@loomhelm/multi-task-flow 0.0.0-stage → 0.2.6

package/toolkit/skills/docs/vendor/dot-codex/specs/r4m7k-fast-track-merge-intent-closeout/replay/positive-safe-align-restores-dirty-untracked.jsonl

@@ -0,0 +1,8 @@
+{"type":"response_item","payload":{"type":"message","role":"user","content":[{"type":"input_text","text":"安全对齐"}]}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"git branch th/backup-main-before-align-20260528 main && git stash push -u -m align-main-backup\",\"workdir\":\"/repo\"}","call_id":"call_stash"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_stash","output":"Saved working directory and index state On main: align-main-backup"}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"git fetch --prune origin && git rebase origin/main main\",\"workdir\":\"/repo\"}","call_id":"call_rebase"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_rebase","output":"Successfully rebased and updated refs/heads/main."}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"git stash apply --index stash@{0} && git status --short --branch\",\"workdir\":\"/repo\"}","call_id":"call_apply"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_apply","output":"## main...origin/main [ahead 1]\n M config.toml\n?? .codex/\n?? goals_1.sqlite"}}
+{"type":"event_msg","payload":{"type":"task_complete","turn_id":"positive-safe-align-restores-dirty-untracked","last_agent_message":"主工作区基线更新=已更新；main 包含 origin/main，dirty/untracked 已恢复到工作区；stash@{0} 保留为备份。"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/r4m7k-fast-track-merge-intent-closeout/replay/positive-safe-align-stash-apply-exit-guard.jsonl

@@ -0,0 +1,4 @@
+{"type":"response_item","payload":{"type":"message","role":"user","content":[{"type":"input_text","text":"安全对齐"}]}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"git branch main-before-align && git stash push -u -m align-main-backup && git rebase origin/main main && git stash apply --index stash@{0} || { git status; exit 1; }\",\"workdir\":\"/repo\"}","call_id":"call_align"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_align","output":"Successfully rebased and updated refs/heads/main.\nOn branch main\nChanges not staged for commit:\n M config.toml"}}
+{"type":"event_msg","payload":{"type":"task_complete","turn_id":"positive-safe-align-stash-apply-exit-guard","last_agent_message":"主工作区基线更新=已更新；dirty/untracked 已恢复到工作区；stash@{0} 保留为备份。"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/r4m7k-fast-track-merge-intent-closeout/replay/positive-safe-align-stash-apply-fallback-after-index-error.jsonl

@@ -0,0 +1,4 @@
+{"type":"response_item","payload":{"type":"message","role":"user","content":[{"type":"input_text","text":"安全对齐"}]}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"git branch main-before-align && git stash push -u -m align-main-backup && git rebase origin/main main && git stash apply --index stash@{0} || git stash apply stash@{0}\",\"workdir\":\"/repo\"}","call_id":"call_align"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_align","output":"error: conflicts in index. Try without --index.\nOn branch main\nChanges not staged for commit:\n  modified: config.toml\nUntracked files:\n  .codex/"}}
+{"type":"event_msg","payload":{"type":"task_complete","turn_id":"positive-safe-align-stash-apply-fallback-after-index-error","last_agent_message":"主工作区基线更新=已更新；dirty/untracked 已恢复到工作区；stash@{0} 保留为备份。"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/r4m7k-fast-track-merge-intent-closeout/replay/positive-safe-align-stash-apply-fallback.jsonl

@@ -0,0 +1,4 @@
+{"type":"response_item","payload":{"type":"message","role":"user","content":[{"type":"input_text","text":"安全对齐"}]}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"git branch main-before-align && git stash push -u -m align-main-backup && git rebase origin/main main && git stash apply --index stash@{0} || git stash apply stash@{0}\",\"workdir\":\"/repo\"}","call_id":"call_align"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_align","output":"Successfully rebased and updated refs/heads/main."}}
+{"type":"event_msg","payload":{"type":"task_complete","turn_id":"positive-safe-align-stash-apply-fallback","last_agent_message":"主工作区基线更新=已更新；dirty/untracked 已恢复到工作区；stash@{0} 保留为备份。"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/r4m7k-fast-track-merge-intent-closeout/replay/positive-shell-command-array-merge-no-cleanup.jsonl

@@ -0,0 +1,9 @@
+{"type":"response_item","payload":{"type":"message","role":"user","content":[{"type":"input_text","text":"合并"}]}}
+{"type":"response_item","payload":{"type":"message","role":"assistant","content":[{"type":"output_text","text":"headRefName=topic"}]}}
+{"type":"response_item","payload":{"type":"message","role":"assistant","content":[{"type":"output_text","text":"PR状态=存在。Step 5C Ready，handoff 到 $pr-merge。"}]}}
+{"type":"response_item","payload":{"type":"function_call","name":"shell","arguments":"{\"command\":[\"bash\",\"-lc\",\"gh pr merge 1 --merge --delete-branch=false\"]}","call_id":"call_shell_array_merge"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_shell_array_merge","output":"✓ Merged pull request owner/repo#1"}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"git push origin --delete topic\",\"workdir\":\"/repo\"}","call_id":"call_delete_remote"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_delete_remote","output":"To github.com:owner/repo.git\n - [deleted]         topic"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"legacy-release-contract","output":{"release_expected":false,"release_epoch":"merge-abc1234","target_repo":"example/repo","target_branch":"main","target_sha":"abc1234","reason":"release_expected=false; release workflow skipped for this merge SHA"}}}
+{"type":"event_msg","payload":{"type":"task_complete","turn_id":"demo-shell-command-array-merge-no-cleanup","last_agent_message":"PR 已合并；远端分支=不存在；主工作区基线更新=已更新；本地收尾=未执行。； release_expected=false；发布状态=未触发；依据=legacy fixture 无仓库发布面；发布版本=none；发布tag=none；发布channel=none；发布绑定sha=none；发布workflow=none；发布URL=none；发布时间=none；发布产物=none；发布处置=report-only"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/r4m7k-fast-track-merge-intent-closeout/replay/positive-shell-script-merge-no-cleanup.jsonl

@@ -0,0 +1,8 @@
+{"type":"response_item","payload":{"type":"message","role":"user","content":[{"type":"input_text","text":"合并"}]}}
+{"type":"response_item","payload":{"type":"message","role":"assistant","content":[{"type":"output_text","text":"headRefName=topic"}]}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"bash -lc 'set -e; cd repo && gh pr merge 1 --merge --delete-branch=false'\",\"workdir\":\"/repo\"}","call_id":"call_shell_script_merge"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_shell_script_merge","output":"✓ Merged pull request owner/repo#1"}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"git push origin --delete topic\",\"workdir\":\"/repo\"}","call_id":"call_delete_remote"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_delete_remote","output":"To github.com:owner/repo.git\n - [deleted]         topic"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"legacy-release-contract","output":{"release_expected":false,"release_epoch":"merge-abc1234","target_repo":"example/repo","target_branch":"main","target_sha":"abc1234","reason":"release_expected=false; release workflow skipped for this merge SHA"}}}
+{"type":"event_msg","payload":{"type":"task_complete","turn_id":"demo-shell-script-merge-no-cleanup","last_agent_message":"结果=已合并；远端分支=不存在；主工作区基线更新=已更新；本地收尾=未执行。； release_expected=false；发布状态=未触发；依据=legacy fixture 无仓库发布面；发布版本=none；发布tag=none；发布channel=none；发布绑定sha=none；发布workflow=none；发布URL=none；发布时间=none；发布产物=none；发布处置=report-only"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/r4m7k-fast-track-merge-intent-closeout/replay/positive-shell-wrapped-compound-delete.jsonl

@@ -0,0 +1,6 @@
+{"type":"response_item","payload":{"type":"message","role":"user","content":[{"type":"input_text","text":"merge"}]}}
+{"type":"response_item","payload":{"type":"message","role":"assistant","content":[{"type":"output_text","text":"headRefName=topic"}]}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"bash -lc 'gh pr merge 1 --merge --delete-branch=false && git push origin --delete topic'\",\"workdir\":\"/repo\"}","call_id":"call_wrapped_merge_delete"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_wrapped_merge_delete","output":"✓ Merged pull request #1\nremote branch: absent"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"legacy-release-contract","output":{"release_expected":false,"release_epoch":"merge-abc1234","target_repo":"example/repo","target_branch":"main","target_sha":"abc1234","reason":"release_expected=false; release workflow skipped for this merge SHA"}}}
+{"type":"event_msg","payload":{"type":"task_complete","turn_id":"demo-shell-wrapped-compound-delete","last_agent_message":"结果=已合并；远端分支=不存在；主工作区基线更新=已更新；本地收尾=未执行。； release_expected=false；发布状态=未触发；依据=legacy fixture 无仓库发布面；发布版本=none；发布tag=none；发布channel=none；发布绑定sha=none；发布workflow=none；发布URL=none；发布时间=none；发布产物=none；发布处置=report-only"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/r4m7k-fast-track-merge-intent-closeout/replay/positive-shell-wrapped-merge-no-cleanup.jsonl

@@ -0,0 +1,8 @@
+{"type":"response_item","payload":{"type":"message","role":"user","content":[{"type":"input_text","text":"合并"}]}}
+{"type":"response_item","payload":{"type":"message","role":"assistant","content":[{"type":"output_text","text":"headRefName=topic"}]}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"/bin/zsh -lc 'gh pr merge 1 --merge --delete-branch=false'\",\"workdir\":\"/repo\"}","call_id":"call_shell_merge"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_shell_merge","output":"✓ Merged pull request owner/repo#1"}}
+{"type":"response_item","payload":{"type":"function_call","name":"exec_command","arguments":"{\"cmd\":\"git push origin --delete topic\",\"workdir\":\"/repo\"}","call_id":"call_delete_remote"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"call_delete_remote","output":"To github.com:owner/repo.git\n - [deleted]         topic"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"legacy-release-contract","output":{"release_expected":false,"release_epoch":"merge-abc1234","target_repo":"example/repo","target_branch":"main","target_sha":"abc1234","reason":"release_expected=false; release workflow skipped for this merge SHA"}}}
+{"type":"event_msg","payload":{"type":"task_complete","turn_id":"demo-shell-wrapped-merge-no-cleanup","last_agent_message":"结果=已合并；远端分支=不存在；主工作区基线更新=已更新；本地收尾=未执行。； release_expected=false；发布状态=未触发；依据=legacy fixture 无仓库发布面；发布版本=none；发布tag=none；发布channel=none；发布绑定sha=none；发布workflow=none；发布URL=none；发布时间=none；发布产物=none；发布处置=report-only"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/r4m7k-fast-track-merge-intent-closeout/replay/positive-sub-agent-ci-wait.jsonl

@@ -0,0 +1,5 @@
+{"type":"response_item","payload":{"type":"function_call","name":"multi_agent_v1__spawn_agent","call_id":"spawn-1","arguments":"{\"message\":\"phase=post_merge_target_ci bound_sha=abc1234\"}"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"spawn-1","output":"{\"agent_id\":\"agent-1\"}"}}
+{"type":"response_item","payload":{"type":"function_call","name":"multi_agent_v1__wait_agent","call_id":"wait-1","arguments":"{\"targets\":[\"agent-1\"],\"timeout_ms\":30000}"}}
+{"type":"response_item","payload":{"type":"function_call_output","call_id":"wait-1","output":"{\"message\":\"Wait completed.\",\"timed_out\":false}"}}
+{"type":"response_item","payload":{"type":"message","role":"assistant","content":[{"type":"output_text","text":"后续追踪=sub-agent\n追踪目标=post_merge_target_ci\n追踪绑定sha=abc1234\n追踪终态=success\n追踪处置=report-only"}]}}

package/toolkit/skills/docs/vendor/dot-codex/specs/r4m7k-fast-track-merge-intent-closeout/replay/positive-unrelated-automation-update.jsonl

@@ -0,0 +1 @@
+{"type":"response_item","payload":{"type":"function_call","name":"automation_update","arguments":"{\"action\":\"pause\",\"kind\":\"heartbeat\",\"id\":\"unrelated\"}"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/r4m7k-fast-track-merge-intent-closeout/replay/positive-unrelated-sidecar-phase-text.jsonl

@@ -0,0 +1 @@
+{"type":"response_item","payload":{"type":"function_call","name":"multi_agent_v1__spawn_agent","arguments":"{\"task_name\":\"review-proof-sidecar\",\"prompt\":\"review context mentions post_merge_target_ci but this is not a CI tracker\"}"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/release-tracking/HISTORY.md

@@ -0,0 +1,7 @@
+# Release Tracking History
+
+The former shared contract named `post-merge-release-tracker` without a registered role. Its thirty-minute observation rule also lacked same-chat recovery and assumed artifacts used the originating merge SHA. The dedicated role and this topic own those boundaries, while CI and pre-merge release decisions remain in their existing topics. Same-SHA publication evidence remains compatible.
+
+Source implementation and deterministic verification are delivered in [PR #167](https://github.com/IvanLi-CN/dot-codex/pull/167); runtime installation and acceptance remain separate.
+
+The current contract now forbids scheduled tracking and requires a live tracker handle plus owner-issued `$flow-continue` for recovery. Earlier scheduled-task wording and replay fixtures remain historical audit compatibility material; existing runtime automations are intentionally untouched.

package/toolkit/skills/docs/vendor/dot-codex/specs/release-tracking/IMPLEMENTATION.md

@@ -0,0 +1,58 @@
+# Release Tracking Implementation
+
+`spec_disposition=update`; ADR 0027 records the ownership and identity tradeoffs.
+
+Candidate source defines and registers the dedicated role and explicit spawn entrypoints, bounded handle waiting, manual `$flow-continue` recovery instructions, and separate origin/publication identity. Tracking automation is prohibited by the active contract; the runtime home is unchanged, so source validation does not establish that the current desktop session has loaded or started `release-tracker`.
+
+The Step 5C card records preparation and trigger alongside its release inputs. A clear confirmation and merge request authorize those card-scoped actions; after a real merge, the caller starts target CI tracking and independent release preparation without waiting for unrelated cleanup, subject to target-repository release gates.
+
+Normalized `post_merge_handoff` replay events bind one merge SHA and model tracker start, independent preparation, explicit blockers, CI waits and terminal results, and dispatch. They test ordering and repository gates; they are fixture inputs, not runtime authorization or external evidence.
+
+Owner reports for an explicit Publication Identity require the fixed full origin SHA even when origin and publication match. Historical one-SHA normalized replay cards remain compatible; differing-SHA lineage cards continue to require full origin and publication commits and complete external transition evidence.
+
+## Coverage
+
+| Verification | Candidate evidence | Runtime boundary |
+| - | - | - |
+| VER-RELEASE-WIRING | Contract/config/profile consistency; missing registration, wrong profile, missing file, and incorrect entry are rejected | Dedicated role startup is unverified |
+| VER-RELEASE-RECOVERY | Contract regression assertions cover trigger availability independence, one active observer handle, prohibited scheduling, fixed deadlines, quiet notifications, persisted retry allowance, and manual `$flow-continue` continuation | Runtime handle startup and deadline stopping are unverified |
+| VER-RELEASE-IDENTITY | Semantic tests accept preparation-PR lineage and actual terminal deployment; reject broken, self-asserted, wrong-origin or conflicting lineage, missing deployment, unknown surfaces, and omitted alternate surface declarations | Actual production evidence remains per-release responsibility |
+| VER-RELEASE-RETRY | Exact-run replay grants must precede mutation and be owner-authored, bound to epoch/origin/run, and not revoked; atomic run failure is distinct from nested surface failure; safety locators and CLI/environment repository targets are checked; conflicting aggregate facts and delayed observations cannot restore revoked permissions; all identifiable attempts and violations survive epoch changes; explicit retry attempts require receipt binding; external success clears only the restored run's failure | Persistence across real successors and continuation is unverified |
+
+## Validation
+
+- Fixed candidate checks: `python3 /Users/ivan/.codex/skills/dot-codex-development/scripts/context.py validate --cwd <candidate-root>`; repository contract tests and skill index checks.
+- Task-specific tests: `python3 -m unittest bin.test_pr_skill_replay_check`; release lineage/deployment test methods include negative variants for malformed declarations and deployment identifiers.
+- Tracking behavior replay: `python3 bin/release_tracking_replay_check.py --cases docs/specs/release-tracking/replay/cases.txt` rejects tracking heartbeat/cron launches, validates manual recovery anchors, and preserves unrelated automation compatibility.
+- The focused replay schema uses `recovery_operation=none|authorized` to represent the existing operation receipt for the 30-minute/one-hour budget. A separate `tracking_scope_boundary` audit record distinguishes unrelated operations; tool arguments and assistant prose cannot erase an active tracking context. These normalized replay records are test inputs, not a runtime tool interface or a substitute for external authorization evidence.
+- Release compatibility: all 148 release cases selected from `fast-track-merge-intent-closeout/replay/cases.txt` passed their expected positive/negative outcomes.
+- All three changed topic SPECs passed `bin/spec_contract_check.py`.
+- Validation and formal review bind the synchronized topic head and its live target-branch base; mainline synchronization requires refreshed evidence and does not install the candidate into the runtime home.
+
+No release is triggered by this change. Candidate validation does not assert runtime rollout, actual production deployment, or runtime tracker startup; no tracking automation is created or modified.
+
+Restored-run success must retain the bound run identity and commit, with a consistent terminal result. A contradictory success flag or another commit cannot clear unresolved failure, even if separate artifact evidence is complete.
+
+Duplicate MCP text/structured facts retain the same unresolved run state. Provided safety locators are parsed and checked rather than ignored when malformed or on another host; rerun target resolution preserves explicit host precedence and exported shell context. Attempt receipts update state only after matching epoch, commit, run locator, and consistent run status.
+
+Aggregate conflict checks cover all validated locator and commit fields, including both orderings; attempt-specific URLs must agree with declared attempts. Surface failures are tracked by concrete locator and invalidate that identity's earlier success facts. Only a later complete success observation for the same identity and publication commit/tag clears its failure; partial, stale, or different-surface evidence leaves it unresolved.
+
+Invalid run context is excluded before collecting nested publication evidence. Explicit attempt URLs participate in retry freshness even when `run_attempt` is omitted. Each concrete surface preserves its latest observation start across crossed failure/success responses; an older response cannot lower that mark, and a newer nonterminal observation invalidates earlier success evidence. Legacy observation-only GitHub Enterprise and failure cards without a discovered run ID remain compatible.
+
+An explicitly malformed attempt is rejected rather than treated as an omitted legacy field. Concrete surface identity remains known after its success proof is invalidated, so later state-only observations at that bound URL can revoke old proof without repeating the SHA; restoration still requires complete fresh identity evidence.
+
+Current invalid safety observations revoke older retry permission without granting new permission; delayed observations remain excluded. The expected next attempt is only a lower bound, and explicit post-retry attempts require a valid result from the exact mutation to bind the returned receipt. A newer nonterminal parent run prevents published closeout until a fresh consistent success observation restores its terminal proof.
+
+Observation freshness is evaluated after both field and locator attempts are resolved. Current invalid observations advance the read-start watermark when revoking permission, so a delayed positive response cannot restore it. Invalid current parent state also revokes old failure permission and terminal proof; malformed or unbound attempt fields do not suppress that revocation, while proven old attempts and delayed reads remain excluded.
+
+Request-bound attempts participate in the same eligibility check before any failure or publication proof is collected. Conflicting current/old attempt indicators cannot establish a stale observation. Semantically duplicate run cards ignore unrelated metadata; multiple distinct current run objects retain revocation rather than disappearing. A bound GitHub read can attribute an invalid-locator state for revocation, but never supplies successful identity proof or mutation permission.
+
+Bound reads also recognize native status-only responses without a normalized run ID, including protocol wrappers, while unrelated nested artifact states remain separate. Request and response attempt conflicts reject positive failure, safety, and publication proof before collection; current invalid responses retain their revocation effect.
+
+Known read targets must agree with the response's bound repository and run before failure, safety, or publication proof is collected. Native ID duplicate fragments are checked in both aggregation orders even without normalized safety fields. Aggregate conflicts in all existing run-state aliases, including `success`, revoke run proof and permit a later complete success observation to restore it. The origin commit locator remains separate from the run locator and must retain the bound origin repository, commit, and consistent code-hosting host.
+
+Native API read attribution resolves endpoint options in either order, leading-slash and absolute API URLs, explicit hostname precedence, and inherited shell environment through the existing target resolver. Absolute URL hosts remain authoritative. Surface revocation scans original observations, including JSON protocol text, so aggregation order cannot discard a same-surface failure or nonterminal fact; a later complete success observation may restore that identity's proof.
+
+Native GitHub `id`/`databaseId` and `attempt` fields retain identity and freshness meaning, including `gh run view --attempt`/`-a` selections. Every existing commit alias is checked consistently, including identity-only protocol fragments in either aggregation order. Same-repository/run REST self locators are equivalent to their GitHub web locators; standard REST auxiliary links remain constrained to their repository and, where applicable, run, without substituting for self identity. Foreign or malformed locators remain invalid. Protocol and explicit `run`/`runs` containers preserve negative safety facts as well as atomic run state, leaving nested jobs and artifact workflow provenance outside run terminal state.
+
+Deterministic rerun fixtures encode an existing task grant in an owner message as `release_retry_authorization` with `allowed`, `release_epoch`, `target_repo`, `target_branch`, `target_sha`, and `release_run_id`. This is a normalized replay receipt; it does not impose a required response format on the owner or replace runtime authorization checks.

package/toolkit/skills/docs/vendor/dot-codex/specs/release-tracking/SPEC.md

@@ -0,0 +1,78 @@
+# Release Tracking
+
+## Context and Scope
+
+发布观察依赖明确可启动的角色、真实外部证据和有限恢复窗口。本主题覆盖发布触发后的观察、发布链绑定、生产部署核验与恢复，不授予新的发布、合并、 版本选择或其他运维操作权限。CI 门禁仍由 CI Tracker 独立负责。CI、Release、部署、PR 状态及其恢复均禁止创建、更新或复用 tracking automation；资源租约续期和已明确授权的非 tracking 交接仍由各自合同负责。
+
+## Terms and Interfaces
+
+Release Origin 固定记录起始仓库、分支与提交；Publication Identity 记录实际发布提交与版本；Release Lineage 是两者之间经过外部证据核实的仓库发布链。
+
+执行入口与返回字段由 [shared release contract](../../../skills/project-engineering-workflow/references/release-tracking-short-contract.md) 定义。发布观察属于 `post_merge`/`post_deploy` closeout，不能反向满足 pre-merge readiness。
+
+## Requirements
+
+### REQ-RELEASE-ROLE
+
+MUST 定义、注册并显式启动专用 `release-tracker`，与 `ci-tracker` 分开；角色名不是独立工具名。配置检查与运行时实际启动结果 MUST 分别报告。恢复 MUST 保持原观察模型配置，不得隐式切换模型或以主 Agent 轮询替代。
+
+### REQ-RELEASE-TRIGGER
+
+Tracker 不可用 MUST NOT 阻止已有授权的发布触发；触发后 MUST 保留未完成核验与精确恢复锚点。发布或部署未经核实 MUST NOT 报告流程成功。
+
+完整决策卡 MUST 列明发布目标、版本规则、政策来源、必要准备及碰撞处理。主人明确确认发布卡并要求合并时，卡内发布准备与发布获得授权；卡外独立运维动作不因此获准。合并后 MUST 按实际仓库政策和 merge SHA 重新核验；事实漂移、冲突或授权不明确时停止受影响动作。
+
+平台确认 PR 已合并并返回实际 merge SHA 后 MUST 立即启动该 SHA 的目标 CI 跟踪，同时推进不依赖其终态的已授权发布准备和适用性核验；不能等待 CI 与发布终态才登记的审计收据。实际发布触发 MUST 遵守仓库声明的前置门禁；CI 和发布分别跟踪至各自终态或明确未完成。手动发布尚未触发不是不适用的证据。
+
+### REQ-RELEASE-RECOVERY
+
+观察不可用或中断后 MUST 返回 `unavailable|incomplete` 与恢复锚点；当前聊天只等待仍存活的 tracker 句柄，不得创建、更新或复用 heartbeat、cron、app automation 或其他调度器。主人再次执行 `$flow-continue` 时 MUST 复用原身份、起始提交、发布链、截止时间和重试记录，不得重复观察或重复触发发布。状态无变化时 MUST 保持安静；完成、失败、需要人工处理或预算耗尽时通知。
+
+### REQ-RELEASE-LINEAGE
+
+MUST 分别记录固定起始 SHA 与实际发布 SHA；不同 SHA 只有在仓库提供的外部证据证明完整连续发布链时才能接受。MUST 核实全部声明发布面，包括管线负责的生产部署；绿灯、tag 匹配或部署已派发均不能代替实际终态证据。未知发布面或链路缺口 MUST 保持未完成。
+
+### REQ-RELEASE-PHASE-IDENTITY
+
+`release_expected` MUST be derived only after a real merge from `target_repo + target_branch + merge_sha`; a Step 5C release decision card, Candidate evidence card, or CI intent snapshot is not publication evidence. Any `post_deploy` acceptance or release observation MUST bind the same merge SHA lineage and a structured `deployment_identity` whose source and bound SHA match that merge. Missing or mismatched deployment identity MUST remain an owner-action blocker and MUST NOT be reclassified as `not_required`.
+
+### REQ-RELEASE-RETRY
+
+Tracker MAY 安全重跑同一已有失败运行一次：已有授权以及该运行幂等、 可安全重试的外部证据缺一不可。MUST 保存重试记录，跨 tracker 重建和手动 `$flow-continue` 均不恢复已用额度；不得派发替代发布或改变发布输入。
+
+### REQ-RELEASE-BUDGET
+
+观察 MUST 使用累计墙钟预算：未执行重跑等发布恢复操作时 30 分钟，执行已获授权的恢复操作后最多一小时；均从同一窗口起点计算。初始起点为自动发布的已确认 merge 或手动发布的已确认 dispatch。等待、启动故障、只读检查、手动 `$flow-continue` 和 tracker 重建 MUST NOT 重置或延长预算。到期 MUST 停止观察，保留锚点供主人手动继续；不取消远端发布。手动继续 MUST 保留原发布身份、窗口起点、deadline 与重试记录。
+
+## Verification
+
+### VER-RELEASE-WIRING
+
+- covers: `REQ-RELEASE-ROLE`
+- 配置检查核对合同入口、角色注册、profile 文件和身份；缺失或错误关联必须失败。运行时验收需取得专用角色的实际启动结果，不能用静态通过代替。
+
+### VER-RELEASE-RECOVERY
+
+- covers: `REQ-RELEASE-TRIGGER`, `REQ-RELEASE-RECOVERY`, `REQ-RELEASE-BUDGET`
+- 合同检查覆盖不阻断触发、句柄等待、手动 `$flow-continue`、活动 tracker 复用、安静通知与共同截止时间；运行时演练覆盖观察故障、接管、截止停止和手动续推，且无重复发布。运行时调度器不属于当前恢复入口。
+- 当前候选的确定性回放还必须拒绝 tracking automation_update 的 heartbeat/cron 创建或更新，验证完整手动恢复锚点、身份连续性与有限窗口，并保留明确标注的非 tracking automation 兼容性。
+- 回放确认卡授权、手动准备、CI 并行及项目门禁，验证缺失授权、事实冲突和未触发发布不会被错误关闭。
+
+### VER-RELEASE-IDENTITY
+
+- covers: `REQ-RELEASE-LINEAGE`, `REQ-RELEASE-PHASE-IDENTITY`
+- 语义回放接受有完整证据的不同发布 SHA 与终态部署；拒绝错误起始 SHA、 断链、仅自述链路、缺失部署、未知发布面或不匹配产物。
+
+### VER-RELEASE-RETRY
+
+- covers: `REQ-RELEASE-RETRY`
+- 回放验证仅可对精确失败运行安全重跑一次，无安全证据或超额重跑必须失败；运行时验收核对重建/续推后的已用额度和实际运行 receipt。
+
+## Related ADRs
+
+- [Distinct CI and Release Tracker Ownership](../../adr/0027-release-tracker-ownership.md)
+
+## References
+
+- [Implementation](IMPLEMENTATION.md)
+- [History](HISTORY.md)

package/toolkit/skills/docs/vendor/dot-codex/specs/release-tracking/replay/cases.txt

@@ -0,0 +1,4 @@
+# Current contract replay cases. Historical fast-track fixtures remain separate audit material.
+manual-recovery-positive.jsonl pass
+tracking-heartbeat-negative.jsonl TRACKING_SCHEDULED_AUTOMATION_FORBIDDEN
+unrelated-automation-positive.jsonl pass

package/toolkit/skills/docs/vendor/dot-codex/specs/release-tracking/replay/manual-recovery-positive.jsonl

@@ -0,0 +1 @@
+{"type":"response_item","payload":{"type":"message","role":"assistant","content":[{"type":"output_text","text":"release-tracker unavailable; return incomplete with recovery anchor chat=thread target_repo=example/repo target_branch=main origin_sha=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa release_epoch=epoch trigger=2026-10-08T09:00:00Z run_locator=run/1 surface_locator=release/1 lineage=origin-to-publication child_handle=child/1 startup_reason=timeout retry_record=none recovery_operation=none window_start=2026-10-08T09:00:00Z deadline=2026-10-08T09:30:00Z and wait for owner $flow-continue"}]}}

package/toolkit/skills/docs/vendor/dot-codex/specs/release-tracking/replay/tracking-heartbeat-negative.jsonl

@@ -0,0 +1,2 @@
+{"type":"response_item","payload":{"type":"message","role":"assistant","content":[{"type":"output_text","text":"release-tracker post_merge_release"}]}}
+{"type":"response_item","payload":{"type":"function_call","name":"mcp__codex_app__automation_update","arguments":"{\"mode\":\"create\",\"kind\":\"heartbeat\",\"name\":\"release-tracker recovery\",\"rrule\":\"FREQ=MINUTELY;INTERVAL=5\"}"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/release-tracking/replay/unrelated-automation-positive.jsonl

@@ -0,0 +1,2 @@
+{"type":"response_item","payload":{"type":"message","role":"assistant","content":[{"type":"output_text","text":"unrelated maintenance"}]}}
+{"type":"response_item","payload":{"type":"function_call","name":"mcp__codex_app__automation_update","arguments":"{\"mode\":\"create\",\"kind\":\"heartbeat\",\"name\":\"unrelated maintenance\",\"tracking_scope\":\"unrelated\",\"rrule\":\"FREQ=DAILY\"}"}}

package/toolkit/skills/docs/vendor/dot-codex/specs/retire-legacy-service-manager/HISTORY.md

@@ -0,0 +1,18 @@
+# Retire zellij service manager 演进历史（#6s9b8）
+
+> 这里记录会影响 Agent 理解“为什么一步步变成现在这样”的关键演进；单次任务流水账不放这里，规范正文仍以 `./SPEC.md` 为准。
+
+## Decision Trace
+
+- `c530b57` chore: retire legacy service manager stack
+- `b39a914` docs(specs): adopt topic-level spec model
+
+## Legacy Change Log
+
+- No legacy change-log section was recorded for this spec.
+
+## References
+
+- `./SPEC.md`
+- `./IMPLEMENTATION.md`
+- Legacy compatibility identity: `#6s9b8`.

package/toolkit/skills/docs/vendor/dot-codex/specs/retire-legacy-service-manager/IMPLEMENTATION.md

@@ -0,0 +1,56 @@
+# Retire zellij service manager 实现状态
+
+> 当前有效规范仍以 `./SPEC.md` 为准；这里记录实现覆盖、交付进度与 rollout 相关事实，避免这些细节散落到 PR / Git 历史里。
+
+## Current Status
+
+- Implementation: 已实现
+- Lifecycle: active
+- Catalog note: 删除已废弃服务托管 skill 与 repo 内配套辅助链，保留本机运行态残留为 out of scope
+
+## Historical rollout snapshot
+
+- Legacy status snapshot: 已实现
+- Legacy created: 2026-04-10
+- Legacy last-tracked: 2026-04-10
+- Current lifecycle: active
+- Catalog note: 删除已废弃服务托管 skill 与 repo 内配套辅助链，保留本机运行态残留为 out of scope
+
+## Delivery Milestones
+
+- [x] M1: 建立退役 spec、更新索引并写清范围边界
+- [x] M2: 删除 skill、本仓库 `devctl` / launchd 辅助链与相关 bin 文档
+- [x] M3: 清理现行技能/规格中的活跃引用并完成本地验证
+
+## Rollout Artifacts
+
+### Docs touched
+
+- `docs/specs/README.md`: 新增索引项
+- `docs/specs/retire-legacy-service-manager/SPEC.md`: 记录退役范围与验收口径
+- `docs/specs/global-port-preview-governance/SPEC.md`: 去掉已删除能力的点名引用
+- `skills/README.md`: 移除 retired skill 条目
+- `skills/storybook-stories/SKILL.md`: 去掉 `$zellij-service-manager` 回退路径
+
+### Plan assets
+
+- Directory: `docs/specs/retire-legacy-service-manager/assets/`
+- Visual evidence source: none required for this non-UI retirement task.
+
+### Asset promotion
+
+None
+
+## Related Changes
+
+- `c530b57` chore: retire legacy service manager stack
+- `b39a914` docs(specs): adopt topic-level spec model
+
+## Remaining Gaps
+
+- None currently tracked.
+
+## References
+
+- `./SPEC.md`
+- `./HISTORY.md`

package/toolkit/skills/docs/vendor/dot-codex/specs/retire-legacy-service-manager/SPEC.md

@@ -0,0 +1,48 @@
+# Retire zellij service manager
+
+> 当前有效规范以本文为准；实现覆盖与当前状态见 `./IMPLEMENTATION.md`，关键演进原因见 `./HISTORY.md`。
+
+## Context and Scope
+
+This topic defines the repository boundary for retiring the obsolete `zellij-service-manager` workflow and its repository-owned helper chain. It covers the retired skill, `devctl` helpers, launchd templates, active consumer references, and the related catalog entry. Host launchd jobs, logs, state, and other runtime residue remain outside this repository contract.
+
+## Requirements
+
+### REQ-ZELLIJ-RETIRE-001
+
+The repository MUST NOT retain the `zellij-service-manager` skill or the `devctl` and launchd helper files that existed only to support that workflow.
+
+### REQ-ZELLIJ-RETIRE-002
+
+Current skills and topic specifications MUST describe Codex native background terminals and live task ownership for long-running work. They MUST NOT present the retired service manager or its helpers as an active capability, fallback, or required dependency.
+
+### REQ-ZELLIJ-RETIRE-003
+
+The topic catalog and direct consumer documentation MUST remain consistent with the retired repository surface. Unrelated Storybook, port governance, and other shared workflow requirements MUST remain intact. Runtime residue outside the repository MUST NOT be removed by this topic.
+
+## Verification
+
+### VER-ZELLIJ-RETIRE-001 covers: REQ-ZELLIJ-RETIRE-001
+
+- Method: inspect the tracked file set and the deletion diff for the retired skill, `devctl` helpers, and launchd templates.
+- Pass condition: no retired repository-owned capability or helper remains in the source tree.
+
+### VER-ZELLIJ-RETIRE-002 covers: REQ-ZELLIJ-RETIRE-002
+
+- Method: search tracked current skills and specifications for active `zellij-service-manager`, `devctl`, or `devctl-gc` references and inspect the long-task wording in the direct consumers.
+- Pass condition: current consumers use Codex native background terminals and live task ownership; any retained old-name hit is limited to the retirement specification or necessary historical evidence.
+
+### VER-ZELLIJ-RETIRE-003 covers: REQ-ZELLIJ-RETIRE-003
+
+- Method: validate the catalog entry, the shared Storybook and port-governance requirements, and the documented runtime boundary.
+- Pass condition: the catalog matches the repository surface, unrelated shared requirements remain present, and host runtime residue is explicitly out of scope.
+
+## Related ADRs
+
+None
+
+## References
+
+- `./IMPLEMENTATION.md`
+- `./HISTORY.md`
+- `docs/specs/global-port-preview-governance/SPEC.md`

package/toolkit/skills/docs/vendor/dot-codex/specs/review-effort-by-pr-stage/HISTORY.md

@@ -0,0 +1,24 @@
+# Review model and effort defaults 演进历史（#y9nrr）
+
+> 这里记录会影响 Agent 理解“为什么一步步变成现在这样”的关键演进；单次任务流水账不放这里，规范正文仍以 `./SPEC.md` 为准。
+
+## Decision Trace
+
+- shared review profile 由 native `$review-agent` 执行，模型/effort 矩阵保持不变；独立手动 review/fix 仅作为兼容入口对齐同一矩阵。
+- Luna lane 不再隐式接受 Terra receipt；Terra 仅作为 Luna `model_unavailable` 后由主人对当前 PR/epoch 显式授权的替代执行模型。
+- Terra 授权使用经 task receipt 关联的 failure 快照，并在写入前复核快照哈希；这只加固既有显式授权，不改变模型矩阵或调用次数。
+- 主人决策：一般与轻量 review 默认使用 `gpt-5.6-luna` + `high`，关联 review 默认使用 `gpt-5.6-sol` + `low`，高要求或疑难 review 在启动前显式标记后使用 `gpt-5.6-sol` + `medium`。
+- 主人决策：默认 review 模型切回 `gpt-5.5`，所有 review 入口默认 `low`，并允许 invocation 启动前一次性自由改档。
+- 先前决策：所有 review 入口固定使用 `gpt-5.6-terra`，所有 profile 默认 `medium`，并允许 invocation 启动前一次性自由改档。
+- `54a9c9b` docs(workflow): align review effort defaults by pr stage
+- `b39a914` docs(specs): adopt topic-level spec model
+
+## Legacy Change Log
+
+- No legacy change-log section was recorded for this spec.
+
+## References
+
+- `./SPEC.md`
+- `./IMPLEMENTATION.md`
+- Legacy compatibility identity: `#y9nrr`.

package/toolkit/skills/docs/vendor/dot-codex/specs/review-effort-by-pr-stage/IMPLEMENTATION.md

@@ -0,0 +1,60 @@
+# Review model and effort defaults 实现状态（superseded）
+
+> 当前有效规范仍以 `./SPEC.md` 为准；这里记录实现覆盖、交付进度与 rollout 相关事实，避免这些细节散落到 PR / Git 历史里。
+
+## Current Status
+
+- Implementation: 已实现
+- Lifecycle: superseded
+- Catalog note: 一般 review 默认使用 `gpt-5.6-luna` + `high`，关联 proof 默认使用 `gpt-5.6-sol` + `low`，高要求信号使用 `gpt-5.6-sol` + `medium`；保留 agent 启动前一次性自由改 effort
+
+## Historical rollout snapshot
+
+- Legacy status snapshot: 已实现
+- Legacy created: 2026-03-17
+- Legacy last-tracked: 2026-03-17
+- Current lifecycle: active
+- Catalog note: 一般 review 默认使用 `gpt-5.6-luna` + `high`，关联 proof 默认使用 `gpt-5.6-sol` + `low`，高要求信号使用 `gpt-5.6-sol` + `medium`；保留 agent 启动前一次性自由改 effort
+
+## Delivery Milestones
+
+- [x] M1: 建立 `docs/specs/review-effort-by-pr-stage/SPEC.md` 规格并登记索引
+- [x] M2: 统一 native review 与独立手动 review/fix 的模型、允许档位与默认矩阵
+- [x] M3: 同步 shared workflow 与 PR 入口的 native proof / convergence 文案
+- [x] M4: 完成静态 CLI、文档一致性与 spec drift 检查
+- [x] M5/M6: historical v2 receipt compatibility retained; current behavior is defined by `../workflow-agent-model-selection/SPEC.md`
+
+## Rollout Artifacts
+
+### Docs touched
+
+- `docs/specs/README.md`
+- `docs/specs/review-effort-by-pr-stage/SPEC.md`
+- `docs/specs/review-effort-by-pr-stage/IMPLEMENTATION.md`
+- `docs/specs/review-effort-by-pr-stage/HISTORY.md`
+- `skills/codex-review-loop/SKILL.md`
+- `skills/project-engineering-workflow/SKILL.md`
+- `skills/pr-create/SKILL.md`
+- `skills/pr-merge/SKILL.md`
+
+### Plan assets
+
+None
+
+### Asset promotion
+
+None
+
+## Related Changes
+
+- `54a9c9b` docs(workflow): align review effort defaults by pr stage
+- `b39a914` docs(specs): adopt topic-level spec model
+
+## Remaining Gaps
+
+- None currently tracked.
+
+## References
+
+- `./SPEC.md`
+- `./HISTORY.md`

package/toolkit/skills/docs/vendor/dot-codex/specs/review-effort-by-pr-stage/SPEC.md

@@ -0,0 +1,110 @@
+# Review model and effort defaults (superseded)
+
+> This historical topic is superseded by `../workflow-agent-model-selection/SPEC.md`. The current contract treats model and effort as recommendations rather than stage-bound requirements.
+
+## 背景 / 问题陈述
+
+- review 模型和默认推理档位分散在 native `$review-agent` profiles、独立手动 review/fix、shared workflow、`$pr-create` 与 `$pr-merge` 中，入口之间可能发生漂移。
+- 主人已明确要求一般 review 默认使用 `gpt-5.6-luna` + `high`，关联 proof 默认使用 `gpt-5.6-sol` + `low`，高要求或疑难 review 使用 `gpt-5.6-sol` + `medium`。
+- 仍需保留 agent 在 invocation 启动前一次性选择其他允许 effort 的能力，且不改变 proof、预算、sandbox 或 merge 流程语义。
+
+## 目标 / 非目标
+
+### Goals
+
+- 统一 repo 内 review 的默认模型与 reasoning effort 口径，避免不同入口互相冲突。
+- 按 review profile 明确 `gpt-5.6-luna` + `high` 的一般默认、`gpt-5.6-sol` + `low` 的关联 proof 默认，以及 `gpt-5.6-sol` + `medium` 的显式高要求档位。
+- 保留 agent 在 invocation 启动前一次性自由改 effort 的权限，但禁止同一 invocation 中途调档。
+
+### Non-goals
+
+- 不修改 freshness gate、scope freeze、base-resolution 或 merge gate。
+- 不修改 `--sandbox read-only`、`-a never`、CLI 参数顺序或 runtime sandbox 真相源规则。
+- 不改变本机全局 `config.toml`、模型供应商或新增真实服务端 smoke test。
+
+## 范围（Scope）
+
+### In scope
+
+- 更新 `skills/codex-review-loop/SKILL.md` 的模型、profile 默认、命令形状、改档语义与示例输出。
+- 更新 `skills/project-engineering-workflow/SKILL.md` 中 dev-subagent、pre-PR local proof、PR convergence、merge-proof、local-merge-proof 的默认说明。
+- 更新 `skills/pr-create/SKILL.md` 与 `skills/pr-merge/SKILL.md` 中 direct proof / convergence 的模型和默认档位描述。
+- 更新本 spec 的 companion docs 与 `docs/specs/README.md` 索引摘要。
+
+### Out of scope
+
+- 更改任何运行时代码、MCP 选型或新增自动化测试框架。
+- 修改 `$local-merge-flow` 的本地 merge 收尾业务语义。
+
+## 需求（Requirements）
+
+### MUST
+
+- native `$review-agent` 与独立手动 review/fix 的默认模型必须按 profile 使用 `gpt-5.6-luna` 或 `gpt-5.6-sol`，`review_effort` 输出契约必须接受 `low|medium|high|xhigh`。
+- 固定请求形状必须为 `codex -m <resolved_model> -c model_reasoning_effort="<resolved_effort>" --sandbox read-only -a never review --base <BASE_REF>`。
+- `dev-subagent`、`pr-convergence` 与 `fallback` 默认使用 `Luna` + `high`。
+- routine review lane 的声明模型与实际 receipt 必须严格一致；不得把声明为 Luna 的 lane 隐式接受为 Terra。只有当前 PR/epoch 内可验证的 Luna `model_unavailable` 和主人显式授权，才能把指定未登记 lane 及本 epoch 后续 routine wave 改为 Terra + `high`；新 epoch 恢复 Luna。
+- `merge-proof` 与 `local-merge-proof` 默认使用 `gpt-5.6-sol` + `low`。
+- 外层在首个进程启动前传入 `HIGH_REQUIREMENT_REVIEW=yes` 时，当前 profile 使用 `gpt-5.6-sol` + `medium`；该信号不改变 profile 或 proof key。
+- `pre-PR local proof` 与 `pr-create` 中的 direct read-only proof 默认遵循 fallback/pr-convergence 的 `gpt-5.6-luna` + `high`；高要求/疑难场景必须在启动前传入 `HIGH_REQUIREMENT_REVIEW=yes`，切换为 `gpt-5.6-sol` + `medium`。
+- `project-engineering-workflow`、`pr-create` 与 `pr-merge` 的模型、默认 effort 与 native review profiles 保持一致。
+- 每次 invocation 只能在启动首个 review 进程前解析一次 effort；后续轮次、重试与 restart 必须沿用同一结果。
+
+### SHOULD
+
+- 各入口应明确说明：agent 可在启动前一次性自由选择任一允许档位，而不将某个 override 描述为新的硬默认。
+- 示例输出应覆盖一般 profile 的 `gpt-5.6-luna` + `high`、关联 proof 的 `gpt-5.6-sol` + `low` 与高要求信号下的 `gpt-5.6-sol` + `medium`，同时保留其他允许 effort override 示例。
+
+## 功能与行为规格（Functional/Behavior Spec）
+
+### Default matrix
+
+- `dev-subagent`：默认 `gpt-5.6-luna` + `high`。
+- `pre-PR local proof`：默认 `gpt-5.6-luna` + `high`；高要求/疑难场景传入 `HIGH_REQUIREMENT_REVIEW=yes` 后使用 `gpt-5.6-sol` + `medium`。
+- `pr-convergence`：默认 `gpt-5.6-luna` + `high`。
+- `pr-convergence` 的 Terra 路径不是自动 fallback：普通失败、timeout 或 finding 不触发授权，且 Sol 仲裁与 merge proof 不受 Terra 授权影响。
+- open-PR `merge-proof`：默认 `gpt-5.6-sol` + `low`。
+- `local-merge-proof`：默认 `gpt-5.6-sol` + `low`。
+- `fallback`：默认 `gpt-5.6-luna` + `high`。
+- 任一 profile 在启动前收到 `HIGH_REQUIREMENT_REVIEW=yes`：使用 `gpt-5.6-sol` + `medium`，但保留原 profile 的 proof 与验证语义。
+
+### Override semantics
+
+- agent 可在启动某次 invocation 前一次性自由选择 `low`、`medium`、`high` 或 `xhigh` effort；模型按 profile 默认解析，只有 `HIGH_REQUIREMENT_REVIEW=yes` 才切换到 `gpt-5.6-sol` + `medium`。
+- invocation 一旦启动，不得在同一次 proof / loop 的轮次、自动重启或卡死恢复中再次调档。
+- 改档不改变 review profile、proof key、repair permit 或其他流程门禁。
+
+### Cross-entry alignment
+
+- 所有 native read-only proof 与独立手动 review/fix 文案必须引用相同的模型和默认档位。
+- 示例输出、总结模板与 merge-proof 文案必须与默认矩阵一致。
+- 实际 sandbox mode 仍以 runtime banner / session output 为准，不从 CLI 参数字面值推断。
+
+## 验收标准（Acceptance Criteria）
+
+- Given 实现者检查 native `$review-agent` 与独立手动 review/fix 输出契约 When 查阅模型、`review_effort` 字段定义与示例输出 Then 一般 profile 默认模型为 `gpt-5.6-luna` 且 effort 为 `high`，关联 proof 默认模型为 `gpt-5.6-sol` 且 effort 为 `low`，允许值包含 `low|medium|high|xhigh`。
+
+- Given 实现者检查 shared workflow 的 Step 3E、Step 4、Step 5 与 Step 5L When 查阅所有 review 入口文案 Then dev-subagent、pre-PR local proof、PR convergence 与 fallback 默认 `gpt-5.6-luna` + `high`，merge-proof 与 local-merge-proof 默认 `gpt-5.6-sol` + `low`；高要求信号使用 `gpt-5.6-sol` + `medium`。
+
+- Given 实现者检查 `pr-create` 与 `pr-merge` When 查阅 direct proof 与 convergence 文案 Then 各入口模型与默认 effort 均与上述 profile 矩阵一致，且高要求信号只在首个 review 进程启动前生效。
+
+- Given 实现者执行静态 CLI 校验 When 分别运行 `codex --strict-config -m gpt-5.6-luna -c 'model_reasoning_effort="high"' review --help` 与 `codex --strict-config -m gpt-5.6-sol -c 'model_reasoning_effort="low"' review --help` Then 命令成功，且不发起真实 review。
+
+## 非功能性验收 / 质量门槛（Quality Gates）
+
+### Testing
+
+- Unit tests: N/A
+- Integration tests: 通过静态 CLI 解析、文档契约审阅与 grep 一致性检查验证
+- E2E tests (if applicable): N/A
+
+### Quality checks
+
+- `git diff --check`
+- `rg -n 'review_model=gpt-5\.6-(luna|sol)|review_effort=(low|medium|high|xhigh)|HIGH_REQUIREMENT_REVIEW' skills/codex-review-loop/SKILL.md skills/project-engineering-workflow/SKILL.md skills/pr-create/SKILL.md skills/pr-merge/SKILL.md`
+
+## 风险 / 开放问题 / 假设（Risks, Open Questions, Assumptions）
+
+- 风险：未来新增 review 入口时可能遗漏共享模型/默认档位；实现时需用目标范围 grep 交叉检查。
+- 假设：`gpt-5.6-luna` 与 `gpt-5.6-sol` 在当前本机 CLI/账号环境可用，静态 CLI 校验可验证参数解析，但不验证服务端账号可用性。
+- 假设：`HIGH_REQUIREMENT_REVIEW=yes` 由外层在启动前根据高要求/疑难事实设置；自由改档只影响启动前的 effort 选择，不改变 profile 或 proof 语义。