@zq-silk/yui 0.15.7 → 0.15.8

package/docs/task-local-identity.md

@@ -5,7 +5,7 @@ Task owns an independent, monotonically increasing sequence for every record
 family:
 
 - WorkItem
-- Turn
+- AgentRun
 - ReviewRound
 - ChangeSet
 - IntegrationAttempt
@@ -18,11 +18,11 @@ family:
 The first record of each family in each Task is therefore local `-1`. Deleted,
 cancelled, completed, reopened, and archived records never lower the persisted
 high-water mark, so a local ID is never reused inside its Task. Each allocation
-advances that aggregate high-water mark under the storage process lock.
+advances that aggregate high-water mark inside the Store transaction.
 
 Candidate identity is narrower: `candidate-N` is a WorkItem-local sequence.
 Every Candidate stores its `taskId` and `workItemId`, in addition to the source
-Turn when one exists.
+AgentRun when one exists.
 
 ## Reference contract
 
@@ -37,13 +37,13 @@ JSON, mailbox, Controller, Hook, receipt, Web, and error paths retain the Task
 scope. Context-free commands reject a bare local ID instead of searching all
 Tasks, even if that ID currently happens to be unique.
 
-A managed Task session may use `work-item-1` or `turn-1` because its
+A managed Task session may use `work-item-1` or `run-1` because its
 `YUI_TASK_ID` is explicit. A command that already receives the Task as another
 argument may also use a subordinate local ID. Outside those two cases, use the
 qualified form. Delivery receipts use the same provenance, for example:
 
 ```text
-turn:task-7/turn-1
+run:task-7/run-1
 input-request:task-7/input-1
 ```
 
@@ -58,5 +58,5 @@ boundary and the migration phase of `yui update`; every valid Home at or above
 the CLI's minimum supported storage version can advance directly to current.
 
 This boundary keeps Task-local references, Role desired configuration, and
-immutable Turn/RoleSession effective snapshots under one unambiguous runtime
+immutable AgentRun/RoleSession effective snapshots under one unambiguous runtime
 contract while the append-only migration chain preserves supported history.

package/docs/testing/verification-levels.md

@@ -0,0 +1,86 @@
+# Verification policy
+
+Yui is a single-user local product. Permanent verification protects essential
+happy paths and a few critical, easily changed correctness boundaries. It is
+not a historical catalog of every defect or edge case.
+
+## Local development
+
+Use the smallest evidence needed for the current change. Retain a focused
+regression when all of the following apply:
+
+- Failure would lose durable intent, cross an authority/isolation boundary, or
+  prevent an Agent/Operator from making legitimate progress.
+- The boundary is shared by frequently changed code or has already failed in
+  a realistic execution.
+- The check is deterministic, uses disposable local fixtures, runs in
+  milliseconds, and asserts observable behavior rather than incidental layout.
+- Equivalent coverage is not already present; prefer one coherent scenario
+  over separate cases for each historical symptom.
+
+Keep broad fault matrices, real-model exercises, malformed-data combinations
+and incident-specific scripts temporary. Remove their harnesses after the
+change, preserving useful reports. Real-resource results do not replace fast
+regressions, and fast regressions do not establish real-model behavior.
+
+## Permanent core smoke
+
+`npm test` and `npm run test:core` build the checkout and run one permanent suite:
+
+1. the packaged CLI starts and exposes setup/update/upgrade/Task commands;
+2. one normal SQLite Task and Message survive a reopen;
+3. a supported historical Home migrates through the linear storage chain to current;
+4. the built-in Codex and Claude Drivers are registered;
+5. one independent declarative plugin is created, validated, called and disabled
+   through authenticated ingress, with its selection and validation preserved.
+6. a Task starts from durable Operator input, exposes planning Context and enters
+   delivery with its original intent and captured planning authority preserved.
+7. Session replacement preserves pending original Messages and independent work;
+   old Sessions keep scoped reads but cannot regain write authority;
+8. InputRequests survive Session replacement without a synthetic AgentRun;
+9. late native terminals cannot settle successor input or invent acceptance;
+10. remote Operator startup carries its reserved workspace, Role instructions
+    and scoped CLI identity, while offline diagnostics/recovery remain reachable.
+11. durably queued native results survive Controller outages and replay without
+    poisoning the Host; known terminal inputs do not become active merely by aging;
+12. Task-final review can use its Task-local Reviewer without a global template.
+13. a native error label permits replacement only with latest-Turn terminal
+    evidence and drained background execution; a wrong native account cannot
+    authorize cleanup.
+14. Claude receives its native environment and settings paths without injected
+    authentication helpers, rewritten approval records, or secrets forwarded
+    to unrelated adapters; native authentication selection stays with Claude. Environment refresh
+    removes revoked keys and keeps values out of durable Task/Role records.
+
+Keep the test phase seconds-scale; measure TypeScript build separately. Record
+incremental runtime when adding a critical regression. The seven recovery boundary
+cases initially add about 0.4 seconds of test bodies (about 0.6 seconds standalone,
+including module startup) on the development host. Avoid sleep-based checks or
+mandatory model/daemon launches in the permanent suite.
+
+## Skill and instruction changes
+
+Review the shared Runtime contract and affected Role/Project Skills together.
+Check instruction boundaries with a few relevant scenarios: analysis remains
+read-only, existing mechanisms are reused, Session loss preserves Task intent,
+and execution failure does not prevent authorized supervision. This is a
+bounded review, not a new permanent matrix or permission to use real models.
+
+The package-start check follows local Skill references in the installed tree,
+including cross-Role links. Entry points and their referenced Markdown must
+ship together. File/format checks establish availability, not Agent behavior;
+do not add prose-matching tests or claim model validation from static checks.
+
+## CI and release
+
+`ci.yml` runs the core smoke plus one package-assembly/start check. It does not
+run a second lint pass or a separate broad regression suite. `publish.yml` reuses that
+exact gated commit and adds only tag, artifact, install, and provenance checks
+that are unique to publishing.
+
+Configured Agents acting as developers or reviewers are ordinary execution
+resources. Using a live provider or model as the subject of validation is
+different: paid APIs, shared Homes, production systems, real account quota, and
+other non-disposable external effects are never implied by a request to test or
+validate. They require an explicit user request for the exact resource and
+effect boundary.