@tiangong-ai/cli 0.0.42 → 0.0.44

package/AGENTS.md

@@ -17,8 +17,8 @@ checkPaths:
   - .docpact/config.yaml
   - docs/agents/**
   - src/**
-lastReviewedAt: 2026-08-18
-lastReviewedCommit: 9205e1b06678ef79042bee89bd3bca3fa77af515
+lastReviewedAt: 2026-08-19
+lastReviewedCommit: cd92a737acbdfd05a36c0d0d5b14c7e531ae6ee7
 ---
 
 # Tiangong AI CLI Contract
@@ -52,6 +52,7 @@ This repository owns the Tiangong AI command-line interface.
 - `tiangong-ai research policy`
 - `tiangong-ai research publication`
 - `tiangong-ai research workspace`
+- `tiangong-ai research reviewer`
 - `tiangong-ai research capability`
 - `tiangong-ai research project`
 - `tiangong-ai research status`

package/README.md

@@ -13,7 +13,7 @@ checkPaths:
   - bin/**
   - src/**
 lastReviewedAt: 2026-08-18
-lastReviewedCommit: 9205e1b06678ef79042bee89bd3bca3fa77af515
+lastReviewedCommit: 34a5c2a3af26fc56e9c9dc94fcbdabd91a6dd1d8
 ---
 
 # Tiangong AI CLI
@@ -376,7 +376,7 @@ binds the manifest and every document by SHA-256; edits, manifest tampering, or
 expiry block preflight and all later stages until the Policy is reviewed and
 approved again.
 
-Before search, the current native Codex or Claude host must author a
+Before search, the current native Codex, Claude, WorkBuddy, or CodeBuddy host must author a
 project-specific scientific design. The CLI owns the closed schema and rejects
 designs that confuse model-to-model disagreement with observed truth, inflate
 independent sample size through resampling, omit quantity/threshold semantics,
@@ -417,14 +417,17 @@ tiangong-ai research project init top-journal-paper \
   --workspace /absolute/path/to/workspace --json
 ```
 
-The base evidence lifecycle remains
-`discover -> acquire -> analyze -> synthesize -> review -> close`, authored in
-the current interactive Codex or Claude Code host. A fresh independent reviewer
+The base evidence lifecycle remains producer-authored in the current interactive
+Codex or Claude Code host, but its frozen control sequence is now
+`discover -> acquire -> typed decomposition/atoms -> content freeze -> inference freeze -> analyze -> Claim-Evidence Graph -> synthesize -> review -> close`.
+A fresh independent reviewer
 must first pass three hash-bound scientific gates: `research-design` before
 discovery, a real-record and outcome-blind `evidence-construct` canary after
-acquisition freezes the evidence snapshot, and `pilot-methods` after that
-canary and before analysis. Evidence-construct coverage may cite only frozen
-snapshot source IDs and states. Its JSON canary artifacts are promoted and
+acquisition and typed-content freeze, and `pilot-methods` after that canary and
+before analysis. Acquisition always freezes its exact result, including honest
+gaps; a stopped acquisition/content gate prevents inference without discarding
+the acquired evidence. Evidence-construct coverage may cite only frozen
+snapshot source IDs and exact content atoms. Its JSON canary artifacts are promoted and
 content-addressed through `--canary-artifacts`; reviewer prose cannot override
 an invented ID, unbound digest, or other mechanical failure.
 
@@ -457,14 +460,23 @@ audit manifest separately records the raw stored packet-file digest. This keeps
 packet identity and byte-level transfer verification explicit rather than
 overloading one hash with both meanings.
 
-After base closure, the current native host writes a final manuscript and
-schema-valid publication assessment. `research publication freeze` then
-content-addresses the Policy, scientific design and early reviews, evidence
-snapshot, base outputs, manuscript, assessment, and supplements.
+After base closure, the current native host writes a final Markdown/plain-text
+manuscript, schema-valid publication assessment, and an explicit submission
+manifest. The manuscript must contain Abstract, Introduction, Methods, Results,
+Discussion, Data availability, Code availability, and References. The
+submission manifest must bind distinct absolute files for cover letter, title
+page, reporting checklist, data availability, code availability, and source
+data; figure/table index, extended data, and supplementary methods are optional.
+`research publication freeze` then content-addresses the Policy, scientific
+design and early reviews, acquisition/content/inference snapshots, reproduced
+analysis, Claim-Evidence Graph, base outputs, manuscript, assessment,
+supplements, role-complete submission files, and reproducibility manifest.
 Exactly four fresh independent sessions review that frozen generation:
 evidence, methods/reproducibility, domain/novelty, and journal-editor. A revised
-manuscript invalidates prior reviews; reviewer-session reuse is rejected from
-the append-only journal even if mutable cache state is removed. The raw opaque
+manuscript invalidates prior reviews. Every reviewer must use the configured
+agent family that differs from the native producer; changing only the session
+ID is not independent. Reviewer-session reuse is rejected from the append-only
+journal even if mutable cache state is removed. The raw opaque
 producer/reviewer session identifiers are accepted only at the command boundary;
 generation, packet, review, journal, and closure objects persist only their
 SHA-256 bindings.
@@ -474,6 +486,7 @@ tiangong-ai research schema show publication-assessment --json
 tiangong-ai research publication freeze top-journal-paper \
   --manuscript /absolute/path/to/final-manuscript.md \
   --assessment /absolute/path/to/publication-assessment.json \
+  --submission /absolute/path/to/submission-package.json \
   --producer-agent codex --producer-session OPAQUE_NATIVE_SESSION \
   --workspace /absolute/path/to/workspace --json
 tiangong-ai research publication status top-journal-paper \
@@ -486,9 +499,13 @@ The CLI returns a mechanically bounded ceiling:
 it. None of these states predicts or guarantees editorial acceptance.
 
 Before external handoff or archival, export and independently verify a portable
-audit directory. It contains the selected project, portable copies of admitted
+audit directory. Export first revalidates the semantic acquisition, content,
+inference, graph, and publication objects; a copied but stale/tampered chain is
+rejected. Its manifest exposes their intrinsic IDs and hashes under
+`researchChain`. It contains the selected project, portable copies of admitted
 inputs, formal evidence and artifact bytes, Policy/design/review objects,
-outputs, environment fingerprints, and journal proofs. Credentials, setup
+outputs, environment fingerprints, and safe hash-preserving journal proof
+derivatives. Credentials, setup
 sources, browser profiles, native active state, capsules, unrelated projects,
 and host-specific absolute paths are excluded.
 
@@ -585,13 +602,19 @@ The workspace stores its current protocol state under `.tiangong-research/`.
 Each project follows the evidence-first sequence: broad discovery, strict
 admission, acquisition audit, immutable evidence freeze, analysis, synthesis,
 independent review, and mechanical closure. Discover, acquire, analyze, and
-synthesize run in the current interactive Codex app/session or Claude Code
-session. The CLI never launches a nested producer process. Independent review
+synthesize run in the current interactive Codex, Claude Code, WorkBuddy, or
+CodeBuddy session. The CLI never launches a nested producer process. Independent review
 runs through the other configured agent family's CLI, and execution is blocked
 when the two roles use the same family.
 
-Independent reviewer execution requires `/usr/bin/sandbox-exec` on macOS or
-Bubblewrap (`bwrap`) on Linux. Windows can inspect and configure workspaces but
+Independent reviewer execution always requires `/usr/bin/sandbox-exec` on macOS
+or Bubblewrap (`bwrap`) on Linux. `reviewerExecution.transport=native-direct`
+creates that capsule in the current process. `sandbox-bridge` sends one
+hash-bound request to an owner-started, exact-version sidecar outside an IDE
+sandbox; the sidecar creates the same capsule and returns an Ed25519-signed
+attestation bound to workspace/config/runtime/capsule/request/result/model and
+policy hashes. The two transports are explicit and never fall back to each
+other. Windows can inspect and configure workspaces but
 does not launch reviewer packages; smoke-test setup reports a non-blocking
 warning there, while production readiness fails closed. The current native producer remains governed
 by its host application's own permissions; the CLI supplies a hash-bound packet
@@ -611,7 +634,7 @@ tiangong-ai research run --workspace /absolute/path/to/workspace \
   --project gpu-resource-impact --progress-jsonl
 # When stopReason is native-stage-required, perform the returned stage here:
 tiangong-ai research project stage prepare gpu-resource-impact \
-  --stage discover --host-agent codex \
+  --stage discover --host-agent workbuddy \
   --workspace /absolute/path/to/workspace --json
 tiangong-ai research project stage submit gpu-resource-impact \
   --session SESSION_ID --output /absolute/path/to/discover.json \
@@ -620,6 +643,36 @@ tiangong-ai research project stage submit gpu-resource-impact \
 tiangong-ai research status --workspace /absolute/path/to/workspace --json
 ```
 
+For WorkBuddy/CodeBuddy, keep Default Permission and start the sidecar from a
+separate native terminal with a private non-symlink state directory outside the
+workspace:
+
+```bash
+tiangong-ai research reviewer serve \
+  --workspace /absolute/path/to/workspace \
+  --state-dir /absolute/private/reviewer-sidecar --json
+
+# From the sandboxed IDE:
+tiangong-ai research reviewer status --workspace /absolute/path/to/workspace --json
+tiangong-ai research reviewer doctor --confirm-agent-smoke-cost \
+  --workspace /absolute/path/to/workspace --json
+```
+
+Sidecar readiness includes real filesystem negative probes and a fixed
+`execute|fingerprint|status` protocol. It has no arbitrary-command endpoint;
+reviewer shell, browser, web, undeclared MCP, and Skill tools remain disabled.
+Do not use Full Access, sandbox-disable flags, unsandboxed-command exceptions,
+or silent transport fallback.
+
+WorkBuddy/CodeBuddy capsule teardown never requests recursive bulk deletion
+inside the outer IDE. Native stages remove only the single active-session
+binding, while completed, aborted, handed-off, and reviewer/work-package
+capsules are retained. The journal records
+`capsuleDisposition=retained-outer-sandbox` plus a non-sensitive capsule ID.
+Native Codex/Claude hosts keep the existing automatic capsule deletion behavior.
+No path silently falls back to Full Access, and retained capsules are never
+reported as active sessions.
+
 The discover packet derives a bounded multi-channel plan from reviewed evidence
 requirements. Required channels run first; exact repeated requests reuse the
 project cache without another provider call but still consume a bounded context
@@ -673,9 +726,19 @@ resume criteria. Research then stops; it does not spend more budget on
 low-yield substitutes. If no lawful remaining route exists, the user must narrow
 or abandon the unsupported scope before a new reviewed generation can resume.
 
-Successful acquisition freezes an immutable evidence snapshot before analysis.
-The reviewer and mechanical closure bind and recheck the snapshot chain,
-ledger, receipts, selected artifacts, excerpts, analysis, and report. Refresh a
+Acquisition freezes an immutable evidence snapshot even when lawful retrieval
+ends with explicit gaps. Before inference, decompose every acquired PDF,
+spreadsheet, archive, or structured file into exact lineage-bound producer-
+readable artifacts; register line-range or JSON-Pointer evidence atoms; then
+freeze `content-snapshot.json`. `research status --json` exposes acquisition,
+content, inference, and graph state under `evidencePipeline` and does not direct
+the operator to analysis while content preparation is missing or stopped.
+Only passing acquisition/content gates and required scientific reviews can
+freeze `inference-snapshot.json`. Analyze schema v2 binds that exact snapshot,
+a reproduced analysis run, source IDs, atom IDs, and design claim IDs; the CLI
+then creates `claim-evidence-graph.json` mechanically. The reviewer and
+mechanical closure bind and recheck the full chain, ledger, receipts, selected
+artifacts, excerpts, analysis, graph, and report. Refresh a
 closed result with `research project addendum SOURCE --to TARGET`; the original
 closure remains unchanged, the child snapshot records a mechanical delta, and
 default status hides the superseded project (`research status --all` shows full