@tiangong-ai/cli 0.0.60 → 0.0.62

package/README.md

@@ -12,8 +12,8 @@ checkPaths:
   - package.json
   - bin/**
   - src/**
-lastReviewedAt: 2026-09-03
-lastReviewedCommit: 06dadef170ab79c19eef9a35663e86fdee22479b
+lastReviewedAt: 2026-09-11
+lastReviewedCommit: f0dc2ee
 ---
 
 # Tiangong AI CLI
@@ -70,16 +70,43 @@ tiangong-ai data run <capability-id> <operation-id> \
 The command-line capability and operation must match the versions in the input
 envelope. Credentials are never accepted in argv or input JSON. Each connector
 declares exact logical environment-variable bindings, HTTPS endpoint scopes,
-and execution limits in its execution manifest. Data commands deliberately do
+and acquisition limits in its execution manifest. Callers may explicitly
+tighten those limits, but upper layers do not silently reinterpret Agent
+context budgets as provider or record limits. Data commands deliberately do
 not load a cwd `.env` file.
 
 `data catalog` also returns a concise capability summary, what the capability
-provides and does not provide, operation summaries, and a separate discovery
-digest. `data describe` expands that layer with source ownership, coverage,
+provides and does not provide, operation summaries, a separate discovery
+digest, and an explicit `available` or `suspended` status. Suspended entries
+remain inspectable, but `doctor` and `run` block before any provider request.
+`data describe` expands that layer with source ownership, coverage,
 granularity, selection hints, typical uses, official documentation, freshness,
 license restrictions, and operation descriptions. Narrative discovery changes
 do not change the execution manifest digest used for compatibility binding.
 Operation input schemas include field-level descriptions and examples.
+Operations may also publish stable feature IDs for Skills that depend on a
+specific compatible behavior within the same contract major.
+
+GDELT DOC requests are paced at least five seconds apart within one CLI process,
+including split queries and retries. Missing-header 429 responses use bounded
+exponential backoff and remain `rate-limited`, never `no-results`. Independent
+processes sharing an egress must be coordinated by the caller. The opt-in positive
+live gate and its timing/throughput definitions are documented in
+[repository validation](docs/agents/repo-validation.md#gdelt-doc-live-acceptance).
+
+Auto Research keeps three budgets separate: connector acquisition limits,
+Evidence package bytes/files, and the Agent-visible context view. A validated
+result is persisted in full when it fits the Evidence package budget;
+`maxBrokerItems` and the context-token ceiling only shape the Agent view.
+Receipts distinguish provider coverage, explicit limits reached, and context
+projection instead of forcing them into one status. A projected result returns
+an opaque, evidence-bound cursor; `research project evidence data read` serves
+the next shape-aware view from immutable local Evidence without another
+provider request or provider quota charge. Agents must either continue until
+`nextCursor` is null or disclose the exact presented/total fraction.
+The public Research command returns receipt identity, coverage, a structured
+bounded context view, and continuation metadata. The complete core result
+remains in immutable Evidence and is not duplicated into Agent stdout.
 
 JSON exits are `0` for success, `2` for request/contract errors, `3` for a
 blocked execution, and `4` for an explicit partial result. Public machine
@@ -90,7 +117,11 @@ The built-in capabilities are:
 - `airnow.hourly-observations` / `fetch-hourly`: fetches official AirNow
   `HourlyAQObs` files for a bounded UTC-hour window, bounding box, and pollutant
   list. Results retain source-file lineage and always state that AirNow data are
-  preliminary and unsuitable as regulatory-grade AQS evidence.
+  preliminary and unsuitable as regulatory-grade AQS evidence. Independent
+  hourly files use bounded concurrency while output files and records retain
+  deterministic UTC-hour order. Execution uses the official
+  `files.airnowtech.org` S3 bucket through its regional S3 endpoint so a failing
+  CloudFront edge does not make the underlying public object unavailable.
 - `bluesky.public-posts` / `fetch-cascades`: fetches bounded public Bluesky
   post seeds from search, an author feed, a custom feed, or a list feed and can
   flatten visible reply cascades. Ranking, counters, moderation visibility, and
@@ -98,7 +129,10 @@ The built-in capabilities are:
 - `epa.eis-records` / `search`: retrieves bounded official EPA EIS Database
   common-search or UI-created search pages and parses title, CEQ/provider IDs,
   document type, dates, agencies, state, detail links, and document-availability
-  cues. It does not fetch or assess linked EIS documents.
+  cues. Its endpoint-scoped, same-origin session cookie jar exists only in
+  memory so the provider's initial redirect can complete; cookies never enter
+  results, receipts, logs, or cross-origin requests. It does not fetch or assess
+  linked EIS documents.
 - `federal-register.documents` / `search`: searches bounded
   FederalRegister.gov document metadata by publication date plus term, agency,
   document type, topic, docket, or RIN filters. It does not follow result links,
@@ -106,48 +140,56 @@ The built-in capabilities are:
 - `gdelt.doc-search` / `search`: searches the rolling GDELT DOC 2.0 index for
   bounded article-link metadata or supported aggregate timelines. Automated
   multilingual extraction and uneven monitored-source coverage are explicit;
-  it does not retrieve article bodies or establish ground-truth facts.
+  it does not retrieve article bodies or establish ground-truth facts. The
+  capability is currently suspended because representative modes do not pass a
+  stable live gate under the provider's dynamic load shedding.
+- `gdelt.web-ngrams` / `search`: searches literal 1–4-word phrases in one
+  explicit published UTC minute's GZIP NGrams/TOC pair, returning matched
+  article links with file-scoped IDs. This local candidate extension is a
+  separately selected file-based alternative to DOC discovery, not a DOC query
+  or timeline substitute. Missing files block; malformed rows and omitted
+  matches are partial. No implicit time-range sampling or automatic fallback.
 - `gdelt.events`, `gdelt.gkg`, and `gdelt.mentions` / `fetch`: independently
   discoverable GDELT 2.0 table capabilities backed by one bounded TypeScript
   file-feed core. They fetch either the latest provider entry or at most twenty
   aligned 15-minute files, verify ZIP/CRC and advertised latest-file checksums,
-  and emit closed named columns without persisting downloaded files.
+  and emit closed named columns without persisting downloaded files. Their
+  wide named-field JSON is preserved as Evidence; Agent context projection is
+  handled by Auto Research without changing the connector result.
 - `nasa-firms.active-fire` / `fetch-area`: retrieves bounded NASA FIRMS MODIS,
   VIIRS, or Landsat active-fire point detections, optionally validates source
   availability, and exposes chunk-level partial coverage. Hotspots are thermal
   anomalies, not fire perimeters or confirmed incident identities.
 - `open-meteo.air-quality` / `fetch-hourly`: retrieves bounded GMT hourly CAMS
   model-grid air-quality series for known coordinates; these are modeled
-  background values rather than station observations.
+  background values rather than station observations. Missing and explicitly
+  returned all-null series are distinct machine-readable partial issues.
 - `open-meteo.flood` / `fetch-daily`: retrieves bounded daily GloFAS simulated
   river-discharge series for the represented river grid; it is neither gauge
-  data nor a flood-alert service.
+  data nor a flood-alert service. Missing and explicitly returned all-null
+  series are distinct machine-readable partial issues.
 - `open-meteo.historical-weather` / `fetch`: retrieves bounded GMT hourly and/or
   daily historical weather reanalysis for one controlled model and known
   coordinates. ERA5 or ERA5-Land should be selected when multi-decade model
-  consistency matters.
+  consistency matters. Missing requested series and provider-returned series
+  whose values are all `null` are distinct machine-readable partial issues.
 - `openaq.air-quality` / `search-locations` and `fetch-sensor-measurements`:
   discovers filtered OpenAQ v3 locations and retrieves a bounded raw, hourly,
   or daily series for one sensor. It preserves provider/license context but
   does not calculate AQI or make health or regulatory determinations.
-- `regulations-gov.comments` / `search` and `fetch-details`: searches bounded
-  Regulations.gov public-comment metadata and retrieves curated details for
-  explicit comment IDs. It omits named personal-profile fields, never submits
-  comments, and returns attachment metadata without downloading file bytes.
-- `regulations-gov.attachments` / `download`: retrieves attachment metadata for
-  exact public comment IDs and writes bounded files only from the official
-  Regulations.gov download origin. It requires `--artifact-dir`, refuses to
-  overwrite files, and commits SHA-256-bound relative files plus a manifest;
-  it does not scan, open, extract, or interpret the untrusted bytes.
 - `usbr.project-records` / `fetch`: inventories caller-supplied official
   `www.usbr.gov` project or program pages plus bounded same-origin links. It
   preserves page response provenance but does not follow, download, parse, or
-  assess linked records and is not USBR-wide search.
+  assess linked records and is not USBR-wide search. Execution is currently
+  suspended because the official origin returns a gateway rejection page in
+  the supported CLI environment.
 - `usbr.rise` / `discover-items` and `fetch-results`: scans bounded Bureau of
   Reclamation RISE catalog pages for client-filtered candidate item IDs, then
   retrieves bounded result rows for explicitly selected items. Provider scan
   order is not ranking, and operational values require item metadata and domain
-  context before interpretation.
+  context before interpretation. Execution is currently suspended because both
+  the legacy API and the official EDR beta endpoint are rejected by the
+  provider gateway in the supported CLI environment.
 - `usgs.water-instantaneous-values` / `fetch`: retrieves bounded legacy USGS
   WaterServices instantaneous observations while preserving site, parameter,
   qualifier, provisional status, and source lifecycle warnings.
@@ -156,12 +198,17 @@ The built-in capabilities are:
   comment/reply text for explicit video IDs. It does not download media or
   transcripts and does not treat ranking or comments as representative opinion.
 
-Fourteen capabilities are keyless. NASA FIRMS requires `NASA_FIRMS_MAP_KEY`, which the
+GDELT DOC, Regulations.gov comment/attachment, USBR RISE, and USBR project
+records remain discoverable with `availability.status=suspended`, a stable
+reason code, and explicit resume criteria. `doctor` and `run` block locally
+without network access, and Auto Research excludes them from its executable
+projection until their production live gates qualify them again.
+
+Of the fifteen execution-enabled capabilities, twelve are keyless. NASA FIRMS requires `NASA_FIRMS_MAP_KEY`, which the
 CLI injects as a protected provider path segment; OpenAQ requires
-`OPENAQ_API_KEY`, Regulations.gov requires `REGGOV_API_KEY`, and YouTube requires
-`YOUTUBE_API_KEY`; the CLI injects all three as protected provider headers, with
-YouTube using `X-Goog-Api-Key` rather than a URL parameter. No secret is accepted
-in argv or input JSON. Exact input and output schemas,
+`OPENAQ_API_KEY`, and YouTube requires `YOUTUBE_API_KEY`; the CLI injects the
+latter two as protected provider headers, with YouTube using `X-Goog-Api-Key`
+rather than a URL parameter. No secret is accepted in argv or input JSON. Exact input and output schemas,
 endpoint scopes and limits are available through the execution manifest, while
 source notes, coverage, selection guidance and license restrictions are
 available in the discovery metadata returned by `data describe`; static
@@ -383,6 +430,57 @@ bytes and report that a new native-host session is required before the routing
 instruction becomes active. Global-scope Skill installation does not create
 project instruction files.
 
+### Reviewed setup upgrades
+
+Use `research setup update --check --candidate-version <exact-stable-version>`
+to inspect one explicitly selected release. Omitting `--candidate-version` keeps
+this a local catalog comparison with no registry request. The optional query
+pins the public npm registry and package scope, has finite time/output limits,
+and reports `newer`, `same`, `older`, or `unavailable`. Metadata includes the
+exact version, tarball URL, SHA-512 integrity and Git commit. This validates
+registry metadata; it does not independently download or authenticate the
+package. An unavailable query never means that no update exists: when there is
+no separately confirmed local migration, `updateAvailable` is `null`.
+
+An older workspace resolver deliberately continues selecting its recorded CLI.
+To use an upgrade-capable candidate, select its exact published version and run
+that version directly; do not edit the runtime lock or use floating `latest`:
+
+```bash
+REVIEWED_UPGRADE_CLI_VERSION=X.Y.Z # replace with one reviewed exact stable release
+npx --yes --registry=https://registry.npmjs.org \
+  --@tiangong-ai:registry=https://registry.npmjs.org --strict-ssl=true \
+  --package "@tiangong-ai/cli@$REVIEWED_UPGRADE_CLI_VERSION" -- tiangong-ai \
+  research setup upgrade --plan --confirm-upgrade \
+  --workspace /absolute/path/to/workspace --json
+```
+
+Review the returned immutable `planPath` and execute its `applyCommand`. The
+candidate also binds the SHA-256 identity of `package.json`, `bin/` and `dist/`;
+apply and rollback reject changed CLI runtime bytes before workspace mutation.
+This content binding excludes installed dependencies and is not a publisher
+signature. Ordinary research commands do not rescan these trees. Planning
+leaves the active plan, runtime lock, configuration and installed Skills intact.
+Apply stages the complete selected generation, verifies each prior-owned tree,
+and reuses unchanged trees and verified downloads. Modified or linked targets
+remain protected. It preserves the workspace identity, evidence, credentials,
+budgets, current model/pricing choices, custom launchers and reviewer transport.
+Changed license choices remain explicit; unchanged accepted licenses carry forward.
+
+An interrupted commit blocks ordinary workspace use and reports the exact
+candidate recovery command. Repeat that candidate's apply to resume, or use its
+`rollbackCommand` to restore the directly bound prior generation with the new
+updater. Rollback refuses conflicting owner changes or subsequent research
+activity. Interrupted rollback remains blocked and resumes with the same command.
+Private rollback preimages (including configured credentials) and prepared caches
+are retained for recovery; they are excluded from portable setup audit exports.
+Doctor runs after coherent activation; a repeated apply does not repeat a paid
+check that already started. If its result was lost, explicitly inspect status
+and run Doctor as needed. Old readiness attestations never certify new bytes.
+A legacy already-mixed plan/lock fails with
+`RESEARCH_SETUP_LEGACY_UPGRADE_RECOVERY_REQUIRED`; preserve its directly linked
+setup history for diagnosis rather than deleting Skills or rewriting locks.
+
 ### Declarative setup
 
 For repeatable provisioning without a TTY, generate a safe workspace-local
@@ -607,8 +705,9 @@ owns the same due gate. Pending implementations use `null` for implementation
 SHA-256, locator, and entrypoint; pending environments use `null` for lock
 SHA-256 and locator. They are exposed in every earlier review packet as
 `futureGateObligations` and become blocking mechanical errors at that gate.
-Freezing them requires a new authoritative generation; it never upgrades the
-old object in place.
+Their predeclared slots may be fulfilled through the append-only same-project
+command below. The original design bytes never change; a material assumption,
+question, policy or already-frozen value still requires a reviewed successor.
 
 Use the same Policy project ID and exact design when preflighting and admitting
 the research project:
@@ -677,6 +776,31 @@ schema-valid, packet/session-bound review. A saved successful execution is
 replayed without another model call after revalidating its immutable proof.
 Failures require explicit `--retry` and remain bounded by the attempt budget;
 unreported usage and interrupted wall time retain conservative reservations.
+Failed processes return a bounded, sanitized exit diagnostic and record it in
+the journal; no full prompt or raw authentication output is persisted.
+When the reviewer returns but submission is rejected, the error and failed
+journal event also return an `executionRecord` locator and SHA-256. The locator
+is relative to `.tiangong-research/` and points to an immutable
+`scientific/failed-executions/` record containing the packet/run binding,
+reported usage and identity, rejection code, and safely retained JSON stdout.
+These are unaccepted execution observations, not a review receipt or permission
+to pass a gate. Inspecting them does not call the provider; another execution
+still requires explicit `--retry`.
+Retained stdout is limited to the smaller of 1 MiB and the configured output
+capture allowance. Unsafe, oversized, or malformed JSON keeps only its digest,
+size and omission reason. If storage fails, `outputRetention=storage-unavailable`
+is reported with the original error instead of claiming that a result was saved.
+Successful review and replay use their existing output/receipt without this
+additional failure capture.
+Automatic
+Claude invocation uses the same dialect-annotation conversion as
+`research schema show NAME --compatibility claude-code`; canonical controller
+validation and its scientific constraints remain unchanged.
+The provider view explicitly types scalar constants/enums; returned values are
+never coerced to satisfy the canonical schema.
+Claude's structured result is used instead of any accompanying narrative;
+declared error results remain failures, with their safe diagnostic ahead of
+incidental stderr warnings.
 A nonpassing mechanical packet can receive an independent stop verdict, never
 an override. The existing manual submit command remains available for an exact
 independent review.
@@ -685,6 +809,8 @@ Reviewer status is read-only and transport-aware. Native-direct does not
 require a bridge connection. Smoke configuration readiness is explicitly not
 production readiness and does not demand an attestation that smoke mode never
 writes. Production still requires its current reviewer doctor attestation.
+Packet read responses carry their actual content and receipt together; a
+receipt alone does not establish that the host displayed the content to its model.
 
 Repeat the same prepare/execute route for `evidence-construct`, adding an
 owner-reviewed JSON array of absolute canonical canary paths with
@@ -704,17 +830,40 @@ audit manifest separately records the raw stored packet-file digest. This keeps
 packet identity and byte-level transfer verification explicit rather than
 overloading one hash with both meanings.
 
-After base closure, the current native host writes a final Markdown/plain-text
+After base closure, inspect `research publication lineage PROJECT --json` before
+authoring materials. It verifies the existing closure and reviewed packet's
+analysis, report and evidence-chain hashes and returns their analysis identity
+with an empty material-file template. It does not certify or relabel previously
+authored files. The current native host then writes a final Markdown/plain-text
 manuscript, schema-valid publication assessment, and an explicit submission
 manifest. The manuscript must contain Abstract, Introduction, Methods, Results,
-Discussion, Data availability, Code availability, and References. The
+Discussion, Data availability, Code availability, and References. Decimal
+section prefixes such as `1. Introduction`, `2 Methods`, `3.1 Results`, and
+`4) Discussion` are accepted when separated from the title by whitespace;
+unrelated titles and body text still cannot satisfy a required section. The
 submission manifest must bind distinct absolute files for cover letter, title
 page, reporting checklist, data availability, code availability, and source
 data; figure/table index, extended data, and supplementary methods are optional.
+The schema-version-1 submission manifest also requires `resultLineage`, following
+`research schema show publication-result-lineage --json`. Preserve the source
+analysis identity from material preparation. Include a role, actual byte SHA-256
+and source `analysisSha256` for the manuscript, assessment, every submission file
+and each `supplement-N` (one-based supplied order). Include the actual figures,
+tables and source inputs as submission files or supplements; an index alone is
+not their contents. Do not replace a stale parent hash merely to pass validation.
+Completeness and scientific derivation remain producer claims for independent
+review; the CLI verifies declared lineage and bytes, not scientific truth.
 `research publication freeze` then content-addresses the Policy, scientific
 design and early reviews, acquisition/content/inference snapshots, mode-bound
 analysis, Claim-Evidence Graph, base outputs, manuscript, assessment,
 supplements, role-complete submission files, and reproducibility manifest.
+Validation reads the frozen copies. The generation, review packet and closure
+carry `analysisGenerationId` and a content-addressed material-results manifest;
+the reproducibility record binds that manifest. A different closed generation,
+changed report, mixed file parent or changed prepared bytes fails before review.
+Status/review/closure recheck the current closed lineage and report the affected
+object and binding. Legacy generations without the manifest retain their history
+but cannot establish current readiness; prepare an honest binding and refreeze.
 Computational/mixed analysis still requires reproduced metadata with exact
 implementation/environment bindings. Qualitative analysis uses
 `status: not-applicable`, null command/seed and empty implementation/environment
@@ -732,6 +881,9 @@ generation, packet, review, journal, and closure objects persist only their
 SHA-256 bindings.
 
 ```bash
+tiangong-ai research publication lineage top-journal-paper \
+  --workspace /absolute/path/to/workspace --json
+tiangong-ai research schema show publication-result-lineage --json
 tiangong-ai research schema show publication-assessment --json
 tiangong-ai research publication freeze top-journal-paper \
   --manuscript /absolute/path/to/final-manuscript.md \
@@ -759,6 +911,16 @@ derivatives. Credentials, setup
 sources, browser profiles, native active state, capsules, unrelated projects,
 and host-specific absolute paths are excluded.
 
+Text inspection distinguishes internal identifiers such as `interruptedSessionId`
+from credential fields. It checks raw text and read-only decoded JSON/JSONL,
+including escaped keys and nested string payloads, while retaining the exact
+evidence and ledger bytes. Authentication values remain blocked even when wrapped
+in arrays or objects; an identifier's UUID shape is never a credential exemption.
+Within the existing 16 MiB per-file text scan bound, valid UTF-8 inputs are also
+checked after staging under extensionless content hashes. Binary inputs remain
+byte-preserving. A nonportable-path error reports a bundle-relative `details.path`
+without disclosing the original host path or the matched source text.
+
 ```bash
 tiangong-ai research project audit export top-journal-paper \
   --output /absolute/path/to/new-audit-directory \
@@ -822,6 +984,11 @@ presentation Skills are post-closure authoring only. Run selected preprocessors
 and acquisition adapters with `research setup companion run`, then admit their
 exact hash-bound output separately. Automatic paper OA exhaustion returns an
 explicit browser handoff and never launches or chooses a browser silently.
+Paper results require the pinned adapter's identity-verified artifact.v3
+manifest: matched document identity must agree between the result and manifest
+and bind the requested or resolved DOI. PDF/manifest paths, bytes and hashes
+remain checked independently. Structural-only legacy metadata cannot establish
+document identity, and successful access does not imply redistribution rights.
 The paper companion and its setup-doctor preflight both enter the verified
 Skill through `scripts/runtime.py`; the CLI never bypasses that lock by invoking
 `fetch.py` or importing `pypdf` from ambient Python. A missing runtime remains
@@ -859,8 +1026,10 @@ For large local sources, pass an immutable `--input-plan` to both preflight and
 project initialization. Each plan entry may expose either a separate
 `contextPath` or non-overlapping, one-based `contextRanges`; the producer sees
 only that bounded context, while independent review receives the hash-verified
-full source. Symlinks, duplicate content, changed hashes, and context above
-`maxInputContextTokens` are rejected.
+full source. Symlinks, duplicate content and changed hashes are rejected.
+There is no total stage-context length gate: large admitted objects remain complete
+and are read through the packet's artifact directory instead of being forced into
+the initial prompt. This does not expose files deliberately withheld by an input plan.
 
 The workspace stores its current protocol state under `.tiangong-research/`.
 Each project follows the evidence-first sequence: broad discovery, strict
@@ -871,6 +1040,13 @@ CodeBuddy session. The CLI never launches a nested producer process. Independent
 runs through the other configured agent family's CLI, and execution is blocked
 when the two roles use the same family.
 
+Native packets direct the host to save one new JSON submission file, not to write
+admitted output paths. Acquire may retrieve files and readable derivatives for
+provisionally admitted sources through the packet's binding/registration commands;
+it may not reopen discovery. Analyze, synthesize and the isolated reviewer retain
+their no-new-evidence boundary. Headless reviewer prompts remain capsule-scoped
+and return JSON rather than saving native submission files.
+
 Every workspace mutation is serialized by an owner-recorded directory lease
 with a heartbeat. A later command immediately reclaims a lease whose same-host
 owner process is definitely dead; an unverifiable cross-host lease is reclaimed
@@ -940,6 +1116,29 @@ reviewer shell, browser, web, undeclared MCP, and Skill tools remain disabled.
 Do not use Full Access, sandbox-disable flags, unsandboxed-command exceptions,
 or silent transport fallback.
 
+Before sending reviewer material, inspect `research reviewer status --json`.
+The runtime reports the CLI family and configured model alias separately from
+`providerRouting`: the configured Claude endpoint origin/source, model-mapping
+sources and a digest of admitted routing values. Explicit process environment
+overrides the imported Claude `settings.json` env allowlist. Approved custom
+HTTPS gateways remain supported. Doctor's `reviewer-configured-routing` check
+is configuration inspection; it does not make a paid model request.
+
+Routing changes invalidate the prior runtime binding before reviewer execution.
+Unchanged effective routing reuses the existing attestation; missing legacy
+bindings require an explicit smoke refresh. Status never starts paid checks.
+Paths, query strings, proxy credentials and mapped provider IDs are omitted
+from routing receipts. `identityVerification=unverified` is intentional: a CLI
+family, model alias, endpoint configuration or successful smoke cannot attest
+the actual upstream provider/model or historical HTTP destinations. A null
+endpoint means no supported explicit endpoint was resolved, not an official
+provider guarantee. Wrappers, proxies and runtime defaults remain outside that
+identity guarantee. Bridge status identifies transport readiness separately.
+Execution `model` and `runtime.model` retain the configured alias; optional
+`telemetry.reportedModel` records the sanitized CLI self-report, with null when
+absent. A mapped response name does not change the configured runtime identity
+or require another smoke. It is not independently verified provider identity.
+
 WorkBuddy/CodeBuddy capsule teardown never requests recursive bulk deletion
 inside the outer IDE. Native stages remove only the single active-session
 binding, while completed, aborted, handed-off, and reviewer/work-package
@@ -1165,7 +1364,8 @@ total tokens, USD 5,000, 30 days, and package ceilings of 12,000,000 for discove
 acquisition, 1,500,000 each for analysis and synthesis, and 2,500,000 for
 review. Primary output is bounded at 32,000 tokens and a separately invoked
 repair at 16,000. The production broker hard ceiling is 256 bounded views with
-32,000 context tokens per view; input context is bounded at 128,000 tokens.
+32,000 context tokens per broker view. The legacy `maxInputContextTokens` setting
+is an embedding/planning hint, not an input admission or artifact-read ceiling.
 Top-journal admission additionally reserves three early scientific reviews at
 500,000 tokens each, four final publication reviews at 750,000 each, and one
 4,000,000-token revision cycle, including their finite wall-time allowances.
@@ -1174,7 +1374,7 @@ stop control ordinary use, while the finite ceilings, three attempts per
 package, and explicit confirmation above the cost threshold stop runaway work.
 Smoke-test workspaces retain their smaller low-cost defaults.
 Before project initialization and every executable package, the control plane
-requires the complete token and conservative price reservation to fit. Native
+requires a token and conservative price estimate to fit the finite execution budget. Native
 producer stages reserve prompt, schema, admitted context, bounded broker
 context, and output allowance, but the host app does not expose trusted
 per-stage usage telemetry to this CLI. A successful native submit therefore
@@ -1184,9 +1384,15 @@ output bytes/tokens, provenance, coverage, hashes, and remaining project budget.
 It does not claim a provider-side turn or output-token cap for the host app.
 
 Independent review uses the pre-call reservation calculator and the reviewer's
-provider-side structured-output/turn controls where available. Review admission
-reserves three maximum-size generated artifacts plus one globally bounded
-evidence-excerpt bundle, and formatting repair remains one separately budgeted,
+provider-side structured-output/turn controls where available. Claude packet-only
+review chooses the largest affordable turn count up to a 64-turn provider
+guard and uses that same count in its reservation; Codex uses the existing finite wall-time and
+token/cost guards because its CLI has no equivalent turn flag. Planning uses a
+small initial-context estimate and expected reads, not the entire corpus or an
+unbounded legacy context hint. Preflight reports `inputContextTokenLimit=null`.
+These are approximate estimates, not precise billing; scientific review keeps
+the approved remaining cost ceiling separate from its rough read-cost estimate.
+Formatting repair remains one separately budgeted,
 tool-free JSON correction. Production workspaces enforce a finite 256-view
 broker ceiling mechanically, while each project derives a much smaller working
 budget from its reviewed coverage requirements and stops early when they are
@@ -1198,6 +1404,55 @@ records and JSONL progress preserve sanitized accounting mode, event/item
 counts, provider turns, tool calls, reasoning tokens, and bounded provider
 errors.
 
+Owners can opt into a numeric project authorization with `project init` or
+`project preflight --max-cost-usd`, or adopt it for an existing project:
+
+```bash
+tiangong-ai research project budget set PROJECT --max-cost-usd 50 \
+  --provider-costs /absolute/provider-costs.json --confirm-budget \
+  --workspace /absolute/workspace --json
+```
+
+The JSON file maps selected capability IDs to owner-reviewed USD maxima for one
+logical operation, for example `{ "method.public-source": 0.01 }`. Choose these
+values from your actual provider agreement; the example is synthetic. Each
+allocation includes that operation's bounded redirects, retries, and provider
+pagination. Missing prices block new provider work; they do not mean zero.
+Project and shared HTTP caches, and local reads of stored Data windows, require
+no new monetary allocation. The existing broker call-count budget still counts
+cache/tool invocations. Concurrent provider calls share one durable ledger;
+local ledger writes are serialized while network operations remain parallel.
+
+The project ledger covers project stage/reviewer admissions and the project
+HTTP/Data evidence entrypoints. Workspace setup/Doctor probes, setup companion
+commands, standalone `data run`, and unrelated host-app actions have no project
+budget binding; their charges are unobserved here and must not be counted as
+zero. Native host work is represented by its declared allocation, not trusted
+provider metering.
+
+The project budget response separates accounted estimates, pending reservations,
+remaining authorization, and overruns. It never reports a provider invoice.
+Model actions require declared route prices; native/provider operations use
+conservative allocations where trusted usage is unavailable. Increasing the
+authorization or changing provider maxima requires `--confirm-budget`.
+Tightening cannot exclude already spent or reserved exposure. Legacy projects
+retain their existing workspace controls until explicitly adopted; changing a
+project authorization leaves workspace settings and Doctor bindings intact.
+Fork/addendum recovery carries outstanding obligations to the current project
+without counting them twice. An uncertain operation remains pending until it
+ends or the owner explicitly resolves it with `project budget resolve`, a
+reservation ID, an accounted estimate, a reason, and `--confirm-budget`.
+A native reservation requires its original session to have ended first.
+Settled accounting evidence is immutable, including conservative allocated
+maxima; this interface does not revise historical costs or reconcile provider
+invoices. Choose reviewed per-operation maxima accordingly.
+An owner estimate above the ceiling records an overrun and blocks further
+positive-cost work; it does not silently increase the authorization.
+If a command fails after saving the decision but before writing its journal
+record, retrying the same command reconciles the missing record without changing
+the authorization or charging again. The record is marked as reconciliation;
+contradictory journal evidence stops the replay for inspection.
+
 Every evidence source must resolve to an admitted input, a completed broker
 receipt, or a completed structured data-runtime receipt. Successful broker and
 data results are immutable content-addressed objects under
@@ -1211,8 +1466,9 @@ context, evidence objects, and registered local input hashes before recording
 their safe locators. Capsule deletion therefore does not delete the durable
 review chain.
 
-Native discovery preparation embeds the exact staged capability manifest and
-each external Skill's top-level `SKILL.md`. It also projects every built-in data
+Native discovery preparation supplies the exact staged capability manifest and
+each external Skill's top-level `SKILL.md` inline or by an exact artifact reference.
+It also projects every built-in data
 operation dynamically, with no per-provider Research adapter. The current host
 may fetch generic broker evidence with `research project evidence fetch`, whose bounded request file
 contains logical IDs but no credential values. The manifest includes the locked,
@@ -1228,6 +1484,11 @@ with `tiangong-ai data describe`, then run the exact request through:
 tiangong-ai research project evidence data run <project-id> \
   --request /absolute/path/to/data-run-request.json \
   --workspace /absolute/path/to/workspace --json
+
+# When contextView.nextCursor is non-null, continue from persisted Evidence:
+tiangong-ai research project evidence data read <project-id> \
+  --receipt <attempt-id> --cursor <opaque-next-cursor> \
+  --workspace /absolute/path/to/workspace --json
 ```
 
 This Research command calls the same TypeScript data service in-process; it does
@@ -1240,19 +1501,43 @@ credentialed operation must resolve its namespaced logical credential from the
 workspace's owner-only store or it is blocked before any provider request.
 Standalone `tiangong-ai data run` keeps its separate manifest-declared
 environment-variable policy. A blocked data result is not promoted to evidence.
-Analyze and synthesize packets contain bounded, hash-verified prior-stage
-artifacts and require no external evidence calls. Review is tool-free and uses the
-reviewer's route-specific structured-output turn cap:
-its prompt embeds the complete generated artifacts and a deterministic,
-globally bounded set of excerpts distributed across registered local contexts
-and broker receipts. Broker excerpts prioritize deterministic, sanitized
+Native packets publish data commands as `workspace-cli-relative-argv`;
+installed Auto Research must prefix them with its workspace-locked resolver
+rather than resolving a global CLI from `PATH`.
+Data Evidence continuation is read-only and does not consume another evidence-call
+or provider-request budget. Provider coverage, limits reached, and Agent context
+coverage are reported independently, so a result may be both partial and bounded.
+Analyze and synthesize packets contain hash-verified prior-stage artifacts and
+require no external evidence calls. Base and scientific review use only the
+packet-bound `research_list_artifacts` and `research_read_artifact` tools; shell,
+general filesystem, browser, broker and undeclared integrations remain disabled.
+The same surface works through native-direct and the signed sandbox-bridge.
+Small objects/excerpts are included initially; large objects are referenced without
+rejecting the stage. Broker excerpts prioritize deterministic, sanitized
 projections of the exact raw-response items selected by admitted evidence JSON
 Pointers; uncited receipts retain metadata-only bindings, and unresolved
 pointers receive a bounded-context fallback. The packet hash is schema-bound, but complete packet
 metadata is not redundantly copied into model context. Full local files,
-original per-receipt bounded contexts, raw broker objects, and the complete
-packet remain hash-bound for durable human/mechanical audit; the model must not
-claim to have read beyond the embedded excerpts.
+original per-receipt contexts, raw broker objects, checks and counterevidence stay
+discoverable in the exact directory. Reads use opaque object IDs and byte offsets;
+UTF-8 pages preserve character boundaries. Omit `length` for a 16 KiB page or use
+`length: null` for the whole object, without a CLI read-length ceiling. Objects
+actually read are preserved under `reads/objects/`, with exact directory and
+packet/object/view hash receipts. Receipts prove bytes delivered, not comprehension
+or scientific truth; actual provider/model capacity remains a limitation.
+
+Native hosts can use the same primitives without adding an IDE integration:
+
+```bash
+tiangong-ai research project stage artifacts PROJECT --session SESSION --workspace /absolute/workspace --json
+tiangong-ai research project stage read PROJECT --session SESSION --artifact OBJECT_ID --offset 0 --length 16384 --workspace /absolute/workspace --json
+tiangong-ai research project stage read PROJECT --session SESSION --artifact OBJECT_ID --length all --workspace /absolute/workspace --json
+```
+
+Follow `nextOffset` for subsequent pages. `--encoding base64` explicitly requests
+binary bytes; prefer a registered text derivative for interpretation. The channel
+does not scan arbitrary host paths or discover files created after the snapshot.
+Stopped, changed or expired native sessions cannot read through it.
 The CLI mechanically derives local full-text availability, source types,
 counts, date coverage, source IDs, and the coverage decision. A `partial`
 dimension is usable but incomplete; a missing dimension or unmet declared
@@ -1436,7 +1721,7 @@ acquisition snapshot; unchanged records are reused. Single and batch intake shar
 this rule. Historical records remain immutable, and atoms from deselected artifacts
 cannot fill current coverage. Same-snapshot conflicting extraction still fails.
 
-Actual question/Policy/design changes or post-analysis work require the existing
+Substantive question/Policy/design changes or post-analysis work require the existing
 fork/addendum flow. Pre-feature snapshots without immutable evidence records cannot
 be repaired in place; use `research project fork SOURCE --to TARGET
 --resume-through discover` to reuse discovery/receipts/artifacts, or explicitly
@@ -1444,6 +1729,91 @@ start a new generation. There is no automatic migration. A top-journal successor
 requires a Policy approved for TARGET and `--design`, `--design-producer-agent`,
 and `--design-producer-session`; it cannot inherit scientific approval.
 
+### Amend planned design declarations before analysis
+
+At an idle boundary before analysis or inference freeze, a compatible runtime
+can amend an existing planned Policy rule's due gate, rationale, or links to
+already declared models/parameters. The question, claims, thresholds, model
+and parameter definitions/values, evidence requirements and Policy content stay
+fixed. Substantive changes continue through a reviewed successor.
+
+```bash
+tiangong-ai research schema show scientific-amendment --json
+tiangong-ai research scientific amendment plan PROJECT \
+  --input /absolute/amendment-input.json --workspace /absolute/workspace --json
+```
+
+The closed input contains `schemaVersion: 1`, a reason and `changes`; use the
+schema for their exact fields. Amendment status exposes the current editable
+fields under `plannedRules`, so unchanged links can be preserved explicitly. Save the returned plan JSON unchanged externally.
+It shows before/after declarations, current parent bindings, preserved acquisition,
+invalidated scientific gates and `affectedTaskRequirementIds`. Planning does not
+mutate the project or request a provider. After explicit approval of that exact
+plan, retain the actual supplied confirmation text in a bounded UTF-8 file:
+
+```bash
+tiangong-ai research scientific amendment apply PROJECT \
+  --plan /absolute/amendment-plan.json --confirm REVIEWED_PLAN_SHA256 \
+  --authorization-source /absolute/confirmation.txt --workspace /absolute/workspace --json
+tiangong-ai research scientific amendment status PROJECT --workspace /absolute/workspace --json
+```
+
+The CLI records operator-supplied confirmation, not authenticated human identity.
+Original design bytes, fulfillment records and valid evidence remain unchanged;
+a new immutable declaration version and its exact parent/changes/source are
+retained. Planned rules are not marked scientifically satisfied. New early
+scientific reviews receive the version history and current effective design.
+
+Task checks linked through existing claim/coverage bindings to changed rules
+become stale; unrelated checks remain reusable and idempotent. Affected check
+contexts expose `requiredDesignAmendmentSha256`; an explicit reassessment records
+its applicable amendment without requiring unchanged sources or calculations to
+be rerun. Unbound source-only checks do not establish the amended design's
+validity. Portable audit verifies the same selective relationships.
+
+Changed parents or Policy, unsupported fields, active stages and late amendments
+reject. Inspect and replan instead of editing hashes. A committed but interrupted
+apply recovers through the existing project transaction and identical retry;
+unknown or conflicting files are preserved. This path does not add a new paid
+review role or silently upgrade a locked runtime that lacks these commands.
+
+### Fulfill predeclared scientific objects
+
+At an idle boundary before analysis, register the exact code/environment files
+as scientific objects, then supply only the pending slots already named in the
+frozen design:
+
+```bash
+tiangong-ai research schema show scientific-fulfillment --json
+tiangong-ai research scientific fulfillment status PROJECT --workspace /absolute/workspace --json
+tiangong-ai research scientific fulfillment record PROJECT \
+  --input /absolute/fulfillment.json --workspace /absolute/workspace --json
+```
+
+The closed input names `designSha256`, the exact `parentFulfillmentSha256`
+(`null` initially), a non-sensitive reason, and arrays `modelImplementations`,
+`environmentLocks`, and `parameterStates`. Model entries bind the registered
+`objectLocator`, raw `sha256`, registration `recordSha256`, and the declared
+`modelId`; implementations additionally supply `entrypoint`. Parameter entries
+name the existing `parameterId` and every exact `stateId`, its source-derived
+`value`, and admitted `evidenceAtomIds` from the frozen typed-content snapshot.
+Units, state sets, ranges, factors, composition, claims, thresholds and Policy
+cannot be changed through this intake. At least one pending slot is required.
+
+Identical replay returns the same immutable record. Replacing an already-frozen
+slot, guessing a parent, an active native session, or analysis/inference already
+started is refused. The journal is the commit point; interrupted state projection
+uses the same narrow recovery mechanism as acquisition/scope revisions.
+
+Only the fulfillment's due gate and later scientific gates are reset; earlier
+reviews remain bound to their unchanged deadline-specific design view. New review
+packets include the original design, the exact fulfillment chain, the effective
+view and registered code/environment bytes. Filing objects does **not** mark the
+original Policy rule scientifically satisfied or certify code execution. The
+existing independent reviewer must assess the actual objects and rule. Portable
+audits retain the raw objects and registration metadata and verify the committed
+fulfillment head, slot semantics and current review view after relocation.
+
 ### Original task, current scope, and actual checks
 
 For a new research project, record a small original-requirement checklist after
@@ -1462,6 +1832,17 @@ Each requirement has a stable ID, acceptance condition, `checkKind` (`evidence`,
 coverage dimensions. Original wording cannot be overwritten. Old projects without
 a task remain explicitly unassessed rather than retrospectively accepted.
 
+Optional `requestProvenance` supplies `mode` (`verbatim`, `interpreted`, or
+`reconstructed`), `source` (`kind: user-message|user-file`, exact `text`, `locator`
+or null), and `explanation`. A null source is valid only for reconstruction.
+Verbatim source text must equal `originalRequest` exactly, including BOM and line
+endings. Source bytes are immutable; locator values are retained only by hash.
+Missing provenance is explicitly `unrecorded`, never inferred retroactively.
+Scope changes and forks preserve it. Declared origin is not authenticated authorship;
+secrets are rejected before admission.
+Scientific review also stages the exact supplied request-source object, so its
+original bytes are available through the same packet-only read channel as its hash.
+
 Before analysis, use `research schema show task-scope-change` and
 `project task scope propose PROJECT --input FILE --expected-contract SHA` to
 propose a change. Review the returned `changes.details` before/after values, then
@@ -1479,17 +1860,57 @@ between native stages. Records bind the exact requirement version, source/atom/
 finding IDs, and explicitly selected bounded UTF-8 result files. The declared
 command is stored only by hash and is **not executed by this command**. Raw result
 bytes are copied into immutable hash-addressed objects; secrets and control-store
-sources are rejected. Positive/negative computational outcomes need a command and
-results; failed, inconclusive, and not-run checks remain honest without invented
-results. All records say `trust=native-observation`, `executionCertified=false`.
+sources are rejected. A reported computation without an observed run remains
+`unverified-execution`, not an answered computational requirement. Failed,
+inconclusive and not-run checks remain honest without invented results. Evidence
+and proof checks need no fabricated computation. All records say
+`trust=native-observation`, `executionCertified=false`.
+
+For an actual calculation, the native host authors and reviews one ordinary
+Node/Python program and explicitly requests observation:
+
+```bash
+tiangong-ai research schema show task-native-run --json
+tiangong-ai research project task run observe PROJECT \
+  --input /absolute/native-run.json --confirm-execution --workspace /absolute/workspace --json
+tiangong-ai research project task run inspect PROJECT --run RUN_ID \
+  --workspace /absolute/workspace --json
+```
 
-One unchanged result blob is stored and included once per reviewer context. The
+The closed request binds the computational requirement version, explicit
+interpreter, script, environment-lock declaration, current acquisition artifact
+IDs/hashes, unique output filenames, non-secret arguments and finite timeout.
+Use `{input:ID}` / `{output:ID}` placeholders rather than host paths in arguments,
+and name `nativeSessionId` when a producer stage is active. The CLI snapshots
+inputs and plans exact output paths before invoking the ordinary program. It
+adds no permission bypass or dependency installation, forwards no provider
+credentials and launches no reasoning agent. The workspace lease is released
+during computation. Program authoring and scientific decisions remain native.
+
+The returned record binds runtime/code/input/output bytes, process exit/signal
+and time. Use `nativeRunSha256` at acceptance; those results come only from that
+run, not a directory scan or unrelated external files. Success requires a zero
+exit, stable inputs and every declared output; failure/timeout/cancellation and
+missing or changed outputs remain nonpassing records. Committed replay does not
+run again. An incomplete interrupted run requires inspection and an explicitly
+new run ID, not automatic retry. `stagingDirectoryName` is only a safe relative
+local-inspection hint; permanent hash-bound objects carry audit authority.
+`observation=cli-observed-native-process` is not mathematical correctness or an
+authenticated execution certificate. The dependency lock is explicitly
+`declared-lock-not-attested`; no hermetic-environment claim is inferred.
+
+One unchanged result blob is stored once and appears once in the reviewer directory. The
 existing independent review receives the original request, original/current
 requirements, exact checks and results, and returns a bound `taskAssessment`;
 there is no additional default paid review round. Missing current checks stop
 before review, and stale/failed/inconclusive checks cannot be promoted to answered.
 Publication packets and portable audit verification retain these relationships;
 hash integrity does not prove execution, scientific validity, or editorial acceptance.
+Native and scientific packets stage observed programs, locks, inputs and outputs
+for exact on-demand inspection. Portable audit checks native start/completion
+events, requirement versions and all run objects. It also replays read selectors
+against the exact stored object, directory and packet/delivery records; a rehashed
+outer inventory cannot hide missing program bytes or a changed read receipt.
 
 `project task status` and each `research run` project summary report original and
 current task completion separately from workflow completion and publication verdict.
@@ -1497,6 +1918,107 @@ A completed workflow or approved reduced scope must not be described as satisfyi
 unanswered original requirements. Use the selected runtime's help/schema discovery
 once before adopting these commands; they are not an implicit runtime upgrade.
 
+Native producer stage packets preserve the original `taskContract` and also
+carry `taskAcceptance`, compiled from the same authoritative check view used by
+status/review. Recorded, failed, stale and unanswered rows remain distinct. The
+packet artifact directory exposes `inputs/task-acceptance.json` and its exact
+check result files for on-demand reading, including non-calculation results.
+Compilation occurs during fresh preparation; replay returns the existing packet.
+A recorded check still requires the existing independent review for acceptance.
+
+## Bounded computational investigations
+
+Use an investigation for a still-unanswered computational requirement when the
+native producer needs several diagnostic attempts over fixed acquired inputs.
+The native host supplies hypotheses, programs, configuration choices and
+interpretation; the CLI observes individual calculations and records their
+relationships. It does not launch another producer or retry loop.
+
+Discover the exact selected CLI's closed schemas first:
+
+```bash
+tiangong-ai research schema show investigation --json
+tiangong-ai research schema show investigation-attempt --json
+tiangong-ai research schema show investigation-candidate --json
+tiangong-ai research schema show investigation-promotion --json
+tiangong-ai research schema show investigation-close --json
+```
+
+An envelope binds the requirement, Policy/design and acquisition versions, exact
+canonical input hashes, existing Node/Python runtimes, program and environment
+bytes, allowed numerical options and required diagnostic metrics/status fields.
+Configure the numeric project budget before approval. Limits include maximum
+runs, cumulative/per-run wall time, cost allocations, per-run `maxOutputBytes`
+and cumulative `maxTotalOutputBytes`. The per-run byte limit is at most 512 MiB.
+A read-only plan starts no program; approval requires its exact hash and the
+actual supplied authorization text:
+
+```bash
+tiangong-ai research project investigation plan PROJECT --input /absolute/envelope.json --json
+tiangong-ai research project investigation approve PROJECT --input /absolute/envelope.json --confirm PLAN_SHA256 --authorization-source /absolute/approval.txt --json
+tiangong-ai research project investigation attempt PROJECT --input /absolute/attempt.json --json
+tiangong-ai research project investigation status PROJECT --investigation INVESTIGATION_ID --json
+```
+
+Add `--workspace /absolute/research` when operating outside the selected research
+workspace. Use a separate scratch directory outside that workspace. Calculation
+confinement denies host network access and workspace reads, makes runtime roots
+read-only, and allows capsule writes. An unsupported boundary is refused before
+execution. Environment locks remain declarations, not dependency attestation;
+programs that require installation or broader capabilities need a separately
+reviewed scope.
+
+Within the approved envelope, attempts need no repeated owner approval. Each
+records a hypothesis, parent attempt (the previous committed attempt by default,
+or explicit `parentAttemptId`), configuration changes, exact results and bounded
+logs. Missing declared solver telemetry is diagnostic-incomplete. Process or
+solver failures remain diagnostic observations, not scientific answers.
+
+Output accounting includes stdout/stderr and the observed high-water sizes of
+declared output files, including the runtime probe. Streams are checked as they
+arrive; files are checked periodically and at completion. Observed overshoot is
+retained honestly; this is not a quota on every temporary filesystem write.
+Exceeding the byte budget terminates the calculation, prevents result admission
+and stops further attempts under that envelope. Unknown cost remains unknown;
+software accounting retains the approved upper-bound allocation.
+
+An identical committed attempt returns its original result. An unresolved start
+keeps its reservation and cannot be blindly replayed or replaced. A one-shot
+process guard retains the deadline independently of the observer and terminates
+the calculation if that observer disconnects; missing durable results remain
+unresolved rather than being reconstructed as success. Status exposes current
+authority, reservations and the permitted next action. Unresolved attempt status
+and promoted `task run inspect` also check the local supervisor process identity;
+a missing or mismatched process never establishes completion or permits retry.
+These local coordinates stay outside portable audit records. `select` records a
+candidate; `close` records why investigation stopped and releases unused cost
+allocation while preserving history. It refuses closure with unresolved work.
+
+```bash
+tiangong-ai research project investigation select PROJECT --input /absolute/selection.json --json
+tiangong-ai research project investigation close PROJECT --input /absolute/closure.json --json
+tiangong-ai research project investigation promotion plan PROJECT --input /absolute/promotion.json --json
+tiangong-ai research project investigation promotion approve PROJECT --input /absolute/promotion.json --confirm PLAN_SHA256 --authorization-source /absolute/promotion-approval.txt --json
+```
+
+Promotion approval alone does not freeze scientific objects or satisfy the task.
+Use existing scientific object registration and fulfillment for predeclared
+pending slots, or a separately approved authoritative successor for a changed
+frozen design. Then supply `investigationPromotionSha256` in a new `task run
+observe` request using the exact frozen recipe. That approval admits one fresh
+certification; a failed or unresolved certification does not authorize another.
+A candidate or older ordinary run cannot substitute for it. A passed observation
+can enter task-check records, with the existing independent review still required
+before the task is answered.
+
+Portable audits retain the investigation, attempt, candidate, promotion,
+certification and closure relationships. A successor includes the explicitly
+referenced source investigation's immutable records and blobs, excluding local
+routing and unrelated investigations. Verification reconstructs the scientific
+view at promotion and certification start, so a later freeze cannot retroactively
+certify an earlier run. Hash/relationship verification does not
+establish authorship, hermetic execution or scientific truth.
+
 ## Research Search
 
 Forward research-oriented search requests to SCI, report, patent, and ESG edge