@pennixrv/trellis 0.7.1 → 0.7.2-beta.0

package/dist/migrations/manifests/0.7.2-beta.0.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.7.2-beta.0",
+  "description": "收敛 fork 全面审查：Teamwork 恢复、证据、容量、委派与多宿主资产",
+  "breaking": true,
+  "recommendMigrate": true,
+  "changelog": "保留全部尝试证据并提供显式清理；修复实际容量和冻结配置核验；增加证据驱动 reconcile 与失败子集 retry；增加 Codex 等待护栏；补齐委派合同绑定、退役和 ownership recover；修复多宿主阶段提示、受管文件备份及跨生命周期初始化；退休隐式 Marketplace spec 来源，保留显式 registry；修复 npm 异步重试。",
+  "migrationGuide": "使用 beta 渠道精确升级到 0.7.2-beta.0，并运行 trellis update。保持用户自定义 spec 和 config；schema-2 项目忽略退休 YAML 容量键，需按实际冲突合并。默认初始化仅提供规范索引、指南和基于源码的 bootstrap；预制规范必须明确指定 --registry。原计划和旧 schema 报告兼容读取；需要本轮冻结配置和重试合同的新批次请通过 plan 构造器生成。保留全部 attempt 报告和 worklog，清理须使用 cleanup-artifacts 的预览摘要。",
+  "aiInstructions": "不要覆盖自定义规范或重开旧终态批次。使用原生 reconcile/retry/cleanup-artifacts/delegate-bind/delegate-reconcile/transfer recover；未知进程保持围栏。CLI 控制 FIFO，主代理静默续接同一等待句柄；Hook 不保证阻止普通模型消息或宿主唤醒。",
+  "migrations": [],
+  "notes": "保持 beta 渠道，0.7.2-beta.0 高于 stable 0.7.1；latest 标签保持不变。"
+}

package/dist/templates/claude/hooks/statusline.py

@@ -136,14 +136,19 @@ def _get_current_task_for_input(trellis_dir: Path, cc_data: dict) -> dict | None
 
 
 def _count_active_tasks(trellis_dir: Path) -> int:
-    """Count non-archived task directories with valid task.json."""
+    """Count planning and in_progress tasks using the native bounded reader."""
     tasks_dir = trellis_dir / "tasks"
     if not tasks_dir.is_dir():
         return 0
     count = 0
-    for d in tasks_dir.iterdir():
-        if d.is_dir() and d.name != "archive" and (d / "task.json").is_file():
-            count += 1
+    scripts_dir = trellis_dir / "scripts"
+    if str(scripts_dir) not in sys.path:
+        sys.path.insert(0, str(scripts_dir))
+    from common.tasks import iter_active_tasks  # type: ignore[import-not-found]
+    try:
+        count = sum(1 for task in iter_active_tasks(tasks_dir) if task.status in {"planning", "in_progress"})
+    except (ValueError, OSError):
+        return 0
     return count
 
 

package/dist/templates/codex/hooks/session-start.py

@@ -232,8 +232,7 @@ def _get_task_status(trellis_dir: Path, hook_input: dict) -> str:
     if not active.task_path:
         return (
             "Status: NO ACTIVE TASK\n"
-            "Next: Classify the current turn and ask for task-creation consent "
-            "before creating any Trellis task."
+            "Next: Route through trellis-request-intake using the existing authorization and taskless contract."
         )
 
     task_ref = active.task_path
@@ -245,12 +244,10 @@ def _get_task_status(trellis_dir: Path, hook_input: dict) -> str:
         )
 
     task_json_path = task_dir / "task.json"
-    task_data: dict = {}
-    if task_json_path.is_file():
-        try:
-            task_data = json.loads(task_json_path.read_text(encoding="utf-8"))
-        except (json.JSONDecodeError, PermissionError):
-            pass  # Optional task metadata; fall back to generic status.
+    from common.io import read_json_checked  # type: ignore[import-not-found]
+    task_data, _reason = read_json_checked(task_json_path)
+    if task_data is None or task_data.get("status") not in ("planning", "in_progress", "completed", "cancelled"):
+        return f"Status: TASK_ERROR\nTask: {task_ref}\nNext: Repair the existing task record through its owner before continuing; do not create a replacement task."
 
     task_title = task_data.get("title", task_ref)
     task_status = task_data.get("status", "unknown")
@@ -380,13 +377,15 @@ def _build_compact_current_state(
     active = _resolve_active_task(trellis_dir, hook_input)
     if active.task_path:
         task_dir = _resolve_task_dir(trellis_dir, active.task_path)
-        status = "unknown"
+        status = "task_error"
         task_json = task_dir / "task.json"
         if task_json.is_file():
             try:
                 data = json.loads(task_json.read_text(encoding="utf-8"))
                 if isinstance(data, dict):
-                    status = str(data.get("status") or "unknown")
+                    value = data.get("status")
+                    if value in ("planning", "in_progress", "completed", "cancelled"):
+                        status = value
             except (json.JSONDecodeError, OSError):
                 pass  # Optional task metadata; fall back to generic status.
         lines.append(f"Current task: {_repo_relative(repo_root, task_dir)}; status={status}.")
@@ -504,11 +503,15 @@ def main() -> None:
         hook_input = json.loads(sys.stdin.read())
         if not isinstance(hook_input, dict):
             hook_input = {}
-        project_dir = Path(_normalize_windows_shell_path(hook_input.get("cwd", "."))).resolve()
+        raw_cwd = hook_input.get("cwd")
+        project_dir = Path(_normalize_windows_shell_path(raw_cwd if isinstance(raw_cwd, str) and raw_cwd else ".")).resolve()
     except (json.JSONDecodeError, KeyError):
         hook_input = {}
         project_dir = Path(".").resolve()
 
+    project_dir = next((candidate for candidate in (project_dir, *project_dir.parents) if (candidate / ".trellis").is_dir()), None)
+    if project_dir is None or not (project_dir / ".trellis" / "scripts" / "common" / "active_task.py").is_file():
+        return
     configure_project_encoding(project_dir)
 
     trellis_dir = project_dir / ".trellis"

package/dist/templates/codex/hooks.json

@@ -36,6 +36,16 @@
       }
     ],
     "PreToolUse": [
+      {
+        "matcher": ".*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "{{PYTHON_CMD}} -X utf8 .codex/hooks/guard-teamwork-wait.py",
+            "timeout": 15
+          }
+        ]
+      },
       {
         "matcher": "Edit|Write",
         "hooks": [

package/dist/templates/common/bundled-skills/trellis-decision-space-construction-and-merging/workflow.md

@@ -4,6 +4,8 @@
 
 需要构造时，梳理决策项及其权限、候选、重要排除项与理由；按需补齐证据、适用约束、标准、阈值、依赖、影响和优先级。证据足够时给出推荐；证据不足则保留未知或待决项，不伪造结论。仅当选择之间存在条件依赖时使用决策树，并标明分支条件、来源、未知路径及其下游影响。互斥、共享依赖或汇合关系可用依赖图；独立候选用比较表或清单即可。
 
+候选尚未覆盖实质选择时，从不同机制、责任边界或运作方式拓宽，而非只列同一做法的参数变体；适用时纳入维持现状或不做。再以已确认约束、当前实现、外部先例及必要的有界探针筛选，区分不可行、代价较高与证据不足，保留排除理由及依赖后果。重要选择已可比较、未知已定位到受影响的决定时停止；不凑候选数量，不在没有新证据时追加轮次。目标变化回第一阶段，用户保留决定整理给第三阶段，不由辅助 Skill 提前锁定。
+
 新颖机制、重大重构、跨组件边界变化或关键取舍缺少可信本地先例时，进行有界的 `prior-art review`，记录适用性与采纳或排除理由。只读 Teamwork 可按需补充证据；主代理核验报告后归并。将 `DecisionSpace` 或有据跳过记录交由 Trellis CLI 接受，待用户决定交由解决方案设计与收敛阶段处理。
 
 ```mermaid

package/dist/templates/common/bundled-skills/trellis-goal-exploration-and-requirements/workflow.md

@@ -4,6 +4,8 @@
 
 整理目标、范围、成功条件、关键约束和责任方。区分已知事实、假设、证据冲突和未知事项；缺少会改变目标或路线的用户事实时，通过 `pennix-decision-grill` 同步询问。记录会阻断推进的问题及恢复条件；不影响当前路线的事项可明确责任方和后续处理。
 
+当请求只描述症状、先给出解法或目标含糊时，先对照实际使用情境、当前行为与期望结果，必要时回述问题，检验是否过早限定了解法。区分硬约束与可挑战的惯例、未经证实的假设；只追查会改变本轮目标、范围或成功条件的信息。明确本轮要改变什么、怎样观察成功、哪些不做及哪些未知仍有实际影响后即可收敛，不强制访谈轮数或将开放问题缩成 MVP。已知目标直接复用，没有价值或不宜继续也可形成适用的分析路线。
+
 形成 `phase_output`，至少包含当前目标与需求基线、必要证据、不确定性、`phase_result` 和非约束性的 `route_advice`。`route_advice` 简要说明任务类型、复杂度画像和项目背景如何影响阶段选择，并记录复杂度判断的实际触发维度与理由；不机械计分或套用固定路由矩阵，也不要求固定字段或篇幅。路线发生变化时，使用 Trellis CLI 更新受影响的分类和阶段，并按影响范围重新核验。阶段可等待用户补充或因依赖阻塞；只有用户确认当前基线且阶段产物有效时，才以 `accepted` 离开本阶段。将阶段产物及引用提交 Trellis CLI 核验后，向用户展示简明基线并请求确认或修订。
 
 ```mermaid

package/dist/templates/common/bundled-skills/trellis-meta/SKILL.md

@@ -66,7 +66,7 @@ Do not assume the user has the Trellis source repository. Do not default to modi
 - `.trellis/workflow.md` is the local workflow source of truth. By default, `trellis init` writes the bundled `native` workflow; a custom workflow is available only when its source is explicitly supplied, and can be re-selected via `trellis workflow --template <id> --workflow-source <source>`. Missing `.trellis/agents/<name>.md` files referenced by the active template trigger a non-blocking stderr warning pointing at `trellis update`.
 - `.trellis/config.yaml` is the project-level Trellis configuration entry point. It hosts task lifecycle hooks (`hooks.after_create` / `after_start` / `after_finish`), journal shape (`session_commit_message` / `max_journal_lines` / `session_auto_commit`), Teamwork teammate guard (`teamwork.teammate_guard.idle_timeout` / `max_live_teammates`), Codex dispatch mode (`codex.dispatch_mode: inline | sub-agent`), and the spec registry block (`registry.spec.source` + `registry.spec.template`).
 - `.trellis/spec/` stores the user's project-specific coding conventions and design constraints. When `registry.spec` is set, files are refreshed by `trellis update`; local edits surface as `modified by user` conflicts in `.trellis/.template-hashes.json`.
-- `.trellis/tasks/` stores task records, planning artifacts, research, and JSONL context. Tasks remain in place after completion or cancellation. Tasks form parent/child trees through `task.py create --parent`, `add-subtask`, `remove-subtask`, and `list-context`.
+- `.trellis/tasks/` stores task records, planning artifacts, research, and JSONL context. Tasks follow their status directory: planning, in_progress, completed/YYYY-MM, or cancelled. Native relocation preserves identity and history and updates machine references transactionally. Tasks form parent/child trees through `task.py create --parent`, `add-subtask`, `remove-subtask`, and `list-context`.
 - `.trellis/workspace/` stores **deliberately written** developer journals. Raw cross-session dialogue is **not** stored here — it lives on disk under `~/.claude/projects/`, `~/.codex/sessions/`, and `~/.pi/agent/sessions/` and is recovered via `trellis mem search|extract|context`. The bundled `trellis-session-insight` skill teaches when to reach for `mem`.
 - `.trellis/agents/teammate.md` is the bundled, platform-agnostic instruction card loaded for a teammate by `trellis teamwork spawn --agent teammate`. Editable; `trellis update` backfills it if missing. Editing the per-platform `trellis-implement.md` / `trellis-check.md` does **not** change Teamwork teammate behavior.
 - `~/.trellis/teamwork/<project>/<session>/events.jsonl` is the Teamwork Session event log. User-owned, file-locked sequence numbering, durable `idempotencyKey` support; never under `.trellis/`.

package/dist/templates/common/bundled-skills/trellis-meta/references/customize-local/add-project-local-conventions.md

@@ -9,7 +9,7 @@ Often the user does not need to change Trellis mechanics; they need local AI to
 | Rules code must follow | `.trellis/spec/<layer>/` |
 | Cross-layer thinking methods | `.trellis/spec/guides/` |
 | AI capability for a project-specific flow | Platform-local skill |
-| One-off task material | `.trellis/tasks/<task>/` |
+| One-off task material | `.trellis/tasks/<task-dir>/` |
 | Session summary | `.trellis/workspace/<developer>/journal-N.md` |
 
 ## Create A Project-Local Skill

package/dist/templates/common/bundled-skills/trellis-meta/references/customize-local/change-context-loading.md

@@ -17,11 +17,11 @@ Context loading determines when AI reads workflow, task, spec, research, workspa
 | Source | Purpose |
 | --- | --- |
 | `.trellis/workflow.md` | Workflow and next-action hints. |
-| `.trellis/tasks/<task>/prd.md` | Current task requirements. |
-| `.trellis/tasks/<task>/design.md` | Complex task technical design. |
-| `.trellis/tasks/<task>/implement.md` | Complex task execution plan. |
-| `.trellis/tasks/<task>/implement.jsonl` | Spec/research to read before implementation. |
-| `.trellis/tasks/<task>/check.jsonl` | Spec/research to read during checking. |
+| `.trellis/tasks/<task-dir>/prd.md` | Current task requirements. |
+| `.trellis/tasks/<task-dir>/design.md` | Complex task technical design. |
+| `.trellis/tasks/<task-dir>/implement.md` | Complex task execution plan. |
+| `.trellis/tasks/<task-dir>/implement.jsonl` | Spec/research to read before implementation. |
+| `.trellis/tasks/<task-dir>/check.jsonl` | Spec/research to read during checking. |
 | `.trellis/spec/` | Project specs. |
 | `.trellis/workspace/` | Session records. |
 | git status | Current working tree changes. |

package/dist/templates/common/bundled-skills/trellis-meta/references/customize-local/change-task-lifecycle.md

@@ -1,6 +1,6 @@
 # Change Local Task Lifecycle
 
-Read the installed project's workflow and task record before changing task creation or lifecycle behavior. Task records remain in .trellis/tasks/ after completion or cancellation; Trellis does not archive task records.
+Read the installed project's workflow and task record before changing task creation or lifecycle behavior. 任务目录由 status 投影到 planning、in_progress、completed/YYYY-MM、cancelled；完成或取消必须通过原生事务同步移动、引用与会话清理，不能只改字段或手工移动目录。
 
 ## Read these files first
 
@@ -9,7 +9,8 @@ Read the installed project's workflow and task record before changing task creat
 3. .trellis/scripts/task.py
 4. .trellis/scripts/common/task_store.py
 5. .trellis/scripts/common/task_workflow.py
-6. The current task's task.json
+6. .trellis/scripts/common/task_layout.py and task_move.py
+7. The current task's task.json
 
 ## Common edit points
 

package/dist/templates/common/bundled-skills/trellis-meta/references/customize-local/overview.md

@@ -29,7 +29,7 @@ This directory is for local AI working in a user project where Trellis was insta
 | --- | --- |
 | Workflow | `.trellis/workflow.md` |
 | Project configuration | `.trellis/config.yaml` |
-| Task material | `.trellis/tasks/<task>/` |
+| Task material | `.trellis/tasks/<task-dir>/` |
 | Project specs | `.trellis/spec/` |
 | Runtime scripts | `.trellis/scripts/` |
 | Platform integration | `.claude/`, `.codex/`, `.cursor/`, `.opencode/`, `.zcode/`, and similar directories |

package/dist/templates/common/bundled-skills/trellis-meta/references/local-architecture/context-injection.md

@@ -9,7 +9,7 @@ Trellis context injection aims to make AI read the right files at the right time
 | session context | `.trellis/scripts/get_context.py` | Current developer, git status, active task, active tasks, journal, packages. |
 | workflow context | `.trellis/workflow.md` | Current Trellis flow and next action. |
 | spec context | `.trellis/spec/` + task JSONL | Specs that must be followed during implementation/checking. |
-| task context | `.trellis/tasks/<task>/prd.md`, `design.md`, `implement.md`, `research/` | Current task requirements, design, execution plan, and research. |
+| task context | `.trellis/tasks/<task-dir>/prd.md`, `design.md`, `implement.md`, `research/` | Current task requirements, design, execution plan, and research. |
 | platform context | Platform hooks/settings/agents | Lets different AI tools read the files above through their own mechanisms. |
 
 ## session-start

package/dist/templates/common/bundled-skills/trellis-meta/references/local-architecture/multi-agent-teamwork.md

@@ -8,7 +8,9 @@
 | --- | --- |
 | `~/.trellis/teamwork/<project>/<session>/events.jsonl` | Durable Teamwork Session event log. |
 | `.trellis/agents/teammate.md` | Generic behavior card loaded for a teammate. |
-| `.trellis/agents/teammate-profiles.json` | Provider and execution profiles. |
+| `.trellis/agents/teammate-profiles.json` | Schema-2 professional profiles and named execution candidates. |
+| `.trellis/agents/profiles/*.md` | Six professional role cards combined with the common card. |
+| `.trellis/teamwork.json` | Coordination mode and member-count defaults. |
 | `.trellis/config.yaml` (`teamwork.*`) | Teammate concurrency and process guard settings. |
 | `packages/core/src/teamwork/` | Reusable Teamwork Session event and storage APIs. |
 | `packages/cli/src/commands/teamwork/` | CLI commands, provider adapters, and process supervision. |
@@ -25,7 +27,17 @@ The storage root defaults to `~/.trellis/teamwork`; `TRELLIS_TEAMWORK_ROOT` over
 
 ## Configuration
 
-The project configuration supports `teamwork.teammate.max_concurrency` and `teamwork.teammate_guard.idle_timeout`, `max_live_teammates`, and `non_batch_reserved`. Defaults and CLI overrides are defined by the current Trellis CLI; read `packages/cli/src/commands/teamwork/teammate-config.ts` before changing them.
+The schema-2 `.trellis/teamwork.json` owns mode member defaults, mode concurrency limits, and the shared live-process budget and reservation. Defaults are members 1/3/3, concurrency 8/3/3, live budget 8, and reservation 0. YAML retains `teamwork.teammate_guard.idle_timeout`; legacy YAML capacity applies only before schema-2 migration and is otherwise ignored with diagnostics. Runtime `maxConcurrency` is a resolved value, not an independent configuration. Read `coordination.ts` and `teammate-config.ts` before changing this policy.
+
+`teamwork config` resolves project defaults. `teamwork plan` freezes profile,
+configuration, instructions and evidence into schema-2 plan/brief artifacts;
+`teamwork batch --task` connects the foreground coordinator to Codex app-server,
+Claude CLI, Copilot ACP or DSH ACP. Claims and content reports are schema 2.
+An unresolved batch keeps a durable project capacity reservation, including
+after coordinator exit. The guard and session cleanup preserve that evidence.
+Role read-only and history-use requirements are behavioral contracts; runtime
+capabilities do not claim filesystem or memory isolation. Teamwork is independent
+of Paseo workspaces, Git worktrees and source-writing delegated agents.
 
 ## Related entry points
 

package/dist/templates/common/bundled-skills/trellis-meta/references/local-architecture/task-system.md

@@ -1,6 +1,6 @@
 # Local Task System
 
-Tasks live under .trellis/tasks/. A task record keeps its artifacts and history in place after completion or cancellation; Trellis does not move tasks into an archive.
+任务按状态存放于 `.trellis/tasks/planning/<task>`、`in_progress/<task>`、`completed/YYYY-MM/<task>`、`cancelled/<task>`。`task.json.status` 是唯一状态事实；目录只投影状态，不增加第五种状态。创建进入 planning，获准实施的 start 进入 in_progress，complete 进入当月 completed，cancel 进入 cancelled。任务身份和父子关系不因移动改变。
 
 ## Task records
 
@@ -27,7 +27,13 @@ The active task pointer is scoped to an AI session under .trellis/.runtime/sessi
 
 Use phase operations through task.py phase for artifact revisions, acceptance, evidence-backed skips, waits, blocks, resume, return, route, and authorization. Consult task.py help for current arguments. Completion and cancellation occur only after Delivery Review and On-Site Closeout Phase.
 
-The read-only trellis task progress command summarizes planning, in_progress, and completed lifecycle records. It does not change task state.
+The read-only trellis task progress command summarizes planning, in_progress, completed, and cancelled lifecycle records, with a partial flag for unreadable or inconsistent input. It does not change task state.
+
+## 布局迁移与恢复
+
+旧平铺目录和 `archive/YYYY-MM` 只能作为显式迁移输入。先运行 `task.py migrate-layout` 预览，再使用 `--apply`；已完成 archive 任务保留原月份，非终态任务按真实状态归位，不伪造完成。`--recover` 恢复未完成事务。重复名称、无效 JSON、符号链接、未知执行资源或交接所有权冲突会阻止迁移；不跳过记录。
+
+移动同步 JSON/JSONL 机器引用、会话指针及 runtime 哈希索引；终态操作在同一事务中清除本任务 runtime。历史正文和正式交接包保留。内容绑定的接受证据或 continuity digest 失效后，通过原生重新接受和 capture 核对，不静默重授历史授权。handoff ownership 在 `consume` 后完成转移；后续普通任务修改不更新交接代次，需要查看现场时使用只读 `transfer status --include-current`。文档中的 `<task-dir>` 指包含状态及必要月份的真实任务相对路径。
 
 ## Context manifests
 

package/dist/templates/common/bundled-skills/trellis-session-insight/references/cli-quick-reference.md

@@ -55,9 +55,10 @@ trellis mem projects
 
 ## Caveats
 
-- **OpenCode adapter is a stub on `0.6.0-beta.*`.** When `--platform` resolves to OpenCode (or `all` and OpenCode would be included), `mem` prints a one-line "reader unavailable" notice and continues with the other platforms. Don't promise OpenCode coverage in your reply until the adapter ships.
+- **OpenCode reads its local SQLite database.** `--include-children` merges supported child-session dialogue for search/context. Historical `--phase` slicing is unavailable for OpenCode: it warns and returns all dialogue. Report unreadable stores or unsupported slices from the actual command result.
 - **`--platform devin` is Cognition Devin CLI** (`~/.local/share/devin/cli/sessions.db`). It is not `trellis init --devin` (Devin Desktop / Cascade) and not Factory Droid.
 - **`--phase` slicing depends on `task.py create` / `task.py start` invocations appearing in the recorded bash calls of the session.** Sessions where the user ran `task.py` from a different terminal — outside the recorded AI loop — will not have phase boundaries. `--phase all` is the safe fallback.
+- **Historical slice names are not native workflow state.** `brainstorm` and `implement` remain valid retrieval flags; they do not identify any of the current five phases, prove acceptance or implementation authorization, or grant task ownership. There is no `--task` filter. Unknown, inapplicable, duplicate, or incomplete flags fail with exit code 2.
 - **`mem` indexes platform JSONL files directly.** If the user has cleared their Claude / Codex / Pi session storage, `mem` cannot recover what is no longer on disk.
 - **`mem` is read-only.** No remote sync, no edits to platform JSONL. Any write you do based on `mem` findings is your own follow-up call into the editing tools available to you.
 

package/dist/templates/common/bundled-skills/trellis-session-insight/references/triggering-patterns.md

@@ -41,7 +41,7 @@ The user resumed work after a gap and the context is implicit.
 - "我们上次做到哪了"
 - "接着昨天那个任务"
 
-Reach: `trellis mem list --task <current-task-dir>` to find the most recent sessions tied to the active task, then `extract` the last one.
+Reach: first read the current task's native phase, ownership, and recorded progress. Use `trellis mem list --cwd <project-root>` and `search "<task-id or distinctive topic>" --cwd <project-root>` to find candidate sessions, then inspect them with `context` or `extract`. The CLI has no `--task` filter; project membership and recency do not prove that a session owns the task. History supplements current task state and does not transfer ownership.
 
 ## Familiar-bug debugging
 
@@ -80,7 +80,7 @@ The user explicitly wants to look back at this task — not as a forced step, on
 - "记一下这次踩的坑"
 - "复盘下这个任务"
 
-Reach: identify the current task's session id (from `.trellis/.runtime/sessions/*.json` or `mem list --task <task-dir>`), then `extract <id> --phase brainstorm` and `--phase implement`. Present a summary — surface concrete file:line citations where possible. Whether to also write the summary somewhere (PRD, spec, notes file) is the user's call; offer, don't auto-write.
+Reach: use the task's recorded host session identifier as a candidate, or search its distinctive topic within `--cwd <project-root>`, then verify the session content. `extract <id> --phase brainstorm` and `--phase implement` are historical dialogue slices based on recorded create/start calls, not the current five workflow phases; use `--phase all` when those boundaries do not apply. Present concrete citations where possible. Write findings only to an authorized natural task or knowledge location.
 
 ## Anti-patterns: do NOT reach for `mem` here
 

package/dist/templates/common/bundled-skills/trellis-solution-design-and-convergence/workflow.md

@@ -6,6 +6,14 @@
 
 判断当前结果：分析交付形成 `analysis_conclusion`；不继续形成 `no_go`；延期形成带责任方、触发条件和恢复位置的 `deferred`，留在解决方案设计与收敛阶段；实施路线形成 `implementation_contract`，明确目标、范围和接受条件，并按路线需要补足实施与核验信息。只有交付物具有独立实施或集成边界时才拆分工作包，并说明推进和协作所需的依赖、顺序、责任或集成信息；单一交付不人为拆分工作包。解决方案设计与收敛阶段的结果接受与实施授权分开记录；只有合同及明确批准均有效时，Trellis CLI 才允许进入任务实施与测试验证阶段。
 
+合同结果已接受、实施尚未授权时，发现需要返修，应通过 `task.py phase return` 回到本阶段或更早受影响阶段，记录理由和证据。受影响的接受与授权随之失效；修订后重新接受当前产物，再核验实施授权。
+
+接受 `implementation_contract` 前，在合同中建立 `## 验收覆盖` 表，表头为 `接受条件 | 工作包 | Owner | 验证入口 | 交付证据 | 停止条件`。逐条映射已接受条件，核对实际源码 owner、可运行验证、证据落点和停止条件；单一工作包可以覆盖多条条件。CLI 仅检查表结构及非空内容，不能代替语义审查。目标、合同、决策与执行记录分别使用明确的文件引用，执行细节追加到 execution 或 research，避免修改已接受的上游合同。
+
+逐项决定回答后，将已决目标、候选依据、接口与数据流、owner、依赖顺序、实施和验证，以及适用的迁移、发布、资源和失败恢复安排组织为一个完整方案。核对需求覆盖、跨产物一致性、可实施性和可验收性；有净收益时使用有界反例或压力测试，先修复可查缺口。向用户展示可识别的整体方案和实质剩余取舍后，再记录当前 revision 的接受及实施授权。逐项答复不自动等于整体批准；用户已充分明确批准整体方案时不重复索取。目标或候选问题回最早受影响阶段，局部方案问题在本阶段解决，不增设外部封口状态。
+
+研究、原型和协作证据写回现有阶段产物、research 或 execution 自然落点，注明来源与版本、事实和假设、适用性、限制及决定影响。证据足够即停止扩搜；工具、报告或模板不能替代用户决定和 Trellis 原生接受事实。
+
 ```mermaid
 flowchart TD
   input["核对需求基线与已接受的 DecisionSpace"] --> decisions{"存在尚待用户决定的实质取舍？"}

package/dist/templates/common/bundled-skills/trellis-spec-bootstrap/references/mcp-setup.md

@@ -2,6 +2,8 @@
 
 GitNexus and ABCoder are recommended when bootstrapping Trellis specs because they expose architecture and AST context to the agent. They are tool choices, not platform requirements. Configure them through whatever MCP mechanism your agent host provides.
 
+First discover the project's approved, available tools and existing indexes. Use source and tests directly when no suitable index is available; record that limit. Spec bootstrapping does not authorize installing tools, configuring MCP servers, downloading executables, or creating or refreshing indexes. The setup examples below apply only after those operations have separate authorization and the target repository is explicit. Prefer an already installed, pinned owner entry point over an unpinned download.
+
 ## GitNexus
 
 GitNexus builds a code knowledge graph from the repository. Use it for module boundaries, execution flows, dependency relationships, blast radius, and graph queries.
@@ -15,7 +17,7 @@ npx gitnexus analyze
 # Check index status.
 npx gitnexus status
 
-# Re-index after code changes when the analysis is stale.
+# Re-index only when explicitly authorized for this repository.
 npx gitnexus analyze
 ```
 
@@ -82,7 +84,7 @@ abcoder mcp ~/abcoder-asts
 
 ## Verification
 
-After configuration, verify from the agent host that both MCP servers are visible. Then run one simple query against each server before starting the spec writing pass.
+After an authorized configuration change, verify the selected MCP server from the agent host and run a simple query. Neither server is mandatory; unavailable tooling does not block a source-backed spec pass.
 
 ```bash
 ls .gitnexus/meta.json

package/dist/templates/common/bundled-skills/trellis-spec-bootstrap/references/spec-task-planning.md

@@ -14,7 +14,7 @@ Avoid artificial decomposition. A small library usually needs one focused spec p
 
 ## Task Shape
 
-When a Trellis task is useful, write a concise PRD with these sections:
+Reuse the current task when the spec work belongs to its authorized scope. Otherwise route the request through request-intake and the project's native phases. The following is an example of useful coverage; preserve the project's actual artifact structure rather than requiring a new PRD or these exact headings:
 
 ```markdown
 # Fill <package-or-layer> Trellis Specs
@@ -55,7 +55,7 @@ If the host supports subagents, helpers can inspect independent packages or run
 Helper tasks must have clear ownership:
 
 - Read-only research tasks may inspect any source needed for the assigned scope.
-- Write tasks should own disjoint spec directories.
+- Native helper write tasks require explicit project authorization and disjoint spec directories. Trellis Teamwork teammates remain in their research, review, or verification role and return findings in the assigned format; the coordinator applies accepted spec edits.
 - Verification tasks should check placeholder removal, broken links, and consistency.
 
 Do not encode helper-agent names, vendor-specific commands, or platform-specific routing in the skill. Put only the required work and acceptance criteria in the task.

package/dist/templates/common/bundled-skills/trellis-task-implementation/workflow.md

@@ -2,6 +2,10 @@
 
 开始前核验当前 `implementation_contract`、实施授权、路线 revision、必要依赖和执行基线。使用 `trellis-before-dev` 读取目标仓库实际适用的规范；按组件 owner 合同选择主工作树或已批准的独立写入路线。调用项目任务 `start` 只在实施授权有效时将任务置为 `in_progress`。
 
+实施阶段为 `blocked` 或 `waiting_user` 时，先解决阻塞并经原生 `phase resume` 恢复，再重新核验准入。`delegate-start` 核验父任务已有的 ownership 围栏和子任务状态；存在未消费交接、当前会话不符合已有 ownership 记录，或子任务已完成、取消时，不启动或复用委派执行。没有 ownership 记录的任务不具备默认会话独占保护。
+
+父授权有效后，用 `task.py delegate-bind <child>` 绑定子 PRD、角色、Git base、分支和结果路径，再用 `delegate-start` 启动。输入漂移须先核对是否仍在父授权范围内，再重新绑定。失联现场先用 `delegate-reconcile` 预览，证据充分时才显式 `--execute --reason ... --approval-ref ...` 核销，不能直接覆盖旧映射。
+
 按合同的依赖和优先级选取当前工作包，实施满足目标的最小变更，并运行与风险和影响相称的局部验证。主工作树主代理核对来源、revision、Git 基线、差异和结果后接受工作包。多包任务按合同集成；单一交付不人为拆分。Trellis Teamwork 仅用于冻结计划下的只读比较或评议，不能改写任务状态或接受实施结果。实际写入委派依父任务规定使用 Trellis 受控入口与 Paseo；各组件源码仍在 owner 仓库内修改。
 
 局部失败、暂时不可用或当前状态已满足接受条件时，先在任务实施与测试验证阶段中处理。依赖或资源暂不可用且现场安全时记录恢复条件；未授权不产生外部副作用；未知现场先停止并核验。合同允许未运行验证且风险可接受时，记录原因、影响和替代证据。替代路线若改变授权、成本、隐私或接受条件，回到解决方案设计与收敛阶段；目标、范围变化按影响回到目标探索与需求核对阶段或决策空间构造与归并阶段。只有合同范围内工作包均已接受、适用必需验证完成或有有效未运行处置、按范围和风险需要的集成验证通过，才将交付候选交由交付审查与现场收尾阶段；仅当路线实际创建或委派资源时，才核验其处置事实。
@@ -26,4 +30,6 @@ flowchart TD
 
 ### 委派、回退与收敛
 
+合同不变的局部修复在当前活动阶段处理；需要撤销实施或交付接受事实时，使用 `phase return --return-kind execution_rework` 并提供原因、证据及目标阶段。仅在需求、合同摘要、路线和依赖仍有效时保留实施授权；CLI 拒绝时核对真实失效原因，不重复索取已有效的用户决定。合同实质变化使用默认 `contract_change` 回到最早受影响阶段并重新接受、授权。终态任务先经独立的 `reopen` 恢复到 `planning`，再操作工作流阶段；重开不复用旧授权。
+
 回退使用当前 owner 的 Git 和资源合同，不覆盖无关改动，也不删除仍需核验的现场。只有当前合同无法安全覆盖目标、授权、依赖、基线、接受条件或停止条件的变化时，才回退到最早受影响阶段。结束任务实施与测试验证阶段前，记录适用验证结果、未运行处置、合同差异和未结发现；仅当路线实际创建或委派资源时，记录其处置状态。

package/dist/templates/common/bundled-skills/trellis-teamwork/SKILL.md

@@ -22,6 +22,7 @@ trellis --version
 trellis teamwork --help
 trellis teamwork list --all
 trellis teamwork list --scope global --all
+trellis teamwork config
 ```
 
 If the user names a Teamwork Session or thread, inspect it before asking for
@@ -37,8 +38,12 @@ trellis teamwork context list <session> --scope global --thread <thread>
 
 | User intent | Read |
 |---|---|
+| `general`: bounded research, review, or verification assignments | `references/teamwork-plan-construction.md`, then `references/coordination-modes.md` |
+| Advisor: one to three bounded consultations | `references/coordination-modes.md`, then `references/teamwork-plan-construction.md` |
+| `committee`: parallel assessment by two or three distinct lenses | `references/coordination-modes.md`, then `references/teamwork-plan-construction.md` |
+| Profile, model, provider, reasoning effort, or role-card configuration | `references/teammate-configuration-matrix.md` |
 | “和 codex/claude 讨论一下”, “brainstorm with another agent” | `references/teamwork-plan-construction.md`, then `references/coordination-modes.md` |
-| “派一个 implement/check agent”, “让 agent review”, “spawn a worker” | `references/teamwork-plan-construction.md`, then `references/teammate-processes.md` |
+| “派 teammate 做研究或验证”, “让 agent review”, “spawn a worker” | `references/teamwork-plan-construction.md`, then `references/teammate-processes.md` |
 | “开 issue 区 / topic 群 / changelog / board”, “make a forum” | `references/teamwork-plan-construction.md` |
 | “看看这个 thread”, “inspect a thread” | `references/teamwork-plan-construction.md` |
 | “Teamwork 卡住了 / 没输出 / progress 被截断”, “teammate stalled” | `references/teammate-processes.md` |
@@ -46,14 +51,24 @@ trellis teamwork context list <session> --scope global --thread <thread>
 
 ## Core Rules
 
+- Teammates provide research, review, verification, evidence, and advice under a role contract; they do not implement product code. Coding tools or provider permission modes do not grant that role authority. Return results in the assigned format and let the coordinator review them.
+- `general`, `advisor`, and `committee` are coordination modes, independent from profiles, providers, `run`, batch execution, and forum sessions. Read project defaults with `teamwork config`; construct a frozen plan with `teamwork plan` and execute it with `teamwork batch --task <task-dir>`.
+- For a managed batch, invoke one foreground `teamwork batch --json` command and wait for its receipt. The CLI owns FIFO admission, capacity, provider waits, retries, cancellation, report validation, and settlement; the main agent must not schedule per-assignment waits or retries.
+- If the host yields that call, silently continue its original handle. Do not emit repetitive progress, query status, start unrelated work, or create another batch. Host continuation is not CLI scheduling. Codex ships a native wait projection and PreToolUse guard for supported tool events; neither prevents model wake-ups or ordinary model messages. After a lost coordinator, use native `teamwork reconcile` and retain reservations until process exit is proven.
+- Agent/program callers must use `run --json`, `batch --json`, or `wait --json --from <worker>` for final results. Default run text and default wait events are compatibility/operator views. Read `execution`, every `reports[].validation` and content status, then perform semantic review; `done`, exit zero, `complete`, and `ALL_ACCEPTED` alone do not accept a task result. `semanticValidation: not_run` explicitly leaves that decision to the main agent.
+- Tool permissions are automatically allowed; the default Codex launch has no sandbox. Source/Git, memory, and delegation boundaries are prompt obligations. Do not add tool/path permission gates or describe the role as technical isolation.
+- Initialization carries common/professional rules and the mode-specific result contract. Task messages carry task data, acceptance and exact identity/path references. Context manifests may choose inline, required full reading, or on-demand references; reference text never becomes system instructions. ACP has user content only and cannot claim system priority.
+- A batch runtime continuation waits on the same provider process under the same frozen deadline. It does not send another provider prompt or consume a full-attempt retry. A live `teamwork wait` host-tool continuation is a separate interactive-session workflow.
+- Select one of the six professional profiles and one of its named configurations. For multiple teammates, consider the second and third candidates and record the selection reason; using the same configuration is allowed. See the configuration matrix reference before constructing a new plan.
+- Teamwork does not create or operate Paseo workspaces, Git worktrees, or source-writing implementation agents. Those mechanisms remain independent.
 - New forum Teamwork Sessions use `--type forum`. A `thread` is one item inside a forum Teamwork Session.
 - Use `--context-file` / `--context-raw` and `trellis teamwork context add/delete/list`.
 - Use `--stdin` or `--text-file` for long messages. Do not put long mixed Chinese/English text in the positional shell argument.
 - Pretty `messages` output is an operator dashboard and may truncate progress. Use `--raw` for audit.
 - `--as` is the speaker or worker handle, depending on the command. Use explicit, stable names when multiple agents or sessions are involved.
 - `--scope project` (default) operates on the current cwd's project bucket; `--scope global` operates on the shared `__global__` bucket. Pick scope deliberately — a global board is invisible from project listings unless `--scope global` is passed.
-- For brainstorm, do multiple pressure-test rounds. One answer plus one confirmation is review, not brainstorm.
-- **Dispatcher wait pattern**: use `--kind done` / `--kind turn_finished` (Trellis-emitted system events), not a user `--tag` as the completion signal. Tags are labels, not runtime completion events.
+- For exploratory discussion, choose distinct questions and pressure-test unresolved assumptions. Continue only while another exchange can change the decision or its evidence; do not require a fixed number of rounds or relabel a confirmation as new evidence.
+- **Dispatcher wait pattern**: use `wait --json --from <worker>` for a final content report. Operator event waits may use `--kind done` / `--kind turn_finished`; tags are labels, not runtime completion events. Resume an outstanding host continuation before any other host action.
 - Teamwork Sessions are event-sourced. Do not parse `events.jsonl` first; use `forum`, `thread`, `messages --thread`, and `context list`.
 - `@pennixrv/trellis-core` owns reusable Teamwork Session/thread state, event append, sequence allocation, context/title projection, reducers, and task helpers. The CLI owns flags, terminal rendering, prompts, teammate lifecycle, and process exits.
 - Teamwork plan construction belongs to the current phase coordinator. Teamwork validates and executes a frozen plan; it does not select the task phase, change task status, or create a second task state machine.

package/dist/templates/common/bundled-skills/trellis-teamwork/references/coordination-modes.md

@@ -3,6 +3,29 @@
 The plan's `coordination_mode` selects the call shape. It is independent from
 the teammate role, execution profile, and Teamwork Session type.
 
+All modes use the same schema-2 content report and common `--json` result
+envelope. Mode selection does not waive result validation or main-agent
+semantic review. It also does not transfer FIFO or process control to a model.
+
+Project defaults live in `.trellis/teamwork.json`: general defaults to one
+member, advisor to three, and committee to three. Schema 2 also owns the mode
+concurrency limits (general 8, advisor 3, committee 3) and the shared live-process
+budget (8, with 0 reserved for non-batch work). Read them with
+`trellis teamwork config --mode <mode>`. The coordinator uses `defaultMembers`
+when composing assignments; it must write each member explicitly. The runtime
+does not invent assignments or silently duplicate one to reach the default.
+Changing defaults affects only newly constructed plans. Advisor must have one to
+three members, committee two or three, and general one or more within capacity.
+
+Member count guides plan composition; concurrency limits simultaneous work.
+Effective capacity is bounded by the selected mode, requested capacity, shared
+live budget after reservations, and verified host capability. Existing live
+workers and batch reservations share admission control. Environment overrides
+are explicit and reported in `capacityPolicy.diagnostics`. Legacy schema 1 and
+YAML capacity remain readable for compatibility. Schema 2 ignores legacy YAML
+capacity keys with a diagnostic, so a stale YAML limit of 1 cannot silently
+override the new policy. YAML retains idle-cleanup settings.
+
 ## `general`
 
 Use general coordination for one or more independent assignments. Each
@@ -12,8 +35,8 @@ each assignment independently.
 
 ## `advisor`
 
-Use advisor coordination for one bounded consultation. The plan contains
-exactly one assignment and its result is advice for the current coordinator.
+Use advisor coordination for one to three bounded consultations. Each advisor
+returns independent advice for the current coordinator; the default is three.
 The result still carries a source digest and acceptance evidence and does not
 change the task or phase by itself.
 
@@ -22,7 +45,15 @@ change the task or phase by itself.
 Use committee coordination when one question benefits from parallel distinct
 lenses. The plan contains two or three assignments in one evaluation group.
 All members share the assignment contract and use distinct lenses. They return
-independent evidence; the coordinator compares the reports after they finish.
+independently authored reports; the coordinator compares them after they finish.
+Members may cite the same authoritative sources. Distinct lenses do not
+guarantee independent evidence or require different providers, models, or profiles.
+
+`lens` is the member's “本次关注点”, not another role directory. It is optional
+in general and advisor mode. Committee members receive the same task, evidence
+and acceptance contract; they must not read peer reports before submitting
+their own. Profiles and configurations may differ, with a recorded selection
+reason. Paseo workspace and Git worktree collaboration are independent.
 
 Committee members do not debate with one another, run a consensus loop, or use
 a directional counter relationship. If a question does not need independent

package/dist/templates/common/bundled-skills/trellis-teamwork/references/teammate-configuration-matrix.md

@@ -1,31 +1,42 @@
-# Teammate configuration matrix
+# Teammate 配置矩阵
 
-The candidate source for teammate execution settings is the teammate
-configuration matrix. It is a selection input, not a new role system. A
-profile may provide a default provider and model plus provider-specific
-options. The frozen plan stores the selected execution values in the
-`Teammate Execution Configuration` snapshot so a running batch is unaffected
-by later matrix changes.
+配置由项目文件持有，运行时读取；下表解释默认选择，不替代实际文件。
 
-The tuple is:
+| 文件 | 职责 |
+| --- | --- |
+| `.trellis/agents/teammate-profiles.json`，schema 2 | `default_profile`；每个 profile 的 `role`、`default_configuration` 和 2–3 套命名 `configurations` |
+| `.trellis/agents/teammate.md` | 通用角色、只读职责和结果合同 |
+| `.trellis/agents/profiles/<profile>.md` | 精确专业角色卡；普通 Markdown，通过 Trellis 注入，不注册宿主原生角色 |
+| `.trellis/teamwork.json`，schema 2 | `default_mode`；各模式的 `default_members`、`max_concurrency`；`resources` 中的共享进程预算与非 batch 预留 |
+| `.trellis/config.yaml` 的 `teamwork.teammate_guard.idle_timeout` | 空闲清理；旧容量键仅在未迁移到 schema 2 时兼容读取 |
 
-```text
-role + provider + optional profile + model + reasoning effort + options
+默认成员数为 general 1、advisor 3、committee 3；默认并发上限分别为 8、3、3，共享存活进程预算为 8，非 batch 预留为 0。成员数用于构造计划，不要求同时运行；有效并发还受显式请求、共享预算和宿主能力约束。schema 2 不再叠加旧 YAML 容量上限，兼容读取和环境覆盖均在 `capacityPolicy.diagnostics` 中说明。`capacityPolicy` 是解析结果，不是另一套配置。
+
+每套执行配置包含 `provider`、`model`，可选 `reasoning_effort` 和适配器支持的 `options`。上下文长度沿用 provider 默认，不配置 token 或预算机制。`teammate` 是内部执行者类型，公开计划不填写 `role_id`；`lens` 只表示成员的“本次关注点”。
+
+| Profile | 工作职责 | 默认配置 | 第二候选 | 第三候选 |
+| --- | --- | --- | --- | --- |
+| `architecture` | 架构、接口、依赖与取舍 | codex / gpt-6.1-sol / xhigh | copilot / gpt-6.1-sol / xhigh | copilot / claude-opus-5.5 / xhigh |
+| `review` | 基于当前差异的正确性审查 | codex / gpt-6.1-sol / high | copilot / gpt-6.1-sol / high | copilot / claude-opus-5.5 / high |
+| `research` | 外部资料、先例与时效核验 | codex / gpt-6.1-sol / high | copilot / gpt-6.1-sol / high | copilot / claude-sonnet-5.5 / high |
+| `verification` | 独立验收、验证和证据核对 | codex / gpt-6.1-sol / high | copilot / gpt-6.1-sol / high | copilot / claude-sonnet-5.5 / high |
+| `exploration` | 围绕主题探索本地源码、调用和边界 | codex / gpt-6.1-sol / high | copilot / gpt-6.1-sol / high | copilot / claude-sonnet-5.5 / high |
+| `diagnosis` | 针对已知故障验证根因假设 | codex / gpt-6.1-sol / high | copilot / gpt-6.1-sol / high | copilot / claude-opus-5.5 / high |
+
+候选名为 `codex-sol`、`copilot-sol`，以及 `copilot-opus` 或 `copilot-sonnet`。默认 profile 为 `exploration`。先查实际设置：
+
+```bash
+trellis teamwork config --profile architecture --configuration copilot-opus --mode committee
 ```
 
-The role remains `teammate`. Coordination mode is separate from role and
-profile. Supported provider adapters are Codex app-server, DSH ACP, Copilot
-ACP, and Claude Code CLI when their host contracts are available. A provider
-name alone does not prove that its host is installed or verified.
-
-The host capability proof covers only the boundaries required by the selected
-plan: foreground waiting, protected artifact writes, read-only protected
-targets and Git state, disabled native or recursive delegation, isolated
-context, supported transport, and a positive capacity. The CLI refuses a
-dispatch when the selected host cannot prove those properties. It does not
-invent an execution profile or silently change the frozen values.
-
-The bundled role card is `.trellis/agents/teammate.md`. It is provider-neutral
-and limits a teammate to the frozen context and current attempt artifacts. A
-Teamwork teammate is not the native host-created `subagent`; the two have
-different creation paths and contracts.
+成员显式覆盖执行值只作用于该成员，不改项目默认。多成员应考虑同 provider 不同模型、跨 provider 同模型或不同专业的收益，填写 `selection_reason`；不强制异构、不自动轮换、不静默 fallback。`architecture + committee` 可以让 2–3 位架构成员分别使用不同配置。
+
+构造器冻结有效执行值、通用加专业角色指令、模式结果合同、上下文、模式配置摘要和能力摘要。能力的 `evidence: adapter-contract` 说明它来自静态适配器合同，不是已安装后端的成功探测。后续改配置只影响新计划，已有计划执行时不重新解析角色文件；新计划的参考文件在派发前后核对冻结摘要。模型不可用、推理强度未被后端声明或选项不支持时明确失败，并保留实际配置协商阶段及后端声明信息。
+
+四种 transport 为 Codex app-server、Claude Code stream-json、Copilot ACP 和 DSH ACP。Copilot 原生 CLI 支持非交互调用；这里选择 ACP 是为了统一会话、配置与取消回执。DSH 使用 `dsh --profile acp`，恢复使用其声明的 `session/resume`；Copilot 使用 `session/load`。安装、账号和真实调用结果须单独核验，fixture 通过不证明某个后端已可用。
+
+Codex 使用 `developerInstructions`，Claude 使用独立的 append-system-prompt；ACP v1 只有用户内容块，Trellis 将角色与任务放在两个明确区分的纯文本块，但不宣称具有独立 system 优先级。完整角色在同一会话成功完成一轮后不重复发送，恢复或首次失败后重新建立。参考资料通过任务数据通道发送。不会动态改写 `AGENTS.md` 或注册 provider 原生 persona。
+
+源码、Git、递归委派和隐式历史使用限制是角色义务。宿主能力检查只声明实际运行能力：前台等待、受控产物、transport 和容量；不声称完成文件系统只读或记忆隔离。可用工具与宽权限模式不授予 teammate 编写产品代码的职责。
+
+工具权限自动允许，不设置默认沙箱或工具/路径准入限制。Codex 默认 `danger-full-access`、`approvalPolicy: never`；ACP 自动选择后端提供的允许选项。宿主仍可能附加 AGENTS、Skills 和环境记忆，角色摘要不代表整个有效上下文摘要。