@xfey/tutti 0.1.51 → 0.1.53

package/dist/artifacts/candidate-validator.d.ts

@@ -1,8 +1,8 @@
 import type { ChildProcessWithoutNullStreams } from "node:child_process";
 import { type ValidatedArtifactContract } from "./manifest-contract.js";
 import { type ArtifactPreviewProcessPlan } from "./process-boundary.js";
-export type ArtifactValidationReasonCode = "artifact_applicability_failed" | "artifact_manifest_missing" | "artifact_manifest_invalid" | "artifact_static_entry_invalid" | "artifact_preview_script_missing" | "artifact_preview_start_failed" | "artifact_preview_not_ready" | "artifact_preview_entry_invalid" | "artifact_preview_modified_candidate";
-export type ArtifactValidationDiagnosticSource = "applicability_judge" | "manifest_parser" | "package_json" | "preview_process" | "ready_probe" | "candidate_diff";
+export type ArtifactValidationReasonCode = "artifact_applicability_failed" | "artifact_manifest_missing" | "artifact_manifest_invalid" | "artifact_static_entry_invalid" | "artifact_preview_script_missing" | "artifact_preview_start_failed" | "artifact_preview_not_ready" | "artifact_preview_entry_invalid";
+export type ArtifactValidationDiagnosticSource = "applicability_judge" | "manifest_parser" | "package_json" | "preview_process" | "ready_probe";
 export type ArtifactValidationDiagnostic = {
     source: ArtifactValidationDiagnosticSource;
     text: string;
@@ -30,7 +30,6 @@ export type ValidateCandidateArtifactOptions = {
     allocatePort?: () => Promise<number>;
     fetchImpl?: typeof fetch;
     terminateProcess?: (child: ChildProcessWithoutNullStreams) => Promise<void>;
-    fingerprintCandidate?: (repoRoot: string) => string;
     readyTimeoutMs?: number;
     probeIntervalMs?: number;
     probeRequestTimeoutMs?: number;

package/dist/artifacts/candidate-validator.js

@@ -1,6 +1,5 @@
 import { lstatSync, readFileSync, realpathSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
-import { fingerprintProjectSourceState } from "../workspace-ops/index.js";
 import { ARTIFACT_MANIFEST_PATH, MAX_ARTIFACT_MANIFEST_BYTES, parseArtifactManifestContract, } from "./manifest-contract.js";
 import { allocateArtifactPreviewPort, ArtifactDiagnosticBuffer, cleanupArtifactProcessRuntime, createArtifactPreviewEnv, createArtifactProcessRuntime, spawnArtifactPreviewProcess, terminateArtifactProcessTree, } from "./process-boundary.js";
 const MAX_PACKAGE_JSON_BYTES = 1024 * 1024;
@@ -290,21 +289,6 @@ async function validateServerCandidate(repoRealPath, contract, options) {
             sensitive: { repoRoot: repoRealPath, extra: [cwd.path] },
         });
     }
-    const fingerprint = options.fingerprintCandidate ?? fingerprintProjectSourceState;
-    let beforeFingerprint;
-    try {
-        beforeFingerprint = fingerprint(repoRealPath);
-    }
-    catch (error) {
-        return failure({
-            reasonCode: "artifact_preview_modified_candidate",
-            summary: "Tutti could not capture the candidate state before preview validation.",
-            guidance: "Keep the candidate project directory in a valid Git repository and retry.",
-            source: "candidate_diff",
-            detail: error instanceof Error ? error.message : "Candidate state capture failed",
-            sensitive: { repoRoot: repoRealPath },
-        });
-    }
     const processRuntime = createArtifactProcessRuntime();
     const diagnostics = new ArtifactDiagnosticBuffer();
     let child;
@@ -439,30 +423,6 @@ async function validateServerCandidate(repoRealPath, contract, options) {
         }
         cleanupArtifactProcessRuntime(processRuntime);
     }
-    let afterFingerprint;
-    try {
-        afterFingerprint = fingerprint(repoRealPath);
-    }
-    catch (error) {
-        return failure({
-            reasonCode: "artifact_preview_modified_candidate",
-            summary: "Tutti could not verify the candidate state after preview validation.",
-            guidance: "Ensure artifact:preview exits cleanly without changing repository files.",
-            source: "candidate_diff",
-            detail: error instanceof Error ? error.message : "Candidate state capture failed",
-            sensitive: { repoRoot: repoRealPath },
-        });
-    }
-    if (afterFingerprint !== beforeFingerprint) {
-        return failure({
-            reasonCode: "artifact_preview_modified_candidate",
-            summary: "The server Artifact preview modified the candidate repository.",
-            guidance: "Make artifact:preview read-only, or generate required tracked files before validation.",
-            source: "candidate_diff",
-            detail: "Candidate Git state changed while artifact:preview was running",
-            sensitive: { repoRoot: repoRealPath },
-        });
-    }
     return (result ??
         failure({
             reasonCode: "artifact_preview_start_failed",

package/dist/run-pipeline/openai.js

@@ -1,5 +1,4 @@
 import { createNodeNpmCheckPlan, executeCheckPlan } from "../checks/index.js";
-import { candidateChangedAfterChecks } from "./candidate-diff.js";
 import { runArtifactCandidateGate, } from "./artifact-applicability.js";
 import { checkSkipFields, checkStatus, checksSummary, completedWithoutRepoChanges, docsStatusForChangedPaths, failedBeforeChecks, failedFinishedResult, promotionNotAttempted, promotionNotPromoted, successfulRunSummary, } from "./result-projections.js";
 import { runWorkspaceWriteTask } from "./task-run-invocation.js";
@@ -94,7 +93,7 @@ function stageProgressSummary(stage) {
         case "checks":
             return "running project checks.";
         case "post_checks_diff_collect":
-            return "rechecking candidate changes after checks.";
+            return "collecting the final project changes after checks.";
         case "accepted_checkpoint":
             return "saving the validated project state as an accepted checkpoint.";
         case "self_correction":
@@ -358,21 +357,18 @@ async function runTaskAttempt(options, input) {
         const postChecksDiff = loggedSyncStage(options, input, "post_checks_diff_collect", () => collectProjectSourceDiff(options.workspaceRoot), (result) => ({ changed_path_count: result.changed_paths.length }));
         changedPaths = postChecksDiff.changed_paths;
         docs = docsStatusForChangedPaths(changedPaths);
-        if (candidateChangedAfterChecks(diff, postChecksDiff)) {
+        if (!postChecksDiff.has_changes) {
             const result = failedFinishedResult({
-                summary: "Checks modified the candidate workspace; promotion was not attempted.",
-                checks: {
-                    status: "failed",
-                    commands: checks.commands,
-                },
+                summary: "Checks completed but no candidate changes remain for acceptance.",
+                checks,
                 docs,
                 changedPaths,
-                promotion: promotionNotAttempted("checks_modified_candidate", "Checks changed tracked candidate files, so promotion was not attempted."),
+                promotion: promotionNotAttempted("no_candidate_changes", "No candidate changes were available for promotion after checks."),
             });
             return requestSelfCorrection({
                 result,
-                reasonCode: "checks_modified_candidate",
-                guidance: "Prevent checks from mutating tracked files, or intentionally produce those generated files before checks run.",
+                reasonCode: "no_candidate_changes",
+                guidance: "Produce a concrete final candidate diff for the frozen task contract.",
             });
         }
         const checkpoint = loggedSyncStage(options, input, "accepted_checkpoint", () => createAcceptedCheckpoint({
@@ -380,7 +376,6 @@ async function runTaskAttempt(options, input) {
             taskId: input.task.id,
             activityRef: input.activity_ref,
             summary: `Complete Tutti task: ${input.task.title}`,
-            expectedSourceFingerprint: postChecksDiff.fingerprint,
         }), (result) => ({
             promoted_commit_oid: result.promoted_commit_oid,
             checkpoint_disposition: result.disposition,

package/dist/workspace-ops/index.d.ts

@@ -1,7 +1,7 @@
 export { DEFAULT_VIEWER_MAX_BYTES, MAX_REFERENCE_UPLOAD_BYTES, MAX_VIEWER_MAX_BYTES, PROJECT_DOC_PATHS, REFERENCE_IMAGE_ASSET_CACHE_VERSION, REFERENCE_IMAGE_PREVIEW_MAX_EDGE_PX, REFERENCE_IMAGE_THUMBNAIL_MAX_EDGE_PX, REFERENCE_DIRECTORY_PATH, REFERENCE_FILES_DIRECTORY_PATH, REFERENCE_IMAGES_DIRECTORY_PATH, REFERENCE_INDEX_PATH, REFERENCE_TUTTI_DIRECTORY_PATH, VIEWER_ASSET_READ_LIMIT_BYTES, VIEWER_HARD_READ_LIMIT_BYTES, WORKSPACE_OPS_MAINLINE_BRANCH, } from "./constants.js";
 export { WorkspaceOpsError } from "./errors.js";
 export { commitOwnedPaths, requireOwnedPathsWriteReady } from "./system-commits.js";
-export { collectProjectSourceDiff, createAcceptedCheckpoint, fingerprintProjectSourceState, inspectProjectWorkspace, recoverAcceptedCheckpoint, } from "./project-workspace.js";
+export { collectProjectSourceDiff, createAcceptedCheckpoint, inspectProjectWorkspace, recoverAcceptedCheckpoint, } from "./project-workspace.js";
 export { initializeProjectDocs, readProjectDocsInitializationStatus, syncProjectDocs, } from "./project-docs.js";
 export { uploadReferenceFile } from "./reference-files.js";
 export { referenceFileCategoryForPath, referenceFileSourceForPath, referenceMediaTypeForPath, referenceTuttiGroupForPath, } from "./reference-metadata.js";

package/dist/workspace-ops/index.js

@@ -1,7 +1,7 @@
 export { DEFAULT_VIEWER_MAX_BYTES, MAX_REFERENCE_UPLOAD_BYTES, MAX_VIEWER_MAX_BYTES, PROJECT_DOC_PATHS, REFERENCE_IMAGE_ASSET_CACHE_VERSION, REFERENCE_IMAGE_PREVIEW_MAX_EDGE_PX, REFERENCE_IMAGE_THUMBNAIL_MAX_EDGE_PX, REFERENCE_DIRECTORY_PATH, REFERENCE_FILES_DIRECTORY_PATH, REFERENCE_IMAGES_DIRECTORY_PATH, REFERENCE_INDEX_PATH, REFERENCE_TUTTI_DIRECTORY_PATH, VIEWER_ASSET_READ_LIMIT_BYTES, VIEWER_HARD_READ_LIMIT_BYTES, WORKSPACE_OPS_MAINLINE_BRANCH, } from "./constants.js";
 export { WorkspaceOpsError } from "./errors.js";
 export { commitOwnedPaths, requireOwnedPathsWriteReady } from "./system-commits.js";
-export { collectProjectSourceDiff, createAcceptedCheckpoint, fingerprintProjectSourceState, inspectProjectWorkspace, recoverAcceptedCheckpoint, } from "./project-workspace.js";
+export { collectProjectSourceDiff, createAcceptedCheckpoint, inspectProjectWorkspace, recoverAcceptedCheckpoint, } from "./project-workspace.js";
 export { initializeProjectDocs, readProjectDocsInitializationStatus, syncProjectDocs, } from "./project-docs.js";
 export { uploadReferenceFile } from "./reference-files.js";
 export { referenceFileCategoryForPath, referenceFileSourceForPath, referenceMediaTypeForPath, referenceTuttiGroupForPath, } from "./reference-metadata.js";

package/dist/workspace-ops/project-workspace.d.ts

@@ -1,6 +1,5 @@
 import type { ActivityRef, TaskId } from "@tutti/shared/ids";
 import type { AcceptedCheckpointRecoveryResult, AcceptedCheckpointResult, CreateAcceptedCheckpointOptions, ProjectWorkspaceInspection, RunDiffSummary } from "./types.js";
-export declare function fingerprintProjectSourceState(workspaceRoot: string): string;
 export declare function collectProjectSourceDiff(workspaceRoot: string): RunDiffSummary;
 export declare function inspectProjectWorkspace(workspaceRoot: string): ProjectWorkspaceInspection;
 export declare function recoverAcceptedCheckpoint(options: {

package/dist/workspace-ops/project-workspace.js

@@ -1,4 +1,3 @@
-import { createHash } from "node:crypto";
 import { classifyRepositoryPathMetadata } from "@tutti/shared/utils";
 import { WorkspaceOpsError } from "./errors.js";
 import { runGit, runGitRaw, runGitText, stagedChangesExist, summarizeGitFailure, tryGitText, } from "./git.js";
@@ -48,20 +47,6 @@ function requireGitCommandSuccess(args, workspaceRoot) {
     }
     return result;
 }
-export function fingerprintProjectSourceState(workspaceRoot) {
-    const status = requireGitCommandSuccess(["status", "--porcelain=v1", "-z"], workspaceRoot);
-    const diff = requireGitCommandSuccess(["diff", "--binary", "HEAD", "--"], workspaceRoot);
-    const untracked = requireGitCommandSuccess(["ls-files", "--others", "--exclude-standard", "-z"], workspaceRoot);
-    const hash = createHash("sha256").update(status.stdout).update(diff.stdout);
-    for (const path of untracked.stdout.toString("utf8").split("\0")) {
-        if (path.length === 0) {
-            continue;
-        }
-        const object = requireGitCommandSuccess(["hash-object", "--no-filters", "--", path], workspaceRoot);
-        hash.update(path).update("\0").update(object.stdout);
-    }
-    return hash.digest("hex");
-}
 export function collectProjectSourceDiff(workspaceRoot) {
     const status = requireGitCommandSuccess(["status", "--porcelain=v1", "-z"], workspaceRoot);
     const changedPaths = parsePorcelainChangedPaths(status.stdout);
@@ -82,7 +67,6 @@ export function collectProjectSourceDiff(workspaceRoot) {
         has_changes: status.stdout.length > 0,
         changed_paths: changedPaths,
         summary: truncateText(summaryParts.join("\n\n"), MAX_RUN_DIFF_SUMMARY_BYTES),
-        fingerprint: fingerprintProjectSourceState(workspaceRoot),
     };
 }
 function acceptedTagName(workspaceRoot, activityRef) {
@@ -225,10 +209,6 @@ export function createAcceptedCheckpoint(options) {
         };
     }
     const inspection = inspectProjectWorkspace(options.workspaceRoot);
-    if (options.expectedSourceFingerprint !== undefined &&
-        fingerprintProjectSourceState(options.workspaceRoot) !== options.expectedSourceFingerprint) {
-        throw new WorkspaceOpsError("conflict", "Project source changed after validation and before accepted checkpoint", { reason_code: "accepted_checkpoint_candidate_changed" });
-    }
     runGit(["add", "-A"], options.workspaceRoot);
     if (!stagedChangesExist(options.workspaceRoot)) {
         throw new WorkspaceOpsError("validation_failed", "Accepted checkpoint has no staged source changes", { reason_code: "accepted_checkpoint_candidate_missing" });

package/dist/workspace-ops/types.d.ts

@@ -170,7 +170,6 @@ export type RunDiffSummary = {
     has_changes: boolean;
     changed_paths: string[];
     summary: string;
-    fingerprint: string;
 };
 export type ProjectWorkspaceInspection = {
     workspace_root: string;
@@ -181,7 +180,6 @@ export type CreateAcceptedCheckpointOptions = WorkspaceViewerOptions & {
     taskId: TaskId;
     activityRef: ActivityRef;
     summary: string;
-    expectedSourceFingerprint?: string;
 };
 export type AcceptedCheckpointResult = {
     promoted_commit_oid: string;

package/migrations/README.md

@@ -21,7 +21,7 @@
 - `0006_scratchpad_source_state.sql`：新增自动 Scratchpad refresh 的本机 source cursor / dirty / in-flight / backoff 状态表。
 - `0007_workspace_signal_read_state_scopes.sql`：扩展 read-state scope，允许 References 与 Skills 写入模块更新通知事件。
 - `0008_provider_usage_anchors.sql`：为 provider usage ledger 增加可空 activity / workflow / task / run result anchor 字段，供 Timeline 尽力把 token usage 挂到可证明的历史节点。
-- `0009_project_timeline_events.sql`：新增 Timeline 专用 append-only durable event 表，用于记录缺少其他稳定 record 的 context sync、reference summary 与 promotion reconcile 轻量可观测性节点。
+- `0009_project_timeline_events.sql`：新增 Timeline 专用 append-only durable event 表，用于记录缺少其他稳定 record 的 context sync、reference summary 与历史 promotion reconcile 轻量可观测性节点；新 Run 不再写 reconcile event。
 - `0010_project_brief.sql`：新增 host-local Project Brief projection 表，用于保存四个 baseline Project Docs 的短摘要和 source fingerprint。
 - `0011_message_author_avatar.sql`：为消息作者增加可选 Relay account avatar 快照，保证跨浏览器查看历史消息时不依赖当前 viewer profile 或 presence sample。
 - `0012_scratchpad_receipts.sql`：为当前 Scratchpad 增加 `submitted` 状态字段，并新增已提交 Scratchpad 小票历史表。
@@ -31,7 +31,7 @@
 
 - `0001_init.sql`、`0002_allow_sealed_round_successor_note.sql`、`0003_drop_scratchpad_source_message_refs.sql`、`0004_read_state.sql`、`0005_provider_usage.sql`、`0006_scratchpad_source_state.sql`、`0007_workspace_signal_read_state_scopes.sql`、`0008_provider_usage_anchors.sql`、`0009_project_timeline_events.sql`、`0010_project_brief.sql`、`0011_message_author_avatar.sql`、`0012_scratchpad_receipts.sql` 与 `0013_scratchpad_receipt_sources.sql` 已存在，代表当前 host project SQLite schema contract。
 - SQLite adapter、migration runner、checksum 校验、store metadata 初始化、transaction helper 与 command recovery scan helper 已实现。
-- 协作 repository 与 Control Plane 已实现第一批业务读写；Phase 7 首批已复用 `0001_init.sql` 中的 `tasks.latest_run_result_id`、`task_details.result_json` 与 `run_results` 表完成 Run result / checks / promotion 摘要持久化。Control Plane recovery resolver 与 task-bound continuation / retry 复用现有 schema；deterministic promotion reconcile 的业务 truth 仍写入最终 Run result / task detail result，Timeline 默认从 `tasks`、`run_results` 与历史主群聊 `refs.worklist_feedback` 投影任务级审计节点，当前 task terminal Chat feedback 写入 `refs.task_result` 消息；`project_timeline_events` 只保留缺少稳定 record 的轻量可观测性事件。merge workspace 不进入 SQLite truth。`provider_usage_events` 只保存 token 计数、调用来源、模型名、记录时间和可空 anchor，不保存 provider secret、prompt 或 raw response。store 基础设施本身已经可以创建并迁移 `tutti.sqlite`。
+- 协作 repository 与 Control Plane 已实现第一批业务读写；Phase 7 首批已复用 `0001_init.sql` 中的 `tasks.latest_run_result_id`、`task_details.result_json` 与 `run_results` 表完成 Run result / checks / promotion 摘要持久化。Control Plane recovery resolver 与 task-bound continuation / retry 复用现有 schema；新 Run 的 accepted checkpoint 业务 truth 继续写入最终 Run result / task detail result，Git tag / commit trailer 承担 crash recovery evidence。Timeline 默认从 `tasks`、`run_results` 与历史主群聊 `refs.worklist_feedback` 投影任务级审计节点，当前 task terminal Chat feedback 写入 `refs.task_result` 消息；`project_timeline_events` 只保留缺少稳定 record 的轻量可观测性事件和历史 reconcile 兼容记录。project workspace、working diff 与 ignored runtime state 都不进入 SQLite truth。`provider_usage_events` 只保存 token 计数、调用来源、模型名、记录时间和可空 anchor，不保存 provider secret、prompt 或 raw response。store 基础设施本身已经可以创建并迁移 `tutti.sqlite`。
 
 ## PRAGMA 边界
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfey/tutti",
-  "version": "0.1.51",
+  "version": "0.1.53",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/prompts/prompt-flow-experiment-plan.md

@@ -76,7 +76,7 @@ repositories are background material only; they can be trimmed or adjusted to ma
 - Purpose:
   - Fast checks.
   - Easy task-bound clarification fixture.
-  - Deterministic promotion reconcile fixture.
+  - Accepted checkpoint / tag recovery fixture.
 - Adjustments:
   - Use a tiny TypeScript or JavaScript CLI.
   - Include one ambiguous data-format task that should require clarification.
@@ -88,13 +88,13 @@ repositories are background material only; they can be trimmed or adjusted to ma
 
 Purpose:
 
-- Verify project context bootstrap, task compile, Run, checks, result commit, and promotion.
+- Verify project context bootstrap, task compile, Run, Artifact gate, checks, and accepted checkpoint.
 
 Expected:
 
 - Missing baseline context files are created before Worklist proposal.
 - First task reaches `done`.
-- Run result includes changed paths and promoted commit.
+- Run result includes changed paths and promoted accepted commit; the immutable activity tag points to that commit.
 
 ### E2: Run Updates Related Docs
 
@@ -110,7 +110,7 @@ Expected:
 
 - Candidate changed paths include source changes and relevant Markdown / README changes.
 - Run result records `docs = updated`.
-- Promotion is mechanical after checks.
+- Accepted checkpoint is created after Artifact validation and checks.
 
 ### E3: Code-Only Run Defers Docs
 
@@ -150,26 +150,27 @@ Purpose:
 Expected:
 
 - Failed checks produce a finished result with failed outcome.
-- No result commit is promoted.
+- No accepted commit or activity tag is created.
 - Task remains explainable through Worklist and run result history.
 
-### E6: Promotion Reconcile
+### E6: Persistent Workspace Dependency Continuity
 
 Purpose:
 
-- Verify deterministic reconcile after mainline moves.
+- Verify candidate validation, accepted checkpoint, and formal Artifact preview use one persistent project directory without copying runtime state.
 
 Setup:
 
-- Start a Run.
-- Move mainline with a non-conflicting commit before promotion.
+- Use an existing npm repo with `node_modules/` ignored and dependencies initially absent.
+- Let the Run install the project-local dependency required by `npm run artifact:preview` and produce a valid Artifact candidate.
 
 Expected:
 
-- Initial promotion detects mainline movement.
-- Reconcile applies candidate changes to latest mainline.
-- Checks rerun on the reconciled workspace.
-- Mechanical promotion succeeds when checks pass.
+- Provider, candidate preview, checks, accepted checkpoint, and formal preview resolve the same project workspace root.
+- Candidate validation and checks pass, then accepted commit + immutable activity tag are created.
+- `node_modules/` is not committed but remains available in the project directory.
+- Formal preview and a later preview restart succeed without reinstalling or restoring a prepared snapshot.
+- No `tutti/run/*`, `tutti/merge/*`, extra worktree, or promotion reconcile event is created.
 
 ### E7: Task-Bound Clarification
 

package/prompts/prompt-flow-map.md

@@ -10,7 +10,7 @@
 
 - OpenAI SDK structured output：用于轻量结构化整理和判断。调用统一经过 Responses API strict JSON schema，schema 由 TypeScript 代码绑定，prompt 只能影响内容倾向，不能新增输出字段。
 - Codex app-server read-only：用于 `@tutti` 协作聊天问答、缺失 Project Docs baseline 的初始化计划、Scratchpad 任务化、文档同步计划和 Reference summary。可以附加 built-in skills 与 invocation-scoped agent context API token。
-- Codex app-server workspace-write：用于正式 task Run、`Run.needs_human` 后的 continuation，以及 Run pipeline 内部 bounded self-correction retry。运行在隔离 run workspace，可附加 built-in skills 和 user skills。provider transient retry 不新增 prompt 或 selection，只在 retryable app-server failure 后复用失败 attempt 的同一 prompt family。
+- Codex app-server workspace-write：用于正式 task Run、`Run.needs_human` 后的 continuation，以及 Run pipeline 内部 bounded self-correction retry。所有 attempt 都在 `tutti/mainline` checkout 所在的持久 project workspace 中运行，可附加 built-in skills 和 user skills。provider transient retry 不新增 prompt 或 selection，只在 retryable app-server failure 后复用失败 attempt 的同一 prompt family 与同一目录现场。
 
 Provider validation 也使用 OpenAI Responses API，但它只是启动前 credential/model 可用性检查，不属于协作 prompt 改造主线。
 
@@ -27,7 +27,7 @@ Provider validation 也使用 OpenAI Responses API，但它只是启动前 crede
 - `workspace_write_run`：已对齐为 workspace-write + 精简 task contract 输入 + Project Docs / Worklist skills + user skills；存在 user skills 时通过 `skills/list.perCwdExtraUserRoots` 预热当前项目 `<TUTTI_HOME>/projects/<project_id>/skills`；Reference Files 不再通过 built-in skill 暴露，若任务或项目文档指向 `docs/reference/` 中资料，Codex 可直接读取相关 repo 文件。
 - `follow_up_run`：已对齐为 workspace-write + 精简 task contract 输入 + continuation block + Project Docs / Worklist skills + user skills；存在 user skills 时同样预热当前项目 `<TUTTI_HOME>/projects/<project_id>/skills` extra root；Reference Files 不再通过 built-in skill 暴露，若任务、项目文档或 clarification answer 指向 `docs/reference/` 中资料，Codex 可直接读取相关 repo 文件。
 - `artifact_applicability`：候选缺少 manifest 且 deterministic evidence 无法明确判定时，使用 `artifacts/applicability.md` 做 transient read-only structured-output 判断；判断不写入 Task contract，失败时 fail closed。
-- `pipeline_self_correction`：已对齐为 workspace-write + 精简 task contract 输入 + 必填 correction diagnostic；使用 `runs/task-retry.md` 和 `workspace_write_run` selection，在同一 active Run 记录终态前处理 Artifact gate、no candidate diff、checks 失败、checks 修改候选或 deterministic promotion reconcile 失败等可自纠 feedback。
+- `pipeline_self_correction`：已对齐为 workspace-write + 精简 task contract 输入 + 必填 correction diagnostic；使用 `runs/task-retry.md` 和 `workspace_write_run` selection，在同一 active Run 记录终态前处理 Artifact gate、checks 前后无 candidate diff、checks 失败或 accepted-checkpoint failure 等可自纠 feedback，并在同一持久 project workspace 中保留前一 attempt 的 source 与 repo-local runtime state。
 - `follow_up_check`：保持 OpenAI SDK structured output；已收敛为只判断上游 `Run.needs_human` 的 task-bound answer，不接入 skill，不重查代码或协作上下文；provider-facing input 只保留精简 task contract、previous Run pause reason、原 clarification request 和 answers，provider raw output 使用 `{ result: ... }` 互斥分支，failed-task retry 从 active path 移除。
 - `reference_summary_refresh`：已对齐为 Codex app-server read-only + 单文件临时 `cwd`；workflow / activity refs、原始 path、blob、media type 和 file metadata 只留在 Control Plane 内部，不进入 prompt；provider raw output 使用 `{ result: ... }` 互斥分支，只输出 `summarized.summary` 或 `unavailable.reason`。
 
@@ -51,6 +51,7 @@ Provider validation 也使用 OpenAI Responses API，但它只是启动前 crede
 - 2026-06-29：`reference_summary_refresh` provider-facing input 清零；runner 复制目标 reference 文件到独立临时目录，并以该目录作为 app-server `cwd` 和唯一 readable path。prompt 不再接收 workflow/activity trace anchors、原始路径、file metadata、blob 或 media type；provider raw output 改为 `{ result: ... }` 互斥分支，只输出 `summarized.summary` 或自然语言 `unavailable.reason`。
 - 2026-07-02：新增 `project_brief_refresh`；在四个 canonical Project Docs 创建、同步、被成功 Run promotion 修改，或 provider 配置完成后需要 backfill 时尽力刷新 host-local Project Brief projection。provider-facing input 只包含四份 Project Docs 的 bounded source / status，输出 `product_summary / tech_summary / structure_summary / principles_summary`。
 - 2026-07-29：新增 `artifacts/applicability.md` transient judge；Run / reconcile candidate 在 checks 前执行 Artifact gate。`task-retry` correction block 增加必填 redacted / bounded diagnostic，`promotion_failure` 改为完整对象或显式 `null`。
+- 2026-08-01：Run pipeline 完成持久 project workspace cutover；本条取代上述历史记录中的 attempt workspace cleanup、fresh run workspace、result commit / fast-forward promotion 与 reconcile candidate 语义。initial、continuation、provider transient retry 和 self-correction 现在复用同一项目目录；candidate Artifact、checks 与正式 preview 共享目录身份，通过 gate 后创建 accepted commit + immutable activity tag。
 
 后续逐项讨论时，默认从尚未在本节标为已完成的环节继续推进，避免重复分析已经收口的 prompt。
 
@@ -346,33 +347,33 @@ Provider raw 输出：根对象只包含 `result`；`result` 内二选一输出
 
 ### 初次 Task Run
 
-定义：围绕单个正式 task，在隔离 run workspace 中实现候选改动。
+定义：围绕单个正式 task，在持久 project workspace 中实现候选改动。
 
-功能：读取任务契约和必要 repo facts，修改 run workspace，返回结构化 task-run result。
+功能：读取任务契约和必要 repo facts，在现有项目现场上继续修改并返回结构化 task-run result。该目录可能保留此前 failed Run 的未接受 source 与 ignored dependency/runtime state。
 
 当前输入：
 
 - `run_input_json.title`：短任务标题，用于快速定位任务意图。
 - `run_input_json.goal`：正式任务目标。
 - `run_input_json.scope`：正式任务边界，同时承接关键约束、非目标、假设和可观察验收信号。
-- 不传入 `context_entry_json`、task id、task summary、workflow / activity refs、Run lineage、dispatch context 或 run workspace 绝对路径。
+- 不传入 `context_entry_json`、task id、task summary、workflow / activity refs、Run lineage、dispatch context 或 project workspace 绝对路径。
 - 通过 `workspace_write_run` selection 可读取 Project Docs 与 Worklist，并可加载所有 enabled user skills；存在 user skills 时，app-server `skills/list` 会先收到当前项目 `<TUTTI_HOME>/projects/<project_id>/skills` extra user root。
 - Reference Files 不通过 built-in skill 暴露；若任务契约或 Project Docs 指向 `docs/reference/` 中资料，Codex 可直接读取相关 repo 文件正文。
 - 不直接读取主群聊或 Scratchpad；这些不作为 hidden scope。
 
 输出：根对象只包含 `result`；`result` 内四选一输出 `completed.{summary,user_note_candidate}`、`completed_no_repo_changes.{summary,user_note_candidate}`、`needs_human.{title,summary,request}` 或 `failed.summary`。`user_note_candidate` 是可选最终反馈候选，字段必填但可为 `null`；生成给用户直接查看的文件应写入 `docs/reference/tutti/`。`completed_no_repo_changes` 只用于任务契约不要求 repository file changes 的情况。`needs_human` payload 必须能直接作为 task-bound clarification request 使用：解释为什么 frozen contract 下无法安全继续，并提出一个具体、可回答、非 secret 的问题。
 
-下游：Run pipeline 收集真实 Git diff 作为 `changed_paths`；`needs_human` 时 Control Plane 记录 `Run.needs_human`、打开 task-bound clarification 并把 task 迁回 `pending`；有 repo candidate 的 `completed` 结果从 Git changed paths 派生 docs 状态，再执行 checks、result commit 和 mechanical promotion；空 diff 的 `completed_no_repo_changes` 结果跳过 checks / commit / promotion，记录 `promotion.status = not_attempted`。
+下游：Run pipeline 收集真实 Git diff 作为 `changed_paths`；`needs_human` 时 Control Plane 记录 `Run.needs_human`、打开 task-bound clarification 并把 task 迁回 `pending`；有 repo candidate 的 `completed` 结果先执行 Artifact candidate gate 与 checks，再在当前 `tutti/mainline` 创建 accepted commit + immutable activity tag；空 diff 的 `completed_no_repo_changes` 结果跳过 Artifact gate、checks 与 accepted checkpoint，记录 `promotion.status = not_attempted`。
 
-provider transient retry：如果本环节的 Codex app-server workspace-write turn 在产生可用结构化输出前因 retryable provider failure 失败，Run pipeline 可清理 attempt workspace 并使用 `runs/task-run.md`、同一 `workspace_write_run` selection 和同一 frozen task contract 重跑一次。该 retry 不使用 `task-retry.md`。
+provider transient retry：如果本环节的 Codex app-server workspace-write turn 在产生可用结构化输出前因 retryable provider failure 失败，Run pipeline 使用 `runs/task-run.md`、同一 `workspace_write_run` selection、同一 frozen task contract 和同一 project workspace 重跑一次。它不清理前一 attempt 现场，也不使用 `task-retry.md`。
 
 当前改造结论：
 
 - frozen task contract 是唯一正式执行范围；Worklist 上下文只用于理解顺序、相邻任务、prior result 和避免冲突。
 - Project Docs / Worklist / repo 内相关 reference 文件 / user skills 可辅助实现和文档判断，但不能覆盖 Tutti 的任务契约、command policy、workspace path policy、checks、promotion 或 redaction 规则。
-- task-run 不再自报 `docs` 或 `changed_paths`；Run result 的路径证据始终来自 Run pipeline 在 candidate workspace 中收集的 Git diff。
+- task-run 不再自报 `docs` 或 `changed_paths`；Run result 的路径证据始终来自 Run pipeline 在 project workspace 中收集的 Git diff。
 - `blocked` 不再属于 initial task-run 输出；无法产出可用 candidate、repo/tooling 错误或普通无 coherent diff 时返回 `failed`。
-- 如果本次改动影响稳定项目事实、使用方式、公开行为、接口、setup、项目组织、维护上下文或项目工作规则，应在同一 run workspace 更新相关项目文档。
+- 如果本次改动影响稳定项目事实、使用方式、公开行为、接口、setup、项目组织、维护上下文或项目工作规则，应在同一 project workspace 更新相关项目文档。
 - 文档更新应写稳定结论和当前事实；不得把 Run 过程记录、任务完成日志、临时推理、调试轨迹或过长实现叙事写进 project specs / README-style 文档。
 
 ### Clarification 后继续
@@ -387,16 +388,16 @@ provider transient retry：如果本环节的 Codex app-server workspace-write t
 - `run_input_json.continuation.previous_run`：上一 Run 的 needs-human summary 与原 clarification request payload，说明为什么暂停。
 - `run_input_json.continuation.clarification.resolved_rounds[]`：截至当前 round 的已提交 task-bound clarification rounds；每轮包含 request payload 和人类回答消息原文。
 - `run_input_json.continuation.follow_up_check`：`resume` 判断的简短 summary，用于说明为什么本次可继续，但不能替代人类回答原文。
-- 不传入 `context_entry_json`、task id、task summary、workflow / activity refs、Run lineage、dispatch context 或 run workspace 绝对路径。
+- 不传入 `context_entry_json`、task id、task summary、workflow / activity refs、Run lineage、dispatch context 或 project workspace 绝对路径。
 - 通过 `follow_up_run` selection 可读取 Project Docs 与 Worklist，并可加载所有 enabled user skills；存在 user skills 时，app-server `skills/list` 会先收到当前项目 `<TUTTI_HOME>/projects/<project_id>/skills` extra user root。
 - Reference Files 不通过 built-in skill 暴露；若任务契约、Project Docs 或 clarification answer 指向 `docs/reference/` 中资料，Codex 可直接读取相关 repo 文件正文。
 - 不直接读取主群聊或 Scratchpad；这些不作为 hidden scope。
 
 输出：同初次 Task Run 的 `{ result: ... }` 互斥分支 schema。continuation 不再自报 `docs` 或 `changed_paths`。
 
-下游：同初次 Task Run。Run pipeline 收集真实 Git diff；有 repo candidate 的 `completed` 后从 Git changed paths 派生 docs 状态并执行 checks；空 diff 的 `completed_no_repo_changes` 跳过 checks / commit / promotion；`needs_human` 时 Control Plane 继续打开 task-bound clarification。
+下游：同初次 Task Run。Run pipeline 收集真实 Git diff；有 repo candidate 的 `completed` 重新经过 Artifact gate、checks 与 accepted checkpoint；空 diff 的 `completed_no_repo_changes` 跳过这些 gate；`needs_human` 时 Control Plane 继续打开 task-bound clarification。
 
-provider transient retry：continuation 的 retryable app-server failure 只重跑同一个 `runs/task-continuation.md` 和 `follow_up_run` selection，不转换为 pipeline self-correction retry，也不改变 frozen task contract。
+provider transient retry：continuation 的 retryable app-server failure 只在同一 project workspace 重跑同一个 `runs/task-continuation.md` 和 `follow_up_run` selection，不清理现场、不转换为 pipeline self-correction retry，也不改变 frozen task contract。
 
 当前改造结论：
 
@@ -412,24 +413,24 @@ provider transient retry：continuation 的 retryable app-server failure 只重
 
 当前状态：active pipeline-internal path。它不等于 task-bound follow-up retry；`Run.failed` / `Task.failed` 当前仍不通过 follow-up retry 复活。如果最终失败后仍需要继续，应由用户在主群聊补充上下文或调整方向，随后重新走 Scratchpad -> Worklist 创建新任务。
 
-触发条件：首批只覆盖无候选 diff、checks 失败、checks 修改 tracked candidate files，以及 deterministic promotion reconcile 返回未 promotion 的可自纠失败。
+触发条件：当前覆盖checks前后无候选diff、可自纠Artifact candidate failure、checks失败，以及accepted-checkpoint failure。
 
 当前输入：
 
 - `run_input_json.title` / `goal` / `scope`：同一 frozen task contract。
 - `run_input_json.correction.summary`：上一 attempt 的 bounded failure summary。
-- `run_input_json.correction.reason_code`：Run pipeline 生成的 feedback 短码，来源包括 Artifact gate、no candidate diff、checks 失败、checks 修改候选或 promotion reconcile 失败。
+- `run_input_json.correction.reason_code`：Run pipeline 生成的 feedback 短码，来源包括 Artifact gate、checks 前后无 candidate diff、checks 失败或 accepted-checkpoint failure。
 - `run_input_json.correction.guidance`：Run pipeline 根据 feedback reason 生成的本次 retry 直接修正目标。
-- `run_input_json.correction.diagnostic`：必填的 redacted / bounded 原始失败文本，包含 `source / text / truncated`，用于让模型看到 parser、package、preview process、probe 或 candidate diff 的直接诊断。
-- `run_input_json.correction.promotion_failure`：promotion / promotion-reconcile 失败时为完整的 reason code 与短摘要；未到达 promotion 时显式为 `null`。
-- 不传入 `context_entry_json`、task id、task summary、workflow / activity refs、Run lineage、dispatch context 或 run workspace 绝对路径。
+- `run_input_json.correction.diagnostic`：必填的 redacted / bounded 原始失败文本，包含 `source / text / truncated`，用于让模型看到 parser、package、preview process、probe 或 pipeline state 的直接诊断。
+- `run_input_json.correction.promotion_failure`：当前可自纠 feedback 都发生在 accepted checkpoint 前，因此显式为 `null`；对象分支仅作为 bounded schema 兼容位，不表示当前存在 promotion reconcile 路径。
+- 不传入 `context_entry_json`、task id、task summary、workflow / activity refs、Run lineage、dispatch context 或 project workspace 绝对路径。
 - 通过 `workspace_write_run` selection 可读取 Project Docs 与 Worklist，并可加载所有 enabled user skills；存在 user skills 时，app-server `skills/list` 会先收到当前项目 `<TUTTI_HOME>/projects/<project_id>/skills` extra user root。
 
 输出：同初次 Task Run 的 `{ result: ... }` 互斥分支 schema。retry 不自报 `docs` 或 `changed_paths`。
 
-下游：Run pipeline 清理上一 attempt workspace 后重新创建 fresh run workspace、收集真实 Git diff；有 repo candidate 时执行 checks、创建 result commit 并 promotion，空 diff 的 `completed_no_repo_changes` 可记录为无 repo 改动完成。若 retry 仍产生可自纠 feedback 且已到上限，Run pipeline 记录最终失败；若 retry 返回 `needs_human`，才进入正常 task-bound clarification path。
+下游：Run pipeline 保留上一 attempt 的 source 与 ignored runtime state，在同一 project workspace 继续执行 retry 并重新收集真实 Git diff；有 repo candidate 时重新执行 Artifact gate、checks 和 accepted checkpoint，空 diff 的 `completed_no_repo_changes` 可记录为无 repo 改动完成。若 retry 仍产生可自纠 feedback 且已到上限，Run pipeline 记录最终失败；若 retry 返回 `needs_human`，才进入正常 task-bound clarification path。
 
-provider transient retry：如果 self-correction attempt 自身遇到 retryable app-server failure，Run pipeline 仍重跑同一个 `runs/task-retry.md` 和 correction block，不创建第二个 correction context。
+provider transient retry：如果 self-correction attempt 自身遇到 retryable app-server failure，Run pipeline 仍在同一 project workspace 重跑同一个 `runs/task-retry.md` 和 correction block，不清理现场，也不创建第二个 correction context。
 
 ### Task-bound 回复判断
 
@@ -478,4 +479,4 @@ Provider raw 输出：根对象只包含 `result`；`result` 内三选一输出
 - 是否可以接入 skill；如果可以，selection 是否只暴露该环节需要的 skills。
 - 输出是否必须匹配固定 schema；如果是，prompt 不能要求 schema 之外的字段。
 - 下游由哪个环节承接，以及下游如何解释 `ready`、`needs_human`、`blocked`、`failed`、`allow`、`deny` 等 decision。
-- 是否存在 secret、路径、reference 文件正文、repo 写入、run workspace 或 baseline 文档生成边界。
+- 是否存在 secret、路径、reference 文件正文、repo 写入、project workspace 或 baseline 文档生成边界。

package/prompts/runs/README.md

@@ -4,7 +4,7 @@ These templates are used by task `Run` execution.
 
 - `task-run.md` is rendered for initial task Runs.
 - `task-continuation.md` is rendered for Phase 8 continuation Runs after task-bound clarification.
-- `task-retry.md` is rendered for bounded Run pipeline self-correction retries after feedback such as no candidate diff, Artifact validation failure, failed checks, source mutation, or accepted-checkpoint failure. It is not a failed-task follow-up path and does not resurrect `Task.failed`.
+- `task-retry.md` is rendered for bounded Run pipeline self-correction retries after feedback such as no candidate diff before or after checks, Artifact validation failure, failed checks, or accepted-checkpoint failure. It is not a failed-task follow-up path and does not resurrect `Task.failed`.
   Templates in this directory may describe task contracts, repo evidence, check expectations, artifact declaration rules, and documentation update responsibilities. They must never include provider credentials or host-local secret material.
 
 `task-run.md` allows `needs_human` only for human requirement decisions, non-secret context, or risk confirmation. Unusable candidates, ordinary missing diffs, or repo/tooling errors that prevent implementation should be returned as `failed` so the Run does not open task-bound clarification incorrectly. If the task contract does not require repository file changes, the output can use `completed_no_repo_changes`; otherwise a completed implementation is expected to produce a candidate diff. If the candidate is complete but Codex self-validation commands are unavailable or blocked, the task-run output should still be `completed`; Tutti checks are the authoritative validation gate.
@@ -14,6 +14,7 @@ Run templates describe `docs/reference/` as a user-visible file exchange area. H
 Initial `task-run.md`, active `task-continuation.md`, and active pipeline `task-retry.md` also instruct Codex to write or update the single active `tutti.artifact.json` manifest only when the task creates or updates a member-viewable visual artifact. Each template includes the complete strict static and server JSON shapes: every behavior field is required, `network` is always an explicit boolean, and server `script / ready_path / port` fields are forbidden. A server package instead declares the fixed `artifact:preview` npm script in its own `package.json` and listens on the injected `HOST / PORT`. The manifest remains repo truth and is not reported through the structured output schema.
 Active task-bound follow-up still only starts continuation Runs from `Run.needs_human`. Pipeline self-correction retry happens before a terminal Run result is recorded and does not open clarification.
 All three templates state that cwd is the persistent project workspace, may contain unaccepted source and project-local runtime/dependency state from earlier failed attempts, and must not be reset, checked out, stashed, cleaned, or otherwise discarded. Continuation, provider transient retry, and self-correction reuse that same directory and accumulated state.
+All three templates require a final Git status inspection and make the Agent responsible for maintaining the repository's own `.gitignore` according to project conventions. They do not prescribe runtime path names or force intentional generated source out of Git.
 
 Provider transient retry is separate from self-correction. If a retryable Codex app-server workspace-write failure occurs before usable structured output, Run pipeline may rerun the same prompt family once in the same project workspace: initial Runs stay on `task-run.md`, continuation Runs stay on `task-continuation.md`, and self-correction attempts stay on `task-retry.md`. This retry does not add `RunCorrectionContext` unless the failed attempt was already a self-correction attempt.
 Run templates are responsible for telling Codex to update related project documentation in the same candidate workspace whenever implementation changes stable project facts. Broader cleanup, fact reconciliation, and phase-level documentation maintenance belong to the independent `context_sync` Procedure.

package/prompts/runs/task-continuation.md

@@ -45,6 +45,7 @@ Human clarification answers may clarify or confirm work inside the frozen task c
 - Work only inside the provided project workspace.
 - This workspace is the persistent development state. It may retain unaccepted source changes and project-local dependency or runtime state from the paused or failed work; inspect and continue from that state within the frozen task contract.
 - Do not reset, checkout, stash, clean, or otherwise discard existing workspace state. Do not remove changes merely because they were created before this continuation.
+- Before returning, inspect the final Git status. Maintain the repository's own `.gitignore` for project-local state that should not be versioned, following existing project conventions; keep files Git-visible when they are intentional versioned source. Do not assume fixed runtime path names.
 - Prefer small, reviewable changes that preserve existing style and tests.
 
 If the formal task contract plus submitted clarification is still insufficient, return `needs_human` only for a human requirement decision, non-secret context, or risk confirmation. Return `failed` when no usable candidate can be produced.

package/prompts/runs/task-retry.md

@@ -30,10 +30,10 @@ Fields:
 Use `correction` to understand why the previous attempt could not pass the acceptance gates and what this retry must fix.
 
 - `summary`: short human-readable summary of the previous attempt failure.
-- `reason_code`: machine-generated pipeline feedback code. Current sources include Artifact candidate validation, no candidate diff, failed checks, checks that modified tracked candidate files, and accepted-checkpoint failures. This code is assigned by Tutti Run pipeline, not by the model.
+- `reason_code`: machine-generated pipeline feedback code. Current sources include Artifact candidate validation, no candidate diff before or after checks, failed checks, and accepted-checkpoint failures. This code is assigned by Tutti Run pipeline, not by the model.
 - `guidance`: direct retry instruction generated by Tutti Run pipeline for the feedback reason.
 - `diagnostic`: required bounded diagnostic from the failed gate.
-  - `source`: stable diagnostic source such as `manifest_parser`, `package_json`, `preview_process`, `ready_probe`, `candidate_diff`, or `pipeline`.
+  - `source`: stable diagnostic source such as `manifest_parser`, `package_json`, `preview_process`, `ready_probe`, or `pipeline`.
   - `text`: redacted original parser, process, probe, diff, or pipeline error text. Use it to fix the concrete failure; do not copy it into user-facing output or project docs.
   - `truncated`: whether Tutti had to bound the original diagnostic.
 - `promotion_failure`: accepted-checkpoint failure details, or explicit `null` when checkpoint creation was not reached.
@@ -53,6 +53,7 @@ Correct the existing candidate in place, using `correction.summary`, `correction
 - Do not use main chat or Scratchpad as hidden scope.
 - Work only inside the provided project workspace.
 - Do not reset, checkout, stash, clean, or otherwise discard the previous attempt's source, dependency, or runtime state. Remove or replace existing changes only when that is directly required to correct the candidate within the frozen task contract.
+- Before returning, inspect the final Git status. Maintain the repository's own `.gitignore` for project-local state that should not be versioned, following existing project conventions; keep files Git-visible when they are intentional versioned source. Do not assume fixed runtime path names.
 - Prefer small, reviewable changes that preserve existing style and tests.
 
 Human clarification is not available as an interactive step inside this retry. If the formal task contract itself is insufficient, return `needs_human` with one concrete, non-secret question. Return `failed` when no usable candidate can be produced.

package/prompts/runs/task-run.md

@@ -32,6 +32,7 @@ Fields:
 - Work only inside the provided project workspace.
 - This workspace is the persistent development state. It may already contain unaccepted source changes or project-local dependency and runtime state left by an earlier failed Run; inspect and continue from that state when it is relevant to the frozen task contract.
 - Do not reset, checkout, stash, clean, or otherwise discard existing workspace state. Do not remove changes merely because they predate this Run or are not part of the immediate fix.
+- Before returning, inspect the final Git status. Maintain the repository's own `.gitignore` for project-local state that should not be versioned, following existing project conventions; keep files Git-visible when they are intentional versioned source. Do not assume fixed runtime path names.
 - Prefer small, reviewable changes that preserve existing style and tests.
 
 If the formal task contract is insufficient, return `needs_human` only for a human requirement decision, non-secret context, or risk confirmation. Return `failed` when no usable candidate can be produced.