@logicseek/hello-cc 1.1.0-rc.1 → 1.1.0-rc.4

package/docs/dsh.md

@@ -8,7 +8,7 @@ The tested runtime is `@deepseek-ai/dsh@0.2.0-rc.2`, with matching plugin versio
 
 Supported hosts are Linux and macOS; on Windows use WSL. Native Windows shells are not supported. Device acceptance must be recorded separately from container verification.
 
-The source and real DeepSeek model acceptance are complete locally; no new npm release has been published. Use this checkout's CLI when testing:
+This integration has been included since hello-cc 1.0.2 on the normal npm `latest` channel. With Node.js 24+, install it using `npm install -g @logicseek/hello-cc`. To test a source checkout instead, use:
 
 ```bash
 node /absolute/path/to/hello-cc/bin/hcc.mjs --root /path/to/project dsh setup --mode cordis
@@ -18,6 +18,8 @@ node /absolute/path/to/hello-cc/bin/hcc.mjs --root /path/to/project dsh web -- -
 
 Below, `hcc` means a CLI containing these changes. An older global installation may not include them.
 
+macOS 1.0.5 upgrades use a stable boot-session identity. Follow the [process identity migration notes](macos-process-identity.md) and restart owned runtimes normally.
+
 ## Choose An Entry Point
 
 | Entry | Use | Lifecycle owner |
@@ -113,7 +115,7 @@ Project overlays work directly from source. The managed manifest records the Cor
 
 ```bash
 npm pack --ignore-scripts
-dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.1.tgz
+dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.5.tgz
 ```
 
 Harness requires explicit approval for native dependency builds. If add returns `ERR_PNPM_IGNORED_BUILDS`, merge the following into the selected profile's `pnpm-workspace.yaml` and rerun the same add command. The default path is `~/.dsh/profiles/web/pnpm-workspace.yaml`; use the configured DSH_HOME when different. Preserve existing settings and approve only the candidate's pinned native dependency:
@@ -123,7 +125,7 @@ allowBuilds:
   node-pty@1.2.0-beta.15: true
 ```
 
-Harness selects bundles through the profile's `dsh.profile.bundles`; do not also load the project Cordis/hooks overlay. Actual npm installation, official add/repeated add/remove, profile resolution and real-model collaboration calls have passed. The actual macOS desktop profile was installed and hot-loaded on 2026-10-02. Its paired ACP worker completed real collaboration calls using the existing DeepSeek route. The initially configured desktop sub2api model returned HTTP 403 because that account only accepts official Codex clients. After the desktop default was observed to have changed to official DeepSeek, a new session completed hcc_state, hcc_message_send and a real completed turn with that existing selection. The original sub2api route restriction remains. npm publication was not performed. Harness manages profile package removal; project-overlay integration is disabled with `setup --mode off`.
+Harness selects bundles through the profile's `dsh.profile.bundles`; do not also load the project Cordis/hooks overlay. Actual npm installation, official add/repeated add/remove, profile resolution and real-model collaboration calls have passed. The actual macOS desktop profile was installed and hot-loaded on 2026-10-02. Its paired ACP worker completed real collaboration calls using the existing DeepSeek route. The initially configured desktop sub2api model returned HTTP 403 because that account only accepts official Codex clients. After the desktop default was observed to have changed to official DeepSeek, a new session completed hcc_state, hcc_message_send and a real completed turn with that existing selection. The original sub2api route restriction remains. Maintenance releases use the normal npm latest channel. Harness manages profile package removal; project-overlay integration is disabled with `setup --mode off`.
 
 See Cordis/native acceptance (source checkout: `docs/verification/2026-10-02-dsh-cordis-native.md`), bridge acceptance (source checkout: `docs/verification/2026-10-02-dsh-official-bridge.md`), and the integration plan (source checkout: `docs/plans/2026-10-02-dsh-integration.md`). Real-model checks used temporary projects and owned processes, without replacing existing user sessions. The isolated order fixture passed artifact/evidence/handoff/lock-release/task-completion checks. See the Mac device receipt (source checkout: `docs/verification/2026-10-02-dsh-device-install.md`). Publication, deployment, other-device installation and genuine business acceptance remain separate delivery stages.
 

package/docs/dsh.zh-CN.md

@@ -8,7 +8,7 @@ DeepSeek Harness（`dsh`）可以与 Claude Code、Codex 共用 hello-cc 的项
 
 支持 Linux 和 macOS；Windows 使用 WSL，不支持原生 Windows shell。容器验证与实际设备验收分别记录。
 
-代码已在本地实现并做真实 DeepSeek 模型验收，尚未发布新的 npm 版本。验证源码时，用本仓库的 CLI：
+此接入自 hello-cc 1.0.2 起提供，沿用 npm 的 latest 标签。在 Node.js 24+ 环境执行 `npm install -g @logicseek/hello-cc` 安装。验证源码时，用本仓库的 CLI：
 
 ```bash
 node /absolute/path/to/hello-cc/bin/hcc.mjs --root /path/to/project dsh setup --mode cordis
@@ -18,6 +18,8 @@ node /absolute/path/to/hello-cc/bin/hcc.mjs --root /path/to/project dsh web -- -
 
 下文 `hcc` 指包含这些代码的 CLI。已有的全局 `hcc` 未必包含此接入。
 
+macOS 从 1.0.5 起使用稳定的启动周期标记。升级时按[进程身份迁移说明](macos-process-identity.md)正常重启所管理的运行时，保留身份无法比较的旧进程。
+
 ## 选择入口
 
 | 入口 | 适用场景 | 会话由谁持有 |
@@ -115,7 +117,7 @@ hcc native start --peer dsh-reviewer --provider dsh --binary /absolute/path/to/d
 
 ```bash
 npm pack --ignore-scripts
-dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.1.tgz
+dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.5.tgz
 ```
 
 Harness 的 pnpm 策略要求明确允许原生依赖构建。若首次 add 返回 `ERR_PNPM_IGNORED_BUILDS`，在所选 profile 的 `pnpm-workspace.yaml` 中合并以下配置，然后重跑同一 add 命令；默认位置是 `~/.dsh/profiles/web/pnpm-workspace.yaml`，自定义 DSH_HOME 时以该目录为准。保留文件中已有设置，只批准候选包使用的固定版本：
@@ -125,9 +127,9 @@ allowBuilds:
   node-pty@1.2.0-beta.15: true
 ```
 
-安装后由 Harness profile 的 `dsh.profile.bundles` 选择包；不要再同时加载项目 Cordis/hooks overlay。bundle 已通过实际 npm 安装、官方 add/重复 add/remove、隔离 profile 加载和真实模型工具调用。2026-10-02 已安装到本机真实 desktop profile 并热加载，配套 ACP 使用既有 DeepSeek 路由完成真实工具调用；初次桌面 sub2api 模型返回账户仅允许 Codex 官方客户端的 403；随后桌面默认模型已变为官方 DeepSeek，沿用当时配置的新建会话完成 hcc_state、hcc_message_send 和真实 completed 回合。原 sub2api 路由限制仍存在。npm 尚未发布。profile 插件安装/移除由 Harness 管理，项目 overlay 则使用 `setup --mode off` 关闭。
+安装后由 Harness profile 的 `dsh.profile.bundles` 选择包；不要再同时加载项目 Cordis/hooks overlay。bundle 已通过实际 npm 安装、官方 add/重复 add/remove、隔离 profile 加载和真实模型工具调用。2026-10-02 已安装到本机真实 desktop profile 并热加载，配套 ACP 使用既有 DeepSeek 路由完成真实工具调用；初次桌面 sub2api 模型返回账户仅允许 Codex 官方客户端的 403；随后桌面默认模型已变为官方 DeepSeek，沿用当时配置的新建会话完成 hcc_state、hcc_message_send 和真实 completed 回合。原 sub2api 路由限制仍存在。后续维护版本沿用 npm latest 标签发布。profile 插件安装/移除由 Harness 管理，项目 overlay 则使用 `setup --mode off` 关闭。
 
-验证记录见 Cordis/native 验收 (源码目录: `docs/verification/2026-10-02-dsh-cordis-native.md`)、兼容桥记录 (源码目录: `docs/verification/2026-10-02-dsh-official-bridge.md`) 和详细接入计划 (源码目录: `docs/plans/2026-10-02-dsh-integration.md`)。真实模型验收在临时项目和自有进程中完成；既有会话与模型凭据保留；本机实际安装记录见 Mac 接入验收 (源码目录: `docs/verification/2026-10-02-dsh-device-install.md`)。尚未发布/部署，也没有跨设备验收或真实业务签收；隔离订单样例已完成报告、证据、交接、解锁与任务结束验证。
+验证记录见 Cordis/native 验收 (源码目录: `docs/verification/2026-10-02-dsh-cordis-native.md`)、兼容桥记录 (源码目录: `docs/verification/2026-10-02-dsh-official-bridge.md`) 和详细接入计划 (源码目录: `docs/plans/2026-10-02-dsh-integration.md`)。真实模型验收在临时项目和自有进程中完成；既有会话与模型凭据保留；本机实际安装记录见 Mac 接入验收 (源码目录: `docs/verification/2026-10-02-dsh-device-install.md`)。Linux 容器已验证，实际 WSL/员工设备和真实业务签收尚未完成；隔离订单样例已完成报告、证据、交接、解锁与任务结束验证。
 
 可用下面的安装验收脚本重现 npm 安装、官方 `plugin add` / 重复 add / remove，以及安装后的公共 CLI。`--run-live` 会沿用已有 DeepSeek 认证，验证 ACP 权限拒绝和一个隔离订单汇总任务；没有该参数时不调用真实模型。脚本只使用本次创建的 HOME、DSH_HOME、项目和进程。
 

package/docs/macos-process-identity.md

@@ -0,0 +1,15 @@
+# macOS 进程身份与升级
+
+macOS 的 `kern.boottime` 是墙上时钟时间，同一次开机期间也可能因时钟校正改变。以它的秒、微秒字段识别进程，会把仍在运行的进程误判为新实例。
+
+Darwin 身份改为 `darwin:<kern.bootsessionuuid>:<UTC/C ps lstart>`。开机 UUID 严格验证并统一小写；缺失、查询失败或格式错误时返回 `unknown`，不会退回 `kern.boottime`。进程开始时间仍前后读取两次，状态中的 zombie 仍视为已退出。PID、进程开始时间和命令摘要的所有权校验没有放宽。
+
+旧版本保存的 `<boot 秒>:<boot 微秒>:<ps lstart>` 无法可靠转换成新标记。对同一存活 PID，旧、新格式之间返回 `unknown`，既不授予所有权，也不证明旧进程已经退出。其 runtime 指针不因超过普通未知状态宽限期而被回收；Cordis 恢复和 native 启动也必须保留仍存活的旧 owner。与真实进程退出或同格式 PID 复用有关的判定保持原有规则。
+
+这种专用 `unknown` 同样保留 peer/binding、过期锁和缓冲文件，阻止过期任务被接管；它不会赋予 `live` 身份、续租或写权限。普通未知状态的超时策略不变。
+
+早期 Web 工作台候选使用过 `mac:<boot UUID>:<ps lstart>` 前缀。它与正式的 `darwin:` 格式交叉比较时同样保留为 `unknown`，不因前缀变化回收仍存活的候选进程；需要由原版本正常关闭后再启动新版本。
+
+升级前，先用原版本正常关闭所属 native worker/runtime，正常退出 Harness Desktop，再安装并启动新版本，使运行中的 owner 重新建立身份。保留账号配置、会话与协作数据库；不要手工改写旧身份、删除仍存活 runtime 的指针，或仅凭 PID 强行接管。若旧进程已经退出，OS 的死亡证据仍允许正常恢复。没有完整身份的其他未知状态继续使用原有策略。
+
+回归覆盖同一次开机期间 `kern.boottime` 漂移、不同 boot UUID、错误和缺失 UUID、PATH 缺失时的固定系统路径、语言环境、PID 复用、exec、真实自有 zombie，以及跨格式 runtime 指针、native 启动和 Cordis 恢复边界。

package/docs/native.md

@@ -16,6 +16,41 @@ multiple pending inbox messages into the same turn. ACP resume and session close
 depend on the extensions the provider advertises. HCC does not claim that an ACP
 resume replays the original conversation transcript.
 
+## Session fork and retries with the original ID
+
+`hcc native fork --parent codex-reviewer --peer codex-branch` invokes the provider's
+session fork. Codex uses `thread/fork`; Claude uses the optional SDK's
+`forkSession`. The child receives a distinct session ID, executor, delivery records
+and subsequent history, plus its own MCP scope when the sandbox permits HCC tools.
+The parent keeps its identity. After
+closing the child, `native start --peer codex-branch --provider codex --resume
+last` resumes the child session. Fork inherits the parent's working directory
+and verifies its identity; pending inbox messages and permission grants are not
+copied.
+
+Only saved HCC-owned native sessions can fork. The parent must be idle or
+explicitly closed, without an active turn, pending approval, queued message or
+unresolved delivery. Parent send, close and inbox dispatch are fenced while
+forking. Existing TUI/Desktop sessions are outside this scope. A Claude SDK
+without `forkSession` reports unsupported capability. DeepSeek Harness
+0.2.0-rc.2 ACP does not implement fork; HCC does not replay a transcript to
+simulate native fork.
+
+A new message may use a unique `--submission-id` containing 8–100 letters,
+digits, underscores or hyphens. After a lost receipt, inspect `native
+deliveries`, then retry the same worker, sender, task and body with the original
+ID. Matching retries return the original durable receipt; changed payloads or
+targets are rejected. The project database commits the message and submission
+ID together. If the native delivery projection was not yet saved, retry or
+worker recovery repairs the original delivery while retaining local user
+origin. Retrying an existing `uncertain` delivery does not replay execution.
+
+Web offers **Retry same submission** for an unconfirmed send. Explicit
+confirmation follows receipt inspection, and the retry must retain the original
+executor and body. Later draft edits are preserved. Executor or project changes
+disable the old retry. Missing durable pending records or expired messages are
+rejected rather than sent as new work.
+
 ## Requirements
 
 Use Node.js 24 or later and a provider installed and authenticated in the same
@@ -54,6 +89,49 @@ real Web approval receipt (source checkout: `docs/verification/2026-10-02-native
 exercises this default project lookup without injecting a query function. It
 does not verify a published package or an employee installation.
 
+## Start from Web
+
+Run `hcc web`, select the project, and choose **New Agent**. Codex, Claude and
+DeepSeek Harness default to **Background Agent**, which creates a native worker
+and starts or reuses the project's independent native runtime. You do not need
+to run `hcc native start` first; the provider requirements above still apply.
+
+**Settings** can save the project default provider plus a model and an in-project
+working directory for each provider. **New Agent** prefills these values; when no
+directory is configured it uses the project root. The worker continues to share the selected
+project's HCC task and message bus. Select or add another project to work outside
+that root. **Model (optional)** can stay empty to use the provider's configured
+default; any supplied value must be supported by that provider. **Name (optional)**
+can stay empty for a generated peer name.
+
+These defaults live in the selected HCC project database and apply only to future
+Web native creations. They do not change running workers, history resume, CLI
+launches or provider account files. Concurrent saves use revision checks; reload
+and review the latest values after a conflict. Clearing the model in the creation
+form explicitly chooses the provider's own default for that one worker.
+
+**New Agent** creates a new native session. **History → HCC retained history**
+browses saved native workers and explicitly resumes workers recorded as closed.
+Resume keeps the peer and provider session ID, rechecks ownership, and starts a
+new executor. CLI resume remains available. **Advanced options** keeps the terminal
+CLI and Codex App Server paths, including their existing history controls. Shell
+uses a terminal; DeepSeek Harness uses a background worker.
+
+After creation, send prompts and inspect receipts or approvals in the same Web
+session. Creating a worker does not by itself complete a model task. Closing
+the page or stopping Web preserves the independent native runtime and worker;
+explicitly close the worker when it is no longer needed. The dated acceptance
+records below do not establish real-model or release acceptance of this new
+creation or history/resume entries. See the [Web guide](web-handoff.zh-CN.md).
+
+The **Files** entry browses saved project files and artifacts without creating a
+worker or sending file contents to a model. It provides bounded text, Markdown,
+image, PDF and static HTML previews. Explicit uploads create new project files
+without replacing existing names (up to 10 MiB); complete UTF-8 text files can be
+edited and saved with a revision check (up to 1 MiB). Conflicts and uncertain write
+results keep the draft for inspection. These actions do not attach files to a model
+conversation. See the [project file guide](web-handoff.zh-CN.md#上传与编辑项目文件).
+
 ## CLI
 
 Run commands from the project you want the workers to share, or select it with
@@ -78,12 +156,56 @@ message bus even when `--cwd DIR` selects another working directory. `--model
 MODEL` selects a provider-supported model. `--binary PATH` overrides the Codex
 or dsh executable. Claude uses the SDK and rejects `--binary`.
 
+### Codex read-only file sandbox
+
+```sh
+hcc native start --peer codex-readonly --provider codex --sandbox read-only
+hcc native close --peer codex-readonly
+hcc native start --peer codex-readonly --provider codex --resume last
+```
+
+Only Codex accepts `--sandbox read-only|workspace-write`. New sessions default to
+the existing `workspace-write` behavior. Resume inherits the stored policy when
+omitted and rejects a different explicit policy; use a new worker for a different
+policy. Legacy saved Codex workers migrate to their original workspace-write mode.
+Retries before a session exists inherit the selected policy unless explicitly changed. Before
+creating/resuming a Codex worker, both CLI and Web require the runtime's sandbox-policy
+protocol version. It refuses an older daemon before sending a create request and
+does not restart it automatically. Creation is bound to the just-verified runtime
+generation; a missing identity or instance replacement rejects the request without
+following the successor or retrying. After existing project work finishes, stop the
+old runtime and start it with this version. Older runtime code cannot enforce the
+new stored policy; downgrade execution is outside this read-only guarantee.
+Web can still inspect or close a legacy worker, but refuses Codex send/respond
+when its fresh snapshot has no sandbox policy. Read-only workers must also report
+provider verification before those actions. Web mutations are bound to the runtime
+generation observed immediately before admission.
+
+Read-only fixes approval policy to `never`, requests `readOnly` and disabled
+sandbox network for each new turn, and denies command/file/permission escalation
+and MCP elicitation. Ordinary user questions remain available. Start/resume fail
+closed if the provider does not report the requested policy, or if a resumed
+thread already has an active turn. Forks require the same checks. `sandboxVerified` means matching provider
+readback, not independent proof of operating-system enforcement.
+
+HCC does not inject its scoped mutation MCP or command instructions into a
+read-only worker. Its control plane still records messages, replies, delivery
+receipts and audit events. The provider file sandbox does not make every external
+service, user-configured MCP server or hook read-only; strict acceptance still
+needs a private HOME without external tools. This policy is separate from the Web
+viewer/control lease: a controller may still submit a review to a read-only worker.
+
+Available since `1.1.0-rc.4`. Native Web snapshots retain `sandbox` and
+`sandboxVerified`. Choose the read-only policy with the CLI. Native forks inherit the saved parent
+policy and cannot override it; the child is independently verified before use.
+
 | Command | Options / behavior |
 | --- | --- |
 | `hcc native up` | Start or reuse the project's background runtime |
 | `hcc native status` | Inspect persisted worker state and runtime identity |
-| `hcc native start` | Required `--peer NAME --provider codex\|claude\|dsh`; optional `--cwd DIR --model MODEL --resume last`; `--binary PATH` is available only for Codex and dsh |
-| `hcc native send` | Required `--peer NAME --body TEXT`; optional `--from NAME --task ID`; returns a durable message/submission receipt |
+| `hcc native start` | Required `--peer NAME --provider codex\|claude\|dsh`; optional `--cwd DIR --model MODEL --resume last`; `--binary PATH` is available only for Codex and dsh; `--sandbox read-only\|workspace-write` is Codex-only |
+| `hcc native fork` | Required `--parent NAME --peer NEW_NAME`; optional `--model MODEL --binary PATH`; forks an HCC-owned Codex or Claude session into a new worker |
+| `hcc native send` | Required `--peer NAME --body TEXT`; optional `--from NAME --task ID --submission-id ID`; returns a durable message/submission receipt |
 | `hcc native deliveries` | Optional `--peer NAME`; inspect delivery receipts |
 | `hcc native events` | Required `--peer NAME`; optional `--after ID`; inspect a bounded event history |
 | `hcc native requests` | Requires `--peer NAME`; inspect pending requests bound to this executor, session and turn |
@@ -153,6 +275,13 @@ it does not attach to an existing live TUI or desktop instance. HCC cannot prove
 that an external application has independently opened the same saved session,
 so do not open the same conversation concurrently outside the owned runtime.
 
+New saved workers also retain the filesystem identity of their working
+directory. Resume requires that identity to still match, even if the path
+spelling is unchanged. Older workers without that evidence remain readable in
+HCC history but are not automatically resumable; manual review and association
+are not yet implemented. Web history marks these records as unavailable before
+the native service rechecks at admission.
+
 Native workers receive a worker-specific `HCC_ROOT`, `HCC_DB`, `HCC_PEER`, and
 `HCC_NATIVE_OWNER`. A provider hook must match the peer's native transport owner.
 Its native hook path only heartbeats that owner and renews its locks. It does
@@ -224,10 +353,14 @@ explicitly. Truncated requests can only be declined or cancelled. Nested schemas
 
 - Existing Codex/Claude/dsh terminal sessions remain on their original transport;
   attaching to or taking over an existing TUI/Desktop session is not implemented.
-- Web discovers existing native workers in the same project and exposes messages,
-  delivery receipts, interruption, and explicit closure. Closing the page or Web
-  runtime preserves the independent native worker. Human responses are bound to
-  the current executor and turn. See the [Web handoff guide](web-handoff.zh-CN.md).
+- Web can create Codex, Claude and dsh native workers, and discovers existing
+  workers in the same project. It exposes messages, delivery receipts,
+  interruption, and explicit closure. History reads retained project events and
+  explicitly resumes closed workers; it is not the provider's complete transcript.
+  Active workers and workers without confirmed closure cannot resume from this
+  entry. Closing the page or Web runtime
+  preserves the independent native worker. Human responses are bound to the
+  current executor and turn. See the [Web handoff guide](web-handoff.zh-CN.md).
 - Codex, Claude and dsh native workers receive project- and peer-scoped HCC MCP
   configuration. Writes still require provider permission and HCC ownership checks.
 - Provider-internal `SendMessage`, subagent/team discovery, and Codex delegation
@@ -367,3 +500,40 @@ Legacy deliveries retain peer origin during migration. This distinction does
 not grant tool permissions: writes and other gated tools still require approval.
 For delegated file work, first authorize the receiving agent's bounded task,
 then send the peer handoff.
+
+## Bounded stability acceptance
+
+Add `--stability` to installed-package acceptance to run sustained work after
+its lifecycle and cross-provider checks:
+
+```sh
+node /absolute/path/to/acceptance-prefix/node_modules/@logicseek/hello-cc/scripts/native-installed-acceptance.mjs \
+  --run-live --codex-bin /absolute/path/to/codex --dsh-bin /absolute/path/to/dsh \
+  --archive /absolute/path/to/hello-cc.tgz --stability \
+  --stability-cycles 6 --stability-burst 2 --stability-idle-ms 30000 \
+  --stability-resume-every 2 --output /absolute/path/to/stability-receipt.json
+```
+
+All three providers work concurrently. Each worker receives its whole burst
+before the driver waits. Each reply must recall the original random marker
+and the previous ticket from history, checking FIFO execution and retained
+context. Duplicate submission IDs must yield exactly one reply and ACK.
+Periodic worker close/resume and one normal owned-daemon restart preserve the
+original sessions. Idle observation checks the control endpoint, pending
+requests and identity. The final audit checks persisted deliveries, database
+integrity, bounded event retention and absence of reply loops. Receipts retain
+actual replies, failure state and owned-process memory samples. Failed work is
+not replayed automatically or reclassified as successful after a retry.
+
+Defaults are six cycles, two queued messages per worker per cycle, 30 seconds
+of idle observation per cycle, and worker resume every two cycles. Limits are
+1–24 cycles, 1–4 messages, 0–300000 idle milliseconds and a 1–24 cycle resume
+interval. These options require `--stability`. This is bounded authenticated
+work, not a 24-hour soak, capacity benchmark or proof of no memory leak. A
+successful DSH resume alone does not explain earlier context fluctuations.
+
+`--stability-only` requires `--stability`. It bootstraps three real sessions and
+runs stability work while skipping the baseline interruption, command approval
+and model MCP communication scenarios. The receipt records this scope; skipped
+scenarios require separate evidence. On any failure, the driver captures current
+session snapshots, recent deliveries and events before closing owned workers.

package/docs/native.zh-CN.md

@@ -14,6 +14,34 @@ Native 模式运行由 HCC 创建并持有的后台 worker。共享 peer、任
 不代表 host 会把多条待处理消息塞进同一个 turn。ACP 的 resume 和 session close
 取决于 provider 声明的扩展；不能把 ACP resume 等同于重放原始会话历史。
 
+## 会话 fork 与原 ID 重试
+
+`hcc native fork --parent codex-reviewer --peer codex-branch` 使用 provider 自身的
+会话 fork。Codex 通过 `thread/fork`，Claude 通过可选 SDK 的 `forkSession` 创建
+新的会话 ID；子 worker 有独立 executor、消息投递记录和后续历史，策略允许 HCC
+工具时也有独立 MCP scope。
+父会话仍保留原身份；关闭子 worker 后可用 `native start --peer codex-branch
+--provider codex --resume last` 恢复子会话。fork 继承父会话的工作目录，并复核目录
+身份，不复制父 worker 的未决 inbox 或权限批准。
+
+只能 fork HCC 持有且保存了会话 ID 的 native worker。父 worker 必须空闲或已明确
+关闭，无活动 turn、待审批请求、排队或结果不明的投递；fork 期间暂停父 worker
+的发送、关闭和 inbox 分发。已有 TUI/Desktop 会话不在此范围内。Claude SDK
+缺少 `forkSession` 时明确报不支持。DeepSeek Harness 0.2.0-rc.2 的 ACP 实现未提供
+fork；HCC 不用 transcript 重放冒充原生 fork。
+
+每条新消息可指定唯一的 `--submission-id`，格式为 8–100 个英文字母、数字、下划线
+或连字符。遇到回执丢失时先查 `native deliveries`，然后对同一 worker、sender、task
+和正文沿用原 ID 重试。相同 ID 返回原持久回执，正文或目标变化会被拒绝。项目
+数据库同时保存消息和 submission ID；若消息已提交而 native 投递记录尚未写入，
+重试或 worker 恢复会补齐原记录，保留用户请求来源。已有 `uncertain` 投递不会
+因为重试被自动重放。
+
+Web 遇到未确认提交时提供“沿用原提交重试”。此操作需核对持久回执后明确确认，
+并保持原执行器身份与原正文；之后编辑的草稿会保留。执行器或项目变化时禁用原
+提交重试。没有匹配的持久 pending 记录、或原消息已被清理时拒绝重试；不会把
+原 ID 当作新工作发送。
+
 ## 环境准备
 
 需要 Node.js 24 或更新版本，并在运行 HCC 的同一环境中安装、登录对应 provider。
@@ -48,6 +76,38 @@ npm install --no-save --package-lock=false @anthropic-ai/claude-agent-sdk@0.3.28
 已有独立回执 (源码目录: `docs/verification/2026-10-02-native-web-claude-default-sdk.json`)，不代表
 发布包或员工设备已完成安装验收。
 
+## 从 Web 新建
+
+运行 `hcc web`，选择项目，再点击“新建 Agent”。Codex、Claude 和 DeepSeek Harness
+默认使用“后台 Agent”，创建 native worker 并按需启动或复用该项目的独立 native
+runtime。无需先运行 `hcc native start`；上述 provider 安装和认证要求仍然适用。
+
+顶部“设置”可保存项目默认 provider，以及各 provider 的默认模型和项目内工作目录。
+新建表单会预填这些值；未设置工作目录时使用项目根目录。worker 继续共享所选项目的
+HCC 任务和消息总线。要在根目录之外工作，先选择或添加相应项目。“模型（可选）”
+留空时使用 provider 当前配置，填写时需使用该 provider 支持的模型值；“名称（可选）”
+留空时自动生成 peer 名称。
+
+这些默认值只用于后续 Web 新建 native worker，不改变既有 worker、恢复或 CLI 启动。
+配置由项目数据库保存，跨浏览器读取；并发保存发生冲突时需重新载入核对。详情见
+[项目启动默认值](web-handoff.zh-CN.md#项目-agent-启动默认值)。
+
+“新建 Agent”创建新 native 会话；项目栏“历史”中的“HCC 保留历史”可查看已保存的
+worker，并显式恢复已关闭的 worker。恢复保留原 peer 和 provider 会话 ID，重新核对
+所有权后启动新执行器。CLI resume 继续可用。“高级选项”保留终端 CLI、Codex App
+Server 及各自原有的历史恢复操作。Shell 使用终端，DeepSeek Harness 使用后台 worker。
+
+创建后在同一 Web 会话内发送提示、查看投递回执或处理审批。创建 worker 不代表模型
+任务已经完成。关闭页面或停止 Web 都保留独立 native runtime 和 worker；不再需要时
+明确关闭 worker。下方带日期的既有验收记录不代表这个新建入口已通过真实模型或发布
+验收。详细操作见 [Web 指南](web-handoff.zh-CN.md)。
+
+顶部“文件”可浏览项目文件与生成产物，也可显式上传新文件（最大 10 MiB）或编辑完整
+UTF-8 文本（最大 1 MiB），无需创建 worker。同名上传不覆盖，文本保存会检查版本；
+冲突或回执不确定时保留草稿。这些操作不会把文件发送给模型。详情见
+[文件与产物预览](web-handoff.zh-CN.md#浏览文件与产物)及
+[上传与编辑](web-handoff.zh-CN.md#上传与编辑项目文件)。
+
 ## CLI 使用
 
 在需要共享状态的项目目录中运行，或使用已有全局 `--root`、`--db` 指定项目和数据库。
@@ -71,12 +131,50 @@ hcc msg inbox --peer coordinator
 `--binary PATH` 覆盖 Codex 或 dsh 可执行文件。Claude 使用 SDK，传入 `--binary`
 会直接报错。
 
+### Codex 文件只读沙箱
+
+```sh
+hcc native start --peer codex-readonly --provider codex --sandbox read-only
+# 关闭后恢复原会话时继承已保存的策略；不要改成 workspace-write。
+hcc native close --peer codex-readonly
+hcc native start --peer codex-readonly --provider codex --resume last
+```
+
+`--sandbox` 仅支持 Codex 的 `read-only` 和 `workspace-write`。新会话未指定时保持
+`workspace-write`；恢复时未指定则继承存储策略，显式不同的策略会被拒绝，需要另建
+worker。旧版本记录迁移为原有 `workspace-write` 行为；无权限推断或自动升级。
+首次初始化尚未建立会话时，重试默认继承已选择策略，也可显式更改。CLI 与 Web 创建／恢复 Codex worker
+前检查后台服务的沙箱协议版本；旧服务不支持时在发送创建请求前拒绝，不自动重启。
+创建请求绑定刚核实的 runtime generation；期间实例被替换或身份缺失时拒绝发送，
+不会跟随新实例自动重试。
+应等项目任务结束后由用户停止旧 runtime，再以新版本启动。不要用旧版本 runtime
+读取新版本只读记录：旧代码不了解该策略，回退执行不属于只读保障。
+Web 仍可查看或关闭旧 worker；其最新快照不含沙箱策略时，拒绝 Codex 发送和回答审批／问题。
+只读 worker 还必须回报 provider 已校验策略，才能执行这两类操作。Web 写请求绑定准入前
+刚读取的 runtime generation，不会自动跟随替换实例。
+
+只读模式固定 `approvalPolicy: never`，每个新 turn 显式请求 `readOnly`、关闭沙箱网络，
+拒绝命令／文件／权限提升和 MCP 授权表单；普通用户问题仍可回答。启动／恢复要求
+provider 回报相符策略，否则关闭自有连接并报错；fork 子会话执行相同校验。已有活动 turn 的只读恢复也拒绝，
+不能用新策略为正在执行的旧 turn 作保证。`sandboxVerified` 仅表示 provider 回报匹配，
+不是一份操作系统行为证明。
+
+HCC 不为只读 worker 注入自有的任务／锁／结果写操作 MCP，也不提示模型执行 HCC
+写命令。HCC 控制面仍保存消息、回复、投递和审计。Codex 的文件沙箱不等于所有外部
+服务或用户配置的 MCP／hooks 都只读；严格隔离验收仍须独立 HOME、无外部工具。
+它也不同于网页“观察／控制”权限：控制者仍可向只读 worker 发送审阅请求。
+
+此功能自 `1.1.0-rc.4` 起提供。Web 的 native 快照会保留 `sandbox` 与 `sandboxVerified`。
+请通过 CLI 选择只读策略。
+原生 fork 继承父会话的持久化策略，不能覆盖或提升；子会话启用前会独立校验。
+
 | 命令 | 参数与作用 |
 | --- | --- |
 | `hcc native up` | 启动或复用本项目后台 runtime |
 | `hcc native status` | 查看持久化 worker 状态和 runtime 身份 |
-| `hcc native start` | 必须 `--peer NAME --provider codex\|claude\|dsh`；可选 `--cwd DIR --model MODEL --resume last`；`--binary PATH` 仅适用于 Codex 和 dsh |
-| `hcc native send` | 必须 `--peer NAME --body TEXT`；可选 `--from NAME --task ID`；返回持久消息/submission 回执 |
+| `hcc native start` | 必须 `--peer NAME --provider codex\|claude\|dsh`；可选 `--cwd DIR --model MODEL --resume last`；`--binary PATH` 仅适用于 Codex 和 dsh；`--sandbox read-only\|workspace-write` 仅适用于 Codex |
+| `hcc native fork` | 必须 `--parent NAME --peer NEW_NAME`；可选 `--model MODEL --binary PATH`；复制 HCC 持有的 Codex 或 Claude 会话到新 worker |
+| `hcc native send` | 必须 `--peer NAME --body TEXT`；可选 `--from NAME --task ID --submission-id ID`；返回持久消息/submission 回执 |
 | `hcc native deliveries` | 可选 `--peer NAME`，查看投递回执 |
 | `hcc native events` | 必须 `--peer NAME`；可选 `--after ID`，查看有界事件历史 |
 | `hcc native requests` | 必须 `--peer NAME`；查看与该执行器、会话、turn 绑定的待处理请求 |
@@ -135,6 +233,11 @@ hcc native start --peer codex-reviewer --provider codex --resume last
 的连接恢复会话历史，不是附着已有的活动 TUI 或桌面实例。HCC 无法证明外部应用
 没有独立打开同一个保存会话，因此不要同时在 owned runtime 外写入该会话。
 
+新保存的 worker 还记录工作目录的文件系统身份；即使路径文字未变，恢复前也必须
+重新匹配该身份。缺少此证据的旧 worker 仍可在 HCC 历史中读取，但不能自动恢复；
+人工核验与关联流程尚未实现。Web 历史会先标为不可恢复，native 服务在实际接纳时
+再次校验。
+
 worker 获得明确的 `HCC_ROOT`、`HCC_DB`、`HCC_PEER`、`HCC_NATIVE_OWNER`。provider hook
 必须匹配该 peer 的 native transport owner。native hook 路径只刷新 owner 心跳和续
 期其锁，不覆盖 provider binding 或进程身份、不再次注入 inbox、不 ACK 消息，也
@@ -213,7 +316,9 @@ Web 刷新执行状态时在页面内存中保留填写内容；提交、请求
 
 - 尚未实现接管或 attach 已有 Codex/Claude/dsh TUI、桌面会话；这些会话继续使用原
   transport。
-- Web 可发现并控制同一项目的现有 native worker，提供消息、回执、中断和明确关闭。
+- Web 可新建 Codex、Claude、dsh native worker，也可发现并控制同一项目的现有 worker，
+  提供消息、回执、中断和明确关闭。“历史”提供 HCC 保留事件与已关闭 worker 的显式恢复；
+  记录不是 provider 完整历史，活跃或停止未确认的 worker 不可从此入口恢复。
   关闭页面或 Web runtime 保留独立 native worker；支持与当前执行器、turn 绑定的人工应答。
   使用方式见 [Web 继续本地任务](web-handoff.zh-CN.md#本地-native-worker-接手)。
 - Codex、Claude 和 dsh native worker 自动获得项目与 peer 受限的 HCC MCP；
@@ -312,3 +417,33 @@ provider 版本、源码摘要、浏览器证据和清理结果；脚本不会
 消息总线送达的内容保持 peer 消息身份，即使发送方自称 `web` 或 `shell`。旧回执
 迁移后仍按 peer 消息处理。来源区分不授予工具权限，写入等受控操作仍需审批。
 委派文件任务时，先由用户明确授权接收 agent 的限定任务，再发送 peer 交接。
+
+## 有界稳定性验收
+
+安装包验收可加 `--stability`，在基础生命周期和跨 provider 通信之后运行持续负载：
+
+```sh
+node /absolute/path/to/acceptance-prefix/node_modules/@logicseek/hello-cc/scripts/native-installed-acceptance.mjs \
+  --run-live --codex-bin /absolute/path/to/codex --dsh-bin /absolute/path/to/dsh \
+  --archive /absolute/path/to/hello-cc.tgz --stability \
+  --stability-cycles 6 --stability-burst 2 --stability-idle-ms 30000 \
+  --stability-resume-every 2 --output /absolute/path/to/stability-receipt.json
+```
+
+三个 provider 同时工作，每轮先向各 worker 排队投递整组消息。每条要求模型从
+历史中回忆原始随机标记和上一条消息的票据，验证串行处理顺序与上下文保留。
+每轮还重复提交同一提交 ID，核对只产生一条回复与一个 ACK；定期关闭并恢复
+worker，在中点正常重启自有 daemon，再验证原 session 和历史。空闲窗口继续
+检查控制接口、pending 请求与会话身份。结束时核对持久投递、数据库完整性、
+事件保留上限与无回复循环。回执保留每条实际回复、失败状态和自有进程内存
+采样，不自动重放失败任务，也不把同轮重新尝试改写为成功。
+
+默认 6 轮、每 worker 每轮 2 条、每轮空闲观察 30 秒、每 2 轮恢复。参数限制为
+1–24 轮、1–4 条、0–300000 毫秒和 1–24 轮恢复间隔；这些选项必须与
+`--stability` 一起使用。这是有界真实模型负载验收，不能代替 24 小时 soak、
+并发容量测量或内存泄漏证明。DSH 单次恢复成功也不能单独解释历史恢复波动。
+
+`--stability-only` 与 `--stability` 一起使用时，只建立三个真实会话并运行稳定性
+负载，跳过基础中断、命令审批和模型 MCP 通信场景；回执明确标记该范围。
+适合已有独立生命周期/交互回执时单独补做持续负载，不能把跳过项算作通过。
+发生任一错误时，脚本在关闭自有 worker 前保存会话快照、最近投递和事件。