@team-agent/installer 0.5.65 → 0.5.68

package/crates/team-agent/src/lifecycle/tests/lane_ops.rs

@@ -3,7 +3,7 @@ use super::*;
 
 // ═════════════════════════════════════════════════════════════════════════
 
-const DELEG_ROLE_ALPHA_COMPAT: &str = "---\nname: alpha\nrole: Alpha Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: compatible_api\nprofile: alpha-compat\ntools:\n  - mcp_team\n---\n\nAlpha.\n";
+const DELEG_ROLE_ALPHA_COMPAT: &str = "---\nname: alpha\nrole: Alpha Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: compatible_api\ndangerously_skip_permissions: false\nprofile: alpha-compat\ntools:\n  - mcp_team\n---\n\nAlpha.\n";
 
 type LaneKills = std::sync::Arc<std::sync::Mutex<Vec<String>>>;
 pub(super) type LaneSpawns = std::sync::Arc<std::sync::Mutex<Vec<(String, Vec<String>)>>>;
@@ -201,7 +201,13 @@ impl crate::transport::Transport for LaneTransport {
         r: crate::transport::CaptureRange,
     ) -> Result<crate::transport::CapturedText, crate::transport::TransportError> {
         Ok(crate::transport::CapturedText {
-            text: String::new(),
+            // A fresh worker has reached the ready prompt by the time this
+            // deterministic lifecycle replay observes its pane.  Returning
+            // the stable ready marker keeps the replay focused on the
+            // single-lock transaction instead of burning the provider's
+            // bounded startup-prompt polling interval on an unobservable
+            // empty screen.
+            text: "OpenAI Codex\n›".to_string(),
             range: r,
         })
     }
@@ -816,7 +822,7 @@ fn current_alias_authority_does_not_leak_into_real_sibling_same_id_retirement()
     );
 }
 
-const CHARLIE_ROLE: &str = "---\nname: charlie\nrole: Charlie Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nCharlie.\n";
+const CHARLIE_ROLE: &str = "---\nname: charlie\nrole: Charlie Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nCharlie.\n";
 
 struct HermeticTestEnv {
     root: std::path::PathBuf,
@@ -1390,9 +1396,11 @@ fn remove_preserves_external_role_source_for_both_flag_forms() {
     }
 }
 
-// A-28 RED: the role markdown recorded for a seat is still a user asset. The
-// default remove path must unregister the seat without deleting the managed
-// registration-path document.
+// A-28 was: default remove must preserve registered managed markdown.
+// ledger.seat-supply-prereq overturned that for files under
+// `.team/dynamic-role-files/` (framework materialization, not user asset).
+// Keep the test name; flip the assertion. External --role-file is covered
+// by `remove_preserves_external_role_source_for_both_flag_forms`.
 #[test]
 fn remove_agent_preserves_registered_role_markdown_by_default() {
     let ws = lanea_ws_agents(json!({
@@ -1417,15 +1425,13 @@ fn remove_agent_preserves_registered_role_markdown_by_default() {
         None,
         &LaneTransport::new("team-laneateam", &[]),
     );
-    assert!(result.is_ok(), "remove-agent should unregister the seat: {result:?}");
     assert!(
-        role.exists(),
-        "A-28: remove-agent must preserve the registered role markdown by default"
+        result.is_ok(),
+        "remove-agent should unregister the seat: {result:?}"
     );
-    assert_eq!(
-        std::fs::read(&role).unwrap(),
-        original,
-        "A-28: remove-agent must preserve the registered role markdown by default"
+    assert!(
+        !role.exists(),
+        "managed role markdown must be gone after remove-agent so the next same-id clone is not blocked"
     );
 }
 
@@ -1455,7 +1461,35 @@ fn remove_preserves_managed_path_symlink_escape() {
     );
     assert!(result.is_ok(), "remove failed: {result:?}");
     assert_eq!(std::fs::read(&external).unwrap(), b"external target\n");
-    assert!(managed.exists(), "symlink escape must be preserved");
+    assert!(
+        !managed.symlink_metadata().is_ok(),
+        "managed symlink must be unlinked; must not follow and delete the external target"
+    );
+}
+
+#[test]
+fn remove_agent_deletes_unrecorded_default_managed_role() {
+    let ws = lanea_ws_agents(json!({
+        "alpha": { "status": "stopped", "provider": "codex", "window": "alpha" },
+        "bravo": { "status": "stopped", "provider": "codex", "window": "bravo" }
+    }));
+    let role = ws.join(".team").join("dynamic-role-files").join("alpha.md");
+    std::fs::create_dir_all(role.parent().unwrap()).unwrap();
+    std::fs::write(&role, b"unrecorded default managed copy\n").unwrap();
+
+    let result = remove_agent_with_transport(
+        &ws,
+        &aid("alpha"),
+        true,
+        true,
+        None,
+        &LaneTransport::new("team-laneateam", &[]),
+    );
+    assert!(result.is_ok(), "remove failed: {result:?}");
+    assert!(
+        !role.exists(),
+        "default managed path must be cleared even when state.dynamic_role_file is unset"
+    );
 }
 
 #[test]
@@ -1659,9 +1693,8 @@ fn lanea_fork_dup_target_leader_id_is_already_exists() {
         fork_agent_with_transport(&ws, &aid("alpha"), &aid("leader"), None, false, None, &tx)
     );
     assert!(
-        text.contains("already exists"),
-        "golden operations.py:301-302 (_find_agent matches the leader): forking ONTO the leader id must raise \
-         'agent id already exists: leader'; Rust skips the dup guard for the leader id and proceeds. got {text}"
+        text.contains("unverified") || text.contains("未验证") || text.contains("refuses --as"),
+        "codex in-window fork is unverified; leader-id duplicate is not reached. got {text}"
     );
 }
 
@@ -1679,9 +1712,11 @@ fn lanea_fork_window_already_exists_guard_before_spec_mutation() {
         fork_agent_with_transport(&ws, &aid("alpha"), &aid("newfork"), None, false, None, &tx)
     );
     assert!(
-        text.contains("tmux window already exists for fork target: team-laneateam:newfork"),
-        "golden operations.py:310-312: a pre-existing target window must raise 'tmux window already exists for \
-         fork target: team-laneateam:newfork' BEFORE spec mutation; Rust has no guard. got {text}"
+        text.contains("unverified")
+            || text.contains("未验证")
+            || text.contains("refuses --as")
+            || text.contains("tmux window already exists for fork target: team-laneateam:newfork"),
+        "codex in-window fork is unverified; window-exists guard is not reached. got {text}"
     );
     let spec_text = std::fs::read_to_string(ws.join("team.spec.yaml")).unwrap();
     assert!(
@@ -1705,9 +1740,8 @@ fn lanea_fork_gate_error_text_and_spec_rollback_on_adapter_arm() {
         fork_agent_with_transport(&ws, &aid("alpha"), &aid("newfork"), None, false, None, &tx);
     let text = format!("{result:?}");
     assert!(
-        text.contains("codex does not support native session fork"),
-        "golden operations.py:329-330: the native-fork gate must raise 'codex does not support native session \
-         fork'; Rust surfaces the generic 'capability unsupported: Codex:fork'. got {text}"
+        text.contains("unverified") || text.contains("未验证"),
+        "codex is unverified (any auth), not 'does not support'. got {text}"
     );
     let spec_text = std::fs::read_to_string(ws.join("team.spec.yaml")).unwrap();
     assert!(
@@ -1736,25 +1770,16 @@ fn lanea_fork_report_session_id_is_not_pane_id() {
         json!(discoverable_source.to_string_lossy().to_string());
     crate::state::persist::save_runtime_state(&ws, &state).unwrap();
     let tx = LaneTransport::new("team-laneateam", &[]);
-    let report =
-        fork_agent_with_transport(&ws, &aid("alpha"), &aid("newfork"), None, false, None, &tx)
-            .expect("fork ok (codex subscription supports fork)");
-    assert_ne!(
-        report.session_id,
-        Some(crate::provider::SessionId::new("%newfork")),
-        "golden operations.py:399,408: report.session_id is the captured provider session id / None, NEVER the \
-         tmux pane id; Rust returns Some(pane_id='%newfork')"
-    );
+    let result =
+        fork_agent_with_transport(&ws, &aid("alpha"), &aid("newfork"), None, false, None, &tx);
+    let err = match result {
+        Err(error) => error.to_string(),
+        Ok(_) => panic!("codex in-window fork is unverified and must refuse"),
+    };
     assert!(
-        report.session_id.is_some(),
-        "a successful fork must carry the verified NEW provider session id"
+        err.contains("unverified") || err.contains("未验证"),
+        "codex must refuse as unverified; got {err}"
     );
-    let state = crate::state::persist::load_runtime_state(&ws).unwrap();
-    let row = &state["agents"]["newfork"];
-    assert!(row["spawned_at"]
-        .as_str()
-        .is_some_and(|value| chrono::DateTime::parse_from_rfc3339(value).is_ok()));
-    assert_eq!(row["spawn_epoch"], serde_json::json!(1));
 }
 
 #[test]

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -31,8 +31,8 @@ struct HermeticTestEnv;
 
 const QS_TEAM_MD: &str =
     "---\nname: quickteam\nobjective: Quick start.\nprovider: codex\n---\n\nQuick-start team.\n";
-pub(super) const QS_VALID_ROLE: &str = "---\nname: implementer\nrole: Implementation Engineer\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nImplement bounded tasks.\n";
-const QS_ROLE_NO_PROVIDER: &str = "---\nname: implementer\nrole: Implementation Engineer\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nImplement bounded tasks.\n";
+pub(super) const QS_VALID_ROLE: &str = "---\nname: implementer\nrole: Implementation Engineer\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nImplement bounded tasks.\n";
+const QS_ROLE_NO_PROVIDER: &str = "---\nname: implementer\nrole: Implementation Engineer\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nImplement bounded tasks.\n";
 
 /// A REAL team dir `<base>/teamdir/{TEAM.md, agents/implementer.md}` — already in team-dir
 /// layout, so quick_start's prepare_quick_start_team returns it as-is and writes the compiled
@@ -57,7 +57,7 @@ fn quick_start_team_dir_with_roles(role_docs: &[(&str, &str)]) -> PathBuf {
 
 fn role_doc(id: &str) -> String {
     format!(
-        "---\nname: {id}\nrole: {id} Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\n{id} worker.\n"
+        "---\nname: {id}\nrole: {id} Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\n{id} worker.\n"
     )
 }
 
@@ -448,7 +448,7 @@ fn add_agent_proceeds_past_owner_gate_and_reaches_recompile() {
     let role = ws.join("w2-role.md");
     std::fs::write(
         &role,
-        "---\nname: w2\nrole: Second Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nSecond worker.\n",
+        "---\nname: w2\nrole: Second Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nSecond worker.\n",
     )
     .unwrap();
     let transport = OfflineTransport::new();
@@ -617,23 +617,8 @@ fn spine_quick_start_seeds_state_under_team_workspace_not_team_dir() {
     );
 }
 
-// #10 — launch dry-run safety is derived from spec.runtime.dangerous_auto_approve (source=runtime_config),
-// NOT a hardcoded Disabled. Golden config.py:effective_runtime_config.
-#[test]
-fn spine_launch_dry_run_safety_reflects_spec_dangerous() {
-    let team = quick_start_team_dir_custom(QS_TEAM_MD_DANGEROUS, QS_VALID_ROLE);
-    let spec_path = compiled_spec_path(&team);
-    let report = launch(&spec_path, true, false, true).expect("dry_run launch");
-    assert!(
-        report.safety.enabled,
-        "safety must reflect spec.runtime.dangerous_auto_approve=true"
-    );
-    assert_eq!(
-        report.safety.source,
-        DangerousApprovalSource::RuntimeConfig,
-        "safety source must be runtime_config when spec-declared"
-    );
-}
+// #10 removed — launch dry-run safety was derived from spec.runtime.dangerous_auto_approve.
+// 0.5.66 bypass 单源:该字段废弃,safety 改由 per-agent `dangerously_skip_permissions` 派生。
 
 // #12 — launch dry-run produces one RoutingDecision PER spec.task via route_task, with the real task id
 // and the route_task reason taxonomy — not one synthetic 'default_assignee' route. Golden core.py:77-88.
@@ -709,7 +694,7 @@ fn e5_add_agent_does_not_copy_role_into_platform_dir_and_injects_into_spec() {
     seed_canonical_team_identity(&team, "teamdir");
     // External role file OUTSIDE team_dir/agents, with recognizable body content.
     let role = team.parent().unwrap().join("w2-external-role.md");
-    let role_body = "---\nname: w2\nrole: Second Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nUNIQUE-E5-BUG1-MARKER body for w2.\n";
+    let role_body = "---\nname: w2\nrole: Second Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nUNIQUE-E5-BUG1-MARKER body for w2.\n";
     std::fs::write(&role, role_body).unwrap();
     let transport = OfflineTransport::new();
     // The spawn may not complete under OfflineTransport; we only assert the no-copy + spec-inject
@@ -749,7 +734,7 @@ fn e5_restart_rebuilds_runtime_spec_from_role_docs() {
                                                  // Edit a role doc AFTER initial compile: change alpha's role text.
     std::fs::write(
         ws.join("agents").join("alpha.md"),
-        "---\nname: alpha\nrole: RENAMED Alpha Role\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nAlpha edited.\n",
+        "---\nname: alpha\nrole: RENAMED Alpha Role\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nAlpha edited.\n",
     )
     .unwrap();
     let transport = OfflineTransport::new();
@@ -974,7 +959,7 @@ fn e5_add_agent_resolves_team_dir_to_role_dir_when_runtime_spec_exists() {
     let role = team.join("w2-role.md");
     std::fs::write(
         &role,
-        "---\nname: w2\nrole: Second Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nw2.\n",
+        "---\nname: w2\nrole: Second Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nw2.\n",
     )
     .unwrap();
     let transport = OfflineTransport::new();
@@ -1563,9 +1548,9 @@ fn quick_start_fresh_ws_spawns_resident_tmux_and_coordinator() {
 // Golden: restart/orchestration.py (Route-B resume spawn), lifecycle/start.py, lifecycle/operations.py.
 // ═════════════════════════════════════════════════════════════════════════
 
-pub(super) const DELEG_ROLE_ALPHA: &str = "---\nname: alpha\nrole: Alpha Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nAlpha.\n";
-pub(super) const DELEG_ROLE_BRAVO: &str = "---\nname: bravo\nrole: Bravo Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nBravo.\n";
-const DELEG_ROLE_WORKER2: &str = "---\nname: worker2\nrole: Second Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nSecond worker.\n";
+pub(super) const DELEG_ROLE_ALPHA: &str = "---\nname: alpha\nrole: Alpha Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nAlpha.\n";
+pub(super) const DELEG_ROLE_BRAVO: &str = "---\nname: bravo\nrole: Bravo Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nBravo.\n";
+const DELEG_ROLE_WORKER2: &str = "---\nname: worker2\nrole: Second Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nSecond worker.\n";
 
 /// A workspace (= self-contained team dir) with a compiled 2-agent spec + state listing alpha/bravo as
 /// RESUMABLE (running, valid first_send_at, session_id) + a seeded HEALTHY coordinator.
@@ -2437,7 +2422,7 @@ fn restart_allow_fresh_copilot_keeps_session_id_null_until_capture_confirms() {
     .unwrap();
     std::fs::write(
         ws.join("agents").join("alpha.md"),
-        "---\nname: alpha\nrole: Alpha Worker\nprovider: copilot\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nAlpha.\n",
+        "---\nname: alpha\nrole: Alpha Worker\nprovider: copilot\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nAlpha.\n",
     )
     .unwrap();
     let spec = crate::compiler::compile_team(&ws).expect("compile copilot team");
@@ -2541,7 +2526,7 @@ fn restart_allow_fresh_claude_clears_poisoned_session_id() {
     .unwrap();
     std::fs::write(
         ws.join("agents").join("alpha.md"),
-        "---\nname: alpha\nrole: Alpha\nprovider: claude\nmodel: sonnet\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nAlpha.\n",
+        "---\nname: alpha\nrole: Alpha\nprovider: claude\nmodel: sonnet\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nAlpha.\n",
     )
     .unwrap();
     let spec = crate::compiler::compile_team(&ws).expect("compile");
@@ -2612,7 +2597,7 @@ fn fork_refuses_source_with_partial_tuple() {
     .unwrap();
     std::fs::write(
         ws.join("agents").join("src.md"),
-        "---\nname: src\nrole: Source\nprovider: codex\nmodel: gpt\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nSrc.\n",
+        "---\nname: src\nrole: Source\nprovider: codex\nmodel: gpt\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nSrc.\n",
     )
     .unwrap();
     let spec = crate::compiler::compile_team(&ws).expect("compile");
@@ -2653,10 +2638,11 @@ fn fork_refuses_source_with_partial_tuple() {
     );
     let err = result.unwrap_err().to_string();
     assert!(
-        err.contains("source session backing is missing")
+        err.contains("unverified")
+            || err.contains("未验证")
             || err.contains("backing")
             || err.contains("incomplete"),
-        "0.4.6: fork refusal must name backing/incomplete cause; got error={err}"
+        "0.4.6/in-window: unverified providers refuse before backing check; got error={err}"
     );
 }
 
@@ -3084,6 +3070,8 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             "mcp_config",
             "permissions",
             "effective_approval_policy",
+            // 0.5.66 bypass 单源:fresh spawn 记录运行面 bypass 值(restart drift 挡板)。
+            "as_launched_dangerously_skip_permissions",
             "session_id",
             "rollout_path",
             "captured_at",

package/crates/team-agent/src/lifecycle/tests/lifecycle_rollback_red.rs

@@ -92,23 +92,31 @@ fn fork_agent_rollback_cleans_spawned_window_spec_state_and_mcp_after_post_spawn
 
     assert!(
         result.is_err(),
-        "failure-injection hook {FAIL_FORK_AFTER_SPAWN}=save_runtime_state must fail after spawn so post-spawn rollback is exercised; result={result:?}"
+        "in-window fork on this fixture must refuse before spawn; result={result:?}"
     );
+    let err = format!("{result:?}");
     assert!(
-        transport
-            .killed()
-            .contains(&"team-rollbackteam:newfork".to_string()),
-        "fork post-spawn rollback must kill the already-spawned window; killed={:?} result={result:?}",
+        err.contains("unverified") || err.contains("未验证") || err.contains("refuses --as"),
+        "codex in-window fork is unverified / --as is refused; no spawn to roll back. result={result:?}"
+    );
+    assert!(
+        transport.killed().is_empty(),
+        "unverified/in-place fork must not spawn a window to kill; killed={:?} result={result:?}",
         transport.killed()
     );
     assert_eq!(
         spec_after, spec_before,
-        "fork post-spawn rollback must restore team.spec.yaml byte-for-byte; result={result:?}"
+        "refused in-window fork must not mutate team.spec.yaml; result={result:?}"
+    );
+    assert!(
+        state_after
+            .pointer("/agents/newfork")
+            .is_none(),
+        "refused in-window fork must not create a newfork row; state={state_after}"
     );
-    assert_failed_fork_has_only_target_tombstone(&state_after, "newfork", "rollbackteam");
     assert!(
         !mcp_path.exists(),
-        "fork post-spawn rollback must cleanup the MCP config written for the half-created agent; leaked={}",
+        "refused in-window fork must not write MCP config; leaked={}",
         mcp_path.display()
     );
 
@@ -410,7 +418,7 @@ impl RollbackFixture {
 
 fn agent_doc(name: &str, role: &str) -> String {
     format!(
-        "---\nname: {name}\nrole: {role}\nprovider: codex\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\n{role}.\n"
+        "---\nname: {name}\nrole: {role}\nprovider: codex\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\n{role}.\n"
     )
 }
 

package/crates/team-agent/src/lifecycle/tests/mcp_tool_name_format_red.rs

@@ -0,0 +1,69 @@
+//! purpose: worker 契约里的 MCP 工具名必须按 provider 实测书写形式渲染
+//! contract:
+//!   claude → mcp__team_orchestrator__send_message / mcp__team_orchestrator__report_result
+//!   grok   → team_orchestrator__send_message / team_orchestrator__report_result
+//!   已验证 provider 的渲染结果不得再含 `team_orchestrator.` 点号
+//! boundary: 只钉 compile_worker_system_prompt 字面；未验证 provider 不在此猜形式
+
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use crate::lifecycle::worker_command_context::{compile_worker_system_prompt, WorkerCommandAgent};
+use crate::model::enums::Provider;
+
+fn compiled_prompt(provider: Provider) -> String {
+    let agent = WorkerCommandAgent::from_json(
+        &serde_json::json!({
+            "id": "w",
+            "role": "developer",
+            "tools": ["mcp_team"],
+            "output_contract": {"format": "result_envelope_v1"},
+        }),
+        Some("w"),
+        provider,
+    )
+    .expect("test agent");
+    compile_worker_system_prompt(&agent).expect("compile prompt")
+}
+
+#[test]
+fn claude_runtime_contract_pins_mcp_double_underscore_literals() {
+    for provider in [Provider::Claude, Provider::ClaudeCode] {
+        let prompt = compiled_prompt(provider);
+        assert!(
+            prompt.contains("mcp__team_orchestrator__report_result"),
+            "{provider:?} must render the claude transcript literal mcp__team_orchestrator__report_result; prompt={prompt}"
+        );
+        assert!(
+            prompt.contains("mcp__team_orchestrator__send_message"),
+            "{provider:?} must render the claude transcript literal mcp__team_orchestrator__send_message; prompt={prompt}"
+        );
+    }
+}
+
+#[test]
+fn grok_runtime_contract_pins_server_double_underscore_literals() {
+    let prompt = compiled_prompt(Provider::Grok);
+    assert!(
+        prompt.contains("team_orchestrator__report_result"),
+        "grok must render team_orchestrator__report_result; prompt={prompt}"
+    );
+    assert!(
+        prompt.contains("team_orchestrator__send_message"),
+        "grok must render team_orchestrator__send_message; prompt={prompt}"
+    );
+    assert!(
+        !prompt.contains("mcp__team_orchestrator"),
+        "grok must not use the claude mcp__ prefix; prompt={prompt}"
+    );
+}
+
+#[test]
+fn verified_provider_contracts_do_not_teach_dotted_tool_names() {
+    for provider in [Provider::Claude, Provider::ClaudeCode, Provider::Grok] {
+        let prompt = compiled_prompt(provider);
+        assert!(
+            !prompt.contains("team_orchestrator."),
+            "{provider:?} contract must not contain the dotted form team_orchestrator.; prompt={prompt}"
+        );
+    }
+}

package/crates/team-agent/src/lifecycle/tests/phase_b_contracts.rs

@@ -204,17 +204,21 @@ fn add_fork_remove_share_lifecycle_lock_behavior() {
         Duration::from_millis(120),
         Duration::from_secs(5),
     );
-    assert_lock_timeout(
-        crate::lifecycle::fork_agent_with_transport(
-            &fork_workspace,
-            &aid("alpha"),
-            &fork_agent,
-            None,
-            false,
-            None,
-            &fork_transport,
-        ),
-        "fork-agent",
+    let fork_held = crate::lifecycle::fork_agent_with_transport(
+        &fork_workspace,
+        &aid("alpha"),
+        &fork_agent,
+        None,
+        false,
+        None,
+        &fork_transport,
+    );
+    let fork_held_text = format!("{fork_held:?}");
+    assert!(
+        fork_held_text.contains("unverified")
+            || fork_held_text.contains("未验证")
+            || fork_held_text.contains("LifecycleLockTimeout"),
+        "codex in-window fork is unverified (lock is not reached); got {fork_held:?}"
     );
     assert!(
         fork_transport.spawns().is_empty(),
@@ -232,7 +236,7 @@ fn add_fork_remove_share_lifecycle_lock_behavior() {
     );
     drop(override_guard);
     drop(held);
-    crate::lifecycle::fork_agent_with_transport(
+    let fork_after = crate::lifecycle::fork_agent_with_transport(
         &fork_workspace,
         &aid("alpha"),
         &fork_agent,
@@ -240,14 +244,11 @@ fn add_fork_remove_share_lifecycle_lock_behavior() {
         false,
         None,
         &fork_transport,
-    )
-    .expect("fork-agent succeeds after lock release");
+    );
+    let fork_after_text = format!("{fork_after:?}");
     assert!(
-        crate::state::persist::load_runtime_state(&fork_workspace)
-            .unwrap()
-            .pointer("/agents/newfork")
-            .is_some(),
-        "released fork-agent must add the fork row"
+        fork_after_text.contains("unverified") || fork_after_text.contains("未验证"),
+        "codex in-window fork stays unverified after lock release; got {fork_after:?}"
     );
 
     let remove_workspace = lanea_team_ws("stopped");
@@ -463,8 +464,8 @@ fn team_dir_with_roles(role_docs: &[(&str, &str)]) -> PathBuf {
 }
 
 fn breal_workspace() -> (PathBuf, PathBuf) {
-    let w1 = "---\nname: w1\nrole: Phase B Real Worker One\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nWorker one body.\n";
-    let w2 = "---\nname: w2\nrole: Phase B Real Worker Two\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nWorker two body.\n";
+    let w1 = "---\nname: w1\nrole: Phase B Real Worker One\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nWorker one body.\n";
+    let w2 = "---\nname: w2\nrole: Phase B Real Worker Two\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nWorker two body.\n";
     let team = team_dir_with_roles(&[("w1.md", w1), ("w2.md", w2)]);
     let workspace = team.parent().expect("team workspace").to_path_buf();
     seed_healthy_coordinator(&workspace);
@@ -483,7 +484,7 @@ fn breal_workspace() -> (PathBuf, PathBuf) {
 }
 
 fn breal_one_worker_workspace() -> (PathBuf, PathBuf) {
-    let w1 = "---\nname: w1\nrole: Phase B Real Worker One\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nWorker one body.\n";
+    let w1 = "---\nname: w1\nrole: Phase B Real Worker One\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nWorker one body.\n";
     let team = team_dir_with_roles(&[("w1.md", w1)]);
     let workspace = team.parent().expect("team workspace").to_path_buf();
     seed_healthy_coordinator(&workspace);
@@ -526,7 +527,7 @@ fn strip_runtime_command_context(workspace: &std::path::Path) {
 
 fn role_doc(id: &str) -> String {
     format!(
-        "---\nname: {id}\nrole: {id} Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\n{id} worker.\n"
+        "---\nname: {id}\nrole: {id} Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\n{id} worker.\n"
     )
 }