@tiangong-ai/cli 0.0.61 → 0.0.62

package/README.md

@@ -12,8 +12,8 @@ checkPaths:
   - package.json
   - bin/**
   - src/**
-lastReviewedAt: 2026-09-04
-lastReviewedCommit: 25b236a15c846c0168ffb84f8afa390d71985f4b
+lastReviewedAt: 2026-09-11
+lastReviewedCommit: f0dc2ee
 ---
 
 # Tiangong AI CLI
@@ -70,16 +70,43 @@ tiangong-ai data run <capability-id> <operation-id> \
 The command-line capability and operation must match the versions in the input
 envelope. Credentials are never accepted in argv or input JSON. Each connector
 declares exact logical environment-variable bindings, HTTPS endpoint scopes,
-and execution limits in its execution manifest. Data commands deliberately do
+and acquisition limits in its execution manifest. Callers may explicitly
+tighten those limits, but upper layers do not silently reinterpret Agent
+context budgets as provider or record limits. Data commands deliberately do
 not load a cwd `.env` file.
 
 `data catalog` also returns a concise capability summary, what the capability
-provides and does not provide, operation summaries, and a separate discovery
-digest. `data describe` expands that layer with source ownership, coverage,
+provides and does not provide, operation summaries, a separate discovery
+digest, and an explicit `available` or `suspended` status. Suspended entries
+remain inspectable, but `doctor` and `run` block before any provider request.
+`data describe` expands that layer with source ownership, coverage,
 granularity, selection hints, typical uses, official documentation, freshness,
 license restrictions, and operation descriptions. Narrative discovery changes
 do not change the execution manifest digest used for compatibility binding.
 Operation input schemas include field-level descriptions and examples.
+Operations may also publish stable feature IDs for Skills that depend on a
+specific compatible behavior within the same contract major.
+
+GDELT DOC requests are paced at least five seconds apart within one CLI process,
+including split queries and retries. Missing-header 429 responses use bounded
+exponential backoff and remain `rate-limited`, never `no-results`. Independent
+processes sharing an egress must be coordinated by the caller. The opt-in positive
+live gate and its timing/throughput definitions are documented in
+[repository validation](docs/agents/repo-validation.md#gdelt-doc-live-acceptance).
+
+Auto Research keeps three budgets separate: connector acquisition limits,
+Evidence package bytes/files, and the Agent-visible context view. A validated
+result is persisted in full when it fits the Evidence package budget;
+`maxBrokerItems` and the context-token ceiling only shape the Agent view.
+Receipts distinguish provider coverage, explicit limits reached, and context
+projection instead of forcing them into one status. A projected result returns
+an opaque, evidence-bound cursor; `research project evidence data read` serves
+the next shape-aware view from immutable local Evidence without another
+provider request or provider quota charge. Agents must either continue until
+`nextCursor` is null or disclose the exact presented/total fraction.
+The public Research command returns receipt identity, coverage, a structured
+bounded context view, and continuation metadata. The complete core result
+remains in immutable Evidence and is not duplicated into Agent stdout.
 
 JSON exits are `0` for success, `2` for request/contract errors, `3` for a
 blocked execution, and `4` for an explicit partial result. Public machine
@@ -90,7 +117,11 @@ The built-in capabilities are:
 - `airnow.hourly-observations` / `fetch-hourly`: fetches official AirNow
   `HourlyAQObs` files for a bounded UTC-hour window, bounding box, and pollutant
   list. Results retain source-file lineage and always state that AirNow data are
-  preliminary and unsuitable as regulatory-grade AQS evidence.
+  preliminary and unsuitable as regulatory-grade AQS evidence. Independent
+  hourly files use bounded concurrency while output files and records retain
+  deterministic UTC-hour order. Execution uses the official
+  `files.airnowtech.org` S3 bucket through its regional S3 endpoint so a failing
+  CloudFront edge does not make the underlying public object unavailable.
 - `bluesky.public-posts` / `fetch-cascades`: fetches bounded public Bluesky
   post seeds from search, an author feed, a custom feed, or a list feed and can
   flatten visible reply cascades. Ranking, counters, moderation visibility, and
@@ -98,7 +129,10 @@ The built-in capabilities are:
 - `epa.eis-records` / `search`: retrieves bounded official EPA EIS Database
   common-search or UI-created search pages and parses title, CEQ/provider IDs,
   document type, dates, agencies, state, detail links, and document-availability
-  cues. It does not fetch or assess linked EIS documents.
+  cues. Its endpoint-scoped, same-origin session cookie jar exists only in
+  memory so the provider's initial redirect can complete; cookies never enter
+  results, receipts, logs, or cross-origin requests. It does not fetch or assess
+  linked EIS documents.
 - `federal-register.documents` / `search`: searches bounded
   FederalRegister.gov document metadata by publication date plus term, agency,
   document type, topic, docket, or RIN filters. It does not follow result links,
@@ -106,48 +140,56 @@ The built-in capabilities are:
 - `gdelt.doc-search` / `search`: searches the rolling GDELT DOC 2.0 index for
   bounded article-link metadata or supported aggregate timelines. Automated
   multilingual extraction and uneven monitored-source coverage are explicit;
-  it does not retrieve article bodies or establish ground-truth facts.
+  it does not retrieve article bodies or establish ground-truth facts. The
+  capability is currently suspended because representative modes do not pass a
+  stable live gate under the provider's dynamic load shedding.
+- `gdelt.web-ngrams` / `search`: searches literal 1–4-word phrases in one
+  explicit published UTC minute's GZIP NGrams/TOC pair, returning matched
+  article links with file-scoped IDs. This local candidate extension is a
+  separately selected file-based alternative to DOC discovery, not a DOC query
+  or timeline substitute. Missing files block; malformed rows and omitted
+  matches are partial. No implicit time-range sampling or automatic fallback.
 - `gdelt.events`, `gdelt.gkg`, and `gdelt.mentions` / `fetch`: independently
   discoverable GDELT 2.0 table capabilities backed by one bounded TypeScript
   file-feed core. They fetch either the latest provider entry or at most twenty
   aligned 15-minute files, verify ZIP/CRC and advertised latest-file checksums,
-  and emit closed named columns without persisting downloaded files.
+  and emit closed named columns without persisting downloaded files. Their
+  wide named-field JSON is preserved as Evidence; Agent context projection is
+  handled by Auto Research without changing the connector result.
 - `nasa-firms.active-fire` / `fetch-area`: retrieves bounded NASA FIRMS MODIS,
   VIIRS, or Landsat active-fire point detections, optionally validates source
   availability, and exposes chunk-level partial coverage. Hotspots are thermal
   anomalies, not fire perimeters or confirmed incident identities.
 - `open-meteo.air-quality` / `fetch-hourly`: retrieves bounded GMT hourly CAMS
   model-grid air-quality series for known coordinates; these are modeled
-  background values rather than station observations.
+  background values rather than station observations. Missing and explicitly
+  returned all-null series are distinct machine-readable partial issues.
 - `open-meteo.flood` / `fetch-daily`: retrieves bounded daily GloFAS simulated
   river-discharge series for the represented river grid; it is neither gauge
-  data nor a flood-alert service.
+  data nor a flood-alert service. Missing and explicitly returned all-null
+  series are distinct machine-readable partial issues.
 - `open-meteo.historical-weather` / `fetch`: retrieves bounded GMT hourly and/or
   daily historical weather reanalysis for one controlled model and known
   coordinates. ERA5 or ERA5-Land should be selected when multi-decade model
-  consistency matters.
+  consistency matters. Missing requested series and provider-returned series
+  whose values are all `null` are distinct machine-readable partial issues.
 - `openaq.air-quality` / `search-locations` and `fetch-sensor-measurements`:
   discovers filtered OpenAQ v3 locations and retrieves a bounded raw, hourly,
   or daily series for one sensor. It preserves provider/license context but
   does not calculate AQI or make health or regulatory determinations.
-- `regulations-gov.comments` / `search` and `fetch-details`: searches bounded
-  Regulations.gov public-comment metadata and retrieves curated details for
-  explicit comment IDs. It omits named personal-profile fields, never submits
-  comments, and returns attachment metadata without downloading file bytes.
-- `regulations-gov.attachments` / `download`: retrieves attachment metadata for
-  exact public comment IDs and writes bounded files only from the official
-  Regulations.gov download origin. It requires `--artifact-dir`, refuses to
-  overwrite files, and commits SHA-256-bound relative files plus a manifest;
-  it does not scan, open, extract, or interpret the untrusted bytes.
 - `usbr.project-records` / `fetch`: inventories caller-supplied official
   `www.usbr.gov` project or program pages plus bounded same-origin links. It
   preserves page response provenance but does not follow, download, parse, or
-  assess linked records and is not USBR-wide search.
+  assess linked records and is not USBR-wide search. Execution is currently
+  suspended because the official origin returns a gateway rejection page in
+  the supported CLI environment.
 - `usbr.rise` / `discover-items` and `fetch-results`: scans bounded Bureau of
   Reclamation RISE catalog pages for client-filtered candidate item IDs, then
   retrieves bounded result rows for explicitly selected items. Provider scan
   order is not ranking, and operational values require item metadata and domain
-  context before interpretation.
+  context before interpretation. Execution is currently suspended because both
+  the legacy API and the official EDR beta endpoint are rejected by the
+  provider gateway in the supported CLI environment.
 - `usgs.water-instantaneous-values` / `fetch`: retrieves bounded legacy USGS
   WaterServices instantaneous observations while preserving site, parameter,
   qualifier, provisional status, and source lifecycle warnings.
@@ -156,12 +198,17 @@ The built-in capabilities are:
   comment/reply text for explicit video IDs. It does not download media or
   transcripts and does not treat ranking or comments as representative opinion.
 
-Fourteen capabilities are keyless. NASA FIRMS requires `NASA_FIRMS_MAP_KEY`, which the
+GDELT DOC, Regulations.gov comment/attachment, USBR RISE, and USBR project
+records remain discoverable with `availability.status=suspended`, a stable
+reason code, and explicit resume criteria. `doctor` and `run` block locally
+without network access, and Auto Research excludes them from its executable
+projection until their production live gates qualify them again.
+
+Of the fifteen execution-enabled capabilities, twelve are keyless. NASA FIRMS requires `NASA_FIRMS_MAP_KEY`, which the
 CLI injects as a protected provider path segment; OpenAQ requires
-`OPENAQ_API_KEY`, Regulations.gov requires `REGGOV_API_KEY`, and YouTube requires
-`YOUTUBE_API_KEY`; the CLI injects all three as protected provider headers, with
-YouTube using `X-Goog-Api-Key` rather than a URL parameter. No secret is accepted
-in argv or input JSON. Exact input and output schemas,
+`OPENAQ_API_KEY`, and YouTube requires `YOUTUBE_API_KEY`; the CLI injects the
+latter two as protected provider headers, with YouTube using `X-Goog-Api-Key`
+rather than a URL parameter. No secret is accepted in argv or input JSON. Exact input and output schemas,
 endpoint scopes and limits are available through the execution manifest, while
 source notes, coverage, selection guidance and license restrictions are
 available in the discovery metadata returned by `data describe`; static
@@ -383,6 +430,57 @@ bytes and report that a new native-host session is required before the routing
 instruction becomes active. Global-scope Skill installation does not create
 project instruction files.
 
+### Reviewed setup upgrades
+
+Use `research setup update --check --candidate-version <exact-stable-version>`
+to inspect one explicitly selected release. Omitting `--candidate-version` keeps
+this a local catalog comparison with no registry request. The optional query
+pins the public npm registry and package scope, has finite time/output limits,
+and reports `newer`, `same`, `older`, or `unavailable`. Metadata includes the
+exact version, tarball URL, SHA-512 integrity and Git commit. This validates
+registry metadata; it does not independently download or authenticate the
+package. An unavailable query never means that no update exists: when there is
+no separately confirmed local migration, `updateAvailable` is `null`.
+
+An older workspace resolver deliberately continues selecting its recorded CLI.
+To use an upgrade-capable candidate, select its exact published version and run
+that version directly; do not edit the runtime lock or use floating `latest`:
+
+```bash
+REVIEWED_UPGRADE_CLI_VERSION=X.Y.Z # replace with one reviewed exact stable release
+npx --yes --registry=https://registry.npmjs.org \
+  --@tiangong-ai:registry=https://registry.npmjs.org --strict-ssl=true \
+  --package "@tiangong-ai/cli@$REVIEWED_UPGRADE_CLI_VERSION" -- tiangong-ai \
+  research setup upgrade --plan --confirm-upgrade \
+  --workspace /absolute/path/to/workspace --json
+```
+
+Review the returned immutable `planPath` and execute its `applyCommand`. The
+candidate also binds the SHA-256 identity of `package.json`, `bin/` and `dist/`;
+apply and rollback reject changed CLI runtime bytes before workspace mutation.
+This content binding excludes installed dependencies and is not a publisher
+signature. Ordinary research commands do not rescan these trees. Planning
+leaves the active plan, runtime lock, configuration and installed Skills intact.
+Apply stages the complete selected generation, verifies each prior-owned tree,
+and reuses unchanged trees and verified downloads. Modified or linked targets
+remain protected. It preserves the workspace identity, evidence, credentials,
+budgets, current model/pricing choices, custom launchers and reviewer transport.
+Changed license choices remain explicit; unchanged accepted licenses carry forward.
+
+An interrupted commit blocks ordinary workspace use and reports the exact
+candidate recovery command. Repeat that candidate's apply to resume, or use its
+`rollbackCommand` to restore the directly bound prior generation with the new
+updater. Rollback refuses conflicting owner changes or subsequent research
+activity. Interrupted rollback remains blocked and resumes with the same command.
+Private rollback preimages (including configured credentials) and prepared caches
+are retained for recovery; they are excluded from portable setup audit exports.
+Doctor runs after coherent activation; a repeated apply does not repeat a paid
+check that already started. If its result was lost, explicitly inspect status
+and run Doctor as needed. Old readiness attestations never certify new bytes.
+A legacy already-mixed plan/lock fails with
+`RESEARCH_SETUP_LEGACY_UPGRADE_RECOVERY_REQUIRED`; preserve its directly linked
+setup history for diagnosis rather than deleting Skills or rewriting locks.
+
 ### Declarative setup
 
 For repeatable provisioning without a TTY, generate a safe workspace-local
@@ -679,7 +777,22 @@ replayed without another model call after revalidating its immutable proof.
 Failures require explicit `--retry` and remain bounded by the attempt budget;
 unreported usage and interrupted wall time retain conservative reservations.
 Failed processes return a bounded, sanitized exit diagnostic and record it in
-the journal; no full prompt or raw authentication output is persisted. Automatic
+the journal; no full prompt or raw authentication output is persisted.
+When the reviewer returns but submission is rejected, the error and failed
+journal event also return an `executionRecord` locator and SHA-256. The locator
+is relative to `.tiangong-research/` and points to an immutable
+`scientific/failed-executions/` record containing the packet/run binding,
+reported usage and identity, rejection code, and safely retained JSON stdout.
+These are unaccepted execution observations, not a review receipt or permission
+to pass a gate. Inspecting them does not call the provider; another execution
+still requires explicit `--retry`.
+Retained stdout is limited to the smaller of 1 MiB and the configured output
+capture allowance. Unsafe, oversized, or malformed JSON keeps only its digest,
+size and omission reason. If storage fails, `outputRetention=storage-unavailable`
+is reported with the original error instead of claiming that a result was saved.
+Successful review and replay use their existing output/receipt without this
+additional failure capture.
+Automatic
 Claude invocation uses the same dialect-annotation conversion as
 `research schema show NAME --compatibility claude-code`; canonical controller
 validation and its scientific constraints remain unchanged.
@@ -717,17 +830,40 @@ audit manifest separately records the raw stored packet-file digest. This keeps
 packet identity and byte-level transfer verification explicit rather than
 overloading one hash with both meanings.
 
-After base closure, the current native host writes a final Markdown/plain-text
+After base closure, inspect `research publication lineage PROJECT --json` before
+authoring materials. It verifies the existing closure and reviewed packet's
+analysis, report and evidence-chain hashes and returns their analysis identity
+with an empty material-file template. It does not certify or relabel previously
+authored files. The current native host then writes a final Markdown/plain-text
 manuscript, schema-valid publication assessment, and an explicit submission
 manifest. The manuscript must contain Abstract, Introduction, Methods, Results,
-Discussion, Data availability, Code availability, and References. The
+Discussion, Data availability, Code availability, and References. Decimal
+section prefixes such as `1. Introduction`, `2 Methods`, `3.1 Results`, and
+`4) Discussion` are accepted when separated from the title by whitespace;
+unrelated titles and body text still cannot satisfy a required section. The
 submission manifest must bind distinct absolute files for cover letter, title
 page, reporting checklist, data availability, code availability, and source
 data; figure/table index, extended data, and supplementary methods are optional.
+The schema-version-1 submission manifest also requires `resultLineage`, following
+`research schema show publication-result-lineage --json`. Preserve the source
+analysis identity from material preparation. Include a role, actual byte SHA-256
+and source `analysisSha256` for the manuscript, assessment, every submission file
+and each `supplement-N` (one-based supplied order). Include the actual figures,
+tables and source inputs as submission files or supplements; an index alone is
+not their contents. Do not replace a stale parent hash merely to pass validation.
+Completeness and scientific derivation remain producer claims for independent
+review; the CLI verifies declared lineage and bytes, not scientific truth.
 `research publication freeze` then content-addresses the Policy, scientific
 design and early reviews, acquisition/content/inference snapshots, mode-bound
 analysis, Claim-Evidence Graph, base outputs, manuscript, assessment,
 supplements, role-complete submission files, and reproducibility manifest.
+Validation reads the frozen copies. The generation, review packet and closure
+carry `analysisGenerationId` and a content-addressed material-results manifest;
+the reproducibility record binds that manifest. A different closed generation,
+changed report, mixed file parent or changed prepared bytes fails before review.
+Status/review/closure recheck the current closed lineage and report the affected
+object and binding. Legacy generations without the manifest retain their history
+but cannot establish current readiness; prepare an honest binding and refreeze.
 Computational/mixed analysis still requires reproduced metadata with exact
 implementation/environment bindings. Qualitative analysis uses
 `status: not-applicable`, null command/seed and empty implementation/environment
@@ -745,6 +881,9 @@ generation, packet, review, journal, and closure objects persist only their
 SHA-256 bindings.
 
 ```bash
+tiangong-ai research publication lineage top-journal-paper \
+  --workspace /absolute/path/to/workspace --json
+tiangong-ai research schema show publication-result-lineage --json
 tiangong-ai research schema show publication-assessment --json
 tiangong-ai research publication freeze top-journal-paper \
   --manuscript /absolute/path/to/final-manuscript.md \
@@ -777,6 +916,10 @@ from credential fields. It checks raw text and read-only decoded JSON/JSONL,
 including escaped keys and nested string payloads, while retaining the exact
 evidence and ledger bytes. Authentication values remain blocked even when wrapped
 in arrays or objects; an identifier's UUID shape is never a credential exemption.
+Within the existing 16 MiB per-file text scan bound, valid UTF-8 inputs are also
+checked after staging under extensionless content hashes. Binary inputs remain
+byte-preserving. A nonportable-path error reports a bundle-relative `details.path`
+without disclosing the original host path or the matched source text.
 
 ```bash
 tiangong-ai research project audit export top-journal-paper \
@@ -841,6 +984,11 @@ presentation Skills are post-closure authoring only. Run selected preprocessors
 and acquisition adapters with `research setup companion run`, then admit their
 exact hash-bound output separately. Automatic paper OA exhaustion returns an
 explicit browser handoff and never launches or chooses a browser silently.
+Paper results require the pinned adapter's identity-verified artifact.v3
+manifest: matched document identity must agree between the result and manifest
+and bind the requested or resolved DOI. PDF/manifest paths, bytes and hashes
+remain checked independently. Structural-only legacy metadata cannot establish
+document identity, and successful access does not imply redistribution rights.
 The paper companion and its setup-doctor preflight both enter the verified
 Skill through `scripts/runtime.py`; the CLI never bypasses that lock by invoking
 `fetch.py` or importing `pypdf` from ambient Python. A missing runtime remains
@@ -968,6 +1116,29 @@ reviewer shell, browser, web, undeclared MCP, and Skill tools remain disabled.
 Do not use Full Access, sandbox-disable flags, unsandboxed-command exceptions,
 or silent transport fallback.
 
+Before sending reviewer material, inspect `research reviewer status --json`.
+The runtime reports the CLI family and configured model alias separately from
+`providerRouting`: the configured Claude endpoint origin/source, model-mapping
+sources and a digest of admitted routing values. Explicit process environment
+overrides the imported Claude `settings.json` env allowlist. Approved custom
+HTTPS gateways remain supported. Doctor's `reviewer-configured-routing` check
+is configuration inspection; it does not make a paid model request.
+
+Routing changes invalidate the prior runtime binding before reviewer execution.
+Unchanged effective routing reuses the existing attestation; missing legacy
+bindings require an explicit smoke refresh. Status never starts paid checks.
+Paths, query strings, proxy credentials and mapped provider IDs are omitted
+from routing receipts. `identityVerification=unverified` is intentional: a CLI
+family, model alias, endpoint configuration or successful smoke cannot attest
+the actual upstream provider/model or historical HTTP destinations. A null
+endpoint means no supported explicit endpoint was resolved, not an official
+provider guarantee. Wrappers, proxies and runtime defaults remain outside that
+identity guarantee. Bridge status identifies transport readiness separately.
+Execution `model` and `runtime.model` retain the configured alias; optional
+`telemetry.reportedModel` records the sanitized CLI self-report, with null when
+absent. A mapped response name does not change the configured runtime identity
+or require another smoke. It is not independently verified provider identity.
+
 WorkBuddy/CodeBuddy capsule teardown never requests recursive bulk deletion
 inside the outer IDE. Native stages remove only the single active-session
 binding, while completed, aborted, handed-off, and reviewer/work-package
@@ -1214,7 +1385,8 @@ It does not claim a provider-side turn or output-token cap for the host app.
 
 Independent review uses the pre-call reservation calculator and the reviewer's
 provider-side structured-output/turn controls where available. Claude packet-only
-review has a 64-turn provider guard; Codex uses the existing finite wall-time and
+review chooses the largest affordable turn count up to a 64-turn provider
+guard and uses that same count in its reservation; Codex uses the existing finite wall-time and
 token/cost guards because its CLI has no equivalent turn flag. Planning uses a
 small initial-context estimate and expected reads, not the entire corpus or an
 unbounded legacy context hint. Preflight reports `inputContextTokenLimit=null`.
@@ -1232,6 +1404,55 @@ records and JSONL progress preserve sanitized accounting mode, event/item
 counts, provider turns, tool calls, reasoning tokens, and bounded provider
 errors.
 
+Owners can opt into a numeric project authorization with `project init` or
+`project preflight --max-cost-usd`, or adopt it for an existing project:
+
+```bash
+tiangong-ai research project budget set PROJECT --max-cost-usd 50 \
+  --provider-costs /absolute/provider-costs.json --confirm-budget \
+  --workspace /absolute/workspace --json
+```
+
+The JSON file maps selected capability IDs to owner-reviewed USD maxima for one
+logical operation, for example `{ "method.public-source": 0.01 }`. Choose these
+values from your actual provider agreement; the example is synthetic. Each
+allocation includes that operation's bounded redirects, retries, and provider
+pagination. Missing prices block new provider work; they do not mean zero.
+Project and shared HTTP caches, and local reads of stored Data windows, require
+no new monetary allocation. The existing broker call-count budget still counts
+cache/tool invocations. Concurrent provider calls share one durable ledger;
+local ledger writes are serialized while network operations remain parallel.
+
+The project ledger covers project stage/reviewer admissions and the project
+HTTP/Data evidence entrypoints. Workspace setup/Doctor probes, setup companion
+commands, standalone `data run`, and unrelated host-app actions have no project
+budget binding; their charges are unobserved here and must not be counted as
+zero. Native host work is represented by its declared allocation, not trusted
+provider metering.
+
+The project budget response separates accounted estimates, pending reservations,
+remaining authorization, and overruns. It never reports a provider invoice.
+Model actions require declared route prices; native/provider operations use
+conservative allocations where trusted usage is unavailable. Increasing the
+authorization or changing provider maxima requires `--confirm-budget`.
+Tightening cannot exclude already spent or reserved exposure. Legacy projects
+retain their existing workspace controls until explicitly adopted; changing a
+project authorization leaves workspace settings and Doctor bindings intact.
+Fork/addendum recovery carries outstanding obligations to the current project
+without counting them twice. An uncertain operation remains pending until it
+ends or the owner explicitly resolves it with `project budget resolve`, a
+reservation ID, an accounted estimate, a reason, and `--confirm-budget`.
+A native reservation requires its original session to have ended first.
+Settled accounting evidence is immutable, including conservative allocated
+maxima; this interface does not revise historical costs or reconcile provider
+invoices. Choose reviewed per-operation maxima accordingly.
+An owner estimate above the ceiling records an overrun and blocks further
+positive-cost work; it does not silently increase the authorization.
+If a command fails after saving the decision but before writing its journal
+record, retrying the same command reconciles the missing record without changing
+the authorization or charging again. The record is marked as reconciliation;
+contradictory journal evidence stops the replay for inspection.
+
 Every evidence source must resolve to an admitted input, a completed broker
 receipt, or a completed structured data-runtime receipt. Successful broker and
 data results are immutable content-addressed objects under
@@ -1263,6 +1484,11 @@ with `tiangong-ai data describe`, then run the exact request through:
 tiangong-ai research project evidence data run <project-id> \
   --request /absolute/path/to/data-run-request.json \
   --workspace /absolute/path/to/workspace --json
+
+# When contextView.nextCursor is non-null, continue from persisted Evidence:
+tiangong-ai research project evidence data read <project-id> \
+  --receipt <attempt-id> --cursor <opaque-next-cursor> \
+  --workspace /absolute/path/to/workspace --json
 ```
 
 This Research command calls the same TypeScript data service in-process; it does
@@ -1275,6 +1501,12 @@ credentialed operation must resolve its namespaced logical credential from the
 workspace's owner-only store or it is blocked before any provider request.
 Standalone `tiangong-ai data run` keeps its separate manifest-declared
 environment-variable policy. A blocked data result is not promoted to evidence.
+Native packets publish data commands as `workspace-cli-relative-argv`;
+installed Auto Research must prefix them with its workspace-locked resolver
+rather than resolving a global CLI from `PATH`.
+Data Evidence continuation is read-only and does not consume another evidence-call
+or provider-request budget. Provider coverage, limits reached, and Agent context
+coverage are reported independently, so a result may be both partial and bounded.
 Analyze and synthesize packets contain hash-verified prior-stage artifacts and
 require no external evidence calls. Base and scientific review use only the
 packet-bound `research_list_artifacts` and `research_read_artifact` tools; shell,
@@ -1489,7 +1721,7 @@ acquisition snapshot; unchanged records are reused. Single and batch intake shar
 this rule. Historical records remain immutable, and atoms from deselected artifacts
 cannot fill current coverage. Same-snapshot conflicting extraction still fails.
 
-Actual question/Policy/design changes or post-analysis work require the existing
+Substantive question/Policy/design changes or post-analysis work require the existing
 fork/addendum flow. Pre-feature snapshots without immutable evidence records cannot
 be repaired in place; use `research project fork SOURCE --to TARGET
 --resume-through discover` to reuse discovery/receipts/artifacts, or explicitly
@@ -1497,6 +1729,54 @@ start a new generation. There is no automatic migration. A top-journal successor
 requires a Policy approved for TARGET and `--design`, `--design-producer-agent`,
 and `--design-producer-session`; it cannot inherit scientific approval.
 
+### Amend planned design declarations before analysis
+
+At an idle boundary before analysis or inference freeze, a compatible runtime
+can amend an existing planned Policy rule's due gate, rationale, or links to
+already declared models/parameters. The question, claims, thresholds, model
+and parameter definitions/values, evidence requirements and Policy content stay
+fixed. Substantive changes continue through a reviewed successor.
+
+```bash
+tiangong-ai research schema show scientific-amendment --json
+tiangong-ai research scientific amendment plan PROJECT \
+  --input /absolute/amendment-input.json --workspace /absolute/workspace --json
+```
+
+The closed input contains `schemaVersion: 1`, a reason and `changes`; use the
+schema for their exact fields. Amendment status exposes the current editable
+fields under `plannedRules`, so unchanged links can be preserved explicitly. Save the returned plan JSON unchanged externally.
+It shows before/after declarations, current parent bindings, preserved acquisition,
+invalidated scientific gates and `affectedTaskRequirementIds`. Planning does not
+mutate the project or request a provider. After explicit approval of that exact
+plan, retain the actual supplied confirmation text in a bounded UTF-8 file:
+
+```bash
+tiangong-ai research scientific amendment apply PROJECT \
+  --plan /absolute/amendment-plan.json --confirm REVIEWED_PLAN_SHA256 \
+  --authorization-source /absolute/confirmation.txt --workspace /absolute/workspace --json
+tiangong-ai research scientific amendment status PROJECT --workspace /absolute/workspace --json
+```
+
+The CLI records operator-supplied confirmation, not authenticated human identity.
+Original design bytes, fulfillment records and valid evidence remain unchanged;
+a new immutable declaration version and its exact parent/changes/source are
+retained. Planned rules are not marked scientifically satisfied. New early
+scientific reviews receive the version history and current effective design.
+
+Task checks linked through existing claim/coverage bindings to changed rules
+become stale; unrelated checks remain reusable and idempotent. Affected check
+contexts expose `requiredDesignAmendmentSha256`; an explicit reassessment records
+its applicable amendment without requiring unchanged sources or calculations to
+be rerun. Unbound source-only checks do not establish the amended design's
+validity. Portable audit verifies the same selective relationships.
+
+Changed parents or Policy, unsupported fields, active stages and late amendments
+reject. Inspect and replan instead of editing hashes. A committed but interrupted
+apply recovers through the existing project transaction and identical retry;
+unknown or conflicting files are preserved. This path does not add a new paid
+review role or silently upgrade a locked runtime that lacks these commands.
+
 ### Fulfill predeclared scientific objects
 
 At an idle boundary before analysis, register the exact code/environment files
@@ -1638,6 +1918,107 @@ A completed workflow or approved reduced scope must not be described as satisfyi
 unanswered original requirements. Use the selected runtime's help/schema discovery
 once before adopting these commands; they are not an implicit runtime upgrade.
 
+Native producer stage packets preserve the original `taskContract` and also
+carry `taskAcceptance`, compiled from the same authoritative check view used by
+status/review. Recorded, failed, stale and unanswered rows remain distinct. The
+packet artifact directory exposes `inputs/task-acceptance.json` and its exact
+check result files for on-demand reading, including non-calculation results.
+Compilation occurs during fresh preparation; replay returns the existing packet.
+A recorded check still requires the existing independent review for acceptance.
+
+## Bounded computational investigations
+
+Use an investigation for a still-unanswered computational requirement when the
+native producer needs several diagnostic attempts over fixed acquired inputs.
+The native host supplies hypotheses, programs, configuration choices and
+interpretation; the CLI observes individual calculations and records their
+relationships. It does not launch another producer or retry loop.
+
+Discover the exact selected CLI's closed schemas first:
+
+```bash
+tiangong-ai research schema show investigation --json
+tiangong-ai research schema show investigation-attempt --json
+tiangong-ai research schema show investigation-candidate --json
+tiangong-ai research schema show investigation-promotion --json
+tiangong-ai research schema show investigation-close --json
+```
+
+An envelope binds the requirement, Policy/design and acquisition versions, exact
+canonical input hashes, existing Node/Python runtimes, program and environment
+bytes, allowed numerical options and required diagnostic metrics/status fields.
+Configure the numeric project budget before approval. Limits include maximum
+runs, cumulative/per-run wall time, cost allocations, per-run `maxOutputBytes`
+and cumulative `maxTotalOutputBytes`. The per-run byte limit is at most 512 MiB.
+A read-only plan starts no program; approval requires its exact hash and the
+actual supplied authorization text:
+
+```bash
+tiangong-ai research project investigation plan PROJECT --input /absolute/envelope.json --json
+tiangong-ai research project investigation approve PROJECT --input /absolute/envelope.json --confirm PLAN_SHA256 --authorization-source /absolute/approval.txt --json
+tiangong-ai research project investigation attempt PROJECT --input /absolute/attempt.json --json
+tiangong-ai research project investigation status PROJECT --investigation INVESTIGATION_ID --json
+```
+
+Add `--workspace /absolute/research` when operating outside the selected research
+workspace. Use a separate scratch directory outside that workspace. Calculation
+confinement denies host network access and workspace reads, makes runtime roots
+read-only, and allows capsule writes. An unsupported boundary is refused before
+execution. Environment locks remain declarations, not dependency attestation;
+programs that require installation or broader capabilities need a separately
+reviewed scope.
+
+Within the approved envelope, attempts need no repeated owner approval. Each
+records a hypothesis, parent attempt (the previous committed attempt by default,
+or explicit `parentAttemptId`), configuration changes, exact results and bounded
+logs. Missing declared solver telemetry is diagnostic-incomplete. Process or
+solver failures remain diagnostic observations, not scientific answers.
+
+Output accounting includes stdout/stderr and the observed high-water sizes of
+declared output files, including the runtime probe. Streams are checked as they
+arrive; files are checked periodically and at completion. Observed overshoot is
+retained honestly; this is not a quota on every temporary filesystem write.
+Exceeding the byte budget terminates the calculation, prevents result admission
+and stops further attempts under that envelope. Unknown cost remains unknown;
+software accounting retains the approved upper-bound allocation.
+
+An identical committed attempt returns its original result. An unresolved start
+keeps its reservation and cannot be blindly replayed or replaced. A one-shot
+process guard retains the deadline independently of the observer and terminates
+the calculation if that observer disconnects; missing durable results remain
+unresolved rather than being reconstructed as success. Status exposes current
+authority, reservations and the permitted next action. Unresolved attempt status
+and promoted `task run inspect` also check the local supervisor process identity;
+a missing or mismatched process never establishes completion or permits retry.
+These local coordinates stay outside portable audit records. `select` records a
+candidate; `close` records why investigation stopped and releases unused cost
+allocation while preserving history. It refuses closure with unresolved work.
+
+```bash
+tiangong-ai research project investigation select PROJECT --input /absolute/selection.json --json
+tiangong-ai research project investigation close PROJECT --input /absolute/closure.json --json
+tiangong-ai research project investigation promotion plan PROJECT --input /absolute/promotion.json --json
+tiangong-ai research project investigation promotion approve PROJECT --input /absolute/promotion.json --confirm PLAN_SHA256 --authorization-source /absolute/promotion-approval.txt --json
+```
+
+Promotion approval alone does not freeze scientific objects or satisfy the task.
+Use existing scientific object registration and fulfillment for predeclared
+pending slots, or a separately approved authoritative successor for a changed
+frozen design. Then supply `investigationPromotionSha256` in a new `task run
+observe` request using the exact frozen recipe. That approval admits one fresh
+certification; a failed or unresolved certification does not authorize another.
+A candidate or older ordinary run cannot substitute for it. A passed observation
+can enter task-check records, with the existing independent review still required
+before the task is answered.
+
+Portable audits retain the investigation, attempt, candidate, promotion,
+certification and closure relationships. A successor includes the explicitly
+referenced source investigation's immutable records and blobs, excluding local
+routing and unrelated investigations. Verification reconstructs the scientific
+view at promotion and certification start, so a later freeze cannot retroactively
+certify an earlier run. Hash/relationship verification does not
+establish authorship, hermetic execution or scientific truth.
+
 ## Research Search
 
 Forward research-oriented search requests to SCI, report, patent, and ESG edge