-automation"
 );
-assert(selectedIds("小云雀 网页 上传 五张图 从资产库选择视频 提交").includes("browser-automation"), "Chinese XYQ prompt did not select browser-automation");
+assert(selectedIds("网页表单 上传 五张图 从素材库选择视频 提交").includes("browser-automation"), "Chinese browser prompt did not select browser-automation");
 assert(selectedIds("write a LaTeX paper and compile a PDF").includes("latex-manuscript"), "latex prompt did not select latex-manuscript");
 assert(selectedIds("edit a Microsoft Word docx and preserve the original").includes("word-documents"), "docx prompt did not select word-documents");
 assert(selectedIds("generate a logo image with grsai nanobanana").includes("image-generation"), "image prompt did not select image-generation");

package/scripts/smoke-tmux-tools.js

@@ -83,6 +83,13 @@ try {
   const destructive = checkTmuxToolUse("tmux_send_keys", { target: start.target, text: "rm -rf /" }, config);
   assert.equal(destructive.allowed, false, "tmux guardrail did not block destructive text");
 
+  const workspaceRelativeCleanup = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-cleanup`, cwd: ".", command: "rm -f logs/task.status && echo cleaned" },
+    config,
+  });
+  assert.equal(workspaceRelativeCleanup.allowed, true, "Host danger tmux should allow workspace-relative cleanup commands");
+
   const outsidePath = path.join(os.tmpdir(), "agintiflow-outside-workspace-canary.txt");
   const workspacePath = path.join(workspace, "inside-workspace.txt");
   const dockerTmuxOutsideStart = checkToolUse({
@@ -249,6 +256,7 @@ try {
           "list-sessions",
           "secret-guardrail",
           "destructive-guardrail",
+          "host-danger-workspace-cleanup-allowed",
           "docker-tmux-start-outside-path-guardrail",
           "docker-tmux-send-outside-path-guardrail",
           "docker-tmux-start-project-path-allowed",

package/skills/autonomous-artifact-pipeline/SKILL.md

@@ -38,7 +38,8 @@ Before launching long work, create or identify a project-local contract:
 3. Task manifest: stable chunk IDs, source location, dependency order, prompt/schema version, and output paths.
 4. Artifact schema: JSON Schema or other validator-owned shape for each generated unit.
 5. Runners: resumable writer, reviewer, repairer, monitor, merge, compile/export, and status commands.
-6. Completion evidence: counters, first missing item, failed IDs, current previews, final artifact paths, and resume commands.
+6. Freshness evidence: runner IDs, heartbeats, log timestamps, status file mtimes, and tmux markers that separate current output from old scrollback.
+7. Completion evidence: counters, first missing item, failed IDs, current previews, final artifact paths, and resume commands.
 
 Project-specific schemas, prompts, layouts, and compilers belong in the target repository. AgInTiFlow provides the orchestration pattern and should generate or patch local scripts when they are missing.
 
@@ -50,6 +51,7 @@ Project-specific schemas, prompts, layouts, and compilers belong in the target r
 - Use isolated structured-data calls for repetitive JSON units. Keep prompts focused on the chunk, schema, source references, and validation errors.
 - Add deterministic canonicalizers before model retry when failures are representational, such as punctuation normalization, stable token splitting, missing metadata backfill, schema version migration, or renderer-specific wrapping. Do not spend provider calls on repairs a local script can prove.
 - Run writers in tmux or another observable background process. Each worker must have disjoint claims, atomic output writes, and shard-local logs.
+- When restarting a tmux worker, print a unique run marker and write the same marker to its log or status file. A pane capture that only shows old scrollback is not proof of current progress.
 - Keep review and repair asynchronous but safe. Reviewers may produce candidate fixes while writers continue; only validators or merge scripts promote candidates.
 - Compile or export checkpoint previews after successful merge batches and always at final completion.
 - Commit reusable scripts, manifests, validators, templates, and stable checkpoints when the project expects git tracking.
@@ -68,4 +70,4 @@ A robust pipeline has an independent repair path that is not blocked by the main
 
 ## Done Criteria
 
-Do not call the task complete until the final artifact was built from the current manifest and the status report shows complete or intentionally quarantined coverage. A partial PDF, stale page count, or successful worker log is not enough.
+Do not call the task complete until the final artifact was built from the current manifest and the status report shows complete or intentionally quarantined coverage. A partial PDF, stale page count, old tmux scrollback, or successful worker log is not enough.

package/skills/bilingual-interlinear-book/SKILL.md

@@ -1,17 +1,19 @@
 ---
 id: bilingual-interlinear-book
-label: Bilingual Interlinear Book Pipeline
-description: Build Chinese/Japanese or other paired-language pocket books with Markdown extraction, chunk manifests, ruby/pinyin JSON, grammar roles, monitoring, and LaTeX PDF outputs.
+label: Multilingual Annotated Book Pipeline
+description: Build paired-language, interlinear, or annotated books from source documents using ingestion, stable task chunks, schema-bound annotations, review loops, and compiled outputs.
 triggers:
   - interlinear
   - bilingual book
+  - multilingual book
   - paired language
+  - annotated book
+  - parallel text
+  - ruby
   - furigana
   - pinyin
-  - ruby
   - xelatex
   - pocket book
-  - grammar roles
 tools:
   - read_file
   - write_file
@@ -19,35 +21,49 @@ tools:
   - tmux_start_session
   - tmux_capture_pane
 ---
-# Bilingual Interlinear Book Pipeline
+# Multilingual Annotated Book Pipeline
+
+Use this skill when the user asks AgInTi to create a book-like artifact that combines a main text with translations, glosses, commentary, readings, grammar labels, or other aligned annotations.
+
+This is a general workflow skill. It must not hard-code a specific book, language pair, schema, layout, filename, page size, or house style. If the target repository contains a project-local skill under `.aginti/skills/<id>/SKILL.md`, prefer that skill for domain-specific rules.
 
-Use this skill when the task asks for a paired-language book, ruby/furigana/pinyin, Chinese/Japanese interlinear layout, grammar-role color, or pocket-size LaTeX output.
+## Workflow
 
-## Required Workflow
+1. Inspect repository instructions, existing scripts, source folders, build folders, ignored paths, and project-local skills before editing.
+2. Inventory sources and create or update a source manifest with path, hash, declared language, observed language/script, role, extraction method, and caveats. Keep original source media untouched unless the user explicitly asks otherwise.
+3. Convert inputs into durable intermediate text first. Use the source-ingestion workflow for PDF, EPUB, image, scan, archive, JSON/wiki, or mixed input folders.
+4. Audit every reference source before using it as translation evidence. A file name, website title, or declared language is not enough. Sample actual text and classify whether it is real target-language prose, source-language text hosted on a target-language site, machine/OCR noise, commentary, glossary, or metadata. Prompts must state this reliability classification.
+5. Split cleaned text into stable paragraph-, section-, page-, or chapter-scoped tasks with persistent IDs. Record source spans so chunks can be regenerated, reused, reviewed, or mapped after later split changes.
+6. Define the project schema in the target repository. Use the structured JSON workflow for repetitive annotation or alignment output, with focused prompts and provider-native JSON/schema modes when available.
+7. Keep writer, validator, reviewer, repairer, monitor, merge, compile/export, and final-report roles separate. Writers produce candidates; validators promote; reviewers request fixes; monitors observe progress and restart only affected work.
+8. Make all workers resumable. Use shard-local outputs, atomic promotion, status files, logs, retry/backoff for provider limits, and exact resume commands.
+9. Never overwrite a valid reviewed artifact unless the source hash, schema version, prompt version, or validator version proves it is stale. Quarantine invalid outputs instead of deleting useful work.
+10. Compile or export previews periodically and final variants at the end. Variant names and directions belong to the project schema or local skill, not this built-in skill.
+11. Verify final artifacts externally: manifest coverage, valid/reviewed counts, missing/stale/failed items, output paths, metadata, and representative visual checks for PDFs or images.
 
-1. Inspect repository instructions, existing scripts, book plans, and ignored paths before editing.
-2. Keep original PDFs/EPUBs in source folders and do not commit large source media unless the repository explicitly tracks them.
-3. Convert source books to durable Markdown first. Treat PDF, EPUB, image, JSON/wiki, and scanned sources as ingestion problems; create a source manifest with hashes, method, role, language, and caveats before generation. Keep raw and cleaned Markdown separate when OCR or EPUB extraction is noisy.
-4. Split cleaned Markdown into stable paragraph- or chapter-scoped chunks with `manifest.json` and `chunks.jsonl`. Use source paragraph IDs that survive reruns. If a paragraph is too large for reliable provider output, split it into ordered subchunks at sentence or clause boundaries while preserving the original source order and recording `split_from_chunk_id`, `split_part`, and `split_part_count`.
-5. When retuning chunk size or repairing split logic, merge any existing `split_from_chunk_id` groups back to the original paragraph text first, then split again. Do not repeatedly split already-split parts, and do not discard valid reviewed chunks unless validation proves they no longer match the manifest.
-6. Write resumable per-chunk JSON artifacts. Never overwrite a valid reviewed chunk unless a validator or prompt version requires regeneration; move stale chunks out of the compile path.
-7. Generate or repair annotations with a provider worker loop, not a monolithic prompt. Each chunk should validate independently before promotion. If JSON is malformed or validation fails, retry the chunk with the exact validator errors before marking it failed. Use the structured JSON workflow for repetitive chunk output.
-8. Keep writer, reviewer, repairer, monitor, merge, and compile roles explicit. Writers produce candidates; validators promote; reviewers check semantic quality and request fixes; repairers handle failed-only or quarantined chunks; monitors observe and resume gently.
-9. Compile preview PDFs periodically and at the end. For paired-language books, compile both directions when renderers exist, plus color and blackwhite variants when color is supported.
-10. Run long jobs in observable tmux sessions with status files, logs, retry/backoff for provider limits, and clear resume commands.
+## Annotation Rules
 
-## JSON Quality Gates
+Keep annotation policies project-defined:
 
-Every promoted chunk must preserve source text exactly. Chinese Hanzi tokens are one character each with pinyin. Japanese kanji tokens are one character each with furigana. Nontrivial Japanese lines must use normal mixed kanji/kana, not kana-only placeholders.
+- Token shape, reading placement, grammar tags, and alignment granularity must come from the project schema.
+- For scripts that need per-character readings, validators should enforce that locally instead of relying on a prompt.
+- Placeholder translations, empty commentary, duplicated readings, copied modern paraphrases, or source drift should be detected by validators or reviewers.
+- Translation/reference quality gates must be derived from the project schema, language profile, and source audit. Do not bake one book's vocabulary, source names, or forbidden-token list into this built-in skill or AgInTiFlow core.
+- If a reference is unreliable for the requested target language, do not feed it to the writer as trusted translation. Either omit it, label it clearly as alignment/source-only context, or ask the project to supply a reliable reference.
+- Color, typography, page size, table of contents, cover design, and exact PDF variants belong in project renderers.
 
-For classical Chinese texts, bracketed notes such as `〈 ... 〉`, inline commentary, variant readings, and punctuation are source text. They must be included in the Chinese token stream and must not be silently skipped as "comments".
+## Orchestration Pattern
 
-Chunk boundaries must not create malformed note syntax. Avoid putting a leading close marker such as `〉` at the start of a subchunk; attach it to the previous subchunk so the writer sees balanced source context.
+For long books, the interactive AgInTiFlow session should own the project orchestration:
 
-For dense classical texts that require one-token-per-Hanzi plus Japanese glosses, start with provider-safe subchunks around 120-160 source characters. If outputs become malformed near provider token limits, retune smaller immediately instead of repeatedly retrying oversized chunks.
+- write or update the project scripts, schemas, prompts, validators, reviewers, monitors, and compilers
+- start writer/reviewer/monitor tmux sessions itself
+- use non-interactive model/API workers only inside those project scripts
+- observe progress, patch the scripts when logs show repeatable failure, and resume from stable chunk IDs
+- commit meaningful project changes when the repository expects git tracking
 
-For grammar coloring, assign `g` using only: `subject`, `predicate`, `object`, `attributive`, `adverbial`, `complement`, `topic`, `function`. Color PDFs depend on these fields: every Chinese Hanzi token and every Japanese kanji token should carry `g`. Blackwhite builds should force all grammar colors to black through the renderer, not by deleting `g`.
+The chat agent should not manually become the chunk writer. If supervised by another agent, provide evidence and ask the interactive session to repair the project.
 
 ## Completion Evidence
 
-Report chunk totals, valid/reviewed count, failed or stale count, first missing chunk, latest PDF paths, and the exact resume command. Verify PDFs exist on disk and that generated TeX contains grammar color macros for color builds. Commit tracked scripts, templates, plans, and stable JSON checkpoints after meaningful edits.
+Report the current manifest total, valid/promoted count, reviewed count, failed or quarantined count, first missing ID, latest artifact paths, compile/export commands, and the exact command to resume generation. Do not claim completion from a model summary alone; check the files and outputs directly.

package/skills/self-healing-pipeline/SKILL.md

@@ -39,6 +39,8 @@ Use this skill when a project has a durable worker, writer, reviewer, monitor, q
 ## Repair Pattern
 
 - Patch project-owned scripts, prompts, validators, or monitors only after the logs identify a repeatable failure.
+- Patch at the right layer. If a failure is caused by task-specific source semantics, schema, prompt, validator, or output conventions, fix the project script or project-local skill. If it is caused by a reusable pipeline capability gap, improve a built-in skill or task profile. If it is caused by runtime/tool/session/SCS behavior, improve AgInTiFlow core.
+- Avoid hard-coded one-case repairs. Prefer data-driven project configuration, language/source profiles, schema versions, prompt versions, validator versions, and manifest evidence so the same pipeline can be reused and backfixed cleanly.
 - Prefer small resumability upgrades: `--failed-only`, bounded retry passes, stale-claim cleanup, atomic writes, checkpoint status, idempotent compile commands, and clear resume commands.
 - Keep writer/reviewer/monitor responsibilities separate. The writer should produce and validate; the reviewer should repair quality; the monitor should observe, compile, restart, or queue the next bounded run.
 - Make monitors gentle: wait on healthy progress, restart only after explicit stop/stall/error evidence, and write a durable decision log.
@@ -58,13 +60,26 @@ Parallel and async designs are optional implementation patterns, not a default p
 - If a worker stalls on one bad chunk, it should mark the chunk failed and continue its shard. Failed-only repair passes should be bounded and observable.
 - When increasing concurrency, check provider quota/rate-limit behavior. If rate limits appear, reduce worker count or add backoff rather than letting every worker retry aggressively.
 
+## Interactive Supervisor Pattern
+
+When AgInTiFlow is the project orchestrator, it should run as an interactive tmux session that writes and updates the project runner scripts, then starts separate non-interactive tmux jobs for writers, reviewers, monitors, compilers, and repair passes. The interactive session remains responsible for reading logs, changing project code, restarting affected jobs, and committing progress. Background workers should not edit orchestrator code unless explicitly designed as a companion repairer with clear write scope and logs.
+
+## Fresh Tmux Evidence
+
+Tmux panes keep old scrollback. After stopping or restarting a worker, do not treat a later pane capture as current evidence unless it includes a fresh run marker, heartbeat, log timestamp, PID, or progress line produced after the restart.
+
+- Prefer starting each runner with a unique marker such as `RUN_ID=$(date -u +%Y%m%dT%H%M%SZ)-$$; echo "AGINTI_RUN_START:$RUN_ID"` and write the same marker to the durable log or status file.
+- If safe for the pane, clear the screen/history before a restart, but still rely on the marker or log timestamp as the proof boundary.
+- When a capture contains both old failures and new progress, judge only the lines after the current marker. If no marker exists, inspect the durable log mtime, process PID/elapsed time, and status file before accepting the run as healthy.
+- Do not call a background pipeline repaired or complete immediately after sending a restart command. Capture fresh output after a short wait or verify a status/log update from the restarted process.
+
 ## Verification And Resume
 
 After a repair:
 
 1. Run syntax checks for changed scripts.
 2. Run a dry-run or small bounded batch when safe.
-3. Verify status counters, first missing item, failed IDs, and output timestamps.
+3. Verify status counters, first missing item, failed IDs, output timestamps, and fresh run markers after any tmux restart.
 4. Restart only the affected tmux session, not unrelated jobs.
 5. Compile or export a checkpoint artifact when the pipeline has a renderer or build command.
 6. Record the exact resume command, current status, logs inspected, remaining failed items, and any quarantined artifacts.

package/skills/structured-json/SKILL.md

@@ -38,10 +38,12 @@ Use this skill when the user needs reliable JSON that follows an explicit schema
 - On validation failure, retry with the exact schema errors and only the smallest relevant source text.
 - For batch work, write candidate JSON per chunk first; promote it only after schema and semantic validators pass.
 - Keep schema versions in the artifact metadata so old reviewed outputs can be reused or selectively regenerated when prompts change.
+- Keep prompt versions and validator versions in or near the artifact metadata. When quality rules change, backfix only artifacts made stale by that change instead of restarting the whole corpus.
 - Before retrying the provider, classify whether the failure is semantic or mechanical. Use local canonicalization for deterministic fixes such as token splitting, punctuation restoration from source text, missing default fields, role aliases, or renderer wrappers.
 
 ## Boundaries
 
 - Do not pass shell, browser, file policy, package-install, or agent-planning context into the JSON specialist.
 - Do not make schemas book-, app-, or project-specific inside AgInTiFlow core. Project schemas belong in the target repository.
+- Do not hard-code source-specific semantic rules in this skill. If JSON quality requires language-specific or corpus-specific checks, make them part of the project schema, project validator, or project-local skill and record the version.
 - Do not let parallel JSON workers share one mutable output file. Use shard-local outputs, atomic renames, and a serialized merge/promote step.