@zq-silk/yui 1.1.0 → 2.0.0

package/docs/cli-information-contract.md

@@ -0,0 +1,107 @@
+# CLI information contracts
+
+Yui separates a command's effect from discovery and full evidence. Queries
+never consume Messages or start subsequent work. Mutation receipts describe
+saved/requested/accepted/unknown facts; `ok: true` means the CLI invocation
+succeeded, not that a Task, native Turn or remote delivery completed.
+
+This is the current wire contract, not a compatibility mode. Stored Tasks,
+Messages, results, Snapshots and Session histories are unchanged. No persistent
+schema migration or new snapshot/cache store is introduced.
+
+## Daily read path
+
+| Question | Entry | Default information / further reading |
+| --- | --- | --- |
+| Which Task? | `task list` | Existing bounded catalog, filters, attention and cursor |
+| What is current? | `task context <task>` | Current Task/Brief/Role/Project/workspace facts, active work and Runs, open inputs, active decisions, unresolved jobs, recent Message references; no event or terminal-Run dump |
+| What records exist? | `task context list <task> --store <family>` | One authorized family, summaries and exact digest-bearing references |
+| What does it actually say? | `task context inspect <task> --store <family> --ref <id> --digest <digest>` | Exact current record, including original result expansion; long documents are paged |
+| What changed? | `task context delta <task> --after <cursor>` | Immutable events with a fixed upper bound, not a snapshot of current mutable state |
+| Which Global input? | `session context <role>` | Identity, profile, authority, current native Turn/retry and separate bounded pending/recent Message pages |
+| Read Global input | `role message list <role> [--pending]`, `role message show <role> <id>` | Scoped discovery, then exact original; queue acceptance never erases history |
+| What arrived in this wake? | `task wake show <task> <wake>` | Fixed window and Message/Run/Event read pointers, not duplicated bodies |
+| What was assigned? | `task run context <task>/<run>` | Frozen authority and a single `pointers` inventory with summaries; changed identities in `deltaRefs`; current observations remain separate |
+| Which configuration is real? | `task role session inspect <task> <role>` | Task/Role identity, desired binding, frozen Session, current Provider binding, retry and explicit Host observation; no full Task/Role copies or Provider conversation history |
+
+Domain lists for Task Messages, events, WorkItems, Runs, decisions, milestones,
+publications and InputRequests use the same summary/reference paging contract.
+Task Role-status and wake-history lists also page, with explicit detail commands.
+Role discovery reports `recordedHealth` and `hostObservation: "not-requested"`,
+not live Host health. Even a normal recorded status cannot rule out a failed Host
+or unacknowledged terminal; follow the row's `task role status` read to inspect it.
+Context lists additionally expose candidates, reviews, jobs, Project Knowledge,
+workspaces and other authorized record families. `--status`, `--after` and
+`--work-item` narrow Context discovery; every continuation must retain filters.
+Run listing accepts a Task or `task/work` target.
+
+Current Context's `attention.messages` counts all authorized Messages, not only
+undelivered input. `collections` counts and `omitted` explicitly describe
+incomplete discovery. Recent samples are not proof that no older pending or
+relevant input exists. Read the relevant fixed wake and original Messages;
+use family discovery when a broader requirement/history audit is needed.
+
+## Budgets and continuations
+
+- Discovery pages default to 20 items, accept 1–100, and reserve a 32 KiB
+  compact-JSON budget. Items contain summaries, never full Message/report bodies.
+- Current Task Context has at most 64 records, with a 24 KiB record/attention
+  budget inside a 32 KiB response budget. Single inline values are at most
+  2 KiB; large values and Message/Run/WorkItem/Knowledge bodies use references.
+  Each collection contributes at most eight sampled records at entry.
+- Global entry samples up to eight pending and eight recent Messages separately.
+  They have independent continuations, so a long historical list cannot crowd
+  pending input out of the entry view.
+- Detail documents up to 16 KiB remain ordinary JSON. Larger documents return
+  `contentPage`: exact source, SHA-256 digest, JSON-character offset, total bytes
+  and characters, text, completeness and a next cursor. Chunks contain at most
+  4096 UTF-16 code units without splitting surrogate pairs, keeping escaped
+  wire output below 32 KiB. There is no 4 MiB cutoff that makes a legal original
+  permanently unreadable.
+- Task metadata/next-action/remote-delivery, Brief, WorkItem, Message, Run,
+  decision/milestone/event, Role show/status/Session inspection, wake detail,
+  InputRequest, Run context and frozen expansion use bounded detail reads.
+
+Use `--json` and read the top-level `data`. Run context and expansion use
+`data.context`; Run Context delta uses `data.contextDelta`. For a long detail, repeat that same read with
+`--cursor <contentPage.nextCursor>`. Concatenate `text` in offset order, checking
+the same source and digest, and parse the combined JSON once. Do not parse
+chunks individually or treat a first chunk as the complete report.
+
+List responses carry `items`, `total`, `complete`, and `nextCursor`. Counts,
+items and cursor validation occur inside the same authorized scope. Cursors
+are opaque positions, not access tokens: every page reauthorizes. A changed
+collection or document returns an explicit source-changed error; restart rather
+than mix versions. No persisted pagination session is needed. Mutable collection
+continuations intentionally do not promise uninterrupted traversal during
+concurrent writes. For append-only event traversal use fixed-bound Context delta.
+Discovery currently scans the selected authorized family to fingerprint it;
+its output, not total storage-reading cost, is bounded.
+
+## Effects and exceptions
+
+Message send/queue/steer receipts preserve identity, digest, body byte count and
+the original submission/delivery/control states without echoing the body.
+Brief updates return a saved reference. No new wait, retry, acknowledgement or
+approval phase is added. Repeating a read cursor must never repeat a mutation.
+
+Whole-transaction operations (activation, completion, integration and input
+control) remain atomic business operations even when their mechanics have
+several steps. Their state-specific receipts and existing unknown-effect
+diagnostics are retained; they are not flattened into a generic “executed” flag.
+
+This change covers daily Agent context, collaboration discovery and original
+evidence reads, not every diagnostic or export in the product. Existing
+specialized log-tail/artifact limits, Task catalog pagination and bounded error
+diagnostics retain their contracts. Configuration catalogs, Project/config
+administration, resource inventories, archive diagnostics, release operations,
+and specialized integration/changeset reads remain purpose-specific; this
+document does not claim a universal 32 KiB cap for them. Full-detail Web
+projections are separate consumers, not silently replaced with CLI summaries.
+Use targeted Context discovery for large Project Knowledge and Task evidence.
+
+For a typical notification, read current Context once, read the fixed wake once,
+then read each relevant original once (or its complete document pages).
+Do not reread an aggregate to obtain a detail it intentionally omits.
+Full-original reading costs additional calls only when the original exceeds
+the inline budget; it is never replaced by a summary.

package/docs/cli-information-contract.zh-CN.md

@@ -0,0 +1,81 @@
+# CLI 信息契约
+
+Yui 将命令的效果、发现和完整证据读取分开。查询不会消费 Message，也不启动后续工作。
+变更回执说明 saved/requested/accepted/unknown 等真实事实；`ok: true` 只说明这次
+CLI 调用成功，不代表 Task、原生 Turn 或远端投递完成。
+
+这是当前通信契约，不是兼容模式。已保存的 Task、Message、结果、Snapshot 和 Session
+历史保持不变；没有持久 schema 迁移，也没有新增快照或缓存存储。
+
+## 日常读取路径
+
+| 问题 | 入口 | 默认信息与下一步 |
+| --- | --- | --- |
+| 找哪个 Task？ | `task list` | 既有有界目录、过滤器、attention 与游标 |
+| 当前有什么？ | `task context <task>` | 当前 Task/Brief/Role/Project/工作区事实、活跃工作与 Run、开放输入、有效决策、未解决 Job、近期 Message 引用；不倾倒事件或终态 Run |
+| 有哪些记录？ | `task context list <task> --store <family>` | 一种获授权的记录、摘要与带 digest 的确切引用 |
+| 原文是什么？ | `task context inspect <task> --store <family> --ref <id> --digest <digest>` | 确切当前记录，含原始结果展开；长文档分页 |
+| 发生了什么变化？ | `task context delta <task> --after <cursor>` | 固定上界内的不可变事件，不是可变当前状态的快照 |
+| Global 收到了什么？ | `session context <role>` | 身份、Profile、权限、当前原生 Turn/retry，以及分别有界的 pending/recent Message 页 |
+| 读取 Global 输入 | `role message list <role> [--pending]`、`role message show <role> <id>` | 在自身范围内发现，再读完整原文；队列接受不删除历史 |
+| 本次唤醒带来什么？ | `task wake show <task> <wake>` | 固定窗口与 Message/Run/Event 读取指针，不重复正文 |
+| 分配了什么？ | `task run context <task>/<run>` | 冻结授权与一份带摘要的 `pointers` 目录；`deltaRefs` 表示变化身份；当前观察独立 |
+| 实际配置是什么？ | `task role session inspect <task> <role>` | Task/Role 身份、期望绑定、冻结 Session、当前 Provider 绑定、retry 与显式 Host 观察；不复制整个 Task/Role 或 Provider 会话历史 |
+
+Task Message、事件、WorkItem、Run、决策、里程碑、publication 和 InputRequest 列表
+共用摘要/引用分页。Role 状态与 wake 历史列表也分页，并给出详情命令。
+Role 发现返回 `recordedHealth` 与 `hostObservation: "not-requested"`，不是实时 Host
+健康度。记录状态正常也不能排除 Host 失败或终态未确认；需沿条目的 `task role status`
+读取指针检查。
+Context 列表还暴露候选、Review、Job、Project Knowledge、工作区等获授权的记录。
+`--status`、`--after`、`--work-item` 缩小发现范围；续读必须保留过滤条件。
+Run 列表接受 Task 或 `task/work` 目标。
+
+当前 Context 的 `attention.messages` 统计全部获授权 Message，不仅是未投递输入。
+`collections` 计数与 `omitted` 明确表达发现不完整。近期抽样不能证明没有更早的待处理
+或相关输入。读取相关固定 wake 与原始 Message；更广的需求/历史审计使用分类发现。
+
+## 预算与续读
+
+- 发现页默认 20 条，可选 1–100，紧凑 JSON 预算 32 KiB。条目包含摘要，不含完整报告正文。
+- 当前 Task Context 至多 64 条，记录与 attention 共 24 KiB，响应预算 32 KiB。
+  单个内联值至多 2 KiB；大值及 Message/Run/WorkItem/Knowledge 正文用引用。
+  入口每个集合最多抽样八条。
+- Global 入口分别抽样八条 pending 与八条 recent；独立续读，历史不能挤掉待处理输入。
+- 不超过 16 KiB 的详情保持普通 JSON。更大详情返回 `contentPage`：确切来源、
+  SHA-256 digest、JSON 字符偏移、总字节数/字符数、文本、完整性与下一游标。
+  每块最多 4096 个 UTF-16 单元，不拆代理对，转义后的输出低于 32 KiB。
+  不再因 4 MiB 上限而永久无法读取合法原文。
+- Task 元信息/next-action/remote-delivery、Brief、WorkItem、Message、Run、
+  决策/里程碑/事件、Role show/status/Session 检查、wake 详情、InputRequest、
+  Run Context 与冻结展开使用有界详情读取。
+
+使用 `--json` 读取顶层 `data`；Run Context 和展开使用 `data.context`，Run Context delta 使用 `data.contextDelta`。
+长详情用同一读取命令加 `--cursor <contentPage.nextCursor>` 继续。按 offset 顺序拼接
+`text`，校验相同 source 与 digest，最后一次性解析 JSON。不要分别解析块，也不要把
+第一块当成完整报告。
+
+列表包含 `items`、`total`、`complete`、`nextCursor`。计数、条目和游标校验处于同一
+授权范围。游标是不透明位置，不是通行令牌：每页重新授权。集合或文档改变时明确报错，
+重新读取，不混合版本；无需持久分页 Session。可变集合不保证并发写入期间无中断遍历。
+追加事件遍历使用固定上界 Context delta。目前分类发现扫描选定的授权集合来计算指纹；
+有界的是输出，不是总存储读取成本。
+
+## 效果与例外
+
+Message send/queue/steer 回执保留身份、digest、正文字节数及原有提交/投递/control
+状态，不回显正文。Brief 更新返回 saved 引用。没有新增等待、重试、确认或审批阶段。
+重复读游标绝不能重放变更。
+
+激活、完成、集成和输入控制仍是完整事务业务操作，即使内部有多步工程机制。
+其特定状态回执与已有未知效果诊断保留，不压平成通用“已执行”标志。
+
+本次覆盖日常 Agent Context、协作发现和原始证据读取，并非产品全部诊断或导出。
+既有日志尾部/artifact 限制、Task 目录分页、有界错误诊断保留各自契约。
+配置目录、Project/config 管理、资源清单、归档诊断、发布操作和专用集成/change-set
+读取仍有自己的用途契约；不宣称它们全部受 32 KiB 限制。Web 全详情投影是独立消费者，
+不会被 CLI 摘要悄悄替代。大 Project Knowledge 与 Task 证据用定向 Context 发现。
+
+典型通知读取一次当前 Context、一次固定 wake，再逐条读取相关原文（或其全部文档页）。
+不要为了入口故意省略的详情重复读聚合。只有原文超过内联预算才增加原文分页调用；
+摘要不能代替完整原文。

package/docs/managed-turn-and-session-runtime.md

@@ -41,6 +41,7 @@ automatically create Runs. Explicit dispatch loads one exact Run Context Pack.
 
 ```sh
 yui task context <task> --json
+yui task context list <task> --store <store> [--cursor <cursor>]
 yui task context delta <task> --after <coreCursor>
 yui task context inspect <task> --store <store> --ref <id>
 yui task run context <task/run> --json
@@ -52,6 +53,14 @@ Delta pages immutable events through a fixed upper bound; inspect expands a
 current record and can require an exact digest. Runtime observations state their
 own coverage and do not become another durable snapshot.
 
+Entry Context samples current facts; it is not a complete historical inventory.
+List one authorized record family, then inspect the relevant originals. Large
+details use `contentPage` and `--cursor`; concatenate all exact text chunks before
+parsing. Global `session context` likewise separates bounded pending/recent
+discovery from `role message show`. See the
+[CLI information contract](cli-information-contract.md) for budgets, scope,
+continuations and the complete-original reading protocol.
+
 Run Context freezes Assignment, source references, effective configuration and
 workspace boundaries. A Role edit does not rewrite an existing Assignment.
 Reading either Context does not acknowledge input or create execution authority.

package/docs/managed-turn-and-session-runtime.zh-CN.md

@@ -33,6 +33,7 @@ Run Context Pack。
 
 ```sh
 yui task context <task> --json
+yui task context list <task> --store <store> [--cursor <cursor>]
 yui task context delta <task> --after <coreCursor>
 yui task context inspect <task> --store <store> --ref <id>
 yui task run context <task/run> --json
@@ -43,6 +44,11 @@ Task Context 是一个有界的、获授权的工作集，带有当前 core 游
 上界内分页不可变事件；inspect 展开一条当前记录，并可要求确切摘要。运行时观察声明
 自己的覆盖范围，不会成为另一份持久快照。
 
+入口 Context 抽样当前事实，不是完整历史目录。先列出一种获授权的记录，再展开相关原文。
+长详情使用 `contentPage` 与 `--cursor`；必须拼接全部确切文本分块后再解析 JSON。
+Global `session context` 同样把有界 pending/recent 发现与 `role message show` 原文分开。
+预算、范围、续读及完整原文协议见 [CLI 信息契约](cli-information-contract.zh-CN.md)。
+
 Run Context 冻结 Assignment、来源引用、生效配置和工作区边界。一次 Role 编辑不改写
 既有 Assignment。读取任一 Context 都不确认输入或创建执行权限。每一条受管输入都指向
 确切的 Session Manifest 和 CLI 入口。Run Pack 是一个参考目录：动手前先读相关的需求

package/docs/plugin-sdk.md

@@ -87,7 +87,9 @@ changed source does not inherit an old digest's authorization. The boundaries
 around resources, network, global configuration and the core namespace are
 unchanged; when existing authority is sufficient it is not re-approved, and when a
 new permission is missing the specific gap is reported rather than impersonating
-the Operator or self-issuing a grant.
+the Operator or inventing user authorization. An original user authorization
+can support a bounded [Leader grant](../skills/yui-leader/references/authorization.md)
+without another Operator signature.
 
 On validation failure the Agent preserves the original error and judges the fix;
 an unknown or partial effect must not be auto-rerun. After using a new capability
@@ -323,8 +325,10 @@ Because trusted-local does not bound direct host effects, this grant must allow
 statement that every call actually produces an irreversible effect. `none` or
 `reversible` must not be read as unlimited local execution authority.
 
-An Operator explicitly authorized by the user uses the original grant ingress,
-for example to allow a single validation:
+An Operator explicitly authorized by the user uses the original grant ingress.
+A current delivery Leader can use that same ingress with `--source-message`,
+a verbatim `--purpose`, stable `--request-id`, expiry and finite uses, limited
+to the user's actual authorization. For example, the Operator path for a single validation:
 
 ```text
 <checkout>/output/dev/bin/yui task grant issue T --action plugin.execute --param pluginId=demo --param digest=SOURCE_SHA256 --param environmentRef=T/P --param trust=trusted-local --param phase=validate --max-uses 1 --irreversibility-ceiling irreversible

package/docs/plugin-sdk.zh-CN.md

@@ -66,7 +66,8 @@ Leader 先通过稳定 `capability search/describe` 读取当前目录和契约
 Task-local 管理权限不等于执行信任：可执行包仍逐阶段核对下面定义的精确
 `plugin.execute` grant，源码改变后不会继承旧摘要授权。资源、网络、全局
 配置及核心 namespace 的边界不变；已有授权充分时不重复批准，缺少新权限则
-报告具体缺口，不冒充 Operator 或自己签发 grant。
+报告具体缺口，不冒充 Operator 或虚构授权。原始用户授权已覆盖时，可使用
+[有界 Leader Grant](../skills/yui-leader/references/authorization.md)，无需 Operator 再次签字。
 
 验证失败由 Agent 保存原错误并判断修复；不可把 unknown／部分效果自动重跑。
 使用新增能力取得实际业务结果后，通过 `artifact.save` 将独立内容保存为文件产物
@@ -245,7 +246,9 @@ package scope 替代资源授信。因 trusted-local 不约束直接宿主效果
 必须允许 `irreversibilityCeiling: irreversible`：这是能力上限，不表示每次调用
 实际产生不可逆效果。`none/reversible` 不得解释为无限本机执行权。
 
-由获用户明确授权的 Operator 使用原 grant 入口，例如只允许一次验证：
+获明确授权的 Operator 保留原 grant 入口；当前 delivery Leader 也可使用同一入口，
+附上 `--source-message`、逐字授权引文 `--purpose`、稳定 `--request-id`、有效期及有限次数，
+范围必须来自真实用户授权。以下是 Operator 只允许一次验证的示例：
 
 ```text
 <checkout>/output/dev/bin/yui task grant issue T --action plugin.execute --param pluginId=demo --param digest=SOURCE_SHA256 --param environmentRef=T/P --param trust=trusted-local --param phase=validate --max-uses 1 --irreversibility-ceiling irreversible

package/docs/release-workflow.md

@@ -149,9 +149,12 @@ protection remain enforced.
 
 Storage upgrades are limited to the current major's explicit minor steps.
 Cross-major conversion is independently authorized and is not a runtime fallback.
-Session CLI refresh only retargets the current two-argument quoted wrapper
-named by a valid Manifest. It does not convert retired wrapper forms. Runtime
-diagnostics do not interpret `schema.json`, `state.json`, or a whole-map release
+New Sessions use the ordinary `yui` entry from their launch environment; updates
+do not generate or retarget per-Session CLI scripts. Global Context commands
+remain self-contained for remote TUI/Desktop use. Correct PATH and Home selection
+are required: protocol/storage checks do not distinguish every same-contract
+installation. Development uses an explicit isolated checkout entry.
+Runtime diagnostics do not interpret `schema.json`, `state.json`, or a whole-map release
 idempotency file; current SQLite data and per-key release receipts remain the
 authorities, and unrelated files are left untouched.
 
@@ -275,18 +278,25 @@ grouped by Role/AgentRun, and process owners use PID/start identity. Storage
 changes follow the [single explicit upgrade boundary](sqlite-control-plane-design.md);
 ordinary commands never rewrite the Home schema.
 
-Grant issue and revoke are irreversible-authority operations. They require
+Operator grant issue and revoke retain their existing authority. They require
 the current registered global Operator conversation. Its native session ID
 must match the durable live session binding: Codex commands use `CODEX_THREAD_ID`
 when present, otherwise `YUI_NATIVE_SESSION_ID`; Claude uses `YUI_NATIVE_SESSION_ID`.
 Host generation and launch-time Agent labels are not caller identity. Resuming
 the same conversation through another entry point does not revoke its authority.
 An unregistered, replaced, or ended conversation has no such authority.
-A managed Task Agent cannot self-issue or
-self-revoke a grant, and clearing the child-process environment does not
-confer user authority. The recorded granter/revoker is bound to that
-Operator session (`operator:<agent-id>`); there is no `--granter`/`--by`
-label to spoof.
+A current delivery Leader can instead issue finite, expiring grants for its own
+Task from an original user/Operator Message, using `--source-message`,
+`--purpose` (a verbatim authorization quotation), and `--request-id`. It must
+choose only the actions actually authorized by that source. Source validation
+is not natural-language approval; development intent is not publication intent.
+Release scope requires Task Projects and their repositories; package/version
+effects also need explicit package/version bounds. Global update, Controller
+replacement and migration remain Operator-only. The Leader may revoke only
+Leader-issued grants in its Task. Empty environments, Worker/Reviewer or
+planning/replaced Sessions confer no such authority. Granter/revoker attribution
+comes from the current Session; there is no `--granter`/`--by` label to spoof.
+See the [complete source/ordinary archive contract](../skills/yui-leader/references/authorization.md).
 
 ```sh
 # 1. The Operator session issues the authority for the release chain.

package/docs/release-workflow.zh-CN.md

@@ -113,8 +113,10 @@ Controller RPC 版本 1。Host 不打开 Home 数据库，包括进程归属、
 
 存储升级仅包含同主版本内明确的小版本步骤。跨主版本转换独立授权，
 不构成运行时回退。
-Session CLI 刷新只重定位有效 Manifest 指向的当前双参数引号 wrapper，不转换
-退役形态。运行时诊断不解释 `schema.json`、`state.json` 或整表 release 幂等文件；
+新 Session 使用启动环境中的普通 `yui` 入口；升级不生成或重定向会话 CLI 脚本。
+Global Context 命令保持自足，供远端 TUI/Desktop 使用。必须正确选择 PATH 和 Home：
+协议及存储校验不能区分所有同合约安装；开发使用显式隔离的 checkout 入口。
+运行时诊断不解释 `schema.json`、`state.json` 或整表 release 幂等文件；
 当前 SQLite 与逐 key release 回执仍是权威，无关文件保持原样。
 
 `task role status`、`task role list` 和 `task role session inspect` 在持久 Run 状态旁
@@ -209,14 +211,19 @@ Session 权威依据当前持久绑定检查。Telemetry 按 Role/AgentRun 分
 PID/start 身份。存储变更遵循[唯一的显式升级边界](sqlite-control-plane-design.zh-CN.md);
 普通命令绝不改写 Home schema。
 
-grant 的签发与撤销是不可逆权威操作。它们需要当前已登记的全局 Operator 对话。它的
+Operator 的 grant 签发与撤销保留现有权威边界，需要当前已登记的全局 Operator 对话。它的
 原生 session ID 必须与持久的活动 session 绑定匹配：Codex 命令在存在时使用
 `CODEX_THREAD_ID`，否则使用 `YUI_NATIVE_SESSION_ID`;Claude 使用 `YUI_NATIVE_SESSION_ID`。
 Host generation 和启动时的 Agent 标签不是调用者身份。通过另一个入口恢复同一段对话
-不撤销其权威。一个未登记、被替换或已结束的对话没有这种权威。一个受管的 Task Agent
-不能自签发或自撤销 grant，清空子进程环境也不赋予用户权威。被记录的授权者/撤销者
-绑定到那个 Operator session（`operator:<agent-id>`）；不存在可伪造的 `--granter`/`--by`
-标签。
+不撤销其权威。未登记、被替换或已结束的对话没有这种权威。
+本 Task 当前 delivery Leader 也可引用真实用户/Operator 原消息，以
+`--source-message`、`--purpose`（逐字授权引文）、`--request-id` 签发有有效期及有限次数的
+有界 Grant，并撤销本 Task 的 Leader Grant。语义判断仍由 Agent 负责：引文匹配只是来源
+验证，开发指令不是发布许可。发布必须限定 Task Project/repository，包与版本操作另须明确
+package/version 边界；全局升级、共享 Controller 替换、迁移仍不开放。
+Worker/Reviewer、规划/失效 Session 和清空环境不获得授权；身份来自当前持久 Session，
+不存在可伪造的 `--granter`/`--by` 标签。参见
+[完整来源与普通归档契约](../skills/yui-leader/references/authorization.md)。
 
 ```sh
 # 1. Operator session 为发布链签发权威。

package/docs/storage-baseline.md

@@ -2,6 +2,11 @@
 
 # Storage baseline 1.0
 
+Current storage is 1.2. The declared 1.1 → 1.2 transition adds optional
+CapabilityGrant authorization-source evidence and native-human input/archive
+audit records. Existing valid Operator grants remain unchanged; migration does
+not infer or invent past user authority. The SQL layout is unchanged.
+
 Yui 1.0.0 starts from one clean persistent contract. The package version,
 storage schema, record envelopes and Controller protocol are separate
 identities; none is inferred from another.

package/docs/testing/verification-levels.md

@@ -50,12 +50,12 @@ is required.
 ## Permanent core smoke
 
 `npm test` and `npm run test:core` build the checkout and run the maintained suite.
-The stable suite owns current storage 1.1 and its declared 1.0 minor
+The stable suite owns current storage 1.2 and its declared 1.0/1.1 minor
 transition. It contains no undeclared historical format compatibility path.
 
 Current coverage includes:
 
-1. Fresh storage 1.1, exact schema/record validation, no initialization over
+1. Fresh storage 1.2, exact schema/record validation, no initialization over
    unknown data, and rejection of old integer formats without mutation.
 2. Exact-version staging, mismatched-target refusal, same-major contiguous
    minor preflight, explicit maintenance-owner identity across handover, and
@@ -101,6 +101,8 @@ do not add prose-matching tests or claim model validation from static checks.
 `ci.yml` runs core plus one assembled-package normal-path smoke per supported
 platform (Linux x64, Mac Intel and Apple Silicon) on every PR, without another
 lint or broad regression suite.
+Linux runs on Node 24 and 26; release fresh-install smoke covers Node 20, 22,
+24 and 26 on all three platforms.
 `node scripts/smoke-runtime-package.mjs --assembled .release-stage` exercises
 the actual CLI/Controller/Host/SQLite and isolated tmux, replacing only the
 external Provider with a deterministic fixture. It covers setup, durable input
@@ -118,6 +120,14 @@ freshly installed package through
 artifact and provenance boundaries. This validates runtime integration, not
 real-model behavior. Pure contract and safety tests remain in `test/core`;
 production wiring is exercised here rather than only through mocked ports.
+The native dependency check launches a fixed local program through PTY and
+requires its output and normal exit. Installed-package smoke explicitly checks
+default Doctor's PTY results using dependencies resolved from the consumer.
+On macOS it also tests a disposable copy with a non-executable spawn-helper:
+Doctor must report the selected helper path and permissions without repairing it.
+Doctor's isolated PTY probe waits up to 750 ms for output/exit, with a 1.5-second
+outer native-process limit, and reports elapsed time. Existing Agent/Controller
+diagnostics have their own costs; this is not a one-second whole-Doctor guarantee.
 The package smoke also checks unconditional status identity and update-owned
 resource/identity capture through the assembled package. Real lifecycle children
 stop the exact Controller and restore its captured launch identity while their

package/docs/testing/verification-levels.zh-CN.md

@@ -74,6 +74,8 @@ package-start 检查跟随已安装树中的本地 Skill 引用，包括跨 Role
 
 `ci.yml` 在每个 PR 上构建一次，运行 core 及一个组装包正常链路检查，不重复 lint，
 也不增加宽泛回归套件。
+Linux CI 在 Node 24 和 26 上运行；发布时的全新安装 smoke 覆盖三个平台上的
+Node 20、22、24 和 26。
 `node scripts/smoke-runtime-package.mjs --assembled .release-stage` 经过真实
 CLI/Controller/Host/SQLite 与隔离 tmux，仅用确定性夹具替换外部 Provider。它验证
 setup、输入跨重启持久化及幂等、scratch 激活、原生结果入库、完成后保留会话、
@@ -85,6 +87,12 @@ setup、输入跨重启持久化及幂等、scratch 激活、原生结果入库
 npm bin、依赖、受支持 Node 版本、产物和 provenance 边界。这证明运行时集成，不证明
 真实模型行为。纯契约与安全检查保留在 `test/core`，生产组件组装在这里验证，
 不只依赖模拟端口。
+原生依赖检查必须通过 PTY 启动固定本地程序，确认输出和正常退出。安装包 smoke
+明确断言默认 Doctor 的 PTY 检查成功，并从消费者安装目录解析依赖。macOS 还会
+在可丢弃的依赖副本中移除 spawn-helper 执行权限，验证 Doctor 报出实际 helper
+路径和权限原因且不自动修复。Doctor 的隔离 PTY 探针等待输出／退出最多 750 ms，
+外层原生进程限制为 1.5 秒，并报告耗时；原有 Agent／Controller 检查另有成本，
+这不是整个 Doctor 一秒内返回的保证。
 组装包检查还验证固定身份输出，以及升级侧通过组装包采集资源和精确 Controller 身份，
 并在父进程持有交接锁时，通过真实生命周期子进程停止精确 Controller、恢复其已捕获的
 启动身份。无关调用仍被锁阻止，锁保持由父进程持有，持久输入不变；

package/i18n/README.zh-CN.md

@@ -41,7 +41,7 @@ npm 包包含 Linux x64、Mac Intel 和 Apple Silicon 的 Yui 预编译程序。
 同一份包在三个平台验证后发布，运行时只选择对应平台的程序。
 
 需要 Linux x64 / glibc 或 macOS（x64 或 Apple Silicon）、Git、tmux，以及
-Node.js `^20.17.0`、`^22.9.0` 或 `^24.0.0`。macOS 上可用
+Node.js `^20.17.0`、`^22.9.0`、`^24.0.0` 或 `^26.0.0`。macOS 上可用
 `brew install tmux` 安装 tmux。最简单的方式是先安装 Codex CLI 或 Claude
 Code CLI，并确保它已经可以使用你自己的账号正常工作。Yui 负责协调 Agent，
 不提供模型访问额度。
@@ -345,6 +345,8 @@ Yui 面向一个受信任本地用户，不是 OS 沙箱，也不是远程多用
 [总体架构](../ARCHITECTURE.zh-CN.md)介绍端到端设计，
 [文档导航](../docs/architecture/README.zh-CN.md)提供配置、执行、交付、存储和插件的
 当前合同。想直接操作 CLI 时，使用 `yui --help` 查看命令。
+[CLI 信息契约](../docs/cli-information-contract.zh-CN.md)说明当前 Context、分页发现、
+完整原文读取和变更回执。
 
 Yui 默认将控制面数据保存在 `~/.yui`，通过 `YUI_HOME` 选择另一个实例。
 切换构建或更新已有 Home 前，请查看[存储与升级](../docs/sqlite-control-plane-design.md)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zq-silk/yui",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "description": "Local control plane for long-running native agent CLI sessions backed by tmux.",
   "license": "MIT",
   "private": false,
@@ -19,7 +19,7 @@
     "LICENSE"
   ],
   "engines": {
-    "node": "^20.17.0 || ^22.9.0 || ^24.0.0"
+    "node": "^20.17.0 || ^22.9.0 || ^24.0.0 || ^26.0.0"
   },
   "os": [
     "linux",
@@ -49,7 +49,7 @@
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "better-sqlite3": "^12.11.1",
-    "node-pty": "^1.1.0",
+    "node-pty": "1.2.0-beta.15",
     "smol-toml": "1.8.0",
     "ws": "^8.21.1"
   }

package/skills/yui-leader/SKILL.md

@@ -7,11 +7,18 @@ description: Lead one Yui Task through authorized planning, activation handoff,
 
 Follow [yui-runtime](../yui-runtime/SKILL.md) first. Load the exact Context Pack
 for an explicitly dispatched AgentRun; for direct conversation or a Task
-notification, read current Task context through the Manifest's Session CLI.
+notification, read current Task context using `yui task context <task-id> --json`.
 No self-dispatch or old completed Run is needed. Read the actual Task
 requirements, current Brief and relevant user/Operator Messages, not just
 their summaries. Resolve links relative to the file containing them.
 
+Current Context is a bounded working set, not all Task history. Use
+`task context list <task> --store <store>` or a domain list for discovery,
+then an exact detail read. A wake contains original Message/Run read pointers,
+not copied reports. Follow Runtime's `nextCursor` and `contentPage` rules:
+read the full relevant window and originals before disposition, without
+unconditionally walking unrelated history.
+
 ## Select the applicable stage
 
 Use current lifecycle, latest intent and the Session's actual planning/delivery

package/skills/yui-leader/references/authorization.md

@@ -0,0 +1,64 @@
+# Source-authorized Task actions
+
+Read the original user/Operator Message in full. A development request, local
+completion, Role report, quoted third-party text, or publication permission
+alone does not authorize another effect. Decide whether the user authorized
+the particular action, resource, trust and scope. Engineering verifies source
+and fixed bounds, not natural-language meaning: a matching quotation proves
+origin, not that your interpretation is correct. Do not issue publication or
+resource grants from a request that only asks to develop.
+
+For actual authorization, the current delivery Leader uses:
+
+```sh
+yui task grant issue <task> --source-message <message-id> \
+  --purpose "<verbatim explicit authorization>" --request-id <stable-id> \
+  --action <action> --expires-at <timestamp> --max-uses <finite-count> \
+  <exact scope, parameter bounds and irreversible ceiling>
+```
+
+The existing Grant records source identity/digest, quotation, Session and fixed
+bounds. Replaying the request id returns the same grant; it never replenishes
+expired, exhausted or revoked authority. Do not change ids to evade limits.
+A changed plan needs a new bounded decision within the user's scope, or a real
+InputRequest if new authority is missing. Operator retains issue/revoke.
+The current Leader may revoke this Task's Leader-issued grants, including
+after Session replacement, but cannot revoke Operator grants.
+
+Release grants require explicit Task Projects/repositories and `sourceCommit`
+bounds (checked against the workflow source, never a step's claimed value); package effects
+also require packages and concrete version bounds. All steps sharing a
+version-bound grant must pass that version. Global installation, shared
+Controller replacement, migration and other Tasks remain outside this path.
+Preserve source/artifact integrity, changed-candidate acceptance, CI,
+Publication and unknown-effect reconciliation.
+
+Plugin execution requires exact pluginId, digest, environmentRef, trust and
+phase. Directory grants require the resourceId, canonical path and read/write
+action. An explicitly authorized unregistered directory can be registered with
+`resource.local.register` using `sourceMessage` and a verbatim `purpose`;
+registration grants no access or Project configuration authority. Then use the
+existing prepare/adopt/bind/release operations. A Home, stable Project or
+managed workspace cannot be registered through this Leader path.
+
+Human input through the Host's human-owned console is persisted before the
+Provider write. Read that original Message. Provider-visible userMessage items
+alone cannot prove human authorship: managed prompts use them too. Never
+transcribe unproven input into a Role report and call it user authority. Use
+the authenticated user input surface when transport provenance is unavailable.
+
+For an explicitly authorized ordinary archive, first save acceptance/delivery
+evidence and complete the Task:
+
+```sh
+yui task archive <task> --integrated --source-message <message-id> \
+  --purpose "<verbatim archive authorization>" --request-id <stable-id>
+```
+
+This single Controller operation checks settlement, delivery and clean
+workspaces, records the source, stops the requesting Leader and applies normal
+cleanup/archive checks. The conversation can end before the CLI response.
+Inspect `task.leader-archive-started`, `task.leader-archive-result`,
+`task.archived` and cleanup receipts. A started operation without a result is
+uncertain; inspect its effects before recovery, never replay with a new id.
+No automatic retry, force or abandonment authority is implied.

package/skills/yui-leader/references/execution.md

@@ -22,6 +22,17 @@ implementation patterns, scheduling options, review routing, or recoverable
 runtime actions. Create an InputRequest only for a real product choice, new
 authority, irreversible external effect, or unavailable external fact.
 
+Task Messages and the Brief are durable records, not delivery receipts to the
+Operator. For a genuinely missing user choice, resource, credential or scope,
+use `task input request`; the Controller notifies the Operator through the
+existing durable notification path with references to the original records.
+Completion and existing blocked-work notifications use that same path. Do not
+invent an InputRequest just to announce progress or ask again for authority
+already granted. A failed global input call does not mean Task notifications
+are broken: a Task Leader must not call global `role message queue`, `steer`
+or `role interrupt`, impersonate Operator, or clear identity environment
+variables to bypass that boundary.
+
 ## Separate the work unit, executor, and concurrency
 
 Honor the user's explicit choice of direct work or delegation. Otherwise make
@@ -286,8 +297,9 @@ Use `capability search`, `describe`, and `call` to inspect current tools.
 Prefer existing tools, composition or a one-off script when sufficient.
 For reusable Task-local capabilities, read [Task plugins](task-plugins.md)
 before creation, validation or activation. Plugin management permission does
-not grant code execution or broader external effects. Never issue your own
-grants, impersonate Operator, or modify the core installation to obtain a tool.
+not grant code execution or broader external effects. Use
+[source-authorized capabilities](authorization.md) for existing explicit user
+authority. Never invent authorization, impersonate Operator, or modify the core installation to obtain a tool.
 
 ## Validate and make the review judgment
 
@@ -369,7 +381,9 @@ after its final report. Cleanup can remain advisory at completion. Ordinary
 archive requires settled resources; explicitly authorized force archive preserves
 unresolved resources and diagnostics under the shared
 [archive contract](../../yui-runtime/references/publication.md). The Leader
-does not gain independent archive authorization.
+does not gain independent archive authorization. An original explicit user
+archive request can authorize the Controller-owned ordinary archive described
+in [source-authorized capabilities](authorization.md).
 
 Complete only when the Task outcome is satisfied, required checks and review
 contracts are settled, WorkItems are accepted or deliberately retired, latest
@@ -381,7 +395,7 @@ yui task complete <task-id> \
 ```
 
 Completion records the exact Project heads. Archive is a separate,
-user-authorized Operator action.
+user-authorized action, never an implication of completion or publication.
 
 Completion is offline by default. `--refresh-remote` only refreshes remote
 freshness observations; neither path rebases or starts Integration checks.