@zq-silk/yui 0.11.3 → 0.12.0

package/i18n/README.zh-CN.md

@@ -308,7 +308,7 @@ yui task work group resolve <task-id>/<work-item-id> \
 
 每个新阶段还会冻结一份 Resource Broker 契约：token、工具调用和墙钟预算，
 quorum 与 deadline，straggler 窗口，以及继续增加 Lane 所需的最低边际价值。
-省略这些参数时复用现有 context budget 与 runtime-health 时间窗；同一阶段的 retry
+省略这些参数时使用独立的执行成本默认值与 runtime-health 时间窗；同一阶段的 retry
 累计原有花费并共享绝对 deadline。执行、Lane retry 和 Reviewer panel 准入统一核算
 Home、Task、WorkItem、Group、Provider、Agent 和模型层级的活动 Lane；容量不足的
 Lane 会耐久保留为 pending，不会把整个 Group 判失败。容量释放或 deadline 到达会沿
@@ -484,7 +484,7 @@ yui task input request <task-id> --question "默认使用哪种格式？" \
 
 推荐项会明确展示给用户；如果截止时间前没有回答，独立的最近 deadline timer 会唤醒 Controller，原子采用这个确定选项，并排队恢复固定的 Leader session。自由文本和必须由用户回答的请求永远不会自动解决。
 
-`task input list` 是权威的全局开放输入 Inbox；可附加 Task ID 限定范围，或使用 `--all` 查看已回答和已取消的请求。Controller 还会尝试向已有且结构化状态为 ready 的 Operator process 投递一次带回执的提示；它不会为了通知而启动或打断 Operator。process 不可用或 pane fence 已变化时，请求仍保留在 Inbox，并在后续 Controller 定向处理中重新尝试。该路径不会读取或分类 Agent 终端文本。用户和 Operator 都可回答。存在开放请求时，无关的 pending wake 不会绕过等待，Task 也不能 complete 或 archive。原 Leader 也可执行 `yui task input cancel <task-id> <input-id> --reason "..."`，取消会排队恢复该固定 Leader session。
+`task input list` 是权威的全局开放输入 Inbox；可附加 Task ID 限定范围，或使用 `--all` 查看已回答和已取消的请求。Task 完成、退役、Leader attention、stall 和开放输入只以不可变 TaskEvent 或 InputRequest 引用进入全局 Operator mailbox。Controller 把一个待处理 batch 合并成一条带回执的 `[Yui updates]` user message，仅投递给已有且 ready 的 Operator；Operator 再通过 CLI 读取引用记录，判断哪些信息值得呈现。Operator 正在运行或不可用时，Yui 不启动也不打断它，整批引用保持持久化，并在原生 turn 完成或后续 Controller 处理中重试。该路径是 user message，不是 tool call，也不会读取或分类 Agent 终端文本。用户和 Operator 都可回答。存在开放请求时，无关的 pending wake 不会绕过等待，Task 也不能 complete 或 archive。原 Leader 也可执行 `yui task input cancel <task-id> <input-id> --reason "..."`，取消会排队恢复该固定 Leader session。
 
 ```sh
 yui task context <task-id>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "0.11.3",
+  "version": "0.12.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,

package/skills/yui-leader/SKILL.md

@@ -323,12 +323,14 @@ Choose before creating the WorkItem:
 Keep review execution separate from implementation. No global Reviewer is
 required: when review is disabled, inspect and decide directly or delegate a
 bounded review to a native subagent or ordinary Worker. When a managed
-ReviewRound is explicitly configured, its reviewer uses the single built-in
-write-capable `reviewer` Profile, but Yui grants that capability only inside a
-fresh ReviewRound-owned worktree created from its exact frozen scope:
+ReviewRound is explicitly requested, its reviewer uses the single built-in
+write-capable `reviewer` Profile. Each Task Reviewer Role keeps one stable,
+isolated Session and physical workspace slot; every ReviewRound updates that
+slot to its exact frozen scope and records a new immutable ownership snapshot:
 the assigned WorkItem Candidate or the committed Integration heads of a
 Task-final Review. Never reuse the Candidate/Worker workspace or its
-implementation Role Session. Codex and Claude may use their normal configured
+implementation Role Session. Multiple Reviewer Roles use independent slots
+and may run in parallel. Codex and Claude may use their normal configured
 full capability in that isolated worktree; the behavioral boundary forbids
 push, Integration, Task mutation, other workspaces, stable checkouts, and the
 real Yui control-plane home. When
@@ -526,8 +528,8 @@ authorized expansions.
   bounded evidence-gathering review to a native subagent or ordinary Worker,
   then make the Leader-owned accept/reject decision. Do not create a Reviewer
   Role merely to satisfy an old setup convention.
-- `always`: wait for the automatically requested ReviewRound to become
-  terminal. Never bypass an active round.
+- `always`: keep the Candidate decision pending until its required ReviewRound
+  is terminal. The Review does not globally pause unrelated Leader work.
 - `leader`: decide whether the existing evidence is sufficient. Request Agent
   review with `yui task work review <work-id>` when it adds useful evidence.
 - `final`: keep WorkItem acceptance and integration independent. After all
@@ -535,10 +537,39 @@ authorized expansions.
   Task-final ReviewRound over the frozen Task candidate. A Task contract may
   require it. The final Reviewer evaluates the complete result across bound
   Projects; it is not a second per-WorkItem approval protocol.
-- A changed Task head creates a new semantic Task-final Round. Reuse the same
-  compatible Reviewer Role Session and stable workspace when Yui offers it;
-  do not create a new Role or native Session for every Round. Round identity
-  still binds each Run to the exact frozen head.
+- Before choosing a Task-final Review action, read `task context` or
+  `task next-action` and inspect every active AgentRun's purpose and exact
+  WorkItem/ReviewRound binding, the current durable heads, active Reviews,
+  each Reviewer's availability, the latest accepted baseline, candidate
+  relation, and Delta facts. These are decision support, not an autopilot;
+  a Review Run is evidence in progress, not a global Task lock.
+- A changed Task head may justify a new semantic Task-final Round. Reuse the
+  same Reviewer Role Session and stable workspace; Round id, full versus Delta
+  mode, desired revision, and frozen commit do not require a replacement
+  Session. Round identity still binds each Run to the exact frozen head.
+- An active Task-final Review freezes candidate A only. Continue handling new
+  user input and, when appropriate, advance candidate B. Always consume A's
+  result, then route it as exact evidence for A, a baseline for descendant B,
+  or historical evidence for a diverged candidate. Do not cancel or discard A
+  merely because Task main moved.
+- Read active Review facts directly from its ReviewRound: frozen Project
+  commits define that Review's evidence boundary; current candidate relation,
+  active Run, and workspace references describe current execution. Do not infer
+  a Task lock or wait for a synthetic freeze lifecycle before advancing Task
+  main.
+- If Yui reports a Reviewer `busy`, wait for the suggested interval, select a
+  different Reviewer, review directly, or continue other work. Busy is a
+  scheduling fact, not a failed Review and not a reason to reset the Session.
+- Prefer Delta Recheck for a technically available, contiguous change over an
+  accepted baseline when the semantic risk is bounded. Use the exact changed
+  files, line counts, diff, previous evidence, Task intent, and Project Policy
+  to choose full Review, Delta, direct Review, another Reviewer, or no Review;
+  Yui does not choose the mode from generic thresholds.
+- Delta `requires-full-review` returns control to the Leader. Decide whether a
+  full Review, another Reviewer, direct inspection, or more development is
+  useful; Yui must not auto-create the next Round. `repeated-full-review` is a
+  cost advisory for an unchanged candidate/Reviewer intent, never an exhausted
+  budget or a prohibition on new evidence.
 - A completed review is advice. Decide whether to accept, reject, review again,
   or ask the user.
 - Route a reachable final-Review finding to the original Worker while that
@@ -563,11 +594,16 @@ authorized expansions.
   full Round over the identical frozen heads. It fails closed for every
   semantic or ambiguous prior result; target the new failed Round explicitly
   if another non-semantic failure occurs.
+- For `review.failed-to-start`, open the referenced ReviewRound and inspect its
+  exact reason, frozen candidate, and workspace when present. Decide whether to
+  retry, explicitly clean a conflicting workspace, select another Reviewer, or
+  continue other work. Preserve the failed Round as request history and do not
+  turn these choices into an automatic retry or cleanup loop.
 - Use `task next-action`'s derived Review outcome literally: non-semantic means
   recover the same frozen head with `force-fresh`; ambiguous means diagnose the
   inconsistent evidence without creating a Repair WorkItem; only semantic
-  negative evidence may create a repair wave. Non-semantic and ambiguous
-  attempts do not consume the full semantic Review budget.
+  negative evidence may create a repair wave. There is no semantic Review
+  budget; exact candidate/Reviewer/intent retries reuse existing evidence.
 - If the same non-resource user choice or unavailable external fact repeats,
   persist context and create an InputRequest instead of looping. Never use an
   InputRequest to solicit authorization for an unrequested real-resource test;
@@ -612,10 +648,11 @@ accept an isolated result while any writable Project's latest ChangeSet is
 unintegrated.
 
 Workspace ownership is not Role ownership. The WorkItem owns its Develop
-workspace even when a Task Role executes there; each ReviewRound owns a fresh
-workspace from the Candidate's frozen commit, and each IntegrationAttempt owns
-its candidate worktree. Dispatch attaches snapshots only. Review workspace
-cleanup is explicit, and review edits can never feed WorkItem ChangeSet capture.
+workspace even when a Task Role executes there; a Task Reviewer Role keeps one
+stable physical workspace while each ReviewRound owns the exact frozen
+workspace evidence for its Run, and each IntegrationAttempt owns its candidate
+worktree. Dispatch attaches snapshots only. Review workspace cleanup is
+explicit, and review edits can never feed WorkItem ChangeSet capture.
 
 Yui validates a candidate and advances the target with compare-and-swap. A
 failed candidate does not advance the target. Inspect and resolve semantic

package/skills/yui-operator/SKILL.md

@@ -46,6 +46,15 @@ mind and avoid imposing a fixed heading, field, section, or character
 template; one semantic event should have one concise summary unless a later
 role adds a genuinely new decision or impact.
 
+A `[Yui updates]` user message is only a wake envelope containing durable
+InputRequest or TaskEvent references. Read those exact records through `yui`
+before responding, merge related references into one user-level update, and
+then end the turn normally. Never create or keep a Codex Goal, automatic
+self-continuation, polling loop, or private follow-up task merely to monitor
+Yui work. Future durable updates will wake the Operator with another user
+message after the current Operator turn is ready; unchanged state needs no
+response.
+
 ## Configure Yui through conversation
 
 Treat configuration as an Operator-owned conversation, not a list of commands

package/skills/yui-reviewer/SKILL.md

@@ -18,13 +18,18 @@ reinterpret its scope:
   anchor.
 
 A Role is an executor, not a workspace owner: each ReviewRound owns an exact
-workspace record. Consecutive Task-final Rounds for the same Reviewer may
-reassign one clean physical workspace and continue the same compatible native
-Session. Treat the new Run Context Pack and frozen head as the authority even
-when the conversation continues; never reuse an earlier verdict. Review edits
-are confined to that workspace, never modify the
+workspace record. Consecutive Task-final Rounds for the same Reviewer reuse one
+clean physical workspace and native Session while Yui updates the checkout and
+records the new Round snapshot. Treat the new Run Context Pack and frozen head
+as the authority even when the conversation continues; never reuse an earlier
+verdict. Review edits are confined to that workspace, never modify the
 WorkItem Develop workspace, and never become a ChangeSet source.
 
+For a dispatched Review, the Run Context Pack identifies the ReviewRound,
+frozen Project commits, and assigned workspace. Inspect those exact commits.
+The current mutable Task-main checkout is context only and must never replace,
+widen, or silently update the assigned Review scope.
+
 ## Separate infrastructure failure from review judgment
 
 Verify the exact Run identity, Context Pack, frozen head, and ReviewRound-owned
@@ -44,10 +49,26 @@ binding fails before review begins:
 
 Yui derives `semantic`, `non-semantic`, or `ambiguous` from the immutable
 Round, Run receipt, completion Event, and finding evidence. Never write or
-simulate a classification field. A non-semantic attempt consumes no semantic
-Review budget and cannot satisfy acceptance; an ambiguous attempt requires
+simulate a classification field. A non-semantic attempt cannot satisfy
+acceptance; an ambiguous attempt requires
 Leader diagnosis before another review or repair decision.
 
+The Review scope remains the current Run's frozen candidate even if the Leader
+handles new user input or advances Task main while this Review is running. Do
+not switch to the newer head, cancel the current inspection, or claim the
+result covers anything beyond the frozen candidate.
+
+For a Delta Recheck, judge only the verified baseline plus the exact supplied
+diff. Return exactly one explicit disposition with reasoning:
+
+- `equivalent-and-accepted` when the new candidate preserves the accepted
+  semantics and evidence;
+- `finding` for a reachable material defect;
+- `requires-full-review` when equivalence cannot be established.
+
+Never create or request a follow-up Round yourself: `requires-full-review`, a
+finding, and every uncertainty return to the Leader for routing.
+
 Keep the context layers distinct. Yui Core owns ReviewRound identity,
 lifecycle, access, workspace, and exact-yield safety; this generic Skill owns
 portable review behavior; Agent-native Project Skills and Project Policy and

package/dist/context/sessionContextBudget.js

@@ -1,71 +0,0 @@
-import { resolveContextBudget } from "../config/yuiConfig.js";
-import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
-export function evaluateSessionContextBudget(events, session, configured) {
-    const budget = resolveContextBudget(configured);
-    const peak = observedPeakInputTokens(events, session);
-    const state = peak >= budget.hardTokens
-        ? "hard"
-        : peak >= budget.softTokens
-            ? "soft"
-            : "within";
-    return Object.freeze({ state, peakTokens: peak, budget });
-}
-/**
- * Largest per-request input peak observed for one Session generation. Usage
- * observations carry cumulative session totals; consecutive deltas bound the
- * per-request input of the window between them. The first observation for a
- * generation is treated as one full request so a long-lived resumed Session
- * that was only sampled late still counts its inherited context.
- */
-export function observedPeakInputTokens(events, session) {
-    let previous = 0;
-    let peak = 0;
-    for (const event of events) {
-        const observation = runtimeObservationFromTaskEvent(event);
-        if (observation === null)
-            continue;
-        if (!matchesSession(observation.fence, session))
-            continue;
-        const usage = usageTotal(observation.payload.usage);
-        if (usage === null)
-            continue;
-        const delta = Math.max(0, usage - previous);
-        if (delta > peak)
-            peak = delta;
-        previous = usage;
-    }
-    return peak;
-}
-function matchesSession(fence, session) {
-    if (fence.taskId !== undefined && fence.taskId !== session.taskId)
-        return false;
-    if (fence.roleName !== session.roleName)
-        return false;
-    if (session.nativeSessionId !== undefined
-        && fence.nativeSessionId !== undefined
-        && fence.nativeSessionId !== session.nativeSessionId) {
-        return false;
-    }
-    if (session.launchId !== undefined
-        && fence.launchId !== undefined
-        && fence.launchId !== session.launchId) {
-        return false;
-    }
-    return true;
-}
-function usageTotal(usage) {
-    if (typeof usage !== "object" || usage === null || Array.isArray(usage))
-        return null;
-    const record = usage;
-    const inputTokens = integer(record.inputTokens);
-    if (inputTokens === null)
-        return null;
-    // RuntimeUsageSnapshot.inputTokens is the normalized processed input total.
-    // cachedInputTokens is an informational breakdown of that total, matching
-    // runtimeProjection and the Driver documentation; adding it again would
-    // fabricate context pressure and trigger premature Session rollover.
-    return inputTokens;
-}
-function integer(value) {
-    return Number.isSafeInteger(value) && value >= 0 ? value : null;
-}

package/dist/lifecycle/contextBudgetRollover.js

@@ -1,81 +0,0 @@
-import { enqueueWork } from "../coordination/workMailboxQueue.js";
-import { validateRoleSessionSet } from "../executor/agentExecutor.js";
-import { createTaskEvent } from "../event/taskEvent.js";
-import { RUNTIME_CLEANUP_REQUIRED_REASON, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
-/**
- * Issue 04 (context token budget): retires one native Session generation that
- * crossed the hard context budget so the next Leader wake starts a fresh
- * generation. This is a controlled rollover, not a failure: the durable Task
- * records are the checkpoint, the bounded context snapshot re-establishes
- * working context for the new generation, and the retired Session is kept in
- * history as `stopped` with an auditable event. The Controller separately
- * owns verified process cleanup through the runtime cleanup lane.
- */
-export const CONTEXT_BUDGET_ROLLOVER_REASON = "context-budget-hard-limit";
-export function rolloverTaskRoleSessionForContextBudget(store, taskId, roleName, evidence, now) {
-    const task = store.getTask(taskId);
-    if (task === null)
-        throw new Error(`Task not found: ${taskId}.`);
-    if (task.status !== "active") {
-        throw new Error(`Task is not active: ${task.id}/${task.status}.`);
-    }
-    const role = store.getRole(task.id, roleName);
-    if (role === null)
-        throw new Error(`Role not found: ${task.id}/${roleName}.`);
-    const set = store.getTaskRoleSessionSet(task.id, role.name);
-    const current = set?.sessions[set.activeAgentId];
-    if (set === null || set === undefined || current === undefined) {
-        // No live generation to retire; the caller can launch fresh directly.
-        return null;
-    }
-    const timestamp = now.toISOString();
-    const reason = `${CONTEXT_BUDGET_ROLLOVER_REASON} (peak ${evidence.peakTokens} >= hard ${evidence.hardTokens} tokens)`;
-    enqueueWork(store, runtimeLifecycleTarget({ scope: "task", taskId: task.id, roleName: role.name }), RUNTIME_CLEANUP_REQUIRED_REASON, now, [{ type: "task", id: task.id }]);
-    const retired = retireStoppedTaskRoleSession(set, timestamp);
-    store.saveTaskRoleSessionSet(retired);
-    const eventId = store.nextEventId(task.id);
-    store.saveEvent(task.id, createTaskEvent(eventId, task.id, "runtime.role-session-reset", {
-        roleName: role.name,
-        reason,
-        peakTokens: String(evidence.peakTokens),
-        hardTokens: String(evidence.hardTokens),
-        ...(current.nativeSessionId === undefined
-            ? {}
-            : { nativeSessionId: current.nativeSessionId }),
-        ...(current.launchId === undefined ? {} : { launchId: current.launchId })
-    }, now));
-    return Object.freeze({
-        taskId: task.id,
-        roleName: role.name,
-        eventId,
-        ...(current.nativeSessionId === undefined
-            ? {}
-            : { retiredNativeSessionId: current.nativeSessionId }),
-        ...(current.launchId === undefined ? {} : { retiredLaunchId: current.launchId })
-    });
-}
-/**
- * Retires the current generation to history as `stopped` (not `broken`:
- * a budget rollover is not a Session failure) and clears the Turn fence so
- * the next launch is a fresh generation.
- */
-function retireStoppedTaskRoleSession(set, timestamp) {
-    validateRoleSessionSet(set);
-    const current = set.sessions[set.activeAgentId];
-    const sessions = { ...set.sessions };
-    delete sessions[set.activeAgentId];
-    const history = current === undefined
-        ? set.history
-        : [
-            ...(set.history ?? []),
-            { ...current, status: "stopped", updatedAt: timestamp }
-        ];
-    return validateRoleSessionSet({
-        ...set,
-        sessions,
-        ...(history === undefined ? {} : { history }),
-        inFlight: null,
-        providerBinding: null,
-        updatedAt: timestamp
-    });
-}

package/dist/scheduler/operatorNotification.js

@@ -1,59 +0,0 @@
-export const CURRENT_OPERATOR_NOTIFICATION_SCHEMA_VERSION = 1;
-export function createLeaderRecoveryNotification(taskId, message, now, existing) {
-    const timestamp = now.toISOString();
-    return {
-        schemaVersion: CURRENT_OPERATOR_NOTIFICATION_SCHEMA_VERSION,
-        taskId: requiredText(taskId, "Task id"),
-        type: "leader-recovery-failed",
-        message: requiredText(message, "Operator notification message"),
-        createdAt: existing?.type === "leader-recovery-failed"
-            ? existing.createdAt
-            : timestamp,
-        updatedAt: timestamp
-    };
-}
-export function createTaskTerminalNotification(taskId, status, by, summary, now) {
-    const timestamp = now.toISOString();
-    return {
-        schemaVersion: CURRENT_OPERATOR_NOTIFICATION_SCHEMA_VERSION,
-        taskId: requiredText(taskId, "Task id"),
-        type: "task-terminal",
-        status,
-        by,
-        summary: requiredText(summary, "Task terminal summary"),
-        createdAt: timestamp,
-        updatedAt: timestamp
-    };
-}
-export function createLeaderStallNotification(taskId, runId, progressAt, evidenceKey, now, existing) {
-    const timestamp = now.toISOString();
-    const previous = existing?.type === "leader-stalled"
-        && existing.runId === runId
-        && existing.progressAt === progressAt
-        ? existing
-        : undefined;
-    return {
-        schemaVersion: CURRENT_OPERATOR_NOTIFICATION_SCHEMA_VERSION,
-        taskId: requiredText(taskId, "Task id"),
-        type: "leader-stalled",
-        message: requiredText([
-            `Leader Run ${runId} is truly stalled for Task ${taskId}.`,
-            `lastProgressAt=${progressAt}`,
-            `classification=truly-stalled`,
-            `evidence=${evidenceKey}`,
-            "Inspect the Task context and decide whether to continue, reset, retry, change Agent, or request user input; Controller performed no automatic action."
-        ].join(" "), "Operator notification message"),
-        runId: requiredText(runId, "Leader Run id"),
-        progressAt: requiredText(progressAt, "Leader progress timestamp"),
-        classification: "truly-stalled",
-        evidenceKey: requiredText(evidenceKey, "Leader stall evidence"),
-        createdAt: previous?.createdAt ?? timestamp,
-        updatedAt: timestamp
-    };
-}
-function requiredText(value, label) {
-    const normalized = value.trim();
-    if (normalized.length === 0)
-        throw new Error(`${label} is required.`);
-    return normalized;
-}